Merge branch 'main' into dynamic_clients

test/integration/category_test.go

@@ -36,7 +36,7 @@ func requireCleanKubectlStderr(t *testing.T, stderr string) {
 		case strings.TrimSpace(line) == "",
 			strings.Contains(line, "Throttling request took"),
 			strings.Contains(line, "due to client-side throttling, not priority and fairness"),
-			strings.Contains(line, "the gcp auth plugin is deprecated in v1.22+, unavailable in v1.25+; use gcloud instead"),
+			strings.Contains(line, "the gcp auth plugin is deprecated in v1.22+, unavailable in "),
 			strings.Contains(line, "To learn more, consult https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke"):
 			// ignore these allowed stderr lines
 		default:

test/integration/cli_test.go

@@ -9,7 +9,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"os/exec"
@@ -94,7 +93,7 @@ func TestCLIGetKubeconfigStaticToken_Parallel(t *testing.T) {
 	t.Run("whoami", func(t *testing.T) {
 		// Validate that `pinniped whoami` returns the correct identity.
 		kubeconfigPath := filepath.Join(testutil.TempDir(t), "whoami-kubeconfig")
-		require.NoError(t, ioutil.WriteFile(kubeconfigPath, []byte(stdout), 0600))
+		require.NoError(t, os.WriteFile(kubeconfigPath, []byte(stdout), 0600))
 		assertWhoami(
 			ctx,
 			t,
@@ -174,7 +173,7 @@ func TestCLILoginOIDC_Browser(t *testing.T) {
 	env := testlib.IntegrationEnv(t)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
+	t.Cleanup(cancel)
 
 	// Build pinniped CLI.
 	pinnipedExe := testlib.PinnipedCLIPath(t)
@@ -426,7 +425,7 @@ func oidcLoginCommand(ctx context.Context, t *testing.T, pinnipedExe string, ses
 	// If there is a custom CA bundle, pass it via --ca-bundle and a temporary file.
 	if env.CLIUpstreamOIDC.CABundle != "" {
 		path := filepath.Join(testutil.TempDir(t), "test-ca.pem")
-		require.NoError(t, ioutil.WriteFile(path, []byte(env.CLIUpstreamOIDC.CABundle), 0600))
+		require.NoError(t, os.WriteFile(path, []byte(env.CLIUpstreamOIDC.CABundle), 0600))
 		cmd.Args = append(cmd.Args, "--ca-bundle", path)
 	}
 

test/integration/concierge_api_serving_certs_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -127,14 +127,14 @@ func TestAPIServingCertificateAutoCreationAndRotation_Disruptive(t *testing.T) {
 					requireEventually.Equalf(v, secret.Labels[k], "expected secret to have label `%s: %s`", k, v)
 				}
 				requireEventually.Equal(env.ConciergeAppName, secret.Labels["app"])
-			}, time.Minute, 250*time.Millisecond)
+			}, 2*time.Minute, 250*time.Millisecond)
 
 			// Expect that the APIService was also updated with the new CA.
 			testlib.RequireEventually(t, func(requireEventually *require.Assertions) {
 				apiService, err := aggregatedClient.ApiregistrationV1().APIServices().Get(ctx, apiServiceName, metav1.GetOptions{})
 				requireEventually.NoErrorf(err, "get for APIService %q returned error", apiServiceName)
 				requireEventually.Equalf(regeneratedCACert, apiService.Spec.CABundle, "CA bundle in APIService %q does not yet have the expected value", apiServiceName)
-			}, time.Minute, 250*time.Millisecond, "never saw CA certificate rotate to expected value")
+			}, 2*time.Minute, 250*time.Millisecond, "never saw CA certificate rotate to expected value")
 
 			// Check that we can still make requests to the aggregated API through the kube API server,
 			// because the kube API server uses these certs when proxying requests to the aggregated API server,

test/integration/concierge_client_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -18,10 +18,10 @@ import (
 
 // Test certificate and private key that should get an authentication error. Generated with cfssl [1], like this:
 //
-// 	$ brew install cfssl
-// 	$ cfssl print-defaults csr | cfssl genkey -initca - | cfssljson -bare ca
-// 	$ cfssl print-defaults csr | cfssl gencert -ca ca.pem -ca-key ca-key.pem -hostname=testuser - | cfssljson -bare client
-// 	$ cat client.pem client-key.pem
+//	$ brew install cfssl
+//	$ cfssl print-defaults csr | cfssl genkey -initca - | cfssljson -bare ca
+//	$ cfssl print-defaults csr | cfssl gencert -ca ca.pem -ca-key ca-key.pem -hostname=testuser - | cfssljson -bare client
+//	$ cat client.pem client-key.pem
 //
 // [1]: https://github.com/cloudflare/cfssl
 var (

test/integration/concierge_impersonation_proxy_test.go

@@ -15,7 +15,7 @@ import (
 	"encoding/json"
 	"encoding/pem"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net"
 	"net/http"
 	"net/url"
@@ -1103,7 +1103,7 @@ func TestImpersonationProxy(t *testing.T) { //nolint:gocyclo // yeah, it's compl
 			localEchoFile := filepath.Join(tempDir, filepath.Base(remoteEchoFile))
 			_, err = runKubectl(t, kubeconfigPath, envVarsWithProxy, "cp", fmt.Sprintf("%s/%s:%s", runningTestPod.Namespace, runningTestPod.Name, remoteEchoFile), localEchoFile)
 			require.NoError(t, err, `"kubectl cp" failed`)
-			localEchoFileData, err := ioutil.ReadFile(localEchoFile)
+			localEchoFileData, err := os.ReadFile(localEchoFile)
 			require.NoError(t, err)
 			require.Equal(t, echoString+"\n", string(localEchoFileData))
 
@@ -1197,7 +1197,7 @@ func TestImpersonationProxy(t *testing.T) { //nolint:gocyclo // yeah, it's compl
 					defer func() { requireEventually.NoError(resp.Body.Close()) }()
 				}
 				if err != nil && resp != nil {
-					body, _ := ioutil.ReadAll(resp.Body)
+					body, _ := io.ReadAll(resp.Body)
 					t.Logf("websocket dial failed: %d:%s", resp.StatusCode, body)
 				}
 				requireEventually.NoError(err)
@@ -1283,7 +1283,7 @@ func TestImpersonationProxy(t *testing.T) { //nolint:gocyclo // yeah, it's compl
 			require.NoError(t, err)
 			response, err := httpClient.Do(getConfigmapRequest)
 			require.NoError(t, err)
-			body, _ := ioutil.ReadAll(response.Body)
+			body, _ := io.ReadAll(response.Body)
 			t.Logf("http2 status code: %d, proto: %s, message: %s", response.StatusCode, response.Proto, body)
 			require.Equal(t, "HTTP/2.0", response.Proto)
 			require.Equal(t, http.StatusOK, response.StatusCode)
@@ -2212,7 +2212,7 @@ func getImpersonationKubeconfig(t *testing.T, env *testlib.TestEnv, impersonatio
 
 	// Write the kubeconfig to a temp file.
 	kubeconfigPath := filepath.Join(tempDir, "kubeconfig.yaml")
-	require.NoError(t, ioutil.WriteFile(kubeconfigPath, []byte(kubeconfigYAML), 0600))
+	require.NoError(t, os.WriteFile(kubeconfigPath, []byte(kubeconfigYAML), 0600))
 
 	return kubeconfigPath, envVarsWithProxy, tempDir
 }

test/integration/e2e_test.go

@@ -11,7 +11,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"os/exec"
@@ -84,7 +83,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 	testCABundlePath := filepath.Join(testutil.TempDir(t), "test-ca.pem")
 	testCABundlePEM := []byte(string(ca.Bundle()) + "\n" + env.SupervisorUpstreamOIDC.CABundle)
 	testCABundleBase64 := base64.StdEncoding.EncodeToString(testCABundlePEM)
-	require.NoError(t, ioutil.WriteFile(testCABundlePath, testCABundlePEM, 0600))
+	require.NoError(t, os.WriteFile(testCABundlePath, testCABundlePEM, 0600))
 
 	// Use the CA to issue a TLS server cert.
 	t.Logf("issuing test certificate")
@@ -384,7 +383,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		t.Logf("waiting for kubectl to output namespace list")
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlOutputBytes, _ := io.ReadAll(ptyFile)
 		requireKubectlGetNamespaceOutput(t, env, string(kubectlOutputBytes))
 
 		t.Logf("first kubectl command took %s", time.Since(start).String())
@@ -509,10 +508,10 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		t.Logf("waiting for kubectl to output namespace list")
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlPtyOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlPtyOutputBytes, _ := io.ReadAll(ptyFile)
 		if kubectlStdoutPipe != nil {
 			// On non-MacOS check that stdout of the CLI contains the expected output.
-			kubectlStdOutOutputBytes, _ := ioutil.ReadAll(kubectlStdoutPipe)
+			kubectlStdOutOutputBytes, _ := io.ReadAll(kubectlStdoutPipe)
 			requireKubectlGetNamespaceOutput(t, env, string(kubectlStdOutOutputBytes))
 		} else {
 			// On MacOS check that the pty (stdout+stderr+stdin) of the CLI contains the expected output.
@@ -603,7 +602,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlOutputBytes, _ := io.ReadAll(ptyFile)
 		requireKubectlGetNamespaceOutput(t, env, string(kubectlOutputBytes))
 
 		t.Logf("first kubectl command took %s", time.Since(start).String())
@@ -681,7 +680,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlOutputBytes, _ := io.ReadAll(ptyFile)
 		kubectlOutput := string(kubectlOutputBytes)
 
 		// The output should look like an authentication failure, because the OIDCIdentityProvider disallows password grants.
@@ -739,7 +738,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlOutputBytes, _ := io.ReadAll(ptyFile)
 		requireKubectlGetNamespaceOutput(t, env, string(kubectlOutputBytes))
 
 		t.Logf("first kubectl command took %s", time.Since(start).String())
@@ -793,7 +792,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlOutputBytes, _ := io.ReadAll(ptyFile)
 		requireKubectlGetNamespaceOutput(t, env, string(kubectlOutputBytes))
 
 		t.Logf("first kubectl command took %s", time.Since(start).String())
@@ -860,7 +859,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlOutputBytes, _ := io.ReadAll(ptyFile)
 		requireKubectlGetNamespaceOutput(t, env, string(kubectlOutputBytes))
 
 		t.Logf("first kubectl command took %s", time.Since(start).String())
@@ -918,7 +917,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlOutputBytes, _ := io.ReadAll(ptyFile)
 		requireKubectlGetNamespaceOutput(t, env, string(kubectlOutputBytes))
 
 		t.Logf("first kubectl command took %s", time.Since(start).String())
@@ -980,7 +979,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlOutputBytes, _ := io.ReadAll(ptyFile)
 		requireKubectlGetNamespaceOutput(t, env, string(kubectlOutputBytes))
 
 		t.Logf("first kubectl command took %s", time.Since(start).String())
@@ -1500,7 +1499,7 @@ func runPinnipedGetKubeconfig(t *testing.T, env *testlib.TestEnv, pinnipedExe st
 	require.Equal(t, []string{"login", "oidc"}, restConfig.ExecProvider.Args[:2])
 
 	kubeconfigPath := filepath.Join(tempDir, "kubeconfig.yaml")
-	require.NoError(t, ioutil.WriteFile(kubeconfigPath, []byte(kubeconfigYAML), 0600))
+	require.NoError(t, os.WriteFile(kubeconfigPath, []byte(kubeconfigYAML), 0600))
 
 	return kubeconfigPath
 }

test/integration/supervisor_discovery_test.go

@@ -10,7 +10,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -587,7 +586,7 @@ func requireSuccessEndpointResponse(t *testing.T, endpointURL, issuer, caBundle
 
 		requireEventually.Equal(http.StatusOK, response.StatusCode)
 
-		responseBody, err = ioutil.ReadAll(response.Body)
+		responseBody, err = io.ReadAll(response.Body)
 		requireEventually.NoError(err)
 	}, 2*time.Minute, 200*time.Millisecond)
 
@@ -662,7 +661,7 @@ func newHTTPClient(t *testing.T, caBundle string, dnsOverrides map[string]string
 		caCertPool.AppendCertsFromPEM([]byte(caBundle))
 		c.Transport = &http.Transport{
 			DialContext:     overrideDialContext,
-			TLSClientConfig: &tls.Config{MinVersion: ptls.SecureTLSConfigMinTLSVersion, RootCAs: caCertPool}, //nolint: gosec // this seems to be a false flag, min tls version is 1.3 in normal mode or 1.2 in fips mode
+			TLSClientConfig: &tls.Config{MinVersion: ptls.SecureTLSConfigMinTLSVersion, RootCAs: caCertPool}, //nolint:gosec // this seems to be a false flag, min tls version is 1.3 in normal mode or 1.2 in fips mode
 		}
 	} else {
 		c.Transport = &http.Transport{

test/integration/supervisor_healthz_test.go

@@ -7,7 +7,7 @@ import (
 	"context"
 	"crypto/tls"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"testing"
 	"time"
@@ -58,7 +58,7 @@ func httpGet(ctx context.Context, t *testing.T, client *http.Client, url string,
 	require.NoError(t, err)
 	require.Equal(t, expectedStatus, response.StatusCode)
 
-	responseBody, err := ioutil.ReadAll(response.Body)
+	responseBody, err := io.ReadAll(response.Body)
 	require.NoError(t, err)
 	err = response.Body.Close()
 	require.NoError(t, err)

test/integration/supervisor_login_test.go

@@ -10,7 +10,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -2305,7 +2305,7 @@ func requestAuthorizationUsingCLIPasswordFlow(t *testing.T, downstreamAuthorizeU
 			return false, nil
 		}
 		defer func() { _ = authResponse.Body.Close() }()
-		responseBody, err = ioutil.ReadAll(authResponse.Body)
+		responseBody, err = io.ReadAll(authResponse.Body)
 		if err != nil {
 			return false, nil
 		}
@@ -2402,7 +2402,7 @@ func doTokenExchange(
 
 	// If a function was passed, call it, so it can make the desired assertions.
 	if wantTokenExchangeResponse != nil {
-		body, err := ioutil.ReadAll(resp.Body)
+		body, err := io.ReadAll(resp.Body)
 		require.NoError(t, err)
 		wantTokenExchangeResponse(t, resp.StatusCode, string(body))
 		return // the above call should have made all desired assertions about the response, so return

test/integration/supervisor_oidc_client_test.go

@@ -412,7 +412,7 @@ func TestOIDCClientStaticValidation_Parallel(t *testing.T) {
 				client.ManagedFields = nil
 				client.CreationTimestamp = metav1.Time{}
 				client.Generation = 0
-				client.SelfLink = "" // nolint: staticcheck  // old API servers still set this field
+				client.SelfLink = "" //nolint:staticcheck  // old API servers still set this field
 
 				require.Equal(t, tt.client, client)
 				return

test/integration/supervisor_warnings_test.go

@@ -7,7 +7,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"os/exec"
@@ -65,7 +64,7 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 	testCABundlePath := filepath.Join(tempDir, "test-ca.pem")
 	testCABundlePEM := []byte(string(ca.Bundle()) + "\n" + env.SupervisorUpstreamOIDC.CABundle)
 	testCABundleBase64 := base64.StdEncoding.EncodeToString(testCABundlePEM)
-	require.NoError(t, ioutil.WriteFile(testCABundlePath, testCABundlePEM, 0600))
+	require.NoError(t, os.WriteFile(testCABundlePath, testCABundlePEM, 0600))
 
 	// Use the CA to issue a TLS server cert.
 	t.Logf("issuing test certificate")
@@ -150,10 +149,10 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 		t.Logf("waiting for kubectl to output namespace list")
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlPtyOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlPtyOutputBytes, _ := io.ReadAll(ptyFile)
 		if kubectlStdoutPipe != nil {
 			// On non-MacOS check that stdout of the CLI contains the expected output.
-			kubectlStdOutOutputBytes, _ := ioutil.ReadAll(kubectlStdoutPipe)
+			kubectlStdOutOutputBytes, _ := io.ReadAll(kubectlStdoutPipe)
 			requireKubectlGetNamespaceOutput(t, env, string(kubectlStdOutOutputBytes))
 		} else {
 			// On MacOS check that the pty (stdout+stderr+stdin) of the CLI contains the expected output.
@@ -227,10 +226,10 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 		t.Logf("waiting for kubectl to output namespace list")
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlPtyOutputBytes2, _ := ioutil.ReadAll(ptyFile2)
+		kubectlPtyOutputBytes2, _ := io.ReadAll(ptyFile2)
 		if kubectlStdoutPipe2 != nil {
 			// On non-MacOS check that stdout of the CLI contains the expected output.
-			kubectlStdOutOutputBytes2, _ := ioutil.ReadAll(kubectlStdoutPipe2)
+			kubectlStdOutOutputBytes2, _ := io.ReadAll(kubectlStdoutPipe2)
 			requireKubectlGetNamespaceOutput(t, env, string(kubectlStdOutOutputBytes2))
 		} else {
 			// On MacOS check that the pty (stdout+stderr+stdin) of the CLI contains the expected output.
@@ -292,10 +291,10 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 		t.Logf("waiting for kubectl to output namespace list")
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlPtyOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlPtyOutputBytes, _ := io.ReadAll(ptyFile)
 		if kubectlStdoutPipe != nil {
 			// On non-MacOS check that stdout of the CLI contains the expected output.
-			kubectlStdOutOutputBytes, _ := ioutil.ReadAll(kubectlStdoutPipe)
+			kubectlStdOutOutputBytes, _ := io.ReadAll(kubectlStdoutPipe)
 			requireKubectlGetNamespaceOutput(t, env, string(kubectlStdOutOutputBytes))
 		} else {
 			// On MacOS check that the pty (stdout+stderr+stdin) of the CLI contains the expected output.
@@ -333,10 +332,10 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 		t.Logf("waiting for kubectl to output namespace list")
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlPtyOutputBytes2, _ := ioutil.ReadAll(ptyFile2)
+		kubectlPtyOutputBytes2, _ := io.ReadAll(ptyFile2)
 		if kubectlStdoutPipe2 != nil {
 			// On non-MacOS check that stdout of the CLI contains the expected output.
-			kubectlStdOutOutputBytes2, _ := ioutil.ReadAll(kubectlStdoutPipe2)
+			kubectlStdOutOutputBytes2, _ := io.ReadAll(kubectlStdoutPipe2)
 			requireKubectlGetNamespaceOutput(t, env, string(kubectlStdOutOutputBytes2))
 		} else {
 			// On MacOS check that the pty (stdout+stderr+stdin) of the CLI contains the expected output.
@@ -458,10 +457,10 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 		t.Logf("waiting for kubectl to output namespace list")
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlPtyOutputBytes, _ := ioutil.ReadAll(ptyFile)
+		kubectlPtyOutputBytes, _ := io.ReadAll(ptyFile)
 		if kubectlStdoutPipe != nil {
 			// On non-MacOS check that stdout of the CLI contains the expected output.
-			kubectlStdOutOutputBytes, _ := ioutil.ReadAll(kubectlStdoutPipe)
+			kubectlStdOutOutputBytes, _ := io.ReadAll(kubectlStdoutPipe)
 			requireKubectlGetNamespaceOutput(t, env, string(kubectlStdOutOutputBytes))
 		} else {
 			// On MacOS check that the pty (stdout+stderr+stdin) of the CLI contains the expected output.
@@ -535,10 +534,10 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 		t.Logf("waiting for kubectl to output namespace list")
 		// Read all output from the subprocess until EOF.
 		// Ignore any errors returned because there is always an error on linux.
-		kubectlPtyOutputBytes2, _ := ioutil.ReadAll(ptyFile2)
+		kubectlPtyOutputBytes2, _ := io.ReadAll(ptyFile2)
 		if kubectlStdoutPipe2 != nil {
 			// On non-MacOS check that stdout of the CLI contains the expected output.
-			kubectlStdOutOutputBytes2, _ := ioutil.ReadAll(kubectlStdoutPipe2)
+			kubectlStdOutOutputBytes2, _ := io.ReadAll(kubectlStdoutPipe2)
 			requireKubectlGetNamespaceOutput(t, env, string(kubectlStdOutOutputBytes2))
 		} else {
 			// On MacOS check that the pty (stdout+stderr+stdin) of the CLI contains the expected output.

test/testlib/access.go

@@ -1,11 +1,10 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package testlib
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"testing"
@@ -154,7 +153,7 @@ func runKubectlGetNamespaces(t *testing.T, kubeConfigYAML string) (string, error
 
 	f := writeStringToTempFile(t, "pinniped-generated-kubeconfig-*", kubeConfigYAML)
 
-	//nolint: gosec // It's okay that we are passing f.Name() to an exec command here. It was created above.
+	//nolint:gosec // It's okay that we are passing f.Name() to an exec command here. It was created above.
 	output, err := exec.Command(
 		"kubectl", "get", "namespace", "--kubeconfig", f.Name(),
 	).CombinedOutput()
@@ -164,7 +163,7 @@ func runKubectlGetNamespaces(t *testing.T, kubeConfigYAML string) (string, error
 
 func writeStringToTempFile(t *testing.T, filename string, kubeConfigYAML string) *os.File {
 	t.Helper()
-	f, err := ioutil.TempFile("", filename)
+	f, err := os.CreateTemp("", filename)
 	require.NoError(t, err)
 	deferMe := func() {
 		err := os.Remove(f.Name())

test/testlib/cli.go

@@ -1,10 +1,9 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package testlib
 
 import (
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -17,7 +16,7 @@ import (
 	"go.pinniped.dev/internal/testutil"
 )
 
-//nolint: gochecknoglobals
+//nolint:gochecknoglobals
 var pinnipedCLIBinaryCache struct {
 	buf   []byte
 	mutex sync.Mutex
@@ -38,7 +37,7 @@ func PinnipedCLIPath(t *testing.T) string {
 	path := filepath.Join(testutil.TempDir(t), "pinniped")
 	if pinnipedCLIBinaryCache.buf != nil {
 		t.Log("using previously built pinniped CLI binary")
-		require.NoError(t, ioutil.WriteFile(path, pinnipedCLIBinaryCache.buf, 0500))
+		require.NoError(t, os.WriteFile(path, pinnipedCLIBinaryCache.buf, 0500))
 		return path
 	}
 
@@ -49,7 +48,7 @@ func PinnipedCLIPath(t *testing.T) string {
 	t.Logf("built CLI binary in %s", time.Since(start).Round(time.Millisecond))
 
 	// Fill our cache so we don't have to do this again.
-	pinnipedCLIBinaryCache.buf, err = ioutil.ReadFile(path)
+	pinnipedCLIBinaryCache.buf, err = os.ReadFile(path)
 	require.NoError(t, err, string(output))
 
 	return path

test/testlib/client.go

@@ -10,7 +10,6 @@ import (
 	"encoding/hex"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -57,7 +56,7 @@ func NewClientsetForKubeConfig(t *testing.T, kubeConfig string) kubernetes.Inter
 }
 
 func NewRestConfigFromKubeconfig(t *testing.T, kubeConfig string) *rest.Config {
-	kubeConfigFile, err := ioutil.TempFile("", "pinniped-cli-test-*")
+	kubeConfigFile, err := os.CreateTemp("", "pinniped-cli-test-*")
 	require.NoError(t, err)
 	defer func() {
 		require.NoError(t, os.Remove(kubeConfigFile.Name()))

test/testlib/env.go

@@ -5,7 +5,6 @@ package testlib
 
 import (
 	"encoding/base64"
-	"io/ioutil"
 	"os"
 	"sort"
 	"strings"
@@ -118,7 +117,7 @@ func (e *TestEnv) ProxyEnv() []string {
 
 // memoizedTestEnvsByTest maps *testing.T pointers to *TestEnv. It exists so that we don't do all the
 // environment parsing N times per test and so that any implicit assertions happen only once.
-var memoizedTestEnvsByTest sync.Map //nolint: gochecknoglobals
+var memoizedTestEnvsByTest sync.Map //nolint:gochecknoglobals
 
 // IntegrationEnv gets the integration test environment from OS environment variables. This
 // method also implies SkipUnlessIntegration().
@@ -137,7 +136,7 @@ func IntegrationEnv(t *testing.T) *TestEnv {
 		"must specify either PINNIPED_TEST_CLUSTER_CAPABILITY_YAML or PINNIPED_TEST_CLUSTER_CAPABILITY_FILE env var for integration tests",
 	)
 	if capabilitiesDescriptionYAML == "" {
-		bytes, err := ioutil.ReadFile(capabilitiesDescriptionFile)
+		bytes, err := os.ReadFile(capabilitiesDescriptionFile)
 		capabilitiesDescriptionYAML = string(bytes)
 		require.NoError(t, err)
 	}

test/testlib/iplookup.go

@@ -1,6 +1,7 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+//go:build !go1.14
 // +build !go1.14
 
 package testlib

test/testlib/iplookup_go1.14.go

@@ -1,7 +1,7 @@
 // Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-//nolint:goimports // not an import
+//go:build go1.14
 // +build go1.14
 
 package testlib