Skip to content

[2- De-Rooting] Move FP to use apiidentities - #4493

Open
mjudeikis wants to merge 3 commits into
kcp-dev:mainfrom
mjudeikis:de.root.the.root
Open

[2- De-Rooting] Move FP to use apiidentities #4493
mjudeikis wants to merge 3 commits into
kcp-dev:mainfrom
mjudeikis:de.root.the.root

Conversation

@mjudeikis

@mjudeikis mjudeikis commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

This moves FP to use APIIdentities vs root shard.

After this change, we have only service accounts still using the root shard to resolve things. This will be follow-up PR.

What Type of PR Is This?

Related Issue(s)

Fixes #

Release Notes

Move FrontProxy to use APIIdentities to resolve core identities so decouping it from root shard.

@kcp-ci-bot kcp-ci-bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note-none Denotes a PR that doesn't merit a release note. dco-signoff: yes Indicates the PR's author has signed the DCO. do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Oct 26, 2026
@mjudeikis mjudeikis mentioned this pull request Oct 26, 2026
Open
@mjudeikis mjudeikis changed the title [wip] Move FP to use apiidentities [wip][2- De-Rooting] Move FP to use apiidentities Oct 26, 2026
@kcp-ci-bot

kcp-ci-bot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xmudrii for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kcp-ci-bot kcp-ci-bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Oct 27, 2026
mjudeikis
mjudeikis commented Oct 27, 2026
View reviewed changes
Comment thread pkg/proxy/options/options.go
if len(o.ShardsPeerKubeconfigs) == 0 && len(o.RootKubeconfig) == 0 {
errs = append(errs, fmt.Errorf("--shard-peer-kubeconfig is required"))
}
if o.Authentication.ServiceAccountAuthEnabled() && len(o.RootKubeconfig) == 0 {

@mjudeikis mjudeikis Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will get removed in follow-up pr

@mjudeikis

mjudeikis commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mjudeikis mjudeikis changed the title [wip][2- De-Rooting] Move FP to use apiidentities [2- De-Rooting] Move FP to use apiidentities Oct 27, 2026
@kcp-ci-bot kcp-ci-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note-none Denotes a PR that doesn't merit a release note. labels Oct 27, 2026
@mjudeikis mjudeikis added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Oct 27, 2026
@mjudeikis

mjudeikis commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

3 similar comments
@mjudeikis

mjudeikis commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mjudeikis

mjudeikis commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mjudeikis

mjudeikis commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mjudeikis

mjudeikis commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

@mjudeikis-bot review this

mjudeikis-bot
mjudeikis-bot reviewed Oct 27, 2026
View reviewed changes

@mjudeikis-bot mjudeikis-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found. Checked: the APIIdentity informer filter and core identity handler against the admin view's label support, the non-blocking startup and readiness path (missing identities make requests error and informers retry), the optional root kubeconfig handling for service account auth and the seed peer, and the group-based metrics authorizer union.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@mjudeikis-bot mjudeikis-bot mjudeikis-bot left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dco-signoff: yes Indicates the PR's author has signed the DCO. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mjudeikis @kcp-ci-bot @mjudeikis-bot