gistfile1.txt

diff --git a/pkg/server/controllers.go b/pkg/server/controllers.go
index 456aaedf..55214a9e 100644
--- a/pkg/server/controllers.go
+++ b/pkg/server/controllers.go
@@ -592,7 +592,8 @@ func (s *Server) installAPIBindingController(ctx context.Context, config *rest.C
 			crdsSynced := s.ApiExtensionsSharedInformerFactory.Apiextensions().V1().CustomResourceDefinitions().Informer().HasSynced()
 			exportsSynced := s.KcpSharedInformerFactory.Apis().V1alpha1().APIExports().Informer().HasSynced()
 			bindingsSynced := s.KcpSharedInformerFactory.Apis().V1alpha1().APIBindings().Informer().HasSynced()
-			return crdsSynced && exportsSynced && bindingsSynced, nil
+			remoteExportSyncer := s.TemporaryRootShardKcpSharedInformerFactory.Apis().V1alpha1().APIExports().Informer().HasSynced()
+			return crdsSynced && exportsSynced && bindingsSynced && remoteExportSynced, nil
 		}); err != nil {
 			klog.Errorf("failed to finish post-start-hook kcp-install-apibinding-controller: %v", err)
 			// nolint:nilerr
diff --git a/pkg/server/server.go b/pkg/server/server.go
index e9be8dcf..76f74552 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -195,8 +195,18 @@ func NewConfig(opts *kcpserveroptions.CompletedOptions) (*Config, error) {
 		if err != nil {
 			return nil, err
 		}
-		var rootKcpShardIdentityRoundTripper func(rt http.RoundTripper) http.RoundTripper
-		rootKcpShardIdentityRoundTripper, c.resolveIdentities = boostrap.NewWildcardIdentitiesWrappingRoundTripper(boostrap.KcpRootGroupExportNames, boostrap.KcpRootGroupResourceExportNames, nonIdentityRootKcpShardClient.Cluster(tenancyv1alpha1.RootCluster))
+
+		rootKcpShardIdentityRoundTripper, resolveIdentities := boostrap.NewWildcardIdentitiesWrappingRoundTripper(boostrap.KcpRootGroupExportNames, boostrap.KcpRootGroupResourceExportNames, nonIdentityRootKcpShardClient.Cluster(tenancyv1alpha1.RootCluster))
+		if err := wait.PollImmediateInfiniteWithContext(ctx, time.Millisecond*500, func(ctx context.Context) (bool, error) {
+			if err := resolveIdentities(ctx); err != nil {
+				klog.V(3).Infof("failed to resolve identities, keeping trying: %v", err)
+				return false, nil
+			}
+			return true, nil
+		}); err != nil {
+			return fmt.Errorf("failed to get or create identities: %w", err)
+		}
+
 		rootKcpShardIdentityConfig := rest.CopyConfig(nonIdentityRootKcpShardSystemAdminConfig)
 		rootKcpShardIdentityConfig.Wrap(rootKcpShardIdentityRoundTripper)
 		c.RootShardKcpClusterClient, err = kcpclient.NewClusterForConfig(rootKcpShardIdentityConfig) // this is now generic to be used for all kcp API groups
@@ -452,6 +462,11 @@ func (s *Server) Run(ctx context.Context) error {
 		s.KubeSharedInformerFactory.WaitForCacheSync(ctx.StopCh)
 		s.ApiExtensionsSharedInformerFactory.WaitForCacheSync(ctx.StopCh)
 
+		if name != "root" {
+			s.TemporaryRootShardKcpSharedInformerFactory.Start(ctx.StopCh)
+			s.TemporaryRootShardKcpSharedInformerFactory.WaitForCacheSync(ctx.StopCh)
+		}
+
 		select {
 		case <-ctx.StopCh:
 			return nil // context closed, avoid reporting success below
@@ -479,47 +494,23 @@ func (s *Server) Run(ctx context.Context) error {
 		}
 		klog.Infof("Finished bootstrapping the shard workspace")
 
-		if len(s.Options.Extra.RootShardKubeconfigFile) > 0 {
-			klog.Info("Starting setting up kcp informers for the root shard")
-
-			go s.TemporaryRootShardKcpSharedInformerFactory.Apis().V1alpha1().APIExports().Informer().Run(ctx.StopCh)
-			go s.TemporaryRootShardKcpSharedInformerFactory.Apis().V1alpha1().APIBindings().Informer().Run(ctx.StopCh)
-
-			if err := wait.PollInfiniteWithContext(goContext(ctx), time.Millisecond*100, func(ctx context.Context) (bool, error) {
-				exportsSynced := s.TemporaryRootShardKcpSharedInformerFactory.Apis().V1alpha1().APIExports().Informer().HasSynced()
-				bindingsSynced := s.TemporaryRootShardKcpSharedInformerFactory.Apis().V1alpha1().APIBindings().Informer().HasSynced()
-				return exportsSynced && bindingsSynced, nil
-			}); err != nil {
-				klog.Errorf("failed to start APIExport and/or APIBinding informers for the root shard: %w", err)
-				// nolint:nilerr
-				return nil // don't klog.Fatal. This only happens when context is cancelled.
-			}
-			klog.Infof("Finished starting APIExport and APIBinding informers for the root shard")
-
-			klog.Infof("Getting kcp APIExport identities for the root shard")
-			if err := wait.PollImmediateInfiniteWithContext(goContext(ctx), time.Millisecond*500, func(ctx context.Context) (bool, error) {
-				if err := s.resolveIdentities(ctx); err != nil {
-					klog.V(3).Infof("failed to resolve identities for the root shard, keeping trying: %w", err)
-					return false, nil
-				}
-				return true, nil
-			}); err != nil {
-				klog.Errorf("failed to get or create identities for the root shard: %w", err)
-				// nolint:nilerr
-				return nil // don't klog.Fatal. This only happens when context is cancelled.
-			}
+		go s.KcpSharedInformerFactory.Apis().V1alpha1().APIExports().Informer().Run(ctx.StopCh)
+		go s.KcpSharedInformerFactory.Apis().V1alpha1().APIBindings().Informer().Run(ctx.StopCh)
 
-			klog.Infof("Finished getting kcp APIExport identities for the root shard")
+		if err := wait.PollInfiniteWithContext(goContext(ctx), time.Millisecond*100, func(ctx context.Context) (bool, error) {
+			exportsSynced := s.KcpSharedInformerFactory.Apis().V1alpha1().APIExports().Informer().HasSynced()
+			bindingsSynced := s.KcpSharedInformerFactory.Apis().V1alpha1().APIBindings().Informer().HasSynced()
+			return exportsSynced && bindingsSynced, nil
+		}); err != nil {
+			klog.Errorf("failed to start APIExport and/or APIBinding informers: %v", err)
+			// nolint:nilerr
+			return nil // don't klog.Fatal. This only happens when context is cancelled.
+		}
 
-			s.TemporaryRootShardKcpSharedInformerFactory.Start(ctx.StopCh)
-			s.TemporaryRootShardKcpSharedInformerFactory.WaitForCacheSync(ctx.StopCh)
+		if len(s.Options.Extra.RootShardKubeconfigFile) > 0 {
+			// I am not root
 
-			select {
-			case <-ctx.StopCh:
-				return nil // context closed, avoid reporting success below
-			default:
-			}
-			klog.Infof("Finished starting kcp informers for the root shard")
+			klog.Info("Starting setting up kcp informers for the root shard")
 
 			klog.Info("Creating ClusterWorkspaceShard resource in the root shard")
 			shard := &tenancyv1alpha1.ClusterWorkspaceShard{
@@ -533,24 +524,11 @@ func (s *Server) Run(ctx context.Context) error {
 				return err
 			}
 			klog.Info("Finished creating ClusterWorkspaceShard resource in the root shard")
-		}
-
-		go s.KcpSharedInformerFactory.Apis().V1alpha1().APIExports().Informer().Run(ctx.StopCh)
-		go s.KcpSharedInformerFactory.Apis().V1alpha1().APIBindings().Informer().Run(ctx.StopCh)
+		} else {
+			// I am root
 
-		if err := wait.PollInfiniteWithContext(goContext(ctx), time.Millisecond*100, func(ctx context.Context) (bool, error) {
-			exportsSynced := s.KcpSharedInformerFactory.Apis().V1alpha1().APIExports().Informer().HasSynced()
-			bindingsSynced := s.KcpSharedInformerFactory.Apis().V1alpha1().APIBindings().Informer().HasSynced()
-			return exportsSynced && bindingsSynced, nil
-		}); err != nil {
-			klog.Errorf("failed to start APIExport and/or APIBinding informers: %v", err)
-			// nolint:nilerr
-			return nil // don't klog.Fatal. This only happens when context is cancelled.
-		}
-
-		klog.Infof("Finished starting APIExport and APIBinding informers")
+			klog.Infof("Finished starting APIExport and APIBinding informers")
 
-		if s.Options.Extra.ShardName == tenancyv1alpha1.RootShard {
 			// bootstrap root workspace phase 0 only if we are on the root shard, no APIBinding resources yet
 			if err := configrootphase0.Bootstrap(goContext(ctx),
 				s.KcpClusterClient.Cluster(tenancyv1alpha1.RootCluster),
@@ -562,9 +540,7 @@ func (s *Server) Run(ctx context.Context) error {
 				return nil // don't klog.Fatal. This only happens when context is cancelled.
 			}
 			klog.Infof("Bootstrapped root workspace phase 0")
-		}
 
-		if s.Options.Extra.ShardName == tenancyv1alpha1.RootShard {
 			klog.Infof("Getting kcp APIExport identities")
 			if err := wait.PollImmediateInfiniteWithContext(goContext(ctx), time.Millisecond*500, func(ctx context.Context) (bool, error) {
 				if err := s.resolveIdentities(ctx); err != nil {