bootstrap

type Options struct {
	// WorkspacePath is the absolute path the objects were installed
	// into, used only for reporting.
	WorkspacePath string

	// HostOverride replaces the scheme://host[:port] of the generated
	// kubeconfig, keeping the workspace path. Needed when init runs with
	// an externally reachable URL but the server will connect from inside
	// the cluster (or the reverse).
	HostOverride string

	// ServerUsers and ServerGroups are extra identities to grant the
	// controller role to, for deployments that run the server as something
	// other than the ServiceAccount minted here -- kcp-operator mounts a
	// client certificate, so its server arrives as a User.
	//
	// Empty means only the ServiceAccount is granted, which is correct when
	// the server uses the generated kubeconfig.
	ServerUsers  []string
	ServerGroups []string

	// Timeout bounds the apply-and-verify loop.
	Timeout time.Duration
}

type Result struct {
	// WorkspacePath is the absolute path of the workspace the objects
	// were installed into.
	WorkspacePath string

	// APIExportEndpointSlice is the name to pass to the server's
	// --apiexport-endpointslice flag.
	APIExportEndpointSlice string

	// VirtualWorkspaceURLs are the per-shard URLs the slice resolved to.
	// Empty means the provider will discover nothing.
	VirtualWorkspaceURLs []string

	// ExportsClusterRef is the logical cluster ID of the workspace the
	// APIExport landed in, which is what a consumer APIBinding must
	// reference. Reported because the workspace is configurable, so no
	// committed example can carry it.
	ExportsClusterRef string

	// KubeconfigSecret is the Secret, in the APIExport's workspace, holding
	// the kubeconfig the server should run with.
	KubeconfigSecret string
}