Allow multiple Pinnipeds to work on same cluster

Yes, this is a huge commit.

The middleware allows you to customize the API groups of all of the
*.pinniped.dev API groups.

Some notes about other small things in this commit:
- We removed the internal/client package in favor of pkg/conciergeclient. The
  two packages do basically the same thing. I don't think we use the former
  anymore.
- We re-enabled cluster-scoped owner assertions in the integration tests.
  This code was added in internal/ownerref. See a0546942 for when this
  assertion was removed.
- Note: the middlware code is in charge of restoring the GV of a request object,
  so we should never need to write mutations that do that.
- We updated the supervisor secret generation to no longer manually set an owner
  reference to the deployment since the middleware code now does this. I think we
  still need some way to make an initial event for the secret generator
  controller, which involves knowing the namespace and the name of the generated
  secret, so I still wired the deployment through. We could use a namespace/name
  tuple here, but I was lazy.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
Co-authored-by: Ryan Richard <richardry@vmware.com>

pkg/conciergeclient/conciergeclient.go

@@ -22,6 +22,7 @@ import (
 	loginv1alpha1 "go.pinniped.dev/generated/1.20/apis/concierge/login/v1alpha1"
 	conciergeclientset "go.pinniped.dev/generated/1.20/client/concierge/clientset/versioned"
 	"go.pinniped.dev/internal/constable"
+	"go.pinniped.dev/internal/groupsuffix"
 	"go.pinniped.dev/internal/kubeclient"
 )
 
@@ -116,8 +117,8 @@ func WithEndpoint(endpoint string) Option {
 // WithAPIGroupSuffix configures the concierge's API group suffix (e.g., "pinniped.dev").
 func WithAPIGroupSuffix(apiGroupSuffix string) Option {
 	return func(c *Client) error {
-		if apiGroupSuffix == "" {
-			return fmt.Errorf("api group suffix must not be empty")
+		if err := groupsuffix.Validate(apiGroupSuffix); err != nil {
+			return fmt.Errorf("invalid api group suffix: %w", err)
 		}
 		c.apiGroupSuffix = apiGroupSuffix
 		return nil
@@ -163,8 +164,10 @@ func (c *Client) clientset() (conciergeclientset.Interface, error) {
 	if err != nil {
 		return nil, err
 	}
-	_ = c.apiGroupSuffix // TODO: wire API group into kubeclient.
-	client, err := kubeclient.New(kubeclient.WithConfig(cfg))
+	client, err := kubeclient.New(
+		kubeclient.WithConfig(cfg),
+		kubeclient.WithMiddleware(groupsuffix.New(c.apiGroupSuffix)),
+	)
 	if err != nil {
 		return nil, err
 	}

pkg/conciergeclient/conciergeclient_test.go

@@ -111,7 +111,16 @@ func TestNew(t *testing.T) {
 				WithEndpoint("https://example.com"),
 				WithAPIGroupSuffix(""),
 			},
-			wantErr: "api group suffix must not be empty",
+			wantErr: "invalid api group suffix: 2 error(s):\n- must contain '.'\n- a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')",
+		},
+		{
+			name: "invalid api group suffix",
+			opts: []Option{
+				WithAuthenticator("jwt", "test-authenticator"),
+				WithEndpoint("https://example.com"),
+				WithAPIGroupSuffix(".starts.with.dot"),
+			},
+			wantErr: "invalid api group suffix: 1 error(s):\n- a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')",
 		},
 		{
 			name: "valid",