Add JWTAuthenticator controller

See https://github.com/vmware-tanzu/pinniped/issues/260 for UX bummer.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>

internal/controller/authenticator/authncache/cache.go

@@ -12,8 +12,10 @@ import (
 
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/klog/v2"
 
 	loginapi "go.pinniped.dev/generated/1.19/apis/concierge/login"
+	"go.pinniped.dev/internal/plog"
 )
 
 var (
@@ -93,6 +95,12 @@ func (c *Cache) AuthenticateTokenCredentialRequest(ctx context.Context, req *log
 
 	val := c.Get(key)
 	if val == nil {
+		plog.Debug(
+			"authenticator does not exist",
+			"authenticator", klog.KRef(key.Namespace, key.Name),
+			"kind", key.Kind,
+			"apiGroup", key.APIGroup,
+		)
 		return nil, ErrNoSuchAuthenticator
 	}