Update all deps to latest where possible, bump Kube deps to v0.23.1

Highlights from this dep bump:

1. Made a copy of the v0.4.0 github.com/go-logr/stdr implementation
   for use in tests.  We must bump this dep as Kube code uses a
   newer version now.  We would have to rewrite hundreds of test log
   assertions without this copy.
2. Use github.com/felixge/httpsnoop to undo the changes made by
   ory/fosite#636 for CLI based login flows.  This is required for
   backwards compatibility with older versions of our CLI.  A
   separate change after this will update the CLI to be more
   flexible (it is purposefully not part of this change to confirm
   that we did not break anything).  For all browser login flows, we
   now redirect using http.StatusSeeOther instead of http.StatusFound.
3. Drop plog.RemoveKlogGlobalFlags as klog no longer mutates global
   process flags
4. Only bump github.com/ory/x to v0.0.297 instead of the latest
   v0.0.321 because v0.0.298+ pulls in a newer version of
   go.opentelemetry.io/otel/semconv which breaks k8s.io/apiserver.
   We should update k8s.io/apiserver to use the newer code.
5. Migrate all code from k8s.io/apimachinery/pkg/util/clock to
   k8s.io/utils/clock and k8s.io/utils/clock/testing
6. Delete testutil.NewDeleteOptionsRecorder and migrate to the new
   kubetesting.NewDeleteActionWithOptions
7. Updated ExpectedAuthorizeCodeSessionJSONFromFuzzing caused by
   fosite's new rotated_secrets OAuth client field.  This new field
   is currently not relevant to us as we have no private clients.

Signed-off-by: Monis Khan <mok@vmware.com>

internal/controller/supervisorstorage/garbage_collector.go

@@ -13,9 +13,10 @@ import (
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/util/clock"
 	corev1informers "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/kubernetes"
+	"k8s.io/utils/clock"
+	clocktesting "k8s.io/utils/clock/testing"
 	"k8s.io/utils/strings/slices"
 
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
@@ -88,7 +89,7 @@ func GarbageCollectorController(
 
 func (c *garbageCollectorController) Sync(ctx controllerlib.Context) error {
 	// make sure we have a consistent, static meaning for the current time during the sync loop
-	frozenClock := clock.NewFakeClock(c.clock.Now())
+	frozenClock := clocktesting.NewFakeClock(c.clock.Now())
 
 	// The Sync method is triggered upon any change to any Secret, which would make this
 	// controller too chatty, so it rate limits itself to a more reasonable interval.

internal/controller/supervisorstorage/garbage_collector_test.go

@@ -18,11 +18,11 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/util/clock"
 	kubeinformers "k8s.io/client-go/informers"
-	"k8s.io/client-go/kubernetes"
 	kubernetesfake "k8s.io/client-go/kubernetes/fake"
 	kubetesting "k8s.io/client-go/testing"
+	"k8s.io/utils/clock"
+	clocktesting "k8s.io/utils/clock/testing"
 
 	"go.pinniped.dev/internal/controllerlib"
 	"go.pinniped.dev/internal/fositestorage/accesstoken"
@@ -127,13 +127,11 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 			subject                 controllerlib.Controller
 			kubeInformerClient      *kubernetesfake.Clientset
 			kubeClient              *kubernetesfake.Clientset
-			deleteOptions           *[]metav1.DeleteOptions
-			deleteOptionsRecorder   kubernetes.Interface
 			kubeInformers           kubeinformers.SharedInformerFactory
 			cancelContext           context.Context
 			cancelContextCancelFunc context.CancelFunc
 			syncContext             *controllerlib.Context
-			fakeClock               *clock.FakeClock
+			fakeClock               *clocktesting.FakeClock
 			frozenNow               time.Time
 		)
 
@@ -144,7 +142,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 			subject = GarbageCollectorController(
 				idpCache,
 				fakeClock,
-				deleteOptionsRecorder,
+				kubeClient,
 				kubeInformers.Core().V1().Secrets(),
 				controllerlib.WithInformer,
 			)
@@ -172,11 +170,9 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 
 			kubeInformerClient = kubernetesfake.NewSimpleClientset()
 			kubeClient = kubernetesfake.NewSimpleClientset()
-			deleteOptions = &[]metav1.DeleteOptions{}
-			deleteOptionsRecorder = testutil.NewDeleteOptionsRecorder(kubeClient, deleteOptions)
 			kubeInformers = kubeinformers.NewSharedInformerFactory(kubeInformerClient, 0)
 			frozenNow = time.Now().UTC()
-			fakeClock = clock.NewFakeClock(frozenNow)
+			fakeClock = clocktesting.NewFakeClock(frozenNow)
 
 			unrelatedSecret := &corev1.Secret{
 				ObjectMeta: metav1.ObjectMeta{
@@ -252,18 +248,11 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "first expired secret"),
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "second expired secret"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "first expired secret", testutil.NewPreconditions("uid-123", "rv-456")),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "second expired secret", testutil.NewPreconditions("uid-789", "rv-555")),
 					},
 					kubeClient.Actions(),
 				)
-				r.ElementsMatch(
-					[]metav1.DeleteOptions{
-						testutil.NewPreconditions("uid-123", "rv-456"),
-						testutil.NewPreconditions("uid-789", "rv-555"),
-					},
-					*deleteOptions,
-				)
 				list, err := kubeClient.CoreV1().Secrets(installedInNamespace).List(context.Background(), metav1.ListOptions{})
 				r.NoError(err)
 				r.Len(list.Items, 2)
@@ -384,18 +373,11 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// Both authcode session secrets are deleted.
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "activeOIDCAuthcodeSession"),
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "inactiveOIDCAuthcodeSession"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "activeOIDCAuthcodeSession", testutil.NewPreconditions("uid-123", "rv-123")),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "inactiveOIDCAuthcodeSession", testutil.NewPreconditions("uid-456", "rv-456")),
 					},
 					kubeClient.Actions(),
 				)
-				r.ElementsMatch(
-					[]metav1.DeleteOptions{
-						testutil.NewPreconditions("uid-123", "rv-123"),
-						testutil.NewPreconditions("uid-456", "rv-456"),
-					},
-					*deleteOptions,
-				)
 			})
 		})
 
@@ -460,16 +442,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// The invalid authcode session secrets is still deleted because it is expired.
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "invalidOIDCAuthcodeSession"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "invalidOIDCAuthcodeSession", testutil.NewPreconditions("uid-123", "rv-123")),
 					},
 					kubeClient.Actions(),
 				)
-				r.ElementsMatch(
-					[]metav1.DeleteOptions{
-						testutil.NewPreconditions("uid-123", "rv-123"),
-					},
-					*deleteOptions,
-				)
 			})
 		})
 
@@ -536,16 +512,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// The authcode session secrets is still deleted because it is expired.
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "wrongProviderNameOIDCAuthcodeSession"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "wrongProviderNameOIDCAuthcodeSession", testutil.NewPreconditions("uid-123", "rv-123")),
 					},
 					kubeClient.Actions(),
 				)
-				r.ElementsMatch(
-					[]metav1.DeleteOptions{
-						testutil.NewPreconditions("uid-123", "rv-123"),
-					},
-					*deleteOptions,
-				)
 			})
 		})
 
@@ -612,16 +582,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// The authcode session secrets is still deleted because it is expired.
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "wrongProviderNameOIDCAuthcodeSession"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "wrongProviderNameOIDCAuthcodeSession", testutil.NewPreconditions("uid-123", "rv-123")),
 					},
 					kubeClient.Actions(),
 				)
-				r.ElementsMatch(
-					[]metav1.DeleteOptions{
-						testutil.NewPreconditions("uid-123", "rv-123"),
-					},
-					*deleteOptions,
-				)
 			})
 		})
 
@@ -767,16 +731,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// The authcode session secrets is deleted.
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "activeOIDCAuthcodeSession"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "activeOIDCAuthcodeSession", testutil.NewPreconditions("uid-123", "rv-123")),
 					},
 					kubeClient.Actions(),
 				)
-				r.ElementsMatch(
-					[]metav1.DeleteOptions{
-						testutil.NewPreconditions("uid-123", "rv-123"),
-					},
-					*deleteOptions,
-				)
 			})
 		})
 
@@ -893,18 +851,11 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// Both session secrets are deleted.
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "offlineAccessGrantedOIDCAccessTokenSession"),
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "offlineAccessNotGrantedOIDCAccessTokenSession"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "offlineAccessGrantedOIDCAccessTokenSession", testutil.NewPreconditions("uid-123", "rv-123")),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "offlineAccessNotGrantedOIDCAccessTokenSession", testutil.NewPreconditions("uid-456", "rv-456")),
 					},
 					kubeClient.Actions(),
 				)
-				r.ElementsMatch(
-					[]metav1.DeleteOptions{
-						testutil.NewPreconditions("uid-123", "rv-123"),
-						testutil.NewPreconditions("uid-456", "rv-456"),
-					},
-					*deleteOptions,
-				)
 			})
 		})
 
@@ -976,16 +927,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// The secret is deleted.
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "oidcRefreshSession"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "oidcRefreshSession", testutil.NewPreconditions("uid-123", "rv-123")),
 					},
 					kubeClient.Actions(),
 				)
-				r.ElementsMatch(
-					[]metav1.DeleteOptions{
-						testutil.NewPreconditions("uid-123", "rv-123"),
-					},
-					*deleteOptions,
-				)
 			})
 		})
 
@@ -994,8 +939,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// Add a secret that will expire in 20 seconds.
 				expiredSecret := &corev1.Secret{
 					ObjectMeta: metav1.ObjectMeta{
-						Name:      "expired secret",
-						Namespace: installedInNamespace,
+						Name:            "expired secret",
+						Namespace:       installedInNamespace,
+						UID:             "uid-747",
+						ResourceVersion: "rv-609",
 						Annotations: map[string]string{
 							"storage.pinniped.dev/garbage-collect-after": frozenNow.Add(20 * time.Second).Format(time.RFC3339),
 						},
@@ -1033,7 +980,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				// It should have deleted the expired secret.
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "expired secret"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "expired secret", testutil.NewPreconditions("uid-747", "rv-609")),
 					},
 					kubeClient.Actions(),
 				)
@@ -1059,8 +1006,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				r.NoError(kubeClient.Tracker().Add(malformedSecret))
 				expiredSecret := &corev1.Secret{
 					ObjectMeta: metav1.ObjectMeta{
-						Name:      "expired secret",
-						Namespace: installedInNamespace,
+						Name:            "expired secret",
+						Namespace:       installedInNamespace,
+						UID:             "uid-748",
+						ResourceVersion: "rv-608",
 						Annotations: map[string]string{
 							"storage.pinniped.dev/garbage-collect-after": frozenNow.Add(-time.Second).Format(time.RFC3339),
 						},
@@ -1076,7 +1025,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "expired secret"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "expired secret", testutil.NewPreconditions("uid-748", "rv-608")),
 					},
 					kubeClient.Actions(),
 				)
@@ -1091,8 +1040,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 			it.Before(func() {
 				erroringSecret := &corev1.Secret{
 					ObjectMeta: metav1.ObjectMeta{
-						Name:      "erroring secret",
-						Namespace: installedInNamespace,
+						Name:            "erroring secret",
+						Namespace:       installedInNamespace,
+						UID:             "uid-111",
+						ResourceVersion: "rv-222",
 						Annotations: map[string]string{
 							"storage.pinniped.dev/garbage-collect-after": frozenNow.Add(-time.Second).Format(time.RFC3339),
 						},
@@ -1108,8 +1059,10 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				})
 				expiredSecret := &corev1.Secret{
 					ObjectMeta: metav1.ObjectMeta{
-						Name:      "expired secret",
-						Namespace: installedInNamespace,
+						Name:            "expired secret",
+						Namespace:       installedInNamespace,
+						UID:             "uid-333",
+						ResourceVersion: "rv-444",
 						Annotations: map[string]string{
 							"storage.pinniped.dev/garbage-collect-after": frozenNow.Add(-time.Second).Format(time.RFC3339),
 						},
@@ -1125,8 +1078,8 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 
 				r.ElementsMatch(
 					[]kubetesting.Action{
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "erroring secret"),
-						kubetesting.NewDeleteAction(secretsGVR, installedInNamespace, "expired secret"),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "erroring secret", testutil.NewPreconditions("uid-111", "rv-222")),
+						kubetesting.NewDeleteActionWithOptions(secretsGVR, installedInNamespace, "expired secret", testutil.NewPreconditions("uid-333", "rv-444")),
 					},
 					kubeClient.Actions(),
 				)