server

type Options struct {
	// SecureServing configures TLS serving (bind address, port,
	// serving certs). The VW must serve TLS: behind kcp's front-proxy
	// the proxy verifies the VW's serving cert, and the VW verifies
	// the proxy's client cert via the requestheader CA.
	SecureServing *genericoptions.SecureServingOptions

	// Authentication configures delegated authentication:
	//   - requestheader: trust X-Remote-User/X-Remote-Group/X-Remote-Extra-*
	//     from clients presenting a cert signed by --requestheader-client-ca-file
	//     (this is how kcp's front-proxy forwards identity),
	//   - bearer tokens: TokenReview against kcp (direct access without
	//     the front-proxy, e.g. local development),
	//   - client certs via --client-ca-file.
	Authentication *genericoptions.DelegatingAuthenticationOptions

	// Authorization is the virtual-workspace-framework authorizer setup:
	// always-allow paths (health endpoints) plus per-VW authorizers.
	Authorization *vwoptions.Authorization

	// Kubeconfig is the path to the kubeconfig for the target kcp.
	// Used by the RBAC provider (informers), for TokenReview-based
	// authentication, and as the base identity for impersonated
	// per-workspace MCP calls.
	Kubeconfig string

	// EndpointBase is the front-proxy URL prefix used to construct
	// per-cluster endpoints in SCAR responses.
	EndpointBase string

	// APIExportEndpointSlice is the name of the APIExportEndpointSlice
	// for the access VW's system APIExport. When set, the RBAC provider
	// runs in multi-shard mode and only indexes workspaces bound to
	// that APIExport.
	APIExportEndpointSlice string
}