IdentityFromContext retrieves the APIExport identity from the context, if any.

WithHomeWorkspaces implements an HTTP handler, in the KCP server, which: - supports a special 'kubectl get workspace ~' request which returns either the old bucket-style workspace if it exists (= a LogicalCluster can be found) or a new parent-less home workspace.

WithIdentity adds an APIExport identity to the context.

WithInClusterServiceAccountRequestRewrite adds the /clusters/<clusterName> prefix to the request path if the request comes from an InCluster service account requests (InCluster clients don't support prefixes).

WithLocalProxy returns a handler with a local-only mini-front-proxy.

WithRequestIdentity checks list/watch requests for an APIExport identity for the resource in the path.

WithVirtualWorkspacesProxy proxies internal requests to virtual workspaces (i.e., requests that did not go through the front proxy) to the external virtual workspaces server.

SystemCRDClusterName is the logical cluster we install system CRDs into for now.