Currently ValidatingAdmissionPolicies and MutatingAdmissionPolicies with ParamRef are only working for single shard. This had to be done as we had to fix an issue there first.
With the issue fixed, we can now focus on implementing VAP & MAP with ParamRefs for multi-shard. The part that we need to change is in our kubernetes fork, where the dynamic fallback not only needs to create an informer scoped to the target of the policy but also take into account that the policy parameter can live on a different shard than the object being validated. This is the case when you use VAP / MAP through APIExports.
https://github.com/kcp-dev/kubernetes/blob/c553feb51c18e01a13f20869f2a783b399cb4a28/staging/src/k8s.io/apiserver/pkg/admission/plugin/policy/generic/policy_source.go#L428-L444
Currently ValidatingAdmissionPolicies and MutatingAdmissionPolicies with ParamRef are only working for single shard. This had to be done as we had to fix an issue there first.
With the issue fixed, we can now focus on implementing VAP & MAP with ParamRefs for multi-shard. The part that we need to change is in our kubernetes fork, where the dynamic fallback not only needs to create an informer scoped to the target of the policy but also take into account that the policy parameter can live on a different shard than the object being validated. This is the case when you use VAP / MAP through APIExports.
https://github.com/kcp-dev/kubernetes/blob/c553feb51c18e01a13f20869f2a783b399cb4a28/staging/src/k8s.io/apiserver/pkg/admission/plugin/policy/generic/policy_source.go#L428-L444