From a tenant (esp. infra dev team) pov, they also want to be able to use different versions of CRDs and different versions of k8s api (at least +1 or -1 version). So the proxy doesn't really work. Just adopt vcluster already, as it's a lot more versatile than this proxy kludge.