Add spec.secretName to OPC and handle case-insensitive hostnames

- When two different Issuers have the same host (i.e. they differ
  only by path) then they must have the same secretName. This is because
  it wouldn't make sense for there to be two different TLS certificates
  for one host. Find any that do not have the same secret name to
  put an error status on them and to avoid serving OIDC endpoints for
  them. The host comparison is case-insensitive.
- Issuer hostnames should be treated as case-insensitive, because
  DNS hostnames are case-insensitive. So https://me.com and
  https://mE.cOm are duplicate issuers. However, paths are
  case-sensitive, so https://me.com/A and https://me.com/a are
  different issuers. Fixed this in the issuer validations and in the
  OIDC Manager's request router logic.

generated/1.17/README.adoc

@@ -132,6 +132,7 @@ OIDCProviderConfigSpec is a struct that describes an OIDC Provider.
 | Field | Description
 | *`issuer`* __string__ | Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the identifier that it will use for the iss claim in issued JWTs. This field will also be used as the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is https://example.com/foo, then your authorization endpoint will look like https://example.com/foo/some/path/to/auth/endpoint). 
  See https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
+| *`secretName`* __string__ | SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider. SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside the cluster using a LoadBalancer Service), and is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.
 |===
 
 

generated/1.17/apis/config/v1alpha1/types_oidcproviderconfig.go

@@ -12,9 +12,10 @@ import (
 type OIDCProviderStatus string
 
 const (
-	SuccessOIDCProviderStatus   = OIDCProviderStatus("Success")
-	DuplicateOIDCProviderStatus = OIDCProviderStatus("Duplicate")
-	InvalidOIDCProviderStatus   = OIDCProviderStatus("Invalid")
+	SuccessOIDCProviderStatus                         = OIDCProviderStatus("Success")
+	DuplicateOIDCProviderStatus                       = OIDCProviderStatus("Duplicate")
+	SameIssuerHostMustUseSameSecretOIDCProviderStatus = OIDCProviderStatus("SameIssuerHostMustUseSameSecret")
+	InvalidOIDCProviderStatus                         = OIDCProviderStatus("Invalid")
 )
 
 // OIDCProviderConfigSpec is a struct that describes an OIDC Provider.
@@ -29,6 +30,15 @@ type OIDCProviderConfigSpec struct {
 	// https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
 	// +kubebuilder:validation:MinLength=1
 	Issuer string `json:"issuer"`
+
+	// SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`,
+	// which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider.
+	// SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside
+	// the cluster using a LoadBalancer Service), and is not required when you would like to use only the
+	// HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named
+	// `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.
+	// +optional
+	SecretName string `json:"secretName,omitempty"`
 }
 
 // OIDCProviderConfigStatus is a struct that describes the actual state of an OIDC Provider.

generated/1.17/client/openapi/zz_generated.openapi.go

@@ -397,6 +397,13 @@ func schema_117_apis_config_v1alpha1_OIDCProviderConfigSpec(ref common.Reference
 							Format:      "",
 						},
 					},
+					"secretName": {
+						SchemaProps: spec.SchemaProps{
+							Description: "SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider. SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside the cluster using a LoadBalancer Service), and is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 				},
 				Required: []string{"issuer"},
 			},

generated/1.17/crds/config.pinniped.dev_oidcproviderconfigs.yaml

@@ -49,6 +49,17 @@ spec:
                   for more information."
                 minLength: 1
                 type: string
+              secretName:
+                description: SecretName is an optional name of a Secret in the same
+                  namespace, of type `kubernetes.io/tls`, which contains the TLS serving
+                  certificate for the HTTPS endpoints served by this OIDC Provider.
+                  SecretName is required if you would like to use the HTTPS endpoints
+                  (e.g. when exposing them outside the cluster using a LoadBalancer
+                  Service), and is not required when you would like to use only the
+                  HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS
+                  secret must contain keys named `tls.crt` and `tls.key` that contain
+                  the certificate and private key to use for TLS.
+                type: string
             required:
             - issuer
             type: object

generated/1.18/README.adoc

@@ -132,6 +132,7 @@ OIDCProviderConfigSpec is a struct that describes an OIDC Provider.
 | Field | Description
 | *`issuer`* __string__ | Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the identifier that it will use for the iss claim in issued JWTs. This field will also be used as the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is https://example.com/foo, then your authorization endpoint will look like https://example.com/foo/some/path/to/auth/endpoint). 
  See https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
+| *`secretName`* __string__ | SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider. SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside the cluster using a LoadBalancer Service), and is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.
 |===
 
 

generated/1.18/apis/config/v1alpha1/types_oidcproviderconfig.go

@@ -12,9 +12,10 @@ import (
 type OIDCProviderStatus string
 
 const (
-	SuccessOIDCProviderStatus   = OIDCProviderStatus("Success")
-	DuplicateOIDCProviderStatus = OIDCProviderStatus("Duplicate")
-	InvalidOIDCProviderStatus   = OIDCProviderStatus("Invalid")
+	SuccessOIDCProviderStatus                         = OIDCProviderStatus("Success")
+	DuplicateOIDCProviderStatus                       = OIDCProviderStatus("Duplicate")
+	SameIssuerHostMustUseSameSecretOIDCProviderStatus = OIDCProviderStatus("SameIssuerHostMustUseSameSecret")
+	InvalidOIDCProviderStatus                         = OIDCProviderStatus("Invalid")
 )
 
 // OIDCProviderConfigSpec is a struct that describes an OIDC Provider.
@@ -29,6 +30,15 @@ type OIDCProviderConfigSpec struct {
 	// https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
 	// +kubebuilder:validation:MinLength=1
 	Issuer string `json:"issuer"`
+
+	// SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`,
+	// which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider.
+	// SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside
+	// the cluster using a LoadBalancer Service), and is not required when you would like to use only the
+	// HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named
+	// `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.
+	// +optional
+	SecretName string `json:"secretName,omitempty"`
 }
 
 // OIDCProviderConfigStatus is a struct that describes the actual state of an OIDC Provider.

generated/1.18/client/openapi/zz_generated.openapi.go

@@ -397,6 +397,13 @@ func schema_118_apis_config_v1alpha1_OIDCProviderConfigSpec(ref common.Reference
 							Format:      "",
 						},
 					},
+					"secretName": {
+						SchemaProps: spec.SchemaProps{
+							Description: "SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider. SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside the cluster using a LoadBalancer Service), and is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 				},
 				Required: []string{"issuer"},
 			},

generated/1.18/crds/config.pinniped.dev_oidcproviderconfigs.yaml

@@ -49,6 +49,17 @@ spec:
                   for more information."
                 minLength: 1
                 type: string
+              secretName:
+                description: SecretName is an optional name of a Secret in the same
+                  namespace, of type `kubernetes.io/tls`, which contains the TLS serving
+                  certificate for the HTTPS endpoints served by this OIDC Provider.
+                  SecretName is required if you would like to use the HTTPS endpoints
+                  (e.g. when exposing them outside the cluster using a LoadBalancer
+                  Service), and is not required when you would like to use only the
+                  HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS
+                  secret must contain keys named `tls.crt` and `tls.key` that contain
+                  the certificate and private key to use for TLS.
+                type: string
             required:
             - issuer
             type: object

generated/1.19/README.adoc

@@ -132,6 +132,7 @@ OIDCProviderConfigSpec is a struct that describes an OIDC Provider.
 | Field | Description
 | *`issuer`* __string__ | Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the identifier that it will use for the iss claim in issued JWTs. This field will also be used as the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is https://example.com/foo, then your authorization endpoint will look like https://example.com/foo/some/path/to/auth/endpoint). 
  See https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
+| *`secretName`* __string__ | SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider. SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside the cluster using a LoadBalancer Service), and is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.
 |===
 
 

generated/1.19/apis/config/v1alpha1/types_oidcproviderconfig.go

@@ -12,9 +12,10 @@ import (
 type OIDCProviderStatus string
 
 const (
-	SuccessOIDCProviderStatus   = OIDCProviderStatus("Success")
-	DuplicateOIDCProviderStatus = OIDCProviderStatus("Duplicate")
-	InvalidOIDCProviderStatus   = OIDCProviderStatus("Invalid")
+	SuccessOIDCProviderStatus                         = OIDCProviderStatus("Success")
+	DuplicateOIDCProviderStatus                       = OIDCProviderStatus("Duplicate")
+	SameIssuerHostMustUseSameSecretOIDCProviderStatus = OIDCProviderStatus("SameIssuerHostMustUseSameSecret")
+	InvalidOIDCProviderStatus                         = OIDCProviderStatus("Invalid")
 )
 
 // OIDCProviderConfigSpec is a struct that describes an OIDC Provider.
@@ -29,6 +30,15 @@ type OIDCProviderConfigSpec struct {
 	// https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
 	// +kubebuilder:validation:MinLength=1
 	Issuer string `json:"issuer"`
+
+	// SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`,
+	// which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider.
+	// SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside
+	// the cluster using a LoadBalancer Service), and is not required when you would like to use only the
+	// HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named
+	// `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.
+	// +optional
+	SecretName string `json:"secretName,omitempty"`
 }
 
 // OIDCProviderConfigStatus is a struct that describes the actual state of an OIDC Provider.

generated/1.19/client/openapi/zz_generated.openapi.go

@@ -398,6 +398,13 @@ func schema_119_apis_config_v1alpha1_OIDCProviderConfigSpec(ref common.Reference
 							Format:      "",
 						},
 					},
+					"secretName": {
+						SchemaProps: spec.SchemaProps{
+							Description: "SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider. SecretName is required if you would like to use the HTTPS endpoints (e.g. when exposing them outside the cluster using a LoadBalancer Service), and is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS secret must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 				},
 				Required: []string{"issuer"},
 			},

generated/1.19/crds/config.pinniped.dev_oidcproviderconfigs.yaml

@@ -49,6 +49,17 @@ spec:
                   for more information."
                 minLength: 1
                 type: string
+              secretName:
+                description: SecretName is an optional name of a Secret in the same
+                  namespace, of type `kubernetes.io/tls`, which contains the TLS serving
+                  certificate for the HTTPS endpoints served by this OIDC Provider.
+                  SecretName is required if you would like to use the HTTPS endpoints
+                  (e.g. when exposing them outside the cluster using a LoadBalancer
+                  Service), and is not required when you would like to use only the
+                  HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS
+                  secret must contain keys named `tls.crt` and `tls.key` that contain
+                  the certificate and private key to use for TLS.
+                type: string
             required:
             - issuer
             type: object