osac CLI: create hub fails with Unimplemented on public API endpoint

[karmab]

Summary

osac create hub calls osac.private.v1.Hubs/Create, but the default CLI login flow (osac login) points to the public API route (fulfillment-api-osac.apps.<cluster>), which only exposes osac.public.v1.* services through the envoy ingress proxy. The result is a confusing Unimplemented error with no useful message.

Steps to reproduce

osac login --insecure fulfillment-api-osac.apps.osac.192-168-254-254.sslip.io:443
osac create hub --kubeconfig=/root/.kcli/clusters/osac/auth/kubeconfig --id hub --namespace osac

Error: failed to create hub: rpc error: code = Unimplemented desc =

Debug output

{"level":"DEBUG","msg":"Sending unary request","method":"/osac.private.v1.Hubs/Create","target":"dns:///fulfillment-api-osac.apps.osac.192-168-254-254.sslip.io:443"}
{"level":"DEBUG","msg":"Received unary response","method":"/osac.private.v1.Hubs/Create","code":"Unimplemented"}

Workaround

Point the CLI at the internal API route instead:

# Edit ~/.config/osac/config.json
# Change "address" to "fulfillment-internal-api-osac.apps.<cluster>:443"

Or:

osac login --insecure fulfillment-internal-api-osac.apps.<cluster>:443

Suggested fix

One or more of:

1. The CLI should use separate endpoints for public vs private API calls, or document which endpoint to use for admin operations
2. The envoy proxy should route private methods on the public route (with proper auth/RBAC)
3. The error message should indicate the method is only available on the internal API, rather than returning an empty Unimplemented