server

type Authentication struct {
	BuiltInOptions *kubeoptions.BuiltInAuthenticationOptions
}

type Options struct {
	// SecureServing configures TLS serving (bind address, port,
	// serving certs). The VW must serve TLS: behind kcp's front-proxy
	// the proxy verifies the VW's serving cert, and the VW verifies
	// the proxy's client cert via the requestheader CA.
	SecureServing *genericoptions.SecureServingOptions

	// Authentication configures how callers are identified: a JWT
	// authenticator (--authentication-config or the --oidc-* flags),
	// request header identity forwarded by kcp's front-proxy, and
	// client certificates. Its configuration must match kcp's, because
	// the graph compares usernames verbatim against RBAC subjects —
	// see authentication.go.
	Authentication *Authentication

	// Authorization is the virtual-workspace-framework authorizer setup:
	// always-allow paths (health endpoints) plus per-VW authorizers.
	Authorization *vwoptions.Authorization

	// Kubeconfig is the path to the kubeconfig for the target kcp.
	// Used by the RBAC provider's informers and as the base identity
	// for impersonated per-workspace calls.
	Kubeconfig string

	// EndpointBase is the front-proxy URL prefix used to construct
	// per-cluster endpoints in SCAR responses.
	EndpointBase string

	// APIExportEndpointSlice is the name of the APIExportEndpointSlice
	// for the access VW's system APIExport. When set, the RBAC provider
	// runs in multi-shard mode and only indexes workspaces bound to
	// that APIExport.
	APIExportEndpointSlice string

	// WorkspacePath is the workspace the kubeconfig is retargeted to,
	// e.g. "root:access:controllers". The APIExportEndpointSlice lookup
	// happens in the workspace the kubeconfig points at; operator-minted
	// admin kubeconfigs point at root, while the bootstrap assets live in
	// the controllers workspace. Empty means use the kubeconfig as-is.
	WorkspacePath string
}