[answersamir]

What

The workspace builder now sends a small workspaceScope summary with every upload. It lists the Kubernetes clusters and namespaces the run covered, and the kubeconfig credential reference each cluster's tasks use. The platform can then configure Kubernetes resource discovery for those clusters itself. Users change nothing: the same workspaceInfo.yaml and the same upload.

Shape (version 1)

{
  "version": 1,
  "generatedAt": "2026-09-25T10:00:00Z",
  "builderVersion": "0.x.y",
  "kubernetes": {
    "clusters": [{
      "name": "prod-eu",                 // kubeconfig clusters[].name, same value SLX cluster tags use
      "context": "prod-eu-admin",
      "clusterType": "kubernetes",       // kubernetes | gke | aks | eks | ...
      "namespaceSelection": "all",       // "explicit" | "all"
      "namespaces": ["orders", "payments"],
      "excludedNamespaces": ["kube-system"],
      "credentialRef": "k8s:file@secret/kubeconfig:kubeconfig",
      "inClusterAuth": false,
      "reachable": true
    }]
  }
}

• No secret material. The payload holds names and the credential reference only, never kubeconfig bytes, tokens, certificates or keys. credentialRef is rendered through the same kubernetes-auth.yaml template the SLX runbooks use, so the two can't drift. A test guards against secret material in the payload.
• Clusters the builder couldn't reach are still listed, with reachable: false. This lets the platform tell "gone" from "unreachable this time".
• Namespace lists are capped at 2,000 entries each (namespacesTruncated: true when cut).

How it travels

• kubeapi.index() records a per-cluster ClusterScanResult. The server resets it at the start of each run.
• The /run/ response carries workspaceScope. run writes it to workspace-scope.json in the output root. That is outside the workspaces/ tree, so the file is never part of the uploaded tarball or a Git-backed workspace repo.
• upload (and run --upload) attaches it to POST /api/v3/workspaces/{ws}/upload as an optional field, best-effort. A platform that doesn't know the field ignores it, and a missing or unreadable file never fails an upload. A run that produced no scope removes the previous run's file.
• In-cluster kubeconfigs now carry the same workspace-builder extension the cloud generators add (cluster_type: kubernetes, in_cluster_auth: true). kubernetes matches no auth, tag or hierarchy template branch, so rendered output is unchanged.

Tests

• src/test_workspace_scope.py: payload shape, credential-ref rendering per cluster type, truncation, and the no-secrets guard.
• src/indexers/test_kubeapi_workspace_scope.py: scan results for explicit/all selection, exclusions and unreachable clusters.
• src/test_run_upload_workspace_scope.py: the upload body carries the scope, the tarball doesn't, and a stale file is removed. These tests sandbox $HOME.

Heads-up for reviewers

Some existing tests (test_gke_multi_project_discovery.py, and anything that calls run.main()) read or write the real ~/.kube. clear_stale_kubeconfig_artifacts deletes ~/.kube/config when run.main() runs outside a container. Run the suite with a sandboxed HOME until those are fixed.