Enforce more imports

- k8s.io/apimachinery/pkg/apis/meta/v1 - k8s.io/api/core/v1 - github.com/coreos/go-oidc/v3/oidc - github.com/ory/fosite/handler/oauth2 - go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1
2026-01-08 15:21:55 +00:00 · 2024-05-11 22:17:37 -05:00
parent 875b0739aa
commit e9252a9ee3
43 changed files with 496 additions and 481 deletions
--- a/internal/controller/authenticator/authenticator.go
+++ b/internal/controller/authenticator/authenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Package authenticator contains helper code for dealing with *Authenticator CRDs.
@@ -11,7 +11,7 @@ import (

 	"k8s.io/client-go/util/cert"

-	auth1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 )

 // Closer is a type that can be closed idempotently.
@@ -25,7 +25,7 @@ type Closer interface {
 // CABundle returns a PEM-encoded CA bundle from the provided spec. If the provided spec is nil, a
 // nil CA bundle will be returned. If the provided spec contains a CA bundle that is not properly
 // encoded, an error will be returned.
-func CABundle(spec *auth1alpha1.TLSSpec) (*x509.CertPool, []byte, error) {
+func CABundle(spec *authenticationv1alpha1.TLSSpec) (*x509.CertPool, []byte, error) {
 	if spec == nil || len(spec.CertificateAuthorityData) == 0 {
 		return nil, nil, nil
 	}
--- a/internal/controller/authenticator/authncache/cache_test.go
+++ b/internal/controller/authenticator/authncache/cache_test.go
@@ -17,7 +17,7 @@ import (
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"

-	authv1alpha "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	loginapi "go.pinniped.dev/generated/latest/apis/concierge/login"
 	"go.pinniped.dev/internal/mocks/mocktokenauthenticator"
 )
@@ -75,7 +75,7 @@ func TestAuthenticateTokenCredentialRequest(t *testing.T) {
 		},
 		Spec: loginapi.TokenCredentialRequestSpec{
 			Authenticator: corev1.TypedLocalObjectReference{
-				APIGroup: &authv1alpha.SchemeGroupVersion.Group,
+				APIGroup: &authenticationv1alpha1.SchemeGroupVersion.Group,
 				Kind:     "WebhookAuthenticator",
 				Name:     "test-name",
 			},
--- a/internal/controller/authenticator/cachecleaner/cachecleaner.go
+++ b/internal/controller/authenticator/cachecleaner/cachecleaner.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Package cachecleaner implements a controller for garbage collecting authenticators from an authenticator cache.
@@ -11,7 +11,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/klog/v2"

-	auth1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	authinformers "go.pinniped.dev/generated/latest/client/concierge/informers/externalversions/authentication/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
 	"go.pinniped.dev/internal/controller/authenticator"
@@ -74,7 +74,7 @@ func (c *controller) Sync(_ controllerlib.Context) error {
 		key := authncache.Key{
 			Name:     webhook.Name,
 			Kind:     "WebhookAuthenticator",
-			APIGroup: auth1alpha1.SchemeGroupVersion.Group,
+			APIGroup: authenticationv1alpha1.SchemeGroupVersion.Group,
 		}
 		authenticatorSet[key] = true
 	}
@@ -82,14 +82,14 @@ func (c *controller) Sync(_ controllerlib.Context) error {
 		key := authncache.Key{
 			Name:     jwtAuthenticator.Name,
 			Kind:     "JWTAuthenticator",
-			APIGroup: auth1alpha1.SchemeGroupVersion.Group,
+			APIGroup: authenticationv1alpha1.SchemeGroupVersion.Group,
 		}
 		authenticatorSet[key] = true
 	}

 	// Delete any entries from the cache which are no longer in the cluster.
 	for _, key := range c.cache.Keys() {
-		if key.APIGroup != auth1alpha1.SchemeGroupVersion.Group || (key.Kind != "WebhookAuthenticator" && key.Kind != "JWTAuthenticator") {
+		if key.APIGroup != authenticationv1alpha1.SchemeGroupVersion.Group || (key.Kind != "WebhookAuthenticator" && key.Kind != "JWTAuthenticator") {
 			continue
 		}
 		if _, exists := authenticatorSet[key]; !exists {
--- a/internal/controller/authenticator/cachecleaner/cachecleaner_test.go
+++ b/internal/controller/authenticator/cachecleaner/cachecleaner_test.go
@@ -12,7 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/authentication/authenticator"

-	authv1alpha "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/concierge/informers/externalversions"
 	controllerAuthenticator "go.pinniped.dev/internal/controller/authenticator"
@@ -65,12 +65,12 @@ func TestController(t *testing.T) {
 				cache.Store(testJWTAuthenticatorKey1, nil)
 			},
 			objects: []runtime.Object{
-				&authv1alpha.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: testWebhookKey1.Name,
 					},
 				},
-				&authv1alpha.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: testJWTAuthenticatorKey1.Name,
 					},
@@ -81,22 +81,22 @@ func TestController(t *testing.T) {
 		{
 			name: "authenticators not yet added",
 			objects: []runtime.Object{
-				&authv1alpha.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: testWebhookKey1.Name,
 					},
 				},
-				&authv1alpha.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: testWebhookKey2.Name,
 					},
 				},
-				&authv1alpha.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: testJWTAuthenticatorKey1.Name,
 					},
 				},
-				&authv1alpha.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: testJWTAuthenticatorKey2.Name,
 					},
@@ -114,12 +114,12 @@ func TestController(t *testing.T) {
 				cache.Store(testKeyUnknownType, nil)
 			},
 			objects: []runtime.Object{
-				&authv1alpha.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: testWebhookKey1.Name,
 					},
 				},
-				&authv1alpha.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: testJWTAuthenticatorKey1.Name,
 					},
--- a/internal/controller/authenticator/jwtcachefiller/jwtcachefiller.go
+++ b/internal/controller/authenticator/jwtcachefiller/jwtcachefiller.go
@@ -29,7 +29,7 @@ import (
 	"k8s.io/utils/clock"
 	"k8s.io/utils/ptr"

-	auth1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	conciergeclientset "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned"
 	authinformers "go.pinniped.dev/generated/latest/client/concierge/informers/externalversions/authentication/v1alpha1"
@@ -103,7 +103,7 @@ type tokenAuthenticatorCloser interface {

 type cachedJWTAuthenticator struct {
 	authenticator.Token
-	spec   *auth1alpha1.JWTAuthenticatorSpec
+	spec   *authenticationv1alpha1.JWTAuthenticatorSpec
 	cancel context.CancelFunc
 }

@@ -161,7 +161,7 @@ func (c *jwtCacheFillerController) Sync(ctx controllerlib.Context) error {
 	}

 	cacheKey := authncache.Key{
-		APIGroup: auth1alpha1.GroupName,
+		APIGroup: authenticationv1alpha1.GroupName,
 		Kind:     "JWTAuthenticator",
 		Name:     ctx.Key.Name,
 	}
@@ -245,7 +245,7 @@ func (c *jwtCacheFillerController) extractValueAsJWTAuthenticator(value authncac
 	return jwtAuthenticator
 }

-func (c *jwtCacheFillerController) validateTLS(tlsSpec *auth1alpha1.TLSSpec, conditions []*metav1.Condition) (*x509.CertPool, []*metav1.Condition, bool) {
+func (c *jwtCacheFillerController) validateTLS(tlsSpec *authenticationv1alpha1.TLSSpec, conditions []*metav1.Condition) (*x509.CertPool, []*metav1.Condition, bool) {
 	rootCAs, _, err := pinnipedauthenticator.CABundle(tlsSpec)
 	if err != nil {
 		msg := fmt.Sprintf("%s: %s", "invalid TLS configuration", err.Error())
@@ -504,7 +504,7 @@ func (c *jwtCacheFillerController) validateJWKSFetch(ctx context.Context, jwksUR
 }

 // newCachedJWTAuthenticator creates a jwt authenticator from the provided spec.
-func (c *jwtCacheFillerController) newCachedJWTAuthenticator(client *http.Client, spec *auth1alpha1.JWTAuthenticatorSpec, keySet *coreosoidc.RemoteKeySet, conditions []*metav1.Condition, prereqOk bool) (*cachedJWTAuthenticator, []*metav1.Condition, error) {
+func (c *jwtCacheFillerController) newCachedJWTAuthenticator(client *http.Client, spec *authenticationv1alpha1.JWTAuthenticatorSpec, keySet *coreosoidc.RemoteKeySet, conditions []*metav1.Condition, prereqOk bool) (*cachedJWTAuthenticator, []*metav1.Condition, error) {
 	if !prereqOk {
 		conditions = append(conditions, &metav1.Condition{
 			Type:    typeAuthenticatorValid,
@@ -580,13 +580,13 @@ func (c *jwtCacheFillerController) newCachedJWTAuthenticator(client *http.Client

 func (c *jwtCacheFillerController) updateStatus(
 	ctx context.Context,
-	original *auth1alpha1.JWTAuthenticator,
+	original *authenticationv1alpha1.JWTAuthenticator,
 	conditions []*metav1.Condition,
 ) error {
 	updated := original.DeepCopy()

 	if conditionsutil.HadErrorCondition(conditions) {
-		updated.Status.Phase = auth1alpha1.JWTAuthenticatorPhaseError
+		updated.Status.Phase = authenticationv1alpha1.JWTAuthenticatorPhaseError
 		conditions = append(conditions, &metav1.Condition{
 			Type:    typeReady,
 			Status:  metav1.ConditionFalse,
@@ -594,7 +594,7 @@ func (c *jwtCacheFillerController) updateStatus(
 			Message: "the JWTAuthenticator is not ready: see other conditions for details",
 		})
 	} else {
-		updated.Status.Phase = auth1alpha1.JWTAuthenticatorPhaseReady
+		updated.Status.Phase = authenticationv1alpha1.JWTAuthenticatorPhaseReady
 		conditions = append(conditions, &metav1.Condition{
 			Type:    typeReady,
 			Status:  metav1.ConditionTrue,
--- a/internal/controller/authenticator/jwtcachefiller/jwtcachefiller_test.go
+++ b/internal/controller/authenticator/jwtcachefiller/jwtcachefiller_test.go
@@ -33,7 +33,7 @@ import (
 	coretesting "k8s.io/client-go/testing"
 	clocktesting "k8s.io/utils/clock/testing"

-	auth1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/concierge/informers/externalversions"
 	"go.pinniped.dev/internal/controller/authenticator/authncache"
@@ -216,72 +216,72 @@ func TestController(t *testing.T) {
 	timeInThePast := time.Date(1111, time.January, 1, 1, 1, 1, 111111, time.Local)
 	frozenTimeInThePast := metav1.NewTime(timeInThePast)

-	someJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	someJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   goodIssuer,
 		Audience: goodAudience,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
 	}
-	someJWTAuthenticatorSpecWithUsernameClaim := &auth1alpha1.JWTAuthenticatorSpec{
+	someJWTAuthenticatorSpecWithUsernameClaim := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   goodIssuer,
 		Audience: goodAudience,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
-		Claims: auth1alpha1.JWTTokenClaims{
+		Claims: authenticationv1alpha1.JWTTokenClaims{
 			Username: "my-custom-username-claim",
 		},
 	}
-	someJWTAuthenticatorSpecWithGroupsClaim := &auth1alpha1.JWTAuthenticatorSpec{
+	someJWTAuthenticatorSpecWithGroupsClaim := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   goodIssuer,
 		Audience: goodAudience,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
-		Claims: auth1alpha1.JWTTokenClaims{
+		Claims: authenticationv1alpha1.JWTTokenClaims{
 			Groups: customGroupsClaim,
 		},
 	}
-	otherJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	otherJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   someOtherIssuer,
 		Audience: goodAudience,
 		// Some random generated cert
 		// Issuer: C=US, O=Pivotal
 		// No SAN provided
-		TLS: &auth1alpha1.TLSSpec{CertificateAuthorityData: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVVENDQWptZ0F3SUJBZ0lWQUpzNStTbVRtaTJXeUI0bGJJRXBXaUs5a1RkUE1BMEdDU3FHU0liM0RRRUIKQ3dVQU1COHhDekFKQmdOVkJBWVRBbFZUTVJBd0RnWURWUVFLREFkUWFYWnZkR0ZzTUI0WERUSXdNRFV3TkRFMgpNamMxT0ZvWERUSTBNRFV3TlRFMk1qYzFPRm93SHpFTE1Ba0dBMVVFQmhNQ1ZWTXhFREFPQmdOVkJBb01CMUJwCmRtOTBZV3d3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRRERZWmZvWGR4Z2NXTEMKZEJtbHB5a0tBaG9JMlBuUWtsVFNXMno1cGcwaXJjOGFRL1E3MXZzMTRZYStmdWtFTGlvOTRZYWw4R01DdVFrbApMZ3AvUEE5N1VYelhQNDBpK25iNXcwRGpwWWd2dU9KQXJXMno2MFRnWE5NSFh3VHk4ME1SZEhpUFVWZ0VZd0JpCmtkNThzdEFVS1Y1MnBQTU1reTJjNy9BcFhJNmRXR2xjalUvaFBsNmtpRzZ5dEw2REtGYjJQRWV3MmdJM3pHZ2IKOFVVbnA1V05DZDd2WjNVY0ZHNXlsZEd3aGc3cnZ4U1ZLWi9WOEhCMGJmbjlxamlrSVcxWFM4dzdpUUNlQmdQMApYZWhKZmVITlZJaTJtZlczNlVQbWpMdnVKaGpqNDIrdFBQWndvdDkzdWtlcEgvbWpHcFJEVm9wamJyWGlpTUYrCkYxdnlPNGMxQWdNQkFBR2pnWU13Z1lBd0hRWURWUjBPQkJZRUZNTWJpSXFhdVkwajRVWWphWDl0bDJzby9LQ1IKTUI4R0ExVWRJd1FZTUJhQUZNTWJpSXFhdVkwajRVWWphWDl0bDJzby9LQ1JNQjBHQTFVZEpRUVdNQlFHQ0NzRwpBUVVGQndNQ0JnZ3JCZ0VGQlFjREFUQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BNEdBMVVkRHdFQi93UUVBd0lCCkJqQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFYbEh4M2tIMDZwY2NDTDlEVE5qTnBCYnlVSytGd2R6T2IwWFYKcmpNaGtxdHVmdEpUUnR5T3hKZ0ZKNXhUR3pCdEtKamcrVU1pczBOV0t0VDBNWThVMU45U2c5SDl0RFpHRHBjVQpxMlVRU0Y4dXRQMVR3dnJIUzIrdzB2MUoxdHgrTEFiU0lmWmJCV0xXQ21EODUzRlVoWlFZekkvYXpFM28vd0p1CmlPUklMdUpNUk5vNlBXY3VLZmRFVkhaS1RTWnk3a25FcHNidGtsN3EwRE91eUFWdG9HVnlkb3VUR0FOdFhXK2YKczNUSTJjKzErZXg3L2RZOEJGQTFzNWFUOG5vZnU3T1RTTzdiS1kzSkRBUHZOeFQzKzVZUXJwNGR1Nmh0YUFMbAppOHNaRkhidmxpd2EzdlhxL3p1Y2JEaHEzQzBhZnAzV2ZwRGxwSlpvLy9QUUFKaTZLQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"},
+		TLS: &authenticationv1alpha1.TLSSpec{CertificateAuthorityData: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVVENDQWptZ0F3SUJBZ0lWQUpzNStTbVRtaTJXeUI0bGJJRXBXaUs5a1RkUE1BMEdDU3FHU0liM0RRRUIKQ3dVQU1COHhDekFKQmdOVkJBWVRBbFZUTVJBd0RnWURWUVFLREFkUWFYWnZkR0ZzTUI0WERUSXdNRFV3TkRFMgpNamMxT0ZvWERUSTBNRFV3TlRFMk1qYzFPRm93SHpFTE1Ba0dBMVVFQmhNQ1ZWTXhFREFPQmdOVkJBb01CMUJwCmRtOTBZV3d3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRRERZWmZvWGR4Z2NXTEMKZEJtbHB5a0tBaG9JMlBuUWtsVFNXMno1cGcwaXJjOGFRL1E3MXZzMTRZYStmdWtFTGlvOTRZYWw4R01DdVFrbApMZ3AvUEE5N1VYelhQNDBpK25iNXcwRGpwWWd2dU9KQXJXMno2MFRnWE5NSFh3VHk4ME1SZEhpUFVWZ0VZd0JpCmtkNThzdEFVS1Y1MnBQTU1reTJjNy9BcFhJNmRXR2xjalUvaFBsNmtpRzZ5dEw2REtGYjJQRWV3MmdJM3pHZ2IKOFVVbnA1V05DZDd2WjNVY0ZHNXlsZEd3aGc3cnZ4U1ZLWi9WOEhCMGJmbjlxamlrSVcxWFM4dzdpUUNlQmdQMApYZWhKZmVITlZJaTJtZlczNlVQbWpMdnVKaGpqNDIrdFBQWndvdDkzdWtlcEgvbWpHcFJEVm9wamJyWGlpTUYrCkYxdnlPNGMxQWdNQkFBR2pnWU13Z1lBd0hRWURWUjBPQkJZRUZNTWJpSXFhdVkwajRVWWphWDl0bDJzby9LQ1IKTUI4R0ExVWRJd1FZTUJhQUZNTWJpSXFhdVkwajRVWWphWDl0bDJzby9LQ1JNQjBHQTFVZEpRUVdNQlFHQ0NzRwpBUVVGQndNQ0JnZ3JCZ0VGQlFjREFUQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BNEdBMVVkRHdFQi93UUVBd0lCCkJqQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFYbEh4M2tIMDZwY2NDTDlEVE5qTnBCYnlVSytGd2R6T2IwWFYKcmpNaGtxdHVmdEpUUnR5T3hKZ0ZKNXhUR3pCdEtKamcrVU1pczBOV0t0VDBNWThVMU45U2c5SDl0RFpHRHBjVQpxMlVRU0Y4dXRQMVR3dnJIUzIrdzB2MUoxdHgrTEFiU0lmWmJCV0xXQ21EODUzRlVoWlFZekkvYXpFM28vd0p1CmlPUklMdUpNUk5vNlBXY3VLZmRFVkhaS1RTWnk3a25FcHNidGtsN3EwRE91eUFWdG9HVnlkb3VUR0FOdFhXK2YKczNUSTJjKzErZXg3L2RZOEJGQTFzNWFUOG5vZnU3T1RTTzdiS1kzSkRBUHZOeFQzKzVZUXJwNGR1Nmh0YUFMbAppOHNaRkhidmxpd2EzdlhxL3p1Y2JEaHEzQzBhZnAzV2ZwRGxwSlpvLy9QUUFKaTZLQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"},
 	}
-	missingTLSJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	missingTLSJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   goodIssuer,
 		Audience: goodAudience,
 	}
-	invalidTLSJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	invalidTLSJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   someOtherIssuer,
 		Audience: goodAudience,
-		TLS:      &auth1alpha1.TLSSpec{CertificateAuthorityData: "invalid base64-encoded data"},
+		TLS:      &authenticationv1alpha1.TLSSpec{CertificateAuthorityData: "invalid base64-encoded data"},
 	}

-	invalidIssuerJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	invalidIssuerJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   "https://.café   .com/café/café/café/coffee",
 		Audience: goodAudience,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
 	}
-	invalidIssuerSchemeJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	invalidIssuerSchemeJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   "http://.café.com/café/café/café/coffee",
 		Audience: goodAudience,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
 	}

-	validIssuerURLButDoesNotExistJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	validIssuerURLButDoesNotExistJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   goodIssuer + "/foo/bar/baz/shizzle",
 		Audience: goodAudience,
 	}
-	badIssuerJWKSURIJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	badIssuerJWKSURIJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   badIssuerInvalidJWKSURI,
 		Audience: goodAudience,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(badOIDCIssuerServerInvalidJWKSURI.TLS),
 	}
-	badIssuerJWKSURISchemeJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	badIssuerJWKSURISchemeJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   badIssuerInvalidJWKSURIScheme,
 		Audience: goodAudience,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(badOIDCIssuerServerInvalidJWKSURIScheme.TLS),
 	}

-	jwksFetchShouldFailJWTAuthenticatorSpec := &auth1alpha1.JWTAuthenticatorSpec{
+	jwksFetchShouldFailJWTAuthenticatorSpec := &authenticationv1alpha1.JWTAuthenticatorSpec{
 		Issuer:   jwksFetchShouldFailServer.URL,
 		Audience: goodAudience,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(jwksFetchShouldFailServer.TLS),
@@ -617,12 +617,12 @@ func TestController(t *testing.T) {
 			name:    "Sync: valid and unchanged JWTAuthenticator: loop will preserve existing status conditions",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -649,13 +649,13 @@ func TestController(t *testing.T) {
 			name:    "Sync: changed JWTAuthenticator: loop will update timestamps only on relevant statuses",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:       "test-name",
 						Generation: 1234,
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 1233),
 							[]metav1.Condition{
@@ -684,13 +684,13 @@ func TestController(t *testing.T) {
 				},
 			}},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:       "test-name",
 						Generation: 1234,
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 1234),
 							[]metav1.Condition{
@@ -714,7 +714,7 @@ func TestController(t *testing.T) {
 			name:    "Sync: valid JWTAuthenticator with CA: loop will complete successfully and update status conditions.",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -732,12 +732,12 @@ func TestController(t *testing.T) {
 				},
 			}},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -756,7 +756,7 @@ func TestController(t *testing.T) {
 			name:    "Sync: JWTAuthenticator with custom username claim: loop will complete successfully and update status conditions.",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -774,12 +774,12 @@ func TestController(t *testing.T) {
 				},
 			}},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpecWithUsernameClaim,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -799,7 +799,7 @@ func TestController(t *testing.T) {
 			name:    "Sync: JWTAuthenticator with custom groups claim: loop will complete successfully and update status conditions.",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -817,12 +817,12 @@ func TestController(t *testing.T) {
 				},
 			}},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpecWithGroupsClaim,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -845,7 +845,7 @@ func TestController(t *testing.T) {
 					authncache.Key{
 						Name:     "test-name",
 						Kind:     "JWTAuthenticator",
-						APIGroup: auth1alpha1.SchemeGroupVersion.Group,
+						APIGroup: authenticationv1alpha1.SchemeGroupVersion.Group,
 					},
 					newCacheValue(t, *otherJWTAuthenticatorSpec, wantClose),
 				)
@@ -853,7 +853,7 @@ func TestController(t *testing.T) {
 			wantClose: true,
 			syncKey:   controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -871,12 +871,12 @@ func TestController(t *testing.T) {
 				},
 			}},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -898,7 +898,7 @@ func TestController(t *testing.T) {
 					authncache.Key{
 						Name:     "test-name",
 						Kind:     "JWTAuthenticator",
-						APIGroup: auth1alpha1.SchemeGroupVersion.Group,
+						APIGroup: authenticationv1alpha1.SchemeGroupVersion.Group,
 					},
 					newCacheValue(t, *someJWTAuthenticatorSpec, wantClose),
 				)
@@ -906,7 +906,7 @@ func TestController(t *testing.T) {
 			wantClose: false,
 			syncKey:   controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -939,14 +939,14 @@ func TestController(t *testing.T) {
 					authncache.Key{
 						Name:     "test-name",
 						Kind:     "JWTAuthenticator",
-						APIGroup: auth1alpha1.SchemeGroupVersion.Group,
+						APIGroup: authenticationv1alpha1.SchemeGroupVersion.Group,
 					},
 					struct{ authenticator.Token }{},
 				)
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -970,12 +970,12 @@ func TestController(t *testing.T) {
 				},
 			}},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -994,7 +994,7 @@ func TestController(t *testing.T) {
 			name:    "Sync: valid JWTAuthenticator without CA: loop will fail to cache the authenticator, will write failed and unknown status conditions, and will enqueue resync",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -1002,12 +1002,12 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *missingTLSJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1038,7 +1038,7 @@ func TestController(t *testing.T) {
 			name:    "validateTLS: JWTAuthenticator with invalid CA: loop will fail, will write failed and unknown status conditions, but will not enqueue a resync due to user config error",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -1046,12 +1046,12 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *invalidTLSJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(someOtherIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1077,7 +1077,7 @@ func TestController(t *testing.T) {
 		}, {
 			name: "validateIssuer: parsing error (spec.issuer URL is invalid): loop will fail sync, will write failed and unknown status conditions, but will not enqueue a resync due to user config error",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -1086,12 +1086,12 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *invalidIssuerJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1116,7 +1116,7 @@ func TestController(t *testing.T) {
 		}, {
 			name: "validateIssuer: parsing error (spec.issuer URL has invalid scheme, requires https): loop will fail sync, will write failed and unknown conditions, but will not enqueue a resync due to user config error",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -1125,12 +1125,12 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *invalidIssuerSchemeJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1155,11 +1155,11 @@ func TestController(t *testing.T) {
 		}, {
 			name: "validateIssuer: issuer cannot include fragment: loop will fail sync, will write failed and unknown conditions, but will not enqueue a resync due to user config error",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.JWTAuthenticatorSpec{
+					Spec: authenticationv1alpha1.JWTAuthenticatorSpec{
 						Issuer:   "https://www.example.com/foo/bar/#do-not-include-fragment",
 						Audience: goodAudience,
 						TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
@@ -1168,16 +1168,16 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.JWTAuthenticatorSpec{
+					Spec: authenticationv1alpha1.JWTAuthenticatorSpec{
 						Issuer:   "https://www.example.com/foo/bar/#do-not-include-fragment",
 						Audience: goodAudience,
 						TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
 					},
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1202,11 +1202,11 @@ func TestController(t *testing.T) {
 		}, {
 			name: "validateIssuer: issuer cannot include query params: loop will fail sync, will write failed and unknown conditions, but will not enqueue a resync due to user config error",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.JWTAuthenticatorSpec{
+					Spec: authenticationv1alpha1.JWTAuthenticatorSpec{
 						Issuer:   "https://www.example.com/foo/bar/?query-params=not-allowed",
 						Audience: goodAudience,
 						TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
@@ -1215,16 +1215,16 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.JWTAuthenticatorSpec{
+					Spec: authenticationv1alpha1.JWTAuthenticatorSpec{
 						Issuer:   "https://www.example.com/foo/bar/?query-params=not-allowed",
 						Audience: goodAudience,
 						TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
 					},
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1249,11 +1249,11 @@ func TestController(t *testing.T) {
 		}, {
 			name: "validateIssuer: issuer cannot include .well-known in path: loop will fail sync, will write failed and unknown conditions, but will not enqueue a resync due to user config error",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.JWTAuthenticatorSpec{
+					Spec: authenticationv1alpha1.JWTAuthenticatorSpec{
 						Issuer:   "https://www.example.com/foo/bar/.well-known/openid-configuration",
 						Audience: goodAudience,
 						TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
@@ -1262,16 +1262,16 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.JWTAuthenticatorSpec{
+					Spec: authenticationv1alpha1.JWTAuthenticatorSpec{
 						Issuer:   "https://www.example.com/foo/bar/.well-known/openid-configuration",
 						Audience: goodAudience,
 						TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
 					},
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1296,7 +1296,7 @@ func TestController(t *testing.T) {
 		}, {
 			name: "validateProviderDiscovery: could not perform oidc discovery on provider issuer: loop will fail sync, will write failed and unknown conditions, and will enqueue new sync",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -1305,12 +1305,12 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *validIssuerURLButDoesNotExistJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1337,11 +1337,11 @@ func TestController(t *testing.T) {
 		}, {
 			name: "validateProviderDiscovery: excessively long errors truncated: loop will fail sync, will write failed and unknown conditions, and will enqueue new sync",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.JWTAuthenticatorSpec{
+					Spec: authenticationv1alpha1.JWTAuthenticatorSpec{
 						Issuer:   goodIssuer + "/path/to/not/found",
 						Audience: goodAudience,
 						TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
@@ -1350,16 +1350,16 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.JWTAuthenticatorSpec{
+					Spec: authenticationv1alpha1.JWTAuthenticatorSpec{
 						Issuer:   goodIssuer + "/path/to/not/found",
 						Audience: goodAudience,
 						TLS:      conciergetestutil.TLSSpecFromTLSConfig(goodOIDCIssuerServer.TLS),
 					},
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1392,7 +1392,7 @@ func TestController(t *testing.T) {
 		{
 			name: "validateProviderJWKSURL: could not parse provider jwks_uri: loop will fail sync, will write failed and unknown conditions, and will enqueue new sync",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -1401,12 +1401,12 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *badIssuerJWKSURIJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1431,7 +1431,7 @@ func TestController(t *testing.T) {
 		}, {
 			name: "validateProviderJWKSURL: invalid scheme, requires 'https': loop will fail sync, will write failed and unknown conditions, and will enqueue new sync",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -1440,12 +1440,12 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *badIssuerJWKSURISchemeJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1473,7 +1473,7 @@ func TestController(t *testing.T) {
 		{
 			name: "validateJWKSFetch: could not fetch keys: loop will fail sync, will write failed and unknown status conditions, and will enqueue a resync",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -1482,12 +1482,12 @@ func TestController(t *testing.T) {
 			},
 			syncKey: controllerlib.Key{Name: "test-name"},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *jwksFetchShouldFailJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1512,12 +1512,12 @@ func TestController(t *testing.T) {
 		{
 			name: "updateStatus: called with matching original and updated conditions: will not make request to update conditions",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -1545,12 +1545,12 @@ func TestController(t *testing.T) {
 		{
 			name: "updateStatus: called with different original and updated conditions: will make request to update conditions",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1573,12 +1573,12 @@ func TestController(t *testing.T) {
 				},
 			}},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -1595,12 +1595,12 @@ func TestController(t *testing.T) {
 		{
 			name: "updateStatus: when update request fails: error will enqueue a resync",
 			jwtAuthenticators: []runtime.Object{
-				&auth1alpha1.JWTAuthenticator{
+				&authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1625,12 +1625,12 @@ func TestController(t *testing.T) {
 				// This captures that there was an attempt to update to Ready, allHappyConditions,
 				// but the wantSyncLoopErr indicates that there is a failure, so the JWTAuthenticator
 				// remains with a bad phase and at least 1 sad condition
-				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &auth1alpha1.JWTAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(jwtAuthenticatorsGVR, "", &authenticationv1alpha1.JWTAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: *someJWTAuthenticatorSpec,
-					Status: auth1alpha1.JWTAuthenticatorStatus{
+					Status: authenticationv1alpha1.JWTAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodIssuer, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -1742,7 +1742,7 @@ func TestController(t *testing.T) {

 			// We expected the cache to have an entry, so pull that entry from the cache and test it.
 			expectedCacheKey := authncache.Key{
-				APIGroup: auth1alpha1.GroupName,
+				APIGroup: authenticationv1alpha1.GroupName,
 				Kind:     "JWTAuthenticator",
 				Name:     syncCtx.Key.Name,
 			}
@@ -2083,7 +2083,7 @@ func createJWT(
 	return jwt
 }

-func newCacheValue(t *testing.T, spec auth1alpha1.JWTAuthenticatorSpec, wantClose bool) authncache.Value {
+func newCacheValue(t *testing.T, spec authenticationv1alpha1.JWTAuthenticatorSpec, wantClose bool) authncache.Value {
 	t.Helper()
 	wasClosed := false

--- a/internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go
+++ b/internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go
@@ -24,7 +24,7 @@ import (
 	"k8s.io/klog/v2"
 	"k8s.io/utils/clock"

-	auth1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	conciergeclientset "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned"
 	authinformers "go.pinniped.dev/generated/latest/client/concierge/informers/externalversions/authentication/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
@@ -126,7 +126,7 @@ func (c *webhookCacheFillerController) Sync(ctx controllerlib.Context) error {

 	if !conditionsutil.HadErrorCondition(conditions) {
 		c.cache.Store(authncache.Key{
-			APIGroup: auth1alpha1.GroupName,
+			APIGroup: authenticationv1alpha1.GroupName,
 			Kind:     "WebhookAuthenticator",
 			Name:     ctx.Key.Name,
 		}, webhookAuthenticator)
@@ -264,7 +264,7 @@ func (c *webhookCacheFillerController) validateConnection(certPool *x509.CertPoo
 	return conditions, nil
 }

-func (c *webhookCacheFillerController) validateTLSBundle(tlsSpec *auth1alpha1.TLSSpec, conditions []*metav1.Condition) (*x509.CertPool, []byte, []*metav1.Condition, bool) {
+func (c *webhookCacheFillerController) validateTLSBundle(tlsSpec *authenticationv1alpha1.TLSSpec, conditions []*metav1.Condition) (*x509.CertPool, []byte, []*metav1.Condition, bool) {
 	rootCAs, pemBytes, err := pinnipedauthenticator.CABundle(tlsSpec)
 	if err != nil {
 		msg := fmt.Sprintf("%s: %s", "invalid TLS configuration", err.Error())
@@ -337,13 +337,13 @@ func (c *webhookCacheFillerController) validateEndpoint(endpoint string, conditi

 func (c *webhookCacheFillerController) updateStatus(
 	ctx context.Context,
-	original *auth1alpha1.WebhookAuthenticator,
+	original *authenticationv1alpha1.WebhookAuthenticator,
 	conditions []*metav1.Condition,
 ) error {
 	updated := original.DeepCopy()

 	if conditionsutil.HadErrorCondition(conditions) {
-		updated.Status.Phase = auth1alpha1.WebhookAuthenticatorPhaseError
+		updated.Status.Phase = authenticationv1alpha1.WebhookAuthenticatorPhaseError
 		conditions = append(conditions, &metav1.Condition{
 			Type:    typeReady,
 			Status:  metav1.ConditionFalse,
@@ -351,7 +351,7 @@ func (c *webhookCacheFillerController) updateStatus(
 			Message: "the WebhookAuthenticator is not ready: see other conditions for details",
 		})
 	} else {
-		updated.Status.Phase = auth1alpha1.WebhookAuthenticatorPhaseReady
+		updated.Status.Phase = authenticationv1alpha1.WebhookAuthenticatorPhaseReady
 		conditions = append(conditions, &metav1.Condition{
 			Type:    typeReady,
 			Status:  metav1.ConditionTrue,
--- a/internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go
+++ b/internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go
@@ -28,7 +28,7 @@ import (
 	clocktesting "k8s.io/utils/clock/testing"
 	"k8s.io/utils/ptr"

-	auth1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/concierge/informers/externalversions"
 	"go.pinniped.dev/internal/certauthority"
@@ -139,34 +139,34 @@ func TestController(t *testing.T) {
 	timeInThePast := time.Date(1111, time.January, 1, 1, 1, 1, 111111, time.Local)
 	frozenTimeInThePast := metav1.NewTime(timeInThePast)

-	goodWebhookAuthenticatorSpecWithCA := auth1alpha1.WebhookAuthenticatorSpec{
+	goodWebhookAuthenticatorSpecWithCA := authenticationv1alpha1.WebhookAuthenticatorSpec{
 		Endpoint: goodWebhookDefaultServingCertEndpoint,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(hostGoodDefaultServingCertServer.TLS),
 	}
-	localWithExampleDotComWeebhookAuthenticatorSpec := auth1alpha1.WebhookAuthenticatorSpec{
+	localWithExampleDotComWeebhookAuthenticatorSpec := authenticationv1alpha1.WebhookAuthenticatorSpec{
 		// CA for example.com, TLS serving cert for example.com, but endpoint is still localhost
 		Endpoint: hostLocalWithExampleDotComCertServer.URL,
-		TLS: &auth1alpha1.TLSSpec{
+		TLS: &authenticationv1alpha1.TLSSpec{
 			// CA Bundle for example.com
 			CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForExampleDotCom.Bundle()),
 		},
 	}
-	goodWebhookAuthenticatorSpecWithoutCA := auth1alpha1.WebhookAuthenticatorSpec{
+	goodWebhookAuthenticatorSpecWithoutCA := authenticationv1alpha1.WebhookAuthenticatorSpec{
 		Endpoint: goodWebhookDefaultServingCertEndpoint,
-		TLS:      &auth1alpha1.TLSSpec{CertificateAuthorityData: ""},
+		TLS:      &authenticationv1alpha1.TLSSpec{CertificateAuthorityData: ""},
 	}
-	goodWebhookAuthenticatorSpecWith404Endpoint := auth1alpha1.WebhookAuthenticatorSpec{
+	goodWebhookAuthenticatorSpecWith404Endpoint := authenticationv1alpha1.WebhookAuthenticatorSpec{
 		Endpoint: goodWebhookDefaultServingCertEndpointBut404,
 		TLS:      conciergetestutil.TLSSpecFromTLSConfig(hostGoodDefaultServingCertServer.TLS),
 	}
-	badWebhookAuthenticatorSpecInvalidTLS := auth1alpha1.WebhookAuthenticatorSpec{
+	badWebhookAuthenticatorSpecInvalidTLS := authenticationv1alpha1.WebhookAuthenticatorSpec{
 		Endpoint: goodWebhookDefaultServingCertEndpoint,
-		TLS:      &auth1alpha1.TLSSpec{CertificateAuthorityData: "invalid base64-encoded data"},
+		TLS:      &authenticationv1alpha1.TLSSpec{CertificateAuthorityData: "invalid base64-encoded data"},
 	}

-	badWebhookAuthenticatorSpecGoodEndpointButUnknownCA := auth1alpha1.WebhookAuthenticatorSpec{
+	badWebhookAuthenticatorSpecGoodEndpointButUnknownCA := authenticationv1alpha1.WebhookAuthenticatorSpec{
 		Endpoint: goodWebhookDefaultServingCertEndpoint,
-		TLS: &auth1alpha1.TLSSpec{
+		TLS: &authenticationv1alpha1.TLSSpec{
 			CertificateAuthorityData: base64.StdEncoding.EncodeToString(pemServerCertForUnknownServer),
 		},
 	}
@@ -392,12 +392,12 @@ func TestController(t *testing.T) {
 			name:    "Sync: valid and unchanged WebhookAuthenticator: loop will preserve existing status conditions",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -427,13 +427,13 @@ func TestController(t *testing.T) {
 			name:    "Sync: changed WebhookAuthenticator: loop will update timestamps only on relevant statuses",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:       "test-name",
 						Generation: 1234,
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 1233),
 							[]metav1.Condition{
@@ -458,13 +458,13 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:       "test-name",
 						Generation: 1234,
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 1234),
 							[]metav1.Condition{
@@ -487,7 +487,7 @@ func TestController(t *testing.T) {
 			name:    "Sync: valid WebhookAuthenticator with CA: will complete sync loop successfully with success conditions and ready phase",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -507,12 +507,12 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -530,14 +530,14 @@ func TestController(t *testing.T) {
 			name:    "Sync: valid WebhookAuthenticator with IPV6 and CA: will complete sync loop successfully with success conditions and ready phase",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: func() auth1alpha1.WebhookAuthenticatorSpec {
+					Spec: func() authenticationv1alpha1.WebhookAuthenticatorSpec {
 						ipv6 := goodWebhookAuthenticatorSpecWithCA.DeepCopy()
 						ipv6.Endpoint = hostLocalIPv6Server.URL
-						ipv6.TLS = ptr.To(auth1alpha1.TLSSpec{
+						ipv6.TLS = ptr.To(authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(ipv6CA),
 						})
 						return *ipv6
@@ -557,19 +557,19 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: func() auth1alpha1.WebhookAuthenticatorSpec {
+					Spec: func() authenticationv1alpha1.WebhookAuthenticatorSpec {
 						ipv6 := goodWebhookAuthenticatorSpecWithCA.DeepCopy()
 						ipv6.Endpoint = hostLocalIPv6Server.URL
-						ipv6.TLS = ptr.To(auth1alpha1.TLSSpec{
+						ipv6.TLS = ptr.To(authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(ipv6CA),
 						})
 						return *ipv6
 					}(),
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(hostLocalIPv6Server.URL, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -587,7 +587,7 @@ func TestController(t *testing.T) {
 			name:    "Sync: valid WebhookAuthenticator without CA: loop will fail to cache the authenticator, will write failed and unknown status conditions, and will enqueue resync",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -595,12 +595,12 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWithoutCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -627,7 +627,7 @@ func TestController(t *testing.T) {
 			name:    "validateTLS: WebhookAuthenticator with invalid CA will fail sync loop and will report failed and unknown conditions and Error phase, but will not enqueue a resync due to user config error",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -635,12 +635,12 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: badWebhookAuthenticatorSpecInvalidTLS,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -666,24 +666,24 @@ func TestController(t *testing.T) {
 			name:    "validateEndpoint: parsing error (spec.endpoint URL is invalid) will fail sync loop and will report failed and unknown conditions and Error phase, but will not enqueue a resync due to user config error",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: badEndpointInvalidURL,
 					},
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: badEndpointInvalidURL,
 					},
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -710,24 +710,24 @@ func TestController(t *testing.T) {
 			name:    "validateEndpoint: parsing error (spec.endpoint URL has invalid scheme, requires https) will fail sync loop, will write failed and unknown status conditions, but will not enqueue a resync due to user config error",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: badEndpointNoHTTPS,
 					},
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: badEndpointNoHTTPS,
 					},
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -754,30 +754,30 @@ func TestController(t *testing.T) {
 			name:    "validateEndpoint: should error if endpoint cannot be parsed",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: "https://[0:0:0:0:0:0:0:1]:69999/some/fake/path",
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: "https://[0:0:0:0:0:0:0:1]:69999/some/fake/path",
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess("https://[0:0:0:0:0:0:0:1]:69999/some/fake/path", frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -803,7 +803,7 @@ func TestController(t *testing.T) {
 			name:    "validateConnection: CA does not validate serving certificate for host, the dialer will error, will fail sync loop, will write failed and unknown status conditions, but will not enqueue a resync due to user config error",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -812,12 +812,12 @@ func TestController(t *testing.T) {
 			},
 			wantSyncLoopErr: testutil.WantExactErrorString("cannot dial server: tls: failed to verify certificate: x509: certificate signed by unknown authority"),
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: badWebhookAuthenticatorSpecGoodEndpointButUnknownCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -845,7 +845,7 @@ func TestController(t *testing.T) {
 			name:    "validateConnection: 404 endpoint on a valid server will still validate server certificate, will complete sync loop successfully with success conditions and ready phase",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
@@ -865,12 +865,12 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWith404Endpoint,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpointBut404, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -888,18 +888,18 @@ func TestController(t *testing.T) {
 			name:    "validateConnection: localhost hostname instead of 127.0.0.1 should still dial correctly as dialer should handle hostnames as well as IPv4",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: fmt.Sprintf("https://localhost:%s", localhostURL.Port()),
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							// CA Bundle for validating the server's certs
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAsHostname.Bundle()),
 						},
 					},
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(fmt.Sprintf("https://localhost:%s", localhostURL.Port()), frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -929,30 +929,30 @@ func TestController(t *testing.T) {
 			name:    "validateConnection: IPv6 address with port: should call dialer func with correct arguments",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: "https://[0:0:0:0:0:0:0:1]:4242/some/fake/path",
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: "https://[0:0:0:0:0:0:0:1]:4242/some/fake/path",
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess("https://[0:0:0:0:0:0:0:1]:4242/some/fake/path", frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -978,30 +978,30 @@ func TestController(t *testing.T) {
 			name:    "validateConnection: IPv6 address without port: should call dialer func with correct arguments",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: "https://[0:0:0:0:0:0:0:1]/some/fake/path",
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: "https://[0:0:0:0:0:0:0:1]/some/fake/path",
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess("https://[0:0:0:0:0:0:0:1]/some/fake/path", frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1027,17 +1027,17 @@ func TestController(t *testing.T) {
 			name:    "validateConnection: localhost as IP address 127.0.0.1 should still dial correctly as dialer should handle hostnames as well as IPv4 and IPv6 addresses",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: hostAs127001WebhookServer.URL,
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(hostAs127001WebhookServer.URL, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -1067,24 +1067,24 @@ func TestController(t *testing.T) {
 			name:    "validateConnection: CA for example.com, serving cert for example.com, but endpoint 127.0.0.1 will fail to validate certificate and will fail sync loop and will report failed and unknown conditions and Error phase, but will not enqueue a resync due to user config error",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: localWithExampleDotComWeebhookAuthenticatorSpec,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(hostLocalWithExampleDotComCertServer.URL, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: localWithExampleDotComWeebhookAuthenticatorSpec,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(hostLocalWithExampleDotComCertServer.URL, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1110,30 +1110,30 @@ func TestController(t *testing.T) {
 			name:    "validateConnection: IPv6 address without port or brackets: should succeed since IPv6 brackets are optional without port",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: "https://0:0:0:0:0:0:0:1/some/fake/path",
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
-					Spec: auth1alpha1.WebhookAuthenticatorSpec{
+					Spec: authenticationv1alpha1.WebhookAuthenticatorSpec{
 						Endpoint: "https://0:0:0:0:0:0:0:1/some/fake/path",
-						TLS: &auth1alpha1.TLSSpec{
+						TLS: &authenticationv1alpha1.TLSSpec{
 							CertificateAuthorityData: base64.StdEncoding.EncodeToString(caForLocalhostAs127001.Bundle()),
 						},
 					},
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess("https://0:0:0:0:0:0:0:1/some/fake/path", frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1159,12 +1159,12 @@ func TestController(t *testing.T) {
 			name:    "updateStatus: called with matching original and updated conditions: will not make request to update conditions",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -1194,12 +1194,12 @@ func TestController(t *testing.T) {
 			name:    "updateStatus: called with different original and updated conditions: will make request to update conditions",
 			syncKey: controllerlib.Key{Name: "test-name"},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1223,12 +1223,12 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},
@@ -1255,12 +1255,12 @@ func TestController(t *testing.T) {
 				)
 			},
 			webhooks: []runtime.Object{
-				&auth1alpha1.WebhookAuthenticator{
+				&authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: conditionstestutil.Replace(
 							allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 							[]metav1.Condition{
@@ -1284,12 +1284,12 @@ func TestController(t *testing.T) {
 				},
 			},
 			wantActions: func() []coretesting.Action {
-				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &auth1alpha1.WebhookAuthenticator{
+				updateStatusAction := coretesting.NewUpdateAction(webhookAuthenticatorGVR, "", &authenticationv1alpha1.WebhookAuthenticator{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "test-name",
 					},
 					Spec: goodWebhookAuthenticatorSpecWithCA,
-					Status: auth1alpha1.WebhookAuthenticatorStatus{
+					Status: authenticationv1alpha1.WebhookAuthenticatorStatus{
 						Conditions: allHappyConditionsSuccess(goodWebhookDefaultServingCertEndpoint, frozenMetav1Now, 0),
 						Phase:      "Ready",
 					},