From 81390bba89b0051e0323ec1ca623c0db571c72f2 Mon Sep 17 00:00:00 2001
From: Matt Moyer <moyerm@vmware.com>
Date: Fri, 30 Oct 2020 10:51:56 -0500
Subject: [PATCH] Rename `idp.pinniped.dev` to `idp.concierge.pinniped.dev`.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
---
 apis/{ => concierge}/idp/doc.go.tmpl          |   2 +-
 .../idp/v1alpha1/conversion.go.tmpl           |   0
 .../idp/v1alpha1/defaults.go.tmpl             |   0
 apis/{ => concierge}/idp/v1alpha1/doc.go.tmpl |   4 +-
 .../idp/v1alpha1/register.go.tmpl             |   2 +-
 .../idp/v1alpha1/types_meta.go.tmpl           |   0
 .../idp/v1alpha1/types_tls.go.tmpl            |   0
 .../idp/v1alpha1/types_webhook.go.tmpl        |   0
 cmd/pinniped/cmd/exchange_credential.go       |   2 +-
 cmd/pinniped/cmd/get_kubeconfig_test.go       |   2 +-
 ...pinniped.dev_webhookidentityproviders.yaml |   4 +-
 deploy/concierge/rbac.yaml                    |   2 +-
 deploy/concierge/z0_crd_overlay.yaml          |   2 +-
 doc/demo.md                                   |   2 +-
 generated/1.17/README.adoc                    |  34 +-
 .../apis => 1.17/apis/concierge}/idp/doc.go   |   2 +-
 .../idp/v1alpha1/conversion.go                |   0
 .../{ => concierge}/idp/v1alpha1/defaults.go  |   0
 .../apis/concierge}/idp/v1alpha1/doc.go       |   4 +-
 .../{ => concierge}/idp/v1alpha1/register.go  |   2 +-
 .../idp/v1alpha1/types_meta.go                |   0
 .../{ => concierge}/idp/v1alpha1/types_tls.go |   0
 .../idp/v1alpha1/types_webhook.go             |   0
 .../idp/v1alpha1/zz_generated.conversion.go   |   0
 .../idp/v1alpha1/zz_generated.deepcopy.go     |   0
 .../idp/v1alpha1/zz_generated.defaults.go     |   0
 .../idp/zz_generated.deepcopy.go              |   0
 .../clientset/versioned/fake/register.go      |   2 +-
 .../clientset/versioned/scheme/register.go    |   2 +-
 .../fake/fake_webhookidentityprovider.go      |   6 +-
 .../typed/idp/v1alpha1/idp_client.go          |   4 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../informers/externalversions/generic.go     |   4 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../client/openapi/zz_generated.openapi.go    | 488 +++++++++---------
 ...inniped.dev_webhookidentityproviders.yaml} |   4 +-
 generated/1.18/README.adoc                    |  34 +-
 .../1.18/apis/{ => concierge}/idp/doc.go      |   2 +-
 .../idp/v1alpha1/conversion.go                |   0
 .../{ => concierge}/idp/v1alpha1/defaults.go  |   0
 .../apis/concierge}/idp/v1alpha1/doc.go       |   4 +-
 .../{ => concierge}/idp/v1alpha1/register.go  |   2 +-
 .../idp/v1alpha1/types_meta.go                |   0
 .../{ => concierge}/idp/v1alpha1/types_tls.go |   0
 .../idp/v1alpha1/types_webhook.go             |   0
 .../idp/v1alpha1/zz_generated.conversion.go   |   0
 .../idp/v1alpha1/zz_generated.deepcopy.go     |   0
 .../idp/v1alpha1/zz_generated.defaults.go     |   0
 .../idp/zz_generated.deepcopy.go              |   0
 .../clientset/versioned/fake/register.go      |   2 +-
 .../clientset/versioned/scheme/register.go    |   2 +-
 .../fake/fake_webhookidentityprovider.go      |   6 +-
 .../typed/idp/v1alpha1/idp_client.go          |   4 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../informers/externalversions/generic.go     |   4 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../client/openapi/zz_generated.openapi.go    | 488 +++++++++---------
 ...pinniped.dev_webhookidentityproviders.yaml |   4 +-
 generated/1.19/README.adoc                    |  34 +-
 .../apis => 1.19/apis/concierge}/idp/doc.go   |   2 +-
 .../idp/v1alpha1/conversion.go                |   0
 .../{ => concierge}/idp/v1alpha1/defaults.go  |   0
 .../apis/{ => concierge}/idp/v1alpha1/doc.go  |   4 +-
 .../{ => concierge}/idp/v1alpha1/register.go  |   2 +-
 .../idp/v1alpha1/types_meta.go                |   0
 .../{ => concierge}/idp/v1alpha1/types_tls.go |   0
 .../idp/v1alpha1/types_webhook.go             |   0
 .../idp/v1alpha1/zz_generated.conversion.go   |   0
 .../idp/v1alpha1/zz_generated.deepcopy.go     |   0
 .../idp/v1alpha1/zz_generated.defaults.go     |   0
 .../idp/zz_generated.deepcopy.go              |   0
 .../clientset/versioned/fake/register.go      |   2 +-
 .../clientset/versioned/scheme/register.go    |   2 +-
 .../fake/fake_webhookidentityprovider.go      |   6 +-
 .../typed/idp/v1alpha1/idp_client.go          |   4 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../informers/externalversions/generic.go     |   4 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../idp/v1alpha1/webhookidentityprovider.go   |   2 +-
 .../client/openapi/zz_generated.openapi.go    | 488 +++++++++---------
 ...inniped.dev_webhookidentityproviders.yaml} |   4 +-
 hack/lib/docs/config.yaml                     |   2 +-
 hack/lib/tilt/Tiltfile                        |   2 +-
 hack/lib/update-codegen.sh                    |   8 +-
 internal/client/client_test.go                |   4 +-
 .../identityprovider/idpcache/cache_test.go   |   2 +-
 .../webhookcachecleaner.go                    |   2 +-
 .../webhookcachecleaner_test.go               |   8 +-
 .../webhookcachefiller/webhookcachefiller.go  |   2 +-
 .../webhookcachefiller_test.go                |   2 +-
 .../concierge_credentialrequest_test.go       |   2 +-
 test/integration/kube_api_discovery_test.go   |   8 +-
 test/library/client.go                        |   2 +-
 test/library/env.go                           |   2 +-
 96 files changed, 871 insertions(+), 871 deletions(-)
 rename apis/{ => concierge}/idp/doc.go.tmpl (84%)
 rename apis/{ => concierge}/idp/v1alpha1/conversion.go.tmpl (100%)
 rename apis/{ => concierge}/idp/v1alpha1/defaults.go.tmpl (100%)
 rename apis/{ => concierge}/idp/v1alpha1/doc.go.tmpl (73%)
 rename apis/{ => concierge}/idp/v1alpha1/register.go.tmpl (96%)
 rename apis/{ => concierge}/idp/v1alpha1/types_meta.go.tmpl (100%)
 rename apis/{ => concierge}/idp/v1alpha1/types_tls.go.tmpl (100%)
 rename apis/{ => concierge}/idp/v1alpha1/types_webhook.go.tmpl (100%)
 rename generated/1.17/crds/idp.pinniped.dev_webhookidentityproviders.yaml => deploy/concierge/idp.concierge.pinniped.dev_webhookidentityproviders.yaml (98%)
 rename generated/{1.19/apis => 1.17/apis/concierge}/idp/doc.go (84%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/conversion.go (100%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/defaults.go (100%)
 rename generated/{1.18/apis => 1.17/apis/concierge}/idp/v1alpha1/doc.go (73%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/register.go (96%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/types_meta.go (100%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/types_tls.go (100%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/types_webhook.go (100%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/zz_generated.conversion.go (100%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/zz_generated.deepcopy.go (100%)
 rename generated/1.17/apis/{ => concierge}/idp/v1alpha1/zz_generated.defaults.go (100%)
 rename generated/1.17/apis/{ => concierge}/idp/zz_generated.deepcopy.go (100%)
 rename generated/{1.18/crds/idp.pinniped.dev_webhookidentityproviders.yaml => 1.17/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml} (98%)
 rename generated/1.18/apis/{ => concierge}/idp/doc.go (84%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/conversion.go (100%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/defaults.go (100%)
 rename generated/{1.17/apis => 1.18/apis/concierge}/idp/v1alpha1/doc.go (73%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/register.go (96%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/types_meta.go (100%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/types_tls.go (100%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/types_webhook.go (100%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/zz_generated.conversion.go (100%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/zz_generated.deepcopy.go (100%)
 rename generated/1.18/apis/{ => concierge}/idp/v1alpha1/zz_generated.defaults.go (100%)
 rename generated/1.18/apis/{ => concierge}/idp/zz_generated.deepcopy.go (100%)
 rename deploy/concierge/idp.pinniped.dev_webhookidentityproviders.yaml => generated/1.18/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml (98%)
 rename generated/{1.17/apis => 1.19/apis/concierge}/idp/doc.go (84%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/conversion.go (100%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/defaults.go (100%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/doc.go (73%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/register.go (96%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/types_meta.go (100%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/types_tls.go (100%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/types_webhook.go (100%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/zz_generated.conversion.go (100%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/zz_generated.deepcopy.go (100%)
 rename generated/1.19/apis/{ => concierge}/idp/v1alpha1/zz_generated.defaults.go (100%)
 rename generated/1.19/apis/{ => concierge}/idp/zz_generated.deepcopy.go (100%)
 rename generated/1.19/crds/{idp.pinniped.dev_webhookidentityproviders.yaml => idp.concierge.pinniped.dev_webhookidentityproviders.yaml} (98%)

diff --git a/apis/idp/doc.go.tmpl b/apis/concierge/idp/doc.go.tmpl
similarity index 84%
rename from apis/idp/doc.go.tmpl
rename to apis/concierge/idp/doc.go.tmpl
index 17d329436..22adc1b52 100644
--- a/apis/idp/doc.go.tmpl
+++ b/apis/concierge/idp/doc.go.tmpl
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package
-// +groupName=idp.pinniped.dev
+// +groupName=idp.concierge.pinniped.dev
 
 // Package idp is the internal version of the Pinniped identity provider API.
 package idp
diff --git a/apis/idp/v1alpha1/conversion.go.tmpl b/apis/concierge/idp/v1alpha1/conversion.go.tmpl
similarity index 100%
rename from apis/idp/v1alpha1/conversion.go.tmpl
rename to apis/concierge/idp/v1alpha1/conversion.go.tmpl
diff --git a/apis/idp/v1alpha1/defaults.go.tmpl b/apis/concierge/idp/v1alpha1/defaults.go.tmpl
similarity index 100%
rename from apis/idp/v1alpha1/defaults.go.tmpl
rename to apis/concierge/idp/v1alpha1/defaults.go.tmpl
diff --git a/apis/idp/v1alpha1/doc.go.tmpl b/apis/concierge/idp/v1alpha1/doc.go.tmpl
similarity index 73%
rename from apis/idp/v1alpha1/doc.go.tmpl
rename to apis/concierge/idp/v1alpha1/doc.go.tmpl
index 1837041f6..86223a810 100644
--- a/apis/idp/v1alpha1/doc.go.tmpl
+++ b/apis/concierge/idp/v1alpha1/doc.go.tmpl
@@ -3,9 +3,9 @@
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/idp
+// +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/idp
 // +k8s:defaulter-gen=TypeMeta
-// +groupName=idp.pinniped.dev
+// +groupName=idp.concierge.pinniped.dev
 // +groupGoName=IDP
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped identity provider API.
diff --git a/apis/idp/v1alpha1/register.go.tmpl b/apis/concierge/idp/v1alpha1/register.go.tmpl
similarity index 96%
rename from apis/idp/v1alpha1/register.go.tmpl
rename to apis/concierge/idp/v1alpha1/register.go.tmpl
index 494aef367..021640359 100644
--- a/apis/idp/v1alpha1/register.go.tmpl
+++ b/apis/concierge/idp/v1alpha1/register.go.tmpl
@@ -9,7 +9,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
-const GroupName = "idp.pinniped.dev"
+const GroupName = "idp.concierge.pinniped.dev"
 
 // SchemeGroupVersion is group version used to register these objects.
 var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
diff --git a/apis/idp/v1alpha1/types_meta.go.tmpl b/apis/concierge/idp/v1alpha1/types_meta.go.tmpl
similarity index 100%
rename from apis/idp/v1alpha1/types_meta.go.tmpl
rename to apis/concierge/idp/v1alpha1/types_meta.go.tmpl
diff --git a/apis/idp/v1alpha1/types_tls.go.tmpl b/apis/concierge/idp/v1alpha1/types_tls.go.tmpl
similarity index 100%
rename from apis/idp/v1alpha1/types_tls.go.tmpl
rename to apis/concierge/idp/v1alpha1/types_tls.go.tmpl
diff --git a/apis/idp/v1alpha1/types_webhook.go.tmpl b/apis/concierge/idp/v1alpha1/types_webhook.go.tmpl
similarity index 100%
rename from apis/idp/v1alpha1/types_webhook.go.tmpl
rename to apis/concierge/idp/v1alpha1/types_webhook.go.tmpl
diff --git a/cmd/pinniped/cmd/exchange_credential.go b/cmd/pinniped/cmd/exchange_credential.go
index 77679b8fb..919411005 100644
--- a/cmd/pinniped/cmd/exchange_credential.go
+++ b/cmd/pinniped/cmd/exchange_credential.go
@@ -16,7 +16,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
 
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	"go.pinniped.dev/internal/client"
 	"go.pinniped.dev/internal/constable"
 	"go.pinniped.dev/internal/here"
diff --git a/cmd/pinniped/cmd/get_kubeconfig_test.go b/cmd/pinniped/cmd/get_kubeconfig_test.go
index 7834e1b44..231425912 100644
--- a/cmd/pinniped/cmd/get_kubeconfig_test.go
+++ b/cmd/pinniped/cmd/get_kubeconfig_test.go
@@ -17,8 +17,8 @@ import (
 	"k8s.io/client-go/rest"
 	coretesting "k8s.io/client-go/testing"
 
+	idpv1alpha "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
-	idpv1alpha "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	pinnipedclientset "go.pinniped.dev/generated/1.19/client/clientset/versioned"
 	pinnipedfake "go.pinniped.dev/generated/1.19/client/clientset/versioned/fake"
 	"go.pinniped.dev/internal/here"
diff --git a/generated/1.17/crds/idp.pinniped.dev_webhookidentityproviders.yaml b/deploy/concierge/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
similarity index 98%
rename from generated/1.17/crds/idp.pinniped.dev_webhookidentityproviders.yaml
rename to deploy/concierge/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
index 213b7ad20..af2416426 100644
--- a/generated/1.17/crds/idp.pinniped.dev_webhookidentityproviders.yaml
+++ b/deploy/concierge/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
@@ -6,9 +6,9 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.4.0
   creationTimestamp: null
-  name: webhookidentityproviders.idp.pinniped.dev
+  name: webhookidentityproviders.idp.concierge.pinniped.dev
 spec:
-  group: idp.pinniped.dev
+  group: idp.concierge.pinniped.dev
   names:
     categories:
     - all
diff --git a/deploy/concierge/rbac.yaml b/deploy/concierge/rbac.yaml
index 149ca4b33..1571d56dd 100644
--- a/deploy/concierge/rbac.yaml
+++ b/deploy/concierge/rbac.yaml
@@ -59,7 +59,7 @@ rules:
   - apiGroups: [ "" ]
     resources: [ pods/exec ]
     verbs: [ create ]
-  - apiGroups: [ config.pinniped.dev, idp.pinniped.dev ]
+  - apiGroups: [ config.pinniped.dev, idp.concierge.pinniped.dev ]
     resources: [ "*" ]
     verbs: [ create, get, list, update, watch ]
 ---
diff --git a/deploy/concierge/z0_crd_overlay.yaml b/deploy/concierge/z0_crd_overlay.yaml
index dfece13bb..7f637f7e8 100644
--- a/deploy/concierge/z0_crd_overlay.yaml
+++ b/deploy/concierge/z0_crd_overlay.yaml
@@ -10,7 +10,7 @@ metadata:
   #@overlay/match missing_ok=True
   labels: #@ labels()
 
-#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"webhookidentityproviders.idp.pinniped.dev"}}), expects=1
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"webhookidentityproviders.idp.concierge.pinniped.dev"}}), expects=1
 ---
 metadata:
   #@overlay/match missing_ok=True
diff --git a/doc/demo.md b/doc/demo.md
index 6318988cd..8cc1a3688 100644
--- a/doc/demo.md
+++ b/doc/demo.md
@@ -122,7 +122,7 @@ as the identity provider.
 
     ```bash
     cat <<EOF | kubectl create --namespace pinniped -f -
-    apiVersion: idp.pinniped.dev/v1alpha1
+    apiVersion: idp.concierge.pinniped.dev/v1alpha1
     kind: WebhookIdentityProvider
     metadata:
       name: local-user-authenticator
diff --git a/generated/1.17/README.adoc b/generated/1.17/README.adoc
index baf568de7..9cf1ecfda 100644
--- a/generated/1.17/README.adoc
+++ b/generated/1.17/README.adoc
@@ -6,7 +6,7 @@
 
 .Packages
 - xref:{anchor_prefix}-config-pinniped-dev-v1alpha1[$$config.pinniped.dev/v1alpha1$$]
-- xref:{anchor_prefix}-idp-pinniped-dev-v1alpha1[$$idp.pinniped.dev/v1alpha1$$]
+- xref:{anchor_prefix}-idp-concierge-pinniped-dev-v1alpha1[$$idp.concierge.pinniped.dev/v1alpha1$$]
 - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$]
 
 
@@ -161,21 +161,21 @@ OIDCProviderConfigStatus is a struct that describes the actual state of an OIDC
 
 
 
-[id="{anchor_prefix}-idp-pinniped-dev-v1alpha1"]
-=== idp.pinniped.dev/v1alpha1
+[id="{anchor_prefix}-idp-concierge-pinniped-dev-v1alpha1"]
+=== idp.concierge.pinniped.dev/v1alpha1
 
 Package v1alpha1 is the v1alpha1 version of the Pinniped identity provider API.
 
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-condition"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-condition"]
 ==== Condition 
 
 Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -190,14 +190,14 @@ Condition status of a resource (mirrored from the metav1.Condition type added in
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-tlsspec"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-tlsspec"]
 ==== TLSSpec 
 
 Configuration for configuring TLS on various identity providers.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -207,14 +207,14 @@ Configuration for configuring TLS on various identity providers.
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityprovider"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityprovider"]
 ==== WebhookIdentityProvider 
 
 WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityproviderlist[$$WebhookIdentityProviderList$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityproviderlist[$$WebhookIdentityProviderList$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -222,45 +222,45 @@ WebhookIdentityProvider describes the configuration of a Pinniped webhook identi
 | Field | Description
 | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
 
-| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]__ | Spec for configuring the identity provider.
-| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]__ | Status of the identity provider.
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]__ | Spec for configuring the identity provider.
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]__ | Status of the identity provider.
 |===
 
 
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityproviderspec"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityproviderspec"]
 ==== WebhookIdentityProviderSpec 
 
 Spec for configuring a webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
 ****
 
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
 | *`endpoint`* __string__ | Webhook server endpoint URL.
-| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration.
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration.
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityproviderstatus"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus"]
 ==== WebhookIdentityProviderStatus 
 
 Status of a webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
 ****
 
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-idp-v1alpha1-condition[$$Condition$$]__ | Represents the observations of an identity provider's current state.
+| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-idp-v1alpha1-condition[$$Condition$$]__ | Represents the observations of an identity provider's current state.
 |===
 
 
diff --git a/generated/1.19/apis/idp/doc.go b/generated/1.17/apis/concierge/idp/doc.go
similarity index 84%
rename from generated/1.19/apis/idp/doc.go
rename to generated/1.17/apis/concierge/idp/doc.go
index 17d329436..22adc1b52 100644
--- a/generated/1.19/apis/idp/doc.go
+++ b/generated/1.17/apis/concierge/idp/doc.go
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package
-// +groupName=idp.pinniped.dev
+// +groupName=idp.concierge.pinniped.dev
 
 // Package idp is the internal version of the Pinniped identity provider API.
 package idp
diff --git a/generated/1.17/apis/idp/v1alpha1/conversion.go b/generated/1.17/apis/concierge/idp/v1alpha1/conversion.go
similarity index 100%
rename from generated/1.17/apis/idp/v1alpha1/conversion.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/conversion.go
diff --git a/generated/1.17/apis/idp/v1alpha1/defaults.go b/generated/1.17/apis/concierge/idp/v1alpha1/defaults.go
similarity index 100%
rename from generated/1.17/apis/idp/v1alpha1/defaults.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/defaults.go
diff --git a/generated/1.18/apis/idp/v1alpha1/doc.go b/generated/1.17/apis/concierge/idp/v1alpha1/doc.go
similarity index 73%
rename from generated/1.18/apis/idp/v1alpha1/doc.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/doc.go
index 95225bb6c..e756111be 100644
--- a/generated/1.18/apis/idp/v1alpha1/doc.go
+++ b/generated/1.17/apis/concierge/idp/v1alpha1/doc.go
@@ -3,9 +3,9 @@
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/generated/1.18/apis/idp
+// +k8s:conversion-gen=go.pinniped.dev/generated/1.17/apis/concierge/idp
 // +k8s:defaulter-gen=TypeMeta
-// +groupName=idp.pinniped.dev
+// +groupName=idp.concierge.pinniped.dev
 // +groupGoName=IDP
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped identity provider API.
diff --git a/generated/1.17/apis/idp/v1alpha1/register.go b/generated/1.17/apis/concierge/idp/v1alpha1/register.go
similarity index 96%
rename from generated/1.17/apis/idp/v1alpha1/register.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/register.go
index 494aef367..021640359 100644
--- a/generated/1.17/apis/idp/v1alpha1/register.go
+++ b/generated/1.17/apis/concierge/idp/v1alpha1/register.go
@@ -9,7 +9,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
-const GroupName = "idp.pinniped.dev"
+const GroupName = "idp.concierge.pinniped.dev"
 
 // SchemeGroupVersion is group version used to register these objects.
 var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
diff --git a/generated/1.17/apis/idp/v1alpha1/types_meta.go b/generated/1.17/apis/concierge/idp/v1alpha1/types_meta.go
similarity index 100%
rename from generated/1.17/apis/idp/v1alpha1/types_meta.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/types_meta.go
diff --git a/generated/1.17/apis/idp/v1alpha1/types_tls.go b/generated/1.17/apis/concierge/idp/v1alpha1/types_tls.go
similarity index 100%
rename from generated/1.17/apis/idp/v1alpha1/types_tls.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/types_tls.go
diff --git a/generated/1.17/apis/idp/v1alpha1/types_webhook.go b/generated/1.17/apis/concierge/idp/v1alpha1/types_webhook.go
similarity index 100%
rename from generated/1.17/apis/idp/v1alpha1/types_webhook.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/types_webhook.go
diff --git a/generated/1.17/apis/idp/v1alpha1/zz_generated.conversion.go b/generated/1.17/apis/concierge/idp/v1alpha1/zz_generated.conversion.go
similarity index 100%
rename from generated/1.17/apis/idp/v1alpha1/zz_generated.conversion.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/zz_generated.conversion.go
diff --git a/generated/1.17/apis/idp/v1alpha1/zz_generated.deepcopy.go b/generated/1.17/apis/concierge/idp/v1alpha1/zz_generated.deepcopy.go
similarity index 100%
rename from generated/1.17/apis/idp/v1alpha1/zz_generated.deepcopy.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/zz_generated.deepcopy.go
diff --git a/generated/1.17/apis/idp/v1alpha1/zz_generated.defaults.go b/generated/1.17/apis/concierge/idp/v1alpha1/zz_generated.defaults.go
similarity index 100%
rename from generated/1.17/apis/idp/v1alpha1/zz_generated.defaults.go
rename to generated/1.17/apis/concierge/idp/v1alpha1/zz_generated.defaults.go
diff --git a/generated/1.17/apis/idp/zz_generated.deepcopy.go b/generated/1.17/apis/concierge/idp/zz_generated.deepcopy.go
similarity index 100%
rename from generated/1.17/apis/idp/zz_generated.deepcopy.go
rename to generated/1.17/apis/concierge/idp/zz_generated.deepcopy.go
diff --git a/generated/1.17/client/clientset/versioned/fake/register.go b/generated/1.17/client/clientset/versioned/fake/register.go
index c4ef82154..2866783b8 100644
--- a/generated/1.17/client/clientset/versioned/fake/register.go
+++ b/generated/1.17/client/clientset/versioned/fake/register.go
@@ -6,9 +6,9 @@
 package fake
 
 import (
+	idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/login/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/1.17/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
diff --git a/generated/1.17/client/clientset/versioned/scheme/register.go b/generated/1.17/client/clientset/versioned/scheme/register.go
index 2c313538b..9d4e26ea0 100644
--- a/generated/1.17/client/clientset/versioned/scheme/register.go
+++ b/generated/1.17/client/clientset/versioned/scheme/register.go
@@ -6,9 +6,9 @@
 package scheme
 
 import (
+	idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/login/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/1.17/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
diff --git a/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go b/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
index e1c46f391..1d87624bd 100644
--- a/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
+++ b/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
@@ -6,7 +6,7 @@
 package fake
 
 import (
-	v1alpha1 "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
@@ -21,9 +21,9 @@ type FakeWebhookIdentityProviders struct {
 	ns   string
 }
 
-var webhookidentityprovidersResource = schema.GroupVersionResource{Group: "idp.pinniped.dev", Version: "v1alpha1", Resource: "webhookidentityproviders"}
+var webhookidentityprovidersResource = schema.GroupVersionResource{Group: "idp.concierge.pinniped.dev", Version: "v1alpha1", Resource: "webhookidentityproviders"}
 
-var webhookidentityprovidersKind = schema.GroupVersionKind{Group: "idp.pinniped.dev", Version: "v1alpha1", Kind: "WebhookIdentityProvider"}
+var webhookidentityprovidersKind = schema.GroupVersionKind{Group: "idp.concierge.pinniped.dev", Version: "v1alpha1", Kind: "WebhookIdentityProvider"}
 
 // Get takes name of the webhookIdentityProvider, and returns the corresponding webhookIdentityProvider object, and an error if there is any.
 func (c *FakeWebhookIdentityProviders) Get(name string, options v1.GetOptions) (result *v1alpha1.WebhookIdentityProvider, err error) {
diff --git a/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go b/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
index fad008c10..4b5cb0c41 100644
--- a/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
+++ b/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
@@ -6,7 +6,7 @@
 package v1alpha1
 
 import (
-	v1alpha1 "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1"
 	"go.pinniped.dev/generated/1.17/client/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
 )
@@ -16,7 +16,7 @@ type IDPV1alpha1Interface interface {
 	WebhookIdentityProvidersGetter
 }
 
-// IDPV1alpha1Client is used to interact with features provided by the idp.pinniped.dev group.
+// IDPV1alpha1Client is used to interact with features provided by the idp.concierge.pinniped.dev group.
 type IDPV1alpha1Client struct {
 	restClient rest.Interface
 }
diff --git a/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go b/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
index 9798d2214..afd49019a 100644
--- a/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.17/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
@@ -8,7 +8,7 @@ package v1alpha1
 import (
 	"time"
 
-	v1alpha1 "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1"
 	scheme "go.pinniped.dev/generated/1.17/client/clientset/versioned/scheme"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
diff --git a/generated/1.17/client/informers/externalversions/generic.go b/generated/1.17/client/informers/externalversions/generic.go
index e5ec9e49c..6e1501702 100644
--- a/generated/1.17/client/informers/externalversions/generic.go
+++ b/generated/1.17/client/informers/externalversions/generic.go
@@ -8,9 +8,9 @@ package externalversions
 import (
 	"fmt"
 
+	idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/login/v1alpha1"
 	v1alpha1 "go.pinniped.dev/generated/1.17/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	cache "k8s.io/client-go/tools/cache"
 )
@@ -47,7 +47,7 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case v1alpha1.SchemeGroupVersion.WithResource("oidcproviderconfigs"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().OIDCProviderConfigs().Informer()}, nil
 
-		// Group=idp.pinniped.dev, Version=v1alpha1
+		// Group=idp.concierge.pinniped.dev, Version=v1alpha1
 	case idpv1alpha1.SchemeGroupVersion.WithResource("webhookidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().WebhookIdentityProviders().Informer()}, nil
 
diff --git a/generated/1.17/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go b/generated/1.17/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
index 5ed462b97..246ac27bd 100644
--- a/generated/1.17/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.17/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
@@ -8,7 +8,7 @@ package v1alpha1
 import (
 	time "time"
 
-	idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1"
 	versioned "go.pinniped.dev/generated/1.17/client/clientset/versioned"
 	internalinterfaces "go.pinniped.dev/generated/1.17/client/informers/externalversions/internalinterfaces"
 	v1alpha1 "go.pinniped.dev/generated/1.17/client/listers/idp/v1alpha1"
diff --git a/generated/1.17/client/listers/idp/v1alpha1/webhookidentityprovider.go b/generated/1.17/client/listers/idp/v1alpha1/webhookidentityprovider.go
index 1081006af..afe205731 100644
--- a/generated/1.17/client/listers/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.17/client/listers/idp/v1alpha1/webhookidentityprovider.go
@@ -6,7 +6,7 @@
 package v1alpha1
 
 import (
-	v1alpha1 "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
diff --git a/generated/1.17/client/openapi/zz_generated.openapi.go b/generated/1.17/client/openapi/zz_generated.openapi.go
index 9ce251b34..9350e05af 100644
--- a/generated/1.17/client/openapi/zz_generated.openapi.go
+++ b/generated/1.17/client/openapi/zz_generated.openapi.go
@@ -17,6 +17,12 @@ import (
 
 func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition {
 	return map[string]common.OpenAPIDefinition{
+		"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.Condition":                      schema_apis_concierge_idp_v1alpha1_Condition(ref),
+		"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.TLSSpec":                        schema_apis_concierge_idp_v1alpha1_TLSSpec(ref),
+		"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProvider":        schema_apis_concierge_idp_v1alpha1_WebhookIdentityProvider(ref),
+		"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProviderList":    schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderList(ref),
+		"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec":    schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderSpec(ref),
+		"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus":  schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderStatus(ref),
 		"go.pinniped.dev/generated/1.17/apis/concierge/login/v1alpha1.ClusterCredential":            schema_apis_concierge_login_v1alpha1_ClusterCredential(ref),
 		"go.pinniped.dev/generated/1.17/apis/concierge/login/v1alpha1.TokenCredentialRequest":       schema_apis_concierge_login_v1alpha1_TokenCredentialRequest(ref),
 		"go.pinniped.dev/generated/1.17/apis/concierge/login/v1alpha1.TokenCredentialRequestList":   schema_apis_concierge_login_v1alpha1_TokenCredentialRequestList(ref),
@@ -31,12 +37,6 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"go.pinniped.dev/generated/1.17/apis/config/v1alpha1.OIDCProviderConfigList":                schema_117_apis_config_v1alpha1_OIDCProviderConfigList(ref),
 		"go.pinniped.dev/generated/1.17/apis/config/v1alpha1.OIDCProviderConfigSpec":                schema_117_apis_config_v1alpha1_OIDCProviderConfigSpec(ref),
 		"go.pinniped.dev/generated/1.17/apis/config/v1alpha1.OIDCProviderConfigStatus":              schema_117_apis_config_v1alpha1_OIDCProviderConfigStatus(ref),
-		"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.Condition":                                schema_117_apis_idp_v1alpha1_Condition(ref),
-		"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.TLSSpec":                                  schema_117_apis_idp_v1alpha1_TLSSpec(ref),
-		"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProvider":                  schema_117_apis_idp_v1alpha1_WebhookIdentityProvider(ref),
-		"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProviderList":              schema_117_apis_idp_v1alpha1_WebhookIdentityProviderList(ref),
-		"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProviderSpec":              schema_117_apis_idp_v1alpha1_WebhookIdentityProviderSpec(ref),
-		"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProviderStatus":            schema_117_apis_idp_v1alpha1_WebhookIdentityProviderStatus(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIGroup":                                             schema_pkg_apis_meta_v1_APIGroup(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIGroupList":                                         schema_pkg_apis_meta_v1_APIGroupList(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIResource":                                          schema_pkg_apis_meta_v1_APIResource(ref),
@@ -91,6 +91,244 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 	}
 }
 
+func schema_apis_concierge_idp_v1alpha1_Condition(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Description: "type of condition in CamelCase or in foo.example.com/CamelCase.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "status of the condition, one of True, False, Unknown.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"observedGeneration": {
+						SchemaProps: spec.SchemaProps{
+							Description: "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"lastTransitionTime": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.Time"),
+						},
+					},
+					"reason": {
+						SchemaProps: spec.SchemaProps{
+							Description: "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"message": {
+						SchemaProps: spec.SchemaProps{
+							Description: "message is a human readable message indicating details about the transition. This may be an empty string.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"type", "status", "lastTransitionTime", "reason", "message"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.Time"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_TLSSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Configuration for configuring TLS on various identity providers.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"certificateAuthorityData": {
+						SchemaProps: spec.SchemaProps{
+							Description: "X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProvider(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec for configuring the identity provider.",
+							Ref:         ref("go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status of the identity provider.",
+							Ref:         ref("go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus"),
+						},
+					},
+				},
+				Required: []string{"spec"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec", "go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "List of WebhookIdentityProvider objects.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref("go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProvider"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.WebhookIdentityProvider", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Spec for configuring a webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"endpoint": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Webhook server endpoint URL.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"tls": {
+						SchemaProps: spec.SchemaProps{
+							Description: "TLS configuration.",
+							Ref:         ref("go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.TLSSpec"),
+						},
+					},
+				},
+				Required: []string{"endpoint"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.TLSSpec"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Status of a webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"type",
+								},
+								"x-kubernetes-list-type":       "map",
+								"x-kubernetes-patch-merge-key": "type",
+								"x-kubernetes-patch-strategy":  "merge",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Represents the observations of an identity provider's current state.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref("go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.Condition"),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.17/apis/concierge/idp/v1alpha1.Condition"},
+	}
+}
+
 func schema_apis_concierge_login_v1alpha1_ClusterCredential(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -642,244 +880,6 @@ func schema_117_apis_config_v1alpha1_OIDCProviderConfigStatus(ref common.Referen
 	}
 }
 
-func schema_117_apis_idp_v1alpha1_Condition(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"type": {
-						SchemaProps: spec.SchemaProps{
-							Description: "type of condition in CamelCase or in foo.example.com/CamelCase.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"status": {
-						SchemaProps: spec.SchemaProps{
-							Description: "status of the condition, one of True, False, Unknown.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"observedGeneration": {
-						SchemaProps: spec.SchemaProps{
-							Description: "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
-							Type:        []string{"integer"},
-							Format:      "int64",
-						},
-					},
-					"lastTransitionTime": {
-						SchemaProps: spec.SchemaProps{
-							Description: "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
-							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.Time"),
-						},
-					},
-					"reason": {
-						SchemaProps: spec.SchemaProps{
-							Description: "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"message": {
-						SchemaProps: spec.SchemaProps{
-							Description: "message is a human readable message indicating details about the transition. This may be an empty string.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-				},
-				Required: []string{"type", "status", "lastTransitionTime", "reason", "message"},
-			},
-		},
-		Dependencies: []string{
-			"k8s.io/apimachinery/pkg/apis/meta/v1.Time"},
-	}
-}
-
-func schema_117_apis_idp_v1alpha1_TLSSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Configuration for configuring TLS on various identity providers.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"certificateAuthorityData": {
-						SchemaProps: spec.SchemaProps{
-							Description: "X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-				},
-			},
-		},
-	}
-}
-
-func schema_117_apis_idp_v1alpha1_WebhookIdentityProvider(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Spec for configuring the identity provider.",
-							Ref:         ref("go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProviderSpec"),
-						},
-					},
-					"status": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Status of the identity provider.",
-							Ref:         ref("go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProviderStatus"),
-						},
-					},
-				},
-				Required: []string{"spec"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProviderSpec", "go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProviderStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
-	}
-}
-
-func schema_117_apis_idp_v1alpha1_WebhookIdentityProviderList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "List of WebhookIdentityProvider objects.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Ref: ref("go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProvider"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"items"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.WebhookIdentityProvider", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
-	}
-}
-
-func schema_117_apis_idp_v1alpha1_WebhookIdentityProviderSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Spec for configuring a webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"endpoint": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Webhook server endpoint URL.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"tls": {
-						SchemaProps: spec.SchemaProps{
-							Description: "TLS configuration.",
-							Ref:         ref("go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.TLSSpec"),
-						},
-					},
-				},
-				Required: []string{"endpoint"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.TLSSpec"},
-	}
-}
-
-func schema_117_apis_idp_v1alpha1_WebhookIdentityProviderStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Status of a webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"conditions": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-map-keys": []interface{}{
-									"type",
-								},
-								"x-kubernetes-list-type":       "map",
-								"x-kubernetes-patch-merge-key": "type",
-								"x-kubernetes-patch-strategy":  "merge",
-							},
-						},
-						SchemaProps: spec.SchemaProps{
-							Description: "Represents the observations of an identity provider's current state.",
-							Type:        []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Ref: ref("go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.Condition"),
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.17/apis/idp/v1alpha1.Condition"},
-	}
-}
-
 func schema_pkg_apis_meta_v1_APIGroup(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
diff --git a/generated/1.18/crds/idp.pinniped.dev_webhookidentityproviders.yaml b/generated/1.17/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
similarity index 98%
rename from generated/1.18/crds/idp.pinniped.dev_webhookidentityproviders.yaml
rename to generated/1.17/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
index 213b7ad20..af2416426 100644
--- a/generated/1.18/crds/idp.pinniped.dev_webhookidentityproviders.yaml
+++ b/generated/1.17/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
@@ -6,9 +6,9 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.4.0
   creationTimestamp: null
-  name: webhookidentityproviders.idp.pinniped.dev
+  name: webhookidentityproviders.idp.concierge.pinniped.dev
 spec:
-  group: idp.pinniped.dev
+  group: idp.concierge.pinniped.dev
   names:
     categories:
     - all
diff --git a/generated/1.18/README.adoc b/generated/1.18/README.adoc
index 0d3dabd97..42bbd525b 100644
--- a/generated/1.18/README.adoc
+++ b/generated/1.18/README.adoc
@@ -6,7 +6,7 @@
 
 .Packages
 - xref:{anchor_prefix}-config-pinniped-dev-v1alpha1[$$config.pinniped.dev/v1alpha1$$]
-- xref:{anchor_prefix}-idp-pinniped-dev-v1alpha1[$$idp.pinniped.dev/v1alpha1$$]
+- xref:{anchor_prefix}-idp-concierge-pinniped-dev-v1alpha1[$$idp.concierge.pinniped.dev/v1alpha1$$]
 - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$]
 
 
@@ -161,21 +161,21 @@ OIDCProviderConfigStatus is a struct that describes the actual state of an OIDC
 
 
 
-[id="{anchor_prefix}-idp-pinniped-dev-v1alpha1"]
-=== idp.pinniped.dev/v1alpha1
+[id="{anchor_prefix}-idp-concierge-pinniped-dev-v1alpha1"]
+=== idp.concierge.pinniped.dev/v1alpha1
 
 Package v1alpha1 is the v1alpha1 version of the Pinniped identity provider API.
 
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-condition"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-condition"]
 ==== Condition 
 
 Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -190,14 +190,14 @@ Condition status of a resource (mirrored from the metav1.Condition type added in
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-tlsspec"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-tlsspec"]
 ==== TLSSpec 
 
 Configuration for configuring TLS on various identity providers.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -207,14 +207,14 @@ Configuration for configuring TLS on various identity providers.
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityprovider"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityprovider"]
 ==== WebhookIdentityProvider 
 
 WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityproviderlist[$$WebhookIdentityProviderList$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityproviderlist[$$WebhookIdentityProviderList$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -222,45 +222,45 @@ WebhookIdentityProvider describes the configuration of a Pinniped webhook identi
 | Field | Description
 | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
 
-| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]__ | Spec for configuring the identity provider.
-| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]__ | Status of the identity provider.
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]__ | Spec for configuring the identity provider.
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]__ | Status of the identity provider.
 |===
 
 
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityproviderspec"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityproviderspec"]
 ==== WebhookIdentityProviderSpec 
 
 Spec for configuring a webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
 ****
 
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
 | *`endpoint`* __string__ | Webhook server endpoint URL.
-| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration.
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration.
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityproviderstatus"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus"]
 ==== WebhookIdentityProviderStatus 
 
 Status of a webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
 ****
 
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-idp-v1alpha1-condition[$$Condition$$]__ | Represents the observations of an identity provider's current state.
+| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-idp-v1alpha1-condition[$$Condition$$]__ | Represents the observations of an identity provider's current state.
 |===
 
 
diff --git a/generated/1.18/apis/idp/doc.go b/generated/1.18/apis/concierge/idp/doc.go
similarity index 84%
rename from generated/1.18/apis/idp/doc.go
rename to generated/1.18/apis/concierge/idp/doc.go
index 17d329436..22adc1b52 100644
--- a/generated/1.18/apis/idp/doc.go
+++ b/generated/1.18/apis/concierge/idp/doc.go
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package
-// +groupName=idp.pinniped.dev
+// +groupName=idp.concierge.pinniped.dev
 
 // Package idp is the internal version of the Pinniped identity provider API.
 package idp
diff --git a/generated/1.18/apis/idp/v1alpha1/conversion.go b/generated/1.18/apis/concierge/idp/v1alpha1/conversion.go
similarity index 100%
rename from generated/1.18/apis/idp/v1alpha1/conversion.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/conversion.go
diff --git a/generated/1.18/apis/idp/v1alpha1/defaults.go b/generated/1.18/apis/concierge/idp/v1alpha1/defaults.go
similarity index 100%
rename from generated/1.18/apis/idp/v1alpha1/defaults.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/defaults.go
diff --git a/generated/1.17/apis/idp/v1alpha1/doc.go b/generated/1.18/apis/concierge/idp/v1alpha1/doc.go
similarity index 73%
rename from generated/1.17/apis/idp/v1alpha1/doc.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/doc.go
index 915de628e..8053d0a2f 100644
--- a/generated/1.17/apis/idp/v1alpha1/doc.go
+++ b/generated/1.18/apis/concierge/idp/v1alpha1/doc.go
@@ -3,9 +3,9 @@
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/generated/1.17/apis/idp
+// +k8s:conversion-gen=go.pinniped.dev/generated/1.18/apis/concierge/idp
 // +k8s:defaulter-gen=TypeMeta
-// +groupName=idp.pinniped.dev
+// +groupName=idp.concierge.pinniped.dev
 // +groupGoName=IDP
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped identity provider API.
diff --git a/generated/1.18/apis/idp/v1alpha1/register.go b/generated/1.18/apis/concierge/idp/v1alpha1/register.go
similarity index 96%
rename from generated/1.18/apis/idp/v1alpha1/register.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/register.go
index 494aef367..021640359 100644
--- a/generated/1.18/apis/idp/v1alpha1/register.go
+++ b/generated/1.18/apis/concierge/idp/v1alpha1/register.go
@@ -9,7 +9,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
-const GroupName = "idp.pinniped.dev"
+const GroupName = "idp.concierge.pinniped.dev"
 
 // SchemeGroupVersion is group version used to register these objects.
 var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
diff --git a/generated/1.18/apis/idp/v1alpha1/types_meta.go b/generated/1.18/apis/concierge/idp/v1alpha1/types_meta.go
similarity index 100%
rename from generated/1.18/apis/idp/v1alpha1/types_meta.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/types_meta.go
diff --git a/generated/1.18/apis/idp/v1alpha1/types_tls.go b/generated/1.18/apis/concierge/idp/v1alpha1/types_tls.go
similarity index 100%
rename from generated/1.18/apis/idp/v1alpha1/types_tls.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/types_tls.go
diff --git a/generated/1.18/apis/idp/v1alpha1/types_webhook.go b/generated/1.18/apis/concierge/idp/v1alpha1/types_webhook.go
similarity index 100%
rename from generated/1.18/apis/idp/v1alpha1/types_webhook.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/types_webhook.go
diff --git a/generated/1.18/apis/idp/v1alpha1/zz_generated.conversion.go b/generated/1.18/apis/concierge/idp/v1alpha1/zz_generated.conversion.go
similarity index 100%
rename from generated/1.18/apis/idp/v1alpha1/zz_generated.conversion.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/zz_generated.conversion.go
diff --git a/generated/1.18/apis/idp/v1alpha1/zz_generated.deepcopy.go b/generated/1.18/apis/concierge/idp/v1alpha1/zz_generated.deepcopy.go
similarity index 100%
rename from generated/1.18/apis/idp/v1alpha1/zz_generated.deepcopy.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/zz_generated.deepcopy.go
diff --git a/generated/1.18/apis/idp/v1alpha1/zz_generated.defaults.go b/generated/1.18/apis/concierge/idp/v1alpha1/zz_generated.defaults.go
similarity index 100%
rename from generated/1.18/apis/idp/v1alpha1/zz_generated.defaults.go
rename to generated/1.18/apis/concierge/idp/v1alpha1/zz_generated.defaults.go
diff --git a/generated/1.18/apis/idp/zz_generated.deepcopy.go b/generated/1.18/apis/concierge/idp/zz_generated.deepcopy.go
similarity index 100%
rename from generated/1.18/apis/idp/zz_generated.deepcopy.go
rename to generated/1.18/apis/concierge/idp/zz_generated.deepcopy.go
diff --git a/generated/1.18/client/clientset/versioned/fake/register.go b/generated/1.18/client/clientset/versioned/fake/register.go
index 24b90e32e..92d661cea 100644
--- a/generated/1.18/client/clientset/versioned/fake/register.go
+++ b/generated/1.18/client/clientset/versioned/fake/register.go
@@ -6,9 +6,9 @@
 package fake
 
 import (
+	idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/login/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/1.18/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
diff --git a/generated/1.18/client/clientset/versioned/scheme/register.go b/generated/1.18/client/clientset/versioned/scheme/register.go
index d8373c67c..47b008a88 100644
--- a/generated/1.18/client/clientset/versioned/scheme/register.go
+++ b/generated/1.18/client/clientset/versioned/scheme/register.go
@@ -6,9 +6,9 @@
 package scheme
 
 import (
+	idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/login/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/1.18/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
diff --git a/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go b/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
index fd10c7060..00071eee3 100644
--- a/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
+++ b/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
@@ -8,7 +8,7 @@ package fake
 import (
 	"context"
 
-	v1alpha1 "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
@@ -23,9 +23,9 @@ type FakeWebhookIdentityProviders struct {
 	ns   string
 }
 
-var webhookidentityprovidersResource = schema.GroupVersionResource{Group: "idp.pinniped.dev", Version: "v1alpha1", Resource: "webhookidentityproviders"}
+var webhookidentityprovidersResource = schema.GroupVersionResource{Group: "idp.concierge.pinniped.dev", Version: "v1alpha1", Resource: "webhookidentityproviders"}
 
-var webhookidentityprovidersKind = schema.GroupVersionKind{Group: "idp.pinniped.dev", Version: "v1alpha1", Kind: "WebhookIdentityProvider"}
+var webhookidentityprovidersKind = schema.GroupVersionKind{Group: "idp.concierge.pinniped.dev", Version: "v1alpha1", Kind: "WebhookIdentityProvider"}
 
 // Get takes name of the webhookIdentityProvider, and returns the corresponding webhookIdentityProvider object, and an error if there is any.
 func (c *FakeWebhookIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.WebhookIdentityProvider, err error) {
diff --git a/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go b/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
index abb575ff2..45705e9a6 100644
--- a/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
+++ b/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
@@ -6,7 +6,7 @@
 package v1alpha1
 
 import (
-	v1alpha1 "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1"
 	"go.pinniped.dev/generated/1.18/client/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
 )
@@ -16,7 +16,7 @@ type IDPV1alpha1Interface interface {
 	WebhookIdentityProvidersGetter
 }
 
-// IDPV1alpha1Client is used to interact with features provided by the idp.pinniped.dev group.
+// IDPV1alpha1Client is used to interact with features provided by the idp.concierge.pinniped.dev group.
 type IDPV1alpha1Client struct {
 	restClient rest.Interface
 }
diff --git a/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go b/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
index 0f262177a..389aff71b 100644
--- a/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.18/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
@@ -9,7 +9,7 @@ import (
 	"context"
 	"time"
 
-	v1alpha1 "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1"
 	scheme "go.pinniped.dev/generated/1.18/client/clientset/versioned/scheme"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
diff --git a/generated/1.18/client/informers/externalversions/generic.go b/generated/1.18/client/informers/externalversions/generic.go
index 0738f86b1..1c522d115 100644
--- a/generated/1.18/client/informers/externalversions/generic.go
+++ b/generated/1.18/client/informers/externalversions/generic.go
@@ -8,9 +8,9 @@ package externalversions
 import (
 	"fmt"
 
+	idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/login/v1alpha1"
 	v1alpha1 "go.pinniped.dev/generated/1.18/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	cache "k8s.io/client-go/tools/cache"
 )
@@ -47,7 +47,7 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case v1alpha1.SchemeGroupVersion.WithResource("oidcproviderconfigs"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().OIDCProviderConfigs().Informer()}, nil
 
-		// Group=idp.pinniped.dev, Version=v1alpha1
+		// Group=idp.concierge.pinniped.dev, Version=v1alpha1
 	case idpv1alpha1.SchemeGroupVersion.WithResource("webhookidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().WebhookIdentityProviders().Informer()}, nil
 
diff --git a/generated/1.18/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go b/generated/1.18/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
index 80c8d5fc9..30c79d4db 100644
--- a/generated/1.18/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.18/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
@@ -9,7 +9,7 @@ import (
 	"context"
 	time "time"
 
-	idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1"
 	versioned "go.pinniped.dev/generated/1.18/client/clientset/versioned"
 	internalinterfaces "go.pinniped.dev/generated/1.18/client/informers/externalversions/internalinterfaces"
 	v1alpha1 "go.pinniped.dev/generated/1.18/client/listers/idp/v1alpha1"
diff --git a/generated/1.18/client/listers/idp/v1alpha1/webhookidentityprovider.go b/generated/1.18/client/listers/idp/v1alpha1/webhookidentityprovider.go
index 2ff082df9..6a9940c83 100644
--- a/generated/1.18/client/listers/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.18/client/listers/idp/v1alpha1/webhookidentityprovider.go
@@ -6,7 +6,7 @@
 package v1alpha1
 
 import (
-	v1alpha1 "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
diff --git a/generated/1.18/client/openapi/zz_generated.openapi.go b/generated/1.18/client/openapi/zz_generated.openapi.go
index 50a1623df..bf054a3ec 100644
--- a/generated/1.18/client/openapi/zz_generated.openapi.go
+++ b/generated/1.18/client/openapi/zz_generated.openapi.go
@@ -17,6 +17,12 @@ import (
 
 func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition {
 	return map[string]common.OpenAPIDefinition{
+		"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.Condition":                      schema_apis_concierge_idp_v1alpha1_Condition(ref),
+		"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.TLSSpec":                        schema_apis_concierge_idp_v1alpha1_TLSSpec(ref),
+		"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProvider":        schema_apis_concierge_idp_v1alpha1_WebhookIdentityProvider(ref),
+		"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProviderList":    schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderList(ref),
+		"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec":    schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderSpec(ref),
+		"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus":  schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderStatus(ref),
 		"go.pinniped.dev/generated/1.18/apis/concierge/login/v1alpha1.ClusterCredential":            schema_apis_concierge_login_v1alpha1_ClusterCredential(ref),
 		"go.pinniped.dev/generated/1.18/apis/concierge/login/v1alpha1.TokenCredentialRequest":       schema_apis_concierge_login_v1alpha1_TokenCredentialRequest(ref),
 		"go.pinniped.dev/generated/1.18/apis/concierge/login/v1alpha1.TokenCredentialRequestList":   schema_apis_concierge_login_v1alpha1_TokenCredentialRequestList(ref),
@@ -31,12 +37,6 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"go.pinniped.dev/generated/1.18/apis/config/v1alpha1.OIDCProviderConfigList":                schema_118_apis_config_v1alpha1_OIDCProviderConfigList(ref),
 		"go.pinniped.dev/generated/1.18/apis/config/v1alpha1.OIDCProviderConfigSpec":                schema_118_apis_config_v1alpha1_OIDCProviderConfigSpec(ref),
 		"go.pinniped.dev/generated/1.18/apis/config/v1alpha1.OIDCProviderConfigStatus":              schema_118_apis_config_v1alpha1_OIDCProviderConfigStatus(ref),
-		"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.Condition":                                schema_118_apis_idp_v1alpha1_Condition(ref),
-		"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.TLSSpec":                                  schema_118_apis_idp_v1alpha1_TLSSpec(ref),
-		"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProvider":                  schema_118_apis_idp_v1alpha1_WebhookIdentityProvider(ref),
-		"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProviderList":              schema_118_apis_idp_v1alpha1_WebhookIdentityProviderList(ref),
-		"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProviderSpec":              schema_118_apis_idp_v1alpha1_WebhookIdentityProviderSpec(ref),
-		"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProviderStatus":            schema_118_apis_idp_v1alpha1_WebhookIdentityProviderStatus(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIGroup":                                             schema_pkg_apis_meta_v1_APIGroup(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIGroupList":                                         schema_pkg_apis_meta_v1_APIGroupList(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIResource":                                          schema_pkg_apis_meta_v1_APIResource(ref),
@@ -91,6 +91,244 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 	}
 }
 
+func schema_apis_concierge_idp_v1alpha1_Condition(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Description: "type of condition in CamelCase or in foo.example.com/CamelCase.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "status of the condition, one of True, False, Unknown.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"observedGeneration": {
+						SchemaProps: spec.SchemaProps{
+							Description: "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"lastTransitionTime": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.Time"),
+						},
+					},
+					"reason": {
+						SchemaProps: spec.SchemaProps{
+							Description: "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"message": {
+						SchemaProps: spec.SchemaProps{
+							Description: "message is a human readable message indicating details about the transition. This may be an empty string.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"type", "status", "lastTransitionTime", "reason", "message"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.Time"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_TLSSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Configuration for configuring TLS on various identity providers.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"certificateAuthorityData": {
+						SchemaProps: spec.SchemaProps{
+							Description: "X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProvider(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec for configuring the identity provider.",
+							Ref:         ref("go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status of the identity provider.",
+							Ref:         ref("go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus"),
+						},
+					},
+				},
+				Required: []string{"spec"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec", "go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "List of WebhookIdentityProvider objects.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref("go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProvider"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.WebhookIdentityProvider", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Spec for configuring a webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"endpoint": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Webhook server endpoint URL.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"tls": {
+						SchemaProps: spec.SchemaProps{
+							Description: "TLS configuration.",
+							Ref:         ref("go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.TLSSpec"),
+						},
+					},
+				},
+				Required: []string{"endpoint"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.TLSSpec"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Status of a webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"type",
+								},
+								"x-kubernetes-list-type":       "map",
+								"x-kubernetes-patch-merge-key": "type",
+								"x-kubernetes-patch-strategy":  "merge",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Represents the observations of an identity provider's current state.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref("go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.Condition"),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.18/apis/concierge/idp/v1alpha1.Condition"},
+	}
+}
+
 func schema_apis_concierge_login_v1alpha1_ClusterCredential(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -642,244 +880,6 @@ func schema_118_apis_config_v1alpha1_OIDCProviderConfigStatus(ref common.Referen
 	}
 }
 
-func schema_118_apis_idp_v1alpha1_Condition(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"type": {
-						SchemaProps: spec.SchemaProps{
-							Description: "type of condition in CamelCase or in foo.example.com/CamelCase.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"status": {
-						SchemaProps: spec.SchemaProps{
-							Description: "status of the condition, one of True, False, Unknown.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"observedGeneration": {
-						SchemaProps: spec.SchemaProps{
-							Description: "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
-							Type:        []string{"integer"},
-							Format:      "int64",
-						},
-					},
-					"lastTransitionTime": {
-						SchemaProps: spec.SchemaProps{
-							Description: "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
-							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.Time"),
-						},
-					},
-					"reason": {
-						SchemaProps: spec.SchemaProps{
-							Description: "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"message": {
-						SchemaProps: spec.SchemaProps{
-							Description: "message is a human readable message indicating details about the transition. This may be an empty string.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-				},
-				Required: []string{"type", "status", "lastTransitionTime", "reason", "message"},
-			},
-		},
-		Dependencies: []string{
-			"k8s.io/apimachinery/pkg/apis/meta/v1.Time"},
-	}
-}
-
-func schema_118_apis_idp_v1alpha1_TLSSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Configuration for configuring TLS on various identity providers.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"certificateAuthorityData": {
-						SchemaProps: spec.SchemaProps{
-							Description: "X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-				},
-			},
-		},
-	}
-}
-
-func schema_118_apis_idp_v1alpha1_WebhookIdentityProvider(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Spec for configuring the identity provider.",
-							Ref:         ref("go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProviderSpec"),
-						},
-					},
-					"status": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Status of the identity provider.",
-							Ref:         ref("go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProviderStatus"),
-						},
-					},
-				},
-				Required: []string{"spec"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProviderSpec", "go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProviderStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
-	}
-}
-
-func schema_118_apis_idp_v1alpha1_WebhookIdentityProviderList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "List of WebhookIdentityProvider objects.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Ref: ref("go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProvider"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"items"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.WebhookIdentityProvider", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
-	}
-}
-
-func schema_118_apis_idp_v1alpha1_WebhookIdentityProviderSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Spec for configuring a webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"endpoint": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Webhook server endpoint URL.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"tls": {
-						SchemaProps: spec.SchemaProps{
-							Description: "TLS configuration.",
-							Ref:         ref("go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.TLSSpec"),
-						},
-					},
-				},
-				Required: []string{"endpoint"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.TLSSpec"},
-	}
-}
-
-func schema_118_apis_idp_v1alpha1_WebhookIdentityProviderStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Status of a webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"conditions": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-map-keys": []interface{}{
-									"type",
-								},
-								"x-kubernetes-list-type":       "map",
-								"x-kubernetes-patch-merge-key": "type",
-								"x-kubernetes-patch-strategy":  "merge",
-							},
-						},
-						SchemaProps: spec.SchemaProps{
-							Description: "Represents the observations of an identity provider's current state.",
-							Type:        []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Ref: ref("go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.Condition"),
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.18/apis/idp/v1alpha1.Condition"},
-	}
-}
-
 func schema_pkg_apis_meta_v1_APIGroup(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
diff --git a/deploy/concierge/idp.pinniped.dev_webhookidentityproviders.yaml b/generated/1.18/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
similarity index 98%
rename from deploy/concierge/idp.pinniped.dev_webhookidentityproviders.yaml
rename to generated/1.18/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
index 213b7ad20..af2416426 100644
--- a/deploy/concierge/idp.pinniped.dev_webhookidentityproviders.yaml
+++ b/generated/1.18/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
@@ -6,9 +6,9 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.4.0
   creationTimestamp: null
-  name: webhookidentityproviders.idp.pinniped.dev
+  name: webhookidentityproviders.idp.concierge.pinniped.dev
 spec:
-  group: idp.pinniped.dev
+  group: idp.concierge.pinniped.dev
   names:
     categories:
     - all
diff --git a/generated/1.19/README.adoc b/generated/1.19/README.adoc
index b43b2eb5f..1c8018cc2 100644
--- a/generated/1.19/README.adoc
+++ b/generated/1.19/README.adoc
@@ -6,7 +6,7 @@
 
 .Packages
 - xref:{anchor_prefix}-config-pinniped-dev-v1alpha1[$$config.pinniped.dev/v1alpha1$$]
-- xref:{anchor_prefix}-idp-pinniped-dev-v1alpha1[$$idp.pinniped.dev/v1alpha1$$]
+- xref:{anchor_prefix}-idp-concierge-pinniped-dev-v1alpha1[$$idp.concierge.pinniped.dev/v1alpha1$$]
 - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$]
 
 
@@ -161,21 +161,21 @@ OIDCProviderConfigStatus is a struct that describes the actual state of an OIDC
 
 
 
-[id="{anchor_prefix}-idp-pinniped-dev-v1alpha1"]
-=== idp.pinniped.dev/v1alpha1
+[id="{anchor_prefix}-idp-concierge-pinniped-dev-v1alpha1"]
+=== idp.concierge.pinniped.dev/v1alpha1
 
 Package v1alpha1 is the v1alpha1 version of the Pinniped identity provider API.
 
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-condition"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-condition"]
 ==== Condition 
 
 Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -190,14 +190,14 @@ Condition status of a resource (mirrored from the metav1.Condition type added in
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-tlsspec"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-tlsspec"]
 ==== TLSSpec 
 
 Configuration for configuring TLS on various identity providers.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -207,14 +207,14 @@ Configuration for configuring TLS on various identity providers.
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityprovider"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityprovider"]
 ==== WebhookIdentityProvider 
 
 WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityproviderlist[$$WebhookIdentityProviderList$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityproviderlist[$$WebhookIdentityProviderList$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -222,45 +222,45 @@ WebhookIdentityProvider describes the configuration of a Pinniped webhook identi
 | Field | Description
 | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
 
-| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]__ | Spec for configuring the identity provider.
-| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]__ | Status of the identity provider.
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityproviderspec[$$WebhookIdentityProviderSpec$$]__ | Spec for configuring the identity provider.
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus[$$WebhookIdentityProviderStatus$$]__ | Status of the identity provider.
 |===
 
 
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityproviderspec"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityproviderspec"]
 ==== WebhookIdentityProviderSpec 
 
 Spec for configuring a webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
 ****
 
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
 | *`endpoint`* __string__ | Webhook server endpoint URL.
-| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration.
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration.
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityproviderstatus"]
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityproviderstatus"]
 ==== WebhookIdentityProviderStatus 
 
 Status of a webhook identity provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-webhookidentityprovider[$$WebhookIdentityProvider$$]
 ****
 
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-idp-v1alpha1-condition[$$Condition$$]__ | Represents the observations of an identity provider's current state.
+| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-idp-v1alpha1-condition[$$Condition$$]__ | Represents the observations of an identity provider's current state.
 |===
 
 
diff --git a/generated/1.17/apis/idp/doc.go b/generated/1.19/apis/concierge/idp/doc.go
similarity index 84%
rename from generated/1.17/apis/idp/doc.go
rename to generated/1.19/apis/concierge/idp/doc.go
index 17d329436..22adc1b52 100644
--- a/generated/1.17/apis/idp/doc.go
+++ b/generated/1.19/apis/concierge/idp/doc.go
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package
-// +groupName=idp.pinniped.dev
+// +groupName=idp.concierge.pinniped.dev
 
 // Package idp is the internal version of the Pinniped identity provider API.
 package idp
diff --git a/generated/1.19/apis/idp/v1alpha1/conversion.go b/generated/1.19/apis/concierge/idp/v1alpha1/conversion.go
similarity index 100%
rename from generated/1.19/apis/idp/v1alpha1/conversion.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/conversion.go
diff --git a/generated/1.19/apis/idp/v1alpha1/defaults.go b/generated/1.19/apis/concierge/idp/v1alpha1/defaults.go
similarity index 100%
rename from generated/1.19/apis/idp/v1alpha1/defaults.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/defaults.go
diff --git a/generated/1.19/apis/idp/v1alpha1/doc.go b/generated/1.19/apis/concierge/idp/v1alpha1/doc.go
similarity index 73%
rename from generated/1.19/apis/idp/v1alpha1/doc.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/doc.go
index acc44b96e..63c0d3c40 100644
--- a/generated/1.19/apis/idp/v1alpha1/doc.go
+++ b/generated/1.19/apis/concierge/idp/v1alpha1/doc.go
@@ -3,9 +3,9 @@
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/generated/1.19/apis/idp
+// +k8s:conversion-gen=go.pinniped.dev/generated/1.19/apis/concierge/idp
 // +k8s:defaulter-gen=TypeMeta
-// +groupName=idp.pinniped.dev
+// +groupName=idp.concierge.pinniped.dev
 // +groupGoName=IDP
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped identity provider API.
diff --git a/generated/1.19/apis/idp/v1alpha1/register.go b/generated/1.19/apis/concierge/idp/v1alpha1/register.go
similarity index 96%
rename from generated/1.19/apis/idp/v1alpha1/register.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/register.go
index 494aef367..021640359 100644
--- a/generated/1.19/apis/idp/v1alpha1/register.go
+++ b/generated/1.19/apis/concierge/idp/v1alpha1/register.go
@@ -9,7 +9,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
-const GroupName = "idp.pinniped.dev"
+const GroupName = "idp.concierge.pinniped.dev"
 
 // SchemeGroupVersion is group version used to register these objects.
 var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
diff --git a/generated/1.19/apis/idp/v1alpha1/types_meta.go b/generated/1.19/apis/concierge/idp/v1alpha1/types_meta.go
similarity index 100%
rename from generated/1.19/apis/idp/v1alpha1/types_meta.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/types_meta.go
diff --git a/generated/1.19/apis/idp/v1alpha1/types_tls.go b/generated/1.19/apis/concierge/idp/v1alpha1/types_tls.go
similarity index 100%
rename from generated/1.19/apis/idp/v1alpha1/types_tls.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/types_tls.go
diff --git a/generated/1.19/apis/idp/v1alpha1/types_webhook.go b/generated/1.19/apis/concierge/idp/v1alpha1/types_webhook.go
similarity index 100%
rename from generated/1.19/apis/idp/v1alpha1/types_webhook.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/types_webhook.go
diff --git a/generated/1.19/apis/idp/v1alpha1/zz_generated.conversion.go b/generated/1.19/apis/concierge/idp/v1alpha1/zz_generated.conversion.go
similarity index 100%
rename from generated/1.19/apis/idp/v1alpha1/zz_generated.conversion.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/zz_generated.conversion.go
diff --git a/generated/1.19/apis/idp/v1alpha1/zz_generated.deepcopy.go b/generated/1.19/apis/concierge/idp/v1alpha1/zz_generated.deepcopy.go
similarity index 100%
rename from generated/1.19/apis/idp/v1alpha1/zz_generated.deepcopy.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/zz_generated.deepcopy.go
diff --git a/generated/1.19/apis/idp/v1alpha1/zz_generated.defaults.go b/generated/1.19/apis/concierge/idp/v1alpha1/zz_generated.defaults.go
similarity index 100%
rename from generated/1.19/apis/idp/v1alpha1/zz_generated.defaults.go
rename to generated/1.19/apis/concierge/idp/v1alpha1/zz_generated.defaults.go
diff --git a/generated/1.19/apis/idp/zz_generated.deepcopy.go b/generated/1.19/apis/concierge/idp/zz_generated.deepcopy.go
similarity index 100%
rename from generated/1.19/apis/idp/zz_generated.deepcopy.go
rename to generated/1.19/apis/concierge/idp/zz_generated.deepcopy.go
diff --git a/generated/1.19/client/clientset/versioned/fake/register.go b/generated/1.19/client/clientset/versioned/fake/register.go
index dc1268ce0..6ac8af66c 100644
--- a/generated/1.19/client/clientset/versioned/fake/register.go
+++ b/generated/1.19/client/clientset/versioned/fake/register.go
@@ -6,9 +6,9 @@
 package fake
 
 import (
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/login/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
diff --git a/generated/1.19/client/clientset/versioned/scheme/register.go b/generated/1.19/client/clientset/versioned/scheme/register.go
index 41bcc8933..bec738f4b 100644
--- a/generated/1.19/client/clientset/versioned/scheme/register.go
+++ b/generated/1.19/client/clientset/versioned/scheme/register.go
@@ -6,9 +6,9 @@
 package scheme
 
 import (
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/login/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
diff --git a/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go b/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
index 3e31b6eb5..1b64361cf 100644
--- a/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
+++ b/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/fake/fake_webhookidentityprovider.go
@@ -8,7 +8,7 @@ package fake
 import (
 	"context"
 
-	v1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
@@ -23,9 +23,9 @@ type FakeWebhookIdentityProviders struct {
 	ns   string
 }
 
-var webhookidentityprovidersResource = schema.GroupVersionResource{Group: "idp.pinniped.dev", Version: "v1alpha1", Resource: "webhookidentityproviders"}
+var webhookidentityprovidersResource = schema.GroupVersionResource{Group: "idp.concierge.pinniped.dev", Version: "v1alpha1", Resource: "webhookidentityproviders"}
 
-var webhookidentityprovidersKind = schema.GroupVersionKind{Group: "idp.pinniped.dev", Version: "v1alpha1", Kind: "WebhookIdentityProvider"}
+var webhookidentityprovidersKind = schema.GroupVersionKind{Group: "idp.concierge.pinniped.dev", Version: "v1alpha1", Kind: "WebhookIdentityProvider"}
 
 // Get takes name of the webhookIdentityProvider, and returns the corresponding webhookIdentityProvider object, and an error if there is any.
 func (c *FakeWebhookIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.WebhookIdentityProvider, err error) {
diff --git a/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go b/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
index 78af6a585..cf93cc9ab 100644
--- a/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
+++ b/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/idp_client.go
@@ -6,7 +6,7 @@
 package v1alpha1
 
 import (
-	v1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	"go.pinniped.dev/generated/1.19/client/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
 )
@@ -16,7 +16,7 @@ type IDPV1alpha1Interface interface {
 	WebhookIdentityProvidersGetter
 }
 
-// IDPV1alpha1Client is used to interact with features provided by the idp.pinniped.dev group.
+// IDPV1alpha1Client is used to interact with features provided by the idp.concierge.pinniped.dev group.
 type IDPV1alpha1Client struct {
 	restClient rest.Interface
 }
diff --git a/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go b/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
index 05948c7f9..b17cc8f2d 100644
--- a/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.19/client/clientset/versioned/typed/idp/v1alpha1/webhookidentityprovider.go
@@ -9,7 +9,7 @@ import (
 	"context"
 	"time"
 
-	v1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	scheme "go.pinniped.dev/generated/1.19/client/clientset/versioned/scheme"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
diff --git a/generated/1.19/client/informers/externalversions/generic.go b/generated/1.19/client/informers/externalversions/generic.go
index 46029aba2..424b73809 100644
--- a/generated/1.19/client/informers/externalversions/generic.go
+++ b/generated/1.19/client/informers/externalversions/generic.go
@@ -8,9 +8,9 @@ package externalversions
 import (
 	"fmt"
 
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/login/v1alpha1"
 	v1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	cache "k8s.io/client-go/tools/cache"
 )
@@ -47,7 +47,7 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case v1alpha1.SchemeGroupVersion.WithResource("oidcproviderconfigs"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().OIDCProviderConfigs().Informer()}, nil
 
-		// Group=idp.pinniped.dev, Version=v1alpha1
+		// Group=idp.concierge.pinniped.dev, Version=v1alpha1
 	case idpv1alpha1.SchemeGroupVersion.WithResource("webhookidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().WebhookIdentityProviders().Informer()}, nil
 
diff --git a/generated/1.19/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go b/generated/1.19/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
index 5d8814a07..0238ec1a2 100644
--- a/generated/1.19/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.19/client/informers/externalversions/idp/v1alpha1/webhookidentityprovider.go
@@ -9,7 +9,7 @@ import (
 	"context"
 	time "time"
 
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	versioned "go.pinniped.dev/generated/1.19/client/clientset/versioned"
 	internalinterfaces "go.pinniped.dev/generated/1.19/client/informers/externalversions/internalinterfaces"
 	v1alpha1 "go.pinniped.dev/generated/1.19/client/listers/idp/v1alpha1"
diff --git a/generated/1.19/client/listers/idp/v1alpha1/webhookidentityprovider.go b/generated/1.19/client/listers/idp/v1alpha1/webhookidentityprovider.go
index 93c7de14f..ec0af7e10 100644
--- a/generated/1.19/client/listers/idp/v1alpha1/webhookidentityprovider.go
+++ b/generated/1.19/client/listers/idp/v1alpha1/webhookidentityprovider.go
@@ -6,7 +6,7 @@
 package v1alpha1
 
 import (
-	v1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	v1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
diff --git a/generated/1.19/client/openapi/zz_generated.openapi.go b/generated/1.19/client/openapi/zz_generated.openapi.go
index 900e7b71b..ee18adb8e 100644
--- a/generated/1.19/client/openapi/zz_generated.openapi.go
+++ b/generated/1.19/client/openapi/zz_generated.openapi.go
@@ -17,6 +17,12 @@ import (
 
 func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition {
 	return map[string]common.OpenAPIDefinition{
+		"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.Condition":                      schema_apis_concierge_idp_v1alpha1_Condition(ref),
+		"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.TLSSpec":                        schema_apis_concierge_idp_v1alpha1_TLSSpec(ref),
+		"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProvider":        schema_apis_concierge_idp_v1alpha1_WebhookIdentityProvider(ref),
+		"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProviderList":    schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderList(ref),
+		"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec":    schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderSpec(ref),
+		"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus":  schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderStatus(ref),
 		"go.pinniped.dev/generated/1.19/apis/concierge/login/v1alpha1.ClusterCredential":            schema_apis_concierge_login_v1alpha1_ClusterCredential(ref),
 		"go.pinniped.dev/generated/1.19/apis/concierge/login/v1alpha1.TokenCredentialRequest":       schema_apis_concierge_login_v1alpha1_TokenCredentialRequest(ref),
 		"go.pinniped.dev/generated/1.19/apis/concierge/login/v1alpha1.TokenCredentialRequestList":   schema_apis_concierge_login_v1alpha1_TokenCredentialRequestList(ref),
@@ -31,12 +37,6 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"go.pinniped.dev/generated/1.19/apis/config/v1alpha1.OIDCProviderConfigList":                schema_119_apis_config_v1alpha1_OIDCProviderConfigList(ref),
 		"go.pinniped.dev/generated/1.19/apis/config/v1alpha1.OIDCProviderConfigSpec":                schema_119_apis_config_v1alpha1_OIDCProviderConfigSpec(ref),
 		"go.pinniped.dev/generated/1.19/apis/config/v1alpha1.OIDCProviderConfigStatus":              schema_119_apis_config_v1alpha1_OIDCProviderConfigStatus(ref),
-		"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.Condition":                                schema_119_apis_idp_v1alpha1_Condition(ref),
-		"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.TLSSpec":                                  schema_119_apis_idp_v1alpha1_TLSSpec(ref),
-		"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProvider":                  schema_119_apis_idp_v1alpha1_WebhookIdentityProvider(ref),
-		"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProviderList":              schema_119_apis_idp_v1alpha1_WebhookIdentityProviderList(ref),
-		"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProviderSpec":              schema_119_apis_idp_v1alpha1_WebhookIdentityProviderSpec(ref),
-		"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProviderStatus":            schema_119_apis_idp_v1alpha1_WebhookIdentityProviderStatus(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIGroup":                                             schema_pkg_apis_meta_v1_APIGroup(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIGroupList":                                         schema_pkg_apis_meta_v1_APIGroupList(ref),
 		"k8s.io/apimachinery/pkg/apis/meta/v1.APIResource":                                          schema_pkg_apis_meta_v1_APIResource(ref),
@@ -92,6 +92,244 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 	}
 }
 
+func schema_apis_concierge_idp_v1alpha1_Condition(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Description: "type of condition in CamelCase or in foo.example.com/CamelCase.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "status of the condition, one of True, False, Unknown.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"observedGeneration": {
+						SchemaProps: spec.SchemaProps{
+							Description: "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"lastTransitionTime": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.Time"),
+						},
+					},
+					"reason": {
+						SchemaProps: spec.SchemaProps{
+							Description: "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"message": {
+						SchemaProps: spec.SchemaProps{
+							Description: "message is a human readable message indicating details about the transition. This may be an empty string.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"type", "status", "lastTransitionTime", "reason", "message"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.Time"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_TLSSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Configuration for configuring TLS on various identity providers.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"certificateAuthorityData": {
+						SchemaProps: spec.SchemaProps{
+							Description: "X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProvider(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec for configuring the identity provider.",
+							Ref:         ref("go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status of the identity provider.",
+							Ref:         ref("go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus"),
+						},
+					},
+				},
+				Required: []string{"spec"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProviderSpec", "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProviderStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "List of WebhookIdentityProvider objects.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref("go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProvider"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.WebhookIdentityProvider", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Spec for configuring a webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"endpoint": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Webhook server endpoint URL.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"tls": {
+						SchemaProps: spec.SchemaProps{
+							Description: "TLS configuration.",
+							Ref:         ref("go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.TLSSpec"),
+						},
+					},
+				},
+				Required: []string{"endpoint"},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.TLSSpec"},
+	}
+}
+
+func schema_apis_concierge_idp_v1alpha1_WebhookIdentityProviderStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Status of a webhook identity provider.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"type",
+								},
+								"x-kubernetes-list-type":       "map",
+								"x-kubernetes-patch-merge-key": "type",
+								"x-kubernetes-patch-strategy":  "merge",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Represents the observations of an identity provider's current state.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref("go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.Condition"),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1.Condition"},
+	}
+}
+
 func schema_apis_concierge_login_v1alpha1_ClusterCredential(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -643,244 +881,6 @@ func schema_119_apis_config_v1alpha1_OIDCProviderConfigStatus(ref common.Referen
 	}
 }
 
-func schema_119_apis_idp_v1alpha1_Condition(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"type": {
-						SchemaProps: spec.SchemaProps{
-							Description: "type of condition in CamelCase or in foo.example.com/CamelCase.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"status": {
-						SchemaProps: spec.SchemaProps{
-							Description: "status of the condition, one of True, False, Unknown.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"observedGeneration": {
-						SchemaProps: spec.SchemaProps{
-							Description: "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
-							Type:        []string{"integer"},
-							Format:      "int64",
-						},
-					},
-					"lastTransitionTime": {
-						SchemaProps: spec.SchemaProps{
-							Description: "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
-							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.Time"),
-						},
-					},
-					"reason": {
-						SchemaProps: spec.SchemaProps{
-							Description: "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"message": {
-						SchemaProps: spec.SchemaProps{
-							Description: "message is a human readable message indicating details about the transition. This may be an empty string.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-				},
-				Required: []string{"type", "status", "lastTransitionTime", "reason", "message"},
-			},
-		},
-		Dependencies: []string{
-			"k8s.io/apimachinery/pkg/apis/meta/v1.Time"},
-	}
-}
-
-func schema_119_apis_idp_v1alpha1_TLSSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Configuration for configuring TLS on various identity providers.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"certificateAuthorityData": {
-						SchemaProps: spec.SchemaProps{
-							Description: "X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-				},
-			},
-		},
-	}
-}
-
-func schema_119_apis_idp_v1alpha1_WebhookIdentityProvider(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "WebhookIdentityProvider describes the configuration of a Pinniped webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Spec for configuring the identity provider.",
-							Ref:         ref("go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProviderSpec"),
-						},
-					},
-					"status": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Status of the identity provider.",
-							Ref:         ref("go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProviderStatus"),
-						},
-					},
-				},
-				Required: []string{"spec"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProviderSpec", "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProviderStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
-	}
-}
-
-func schema_119_apis_idp_v1alpha1_WebhookIdentityProviderList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "List of WebhookIdentityProvider objects.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Ref: ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Ref: ref("go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProvider"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"items"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.WebhookIdentityProvider", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
-	}
-}
-
-func schema_119_apis_idp_v1alpha1_WebhookIdentityProviderSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Spec for configuring a webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"endpoint": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Webhook server endpoint URL.",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"tls": {
-						SchemaProps: spec.SchemaProps{
-							Description: "TLS configuration.",
-							Ref:         ref("go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.TLSSpec"),
-						},
-					},
-				},
-				Required: []string{"endpoint"},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.TLSSpec"},
-	}
-}
-
-func schema_119_apis_idp_v1alpha1_WebhookIdentityProviderStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Status of a webhook identity provider.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"conditions": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-map-keys": []interface{}{
-									"type",
-								},
-								"x-kubernetes-list-type":       "map",
-								"x-kubernetes-patch-merge-key": "type",
-								"x-kubernetes-patch-strategy":  "merge",
-							},
-						},
-						SchemaProps: spec.SchemaProps{
-							Description: "Represents the observations of an identity provider's current state.",
-							Type:        []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Ref: ref("go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.Condition"),
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"go.pinniped.dev/generated/1.19/apis/idp/v1alpha1.Condition"},
-	}
-}
-
 func schema_pkg_apis_meta_v1_APIGroup(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
diff --git a/generated/1.19/crds/idp.pinniped.dev_webhookidentityproviders.yaml b/generated/1.19/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
similarity index 98%
rename from generated/1.19/crds/idp.pinniped.dev_webhookidentityproviders.yaml
rename to generated/1.19/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
index 213b7ad20..af2416426 100644
--- a/generated/1.19/crds/idp.pinniped.dev_webhookidentityproviders.yaml
+++ b/generated/1.19/crds/idp.concierge.pinniped.dev_webhookidentityproviders.yaml
@@ -6,9 +6,9 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.4.0
   creationTimestamp: null
-  name: webhookidentityproviders.idp.pinniped.dev
+  name: webhookidentityproviders.idp.concierge.pinniped.dev
 spec:
-  group: idp.pinniped.dev
+  group: idp.concierge.pinniped.dev
   names:
     categories:
     - all
diff --git a/hack/lib/docs/config.yaml b/hack/lib/docs/config.yaml
index 6efb47114..078c13cdf 100644
--- a/hack/lib/docs/config.yaml
+++ b/hack/lib/docs/config.yaml
@@ -4,7 +4,7 @@ processor:
   #  Ignore internal API versions
   ignoreGroupVersions:
     - "config.pinniped.dev/config"
-    - "idp.pinniped.dev/idp"
+    - "idp.concierge.pinniped.dev/idp"
     - "login.concierge.pinniped.dev/login"
   ignoreFields:
     - "TypeMeta$"
diff --git a/hack/lib/tilt/Tiltfile b/hack/lib/tilt/Tiltfile
index 67509cc44..653668545 100644
--- a/hack/lib/tilt/Tiltfile
+++ b/hack/lib/tilt/Tiltfile
@@ -170,7 +170,7 @@ k8s_resource(
         'pinniped-concierge:clusterrolebinding',
         'pinniped-concierge:serviceaccount',
         'credentialissuerconfigs.config.pinniped.dev:customresourcedefinition',
-        'webhookidentityproviders.idp.pinniped.dev:customresourcedefinition',
+        'webhookidentityproviders.idp.concierge.pinniped.dev:customresourcedefinition',
         'v1alpha1.login.concierge.pinniped.dev:apiservice',
     ],
 )
diff --git a/hack/lib/update-codegen.sh b/hack/lib/update-codegen.sh
index 001c8d55c..bef6aec01 100755
--- a/hack/lib/update-codegen.sh
+++ b/hack/lib/update-codegen.sh
@@ -110,7 +110,7 @@ echo "generating API-related code for our public API groups..."
         deepcopy \
         "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/apis" \
         "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/apis" \
-        "config:v1alpha1 idp:v1alpha1 concierge/login:v1alpha1" \
+        "config:v1alpha1 concierge/idp:v1alpha1 concierge/login:v1alpha1" \
         --go-header-file "${ROOT}/hack/boilerplate.go.txt" 2>&1 | sed "s|^|gen-api > |"
 )
 
@@ -122,7 +122,7 @@ echo "generating API-related code for our internal API groups..."
         "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/client" \
         "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/apis" \
         "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/apis" \
-        "config:v1alpha1 idp:v1alpha1 concierge/login:v1alpha1" \
+        "config:v1alpha1 concierge/idp:v1alpha1 concierge/login:v1alpha1" \
         --go-header-file "${ROOT}/hack/boilerplate.go.txt"  2>&1 | sed "s|^|gen-int-api > |"
 )
 
@@ -137,7 +137,7 @@ echo "generating client code for our public API groups..."
         client,lister,informer \
         "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/client" \
         "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/apis" \
-        "config:v1alpha1 idp:v1alpha1 concierge/login:v1alpha1" \
+        "config:v1alpha1 concierge/idp:v1alpha1 concierge/login:v1alpha1" \
         --go-header-file "${ROOT}/hack/boilerplate.go.txt"  2>&1 | sed "s|^|gen-client > |"
 )
 
@@ -157,5 +157,5 @@ crd-ref-docs \
 # Generate CRD YAML
 (cd apis &&
     controller-gen paths=./config/v1alpha1 crd:trivialVersions=true output:crd:artifacts:config=../crds &&
-    controller-gen paths=./idp/v1alpha1 crd:trivialVersions=true output:crd:artifacts:config=../crds
+    controller-gen paths=./concierge/idp/v1alpha1 crd:trivialVersions=true output:crd:artifacts:config=../crds
 )
diff --git a/internal/client/client_test.go b/internal/client/client_test.go
index 42a4c4028..bcb1e2e6c 100644
--- a/internal/client/client_test.go
+++ b/internal/client/client_test.go
@@ -16,8 +16,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
 
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/login/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	"go.pinniped.dev/internal/testutil"
 )
 
@@ -106,7 +106,7 @@ func TestExchangeToken(t *testing.T) {
 				  "spec": {
 					"token": "test-token",
 					"identityProvider": {
-						"apiGroup": "idp.pinniped.dev",
+						"apiGroup": "idp.concierge.pinniped.dev",
 						"kind": "WebhookIdentityProvider",
 						"name": "test-webhook"
 					}
diff --git a/internal/controller/identityprovider/idpcache/cache_test.go b/internal/controller/identityprovider/idpcache/cache_test.go
index c00396791..1cc0c292a 100644
--- a/internal/controller/identityprovider/idpcache/cache_test.go
+++ b/internal/controller/identityprovider/idpcache/cache_test.go
@@ -17,8 +17,8 @@ import (
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"
 
+	idpv1alpha "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	loginapi "go.pinniped.dev/generated/1.19/apis/concierge/login"
-	idpv1alpha "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	"go.pinniped.dev/internal/mocks/mocktokenauthenticator"
 )
 
diff --git a/internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner.go b/internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner.go
index ba8944ab6..9ab9e1691 100644
--- a/internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner.go
+++ b/internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner.go
@@ -11,7 +11,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/klog/v2"
 
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	idpinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions/idp/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
 	"go.pinniped.dev/internal/controller/identityprovider/idpcache"
diff --git a/internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner_test.go b/internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner_test.go
index 70ea0197b..e2450916c 100644
--- a/internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner_test.go
+++ b/internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner_test.go
@@ -12,7 +12,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
-	idpv1alpha "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	idpv1alpha "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/1.19/client/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions"
 	"go.pinniped.dev/internal/controller/identityprovider/idpcache"
@@ -24,19 +24,19 @@ func TestController(t *testing.T) {
 	t.Parallel()
 
 	testKey1 := idpcache.Key{
-		APIGroup:  "idp.pinniped.dev",
+		APIGroup:  "idp.concierge.pinniped.dev",
 		Kind:      "WebhookIdentityProvider",
 		Namespace: "test-namespace",
 		Name:      "test-name-one",
 	}
 	testKey2 := idpcache.Key{
-		APIGroup:  "idp.pinniped.dev",
+		APIGroup:  "idp.concierge.pinniped.dev",
 		Kind:      "WebhookIdentityProvider",
 		Namespace: "test-namespace",
 		Name:      "test-name-two",
 	}
 	testKeyNonwebhook := idpcache.Key{
-		APIGroup:  "idp.pinniped.dev",
+		APIGroup:  "idp.concierge.pinniped.dev",
 		Kind:      "SomeOtherIdentityProvider",
 		Namespace: "test-namespace",
 		Name:      "test-name-one",
diff --git a/internal/controller/identityprovider/webhookcachefiller/webhookcachefiller.go b/internal/controller/identityprovider/webhookcachefiller/webhookcachefiller.go
index c2c642a51..0f6b5539b 100644
--- a/internal/controller/identityprovider/webhookcachefiller/webhookcachefiller.go
+++ b/internal/controller/identityprovider/webhookcachefiller/webhookcachefiller.go
@@ -20,7 +20,7 @@ import (
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 	"k8s.io/klog/v2"
 
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	idpinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions/idp/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
 	"go.pinniped.dev/internal/controller/identityprovider/idpcache"
diff --git a/internal/controller/identityprovider/webhookcachefiller/webhookcachefiller_test.go b/internal/controller/identityprovider/webhookcachefiller/webhookcachefiller_test.go
index cde852162..b46b3281f 100644
--- a/internal/controller/identityprovider/webhookcachefiller/webhookcachefiller_test.go
+++ b/internal/controller/identityprovider/webhookcachefiller/webhookcachefiller_test.go
@@ -19,7 +19,7 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/1.19/client/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions"
 	"go.pinniped.dev/internal/controller/identityprovider/idpcache"
diff --git a/test/integration/concierge_credentialrequest_test.go b/test/integration/concierge_credentialrequest_test.go
index 87adb34c0..b4504cd88 100644
--- a/test/integration/concierge_credentialrequest_test.go
+++ b/test/integration/concierge_credentialrequest_test.go
@@ -16,8 +16,8 @@ import (
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/login/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	"go.pinniped.dev/test/library"
 )
 
diff --git a/test/integration/kube_api_discovery_test.go b/test/integration/kube_api_discovery_test.go
index d030a0c29..473cc682b 100644
--- a/test/integration/kube_api_discovery_test.go
+++ b/test/integration/kube_api_discovery_test.go
@@ -91,20 +91,20 @@ func TestGetAPIResourceList(t *testing.T) {
 		},
 		{
 			group: metav1.APIGroup{
-				Name: "idp.pinniped.dev",
+				Name: "idp.concierge.pinniped.dev",
 				Versions: []metav1.GroupVersionForDiscovery{
 					{
-						GroupVersion: "idp.pinniped.dev/v1alpha1",
+						GroupVersion: "idp.concierge.pinniped.dev/v1alpha1",
 						Version:      "v1alpha1",
 					},
 				},
 				PreferredVersion: metav1.GroupVersionForDiscovery{
-					GroupVersion: "idp.pinniped.dev/v1alpha1",
+					GroupVersion: "idp.concierge.pinniped.dev/v1alpha1",
 					Version:      "v1alpha1",
 				},
 			},
 			resourceByVersion: map[string][]metav1.APIResource{
-				"idp.pinniped.dev/v1alpha1": {
+				"idp.concierge.pinniped.dev/v1alpha1": {
 					{
 						Name:         "webhookidentityproviders",
 						SingularName: "webhookidentityprovider",
diff --git a/test/library/client.go b/test/library/client.go
index 95f798b45..50aa9057a 100644
--- a/test/library/client.go
+++ b/test/library/client.go
@@ -23,8 +23,8 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
 
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	pinnipedclientset "go.pinniped.dev/generated/1.19/client/clientset/versioned"
 
 	// Import to initialize client auth plugins - the kubeconfig that we use for
diff --git a/test/library/env.go b/test/library/env.go
index 22b8d6665..1ed59e1ae 100644
--- a/test/library/env.go
+++ b/test/library/env.go
@@ -13,7 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/yaml"
 
-	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/idp/v1alpha1"
 )
 
 type Capability string