Merge pull request #2069 from vmware-tanzu/dial_probes_with_proxy

Dial probes with proxy
2026-09-18 22:14:22 +00:00 · 2024-10-15 12:42:00 -07:00
parent 7a41b74ac1 c235239ee7
commit 4b1577ab70
22 changed files with 935 additions and 248 deletions
@@ -33,8 +33,8 @@ replace github.com/hashicorp/go-retryablehttp => github.com/hashicorp/go-retryab

 require (
 	github.com/MakeNowJust/heredoc/v2 v2.0.1
-	github.com/chromedp/cdproto v0.0.0-20241003230502-a4a8f7c660df
-	github.com/chromedp/chromedp v0.10.0
+	github.com/chromedp/cdproto v0.0.0-20241014181340-cb3a7a1d51d7
+	github.com/chromedp/chromedp v0.11.0
 	github.com/coreos/go-oidc/v3 v3.11.0
 	github.com/coreos/go-semver v0.3.1
 	github.com/creack/pty v1.1.23
@@ -64,7 +64,7 @@ require (
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
-	github.com/tdewolff/minify/v2 v2.20.37
+	github.com/tdewolff/minify/v2 v2.21.0
 	go.uber.org/mock v0.4.0
 	go.uber.org/zap v1.27.0
 	golang.org/x/crypto v0.28.0
@@ -162,7 +162,7 @@ require (
 	github.com/spf13/viper v1.16.0 // indirect
 	github.com/stoewer/go-strcase v1.2.0 // indirect
 	github.com/subosito/gotenv v1.4.2 // indirect
-	github.com/tdewolff/parse/v2 v2.7.15 // indirect
+	github.com/tdewolff/parse/v2 v2.7.17 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.etcd.io/etcd/api/v3 v3.5.14 // indirect
 	go.etcd.io/etcd/client/pkg/v3 v3.5.14 // indirect
@@ -64,11 +64,11 @@ github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chromedp/cdproto v0.0.0-20240801214329-3f85d328b335/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
-github.com/chromedp/cdproto v0.0.0-20241003230502-a4a8f7c660df h1:cbtSn19AtqQha1cxmP2Qvgd3fFMz51AeAEKLJMyEUhc=
 github.com/chromedp/cdproto v0.0.0-20241003230502-a4a8f7c660df/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
-github.com/chromedp/chromedp v0.10.0 h1:bRclRYVpMm/UVD76+1HcRW9eV3l58rFfy7AdBvKab1E=
-github.com/chromedp/chromedp v0.10.0/go.mod h1:ei/1ncZIqXX1YnAYDkxhD4gzBgavMEUu7JCKvztdomE=
+github.com/chromedp/cdproto v0.0.0-20241014181340-cb3a7a1d51d7 h1:VDBgUGgdCBw9lTKwp0KPExhnqmGfGVJQTER2MehoICk=
+github.com/chromedp/cdproto v0.0.0-20241014181340-cb3a7a1d51d7/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
+github.com/chromedp/chromedp v0.11.0 h1:1PT6O4g39sBAFjlljIHTpxmCSk8meeYL6+R+oXH4bWA=
+github.com/chromedp/chromedp v0.11.0/go.mod h1:jsD7OHrX0Qmskqb5Y4fn4jHnqquqW22rkMFgKbECsqg=
 github.com/chromedp/sysutil v1.0.0 h1:+ZxhTpfpZlmchB58ih/LBHX52ky7w2VhQVKQMucy3Ic=
 github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moAV0xufSww=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
@@ -560,10 +560,10 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
-github.com/tdewolff/minify/v2 v2.20.37 h1:Q97cx4STXCh1dlWDlNHZniE8BJ2EBL0+2b0n92BJQhw=
-github.com/tdewolff/minify/v2 v2.20.37/go.mod h1:L1VYef/jwKw6Wwyk5A+T0mBjjn3mMPgmjjA688RNsxU=
-github.com/tdewolff/parse/v2 v2.7.15 h1:hysDXtdGZIRF5UZXwpfn3ZWRbm+ru4l53/ajBRGpCTw=
-github.com/tdewolff/parse/v2 v2.7.15/go.mod h1:3FbJWZp3XT9OWVN3Hmfp0p/a08v4h8J9W1aghka0soA=
+github.com/tdewolff/minify/v2 v2.21.0 h1:nAPP1UVx0aK1xsQh/JiG3xyEnnqWw+agPstn+V6Pkto=
+github.com/tdewolff/minify/v2 v2.21.0/go.mod h1:hGcthJ6Vj51NG+9QRIfN/DpWj5loHnY3bfhThzWWq08=
+github.com/tdewolff/parse/v2 v2.7.17 h1:uC10p6DaQQORDy72eaIyD+AvAkaIUOouQ0nWp4uD0D0=
+github.com/tdewolff/parse/v2 v2.7.17/go.mod h1:3FbJWZp3XT9OWVN3Hmfp0p/a08v4h8J9W1aghka0soA=
 github.com/tdewolff/test v1.0.11-0.20231101010635-f1265d231d52/go.mod h1:6DAvZliBAAnD7rhVgwaM7DE5/d9NMOAJ09SqYqeK4QE=
 github.com/tdewolff/test v1.0.11-0.20240106005702-7de5f7df4739 h1:IkjBCtQOOjIn03u/dMQK9g+Iw9ewps4mCl1nB8Sscbo=
 github.com/tdewolff/test v1.0.11-0.20240106005702-7de5f7df4739/go.mod h1:XPuWBzvdUzhCuxWO1ojpXsyzsA5bFoS3tO/Q3kFuTG8=
@@ -851,7 +851,6 @@ golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
 golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
@@ -34,7 +34,7 @@ clean_kind=no
 api_group_suffix="pinniped.dev" # same default as in the values.yaml ytt file
 dockerfile_path=""
 get_active_directory_vars="" # specify a filename for a script to get AD related env variables
-get_github_vars="" # specify a filename for a script to get GitHub related env variables
+get_github_vars=""           # specify a filename for a script to get GitHub related env variables
 alternate_deploy="undefined"
 pre_install="undefined"

@@ -319,6 +319,15 @@ service_https_nodeport_nodeport: $service_https_nodeport_nodeport
 service_https_clusterip_port: $service_https_clusterip_port
 EOF

+if [[ "${FIREWALL_IDPS:-no}" == "yes" ]]; then
+  # Configure the web proxy on the Supervisor pods. Note that .svc and .cluster.local are not included,
+  # so requests for things like dex.tools.svc.cluster.local will go through the web proxy.
+  cat <<EOF >>"$data_values_file"
+https_proxy: "http://proxy.tools.svc.cluster.local:3128"
+no_proxy: "\$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost"
+EOF
+fi
+
 if [ "$alternate_deploy" != "undefined" ]; then
  log_note "The Pinniped Supervisor will be deployed with $alternate_deploy pinniped-supervisor $tag $registry_with_port $repo $data_values_file ..."
  $alternate_deploy pinniped-supervisor "$tag" $registry_with_port $repo $data_values_file
@@ -338,7 +347,7 @@ manifest=/tmp/pinniped-concierge.yaml
 data_values_file=/tmp/concierge-values.yml
 concierge_app_name="pinniped-concierge"
 concierge_namespace="concierge"
-webhook_url="https://local-user-authenticator.local-user-authenticator.svc/authenticate"
+webhook_url="https://local-user-authenticator.local-user-authenticator.svc.cluster.local/authenticate"
 discovery_url="$(TERM=dumb kubectl cluster-info | awk '/master|control plane/ {print $NF}')"
 concierge_custom_labels="{myConciergeCustomLabelName: myConciergeCustomLabelValue}"
 log_level="debug"
@@ -354,6 +363,16 @@ image_tag: $tag
 discovery_url: $discovery_url
 EOF

+if [[ "${FIREWALL_IDPS:-no}" == "yes" ]]; then
+  # Configure the web proxy on the Concierge pods. Note that .svc and .cluster.local are not included,
+  # so requests for things like pinniped-supervisor-clusterip.supervisor.svc.cluster.local and
+  # local-user-authenticator.local-user-authenticator.svc.cluster.local will go through the web proxy.
+  cat <<EOF >>"$data_values_file"
+https_proxy: "http://proxy.tools.svc.cluster.local:3128"
+no_proxy: "\$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost"
+EOF
+fi
+
 if [ "$alternate_deploy" != "undefined" ]; then
  log_note "The Pinniped Concierge will be deployed with $alternate_deploy pinniped-concierge $tag $registry_with_port $repo $data_values_file ..."
  $alternate_deploy pinniped-concierge "$tag" $registry_with_port $repo $data_values_file
@@ -366,6 +385,77 @@ else
  popd >/dev/null
 fi

+#
+# Now that the everything is deployed, optionally firewall the Dex server, the local user authenticator server,
+# and the GitHub API so that the Supervisor and Concierge cannot reach them directly. However, the Squid
+# proxy server can reach them all, so the Supervisor and Concierge can reach them through the proxy.
+#
+if [[ "${FIREWALL_IDPS:-no}" == "yes" ]]; then
+  log_note "Setting up firewalls for the Supervisor and Concierge's outgoing TCP/UDP network traffic..."
+  cat <<EOF | kubectl apply --wait -f -
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: supervisor-cannot-make-external-requests
+  namespace: ${supervisor_namespace}
+spec:
+  # An empty podSelector matches all pods in this namespace.
+  podSelector: {}
+  policyTypes:
+    - Egress
+  # This is an allow list. Everything else disallowed.
+  # Especially note that it cannot access Dex or the GitHub API directly.
+  egress:
+  - to:
+    # Allowed to make requests to all pods in kube-system for DNS and Kube API.
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    # Allowed to make requests to the LDAP server in tools, because we cannot use
+    # an HTTP proxy for the LDAP protocol, since LDAP is not over HTTP.
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: tools
+      podSelector:
+        matchLabels:
+          app: ldap
+    # Allowed to make requests to the Squid proxy server in the tools namespace.
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: tools
+      podSelector:
+        matchLabels:
+          app: proxy
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: concierge-cannot-make-external-requests
+  namespace: ${concierge_namespace}
+spec:
+  # An empty podSelector matches all pods in this namespace.
+  podSelector: {}
+  policyTypes:
+    - Egress
+  # This is an allow list. Everything else disallowed.
+  # Especially note that it cannot access the local user authenticator or Supervisor directly.
+  egress:
+  - to:
+    # Allowed to make requests to all pods in kube-system for DNS and Kube API.
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    # Allowed to make requests to the Squid proxy server in the tools namespace.
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: tools
+      podSelector:
+        matchLabels:
+          app: proxy
+EOF
+fi
+
 #
 # Create a test user in the local-user-authenticator and get its CA bundle.
 #
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash

-# Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+# Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0

 #
@@ -50,7 +50,7 @@ kind: WebhookAuthenticator
 metadata:
  name: local-user-authenticator
 spec:
-  endpoint: https://local-user-authenticator.local-user-authenticator.svc/authenticate
+  endpoint: https://local-user-authenticator.local-user-authenticator.svc.cluster.local/authenticate
  tls:
    certificateAuthorityData: $LOCAL_USER_AUTHENTICATOR_CA
 EOF
@@ -119,7 +119,8 @@ func (c *certsManagerController) Sync(ctx controllerlib.Context) error {
 	// Using the CA from above, create a TLS server cert if we have service name.
 	if len(c.serviceNameForGeneratedCertCommonName) != 0 {
 		serviceEndpoint := c.serviceNameForGeneratedCertCommonName + "." + c.namespace + ".svc"
-		tlsCert, err := ca.IssueServerCert([]string{serviceEndpoint}, nil, c.certDuration)
+		// Allow clients to use either service-name.namespace.svc or service-name.namespace.svc.cluster.local to verify TLS.
+		tlsCert, err := ca.IssueServerCert([]string{serviceEndpoint, serviceEndpoint + ".cluster.local"}, nil, c.certDuration)
 		if err != nil {
 			return fmt.Errorf("could not issue serving certificate: %w", err)
 		}
@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 package apicerts
@@ -225,6 +225,7 @@ func TestManagerControllerSync(t *testing.T) {
 				// Validate the created cert using the CA, and also validate the cert's hostname
 				validCert := testutil.ValidateServerCertificate(t, actualCACert, actualCertChain)
 				validCert.RequireDNSName("pinniped-api." + installedInNamespace + ".svc")
+				validCert.RequireDNSName("pinniped-api." + installedInNamespace + ".svc.cluster.local")
 				validCert.RequireLifetime(time.Now(), time.Now().Add(certDuration), 6*time.Minute)
 				validCert.RequireMatchesPrivateKey(actualPrivateKey)
 			})
@@ -39,6 +39,7 @@ import (
 	"go.pinniped.dev/internal/endpointaddr"
 	"go.pinniped.dev/internal/kubeclient"
 	"go.pinniped.dev/internal/plog"
+	"go.pinniped.dev/internal/proxydetect"
 )

 const (
@@ -49,10 +50,12 @@ const (
 	typeEndpointURLValid       = "EndpointURLValid"
 	typeAuthenticatorValid     = "AuthenticatorValid"

-	reasonUnableToCreateClient       = "UnableToCreateClient"
-	reasonUnableToInstantiateWebhook = "UnableToInstantiateWebhook"
-	reasonInvalidEndpointURL         = "InvalidEndpointURL"
-	reasonInvalidEndpointURLScheme   = "InvalidEndpointURLScheme"
+	reasonUnableToCreateClient                = "UnableToCreateClient"
+	reasonUnableToInstantiateWebhook          = "UnableToInstantiateWebhook"
+	reasonInvalidEndpointURL                  = "InvalidEndpointURL"
+	reasonInvalidEndpointURLScheme            = "InvalidEndpointURLScheme"
+	reasonInvalidEndpointCannotDetermineProxy = "InvalidEndpointCannotDetermineProxy"
+	reasonUnableToDialServer                  = "UnableToDialServer"
 )

 type cachedWebhookAuthenticator struct {
@@ -77,6 +80,7 @@ func New(
 	clock clock.Clock,
 	log plog.Logger,
 	dialer ptls.Dialer,
+	proxyDetector proxydetect.ProxyDetect,
 ) controllerlib.Controller {
 	return controllerlib.New(
 		controllerlib.Config{
@@ -91,6 +95,7 @@ func New(
 				clock:             clock,
 				log:               log.WithName(controllerName),
 				dialer:            dialer,
+				proxyDetector:     proxyDetector,
 			},
 		},
 		withInformer(
@@ -127,6 +132,7 @@ type webhookCacheFillerController struct {
 	clock             clock.Clock
 	log               plog.Logger
 	dialer            ptls.Dialer
+	proxyDetector     proxydetect.ProxyDetect
 }

 // Sync implements controllerlib.Syncer.
@@ -173,7 +179,7 @@ func (c *webhookCacheFillerController) syncIndividualWebhookAuthenticator(ctx co

 	caBundle, conditions, tlsBundleOk := c.validateTLSBundle(webhookAuthenticator.Spec.TLS, conditions)

-	endpointHostPort, conditions, endpointOk := c.validateEndpoint(webhookAuthenticator.Spec.Endpoint, conditions)
+	endpointHostPort, conditions, usingProxyForHost, endpointOk := c.validateEndpoint(webhookAuthenticator.Spec.Endpoint, conditions)
 	okSoFar := tlsBundleOk && endpointOk

 	// Only revalidate and update the cache if the cached authenticator is different from the desired authenticator.
@@ -194,12 +200,14 @@ func (c *webhookCacheFillerController) syncIndividualWebhookAuthenticator(ctx co
 		// if they need to be updated.
 		logger.Info("cached webhook authenticator and desired webhook authenticator are the same: already cached, so skipping validations")
 		conditions = append(conditions,
-			successfulWebhookConnectionValidCondition(),
+			successfulWebhookConnectionValidCondition(usingProxyForHost),
 			successfulAuthenticatorValidCondition(),
 		)
 	} else {
 		// Run all remaining validations.
-		a, moreConditions, moreErrs := c.doExpensiveValidations(ctx, webhookAuthenticator, endpointHostPort, caBundle, okSoFar, logger)
+		a, moreConditions, moreErrs := c.doExpensiveValidations(
+			ctx, webhookAuthenticator, endpointHostPort, caBundle, okSoFar, usingProxyForHost, logger,
+		)
 		newWebhookAuthenticatorForCache = a
 		conditions = append(conditions, moreConditions...)
 		errs = append(errs, moreErrs...)
@@ -243,13 +251,14 @@ func (c *webhookCacheFillerController) doExpensiveValidations(
 	endpointHostPort *endpointaddr.HostPort,
 	caBundle *tlsconfigutil.CABundle,
 	okSoFar bool,
+	usingProxyForHost bool,
 	logger plog.Logger,
 ) (*cachedWebhookAuthenticator, []*metav1.Condition, []error) {
 	var newWebhookAuthenticatorForCache *cachedWebhookAuthenticator
 	var conditions []*metav1.Condition
 	var errs []error

-	conditions, tlsNegotiateErr := c.validateConnection(ctx, caBundle.CertPool(), endpointHostPort, conditions, okSoFar, logger)
+	conditions, tlsNegotiateErr := c.validateConnection(ctx, caBundle.CertPool(), endpointHostPort, conditions, okSoFar, usingProxyForHost, logger)
 	errs = append(errs, tlsNegotiateErr)
 	okSoFar = okSoFar && tlsNegotiateErr == nil

@@ -405,12 +414,16 @@ func newWebhookAuthenticator(
 	return webhookAuthenticator, conditions, nil
 }

-func successfulWebhookConnectionValidCondition() *metav1.Condition {
+func successfulWebhookConnectionValidCondition(usingProxyForHost bool) *metav1.Condition {
+	msg := "successfully dialed webhook server"
+	if usingProxyForHost {
+		msg = "skipped dialing connection probe because HTTPS_PROXY is configured for use with the specified host"
+	}
 	return &metav1.Condition{
 		Type:    typeWebhookConnectionValid,
 		Status:  metav1.ConditionTrue,
 		Reason:  conditionsutil.ReasonSuccess,
-		Message: "successfully dialed webhook server",
+		Message: msg,
 	}
 }

@@ -420,6 +433,7 @@ func (c *webhookCacheFillerController) validateConnection(
 	endpointHostPort *endpointaddr.HostPort,
 	conditions []*metav1.Condition,
 	prereqOk bool,
+	usingProxyForHost bool,
 	logger plog.Logger,
 ) ([]*metav1.Condition, error) {
 	if !prereqOk {
@@ -432,6 +446,13 @@ func (c *webhookCacheFillerController) validateConnection(
 		return conditions, nil
 	}

+	if usingProxyForHost {
+		// We cannot assume that we can directly dial the host in the case where we should
+		// be using a web proxy to reach the host, so skip the dial probe in that case.
+		conditions = append(conditions, successfulWebhookConnectionValidCondition(usingProxyForHost))
+		return conditions, nil
+	}
+
 	dialCtx, dialCancel := context.WithTimeout(ctx, 30*time.Second)
 	defer dialCancel()
 	err := c.dialer.IsReachableAndTLSValidationSucceeds(dialCtx, endpointHostPort.Endpoint(), certPool, logger)
@@ -442,17 +463,17 @@ func (c *webhookCacheFillerController) validateConnection(
 		conditions = append(conditions, &metav1.Condition{
 			Type:    typeWebhookConnectionValid,
 			Status:  metav1.ConditionFalse,
-			Reason:  conditionsutil.ReasonUnableToDialServer,
+			Reason:  reasonUnableToDialServer,
 			Message: msg,
 		})
 		return conditions, fmt.Errorf("%s: %w", errText, err)
 	}

-	conditions = append(conditions, successfulWebhookConnectionValidCondition())
+	conditions = append(conditions, successfulWebhookConnectionValidCondition(usingProxyForHost))
 	return conditions, nil
 }

-func (c *webhookCacheFillerController) validateEndpoint(endpoint string, conditions []*metav1.Condition) (*endpointaddr.HostPort, []*metav1.Condition, bool) {
+func (c *webhookCacheFillerController) validateEndpoint(endpoint string, conditions []*metav1.Condition) (*endpointaddr.HostPort, []*metav1.Condition, bool, bool) {
 	endpointURL, err := url.Parse(endpoint)
 	if err != nil {
 		msg := fmt.Sprintf("%s: %s", "spec.endpoint URL cannot be parsed", err.Error())
@@ -462,7 +483,7 @@ func (c *webhookCacheFillerController) validateEndpoint(endpoint string, conditi
 			Reason:  reasonInvalidEndpointURL,
 			Message: msg,
 		})
-		return nil, conditions, false
+		return nil, conditions, false, false
 	}

 	// handles empty string and other issues as well.
@@ -474,7 +495,7 @@ func (c *webhookCacheFillerController) validateEndpoint(endpoint string, conditi
 			Reason:  reasonInvalidEndpointURLScheme,
 			Message: msg,
 		})
-		return nil, conditions, false
+		return nil, conditions, false, false
 	}

 	endpointHostPort, err := endpointaddr.ParseFromURL(endpointURL, 443)
@@ -486,7 +507,19 @@ func (c *webhookCacheFillerController) validateEndpoint(endpoint string, conditi
 			Reason:  reasonInvalidEndpointURL,
 			Message: msg,
 		})
-		return nil, conditions, false
+		return nil, conditions, false, false
+	}
+
+	usingProxyForHost, err := c.proxyDetector.UsingProxyForHost(endpointHostPort.Endpoint())
+	if err != nil {
+		msg := fmt.Sprintf("%s: %s", "spec.endpoint URL error", err.Error())
+		conditions = append(conditions, &metav1.Condition{
+			Type:    typeEndpointURLValid,
+			Status:  metav1.ConditionFalse,
+			Reason:  reasonInvalidEndpointCannotDetermineProxy,
+			Message: msg,
+		})
+		return nil, conditions, false, false
 	}

 	conditions = append(conditions, &metav1.Condition{
@@ -495,7 +528,7 @@ func (c *webhookCacheFillerController) validateEndpoint(endpoint string, conditi
 		Reason:  conditionsutil.ReasonSuccess,
 		Message: "spec.endpoint is a valid URL",
 	})
-	return &endpointHostPort, conditions, true
+	return &endpointHostPort, conditions, usingProxyForHost, true
 }

 func (c *webhookCacheFillerController) updateStatus(
@@ -44,8 +44,10 @@ import (
 	"go.pinniped.dev/internal/crypto/ptls"
 	"go.pinniped.dev/internal/mocks/mockcachevalue"
 	"go.pinniped.dev/internal/plog"
+	"go.pinniped.dev/internal/proxydetect"
 	"go.pinniped.dev/internal/testutil"
 	"go.pinniped.dev/internal/testutil/conditionstestutil"
+	"go.pinniped.dev/internal/testutil/fakeproxydetect"
 	"go.pinniped.dev/internal/testutil/tlsserver"
 )

@@ -302,6 +304,11 @@ func TestController(t *testing.T) {
 			Message:            "successfully dialed webhook server",
 		}
 	}
+	happyWebhookConnectionValidWithoutDialingDueToProxy := func(time metav1.Time, observedGeneration int64) metav1.Condition {
+		c := happyWebhookConnectionValid(time, observedGeneration)
+		c.Message = "skipped dialing connection probe because HTTPS_PROXY is configured for use with the specified host"
+		return c
+	}
 	unknownWebhookConnectionValid := func(time metav1.Time, observedGeneration int64) metav1.Condition {
 		return metav1.Condition{
 			Type:               "WebhookConnectionValid",
@@ -373,7 +380,16 @@ func TestController(t *testing.T) {
 			Message:            fmt.Sprintf(`spec.endpoint URL %s has invalid scheme, require 'https'`, endpoint),
 		}
 	}
-
+	sadEndpointURLValidProxyDetectErr := func(msg string, time metav1.Time, observedGeneration int64) metav1.Condition {
+		return metav1.Condition{
+			Type:               "EndpointURLValid",
+			Status:             "False",
+			ObservedGeneration: observedGeneration,
+			LastTransitionTime: time,
+			Reason:             "InvalidEndpointCannotDetermineProxy",
+			Message:            msg,
+		}
+	}
 	sadEndpointURLValidWithMessage := func(time metav1.Time, observedGeneration int64, msg string) metav1.Condition {
 		return metav1.Condition{
 			Type:               "EndpointURLValid",
@@ -412,10 +428,11 @@ func TestController(t *testing.T) {
 		webhookAuthenticators []runtime.Object
 		secretsAndConfigMaps  []runtime.Object
 		// for modifying the clients to hack in arbitrary api responses
-		configClient func(*conciergefake.Clientset)
-		wantSyncErr  testutil.RequireErrorStringFunc
-		wantLogLines []string
-		wantActions  func() []coretesting.Action
+		configClient  func(*conciergefake.Clientset)
+		proxyDetector func(t *testing.T) proxydetect.ProxyDetect
+		wantSyncErr   testutil.RequireErrorStringFunc
+		wantLogLines  []string
+		wantActions   func() []coretesting.Action
 		// random comment so lines above don't have huge indents
 		wantNamesOfWebhookAuthenticatorsInCache []string
 	}{
@@ -1011,6 +1028,83 @@ func TestController(t *testing.T) {
 			},
 			wantNamesOfWebhookAuthenticatorsInCache: []string{"test-name"}, // keeps the old entry in the cache
 		},
+		{
+			name: "Sync: previously cached valid authenticator with unchanged endpoint URL and CA bundle hash has invalid status conditions in informer cache, as can happen on subsequent sync soon after multiple quick status updates (when the informer cache finally catches up), and the webhook host would be reached through a proxy: should update status in current sync",
+			cache: func(t *testing.T, cache *authncache.Cache) {
+				oldCA, err := base64.StdEncoding.DecodeString(goodWebhookAuthenticatorSpecWithCA.TLS.CertificateAuthorityData)
+				require.NoError(t, err)
+				cache.Store(
+					authncache.Key{
+						Name:     "test-name",
+						Kind:     "WebhookAuthenticator",
+						APIGroup: authenticationv1alpha1.SchemeGroupVersion.Group,
+					},
+					newCacheValue(t, goodWebhookAuthenticatorSpecWithCA, string(oldCA)),
+				)
+			},
+			webhookAuthenticators: []runtime.Object{
+				&authenticationv1alpha1.WebhookAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:       "test-name",
+						Generation: 1234,
+					},
+					Spec: goodWebhookAuthenticatorSpecWithCA,
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
+						Conditions: conditionstestutil.Replace(
+							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
+							[]metav1.Condition{
+								sadTLSConfigurationValid(frozenMetav1Now, 0),
+								unknownWebhookConnectionValid(frozenMetav1Now, 0),
+								unknownAuthenticatorValid(frozenMetav1Now, 0),
+								sadReadyCondition(frozenMetav1Now, 0),
+							},
+						),
+						Phase: "Error",
+					},
+				},
+			},
+			proxyDetector: func(t *testing.T) proxydetect.ProxyDetect {
+				// Detect that a proxy is required for the webhook host.
+				fakeProxyDetect := fakeproxydetect.New(true, nil)
+				t.Cleanup(func() {
+					require.Equal(t, 1, fakeProxyDetect.NumberOfInvocations())
+					require.Equal(t,
+						strings.TrimPrefix(goodWebhookAuthenticatorSpecWithCA.Endpoint, "https://"),
+						fakeProxyDetect.ReceivedHostDuringMostRecentInvocation(),
+					)
+				})
+				return fakeProxyDetect
+			},
+			wantLogLines: []string{
+				fmt.Sprintf(`{"level":"info","timestamp":"2099-08-08T13:57:36.123456Z","logger":"webhookcachefiller-controller","caller":"webhookcachefiller/webhookcachefiller.go:<line>$webhookcachefiller.(*webhookCacheFillerController).syncIndividualWebhookAuthenticator","message":"cached webhook authenticator and desired webhook authenticator are the same: already cached, so skipping validations","webhookAuthenticator":"test-name","endpoint":"%s"}`, goodWebhookAuthenticatorSpecWithCA.Endpoint),
+				fmt.Sprintf(`{"level":"debug","timestamp":"2099-08-08T13:57:36.123456Z","logger":"webhookcachefiller-controller","caller":"webhookcachefiller/webhookcachefiller.go:<line>$webhookcachefiller.(*webhookCacheFillerController).updateStatus","message":"webhookauthenticator status successfully updated","webhookAuthenticator":"test-name","endpoint":"%s","phase":"Ready"}`, goodWebhookAuthenticatorSpecWithCA.Endpoint),
+			},
+			wantActions: func() []coretesting.Action {
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:       "test-name",
+						Generation: 1234,
+					},
+					Spec: goodWebhookAuthenticatorSpecWithCA,
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{ // updates the status to ready
+						Conditions: conditionstestutil.Replace(
+							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 1234),
+							[]metav1.Condition{
+								happyWebhookConnectionValidWithoutDialingDueToProxy(frozenMetav1Now, 1234),
+							},
+						),
+						Phase: "Ready",
+					},
+				})
+				updateStatusAction.Subresource = "status"
+				return []coretesting.Action{
+					coretesting.NewListAction(webhookAuthenticatorGVR, webhookAuthenticatorGVK, "", metav1.ListOptions{}),
+					coretesting.NewWatchAction(webhookAuthenticatorGVR, "", metav1.ListOptions{}),
+					updateStatusAction,
+				}
+			},
+			wantNamesOfWebhookAuthenticatorsInCache: []string{"test-name"}, // keeps the old entry in the cache
+		},
 		{
 			name: "Sync: valid WebhookAuthenticator with CA: will complete sync loop successfully with success conditions and ready phase",
 			webhookAuthenticators: []runtime.Object{
@@ -1021,6 +1115,18 @@ func TestController(t *testing.T) {
 					Spec: goodWebhookAuthenticatorSpecWithCA,
 				},
 			},
+			proxyDetector: func(t *testing.T) proxydetect.ProxyDetect {
+				// Detect that a proxy is not required for the webhook host.
+				fakeProxyDetect := fakeproxydetect.New(false, nil)
+				t.Cleanup(func() {
+					require.Equal(t, 1, fakeProxyDetect.NumberOfInvocations())
+					require.Equal(t,
+						strings.TrimPrefix(goodWebhookAuthenticatorSpecWithCA.Endpoint, "https://"),
+						fakeProxyDetect.ReceivedHostDuringMostRecentInvocation(),
+					)
+				})
+				return fakeProxyDetect
+			},
 			wantLogLines: []string{
 				fmt.Sprintf(`{"level":"debug","timestamp":"2099-08-08T13:57:36.123456Z","logger":"webhookcachefiller-controller","caller":"webhookcachefiller/webhookcachefiller.go:<line>$webhookcachefiller.(*webhookCacheFillerController).updateStatus","message":"webhookauthenticator status successfully updated","webhookAuthenticator":"test-name","endpoint":"%s","phase":"Ready"}`, goodWebhookDefaultServingCertEndpoint),
 				fmt.Sprintf(`{"level":"info","timestamp":"2099-08-08T13:57:36.123456Z","logger":"webhookcachefiller-controller","caller":"webhookcachefiller/webhookcachefiller.go:<line>$webhookcachefiller.(*webhookCacheFillerController).syncIndividualWebhookAuthenticator","message":"added or updated webhook authenticator in cache","webhookAuthenticator":"test-name","endpoint":"%s","isOverwrite":false}`, goodWebhookDefaultServingCertEndpoint),
@@ -1045,6 +1151,110 @@ func TestController(t *testing.T) {
 			},
 			wantNamesOfWebhookAuthenticatorsInCache: []string{"test-name"},
 		},
+		{
+			name: "Sync: valid WebhookAuthenticator when webhook host will use web proxy: will complete sync loop successfully with success conditions and ready phase",
+			webhookAuthenticators: []runtime.Object{
+				&authenticationv1alpha1.WebhookAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "test-name",
+					},
+					Spec: goodWebhookAuthenticatorSpecWithCA,
+				},
+			},
+			proxyDetector: func(t *testing.T) proxydetect.ProxyDetect {
+				// Detect that a proxy is required for the webhook host.
+				fakeProxyDetect := fakeproxydetect.New(true, nil)
+				t.Cleanup(func() {
+					require.Equal(t, 1, fakeProxyDetect.NumberOfInvocations())
+					require.Equal(t,
+						strings.TrimPrefix(goodWebhookAuthenticatorSpecWithCA.Endpoint, "https://"),
+						fakeProxyDetect.ReceivedHostDuringMostRecentInvocation(),
+					)
+				})
+				return fakeProxyDetect
+			},
+			wantLogLines: []string{
+				fmt.Sprintf(`{"level":"debug","timestamp":"2099-08-08T13:57:36.123456Z","logger":"webhookcachefiller-controller","caller":"webhookcachefiller/webhookcachefiller.go:<line>$webhookcachefiller.(*webhookCacheFillerController).updateStatus","message":"webhookauthenticator status successfully updated","webhookAuthenticator":"test-name","endpoint":"%s","phase":"Ready"}`, goodWebhookDefaultServingCertEndpoint),
+				fmt.Sprintf(`{"level":"info","timestamp":"2099-08-08T13:57:36.123456Z","logger":"webhookcachefiller-controller","caller":"webhookcachefiller/webhookcachefiller.go:<line>$webhookcachefiller.(*webhookCacheFillerController).syncIndividualWebhookAuthenticator","message":"added or updated webhook authenticator in cache","webhookAuthenticator":"test-name","endpoint":"%s","isOverwrite":false}`, goodWebhookDefaultServingCertEndpoint),
+			},
+			wantActions: func() []coretesting.Action {
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "test-name",
+					},
+					Spec: goodWebhookAuthenticatorSpecWithCA,
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
+						Conditions: conditionstestutil.Replace(
+							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
+							[]metav1.Condition{
+								happyWebhookConnectionValidWithoutDialingDueToProxy(frozenMetav1Now, 0),
+							},
+						),
+						Phase: "Ready",
+					},
+				})
+				updateStatusAction.Subresource = "status"
+				return []coretesting.Action{
+					coretesting.NewListAction(webhookAuthenticatorGVR, webhookAuthenticatorGVK, "", metav1.ListOptions{}),
+					coretesting.NewWatchAction(webhookAuthenticatorGVR, "", metav1.ListOptions{}),
+					updateStatusAction,
+				}
+			},
+			wantNamesOfWebhookAuthenticatorsInCache: []string{"test-name"},
+		},
+		{
+			name: "Sync: valid WebhookAuthenticator when error while checking if webhook host will use web proxy: will complete sync loop successfully with error conditions and error phase",
+			webhookAuthenticators: []runtime.Object{
+				&authenticationv1alpha1.WebhookAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "test-name",
+					},
+					Spec: goodWebhookAuthenticatorSpecWithCA,
+				},
+			},
+			proxyDetector: func(t *testing.T) proxydetect.ProxyDetect {
+				// Return a fake error when trying to determine if a proxy is needed for the webhook host.
+				fakeProxyDetect := fakeproxydetect.New(false, errors.New("fake proxy detector error"))
+				t.Cleanup(func() {
+					require.Equal(t, 1, fakeProxyDetect.NumberOfInvocations())
+					require.Equal(t,
+						strings.TrimPrefix(goodWebhookAuthenticatorSpecWithCA.Endpoint, "https://"),
+						fakeProxyDetect.ReceivedHostDuringMostRecentInvocation(),
+					)
+				})
+				return fakeProxyDetect
+			},
+			wantLogLines: []string{
+				fmt.Sprintf(`{"level":"info","timestamp":"2099-08-08T13:57:36.123456Z","logger":"webhookcachefiller-controller","caller":"webhookcachefiller/webhookcachefiller.go:<line>$webhookcachefiller.(*webhookCacheFillerController).syncIndividualWebhookAuthenticator","message":"invalid webhook authenticator","webhookAuthenticator":"test-name","endpoint":"%s","removedFromCache":false}`, goodWebhookDefaultServingCertEndpoint),
+				fmt.Sprintf(`{"level":"debug","timestamp":"2099-08-08T13:57:36.123456Z","logger":"webhookcachefiller-controller","caller":"webhookcachefiller/webhookcachefiller.go:<line>$webhookcachefiller.(*webhookCacheFillerController).updateStatus","message":"webhookauthenticator status successfully updated","webhookAuthenticator":"test-name","endpoint":"%s","phase":"Error"}`, goodWebhookDefaultServingCertEndpoint),
+			},
+			wantActions: func() []coretesting.Action {
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "test-name",
+					},
+					Spec: goodWebhookAuthenticatorSpecWithCA,
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
+						Conditions: conditionstestutil.Replace(
+							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
+							[]metav1.Condition{
+								sadEndpointURLValidProxyDetectErr("spec.endpoint URL error: fake proxy detector error", frozenMetav1Now, 0),
+								unknownWebhookConnectionValid(frozenMetav1Now, 0),
+								unknownAuthenticatorValid(frozenMetav1Now, 0),
+								sadReadyCondition(frozenMetav1Now, 0),
+							},
+						),
+						Phase: "Error",
+					},
+				})
+				updateStatusAction.Subresource = "status"
+				return []coretesting.Action{
+					coretesting.NewListAction(webhookAuthenticatorGVR, webhookAuthenticatorGVK, "", metav1.ListOptions{}),
+					coretesting.NewWatchAction(webhookAuthenticatorGVR, "", metav1.ListOptions{}),
+					updateStatusAction,
+				}
+			},
+		},
 		{
 			name: "Sync: valid WebhookAuthenticator with IPV6 and CA: will complete sync loop successfully with success conditions and ready phase",
 			webhookAuthenticators: []runtime.Object{
@@ -1925,6 +2135,13 @@ func TestController(t *testing.T) {
 				tt.cache(t, cache)
 			}

+			if tt.proxyDetector == nil {
+				// By default, detect that a proxy is not required for any webhook hosts.
+				tt.proxyDetector = func(t *testing.T) proxydetect.ProxyDetect {
+					return fakeproxydetect.New(false, nil)
+				}
+			}
+
 			controller := New(
 				"concierge", // namespace for controller
 				cache,
@@ -1935,7 +2152,9 @@ func TestController(t *testing.T) {
 				controllerlib.WithInformer,
 				frozenClock,
 				logger,
-				ptls.NewDialer())
+				ptls.NewDialer(),
+				tt.proxyDetector(t),
+			)

 			ctx, cancel := context.WithCancel(context.Background())
 			defer cancel()
@@ -2179,7 +2398,9 @@ func TestControllerFilterSecret(t *testing.T) {
 				observableInformers.WithInformer,
 				frozenClock,
 				logger,
-				ptls.NewDialer())
+				ptls.NewDialer(),
+				fakeproxydetect.New(false, nil),
+			)

 			unrelated := &corev1.Secret{}
 			filter := observableInformers.GetFilterForInformer(secretInformer)
@@ -2241,7 +2462,9 @@ func TestControllerFilterConfigMap(t *testing.T) {
 				observableInformers.WithInformer,
 				frozenClock,
 				logger,
-				ptls.NewDialer())
+				ptls.NewDialer(),
+				fakeproxydetect.New(false, nil),
+			)

 			unrelated := &corev1.ConfigMap{}
 			filter := observableInformers.GetFilterForInformer(configMapInformer)
@@ -15,11 +15,10 @@ import (

 // Some common reasons and messages shared by conditions of various resources.
 const (
-	ReasonSuccess            = "Success"
-	ReasonNotReady           = "NotReady"
-	ReasonUnableToValidate   = "UnableToValidate"
-	ReasonUnableToDialServer = "UnableToDialServer"
-	ReasonInvalidIssuerURL   = "InvalidIssuerURL"
+	ReasonSuccess          = "Success"
+	ReasonNotReady         = "NotReady"
+	ReasonUnableToValidate = "UnableToValidate"
+	ReasonInvalidIssuerURL = "InvalidIssuerURL"

 	MessageUnableToValidate = "unable to validate; see other conditions for details"
 )
@@ -33,7 +33,6 @@ import (
 	"go.pinniped.dev/internal/controller/supervisorconfig/upstreamwatchers"
 	"go.pinniped.dev/internal/controller/tlsconfigutil"
 	"go.pinniped.dev/internal/controllerlib"
-	"go.pinniped.dev/internal/crypto/ptls"
 	"go.pinniped.dev/internal/endpointaddr"
 	"go.pinniped.dev/internal/federationdomain/upstreamprovider"
 	"go.pinniped.dev/internal/net/phttp"
@@ -58,11 +57,19 @@ const (
 	GitHubConnectionValid        string = "GitHubConnectionValid"
 	ClaimsValid                  string = "ClaimsValid"

-	reasonInvalid     = "Invalid"
-	reasonInvalidHost = "InvalidHost"
+	reasonInvalid             = "Invalid"
+	reasonInvalidHost         = "InvalidHost"
+	reasonUnableToMakeRequest = "UnableToMakeRequest"

 	apiDotGithubDotCom = "api.github.com"
 	githubDotCom       = "github.com"
+
+	headerNameAPIVersion          = "X-GitHub-Api-Version"
+	headerValueAPIVersion2022     = "2022-11-28"
+	headerNameUserAgent           = "User-Agent"
+	headerValueUserAgentConcierge = "pinniped-concierge/v1"
+	headerNameAccept              = "Accept"
+	headerValueAcceptGitHubJSON   = "application/vnd.github+json"
 )

 // UpstreamGitHubIdentityProviderICache is a thread safe cache that holds a list of validated upstream GitHub IDP configurations.
@@ -107,6 +114,8 @@ func NewGitHubValidatedAPICache(cache *cache.Expiring) GitHubValidatedAPICacheI
 	return &GitHubValidatedAPICache{cache: cache}
 }

+type ProbeURLFunc func(ctx context.Context, client *http.Client, url string) error
+
 type gitHubWatcherController struct {
 	namespace                      string
 	cache                          UpstreamGitHubIdentityProviderICache
@@ -116,7 +125,7 @@ type gitHubWatcherController struct {
 	secretInformer                 corev1informers.SecretInformer
 	configMapInformer              corev1informers.ConfigMapInformer
 	clock                          clock.Clock
-	dialer                         ptls.Dialer
+	probeURLFunc                   ProbeURLFunc
 	validatedCache                 GitHubValidatedAPICacheI
 }

@@ -131,7 +140,7 @@ func New(
 	log plog.Logger,
 	withInformer pinnipedcontroller.WithInformerOptionFunc,
 	clock clock.Clock,
-	dialer ptls.Dialer,
+	probeURLFunc ProbeURLFunc,
 	validatedCache *cache.Expiring,
 ) controllerlib.Controller {
 	c := gitHubWatcherController{
@@ -143,7 +152,7 @@ func New(
 		secretInformer:                 secretInformer,
 		configMapInformer:              configMapInformer,
 		clock:                          clock,
-		dialer:                         dialer,
+		probeURLFunc:                   probeURLFunc,
 		validatedCache:                 NewGitHubValidatedAPICache(validatedCache),
 	}

@@ -299,7 +308,7 @@ func validateOrganizationsPolicy(organizationsSpec *idpv1alpha1.GitHubOrganizati

 func (c *gitHubWatcherController) validateUpstreamAndUpdateConditions(ctx context.Context, upstream *idpv1alpha1.GitHubIdentityProvider) (
 	*upstreamgithub.Provider, // If validated, returns the config
-	error, // This error will only refer to programmatic errors such as inability to perform a Dial or dereference a pointer, not configuration errors
+	error, // This error will only refer to programmatic errors such as inability to perform a connection probe or dereference a pointer, not configuration errors
 ) {
 	conditions := make([]*metav1.Condition, 0)
 	applicationErrors := make([]error, 0)
@@ -365,7 +374,7 @@ func (c *gitHubWatcherController) validateUpstreamAndUpdateConditions(ctx contex
 		upstreamgithub.ProviderConfig{
 			Name:               upstream.Name,
 			ResourceUID:        upstream.UID,
-			APIBaseURL:         apiBaseUrl(apiHostPort),
+			APIBaseURL:         apiBaseURL(apiHostPort),
 			GroupNameAttribute: groupNameAttribute,
 			UsernameAttribute:  usernameAttribute,
 			OAuth2Config: &oauth2.Config{
@@ -388,7 +397,7 @@ func (c *gitHubWatcherController) validateUpstreamAndUpdateConditions(ctx contex
 	return provider, utilerrors.NewAggregate(applicationErrors)
 }

-func apiBaseUrl(apiHostPort *endpointaddr.HostPort) string {
+func apiBaseURL(apiHostPort *endpointaddr.HostPort) string {
 	endpoint := hostPortForHTTPS(apiHostPort)

 	if strings.ToLower(apiHostPort.Host) == apiDotGithubDotCom {
@@ -471,19 +480,33 @@ func (c *gitHubWatcherController) validateGitHubConnection(

 	apiAddress := apiHostPort.Endpoint()

-	if !c.validatedCache.IsValid(apiAddress, caBundle.Hash()) {
-		dialCtx, dialCancel := context.WithTimeout(ctx, 30*time.Second)
-		defer dialCancel()
+	// Note that this client already has some reasonable timeouts configured on it.
+	httpClient := phttp.Default(caBundle.CertPool())

-		tlsDialErr := c.dialer.IsReachableAndTLSValidationSucceeds(dialCtx, apiAddress, caBundle.CertPool(), c.log)
-		if tlsDialErr != nil {
+	if !c.validatedCache.IsValid(apiAddress, caBundle.Hash()) {
+		// In order to provide feedback on the configured host and CA bundle, probe the configured server by using
+		// a real HTTPS request, so we can also respect the pod's proxy settings during the request, if they are present.
+		// To make a real request, we need to choose a real endpoint.
+		// According to the GitHub API docs for your getting your rate limit status, "Accessing this endpoint does not
+		// count against your REST API rate limit" and you do not need to be authenticated to use this endpoint.
+		// See https://docs.github.com/en/rest/rate-limit/rate-limit?apiVersion=2022-11-28#get-rate-limit-status-for-the-authenticated-user.
+		// Note that like other APIs, the URL path is different for GitHub Enterprise Server (https://HOSTNAME/api/v3/rate_limit)
+		// versus Enterprise Cloud or Public (https://api.github.com/rate_limit).
+		// The docs also say that "Unauthenticated requests are associated with the originating IP address" and
+		// "The primary rate limit for unauthenticated requests is 60 requests per hour."
+		// So we'll use this endpoint in hopes that we can avoid impacting the rate limit for our originating IP,
+		// which could potentially be shared with other apps.
+		rateLimitAPIURL := fmt.Sprintf("%s/rate_limit", apiBaseURL(apiHostPort))
+
+		err := c.probeURLFunc(ctx, httpClient, rateLimitAPIURL)
+		if err != nil {
 			return &metav1.Condition{
 				Type:   GitHubConnectionValid,
 				Status: metav1.ConditionFalse,
-				Reason: conditionsutil.ReasonUnableToDialServer,
-				Message: fmt.Sprintf("cannot dial %q for spec.githubAPI.host (%q): %s",
-					apiAddress, *specifiedHost, buildDialErrorMessage(tlsDialErr)),
-			}, nil, tlsDialErr
+				Reason: reasonUnableToMakeRequest,
+				Message: fmt.Sprintf("cannot make connection probe request for spec.githubAPI.host (%q): %s",
+					*specifiedHost, buildProbeErrorMessage(err)),
+			}, nil, err
 		}
 	}

@@ -493,18 +516,49 @@ func (c *gitHubWatcherController) validateGitHubConnection(
 		Type:   GitHubConnectionValid,
 		Status: metav1.ConditionTrue,
 		Reason: conditionsutil.ReasonSuccess,
-		Message: fmt.Sprintf("dialed %q for spec.githubAPI.host (%q): host is reachable and TLS verification succeeds",
+		Message: fmt.Sprintf("probed connection to %q for spec.githubAPI.host (%q): host is reachable and TLS verification succeeds",
 			apiAddress, *specifiedHost),
-	}, phttp.Default(caBundle.CertPool()), nil
+	}, httpClient, nil
 }

-// buildDialErrorMessage standardizes DNS error messages that appear differently on different platforms, so that tests and log grepping is uniform.
-func buildDialErrorMessage(tlsDialErr error) string {
-	reason := tlsDialErr.Error()
+// ProbeURL is the production code for how to probe a GitHub URL to test our connection to the GitHub API.
+// It can be replaced via constructor injection for testing. Implements ProbeURLFunc.
+func ProbeURL(ctx context.Context, client *http.Client, url string) error {
+	probeRequestCtx, probeRequestCancel := context.WithTimeout(ctx, 30*time.Second)
+	defer probeRequestCancel()
+
+	probeRequest, err := http.NewRequestWithContext(probeRequestCtx, http.MethodGet, url, nil)
+	if err != nil {
+		// Shouldn't really get here as long as the URL is valid.
+		return err
+	}
+
+	// GitHub API docs say that these headers are required for all requests.
+	// See https://docs.github.com/en/rest/using-the-rest-api/getting-started-with-the-rest-api?apiVersion=2022-11-28#headers.
+	probeRequest.Header.Set(headerNameAPIVersion, headerValueAPIVersion2022)
+	probeRequest.Header.Set(headerNameUserAgent, headerValueUserAgentConcierge)
+	probeRequest.Header.Set(headerNameAccept, headerValueAcceptGitHubJSON)
+
+	probeResponse, err := client.Do(probeRequest)
+	if err != nil {
+		return err
+	}
+
+	// Don't care what the response was, even if it was an error status, as long as we were able to connect
+	// successfully to the specified host using the specified CA bundle and the pod's proxy env var settings.
+	_ = probeResponse.Body.Close()
+
+	return nil
+}
+
+// buildProbeErrorMessage standardizes DNS error messages that appear differently on different platforms,
+// so that tests and log grepping is uniform.
+func buildProbeErrorMessage(err error) string {
+	reason := err.Error()

 	var opError *net.OpError
 	var dnsError *net.DNSError
-	if errors.As(tlsDialErr, &opError) && errors.As(tlsDialErr, &dnsError) {
+	if errors.As(err, &opError) && errors.As(err, &dnsError) {
 		dnsError.Server = ""
 		opError.Err = dnsError
 		return opError.Error()
@@ -40,7 +40,6 @@ import (
 	"go.pinniped.dev/internal/controller/supervisorconfig/upstreamwatchers"
 	"go.pinniped.dev/internal/controller/tlsconfigutil"
 	"go.pinniped.dev/internal/controllerlib"
-	"go.pinniped.dev/internal/crypto/ptls"
 	"go.pinniped.dev/internal/federationdomain/dynamicupstreamprovider"
 	"go.pinniped.dev/internal/federationdomain/upstreamprovider"
 	"go.pinniped.dev/internal/net/phttp"
@@ -61,32 +60,55 @@ var (
 	githubIDPKind = idpv1alpha1.SchemeGroupVersion.WithKind("GitHubIdentityProvider")
 )

-type fakeGithubDialer struct {
-	t            *testing.T
-	realAddress  string
-	realCertPool *x509.CertPool
+func fakeGithubProbeFuncProbesOtherAddress(t *testing.T, realAddress string) ProbeURLFunc {
+	return func(ctx context.Context, client *http.Client, url string) error {
+		t.Helper()
+		require.Equal(t, "https://api.github.com/rate_limit", url)
+		r, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "https://"+realAddress+"/rate_limit", nil)
+		require.NoError(t, err)
+		resp, err := client.Do(r)
+		_ = resp.Body.Close()
+		return err
+	}
 }

-func (f fakeGithubDialer) IsReachableAndTLSValidationSucceeds(ctx context.Context, address string, _ *x509.CertPool, logger plog.Logger) error {
-	require.Equal(f.t, "api.github.com:443", address)
-
-	return ptls.NewDialer().IsReachableAndTLSValidationSucceeds(ctx, f.realAddress, f.realCertPool, logger)
+func fakeGithubProbeFuncDisallowsAllProbes(t *testing.T) ProbeURLFunc {
+	return func(ctx context.Context, client *http.Client, url string) error {
+		t.Helper()
+		t.Errorf("this test should not perform any connection probe")
+		t.FailNow()
+		return nil
+	}
 }

-var _ ptls.Dialer = (*fakeGithubDialer)(nil)
+// TestProbeURL tests the production version of the ProbeURLFunc type.
+func TestProbeURL(t *testing.T) {
+	serverEndpointReached := false
+	testServer, testServerCA := tlsserver.TestServerIPv4(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		require.Equal(t, []string{"2022-11-28"}, r.Header.Values("X-GitHub-Api-Version"))
+		require.Equal(t, []string{"pinniped-concierge/v1"}, r.Header.Values("User-Agent"))
+		require.Equal(t, []string{"application/vnd.github+json"}, r.Header.Values("Accept"))
+		serverEndpointReached = true
+	}), nil)

-type allowNoDials struct {
-	t *testing.T
+	testServerCertPool := x509.NewCertPool()
+	testServerCertPool.AppendCertsFromPEM(testServerCA)
+	httpClient := phttp.Default(testServerCertPool)
+
+	// Happy path.
+	err := ProbeURL(context.Background(), httpClient, testServer.URL)
+	require.NoError(t, err)
+	require.True(t, serverEndpointReached)
+
+	// Invalid URL.
+	err = ProbeURL(context.Background(), httpClient, "https://invalid hostname")
+	require.EqualError(t, err, `parse "https://invalid hostname": invalid character " " in host name`)
+
+	// Did not trust server's CA, as an example of a failed connection.
+	err = ProbeURL(context.Background(), phttp.Default(nil), testServer.URL)
+	require.EqualError(t, err, fmt.Sprintf("Get %q: tls: failed to verify certificate: x509: certificate signed by unknown authority", testServer.URL))
 }

-func (f allowNoDials) IsReachableAndTLSValidationSucceeds(_ context.Context, _ string, _ *x509.CertPool, _ plog.Logger) error {
-	f.t.Errorf("this test should not perform dial")
-	f.t.FailNow()
-	return nil
-}
-
-var _ ptls.Dialer = (*allowNoDials)(nil)
-
 func TestController(t *testing.T) {
 	require.Equal(t, 6, countExpectedConditions)

@@ -215,8 +237,6 @@ func TestController(t *testing.T) {
 	}

 	buildHostValidTrue := func(t *testing.T, host string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               HostValid,
 			Status:             metav1.ConditionTrue,
@@ -228,8 +248,6 @@ func TestController(t *testing.T) {
 	}

 	buildHostValidFalse := func(t *testing.T, host, message string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               HostValid,
 			Status:             metav1.ConditionFalse,
@@ -240,8 +258,6 @@ func TestController(t *testing.T) {
 		}
 	}
 	buildTLSConfigurationValidTrueWithMsg := func(t *testing.T, msg string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               TLSConfigurationValid,
 			Status:             metav1.ConditionTrue,
@@ -253,13 +269,10 @@ func TestController(t *testing.T) {
 	}

 	buildTLSConfigurationValidTrue := func(t *testing.T) metav1.Condition {
-		t.Helper()
 		return buildTLSConfigurationValidTrueWithMsg(t, "using configured CA bundle")
 	}

 	buildTLSConfigurationValidFalse := func(t *testing.T, message string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               TLSConfigurationValid,
 			Status:             metav1.ConditionFalse,
@@ -271,8 +284,6 @@ func TestController(t *testing.T) {
 	}

 	buildOrganizationsPolicyValidTrue := func(t *testing.T, policy idpv1alpha1.GitHubAllowedAuthOrganizationsPolicy) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               OrganizationsPolicyValid,
 			Status:             metav1.ConditionTrue,
@@ -284,8 +295,6 @@ func TestController(t *testing.T) {
 	}

 	buildOrganizationsPolicyValidFalse := func(t *testing.T, message string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               OrganizationsPolicyValid,
 			Status:             metav1.ConditionFalse,
@@ -297,8 +306,6 @@ func TestController(t *testing.T) {
 	}

 	buildClientCredentialsSecretValidTrue := func(t *testing.T, secretName string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               ClientCredentialsSecretValid,
 			Status:             metav1.ConditionTrue,
@@ -310,8 +317,6 @@ func TestController(t *testing.T) {
 	}

 	buildClientCredentialsSecretValidFalse := func(t *testing.T, prefix, secretName, namespace, reason string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               ClientCredentialsSecretValid,
 			Status:             metav1.ConditionFalse,
@@ -328,8 +333,6 @@ func TestController(t *testing.T) {
 	}

 	buildClaimsValidatedTrue := func(t *testing.T) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               ClaimsValid,
 			Status:             metav1.ConditionTrue,
@@ -341,8 +344,6 @@ func TestController(t *testing.T) {
 	}

 	buildClaimsValidatedFalse := func(t *testing.T, message string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               ClaimsValid,
 			Status:             metav1.ConditionFalse,
@@ -353,35 +354,29 @@ func TestController(t *testing.T) {
 		}
 	}

-	buildGitHubConnectionValidTrue := func(t *testing.T, hostDialed string, hostSpecified string) metav1.Condition {
-		t.Helper()
-
+	buildGitHubConnectionValidTrue := func(t *testing.T, hostProbed string, hostSpecified string) metav1.Condition {
 		return metav1.Condition{
 			Type:               GitHubConnectionValid,
 			Status:             metav1.ConditionTrue,
 			ObservedGeneration: wantObservedGeneration,
 			LastTransitionTime: wantLastTransitionTime,
 			Reason:             conditionsutil.ReasonSuccess,
-			Message:            fmt.Sprintf("dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds", hostDialed, hostSpecified),
+			Message:            fmt.Sprintf("probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds", hostProbed, hostSpecified),
 		}
 	}

 	buildGitHubConnectionValidFalse := func(t *testing.T, message string) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               GitHubConnectionValid,
 			Status:             metav1.ConditionFalse,
 			ObservedGeneration: wantObservedGeneration,
 			LastTransitionTime: wantLastTransitionTime,
-			Reason:             "UnableToDialServer",
+			Reason:             "UnableToMakeRequest",
 			Message:            message,
 		}
 	}

 	buildGitHubConnectionValidUnknown := func(t *testing.T) metav1.Condition {
-		t.Helper()
-
 		return metav1.Condition{
 			Type:               GitHubConnectionValid,
 			Status:             metav1.ConditionUnknown,
@@ -416,8 +411,12 @@ func TestController(t *testing.T) {
 		return fmt.Sprintf(`{"level":"info","timestamp":"2099-08-08T13:57:36.123456Z","logger":"github-upstream-observer","caller":"conditionsutil/conditions_util.go:<line>$conditionsutil.MergeConditions","message":"updated condition","namespace":"some-namespace","name":"%s","type":"TLSConfigurationValid","status":"%s","reason":"%s","message":"%s"}`, name, status, reason, message)
 	}

-	buildLogForUpdatingGitHubConnectionValid := func(name, status, reason, messageFmt, dialHost, specHost string) string {
-		return fmt.Sprintf(`{"level":"info","timestamp":"2099-08-08T13:57:36.123456Z","logger":"github-upstream-observer","caller":"conditionsutil/conditions_util.go:<line>$conditionsutil.MergeConditions","message":"updated condition","namespace":"some-namespace","name":"%s","type":"GitHubConnectionValid","status":"%s","reason":"%s","message":"%s"}`, name, status, reason, fmt.Sprintf(messageFmt, dialHost, specHost))
+	buildLogForUpdatingGitHubConnectionValid := func(name, status, reason, messageFmt, probedHost, specHost string) string {
+		return fmt.Sprintf(`{"level":"info","timestamp":"2099-08-08T13:57:36.123456Z","logger":"github-upstream-observer","caller":"conditionsutil/conditions_util.go:<line>$conditionsutil.MergeConditions","message":"updated condition","namespace":"some-namespace","name":"%s","type":"GitHubConnectionValid","status":"%s","reason":"%s","message":"%s"}`, name, status, reason, fmt.Sprintf(messageFmt, probedHost, specHost))
+	}
+
+	buildLogForUpdatingGitHubConnectionInvalid := func(name, msg string) string {
+		return fmt.Sprintf(`{"level":"info","timestamp":"2099-08-08T13:57:36.123456Z","logger":"github-upstream-observer","caller":"conditionsutil/conditions_util.go:<line>$conditionsutil.MergeConditions","message":"updated condition","namespace":"some-namespace","name":"%s","type":"GitHubConnectionValid","status":"%s","reason":"%s","message":"%s"}`, name, "False", "UnableToMakeRequest", msg)
 	}

 	buildLogForUpdatingGitHubConnectionValidUnknown := func(name string) string {
@@ -432,7 +431,7 @@ func TestController(t *testing.T) {
 		name                      string
 		githubIdentityProviders   []runtime.Object
 		secretsAndConfigMaps      []runtime.Object
-		mockDialer                func(*testing.T) ptls.Dialer
+		mockProbeURLFunc          func(t *testing.T) ProbeURLFunc
 		preexistingValidatedCache []GitHubValidatedAPICacheKey
 		wantErr                   string
 		wantLogs                  []string
@@ -504,7 +503,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Ready"),
 			},
 		},
@@ -566,7 +565,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validMinimalIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validMinimalIDP.Spec.GitHubAPI.Host, *validMinimalIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validMinimalIDP.Spec.GitHubAPI.Host, *validMinimalIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("minimal-idp-name", "Ready"),
 			},
 		},
@@ -581,14 +580,8 @@ func TestController(t *testing.T) {
 					return githubIDP
 				}(),
 			},
-			mockDialer: func(t *testing.T) ptls.Dialer {
-				t.Helper()
-
-				return &fakeGithubDialer{
-					t:            t,
-					realAddress:  goodServerDomain,
-					realCertPool: goodServerCertPool,
-				}
+			mockProbeURLFunc: func(t *testing.T) ProbeURLFunc {
+				return fakeGithubProbeFuncProbesOtherAddress(t, goodServerDomain)
 			},
 			wantResultingCache: []*upstreamgithub.ProviderConfig{
 				{
@@ -647,7 +640,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, "github.com"),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "github.com"),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "github.com"),
 				buildLogForUpdatingPhase("minimal-idp-name", "Ready"),
 			},
 		},
@@ -662,14 +655,8 @@ func TestController(t *testing.T) {
 					return githubIDP
 				}(),
 			},
-			mockDialer: func(t *testing.T) ptls.Dialer {
-				t.Helper()
-
-				return &fakeGithubDialer{
-					t:            t,
-					realAddress:  goodServerDomain,
-					realCertPool: goodServerCertPool,
-				}
+			mockProbeURLFunc: func(t *testing.T) ProbeURLFunc {
+				return fakeGithubProbeFuncProbesOtherAddress(t, goodServerDomain)
 			},
 			wantResultingCache: []*upstreamgithub.ProviderConfig{
 				{
@@ -728,7 +715,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, "GitHub.com"),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "GitHub.com"),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "GitHub.com"),
 				buildLogForUpdatingPhase("minimal-idp-name", "Ready"),
 			},
 		},
@@ -743,14 +730,8 @@ func TestController(t *testing.T) {
 					return githubIDP
 				}(),
 			},
-			mockDialer: func(t *testing.T) ptls.Dialer {
-				t.Helper()
-
-				return &fakeGithubDialer{
-					t:            t,
-					realAddress:  goodServerDomain,
-					realCertPool: goodServerCertPool,
-				}
+			mockProbeURLFunc: func(t *testing.T) ProbeURLFunc {
+				return fakeGithubProbeFuncProbesOtherAddress(t, goodServerDomain)
 			},
 			wantResultingCache: []*upstreamgithub.ProviderConfig{
 				{
@@ -809,7 +790,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, "api.github.com"),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "api.github.com"),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "api.github.com"),
 				buildLogForUpdatingPhase("minimal-idp-name", "Ready"),
 			},
 		},
@@ -824,14 +805,8 @@ func TestController(t *testing.T) {
 					return githubIDP
 				}(),
 			},
-			mockDialer: func(t *testing.T) ptls.Dialer {
-				t.Helper()
-
-				return &fakeGithubDialer{
-					t:            t,
-					realAddress:  goodServerDomain,
-					realCertPool: goodServerCertPool,
-				}
+			mockProbeURLFunc: func(t *testing.T) ProbeURLFunc {
+				return fakeGithubProbeFuncProbesOtherAddress(t, goodServerDomain)
 			},
 			wantResultingCache: []*upstreamgithub.ProviderConfig{
 				{
@@ -890,7 +865,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, "github.com:443"),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "github.com:443"),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "github.com:443"),
 				buildLogForUpdatingPhase("minimal-idp-name", "Ready"),
 			},
 		},
@@ -905,14 +880,8 @@ func TestController(t *testing.T) {
 					return githubIDP
 				}(),
 			},
-			mockDialer: func(t *testing.T) ptls.Dialer {
-				t.Helper()
-
-				return &fakeGithubDialer{
-					t:            t,
-					realAddress:  goodServerDomain,
-					realCertPool: goodServerCertPool,
-				}
+			mockProbeURLFunc: func(t *testing.T) ProbeURLFunc {
+				return fakeGithubProbeFuncProbesOtherAddress(t, goodServerDomain)
 			},
 			wantResultingCache: []*upstreamgithub.ProviderConfig{
 				{
@@ -971,7 +940,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, "api.GitHub.com:443"),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "api.GitHub.com:443"),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, "api.github.com:443", "api.GitHub.com:443"),
 				buildLogForUpdatingPhase("minimal-idp-name", "Ready"),
 			},
 		},
@@ -1048,7 +1017,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, goodServerIPv6Domain),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, goodServerIPv6Domain, goodServerIPv6Domain),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, goodServerIPv6Domain, goodServerIPv6Domain),
 				buildLogForUpdatingPhase("minimal-idp-name", "Ready"),
 			},
 		},
@@ -1208,7 +1177,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("invalid-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("invalid-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("invalid-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("invalid-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("invalid-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("invalid-idp-name", "Error"),

 				buildLogForUpdatingClientCredentialsSecretValid("other-idp-name", "True", "Success", `clientID and clientSecret have been read from spec.client.SecretName (\"other-secret-name\")`),
@@ -1216,7 +1185,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("other-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("other-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("other-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("other-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("other-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("other-idp-name", "Ready"),

 				buildLogForUpdatingClientCredentialsSecretValid("some-idp-name", "True", "Success", fmt.Sprintf(`clientID and clientSecret have been read from spec.client.SecretName (\"%s\")`, validFilledOutIDP.Spec.Client.SecretName)),
@@ -1224,7 +1193,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Ready"),
 			},
 		},
@@ -1379,7 +1348,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("idp-with-tls-in-config-map", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("idp-with-tls-in-config-map", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("idp-with-tls-in-config-map", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("idp-with-tls-in-config-map", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("idp-with-tls-in-config-map", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("idp-with-tls-in-config-map", "Ready"),

 				buildLogForUpdatingClientCredentialsSecretValid("idp-with-tls-in-secret", "True", "Success", fmt.Sprintf(`clientID and clientSecret have been read from spec.client.SecretName (\"%s\")`, validFilledOutIDP.Spec.Client.SecretName)),
@@ -1387,7 +1356,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("idp-with-tls-in-secret", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("idp-with-tls-in-secret", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("idp-with-tls-in-secret", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("idp-with-tls-in-secret", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("idp-with-tls-in-secret", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("idp-with-tls-in-secret", "Ready"),
 			},
 		},
@@ -1395,11 +1364,7 @@ func TestController(t *testing.T) {
 			name:                    "happy path with previously validated address/CA Bundle does not validate again",
 			secretsAndConfigMaps:    []runtime.Object{goodClientCredentialsSecret},
 			githubIdentityProviders: []runtime.Object{validFilledOutIDP},
-			mockDialer: func(t *testing.T) ptls.Dialer {
-				t.Helper()
-
-				return &allowNoDials{t: t}
-			},
+			mockProbeURLFunc:        fakeGithubProbeFuncDisallowsAllProbes,
 			preexistingValidatedCache: []GitHubValidatedAPICacheKey{
 				{
 					address:      goodServerDomain,
@@ -1458,7 +1423,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Ready"),
 			},
 		},
@@ -1777,7 +1742,7 @@ func TestController(t *testing.T) {
 						Conditions: []metav1.Condition{
 							buildClaimsValidatedTrue(t),
 							buildClientCredentialsSecretValidTrue(t, validMinimalIDP.Spec.Client.SecretName),
-							buildGitHubConnectionValidFalse(t, fmt.Sprintf(`cannot dial "%s" for spec.githubAPI.host (%q): dial tcp: lookup nowhere.bad-tld: no such host`, "nowhere.bad-tld:443", "nowhere.bad-tld")),
+							buildGitHubConnectionValidFalse(t, fmt.Sprintf(`cannot make connection probe request for spec.githubAPI.host (%q): dial tcp: lookup nowhere.bad-tld: no such host`, "nowhere.bad-tld")),
 							buildHostValidTrue(t, "nowhere.bad-tld"),
 							buildOrganizationsPolicyValidTrue(t, *validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy),
 							buildTLSConfigurationValidTrue(t),
@@ -1791,7 +1756,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, "nowhere.bad-tld"),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "False", "UnableToDialServer", `cannot dial \"%s\" for spec.githubAPI.host (\"%s\"): dial tcp: lookup nowhere.bad-tld: no such host`, "nowhere.bad-tld:443", "nowhere.bad-tld"),
+				buildLogForUpdatingGitHubConnectionInvalid("minimal-idp-name", fmt.Sprintf(`cannot make connection probe request for spec.githubAPI.host (\"%s\"): dial tcp: lookup nowhere.bad-tld: no such host`, "nowhere.bad-tld")),
 				buildLogForUpdatingPhase("minimal-idp-name", "Error"),
 			},
 		},
@@ -1860,7 +1825,7 @@ func TestController(t *testing.T) {
 						Conditions: []metav1.Condition{
 							buildClaimsValidatedTrue(t),
 							buildClientCredentialsSecretValidTrue(t, validFilledOutIDP.Spec.Client.SecretName),
-							buildGitHubConnectionValidFalse(t, fmt.Sprintf(`cannot dial "%s" for spec.githubAPI.host (%q): tls: failed to verify certificate: x509: certificate signed by unknown authority`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host)),
+							buildGitHubConnectionValidFalse(t, fmt.Sprintf(`cannot make connection probe request for spec.githubAPI.host (%q): Get %q: tls: failed to verify certificate: x509: certificate signed by unknown authority`, *validFilledOutIDP.Spec.GitHubAPI.Host, fmt.Sprintf("https://%s/api/v3/rate_limit", *validFilledOutIDP.Spec.GitHubAPI.Host))),
 							buildHostValidTrue(t, *validFilledOutIDP.Spec.GitHubAPI.Host),
 							buildOrganizationsPolicyValidTrue(t, *validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy),
 							buildTLSConfigurationValidTrueWithMsg(t, "no TLS configuration provided: using default root CA bundle from container image"),
@@ -1874,7 +1839,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: no TLS configuration provided: using default root CA bundle from container image"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "False", "UnableToDialServer", `cannot dial \"%s\" for spec.githubAPI.host (\"%s\"): tls: failed to verify certificate: x509: certificate signed by unknown authority`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionInvalid("some-idp-name", fmt.Sprintf(`cannot make connection probe request for spec.githubAPI.host (\"%s\"): Get \"%s\": tls: failed to verify certificate: x509: certificate signed by unknown authority`, *validFilledOutIDP.Spec.GitHubAPI.Host, fmt.Sprintf("https://%s/api/v3/rate_limit", *validFilledOutIDP.Spec.GitHubAPI.Host))),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -1906,7 +1871,7 @@ func TestController(t *testing.T) {
 						Conditions: []metav1.Condition{
 							buildClaimsValidatedTrue(t),
 							buildClientCredentialsSecretValidTrue(t, validFilledOutIDP.Spec.Client.SecretName),
-							buildGitHubConnectionValidFalse(t, fmt.Sprintf(`cannot dial "%s" for spec.githubAPI.host (%q): tls: failed to verify certificate: x509: certificate signed by unknown authority`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host)),
+							buildGitHubConnectionValidFalse(t, fmt.Sprintf(`cannot make connection probe request for spec.githubAPI.host (%q): Get %q: tls: failed to verify certificate: x509: certificate signed by unknown authority`, *validFilledOutIDP.Spec.GitHubAPI.Host, fmt.Sprintf("https://%s/api/v3/rate_limit", *validFilledOutIDP.Spec.GitHubAPI.Host))),
 							buildHostValidTrue(t, *validFilledOutIDP.Spec.GitHubAPI.Host),
 							buildOrganizationsPolicyValidTrue(t, *validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy),
 							buildTLSConfigurationValidTrue(t),
@@ -1920,7 +1885,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "False", "UnableToDialServer", `cannot dial \"%s\" for spec.githubAPI.host (\"%s\"): tls: failed to verify certificate: x509: certificate signed by unknown authority`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionInvalid("some-idp-name", fmt.Sprintf(`cannot make connection probe request for spec.githubAPI.host (\"%s\"): Get \"%s\": tls: failed to verify certificate: x509: certificate signed by unknown authority`, *validFilledOutIDP.Spec.GitHubAPI.Host, fmt.Sprintf("https://%s/api/v3/rate_limit", *validFilledOutIDP.Spec.GitHubAPI.Host))),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -1961,7 +1926,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "False", "Invalid", "spec.allowAuthentication.organizations.policy must be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed has organizations listed"),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -2002,7 +1967,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "False", "Invalid", "spec.allowAuthentication.organizations.policy must be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed has organizations listed"),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -2043,7 +2008,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "False", "Invalid", "spec.allowAuthentication.organizations.policy must be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed has organizations listed"),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -2084,7 +2049,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "False", "Invalid", "spec.allowAuthentication.organizations.policy must be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed is empty"),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -2125,7 +2090,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -2166,7 +2131,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -2207,7 +2172,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -2248,7 +2213,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("some-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validFilledOutIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("some-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("some-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("some-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("some-idp-name", "Error"),
 			},
 		},
@@ -2291,7 +2256,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("minimal-idp-name", "Error"),
 			},
 		},
@@ -2334,7 +2299,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validMinimalIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validMinimalIDP.Spec.GitHubAPI.Host, *validMinimalIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validMinimalIDP.Spec.GitHubAPI.Host, *validMinimalIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("minimal-idp-name", "Error"),
 			},
 		},
@@ -2377,7 +2342,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("minimal-idp-name", "Error"),
 			},
 		},
@@ -2420,7 +2385,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validMinimalIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validMinimalIDP.Spec.GitHubAPI.Host, *validMinimalIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validMinimalIDP.Spec.GitHubAPI.Host, *validMinimalIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("minimal-idp-name", "Error"),
 			},
 		},
@@ -2463,7 +2428,7 @@ func TestController(t *testing.T) {
 				buildLogForUpdatingOrganizationPolicyValid("minimal-idp-name", "True", "Success", fmt.Sprintf(`spec.allowAuthentication.organizations.policy (\"%s\") is valid`, string(*validMinimalIDP.Spec.AllowAuthentication.Organizations.Policy))),
 				buildLogForUpdatingHostValid("minimal-idp-name", "True", "Success", `spec.githubAPI.host (\"%s\") is valid`, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingTLSConfigurationValid("minimal-idp-name", "True", "Success", "spec.githubAPI.tls is valid: using configured CA bundle"),
-				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `dialed \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
+				buildLogForUpdatingGitHubConnectionValid("minimal-idp-name", "True", "Success", `probed connection to \"%s\" for spec.githubAPI.host (\"%s\"): host is reachable and TLS verification succeeds`, *validFilledOutIDP.Spec.GitHubAPI.Host, *validFilledOutIDP.Spec.GitHubAPI.Host),
 				buildLogForUpdatingPhase("minimal-idp-name", "Error"),
 			},
 		},
@@ -2491,9 +2456,9 @@ func TestController(t *testing.T) {

 			gitHubIdentityProviderInformer := supervisorInformers.IDP().V1alpha1().GitHubIdentityProviders()

-			var dialer ptls.Dialer = ptls.NewDialer()
-			if tt.mockDialer != nil {
-				dialer = tt.mockDialer(t)
+			var probeURLFunc ProbeURLFunc = ProbeURL // by default use the production code for probing a URL
+			if tt.mockProbeURLFunc != nil {
+				probeURLFunc = tt.mockProbeURLFunc(t)
 			}

 			validatedCache := cache.NewExpiring()
@@ -2511,7 +2476,7 @@ func TestController(t *testing.T) {
 				logger,
 				controllerlib.WithInformer,
 				frozenClockForLastTransitionTime,
-				dialer,
+				probeURLFunc,
 				validatedCache,
 			)

@@ -2722,7 +2687,7 @@ func TestController_OnlyWantActions(t *testing.T) {
 					ObservedGeneration: 333,
 					LastTransitionTime: oneHourAgo,
 					Reason:             conditionsutil.ReasonSuccess,
-					Message:            fmt.Sprintf("dialed %q for spec.githubAPI.host (%q): host is reachable and TLS verification succeeds", goodServerDomain, goodServerDomain),
+					Message:            fmt.Sprintf("probed connection to %q for spec.githubAPI.host (%q): host is reachable and TLS verification succeeds", goodServerDomain, goodServerDomain),
 				},
 				{
 					Type:               HostValid,
@@ -2834,7 +2799,7 @@ func TestController_OnlyWantActions(t *testing.T) {
 								ObservedGeneration: 1234,
 								LastTransitionTime: wantLastTransitionTime,
 								Reason:             conditionsutil.ReasonSuccess,
-								Message:            fmt.Sprintf("dialed %q for spec.githubAPI.host (%q): host is reachable and TLS verification succeeds", goodServerDomain, goodServerDomain),
+								Message:            fmt.Sprintf("probed connection to %q for spec.githubAPI.host (%q): host is reachable and TLS verification succeeds", goodServerDomain, goodServerDomain),
 							},
 							{
 								Type:               HostValid,
@@ -2894,7 +2859,7 @@ func TestController_OnlyWantActions(t *testing.T) {
 				logger,
 				controllerlib.WithInformer,
 				frozenClockForLastTransitionTime,
-				ptls.NewDialer(),
+				ProbeURL,
 				cache.NewExpiring(),
 			)

@@ -3018,7 +2983,7 @@ func TestGitHubUpstreamWatcherControllerFilterSecret(t *testing.T) {
 				logger,
 				observableInformers.WithInformer,
 				clock.RealClock{},
-				ptls.NewDialer(),
+				nil,
 				cache.NewExpiring(),
 			)

@@ -3075,7 +3040,7 @@ func TestGitHubUpstreamWatcherControllerFilterConfigMaps(t *testing.T) {
 				logger,
 				observableInformers.WithInformer,
 				clock.RealClock{},
-				ptls.NewDialer(),
+				nil,
 				cache.NewExpiring(),
 			)

@@ -3132,7 +3097,7 @@ func TestGitHubUpstreamWatcherControllerFilterGitHubIDP(t *testing.T) {
 				logger,
 				observableInformers.WithInformer,
 				clock.RealClock{},
-				ptls.NewDialer(),
+				nil,
 				cache.NewExpiring(),
 			)

@@ -36,6 +36,7 @@ import (
 	"go.pinniped.dev/internal/kubeclient"
 	"go.pinniped.dev/internal/leaderelection"
 	"go.pinniped.dev/internal/plog"
+	"go.pinniped.dev/internal/proxydetect"
 	"go.pinniped.dev/internal/tokenclient"
 )

@@ -246,6 +247,7 @@ func PrepareControllers(c *Config) (controllerinit.RunnerBuilder, error) { //nol
 				clock.RealClock{},
 				plog.New(),
 				ptls.NewDialer(),
+				proxydetect.New(),
 			),
 			singletonWorker,
 		).
@@ -0,0 +1,64 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package proxydetect
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"k8s.io/apimachinery/pkg/util/net"
+)
+
+type ProxyDetect interface {
+	// UsingProxyForHost returns true if HTTPS requests made to the specified host would be sent through a web proxy.
+	// It returns false if requests would not be sent through a proxy. It returns an error if it cannot be determined.
+	UsingProxyForHost(host string) (bool, error)
+}
+
+type detector struct {
+	// The real http.ProxyFromEnvironment func only reads the env vars once, and then never reads them again
+	// for the rest of the process's lifetime. This makes it hard to write unit tests that use the real func,
+	// because you cannot vary the env variables' values between tests, so we'll use a fake in unit tests.
+	proxyFromEnvironmentFunc func(req *http.Request) (*url.URL, error)
+}
+
+var _ ProxyDetect = (*detector)(nil)
+
+func New() ProxyDetect {
+	return &detector{
+		// Because this is intended for use with the WebhookAuthenticator, let's
+		// use the same proxy function that we use for the WebhookAuthenticator.
+		// Refer to how webhookcachefiller.go constructs the webhook authenticator,
+		// and you'll find how it sets the proxy function in kubeclient.go to be this...
+		proxyFromEnvironmentFunc: net.NewProxierWithNoProxyCIDR(http.ProxyFromEnvironment),
+	}
+}
+
+func (d *detector) UsingProxyForHost(host string) (bool, error) {
+	const msgFmt = "could not determine if requests will be proxied for host %q: %v"
+
+	// Make a request object that represents any HTTPS request to the specified server.
+	// The other parameter values don't matter, as long as they are valid, because we won't actually make this request.
+	r, err := http.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet,
+		fmt.Sprintf("https://%s", host),
+		nil,
+	)
+	if err != nil {
+		// This will return an error if the host string has an invalid format.
+		return false, fmt.Errorf(msgFmt, host, err)
+	}
+
+	// Ask if the request would use a proxy or not. This does not actually make the request.
+	proxyURL, err := d.proxyFromEnvironmentFunc(r)
+	if err != nil {
+		// This could return an error if the HTTPS_PROXY env variable's value had an invalid format, for example.
+		return false, fmt.Errorf(msgFmt, host, err)
+	}
+
+	return proxyURL != nil, nil
+}
@@ -0,0 +1,168 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package proxydetect
+
+import (
+	"errors"
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestProxyDetectWithoutMock(t *testing.T) {
+	// Setting these real env vars means that we cannot run this test in parallel.
+	t.Setenv("HTTPS_PROXY", "http://proxy.pinniped.dev")
+	t.Setenv("NO_PROXY", "1.2.3.4,1.2.3.5:3333,4.4.4.0/28,example1.pinniped.dev:8443,example2.pinniped.dev")
+
+	subject := New()
+
+	tests := []struct {
+		name        string
+		host        string
+		wantProxied bool
+		wantErr     string
+	}{
+		// This does not test all permutations of how HTTPS_PROXY and NO_PROXY work.
+		// Some basic tests to understand how these settings work are included below.
+		// See https://pkg.go.dev/golang.org/x/net/http/httpproxy for docs.
+		{
+			name:        "any host not included in NO_PROXY should use the proxy",
+			host:        "www.pinniped.dev",
+			wantProxied: true,
+		},
+		{
+			name:        "a port different from the one specified in NO_PROXY should use the proxy, for the default HTTPS port",
+			host:        "example1.pinniped.dev",
+			wantProxied: true,
+		},
+		{
+			name:        "a port different from the one specified in NO_PROXY should use the proxy, for an explicit port",
+			host:        "example1.pinniped.dev:994",
+			wantProxied: true,
+		},
+		{
+			name:        "same port as the one specified in NO_PROXY should skip the proxy",
+			host:        "example1.pinniped.dev:8443",
+			wantProxied: false,
+		},
+		{
+			name:        "any host included in NO_PROXY should skip the proxy, with default ports",
+			host:        "example2.pinniped.dev",
+			wantProxied: false,
+		},
+		{
+			name:        "an IP specified in NO_PROXY should skip the proxy",
+			host:        "1.2.3.4",
+			wantProxied: false,
+		},
+		{
+			name:        "an IP specified in NO_PROXY should skip the proxy, with matching explicit ports",
+			host:        "1.2.3.5:3333",
+			wantProxied: false,
+		},
+		{
+			name:        "an IP specified in NO_PROXY should use the proxy when the ports don't match",
+			host:        "1.2.3.5:1234",
+			wantProxied: true,
+		},
+		{
+			name:        "an IP included in a NO_PROXY CIDR should skip the proxy",
+			host:        "4.4.4.4",
+			wantProxied: false,
+		},
+		{
+			name:        "an IP outside a NO_PROXY CIDR should use the proxy",
+			host:        "4.4.4.16",
+			wantProxied: true,
+		},
+		{
+			name:        "as a special case in the Go documentation, localhost never uses the proxy, regardless of NO_PROXY settings",
+			host:        "localhost",
+			wantProxied: false,
+		},
+		{
+			name:        "a bad hostname returns an error",
+			host:        "bad hostname",
+			wantProxied: false,
+			wantErr:     `could not determine if requests will be proxied for host "bad hostname": parse "https://bad hostname": invalid character " " in host name`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			usingProxyForHost, err := subject.UsingProxyForHost(tt.host)
+			if tt.wantErr != "" {
+				require.EqualError(t, err, tt.wantErr)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tt.wantProxied, usingProxyForHost)
+		})
+	}
+}
+
+func TestProxyDetectWithMock(t *testing.T) {
+	proxyURL, err := url.Parse("http://myproxy.com")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name string
+
+		proxyFromEnvironmentReturnsURL *url.URL
+		proxyFromEnvironmentReturnsErr error
+
+		host string
+
+		wantProxied bool
+		wantErr     string
+	}{
+		{
+			name:                           "when using proxy for host",
+			proxyFromEnvironmentReturnsURL: proxyURL,
+			host:                           "example.com",
+			wantProxied:                    true,
+		},
+		{
+			name:                           "when not using proxy for host",
+			proxyFromEnvironmentReturnsURL: nil,
+			host:                           "example.com",
+			wantProxied:                    false,
+		},
+		{
+			name:                           "when ProxyFromEnvironment returns an error",
+			proxyFromEnvironmentReturnsErr: errors.New("some error"),
+			host:                           "example.com",
+			wantProxied:                    false,
+			wantErr:                        `could not determine if requests will be proxied for host "example.com": some error`,
+		},
+		{
+			name:        "invalid host",
+			host:        "invalid hostname",
+			wantProxied: false,
+			wantErr:     `could not determine if requests will be proxied for host "invalid hostname": parse "https://invalid hostname": invalid character " " in host name`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			subject := detector{proxyFromEnvironmentFunc: func(req *http.Request) (*url.URL, error) {
+				return tt.proxyFromEnvironmentReturnsURL, tt.proxyFromEnvironmentReturnsErr
+			}}
+
+			proxied, err := subject.UsingProxyForHost(tt.host)
+
+			if tt.wantErr != "" {
+				require.EqualError(t, err, tt.wantErr)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tt.wantProxied, proxied)
+		})
+	}
+}
@@ -342,7 +342,7 @@ func prepareControllers(
 				plog.New(),
 				controllerlib.WithInformer,
 				clock.RealClock{},
-				ptls.NewDialer(),
+				githubupstreamwatcher.ProbeURL,
 				cache.NewExpiring(),
 			),
 			singletonWorker).
@@ -0,0 +1,36 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package fakeproxydetect
+
+import "go.pinniped.dev/internal/proxydetect"
+
+type FakeProxyDetect struct {
+	returnBool   bool
+	returnErr    error
+	numCalls     int
+	receivedHost string
+}
+
+var _ proxydetect.ProxyDetect = (*FakeProxyDetect)(nil)
+
+func (f *FakeProxyDetect) UsingProxyForHost(host string) (bool, error) {
+	f.numCalls++
+	f.receivedHost = host
+	return f.returnBool, f.returnErr
+}
+
+func (f *FakeProxyDetect) ReceivedHostDuringMostRecentInvocation() string {
+	return f.receivedHost
+}
+
+func (f *FakeProxyDetect) NumberOfInvocations() int {
+	return f.numCalls
+}
+
+func New(returnBool bool, returnErr error) *FakeProxyDetect {
+	return &FakeProxyDetect{
+		returnBool: returnBool,
+		returnErr:  returnErr,
+	}
+}
@@ -192,7 +192,7 @@ func TestConciergeJWTAuthenticatorStatus_Parallel(t *testing.T) {
 				},
 			},
 			wantPhase: authenticationv1alpha1.JWTAuthenticatorPhaseError,
-			wantConditions: replaceSomeConditions(
+			wantConditions: replaceSomeConditions(t,
 				allSuccessfulJWTAuthenticatorConditions(true),
 				[]metav1.Condition{
 					{
@@ -242,7 +242,7 @@ func TestConciergeJWTAuthenticatorStatus_Parallel(t *testing.T) {
 				},
 			},
 			wantPhase: authenticationv1alpha1.JWTAuthenticatorPhaseError,
-			wantConditions: replaceSomeConditions(
+			wantConditions: replaceSomeConditions(t,
 				allSuccessfulJWTAuthenticatorConditions(true),
 				[]metav1.Condition{
 					{
@@ -286,7 +286,7 @@ func TestConciergeJWTAuthenticatorStatus_Parallel(t *testing.T) {
 				},
 			},
 			wantPhase: authenticationv1alpha1.JWTAuthenticatorPhaseError,
-			wantConditions: replaceSomeConditions(
+			wantConditions: replaceSomeConditions(t,
 				allSuccessfulJWTAuthenticatorConditions(len(env.SupervisorUpstreamOIDC.CABundle) != 0),
 				[]metav1.Condition{
 					{
@@ -153,22 +153,24 @@ func TestConciergeWebhookAuthenticatorStatus_Parallel(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 	t.Cleanup(cancel)

+	conciergeUsingHTTPSProxy := testlib.DeploymentsContainerHasHTTPSProxyEnvVar(t, env.ConciergeNamespace, env.ConciergeAppName)
+
 	caBundleSomePivotalCA := "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVVENDQWptZ0F3SUJBZ0lWQUpzNStTbVRtaTJXeUI0bGJJRXBXaUs5a1RkUE1BMEdDU3FHU0liM0RRRUIKQ3dVQU1COHhDekFKQmdOVkJBWVRBbFZUTVJBd0RnWURWUVFLREFkUWFYWnZkR0ZzTUI0WERUSXdNRFV3TkRFMgpNamMxT0ZvWERUSTBNRFV3TlRFMk1qYzFPRm93SHpFTE1Ba0dBMVVFQmhNQ1ZWTXhFREFPQmdOVkJBb01CMUJwCmRtOTBZV3d3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRRERZWmZvWGR4Z2NXTEMKZEJtbHB5a0tBaG9JMlBuUWtsVFNXMno1cGcwaXJjOGFRL1E3MXZzMTRZYStmdWtFTGlvOTRZYWw4R01DdVFrbApMZ3AvUEE5N1VYelhQNDBpK25iNXcwRGpwWWd2dU9KQXJXMno2MFRnWE5NSFh3VHk4ME1SZEhpUFVWZ0VZd0JpCmtkNThzdEFVS1Y1MnBQTU1reTJjNy9BcFhJNmRXR2xjalUvaFBsNmtpRzZ5dEw2REtGYjJQRWV3MmdJM3pHZ2IKOFVVbnA1V05DZDd2WjNVY0ZHNXlsZEd3aGc3cnZ4U1ZLWi9WOEhCMGJmbjlxamlrSVcxWFM4dzdpUUNlQmdQMApYZWhKZmVITlZJaTJtZlczNlVQbWpMdnVKaGpqNDIrdFBQWndvdDkzdWtlcEgvbWpHcFJEVm9wamJyWGlpTUYrCkYxdnlPNGMxQWdNQkFBR2pnWU13Z1lBd0hRWURWUjBPQkJZRUZNTWJpSXFhdVkwajRVWWphWDl0bDJzby9LQ1IKTUI4R0ExVWRJd1FZTUJhQUZNTWJpSXFhdVkwajRVWWphWDl0bDJzby9LQ1JNQjBHQTFVZEpRUVdNQlFHQ0NzRwpBUVVGQndNQ0JnZ3JCZ0VGQlFjREFUQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BNEdBMVVkRHdFQi93UUVBd0lCCkJqQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFYbEh4M2tIMDZwY2NDTDlEVE5qTnBCYnlVSytGd2R6T2IwWFYKcmpNaGtxdHVmdEpUUnR5T3hKZ0ZKNXhUR3pCdEtKamcrVU1pczBOV0t0VDBNWThVMU45U2c5SDl0RFpHRHBjVQpxMlVRU0Y4dXRQMVR3dnJIUzIrdzB2MUoxdHgrTEFiU0lmWmJCV0xXQ21EODUzRlVoWlFZekkvYXpFM28vd0p1CmlPUklMdUpNUk5vNlBXY3VLZmRFVkhaS1RTWnk3a25FcHNidGtsN3EwRE91eUFWdG9HVnlkb3VUR0FOdFhXK2YKczNUSTJjKzErZXg3L2RZOEJGQTFzNWFUOG5vZnU3T1RTTzdiS1kzSkRBUHZOeFQzKzVZUXJwNGR1Nmh0YUFMbAppOHNaRkhidmxpd2EzdlhxL3p1Y2JEaHEzQzBhZnAzV2ZwRGxwSlpvLy9QUUFKaTZLQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"

 	tests := []struct {
 		name            string
+		maybeSkip       func(t *testing.T)
 		spec            func() *authenticationv1alpha1.WebhookAuthenticatorSpec
 		initialPhase    authenticationv1alpha1.WebhookAuthenticatorPhase
 		finalConditions []metav1.Condition
-		run             func(t *testing.T)
 	}{
 		{
-			name: "basic test to see if the WebhookAuthenticator wakes up or not",
+			name: "happy path",
 			spec: func() *authenticationv1alpha1.WebhookAuthenticatorSpec {
 				return &env.TestWebhook
 			},
 			initialPhase:    authenticationv1alpha1.WebhookAuthenticatorPhaseReady,
-			finalConditions: allSuccessfulWebhookAuthenticatorConditions(),
+			finalConditions: allSuccessfulWebhookAuthenticatorConditions(conciergeUsingHTTPSProxy),
 		},
 		{
 			name: "valid spec with invalid CA in TLS config will result in a WebhookAuthenticator that is not ready",
@@ -181,8 +183,8 @@ func TestConciergeWebhookAuthenticatorStatus_Parallel(t *testing.T) {
 				return webhookSpec
 			},
 			initialPhase: authenticationv1alpha1.WebhookAuthenticatorPhaseError,
-			finalConditions: replaceSomeConditions(
-				allSuccessfulWebhookAuthenticatorConditions(),
+			finalConditions: replaceSomeConditions(t,
+				allSuccessfulWebhookAuthenticatorConditions(false),
 				[]metav1.Condition{
 					{
 						Type:    "Ready",
@@ -210,6 +212,14 @@ func TestConciergeWebhookAuthenticatorStatus_Parallel(t *testing.T) {
 		},
 		{
 			name: "valid spec with valid CA in TLS config but does not match issuer server will result in a WebhookAuthenticator that is not ready",
+			maybeSkip: func(t *testing.T) {
+				if conciergeUsingHTTPSProxy {
+					// Skip this test when HTTPS_PROXY is in use, because WebhookConnectionValid will have status Success
+					// with a message saying that the dialing was skipped due to the proxy setting, so the expectations
+					// below are wrong for that case.
+					t.Skip("Skipping test that requires HTTPS_PROXY to be unset")
+				}
+			},
 			spec: func() *authenticationv1alpha1.WebhookAuthenticatorSpec {
 				webhookSpec := env.TestWebhook.DeepCopy()
 				webhookSpec.TLS = &authenticationv1alpha1.TLSSpec{
@@ -218,8 +228,8 @@ func TestConciergeWebhookAuthenticatorStatus_Parallel(t *testing.T) {
 				return webhookSpec
 			},
 			initialPhase: authenticationv1alpha1.WebhookAuthenticatorPhaseError,
-			finalConditions: replaceSomeConditions(
-				allSuccessfulWebhookAuthenticatorConditions(),
+			finalConditions: replaceSomeConditions(t,
+				allSuccessfulWebhookAuthenticatorConditions(false),
 				[]metav1.Condition{
 					{
 						Type:    "Ready",
@@ -247,12 +257,16 @@ func TestConciergeWebhookAuthenticatorStatus_Parallel(t *testing.T) {
 				webhookSpec.TLS = &authenticationv1alpha1.TLSSpec{
 					CertificateAuthorityData: caBundleSomePivotalCA,
 				}
-				webhookSpec.Endpoint = "https://127.0.0.1:443/some-fake-endpoint"
+				// Note that requests to 127.0.0.1 will not be proxied even when HTTPS_PROXY is set on the Concierge,
+				// so it's okay to run this test in that case too. The Concierge will attempt the dial because it sees
+				// that the request would not be proxied anyway. 127.0.0.1:8781 will be seen by the Concierge as a port
+				// local to its own pod, which does not exist so the connection will fail.
+				webhookSpec.Endpoint = "https://127.0.0.1:8781/some-fake-endpoint"
 				return webhookSpec
 			},
 			initialPhase: authenticationv1alpha1.WebhookAuthenticatorPhaseError,
-			finalConditions: replaceSomeConditions(
-				allSuccessfulWebhookAuthenticatorConditions(),
+			finalConditions: replaceSomeConditions(t,
+				allSuccessfulWebhookAuthenticatorConditions(false),
 				[]metav1.Condition{
 					{
 						Type:    "Ready",
@@ -268,7 +282,7 @@ func TestConciergeWebhookAuthenticatorStatus_Parallel(t *testing.T) {
 						Type:    "WebhookConnectionValid",
 						Status:  "False",
 						Reason:  "UnableToDialServer",
-						Message: "cannot dial server: dial tcp 127.0.0.1:443: connect: connection refused",
+						Message: "cannot dial server: dial tcp 127.0.0.1:8781: connect: connection refused",
 					},
 				},
 			),
@@ -279,6 +293,10 @@ func TestConciergeWebhookAuthenticatorStatus_Parallel(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()

+			if tt.maybeSkip != nil {
+				tt.maybeSkip(t)
+			}
+
 			webhookAuthenticator := testlib.CreateTestWebhookAuthenticator(
 				ctx,
 				t,
@@ -397,7 +415,12 @@ func TestConciergeWebhookAuthenticatorCRDValidations_Parallel(t *testing.T) {
 	}
 }

-func allSuccessfulWebhookAuthenticatorConditions() []metav1.Condition {
+func allSuccessfulWebhookAuthenticatorConditions(conciergeUsingHTTPSProxy bool) []metav1.Condition {
+	dialMessage := "successfully dialed webhook server"
+	if conciergeUsingHTTPSProxy {
+		dialMessage = "skipped dialing connection probe because HTTPS_PROXY is configured for use with the specified host"
+	}
+
 	return []metav1.Condition{
 		{
 			Type:    "AuthenticatorValid",
@@ -427,7 +450,7 @@ func allSuccessfulWebhookAuthenticatorConditions() []metav1.Condition {
 			Type:    "WebhookConnectionValid",
 			Status:  "True",
 			Reason:  "Success",
-			Message: "successfully dialed webhook server",
+			Message: dialMessage,
 		},
 	}
 }
@@ -2196,7 +2196,8 @@ func requireUserCanUseKubectlWithoutAuthenticatingAgain(

 func requireGCAnnotationsOnSessionStorage(ctx context.Context, t *testing.T, supervisorNamespace string, startTime time.Time, token *oidctypes.Token) {
 	// check that the access token is new (since it's just been refreshed) and has close to two minutes left.
-	testutil.RequireTimeInDelta(t, startTime.Add(2*time.Minute), token.AccessToken.Expiry.Time, 15*time.Second)
+	// Give some significant fudge factor to allow for slow CI workers.
+	testutil.RequireTimeInDelta(t, startTime.Add(2*time.Minute), token.AccessToken.Expiry.Time, 35*time.Second)

 	kubeClient := testlib.NewKubernetesClientset(t).CoreV1()

@@ -46,8 +46,8 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 				fd := testlib.CreateTestFederationDomain(ctx, t, supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com/fake",
 				}, supervisorconfigv1alpha1.FederationDomainPhaseError)
-				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
-					allSuccessfulLegacyFederationDomainConditions("", fd.Spec),
+				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(t,
+					allSuccessfulLegacyFederationDomainConditions(t, "", fd.Spec),
 					[]metav1.Condition{
 						{
 							Type: "IdentityProvidersFound", Status: "False", Reason: "LegacyConfigurationIdentityProviderNotFound",
@@ -67,7 +67,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 				}, idpv1alpha1.PhaseError)
 				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name,
-					allSuccessfulLegacyFederationDomainConditions(oidcIdentityProvider1.Name, fd.Spec))
+					allSuccessfulLegacyFederationDomainConditions(t, oidcIdentityProvider1.Name, fd.Spec))

 				// Creating a second IDP should put the FederationDomain back into an error status again.
 				oidcIdentityProvider2 := testlib.CreateTestOIDCIdentityProvider(t, idpv1alpha1.OIDCIdentityProviderSpec{
@@ -75,8 +75,8 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					Client: idpv1alpha1.OIDCClient{SecretName: "this-will-not-exist-but-does-not-matter"},
 				}, idpv1alpha1.PhaseError)
 				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseError)
-				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
-					allSuccessfulLegacyFederationDomainConditions(oidcIdentityProvider2.Name, fd.Spec),
+				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(t,
+					allSuccessfulLegacyFederationDomainConditions(t, oidcIdentityProvider2.Name, fd.Spec),
 					[]metav1.Condition{
 						{
 							Type: "IdentityProvidersFound", Status: "False", Reason: "IdentityProviderNotSpecified",
@@ -121,7 +121,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 						},
 					},
 				}, supervisorconfigv1alpha1.FederationDomainPhaseError)
-				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
+				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(t,
 					allSuccessfulFederationDomainConditions(fd.Spec),
 					[]metav1.Condition{
 						{
@@ -145,7 +145,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					Client: idpv1alpha1.OIDCClient{SecretName: "this-will-not-exist-but-does-not-matter"},
 				}, oidcIDP1Meta, idpv1alpha1.PhaseError)
 				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseError)
-				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
+				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(t,
 					allSuccessfulFederationDomainConditions(fd.Spec),
 					[]metav1.Condition{
 						{
@@ -173,7 +173,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 				err := oidcIDPClient.Delete(ctx, oidcIdentityProvider1.Name, metav1.DeleteOptions{})
 				require.NoError(t, err)
 				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseError)
-				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
+				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(t,
 					allSuccessfulFederationDomainConditions(fd.Spec),
 					[]metav1.Condition{
 						{
@@ -340,7 +340,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					},
 				}, supervisorconfigv1alpha1.FederationDomainPhaseError)

-				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
+				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(t,
 					allSuccessfulFederationDomainConditions(fd.Spec),
 					[]metav1.Condition{
 						{
@@ -483,7 +483,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 				})
 				require.NoError(t, err)

-				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
+				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(t,
 					allSuccessfulFederationDomainConditions(fd.Spec),
 					[]metav1.Condition{
 						{
@@ -950,22 +950,30 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 	}
 }

-func replaceSomeConditions(conditions []metav1.Condition, replaceWithTheseConditions []metav1.Condition) []metav1.Condition {
+func replaceSomeConditions(t *testing.T, conditions []metav1.Condition, replaceWithTheseConditions []metav1.Condition) []metav1.Condition {
 	cp := make([]metav1.Condition, len(conditions))
 	copy(cp, conditions)
 	for _, replacementCond := range replaceWithTheseConditions {
+		found := false
 		for i, cond := range cp {
 			if replacementCond.Type == cond.Type {
 				cp[i] = replacementCond
+				found = true
 				break
 			}
 		}
+		if !found {
+			require.Failf(t,
+				"test setup problem",
+				"replaceSomeConditions() helper was called to replace condition of type %q but no such condition was found in conditions slice",
+				replacementCond.Type)
+		}
 	}
 	return cp
 }

-func allSuccessfulLegacyFederationDomainConditions(idpName string, federationDomainSpec supervisorconfigv1alpha1.FederationDomainSpec) []metav1.Condition {
-	return replaceSomeConditions(
+func allSuccessfulLegacyFederationDomainConditions(t *testing.T, idpName string, federationDomainSpec supervisorconfigv1alpha1.FederationDomainSpec) []metav1.Condition {
+	return replaceSomeConditions(t,
 		allSuccessfulFederationDomainConditions(federationDomainSpec),
 		[]metav1.Condition{
 			{
@@ -392,7 +392,7 @@ func TestGitHubIDPPhaseAndConditions_Parallel(t *testing.T) {
 					Type:    "GitHubConnectionValid",
 					Status:  metav1.ConditionTrue,
 					Reason:  "Success",
-					Message: `dialed "api.github.com:443" for spec.githubAPI.host ("github.com"): host is reachable and TLS verification succeeds`,
+					Message: `probed connection to "api.github.com:443" for spec.githubAPI.host ("github.com"): host is reachable and TLS verification succeeds`,
 				},
 				{
 					Type:    "HostValid",
@@ -461,7 +461,7 @@ func TestGitHubIDPPhaseAndConditions_Parallel(t *testing.T) {
 					Type:    "GitHubConnectionValid",
 					Status:  metav1.ConditionTrue,
 					Reason:  "Success",
-					Message: `dialed "api.github.com:443" for spec.githubAPI.host ("api.github.com"): host is reachable and TLS verification succeeds`,
+					Message: `probed connection to "api.github.com:443" for spec.githubAPI.host ("api.github.com"): host is reachable and TLS verification succeeds`,
 				},
 				{
 					Type:    "HostValid",
@@ -668,7 +668,7 @@ func TestGitHubIDPSecretInOtherNamespace_Parallel(t *testing.T) {
 			Type:    "GitHubConnectionValid",
 			Status:  metav1.ConditionTrue,
 			Reason:  "Success",
-			Message: `dialed "api.github.com:443" for spec.githubAPI.host ("github.com"): host is reachable and TLS verification succeeds`,
+			Message: `probed connection to "api.github.com:443" for spec.githubAPI.host ("github.com"): host is reachable and TLS verification succeeds`,
 		},
 		{
 			Type:    "HostValid",
@@ -1109,3 +1109,23 @@ func ObjectMetaWithRandomName(t *testing.T, baseName string) metav1.ObjectMeta {
 		Annotations: map[string]string{"pinniped.dev/testName": t.Name()},
 	}
 }
+
+func DeploymentsContainerHasHTTPSProxyEnvVar(t *testing.T, namespaceName string, deploymentName string) bool {
+	client := NewKubernetesClientset(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+	defer cancel()
+
+	d, err := client.AppsV1().Deployments(namespaceName).Get(ctx, deploymentName, metav1.GetOptions{})
+	require.NoError(t, err)
+
+	for _, c := range d.Spec.Template.Spec.Containers {
+		for _, e := range c.Env {
+			if e.Name == "HTTPS_PROXY" {
+				return true
+			}
+		}
+	}
+
+	return false
+}