Implement sync.Once concurrent access solution

Signed-off-by: Nelo-T. Wallus <[email protected]>

Author: ntnn

pkg/server/config.go

@@ -25,6 +25,7 @@ import (
 	"net/http/httputil"
 	"net/url"
 	"os"
+	"sync"
 
 	apiextensionsapiserver "k8s.io/apiextensions-apiserver/pkg/apiserver"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -207,7 +208,16 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 
 	// break connections on the tcp layer. Setting the client timeout would
 	// also apply to watches, which we don't want.
-	c.GenericConfig.LoopbackClientConfig.Wrap(network.DefaultTransportWrapper)
+	// To prevent data races when wrapping the default transport in
+	// multiple goroutines the wrapping is done in a once.
+	var wrapDefaultTransportWrapper = sync.Once{}
+	c.GenericConfig.LoopbackClientConfig.Wrap(func(rt http.RoundTripper) http.RoundTripper {
+		wrapDefaultTransportWrapper.Do(func() {
+			rt = network.DefaultTransportWrapper(rt)
+		})
+		return rt
+	})
+
 	// Set effective version to the default kube version of the vendored libs.
 	c.GenericConfig.EffectiveVersion = utilversion.DefaultKubeEffectiveVersion()