Put all of our APIs into a "pinniped" category, and never use "all".

We want to have our APIs respond to `kubectl get pinniped`, and we shouldn't use `all` because we don't think most average users should have permission to see our API types, which means if we put our types there, they would get an error from `kubectl get all`.

I also added some tests to assert these properties on all `*.pinniped.dev` API resources.

Signed-off-by: Matt Moyer <moyerm@vmware.com>

test/integration/kube_api_discovery_test.go

@@ -4,8 +4,10 @@
 package integration
 
 import (
+	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
@@ -45,11 +47,6 @@ func TestGetAPIResourceList(t *testing.T) {
 						Kind:       "TokenCredentialRequest",
 						Verbs:      []string{"create"},
 						Namespaced: true,
-
-						// This is currently an empty string in the response; maybe it should not be
-						// empty? Seems like no harm in keeping it like this for now, but feel free
-						// to update in the future if there is a compelling reason to do so.
-						SingularName: "",
 					},
 				},
 			},
@@ -76,6 +73,7 @@ func TestGetAPIResourceList(t *testing.T) {
 						Namespaced:   true,
 						Kind:         "OIDCProvider",
 						Verbs:        []string{"delete", "deletecollection", "get", "list", "patch", "create", "update", "watch"},
+						Categories:   []string{"pinniped"},
 					},
 				},
 			},
@@ -102,6 +100,7 @@ func TestGetAPIResourceList(t *testing.T) {
 						Namespaced:   true,
 						Kind:         "CredentialIssuer",
 						Verbs:        []string{"delete", "deletecollection", "get", "list", "patch", "create", "update", "watch"},
+						Categories:   []string{"pinniped"},
 					},
 				},
 			},
@@ -128,16 +127,46 @@ func TestGetAPIResourceList(t *testing.T) {
 						Namespaced:   true,
 						Kind:         "WebhookAuthenticator",
 						Verbs:        []string{"delete", "deletecollection", "get", "list", "patch", "create", "update", "watch"},
-						Categories:   []string{"all", "authenticator", "authenticators"},
+						Categories:   []string{"pinniped", "pinniped-authenticator", "pinniped-authenticators"},
 					},
 				},
 			},
 		},
 	}
 
+	t.Run("every Pinniped API has explicit test coverage", func(t *testing.T) {
+		t.Parallel()
+		testedGroups := map[string]bool{}
+		for _, tt := range tests {
+			testedGroups[tt.group.Name] = true
+		}
+		for _, g := range groups {
+			if !strings.Contains(g.Name, "pinniped.dev") {
+				continue
+			}
+			assert.Truef(t, testedGroups[g.Name], "expected group %q to have assertions defined", g.Name)
+		}
+	})
+
+	t.Run("every API categorized appropriately", func(t *testing.T) {
+		t.Parallel()
+		for _, r := range resources {
+			if !strings.Contains(r.GroupVersion, "pinniped.dev") {
+				continue
+			}
+			for _, a := range r.APIResources {
+				if a.Kind != "TokenCredentialRequest" {
+					assert.Containsf(t, a.Categories, "pinniped", "expected resource %q to be in the 'pinniped' category", a.Name)
+				}
+				assert.NotContainsf(t, a.Categories, "all", "expected resource %q not to be in the 'all' category", a.Name)
+			}
+		}
+	})
+
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.group.Name, func(t *testing.T) {
+			t.Parallel()
 			require.Contains(t, groups, &tt.group)
 
 			for groupVersion, expectedResources := range tt.resourceByVersion {