TODOs #4502

This issue is a collection of all TODO/HACK/FIXME/... markers in kcp code.
Most of them are relatively easy to pick up and quick wins.

When fixing any of these please pick only a fitting number of issues per pull request and reference which specific TODO in this issue the PR fixes.

Security

• Reload serviceaccount root CA on file change (pkg/server/controllers.go:371); Support CA rotation in front-proxy #1308 is the front-proxy twin
• APIBinder initializer does not work sharded (pkg/reconciler/tenancy/initialization/apibinder_initializer_controller.go:227)
• Load-test manifests: proper auth once bug: accessing shard metrics is handled on workspace level #4062 lands (test/load/setup/manifests/metrics-viewer-kubeconfig-req.yaml:10)

Performance

• Re-enable watch cache on cache server (pkg/cache/server/options/options.go:89, pkg/server/options/options.go:445)
• Cache discovered virtual types / skip discovery for known VW resources (pkg/server/aggregatingcrdversiondiscovery/verbs_provider_virtualstorage.go (L39, L86))
• Authenticator cache TTLs configurable (pkg/authentication/index_lazy.go:79)
• Rebuild WAC/union authenticators incrementally from cache-server events (pkg/authentication/index_lazy.go:177)

Functionality

• Unlock schemas removed from an APIExport vs. moved between exports (pkg/reconciler/apis/apibinding/apibinding_reconcile.go:280); bug: APIBinding lock on crd deletion is not removed from logicalCluster annotation #3799 fixed only the CRD-deletion case
• Logical cluster deletion: ClusterRole/Binding cleanup (pkg/reconciler/core/logicalclusterdeletion/logicalcluster_deletion_controller.go:292), grace periods and k/k#22413 (pkg/reconciler/core/logicalclusterdeletion/deletion/logicalcluster_resource_deletor.go (L206, L516)), CRD-bootstrap special case (config/system-crds/bootstrap.go:53)
• Eager authenticator build failure goes stale silently (pkg/authentication/index_eager.go:98)
• Locking for multiple workers in CachedResource replication (pkg/reconciler/cache/clustercachedresources/clustercachedresources_reconcile_replication.go:69)
• User-visible errors in apireconcilers (pkg/virtual/apiexport/controllers/apireconciler/apiexport_apireconciler_reconcile.go (L239, L258), pkg/virtual/replication/controllers/apireconciler/clustercachedresource_apireconciler_reconcile.go:124)
• Proxy metrics: include shard URL (pkg/proxy/metrics/metrics.go:53)
• APIExport v1alpha2 pre-beta: field name, resource selector (staging/src/github.com/kcp-dev/sdk/apis/apis/v1alpha2/types_apiexport.go (L120, L203))
• Workspaces: /services hard-coded (pkg/virtual/initializingworkspaces/builder/build.go:469), drop fallback (pkg/virtual/initializingworkspaces/builder/build.go:292), migrating annotation in API (pkg/index/index.go:290), workspacemounts beyond status (pkg/reconciler/tenancy/workspacemounts/workspacemounts_reconcile_updater.go:37), home-workspace phase-A checks (pkg/server/home_workspaces.go:168), reserved names tied to patches (staging/src/github.com/kcp-dev/sdk/apis/tenancy/v1alpha1/types_workspacetype.go:34)
• kubectl kcp bind selector support (staging/src/github.com/kcp-dev/cli/pkg/bind/plugin/bind.go:357)
• Verify Codecs (pkg/server/handler.go (L118, L169))
• dynamicrestmapper: plural-only ops, cross-version name mapping, drop shared-mapper shortcut (pkg/reconciler/dynamicrestmapper/defaultrestmapper_kcp.go (L62, L94, L124))
• Controller worker counts / tuning configurable (pkg/server/controllers.go (L1760, L1944, L1945))
• Decide on Destroy() in forwarding registry (staging/src/github.com/kcp-dev/virtual-workspace-framework/pkg/forwardingregistry/rest.go:94)

Cleanup

• Drop v1alpha1 APIExport migrations and feature-gate leftovers (pkg/admission/apiexport/admission.go (L204, L215, L245), pkg/admission/apibinding/apibinding_admission.go:348, pkg/reconciler/apis/apiexport/apiexport_reconcile.go:132, pkg/reconciler/apis/apiexportendpointslice/apiexportendpointslice_reconcile.go:49, pkg/virtual/apiexport/schemas/builtin/builtin.go (L60, L119))
• SplitMetaClusterNamespaceKey/ClusterFrom return tenancy.Name (pkg/admission/reservedcrdannotations/admission.go:75, pkg/reconciler/apis/apibindingdeletion/apibinding_deletion_controller.go:255, pkg/reconciler/apis/identitycache/api_export_identity_controller.go (L98, L120), pkg/reconciler/apis/crdcleanup/crdcleanup_controller.go:324)
• Dedupe: apibinding admission copy (pkg/reconciler/apis/apibinding/apibinding_reconcile_test.go:1285), apiexport controller copy (pkg/reconciler/cache/clustercachedresources/clustercachedresources_reconcile.go:229), workspacetypeexists check to shared location (pkg/admission/workspacetypeexists/admission.go:451), cache e2e helpers (test/e2e/cache/replication_api_cache_test.go:373)
• Server/controller cleanups: move verification up (pkg/server/controllers.go (L997, L1001, L1005, L1059, L1063, L1067)), batteries (pkg/server/controllers.go:734), user agent (pkg/server/controllers.go:1862), P&F leftovers (pkg/server/server.go (L140, L150)), split into commands (pkg/server/server.go:717), default config (pkg/server/config.go:665, pkg/reconciler/kubequota/kubequota_controller.go (L64, L80))
• Code generator debt (staging/src/github.com/kcp-dev/code-generator/cmd/cluster-client-gen/generators/client_generator.go:323, staging/src/github.com/kcp-dev/code-generator/cmd/cluster-client-gen/generators/fake/generator_fake_for_type.go (L252, L273, L296), staging/src/github.com/kcp-dev/code-generator/cmd/cluster-client-gen/generators/fake/fake_client_generator.go (L36, L96), staging/src/github.com/kcp-dev/code-generator/cmd/cluster-client-gen/main.go:40, hack/update-codegen-clients.sh:36)
• Test debt: event assertions (test/integration/logicalclustermigration/per_cluster_context_test.go (L66, L105)), WaitForAPIReady (test/e2e/garbagecollector/apis_test.go:128), generation mismatch (test/e2e/reconciler/cache/replication_test.go (L770, L782)), empty discovery group (test/e2e/virtual/initializingworkspaces/virtualworkspace_test.go:77), global fixtures (pkg/authorization/workspace_content_authorizer_test.go (L354, L394)), QPS*4 (test/load/testing/workspace_simple_crud_test.go:89)
• Docs: bare TODO/TBD in docs/content/concepts/apis/exporting-apis.md:422, docs/content/concepts/sharding/cache-server.md:209, docs/content/concepts/authorization/authorizers.md:265, docs/content/contributing/monorepo.md:118; drop Syncer mention (docs/content/contributing/governance/security-self-assessment.md:108)