bug/flake: authorizer_test.go:437: verify that service-provider-2-admin cannot lists CRD shadowed sherriffs resources in the tenant workspace "root:e2e-workspace-nvqzj:tenant-shadowed-crd" via the virtual apiexport apiserver about kcp HOT 4 CLOSED

    authorizer_test.go:427: verify that service-provider-2-admin can lists all claimed resources using a wildcard request
    authorizer_test.go:441: verify that service-provider-2-admin can lists sherriffs resources in the tenant workspace "root:e2e-workspace-f57nc:tenant" via the virtual apiexport apiserver
=== CONT  TestAPIExportAuthorizers
    authorizer_test.go:450: verify that service-provider-2-admin cannot list CRD shadowed cowboy resources in the tenant workspace "root:e2e-workspace-f57nc:tenant-shadowed-crd" via the virtual apiexport apiserver
I0201 20:28:00.173011   31870 bootstrap.go:236] "upserted object" apiresourceschema.workspace="1wznj91olpts85q5" apiresourceschema.namespace="" apiresourceschema.name="today.cowboys.wildwest.dev" apiresourceschema.apiVersion="apis.kcp.io/v1alpha1"
=== CONT  TestAPIExportAuthorizers
    assertions.go:1691: Waiting for condition, but got: expected a not-found error, but got cowboys:1bda3a4fb9f21dde8f3f0264eab425b025d7661a41b58121b2e5519f2fb20bbd.wildwest.dev is forbidden: User "system:serviceaccount:default:rest" cannot list resource "cowboys:1bda3a4fb9f21dde8f3f0264eab425b025d7661a41b58121b2e5519f2fb20bbd" in API group "wildwest.dev" at the cluster scope: access denied
E0201 20:28:06.323080   31870 memcache.go:206] couldn't get resource list for v1: Got empty response for: v1
=== CONT  TestAPIExportAuthorizers
    authorizer_test.go:451: 
        	Error Trace:	util.go:327
        	            				authorizer_test.go:451
        	Error:      	Condition never satisfied
        	Test:       	TestAPIExportAuthorizers
        	Messages:   	expected service-provider-2-admin to be denied to shadowed cowboy resources
--- FAIL: TestAPIExportAuthorizers (50.48s)

    "annotations":{
        "authorization.k8s.io/decision":"forbid",
        "authorization.k8s.io/reason":"access denied",
        "request.auth.kcp.io/01-requiredgroups-decision":"Denied",
        "request.auth.kcp.io/01-requiredgroups-reason":"delegating due to service account access to logical cluster",
        "request.auth.kcp.io/02-content-decision":"Denied",
        "request.auth.kcp.io/02-content-reason":"LogicalCluster not found",
        "tenancy.kcp.io/workspace":"dpprabp7l5ygefwt"
    }