Feat: virtual workspace

[vertex451]

Solves #275

For more details check docs/virtual-workspaces.md at this PR.

Out of scope

Apiexport-based virtual ws

TBD

• [ x] Unit/Integration tests
• [ x] Manual testing of ClusterAccess logic(was affected during the refactoring)

Changes

• Added virtual workspace support in both Listener and Gateway.
• Passed auth info to gateway via spec files instead of direct kubeconfig export for all types of clusters.
• Moved code of metadata injection to a separate package common/auth to eliminate DRY.
• Altered file watching logic at the gateway to support nesting.
• Moved file watching logic from the gateway into a separate pacakge common/wather and reused it in the listener(to watch config.yaml for a virtual workspace entries).
• Adjusted Roundtripper to detect virtual workspace discovery requests.
• Introduced pattern matching function to extract cluster name from request URL.
• Took out schema generation code from kcp workspace reconciler to reuse it in virtual workspace reconciler.

Testing

Local setup

Last tested: at 17:00 23.07.2025 at this commit: used constants for timeout
Created an account ✅

Virtual workspace

Last tested: at 17:00 23.07.2025 at this commit: used constants for timeout
Used this config:

virtualWorkspaces:
  - name: custom-ws
    url: https://kcp.api.portal.cc-d1.showroom.apeirora.eu:443/services/contentconfigurations
    kubeconfig: /Users/artem.shcherbatiuk/.kube/cc-clusters/cc-d1-kcp

And successfully fetched ContentConfigurations:

Clusteraccess

Last tested: at 17:00 23.07.2025 at this commit: used constants for timeout
Created clusteraccess entries for both kind-kind(single cluster mode) and kind-target clusters, fetched configMaps for both clusters:

[aaronschweig]

some smaller things to consider

[aaronschweig]

didnt have a new look at it but I want to unblock greg. If we still see some things to work on lets follow up on that