Merge branch 'main' into jtc/add-importas-linter

hack/Dockerfile_fips

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-# Copyright 2022-2023 the Pinniped contributors. All Rights Reserved.
+# Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 # this dockerfile is used to produce a binary of Pinniped that uses
@@ -16,7 +16,7 @@
 # See https://go.googlesource.com/go/+/dev.boringcrypto/README.boringcrypto.md
 # and https://kupczynski.info/posts/fips-golang/ for details.
 
-ARG BUILD_IMAGE=golang:1.22.3@sha256:f43c6f049f04cbbaeb28f0aad3eea15274a7d0a7899a617d0037aec48d7ab010
+ARG BUILD_IMAGE=golang:1.22.4@sha256:969349b8121a56d51c74f4c273ab974c15b3a8ae246a5cffc1df7d28b66cf978
 ARG BASE_IMAGE=gcr.io/distroless/static:nonroot@sha256:e9ac71e2b8e279a8372741b7a0293afda17650d926900233ec3a7b2b7c22a246
 
 # This is not currently using --platform to prepare to cross-compile because we use gcc below to build

hack/lib/kube-versions.txt

@@ -11,10 +11,10 @@
 #
 # Whenever a new version is added to this file, run hack/update.sh.
 #
-1.30.0
-1.29.4
-1.28.9
-1.27.13
+1.30.1
+1.29.5
+1.28.10
+1.27.14
 1.26.15
 1.25.16
 1.24.17

hack/prepare-for-integration-tests.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 #
@@ -31,6 +31,7 @@ clean_kind=no
 api_group_suffix="pinniped.dev" # same default as in the values.yaml ytt file
 dockerfile_path=""
 get_active_directory_vars="" # specify a filename for a script to get AD related env variables
+get_github_vars="" # specify a filename for a script to get GitHub related env variables
 alternate_deploy="undefined"
 pre_install="undefined"
 
@@ -68,6 +69,16 @@ while (("$#")); do
     get_active_directory_vars=$1
     shift
     ;;
+  --get-github-vars)
+    shift
+    # If there are no more command line arguments, or there is another command line argument but it starts with a dash, then error
+    if [[ "$#" == "0" || "$1" == -* ]]; then
+      log_error "--get-github-vars requires a script name to be specified"
+      exit 1
+    fi
+    get_github_vars=$1
+    shift
+    ;;
   --dockerfile-path)
     shift
     # If there are no more command line arguments, or there is another command line argument but it starts with a dash, then error
@@ -121,6 +132,7 @@ if [[ "$help" == "yes" ]]; then
   log_note "   -g, --api-group-suffix:          deploy Pinniped with an alternate API group suffix"
   log_note "   -s, --skip-build:                reuse the most recently built image of the app instead of building"
   log_note "   -a, --get-active-directory-vars: specify a script that exports active directory environment variables"
+  log_note "       --get-github-vars:           specify a script that exports GitHub environment variables"
   log_note "       --alternate-deploy:          specify an alternate deploy script to install all components of Pinniped"
   log_note "       --pre-install:               specify an pre-install script such as a build script"
   exit 1
@@ -453,6 +465,15 @@ if [[ "$get_active_directory_vars" != "" ]]; then
   source $get_active_directory_vars
 fi
 
+# We can't set up an in-cluster GitHub instance, but
+# if you have a GitHub account that you wish to run the tests against,
+# specify a script to set the GitHub environment variables.
+# You will need to set the environment variables that start with "PINNIPED_TEST_GITHUB_"
+# found in pinniped/test/testlib/env.go.
+if [[ "$get_github_vars" != "" ]]; then
+  source $get_github_vars
+fi
+
 read -r -d '' PINNIPED_TEST_CLUSTER_CAPABILITY_YAML << PINNIPED_TEST_CLUSTER_CAPABILITY_YAML_EOF || true
 ${pinniped_cluster_capability_file_content}
 PINNIPED_TEST_CLUSTER_CAPABILITY_YAML_EOF

hack/prepare-supervisor-on-kind.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+# Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 #
@@ -42,6 +42,7 @@ source hack/lib/helpers.sh
 use_oidc_upstream=no
 use_ldap_upstream=no
 use_ad_upstream=no
+use_github_upstream=no
 use_flow=""
 while (("$#")); do
   case "$1" in
@@ -67,6 +68,10 @@ while (("$#")); do
     use_oidc_upstream=yes
     shift
     ;;
+  --github)
+    use_github_upstream=yes
+    shift
+    ;;
   --ad)
     # Use an ActiveDirectoryIdentityProvider.
     # This assumes that you used the --get-active-directory-vars flag with hack/prepare-for-integration-tests.sh.
@@ -84,8 +89,8 @@ while (("$#")); do
   esac
 done
 
-if [[ "$use_oidc_upstream" == "no" && "$use_ldap_upstream" == "no" && "$use_ad_upstream" == "no" ]]; then
-  log_error "Error: Please use --oidc, --ldap, or --ad to specify which type(s) of upstream identity provider(s) you would like. May use one or multiple."
+if [[ "$use_oidc_upstream" == "no" && "$use_ldap_upstream" == "no" && "$use_ad_upstream" == "no" && "$use_github_upstream" == "no" ]]; then
+  log_error "Error: Please use --oidc, --ldap, --ad, or --github to specify which type(s) of upstream identity provider(s) you would like. May use one or multiple."
   exit 1
 fi
 
@@ -290,6 +295,39 @@ EOF
     --dry-run=client --output yaml | kubectl apply -f -
 fi
 
+if [[ "$use_github_upstream" == "yes" ]]; then
+  # Make an GitHubIdentityProvider.  Needs to be configured with an actual GitHub App or GitHub OAuth App.
+  cat <<EOF | kubectl apply --namespace "$PINNIPED_TEST_SUPERVISOR_NAMESPACE" -f -
+apiVersion: idp.supervisor.pinniped.dev/v1alpha1
+kind: GitHubIdentityProvider
+metadata:
+  name: my-github-provider
+spec:
+  client:
+    secretName: my-github-provider-client-secret
+  allowAuthentication:
+    organizations:
+      policy: AllGitHubUsers
+EOF
+
+  # Make a Secret for the above GitHubIdentityProvider to describe the GitHub client configured.
+  cat <<EOF | kubectl apply --namespace "$PINNIPED_TEST_SUPERVISOR_NAMESPACE" -f -
+apiVersion: v1
+kind: Secret
+type: "secrets.pinniped.dev/github-client"
+metadata:
+  name: my-github-provider-client-secret
+stringData:
+  clientID: "$PINNIPED_TEST_GITHUB_APP_CLIENT_ID"
+  clientSecret: "$PINNIPED_TEST_GITHUB_APP_CLIENT_SECRET"
+EOF
+
+  # Grant the test user some RBAC permissions so we can play with kubectl as that user.
+  kubectl create clusterrolebinding github-test-user-can-view --clusterrole view \
+    --user "$PINNIPED_TEST_GITHUB_USER_USERNAME:$PINNIPED_TEST_GITHUB_USERID" \
+    --dry-run=client --output yaml | kubectl apply -f -
+fi
+
 # Create a CA and TLS serving certificates for the Supervisor's FederationDomain.
 if [[ ! -f "$root_ca_crt_path" ]]; then
   step certificate create \
@@ -406,7 +444,7 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
   # Indenting the heredoc by 4 spaces to make it indented the correct amount in the FederationDomain below.
   cat <<EOF >>$fd_file
 
-    - displayName: "My AD IDP"
+    - displayName: "My AD IDP 🚀"
       objectRef:
         apiGroup: idp.supervisor.pinniped.dev
         kind: ActiveDirectoryIdentityProvider
@@ -414,6 +452,18 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
 EOF
 fi
 
+if [[ "$use_github_upstream" == "yes" ]]; then
+  # Indenting the heredoc by 4 spaces to make it indented the correct amount in the FederationDomain below.
+  cat <<EOF >>$fd_file
+
+    - displayName: "My GitHub IDP 🚀"
+      objectRef:
+        apiGroup: idp.supervisor.pinniped.dev
+        kind: GitHubIdentityProvider
+        name: my-github-provider
+EOF
+fi
+
 # Apply the FederationDomain from the file created above.
 kubectl apply --namespace "$PINNIPED_TEST_SUPERVISOR_NAMESPACE" -f "$fd_file"
 
@@ -496,6 +546,11 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
   https_proxy="$proxy_server" no_proxy="$proxy_except" \
     ./pinniped get kubeconfig --oidc-skip-browser $flow_arg --upstream-identity-provider-type activedirectory >kubeconfig-ad.yaml
 fi
+if [[ "$use_github_upstream" == "yes" ]]; then
+  echo "Generating GitHub kubeconfig..."
+  https_proxy="$proxy_server" no_proxy="$proxy_except" \
+    ./pinniped get kubeconfig --oidc-skip-browser $flow_arg --upstream-identity-provider-type github >kubeconfig-github.yaml
+fi
 
 # Clear the local CLI cache to ensure that the kubectl command below will need to perform a fresh login.
 rm -f "$HOME/.config/pinniped/sessions.yaml"
@@ -534,6 +589,12 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
   echo
 fi
 
+if [[ "$use_github_upstream" == "yes" ]]; then
+  echo "    GitHub Username: $PINNIPED_TEST_GITHUB_USER_USERNAME (or use your own account)"
+  echo "    GitHub Password: $PINNIPED_TEST_GITHUB_USER_PASSWORD (also requires OTP, or use your own account)"
+  echo
+fi
+
 # Echo the commands that may be used to login and print the identity of the currently logged in user.
 # Once the CLI has cached your tokens, it will automatically refresh your short-lived credentials whenever
 # they expire, so you should not be prompted to log in again for the rest of the day.
@@ -552,3 +613,8 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
   echo "PINNIPED_DEBUG=true ${proxy_env_vars}./pinniped whoami --kubeconfig ./kubeconfig-ad.yaml"
   echo
 fi
+if [[ "$use_github_upstream" == "yes" ]]; then
+  echo "To log in using GitHub, run:"
+  echo "PINNIPED_DEBUG=true ${proxy_env_vars}./pinniped whoami --kubeconfig ./kubeconfig-github.yaml"
+  echo
+fi

hack/update-go-mod/go.mod

@@ -4,4 +4,4 @@ go 1.22.0
 
 toolchain go1.22.2
 
-require golang.org/x/mod v0.17.0
+require golang.org/x/mod v0.18.0

hack/update-go-mod/go.sum

@@ -1,2 +1,2 @@
-golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0=
+golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=