GitLab agent for K8s ci_access sharing does not work across top level groups
## Problem to solve On self-managed instances, sharing a registered agent across the whole instance should be possible. ## History This is a follow-up issue of https://gitlab.com/gitlab-org/gitlab/-/issues/346566+ Originally, the agent had to be a direct descendant of the group where the shared projects lived. We lifted this restriction as part of https://gitlab.com/gitlab-org/gitlab/-/issues/346566+, but it's still required that the agent and the shared projects have a common top-level root group. ## Proposal ``` gitlab.example.com/ |- infra-group/infra-project | |- my-agent |- dev-group/app-project ``` `my-agent` can be shared with the `dev-group` and all its project. Make it possible to enable/disable this feature to support large installations when the feature would cause a security or compliance risk. Use the same admin setting that controls organization-level sharing (added in https://gitlab.com/gitlab-org/gitlab/-/issues/357516) to enable/disable this functionality. ### Related - https://gitlab.com/gitlab-org/gitlab/-/issues/346566+
issue