feature: target a kcp workspace and custom endpoint with the 'kubeconfig' resource

[akafazov]

Feature Description

Using the kubeconfig resource, it is currently not possible to create a kubeconfig to target a specific KCP workspace.

Another feature we lack is a parameter to change the port of the frontproxy/server in the kubeconfig. This would be helpful in cases where clients are external and do not have access to the internal endpoint of the frontproxy.

Proposed Solution

Add 2 parameters:

• spec.target.path pointing to the workspace path, e.g. root:orgs:acme
• spec.target.frontProxyRef.port to override the internal port used currently for the frontproxy

Alternative Solutions

No response

Want to contribute?

• I would like to work on this issue.

Additional Context

No response

[mjudeikis]

Regarding point 2: this got fixed here:#113

And on point 1, how would permission be managed in this case? Assuming you dont want to give kcp-admin or wirder permissions for this kubeconfig?

Can you describe what problem you are truign to solve with "per workspace kubeconfigs"?

[akafazov]

Hi and thanks for the response. I was trying to generate a kcp kubeconfig pointing to a workspace using the kubeconfig resource. KCP was exposed externally via a different hostname and port than the internal one, so looked for a way to override this.

Good question about the permissions, I guess regular RBAC but we could do this separately.