feature: Identity resolution without root shard

The root kubeconfig is still
required for APIExport identity resolution and will be removed once
identities are resolvable without the root shard.

We need way to remove need for "root" shard to be there to resolve identities, so we can remove need for root shard :)

Do it :)

No response

This will depend on decouple shards first

This is harder than it looks.
Identities are now established ONLY by root shard in the root workspace.
Most ideal option for this is to use Certificate and "seed" the identies from it.
But it does not have an upgrade path for existing installs.
So for this to decouple we need to do this https://github.com/kcp-dev/enhancements/blob/c62b9141c1b49df82b0be1d519ec74a11a3a7996/keps/core/0005-apiexport-identity-rotation.md
and once we have migration, we would migrate existing identities, to seed file ones during kcp upgrade.

Navigation Menu