Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'

Enforce importas:

- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1

internal/controller/authenticator/authncache/cache.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // Package authncache implements a cache of active authenticators.
@@ -65,7 +65,7 @@ func (c *Cache) Delete(key Key) {
 // Keys currently stored in the cache.
 func (c *Cache) Keys() []Key {
 	var result []Key
-	c.cache.Range(func(key, _ interface{}) bool {
+	c.cache.Range(func(key, _ any) bool {
 		result = append(result, key.(Key))
 		return true
 	})

internal/controller/authenticator/authncache/cache_test.go

@@ -184,7 +184,7 @@ func TestAuthenticateTokenCredentialRequest(t *testing.T) {
 
 type audienceFreeContext struct{}
 
-func (audienceFreeContext) Matches(in interface{}) bool {
+func (audienceFreeContext) Matches(in any) bool {
 	ctx, isCtx := in.(context.Context)
 	if !isCtx {
 		return false

internal/controller/authenticator/jwtcachefiller/jwtcachefiller_test.go

@@ -141,8 +141,8 @@ func TestController(t *testing.T) {
 
 		builder := jwt.Signed(sig).Claims(claimsWithoutSubject)
 
-		builder = builder.Claims(map[string]interface{}{customGroupsClaim: distributedGroups})
-		builder = builder.Claims(map[string]interface{}{"groups": distributedGroups})
+		builder = builder.Claims(map[string]any{customGroupsClaim: distributedGroups})
+		builder = builder.Claims(map[string]any{"groups": distributedGroups})
 
 		distributedClaimsJwt, err := builder.CompactSerialize()
 		require.NoError(t, err)
@@ -162,7 +162,7 @@ func TestController(t *testing.T) {
 
 		builder := jwt.Signed(sig).Claims(claimsWithoutSubject)
 
-		builder = builder.Claims(map[string]interface{}{"some-other-claim": distributedGroups})
+		builder = builder.Claims(map[string]any{"some-other-claim": distributedGroups})
 
 		distributedClaimsJwt, err := builder.CompactSerialize()
 		require.NoError(t, err)
@@ -634,7 +634,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -679,7 +679,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -727,7 +727,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -769,7 +769,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -812,7 +812,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -866,7 +866,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -919,7 +919,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "actual jwt authenticator and desired jwt authenticator are the same",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -965,7 +965,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -1530,7 +1530,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -1568,7 +1568,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -1648,7 +1648,7 @@ func TestController(t *testing.T) {
 				"logger":    "jwtcachefiller-controller",
 				"message":   "added new jwt authenticator",
 				"issuer":    goodIssuer,
-				"jwtAuthenticator": map[string]interface{}{
+				"jwtAuthenticator": map[string]any{
 					"name": "test-name",
 				},
 			}},
@@ -1791,13 +1791,13 @@ func TestController(t *testing.T) {
 						NotBefore: jwt.NewNumericDate(time.Now().Add(-time.Hour)),
 						IssuedAt:  jwt.NewNumericDate(time.Now().Add(-time.Hour)),
 					}
-					var groups interface{}
+					var groups any
 					username := goodUsername
 					if test.jwtClaims != nil {
 						test.jwtClaims(&wellKnownClaims, &groups, &username)
 					}
 
-					var signingKey interface{} = goodECSigningKey
+					var signingKey any = goodECSigningKey
 					signingAlgo := goodECSigningAlgo
 					signingKID := goodECSigningKeyID
 					if test.jwtSignature != nil {
@@ -1860,8 +1860,8 @@ func testTableForAuthenticateTokenTests(
 	issuer string,
 ) []struct {
 	name                      string
-	jwtClaims                 func(wellKnownClaims *jwt.Claims, groups *interface{}, username *string)
-	jwtSignature              func(key *interface{}, algo *jose.SignatureAlgorithm, kid *string)
+	jwtClaims                 func(wellKnownClaims *jwt.Claims, groups *any, username *string)
+	jwtSignature              func(key *any, algo *jose.SignatureAlgorithm, kid *string)
 	wantResponse              *authenticator.Response
 	wantAuthenticated         bool
 	wantErr                   testutil.RequireErrorStringFunc
@@ -1869,8 +1869,8 @@ func testTableForAuthenticateTokenTests(
 } {
 	tests := []struct {
 		name                      string
-		jwtClaims                 func(wellKnownClaims *jwt.Claims, groups *interface{}, username *string)
-		jwtSignature              func(key *interface{}, algo *jose.SignatureAlgorithm, kid *string)
+		jwtClaims                 func(wellKnownClaims *jwt.Claims, groups *any, username *string)
+		jwtSignature              func(key *any, algo *jose.SignatureAlgorithm, kid *string)
 		wantResponse              *authenticator.Response
 		wantAuthenticated         bool
 		wantErr                   testutil.RequireErrorStringFunc
@@ -1887,7 +1887,7 @@ func testTableForAuthenticateTokenTests(
 		},
 		{
 			name: "good token without groups and with RSA signature",
-			jwtSignature: func(key *interface{}, algo *jose.SignatureAlgorithm, kid *string) {
+			jwtSignature: func(key *any, algo *jose.SignatureAlgorithm, kid *string) {
 				*key = goodRSASigningKey
 				*algo = goodRSASigningAlgo
 				*kid = goodRSASigningKeyID
@@ -1901,7 +1901,7 @@ func testTableForAuthenticateTokenTests(
 		},
 		{
 			name: "good token with groups as array",
-			jwtClaims: func(_ *jwt.Claims, groups *interface{}, username *string) {
+			jwtClaims: func(_ *jwt.Claims, groups *any, username *string) {
 				*groups = []string{group0, group1}
 			},
 			wantResponse: &authenticator.Response{
@@ -1914,7 +1914,7 @@ func testTableForAuthenticateTokenTests(
 		},
 		{
 			name: "good token with good distributed groups",
-			jwtClaims: func(claims *jwt.Claims, groups *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, groups *any, username *string) {
 			},
 			distributedGroupsClaimURL: issuer + "/claim_source",
 			wantResponse: &authenticator.Response{
@@ -1927,21 +1927,21 @@ func testTableForAuthenticateTokenTests(
 		},
 		{
 			name: "distributed groups returns a 404",
-			jwtClaims: func(claims *jwt.Claims, groups *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, groups *any, username *string) {
 			},
 			distributedGroupsClaimURL: issuer + "/not_found_claim_source",
 			wantErr:                   testutil.WantMatchingErrorString(`oidc: could not expand distributed claims: while getting distributed claim "` + expectedGroupsClaim + `": error while getting distributed claim JWT: 404 Not Found`),
 		},
 		{
 			name: "distributed groups doesn't return the right claim",
-			jwtClaims: func(claims *jwt.Claims, groups *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, groups *any, username *string) {
 			},
 			distributedGroupsClaimURL: issuer + "/wrong_claim_source",
 			wantErr:                   testutil.WantMatchingErrorString(`oidc: could not expand distributed claims: jwt returned by distributed claim endpoint "` + issuer + `/wrong_claim_source" did not contain claim: `),
 		},
 		{
 			name: "good token with groups as string",
-			jwtClaims: func(_ *jwt.Claims, groups *interface{}, username *string) {
+			jwtClaims: func(_ *jwt.Claims, groups *any, username *string) {
 				*groups = group0
 			},
 			wantResponse: &authenticator.Response{
@@ -1954,7 +1954,7 @@ func testTableForAuthenticateTokenTests(
 		},
 		{
 			name: "good token with nbf unset",
-			jwtClaims: func(claims *jwt.Claims, _ *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, _ *any, username *string) {
 				claims.NotBefore = nil
 			},
 			wantResponse: &authenticator.Response{
@@ -1966,14 +1966,14 @@ func testTableForAuthenticateTokenTests(
 		},
 		{
 			name: "bad token with groups as map",
-			jwtClaims: func(_ *jwt.Claims, groups *interface{}, username *string) {
+			jwtClaims: func(_ *jwt.Claims, groups *any, username *string) {
 				*groups = map[string]string{"not an array": "or a string"}
 			},
 			wantErr: testutil.WantMatchingErrorString("oidc: parse groups claim \"" + expectedGroupsClaim + "\": json: cannot unmarshal object into Go value of type string"),
 		},
 		{
 			name: "bad token with wrong issuer",
-			jwtClaims: func(claims *jwt.Claims, _ *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, _ *any, username *string) {
 				claims.Issuer = "wrong-issuer"
 			},
 			wantResponse:      nil,
@@ -1981,49 +1981,49 @@ func testTableForAuthenticateTokenTests(
 		},
 		{
 			name: "bad token with no audience",
-			jwtClaims: func(claims *jwt.Claims, _ *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, _ *any, username *string) {
 				claims.Audience = nil
 			},
 			wantErr: testutil.WantMatchingErrorString(`oidc: verify token: oidc: expected audience "some-audience" got \[\]`),
 		},
 		{
 			name: "bad token with wrong audience",
-			jwtClaims: func(claims *jwt.Claims, _ *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, _ *any, username *string) {
 				claims.Audience = []string{"wrong-audience"}
 			},
 			wantErr: testutil.WantMatchingErrorString(`oidc: verify token: oidc: expected audience "some-audience" got \["wrong-audience"\]`),
 		},
 		{
 			name: "bad token with nbf in the future",
-			jwtClaims: func(claims *jwt.Claims, _ *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, _ *any, username *string) {
 				claims.NotBefore = jwt.NewNumericDate(time.Date(3020, 2, 3, 4, 5, 6, 7, time.UTC))
 			},
 			wantErr: testutil.WantMatchingErrorString(`oidc: verify token: oidc: current time .* before the nbf \(not before\) time: 3020-.*`),
 		},
 		{
 			name: "bad token with exp in past",
-			jwtClaims: func(claims *jwt.Claims, _ *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, _ *any, username *string) {
 				claims.Expiry = jwt.NewNumericDate(time.Date(1, 2, 3, 4, 5, 6, 7, time.UTC))
 			},
 			wantErr: testutil.WantMatchingErrorString(`oidc: verify token: oidc: token is expired \(Token Expiry: .+`),
 		},
 		{
 			name: "bad token without exp",
-			jwtClaims: func(claims *jwt.Claims, _ *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, _ *any, username *string) {
 				claims.Expiry = nil
 			},
 			wantErr: testutil.WantMatchingErrorString(`oidc: verify token: oidc: token is expired \(Token Expiry: .+`),
 		},
 		{
 			name: "token does not have username claim",
-			jwtClaims: func(claims *jwt.Claims, _ *interface{}, username *string) {
+			jwtClaims: func(claims *jwt.Claims, _ *any, username *string) {
 				*username = ""
 			},
 			wantErr: testutil.WantMatchingErrorString(`oidc: parse username claims "` + expectedUsernameClaim + `": claim not present`),
 		},
 		{
 			name: "signing key is wrong",
-			jwtSignature: func(key *interface{}, algo *jose.SignatureAlgorithm, kid *string) {
+			jwtSignature: func(key *any, algo *jose.SignatureAlgorithm, kid *string) {
 				var err error
 				*key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 				require.NoError(t, err)
@@ -2033,7 +2033,7 @@ func testTableForAuthenticateTokenTests(
 		},
 		{
 			name: "signing algo is unsupported",
-			jwtSignature: func(key *interface{}, algo *jose.SignatureAlgorithm, kid *string) {
+			jwtSignature: func(key *any, algo *jose.SignatureAlgorithm, kid *string) {
 				var err error
 				*key, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
 				require.NoError(t, err)
@@ -2048,12 +2048,12 @@ func testTableForAuthenticateTokenTests(
 
 func createJWT(
 	t *testing.T,
-	signingKey interface{},
+	signingKey any,
 	signingAlgo jose.SignatureAlgorithm,
 	kid string,
 	claims *jwt.Claims,
 	groupsClaim string,
-	groupsValue interface{},
+	groupsValue any,
 	distributedGroupsClaimURL string,
 	usernameClaim string,
 	usernameValue string,
@@ -2068,14 +2068,14 @@ func createJWT(
 
 	builder := jwt.Signed(sig).Claims(claims)
 	if groupsValue != nil {
-		builder = builder.Claims(map[string]interface{}{groupsClaim: groupsValue})
+		builder = builder.Claims(map[string]any{groupsClaim: groupsValue})
 	}
 	if distributedGroupsClaimURL != "" {
-		builder = builder.Claims(map[string]interface{}{"_claim_names": map[string]string{groupsClaim: "src1"}})
-		builder = builder.Claims(map[string]interface{}{"_claim_sources": map[string]interface{}{"src1": map[string]string{"endpoint": distributedGroupsClaimURL}}})
+		builder = builder.Claims(map[string]any{"_claim_names": map[string]string{groupsClaim: "src1"}})
+		builder = builder.Claims(map[string]any{"_claim_sources": map[string]any{"src1": map[string]string{"endpoint": distributedGroupsClaimURL}}})
 	}
 	if usernameValue != "" {
-		builder = builder.Claims(map[string]interface{}{usernameClaim: usernameValue})
+		builder = builder.Claims(map[string]any{usernameClaim: usernameValue})
 	}
 	jwt, err := builder.CompactSerialize()
 	require.NoError(t, err)

internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go

@@ -410,7 +410,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  goodWebhookDefaultServingCertEndpoint,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -452,7 +452,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  goodWebhookDefaultServingCertEndpoint,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -501,7 +501,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  goodWebhookDefaultServingCertEndpoint,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -551,7 +551,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  hostLocalIPv6Server.URL,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -859,7 +859,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  goodWebhookDefaultServingCertEndpointBut404,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -912,7 +912,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  fmt.Sprintf("https://localhost:%s", localhostURL.Port()),
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -1050,7 +1050,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  hostAs127001WebhookServer.URL,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -1177,7 +1177,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  goodWebhookDefaultServingCertEndpoint,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -1217,7 +1217,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  goodWebhookDefaultServingCertEndpoint,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},
@@ -1278,7 +1278,7 @@ func TestController(t *testing.T) {
 					"logger":    "webhookcachefiller-controller",
 					"message":   "added new webhook authenticator",
 					"endpoint":  goodWebhookDefaultServingCertEndpoint,
-					"webhook": map[string]interface{}{
+					"webhook": map[string]any{
 						"name": "test-name",
 					},
 				},

internal/controller/impersonatorconfig/impersonator_config_test.go

@@ -715,7 +715,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
 		// If an object is added to the informer's client *before* the informer is started, then waiting is
 		// not needed because the informer's initial "list" will pick up the object.
 		var waitForObjectToAppearInInformer = func(obj kubeclient.Object, informer controllerlib.InformerGetter) {
-			var objFromInformer interface{}
+			var objFromInformer any
 			var exists bool
 			var err error
 			assert.Eventually(t, func() bool {
@@ -728,7 +728,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
 		}
 
 		var waitForClusterScopedObjectToAppearInInformer = func(obj kubeclient.Object, informer controllerlib.InformerGetter) {
-			var objFromInformer interface{}
+			var objFromInformer any
 			var exists bool
 			var err error
 			assert.Eventually(t, func() bool {
@@ -742,7 +742,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
 
 		// See comment for waitForObjectToAppearInInformer above.
 		var waitForObjectToBeDeletedFromInformer = func(resourceName string, informer controllerlib.InformerGetter) {
-			var objFromInformer interface{}
+			var objFromInformer any
 			var exists bool
 			var err error
 			assert.Eventually(t, func() bool {

internal/controller/supervisorconfig/activedirectoryupstreamwatcher/active_directory_upstream_watcher.go

@@ -19,7 +19,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	corev1informers "k8s.io/client-go/informers/core/v1"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	pinnipedsupervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	idpinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/idp/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
@@ -74,7 +74,7 @@ const (
 )
 
 type activeDirectoryUpstreamGenericLDAPImpl struct {
-	activeDirectoryIdentityProvider v1alpha1.ActiveDirectoryIdentityProvider
+	activeDirectoryIdentityProvider idpv1alpha1.ActiveDirectoryIdentityProvider
 }
 
 func (g *activeDirectoryUpstreamGenericLDAPImpl) Spec() upstreamwatchers.UpstreamGenericLDAPSpec {
@@ -98,14 +98,14 @@ func (g *activeDirectoryUpstreamGenericLDAPImpl) Status() upstreamwatchers.Upstr
 }
 
 type activeDirectoryUpstreamGenericLDAPSpec struct {
-	activeDirectoryIdentityProvider v1alpha1.ActiveDirectoryIdentityProvider
+	activeDirectoryIdentityProvider idpv1alpha1.ActiveDirectoryIdentityProvider
 }
 
 func (s *activeDirectoryUpstreamGenericLDAPSpec) Host() string {
 	return s.activeDirectoryIdentityProvider.Spec.Host
 }
 
-func (s *activeDirectoryUpstreamGenericLDAPSpec) TLSSpec() *v1alpha1.TLSSpec {
+func (s *activeDirectoryUpstreamGenericLDAPSpec) TLSSpec() *idpv1alpha1.TLSSpec {
 	return s.activeDirectoryIdentityProvider.Spec.TLS
 }
 
@@ -161,7 +161,7 @@ func (s *activeDirectoryUpstreamGenericLDAPSpec) DetectAndSetSearchBase(ctx cont
 }
 
 type activeDirectoryUpstreamGenericLDAPUserSearch struct {
-	userSearch v1alpha1.ActiveDirectoryIdentityProviderUserSearch
+	userSearch idpv1alpha1.ActiveDirectoryIdentityProviderUserSearch
 }
 
 func (u *activeDirectoryUpstreamGenericLDAPUserSearch) Base() string {
@@ -190,7 +190,7 @@ func (u *activeDirectoryUpstreamGenericLDAPUserSearch) UIDAttribute() string {
 }
 
 type activeDirectoryUpstreamGenericLDAPGroupSearch struct {
-	groupSearch v1alpha1.ActiveDirectoryIdentityProviderGroupSearch
+	groupSearch idpv1alpha1.ActiveDirectoryIdentityProviderGroupSearch
 }
 
 func (g *activeDirectoryUpstreamGenericLDAPGroupSearch) Base() string {
@@ -216,7 +216,7 @@ func (g *activeDirectoryUpstreamGenericLDAPGroupSearch) GroupNameAttribute() str
 }
 
 type activeDirectoryUpstreamGenericLDAPStatus struct {
-	activeDirectoryIdentityProvider v1alpha1.ActiveDirectoryIdentityProvider
+	activeDirectoryIdentityProvider idpv1alpha1.ActiveDirectoryIdentityProvider
 }
 
 func (s *activeDirectoryUpstreamGenericLDAPStatus) Conditions() []metav1.Condition {
@@ -318,7 +318,7 @@ func (c *activeDirectoryWatcherController) Sync(ctx controllerlib.Context) error
 	return nil
 }
 
-func (c *activeDirectoryWatcherController) validateUpstream(ctx context.Context, upstream *v1alpha1.ActiveDirectoryIdentityProvider) (p upstreamprovider.UpstreamLDAPIdentityProviderI, requeue bool) {
+func (c *activeDirectoryWatcherController) validateUpstream(ctx context.Context, upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) (p upstreamprovider.UpstreamLDAPIdentityProviderI, requeue bool) {
 	spec := upstream.Spec
 
 	adUpstreamImpl := &activeDirectoryUpstreamGenericLDAPImpl{activeDirectoryIdentityProvider: *upstream}
@@ -364,15 +364,15 @@ func (c *activeDirectoryWatcherController) validateUpstream(ctx context.Context,
 	return upstreamwatchers.EvaluateConditions(conditions, config)
 }
 
-func (c *activeDirectoryWatcherController) updateStatus(ctx context.Context, upstream *v1alpha1.ActiveDirectoryIdentityProvider, conditions []*metav1.Condition) {
+func (c *activeDirectoryWatcherController) updateStatus(ctx context.Context, upstream *idpv1alpha1.ActiveDirectoryIdentityProvider, conditions []*metav1.Condition) {
 	log := plog.WithValues("namespace", upstream.Namespace, "name", upstream.Name)
 	updated := upstream.DeepCopy()
 
 	hadErrorCondition := conditionsutil.MergeIDPConditions(conditions, upstream.Generation, &updated.Status.Conditions, log)
 
-	updated.Status.Phase = v1alpha1.ActiveDirectoryPhaseReady
+	updated.Status.Phase = idpv1alpha1.ActiveDirectoryPhaseReady
 	if hadErrorCondition {
-		updated.Status.Phase = v1alpha1.ActiveDirectoryPhaseError
+		updated.Status.Phase = idpv1alpha1.ActiveDirectoryPhaseError
 	}
 
 	if equality.Semantic.DeepEqual(upstream, updated) {

internal/controller/supervisorconfig/activedirectoryupstreamwatcher/active_directory_upstream_watcher_test.go

@@ -22,7 +22,7 @@ import (
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes/fake"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/certauthority"
@@ -106,7 +106,7 @@ func TestActiveDirectoryUpstreamWatcherControllerFilterActiveDirectoryIdentityPr
 	}{
 		{
 			name: "any ActiveDirectoryIdentityProvider",
-			idp: &v1alpha1.ActiveDirectoryIdentityProvider{
+			idp: &idpv1alpha1.ActiveDirectoryIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Name: "some-name", Namespace: "some-namespace"},
 			},
 			wantAdd:    true,
@@ -176,32 +176,32 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 	testCABundle := testCA.Bundle()
 	testCABundleBase64Encoded := base64.StdEncoding.EncodeToString(testCABundle)
 
-	validUpstream := &v1alpha1.ActiveDirectoryIdentityProvider{
+	validUpstream := &idpv1alpha1.ActiveDirectoryIdentityProvider{
 		ObjectMeta: metav1.ObjectMeta{Name: testName, Namespace: testNamespace, Generation: 1234, UID: testResourceUID},
-		Spec: v1alpha1.ActiveDirectoryIdentityProviderSpec{
+		Spec: idpv1alpha1.ActiveDirectoryIdentityProviderSpec{
 			Host: testHost,
-			TLS:  &v1alpha1.TLSSpec{CertificateAuthorityData: testCABundleBase64Encoded},
-			Bind: v1alpha1.ActiveDirectoryIdentityProviderBind{SecretName: testBindSecretName},
-			UserSearch: v1alpha1.ActiveDirectoryIdentityProviderUserSearch{
+			TLS:  &idpv1alpha1.TLSSpec{CertificateAuthorityData: testCABundleBase64Encoded},
+			Bind: idpv1alpha1.ActiveDirectoryIdentityProviderBind{SecretName: testBindSecretName},
+			UserSearch: idpv1alpha1.ActiveDirectoryIdentityProviderUserSearch{
 				Base:   testUserSearchBase,
 				Filter: testUserSearchFilter,
-				Attributes: v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{
+				Attributes: idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{
 					Username: testUserSearchUsernameAttrName,
 					UID:      testUserSearchUIDAttrName,
 				},
 			},
-			GroupSearch: v1alpha1.ActiveDirectoryIdentityProviderGroupSearch{
+			GroupSearch: idpv1alpha1.ActiveDirectoryIdentityProviderGroupSearch{
 				Base:                   testGroupSearchBase,
 				Filter:                 testGroupSearchFilter,
 				UserAttributeForFilter: testGroupSearchUserAttributeForFilter,
-				Attributes: v1alpha1.ActiveDirectoryIdentityProviderGroupSearchAttributes{
+				Attributes: idpv1alpha1.ActiveDirectoryIdentityProviderGroupSearchAttributes{
 					GroupName: testGroupSearchNameAttrName,
 				},
 				SkipGroupRefresh: false,
 			},
 		},
 	}
-	editedValidUpstream := func(editFunc func(*v1alpha1.ActiveDirectoryIdentityProvider)) *v1alpha1.ActiveDirectoryIdentityProvider {
+	editedValidUpstream := func(editFunc func(*idpv1alpha1.ActiveDirectoryIdentityProvider)) *idpv1alpha1.ActiveDirectoryIdentityProvider {
 		deepCopy := validUpstream.DeepCopy()
 		editFunc(deepCopy)
 		return deepCopy
@@ -373,7 +373,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		dialErrors               map[string]error
 		wantErr                  string
 		wantResultingCache       []*upstreamldap.ProviderConfig
-		wantResultingUpstreams   []v1alpha1.ActiveDirectoryIdentityProvider
+		wantResultingUpstreams   []idpv1alpha1.ActiveDirectoryIdentityProvider
 		wantValidatedSettings    map[string]upstreamwatchers.ValidatedSettings
 	}{
 		{
@@ -390,9 +390,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -413,9 +413,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 			inputSecrets:       []runtime.Object{},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						{
@@ -441,9 +441,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 			}},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						{
@@ -468,9 +468,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 			}},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						{
@@ -488,15 +488,15 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "CertificateAuthorityData is not base64 encoded",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.TLS.CertificateAuthorityData = "this-is-not-base64-encoded"
 			})},
 			inputSecrets:       []runtime.Object{validBindUserSecret("")},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -514,15 +514,15 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "CertificateAuthorityData is not valid pem data",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.TLS.CertificateAuthorityData = base64.StdEncoding.EncodeToString([]byte("this is not pem data"))
 			})},
 			inputSecrets:       []runtime.Object{validBindUserSecret("")},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -540,7 +540,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "nil TLS configuration is valid",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.TLS = nil
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -578,9 +578,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -609,7 +609,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "sAMAccountName explicitly provided as group name attribute does not add an override",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.TLS = nil
 				upstream.Spec.GroupSearch.Attributes.GroupName = "sAMAccountName"
 			})},
@@ -648,9 +648,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -679,7 +679,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when TLS connection fails it tries to use StartTLS instead: without a specified port it automatically switches ports",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.Host = "ldap.example.com" // when the port is not specified, automatically switch ports for StartTLS
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -721,9 +721,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -761,7 +761,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when TLS connection fails it tries to use StartTLS instead: with a specified port it does not automatically switch ports",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.Host = "ldap.example.com:5678" // when the port is specified, do not automatically switch ports for StartTLS
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -802,9 +802,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				},
 			},
 			wantErr: controllerlib.ErrSyntheticRequeue.Error(),
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -827,7 +827,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "non-nil TLS configuration with empty CertificateAuthorityData is valid",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.TLS.CertificateAuthorityData = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -865,9 +865,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -884,7 +884,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "one valid upstream and one invalid upstream updates the cache to include only the valid upstream",
-			inputUpstreams: []runtime.Object{validUpstream, editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{validUpstream, editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Name = "other-upstream"
 				upstream.Generation = 42
 				upstream.Spec.Bind.SecretName = "non-existent-secret"
@@ -898,10 +898,10 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 			},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{
 				{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "other-upstream", Generation: 42, UID: "other-uid"},
-					Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+					Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 						Phase: "Error",
 						Conditions: []metav1.Condition{
 							{
@@ -918,7 +918,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				},
 				{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-					Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+					Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 						Phase:      "Ready",
 						Conditions: allConditionsTrue(1234, "4242"),
 					},
@@ -948,9 +948,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 			},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -973,8 +973,8 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when testing the connection to the LDAP server fails, but later querying defaultsearchbase succeeds, then the upstream is still added to the cache anyway (treated like a warning)",
-			// Add to cache but not to validatedSettings so we recheck next time
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			// Add to cache, but not to validatedSettings, so we recheck next time
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.UserSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("")},
@@ -1016,9 +1016,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1041,7 +1041,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when testing the connection to the LDAP server fails, and querying defaultsearchbase fails, then the upstream is not added to the cache",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.UserSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("")},
@@ -1052,9 +1052,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(3)
 			},
 			wantErr: controllerlib.ErrSyntheticRequeue.Error(),
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1077,7 +1077,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was already validated using TLS for the current resource generation and secret version, then do not validate it again and keep using TLS",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					activeDirectoryConnectionValidTrueCondition(1234, "4242"),
@@ -1098,9 +1098,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				// Should not perform a test dial and bind. No mocking here means the test will fail if Bind() or Close() are called.
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -1119,7 +1119,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 			name: "when the validated cache contains LDAP server info but the search base is empty, reload everything",
 			// this is an invalid state that shouldn't happen now, but if it does we should consider the whole
 			// validatedsettings cache invalid.
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					activeDirectoryConnectionValidTrueCondition(1234, "4242"),
@@ -1165,9 +1165,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 						"msDS-User-Account-Control-Computed": validComputedUserAccountControl,
 					}},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1189,7 +1189,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was already validated using TLS, and the search base was found, load TLS and search base info into the cache",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					activeDirectoryConnectionValidTrueCondition(1234, "4242"),
@@ -1238,9 +1238,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1262,7 +1262,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was already validated using StartTLS for the current resource generation and secret version, then do not validate it again and keep using StartTLS",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					activeDirectoryConnectionValidTrueCondition(1234, "4242"),
@@ -1283,9 +1283,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				// Should not perform a test dial and bind. No mocking here means the test will fail if Bind() or Close() are called.
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithStartTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -1302,7 +1302,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was validated for an older resource generation, then try to validate it again",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234 // current generation
 				upstream.Status.Conditions = []metav1.Condition{
 					activeDirectoryConnectionValidTrueCondition(1233, "4242"), // older spec generation!
@@ -1324,9 +1324,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -1343,7 +1343,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection condition failed to update previously, then write the cached condition from the previous connection validation",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234 // current generation
 				upstream.Status.Conditions = []metav1.Condition{
 					activeDirectoryConnectionValidTrueCondition(1234, "4200"), // old version of the condition, as if the previous update of conditions had failed
@@ -1364,9 +1364,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				// Should not perform a test dial and bind. No mocking here means the test will fail if Bind() or Close() are called.
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"), // updated version of the condition using the cached condition value
 				},
@@ -1383,7 +1383,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection validation previously failed for this resource generation, then try to validate it again",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					{
@@ -1403,9 +1403,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -1422,7 +1422,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was already validated for this resource generation but the bind secret has changed, then try to validate it again",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					activeDirectoryConnectionValidTrueCondition(1234, "4241"), // same spec generation, old secret version
@@ -1444,9 +1444,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -1463,11 +1463,11 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the input activedirectoryidentityprovider leaves user attributes blank, provide default values",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.UserSearch.Filter = ""
 				upstream.Spec.GroupSearch.Filter = ""
-				upstream.Spec.GroupSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderGroupSearchAttributes{}
+				upstream.Spec.GroupSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderGroupSearchAttributes{}
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
 			setupMocks: func(conn *mockldapconn.MockConn) {
@@ -1505,9 +1505,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -1524,8 +1524,8 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the input activedirectoryidentityprovider leaves user and group search base blank, query for defaultNamingContext",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.UserSearch.Base = ""
 				upstream.Spec.GroupSearch.Base = ""
 			})},
@@ -1565,9 +1565,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1589,8 +1589,8 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the input activedirectoryidentityprovider leaves user search base blank but provides group search base, query for defaultNamingContext",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.UserSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1629,9 +1629,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1653,8 +1653,8 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the input activedirectoryidentityprovider leaves group search base blank but provides user search base, query for defaultNamingContext",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.GroupSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1693,9 +1693,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1717,8 +1717,8 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the input activedirectoryidentityprovider leaves group search base blank and query for defaultNamingContext fails",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.GroupSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1729,9 +1729,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Search(expectedDefaultNamingContextSearch()).Return(nil, errors.New("some error")).Times(1)
 			},
 			wantErr: controllerlib.ErrSyntheticRequeue.Error(),
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1745,8 +1745,8 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when query for defaultNamingContext returns empty string",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.GroupSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1765,9 +1765,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					}}, nil).Times(1)
 			},
 			wantErr: controllerlib.ErrSyntheticRequeue.Error(),
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1781,8 +1781,8 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when query for defaultNamingContext returns multiple entries",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.GroupSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1807,9 +1807,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					}}, nil).Times(1)
 			},
 			wantErr: controllerlib.ErrSyntheticRequeue.Error(),
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1823,8 +1823,8 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when query for defaultNamingContext returns no entries",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.GroupSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1836,9 +1836,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					Entries: []*ldap.Entry{}}, nil).Times(1)
 			},
 			wantErr: controllerlib.ErrSyntheticRequeue.Error(),
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1852,12 +1852,12 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when search base was previously found but the bind secret has changed",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					searchBaseFoundInRootDSECondition(1234),
 				}
-				upstream.Spec.UserSearch.Attributes = v1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
+				upstream.Spec.UserSearch.Attributes = idpv1alpha1.ActiveDirectoryIdentityProviderUserSearchAttributes{}
 				upstream.Spec.GroupSearch.Base = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1905,9 +1905,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testResourceUID, Generation: 1234},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1929,7 +1929,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "skipping group refresh is valid",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.ActiveDirectoryIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.ActiveDirectoryIdentityProvider) {
 				upstream.Spec.GroupSearch.SkipGroupRefresh = true
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1968,9 +1968,9 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.ActiveDirectoryIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.ActiveDirectoryIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.ActiveDirectoryIdentityProviderStatus{
+				Status: idpv1alpha1.ActiveDirectoryIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -2133,13 +2133,13 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 	}
 }
 
-func normalizeActiveDirectoryUpstreams(upstreams []v1alpha1.ActiveDirectoryIdentityProvider, now metav1.Time) []v1alpha1.ActiveDirectoryIdentityProvider {
-	result := make([]v1alpha1.ActiveDirectoryIdentityProvider, 0, len(upstreams))
+func normalizeActiveDirectoryUpstreams(upstreams []idpv1alpha1.ActiveDirectoryIdentityProvider, now metav1.Time) []idpv1alpha1.ActiveDirectoryIdentityProvider {
+	result := make([]idpv1alpha1.ActiveDirectoryIdentityProvider, 0, len(upstreams))
 	for _, u := range upstreams {
 		normalized := u.DeepCopy()
 
 		// We're only interested in comparing the status, so zero out the spec.
-		normalized.Spec = v1alpha1.ActiveDirectoryIdentityProviderSpec{}
+		normalized.Spec = idpv1alpha1.ActiveDirectoryIdentityProviderSpec{}
 
 		// Round down the LastTransitionTime values to `now` if they were just updated. This makes
 		// it much easier to encode assertions about the expected timestamps.

internal/controller/supervisorconfig/federation_domain_watcher.go

@@ -21,7 +21,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/utils/clock"
 
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	pinnipedsupervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	configinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/config/v1alpha1"
 	idpinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/idp/v1alpha1"
@@ -190,10 +190,10 @@ func (c *federationDomainWatcherController) Sync(ctx controllerlib.Context) erro
 
 func (c *federationDomainWatcherController) processAllFederationDomains(
 	ctx context.Context,
-	federationDomains []*configv1alpha1.FederationDomain,
-) ([]*federationdomainproviders.FederationDomainIssuer, map[*configv1alpha1.FederationDomain][]*metav1.Condition, error) {
+	federationDomains []*supervisorconfigv1alpha1.FederationDomain,
+) ([]*federationdomainproviders.FederationDomainIssuer, map[*supervisorconfigv1alpha1.FederationDomain][]*metav1.Condition, error) {
 	federationDomainIssuers := make([]*federationdomainproviders.FederationDomainIssuer, 0)
-	fdToConditionsMap := map[*configv1alpha1.FederationDomain][]*metav1.Condition{}
+	fdToConditionsMap := map[*supervisorconfigv1alpha1.FederationDomain][]*metav1.Condition{}
 	crossDomainConfigValidator := newCrossFederationDomainConfigValidator(federationDomains)
 
 	for _, federationDomain := range federationDomains {
@@ -222,7 +222,7 @@ func (c *federationDomainWatcherController) processAllFederationDomains(
 
 func (c *federationDomainWatcherController) makeFederationDomainIssuer(
 	ctx context.Context,
-	federationDomain *configv1alpha1.FederationDomain,
+	federationDomain *supervisorconfigv1alpha1.FederationDomain,
 	conditions []*metav1.Condition,
 ) (*federationdomainproviders.FederationDomainIssuer, []*metav1.Condition, error) {
 	var err error
@@ -246,7 +246,7 @@ func (c *federationDomainWatcherController) makeFederationDomainIssuer(
 }
 
 func (c *federationDomainWatcherController) makeLegacyFederationDomainIssuer(
-	federationDomain *configv1alpha1.FederationDomain,
+	federationDomain *supervisorconfigv1alpha1.FederationDomain,
 	conditions []*metav1.Condition,
 ) (*federationdomainproviders.FederationDomainIssuer, []*metav1.Condition, error) {
 	var defaultFederationDomainIdentityProvider *federationdomainproviders.FederationDomainIdentityProvider
@@ -337,7 +337,7 @@ func (c *federationDomainWatcherController) makeLegacyFederationDomainIssuer(
 //nolint:funlen
 func (c *federationDomainWatcherController) makeFederationDomainIssuerWithExplicitIDPs(
 	ctx context.Context,
-	federationDomain *configv1alpha1.FederationDomain,
+	federationDomain *supervisorconfigv1alpha1.FederationDomain,
 	conditions []*metav1.Condition,
 ) (*federationdomainproviders.FederationDomainIssuer, []*metav1.Condition, error) {
 	federationDomainIdentityProviders := []*federationdomainproviders.FederationDomainIdentityProvider{}
@@ -464,7 +464,7 @@ func (c *federationDomainWatcherController) findIDPsUIDByObjectRef(objectRef cor
 
 func (c *federationDomainWatcherController) makeTransformationPipelineAndEvaluateExamplesForIdentityProvider(
 	ctx context.Context,
-	idp configv1alpha1.FederationDomainIdentityProvider,
+	idp supervisorconfigv1alpha1.FederationDomainIdentityProvider,
 	idpIndex int,
 	validationErrorMessages *transformsValidationErrorMessages,
 ) (*idtransform.TransformationPipeline, bool, error) {
@@ -490,7 +490,7 @@ func (c *federationDomainWatcherController) makeTransformationPipelineAndEvaluat
 }
 
 func (c *federationDomainWatcherController) makeTransformsConstantsForIdentityProvider(
-	idp configv1alpha1.FederationDomainIdentityProvider,
+	idp supervisorconfigv1alpha1.FederationDomainIdentityProvider,
 ) (*celtransformer.TransformationConstants, error) {
 	consts := &celtransformer.TransformationConstants{
 		StringConstants:     map[string]string{},
@@ -518,7 +518,7 @@ func (c *federationDomainWatcherController) makeTransformsConstantsForIdentityPr
 }
 
 func (c *federationDomainWatcherController) makeTransformationPipelineForIdentityProvider(
-	idp configv1alpha1.FederationDomainIdentityProvider,
+	idp supervisorconfigv1alpha1.FederationDomainIdentityProvider,
 	idpIndex int,
 	consts *celtransformer.TransformationConstants,
 ) (*idtransform.TransformationPipeline, string, error) {
@@ -564,7 +564,7 @@ func (c *federationDomainWatcherController) makeTransformationPipelineForIdentit
 
 func (c *federationDomainWatcherController) evaluateExamplesForIdentityProvider(
 	ctx context.Context,
-	idp configv1alpha1.FederationDomainIdentityProvider,
+	idp supervisorconfigv1alpha1.FederationDomainIdentityProvider,
 	idpIndex int,
 	pipeline *idtransform.TransformationPipeline,
 ) (bool, string) {
@@ -662,7 +662,7 @@ func appendIdentityProviderObjectRefKindCondition(expectedKinds []string, badSuf
 
 func appendIdentityProvidersFoundCondition(
 	idpNotFoundIndices []int,
-	federationDomainIdentityProviders []configv1alpha1.FederationDomainIdentityProvider,
+	federationDomainIdentityProviders []supervisorconfigv1alpha1.FederationDomainIdentityProvider,
 	conditions []*metav1.Condition,
 ) []*metav1.Condition {
 	if len(idpNotFoundIndices) != 0 {
@@ -789,13 +789,13 @@ func appendIssuerURLValidCondition(err error, conditions []*metav1.Condition) []
 
 func (c *federationDomainWatcherController) updateStatus(
 	ctx context.Context,
-	federationDomain *configv1alpha1.FederationDomain,
+	federationDomain *supervisorconfigv1alpha1.FederationDomain,
 	conditions []*metav1.Condition,
 ) error {
 	updated := federationDomain.DeepCopy()
 
 	if conditionsutil.HadErrorCondition(conditions) {
-		updated.Status.Phase = configv1alpha1.FederationDomainPhaseError
+		updated.Status.Phase = supervisorconfigv1alpha1.FederationDomainPhaseError
 		conditions = append(conditions, &metav1.Condition{
 			Type:    typeReady,
 			Status:  metav1.ConditionFalse,
@@ -803,7 +803,7 @@ func (c *federationDomainWatcherController) updateStatus(
 			Message: "the FederationDomain is not ready: see other conditions for details",
 		})
 	} else {
-		updated.Status.Phase = configv1alpha1.FederationDomainPhaseReady
+		updated.Status.Phase = supervisorconfigv1alpha1.FederationDomainPhaseReady
 		conditions = append(conditions, &metav1.Condition{
 			Type:   typeReady,
 			Status: metav1.ConditionTrue,
@@ -858,7 +858,7 @@ func issuerURLToIssuerKey(issuerURL *url.URL) string {
 	return fmt.Sprintf("%s://%s%s", issuerURL.Scheme, strings.ToLower(issuerURL.Host), issuerURL.Path)
 }
 
-func (v *crossFederationDomainConfigValidator) Validate(federationDomain *configv1alpha1.FederationDomain, conditions []*metav1.Condition) []*metav1.Condition {
+func (v *crossFederationDomainConfigValidator) Validate(federationDomain *supervisorconfigv1alpha1.FederationDomain, conditions []*metav1.Condition) []*metav1.Condition {
 	issuerURL, urlParseErr := url.Parse(federationDomain.Spec.Issuer)
 
 	if urlParseErr != nil {
@@ -913,7 +913,7 @@ func (v *crossFederationDomainConfigValidator) Validate(federationDomain *config
 	return conditions
 }
 
-func newCrossFederationDomainConfigValidator(federationDomains []*configv1alpha1.FederationDomain) *crossFederationDomainConfigValidator {
+func newCrossFederationDomainConfigValidator(federationDomains []*supervisorconfigv1alpha1.FederationDomain) *crossFederationDomainConfigValidator {
 	// Make a map of issuer strings -> count of how many times we saw that issuer string.
 	// This will help us complain when there are duplicate issuer strings.
 	// Also make a helper function for forming keys into this map.

internal/controller/supervisorconfig/generator/federation_domain_secrets.go

@@ -16,7 +16,7 @@ import (
 	"k8s.io/client-go/util/retry"
 	"k8s.io/klog/v2"
 
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	pinnipedsupervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	configinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/config/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
@@ -26,7 +26,7 @@ import (
 
 type federationDomainSecretsController struct {
 	secretHelper             SecretHelper
-	secretRefFunc            func(domain *configv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference
+	secretRefFunc            func(domain *supervisorconfigv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference
 	kubeClient               kubernetes.Interface
 	pinnipedClient           pinnipedsupervisorclientset.Interface
 	federationDomainInformer configinformers.FederationDomainInformer
@@ -38,7 +38,7 @@ type federationDomainSecretsController struct {
 // provides the parent/child mapping logic.
 func NewFederationDomainSecretsController(
 	secretHelper SecretHelper,
-	secretRefFunc func(domain *configv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference,
+	secretRefFunc func(domain *supervisorconfigv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference,
 	kubeClient kubernetes.Interface,
 	pinnipedClient pinnipedsupervisorclientset.Interface,
 	secretInformer corev1informers.SecretInformer,
@@ -144,7 +144,7 @@ func (c *federationDomainSecretsController) Sync(ctx controllerlib.Context) erro
 // secretNeedsUpdate returns whether or not the Secret, with name secretName, for the federationDomain param
 // needs to be updated. It returns the existing secret as its second argument.
 func (c *federationDomainSecretsController) secretNeedsUpdate(
-	federationDomain *configv1alpha1.FederationDomain,
+	federationDomain *supervisorconfigv1alpha1.FederationDomain,
 	secretName string,
 ) (bool, *corev1.Secret, error) {
 	// This FederationDomain says it has a secret associated with it. Let's try to get it from the cache.
@@ -168,7 +168,7 @@ func (c *federationDomainSecretsController) secretNeedsUpdate(
 
 func (c *federationDomainSecretsController) createOrUpdateSecret(
 	ctx context.Context,
-	federationDomain *configv1alpha1.FederationDomain,
+	federationDomain *supervisorconfigv1alpha1.FederationDomain,
 	newSecret **corev1.Secret,
 ) error {
 	secretClient := c.kubeClient.CoreV1().Secrets((*newSecret).Namespace)
@@ -207,7 +207,7 @@ func (c *federationDomainSecretsController) createOrUpdateSecret(
 
 func (c *federationDomainSecretsController) updateFederationDomainStatus(
 	ctx context.Context,
-	newFederationDomain *configv1alpha1.FederationDomain,
+	newFederationDomain *supervisorconfigv1alpha1.FederationDomain,
 ) error {
 	federationDomainClient := c.pinnipedClient.ConfigV1alpha1().FederationDomains(newFederationDomain.Namespace)
 	return retry.RetryOnConflict(retry.DefaultRetry, func() error {

internal/controller/supervisorconfig/generator/federation_domain_secrets_test.go

@@ -22,7 +22,7 @@ import (
 	kubernetesfake "k8s.io/client-go/kubernetes/fake"
 	kubetesting "k8s.io/client-go/testing"
 
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/controllerlib"
@@ -72,7 +72,7 @@ func TestFederationDomainControllerFilterSecret(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Name:       "some-name",
 							Controller: boolPtr(true),
 						},
@@ -88,7 +88,7 @@ func TestFederationDomainControllerFilterSecret(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Kind:       "FederationDomain",
 							Name:       "some-name",
 						},
@@ -104,7 +104,7 @@ func TestFederationDomainControllerFilterSecret(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Kind:       "FederationDomain",
 							Name:       "some-name",
 							Controller: boolPtr(true),
@@ -128,7 +128,7 @@ func TestFederationDomainControllerFilterSecret(t *testing.T) {
 							Kind: "UnrelatedKind",
 						},
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Kind:       "FederationDomain",
 							Name:       "some-name",
 							Controller: boolPtr(true),
@@ -149,7 +149,7 @@ func TestFederationDomainControllerFilterSecret(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Kind:       "FederationDomain",
 							Name:       "some-name",
 							Controller: boolPtr(true),
@@ -214,7 +214,7 @@ func TestNewFederationDomainSecretsControllerFilterFederationDomain(t *testing.T
 
 	tests := []struct {
 		name             string
-		federationDomain configv1alpha1.FederationDomain
+		federationDomain supervisorconfigv1alpha1.FederationDomain
 		wantAdd          bool
 		wantUpdate       bool
 		wantDelete       bool
@@ -222,7 +222,7 @@ func TestNewFederationDomainSecretsControllerFilterFederationDomain(t *testing.T
 	}{
 		{
 			name:             "anything goes",
-			federationDomain: configv1alpha1.FederationDomain{},
+			federationDomain: supervisorconfigv1alpha1.FederationDomain{},
 			wantAdd:          true,
 			wantUpdate:       true,
 			wantDelete:       true,
@@ -260,7 +260,7 @@ func TestNewFederationDomainSecretsControllerFilterFederationDomain(t *testing.T
 				withInformer.WithInformer,
 			)
 
-			unrelated := configv1alpha1.FederationDomain{}
+			unrelated := supervisorconfigv1alpha1.FederationDomain{}
 			filter := withInformer.GetFilterForInformer(federationDomainInformer)
 			require.Equal(t, test.wantAdd, filter.Add(test.federationDomain.DeepCopy()))
 			require.Equal(t, test.wantUpdate, filter.Update(&unrelated, test.federationDomain.DeepCopy()))
@@ -285,8 +285,8 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 	)
 
 	federationDomainGVR := schema.GroupVersionResource{
-		Group:    configv1alpha1.SchemeGroupVersion.Group,
-		Version:  configv1alpha1.SchemeGroupVersion.Version,
+		Group:    supervisorconfigv1alpha1.SchemeGroupVersion.Group,
+		Version:  supervisorconfigv1alpha1.SchemeGroupVersion.Version,
 		Resource: "federationdomains",
 	}
 
@@ -296,7 +296,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		Resource: "secrets",
 	}
 
-	goodFederationDomain := &configv1alpha1.FederationDomain{
+	goodFederationDomain := &supervisorconfigv1alpha1.FederationDomain{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      federationDomainName,
 			Namespace: namespace,
@@ -359,7 +359,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 
 	tests := []struct {
 		name                        string
-		storage                     func(**configv1alpha1.FederationDomain, **corev1.Secret)
+		storage                     func(**supervisorconfigv1alpha1.FederationDomain, **corev1.Secret)
 		client                      func(*pinnipedfake.Clientset, *kubernetesfake.Clientset)
 		secretHelper                func(*mocksecrethelper.MockSecretHelper)
 		wantFederationDomainActions []kubetesting.Action
@@ -368,20 +368,20 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 	}{
 		{
 			name: "FederationDomain does not exist and secret does not exist",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*federationDomain = nil
 				*s = nil
 			},
 		},
 		{
 			name: "FederationDomain does not exist and secret exists",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*federationDomain = nil
 			},
 		},
 		{
 			name: "FederationDomain exists and secret does not exist",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*s = nil
 			},
 			secretHelper: func(secretHelper *mocksecrethelper.MockSecretHelper) {
@@ -399,7 +399,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		},
 		{
 			name: "FederationDomain exists and secret does not exist and upon updating FederationDomain we learn a new status field has been set",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*s = nil
 			},
 			secretHelper: func(secretHelper *mocksecrethelper.MockSecretHelper) {
@@ -422,7 +422,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		},
 		{
 			name: "FederationDomain exists and secret does not exist and upon updating FederationDomain we learn all status fields have been set",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*s = nil
 			},
 			secretHelper: func(secretHelper *mocksecrethelper.MockSecretHelper) {
@@ -444,7 +444,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		},
 		{
 			name: "FederationDomain exists and invalid secret exists",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*s = invalidSecret.DeepCopy()
 			},
 			secretHelper: func(secretHelper *mocksecrethelper.MockSecretHelper) {
@@ -505,7 +505,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		},
 		{
 			name: "FederationDomain exists and secret does not exist and creating secret fails",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*s = nil
 			},
 			secretHelper: func(secretHelper *mocksecrethelper.MockSecretHelper) {
@@ -541,7 +541,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		},
 		{
 			name: "FederationDomain exists and invalid secret exists and updating secret fails due to conflict",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*s = invalidSecret.DeepCopy()
 			},
 			secretHelper: func(secretHelper *mocksecrethelper.MockSecretHelper) {
@@ -570,7 +570,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		},
 		{
 			name: "FederationDomain exists and invalid secret exists and getting FederationDomain fails",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*s = invalidSecret.DeepCopy()
 			},
 			secretHelper: func(secretHelper *mocksecrethelper.MockSecretHelper) {
@@ -594,7 +594,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		},
 		{
 			name: "FederationDomain exists and invalid secret exists and updating FederationDomain fails due to conflict",
-			storage: func(federationDomain **configv1alpha1.FederationDomain, s **corev1.Secret) {
+			storage: func(federationDomain **supervisorconfigv1alpha1.FederationDomain, s **corev1.Secret) {
 				*s = invalidSecret.DeepCopy()
 			},
 			secretHelper: func(secretHelper *mocksecrethelper.MockSecretHelper) {
@@ -673,7 +673,7 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 
 			c := NewFederationDomainSecretsController(
 				secretHelper,
-				func(fd *configv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference {
+				func(fd *supervisorconfigv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference {
 					return &fd.Secrets.TokenSigningKey
 				},
 				kubeAPIClient,

internal/controller/supervisorconfig/generator/secret_helper.go

@@ -11,7 +11,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 )
 
 // SecretHelper describes an object that can Generate() a Secret and determine whether a Secret
@@ -20,9 +20,9 @@ import (
 // A SecretHelper has a NamePrefix() that can be used to identify it from other SecretHelper instances.
 type SecretHelper interface {
 	NamePrefix() string
-	Generate(*configv1alpha1.FederationDomain) (*corev1.Secret, error)
-	IsValid(*configv1alpha1.FederationDomain, *corev1.Secret) bool
-	ObserveActiveSecretAndUpdateParentFederationDomain(*configv1alpha1.FederationDomain, *corev1.Secret) *configv1alpha1.FederationDomain
+	Generate(*supervisorconfigv1alpha1.FederationDomain) (*corev1.Secret, error)
+	IsValid(*supervisorconfigv1alpha1.FederationDomain, *corev1.Secret) bool
+	ObserveActiveSecretAndUpdateParentFederationDomain(*supervisorconfigv1alpha1.FederationDomain, *corev1.Secret) *supervisorconfigv1alpha1.FederationDomain
 	Handles(metav1.Object) bool
 }
 
@@ -89,7 +89,7 @@ type symmetricSecretHelper struct {
 func (s *symmetricSecretHelper) NamePrefix() string { return s.namePrefix }
 
 // Generate implements SecretHelper.Generate().
-func (s *symmetricSecretHelper) Generate(parent *configv1alpha1.FederationDomain) (*corev1.Secret, error) {
+func (s *symmetricSecretHelper) Generate(parent *supervisorconfigv1alpha1.FederationDomain) (*corev1.Secret, error) {
 	key := make([]byte, symmetricKeySize)
 	if _, err := s.rand.Read(key); err != nil {
 		return nil, err
@@ -102,8 +102,8 @@ func (s *symmetricSecretHelper) Generate(parent *configv1alpha1.FederationDomain
 			Labels:    s.labels,
 			OwnerReferences: []metav1.OwnerReference{
 				*metav1.NewControllerRef(parent, schema.GroupVersionKind{
-					Group:   configv1alpha1.SchemeGroupVersion.Group,
-					Version: configv1alpha1.SchemeGroupVersion.Version,
+					Group:   supervisorconfigv1alpha1.SchemeGroupVersion.Group,
+					Version: supervisorconfigv1alpha1.SchemeGroupVersion.Version,
 					Kind:    federationDomainKind,
 				}),
 			},
@@ -116,7 +116,7 @@ func (s *symmetricSecretHelper) Generate(parent *configv1alpha1.FederationDomain
 }
 
 // IsValid implements SecretHelper.IsValid().
-func (s *symmetricSecretHelper) IsValid(parent *configv1alpha1.FederationDomain, secret *corev1.Secret) bool {
+func (s *symmetricSecretHelper) IsValid(parent *supervisorconfigv1alpha1.FederationDomain, secret *corev1.Secret) bool {
 	if !metav1.IsControlledBy(secret, parent) {
 		return false
 	}
@@ -138,9 +138,9 @@ func (s *symmetricSecretHelper) IsValid(parent *configv1alpha1.FederationDomain,
 
 // ObserveActiveSecretAndUpdateParentFederationDomain implements SecretHelper.ObserveActiveSecretAndUpdateParentFederationDomain().
 func (s *symmetricSecretHelper) ObserveActiveSecretAndUpdateParentFederationDomain(
-	federationDomain *configv1alpha1.FederationDomain,
+	federationDomain *supervisorconfigv1alpha1.FederationDomain,
 	secret *corev1.Secret,
-) *configv1alpha1.FederationDomain {
+) *supervisorconfigv1alpha1.FederationDomain {
 	s.updateCacheFunc(federationDomain.Spec.Issuer, secret.Data[symmetricSecretDataKey])
 
 	switch s.secretUsage {
@@ -189,6 +189,6 @@ func IsFederationDomainSecretOfType(obj metav1.Object, secretType corev1.SecretT
 func isFederationDomainControllee(obj metav1.Object) bool {
 	controller := metav1.GetControllerOf(obj)
 	return controller != nil &&
-		controller.APIVersion == configv1alpha1.SchemeGroupVersion.String() &&
+		controller.APIVersion == supervisorconfigv1alpha1.SchemeGroupVersion.String() &&
 		controller.Kind == federationDomainKind
 }

internal/controller/supervisorconfig/generator/secret_helper_test.go

@@ -12,7 +12,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 )
 
 const keyWith32Bytes = "0123456789abcdef0123456789abcdef"
@@ -24,13 +24,13 @@ func TestSymmetricSecretHelper(t *testing.T) {
 		name                         string
 		secretUsage                  SecretUsage
 		wantSecretType               corev1.SecretType
-		wantSetFederationDomainField func(*configv1alpha1.FederationDomain) string
+		wantSetFederationDomainField func(*supervisorconfigv1alpha1.FederationDomain) string
 	}{
 		{
 			name:           "token signing key",
 			secretUsage:    SecretUsageTokenSigningKey,
 			wantSecretType: "secrets.pinniped.dev/federation-domain-token-signing-key",
-			wantSetFederationDomainField: func(federationDomain *configv1alpha1.FederationDomain) string {
+			wantSetFederationDomainField: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string {
 				return federationDomain.Status.Secrets.TokenSigningKey.Name
 			},
 		},
@@ -38,7 +38,7 @@ func TestSymmetricSecretHelper(t *testing.T) {
 			name:           "state signing key",
 			secretUsage:    SecretUsageStateSigningKey,
 			wantSecretType: "secrets.pinniped.dev/federation-domain-state-signing-key",
-			wantSetFederationDomainField: func(federationDomain *configv1alpha1.FederationDomain) string {
+			wantSetFederationDomainField: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string {
 				return federationDomain.Status.Secrets.StateSigningKey.Name
 			},
 		},
@@ -46,7 +46,7 @@ func TestSymmetricSecretHelper(t *testing.T) {
 			name:           "state encryption key",
 			secretUsage:    SecretUsageStateEncryptionKey,
 			wantSecretType: "secrets.pinniped.dev/federation-domain-state-encryption-key",
-			wantSetFederationDomainField: func(federationDomain *configv1alpha1.FederationDomain) string {
+			wantSetFederationDomainField: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string {
 				return federationDomain.Status.Secrets.StateEncryptionKey.Name
 			},
 		},
@@ -74,7 +74,7 @@ func TestSymmetricSecretHelper(t *testing.T) {
 				},
 			)
 
-			parent := &configv1alpha1.FederationDomain{
+			parent := &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: metav1.ObjectMeta{
 					UID:       "some-uid",
 					Namespace: "some-namespace",
@@ -89,8 +89,8 @@ func TestSymmetricSecretHelper(t *testing.T) {
 					Labels:    labels,
 					OwnerReferences: []metav1.OwnerReference{
 						*metav1.NewControllerRef(parent, schema.GroupVersionKind{
-							Group:   configv1alpha1.SchemeGroupVersion.Group,
-							Version: configv1alpha1.SchemeGroupVersion.Version,
+							Group:   supervisorconfigv1alpha1.SchemeGroupVersion.Group,
+							Version: supervisorconfigv1alpha1.SchemeGroupVersion.Version,
 							Kind:    "FederationDomain",
 						}),
 					},
@@ -124,7 +124,7 @@ func TestSymmetricSecretHelperIsValid(t *testing.T) {
 		name        string
 		secretUsage SecretUsage
 		child       func(*corev1.Secret)
-		parent      func(*configv1alpha1.FederationDomain)
+		parent      func(*supervisorconfigv1alpha1.FederationDomain)
 		want        bool
 	}{
 		{
@@ -167,7 +167,7 @@ func TestSymmetricSecretHelperIsValid(t *testing.T) {
 			child: func(s *corev1.Secret) {
 				s.Type = FederationDomainTokenSigningKeyType
 			},
-			parent: func(federationDomain *configv1alpha1.FederationDomain) {
+			parent: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) {
 				federationDomain.UID = "wrong"
 			},
 			want: false,
@@ -184,7 +184,7 @@ func TestSymmetricSecretHelperIsValid(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			h := NewSymmetricSecretHelper("none of these args matter", nil, nil, test.secretUsage, nil)
 
-			parent := &configv1alpha1.FederationDomain{
+			parent := &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "some-parent-name",
 					Namespace: "some-namespace",
@@ -197,8 +197,8 @@ func TestSymmetricSecretHelperIsValid(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						*metav1.NewControllerRef(parent, schema.GroupVersionKind{
-							Group:   configv1alpha1.SchemeGroupVersion.Group,
-							Version: configv1alpha1.SchemeGroupVersion.Version,
+							Group:   supervisorconfigv1alpha1.SchemeGroupVersion.Group,
+							Version: supervisorconfigv1alpha1.SchemeGroupVersion.Version,
 							Kind:    "FederationDomain",
 						}),
 					},

internal/controller/supervisorconfig/jwks_observer_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package supervisorconfig
@@ -17,7 +17,7 @@ import (
 	k8sinformers "k8s.io/client-go/informers"
 	kubernetesfake "k8s.io/client-go/kubernetes/fake"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/controllerlib"
@@ -82,13 +82,13 @@ func TestJWKSObserverControllerInformerFilters(t *testing.T) {
 		when("watching FederationDomain objects", func() {
 			var (
 				subject                 controllerlib.Filter
-				provider, otherProvider *v1alpha1.FederationDomain
+				provider, otherProvider *supervisorconfigv1alpha1.FederationDomain
 			)
 
 			it.Before(func() {
 				subject = federationDomainInformerFilter
-				provider = &v1alpha1.FederationDomain{ObjectMeta: metav1.ObjectMeta{Name: "any-name", Namespace: "any-namespace"}}
-				otherProvider = &v1alpha1.FederationDomain{ObjectMeta: metav1.ObjectMeta{Name: "any-other-name", Namespace: "any-other-namespace"}}
+				provider = &supervisorconfigv1alpha1.FederationDomain{ObjectMeta: metav1.ObjectMeta{Name: "any-name", Namespace: "any-namespace"}}
+				otherProvider = &supervisorconfigv1alpha1.FederationDomain{ObjectMeta: metav1.ObjectMeta{Name: "any-other-name", Namespace: "any-other-namespace"}}
 			})
 
 			when("any FederationDomain changes", func() {
@@ -204,78 +204,78 @@ func TestJWKSObserverControllerSync(t *testing.T) {
 			)
 
 			it.Before(func() {
-				federationDomainWithoutSecret1 := &v1alpha1.FederationDomain{
+				federationDomainWithoutSecret1 := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "no-secret-federationdomain1",
 						Namespace: installedInNamespace,
 					},
-					Spec:   v1alpha1.FederationDomainSpec{Issuer: "https://no-secret-issuer1.com"},
-					Status: v1alpha1.FederationDomainStatus{}, // no Secrets.JWKS field
+					Spec:   supervisorconfigv1alpha1.FederationDomainSpec{Issuer: "https://no-secret-issuer1.com"},
+					Status: supervisorconfigv1alpha1.FederationDomainStatus{}, // no Secrets.JWKS field
 				}
-				federationDomainWithoutSecret2 := &v1alpha1.FederationDomain{
+				federationDomainWithoutSecret2 := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "no-secret-federationdomain2",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{Issuer: "https://no-secret-issuer2.com"},
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{Issuer: "https://no-secret-issuer2.com"},
 					// no Status field
 				}
-				federationDomainWithBadSecret := &v1alpha1.FederationDomain{
+				federationDomainWithBadSecret := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "bad-secret-federationdomain",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{Issuer: "https://bad-secret-issuer.com"},
-					Status: v1alpha1.FederationDomainStatus{
-						Secrets: v1alpha1.FederationDomainSecrets{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{Issuer: "https://bad-secret-issuer.com"},
+					Status: supervisorconfigv1alpha1.FederationDomainStatus{
+						Secrets: supervisorconfigv1alpha1.FederationDomainSecrets{
 							JWKS: corev1.LocalObjectReference{Name: "bad-secret-name"},
 						},
 					},
 				}
-				federationDomainWithBadJWKSSecret := &v1alpha1.FederationDomain{
+				federationDomainWithBadJWKSSecret := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "bad-jwks-secret-federationdomain",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{Issuer: "https://bad-jwks-secret-issuer.com"},
-					Status: v1alpha1.FederationDomainStatus{
-						Secrets: v1alpha1.FederationDomainSecrets{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{Issuer: "https://bad-jwks-secret-issuer.com"},
+					Status: supervisorconfigv1alpha1.FederationDomainStatus{
+						Secrets: supervisorconfigv1alpha1.FederationDomainSecrets{
 							JWKS: corev1.LocalObjectReference{Name: "bad-jwks-secret-name"},
 						},
 					},
 				}
-				federationDomainWithBadActiveJWKSecret := &v1alpha1.FederationDomain{
+				federationDomainWithBadActiveJWKSecret := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "bad-active-jwk-secret-federationdomain",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{Issuer: "https://bad-active-jwk-secret-issuer.com"},
-					Status: v1alpha1.FederationDomainStatus{
-						Secrets: v1alpha1.FederationDomainSecrets{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{Issuer: "https://bad-active-jwk-secret-issuer.com"},
+					Status: supervisorconfigv1alpha1.FederationDomainStatus{
+						Secrets: supervisorconfigv1alpha1.FederationDomainSecrets{
 							JWKS: corev1.LocalObjectReference{Name: "bad-active-jwk-secret-name"},
 						},
 					},
 				}
-				federationDomainWithGoodSecret1 := &v1alpha1.FederationDomain{
+				federationDomainWithGoodSecret1 := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "good-secret-federationdomain1",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{Issuer: "https://issuer-with-good-secret1.com"},
-					Status: v1alpha1.FederationDomainStatus{
-						Secrets: v1alpha1.FederationDomainSecrets{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{Issuer: "https://issuer-with-good-secret1.com"},
+					Status: supervisorconfigv1alpha1.FederationDomainStatus{
+						Secrets: supervisorconfigv1alpha1.FederationDomainSecrets{
 							JWKS: corev1.LocalObjectReference{Name: "good-jwks-secret-name1"},
 						},
 					},
 				}
-				federationDomainWithGoodSecret2 := &v1alpha1.FederationDomain{
+				federationDomainWithGoodSecret2 := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "good-secret-federationdomain2",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{Issuer: "https://issuer-with-good-secret2.com"},
-					Status: v1alpha1.FederationDomainStatus{
-						Secrets: v1alpha1.FederationDomainSecrets{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{Issuer: "https://issuer-with-good-secret2.com"},
+					Status: supervisorconfigv1alpha1.FederationDomainStatus{
+						Secrets: supervisorconfigv1alpha1.FederationDomainSecrets{
 							JWKS: corev1.LocalObjectReference{Name: "good-jwks-secret-name2"},
 						},
 					},

internal/controller/supervisorconfig/jwks_writer.go

@@ -22,7 +22,7 @@ import (
 	"k8s.io/client-go/util/retry"
 	"k8s.io/klog/v2"
 
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	pinnipedsupervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	configinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/config/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
@@ -52,7 +52,7 @@ const (
 // generateKey is stubbed out for the purpose of testing. The default behavior is to generate an EC key.
 var generateKey = generateECKey //nolint:gochecknoglobals
 
-func generateECKey(r io.Reader) (interface{}, error) {
+func generateECKey(r io.Reader) (any, error) {
 	return ecdsa.GenerateKey(elliptic.P256(), r)
 }
 
@@ -168,7 +168,7 @@ func (c *jwksWriterController) Sync(ctx controllerlib.Context) error {
 	return nil
 }
 
-func (c *jwksWriterController) secretNeedsUpdate(federationDomain *configv1alpha1.FederationDomain) (bool, error) {
+func (c *jwksWriterController) secretNeedsUpdate(federationDomain *supervisorconfigv1alpha1.FederationDomain) (bool, error) {
 	if federationDomain.Status.Secrets.JWKS.Name == "" {
 		// If the FederationDomain says it doesn't have a secret associated with it, then let's create one.
 		return true, nil
@@ -193,7 +193,7 @@ func (c *jwksWriterController) secretNeedsUpdate(federationDomain *configv1alpha
 	return false, nil
 }
 
-func (c *jwksWriterController) generateSecret(federationDomain *configv1alpha1.FederationDomain) (*corev1.Secret, error) {
+func (c *jwksWriterController) generateSecret(federationDomain *supervisorconfigv1alpha1.FederationDomain) (*corev1.Secret, error) {
 	// Note! This is where we could potentially add more handling of FederationDomain spec fields which tell us how
 	// this FederationDomain should sign and verify ID tokens (e.g., hardcoded token secret, gRPC
 	// connection to KMS, etc).
@@ -231,8 +231,8 @@ func (c *jwksWriterController) generateSecret(federationDomain *configv1alpha1.F
 			Labels:    c.jwksSecretLabels,
 			OwnerReferences: []metav1.OwnerReference{
 				*metav1.NewControllerRef(federationDomain, schema.GroupVersionKind{
-					Group:   configv1alpha1.SchemeGroupVersion.Group,
-					Version: configv1alpha1.SchemeGroupVersion.Version,
+					Group:   supervisorconfigv1alpha1.SchemeGroupVersion.Group,
+					Version: supervisorconfigv1alpha1.SchemeGroupVersion.Version,
 					Kind:    federationDomainKind,
 				}),
 			},
@@ -284,7 +284,7 @@ func (c *jwksWriterController) createOrUpdateSecret(
 
 func (c *jwksWriterController) updateFederationDomainStatus(
 	ctx context.Context,
-	newFederationDomain *configv1alpha1.FederationDomain,
+	newFederationDomain *supervisorconfigv1alpha1.FederationDomain,
 ) error {
 	federationDomainClient := c.pinnipedClient.ConfigV1alpha1().FederationDomains(newFederationDomain.Namespace)
 	return retry.RetryOnConflict(retry.DefaultRetry, func() error {

internal/controller/supervisorconfig/jwks_writer_test.go

@@ -22,7 +22,7 @@ import (
 	kubernetesfake "k8s.io/client-go/kubernetes/fake"
 	kubetesting "k8s.io/client-go/testing"
 
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/controllerlib"
@@ -71,7 +71,7 @@ func TestJWKSWriterControllerFilterSecret(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Name:       "some-name",
 							Controller: boolPtr(true),
 						},
@@ -87,7 +87,7 @@ func TestJWKSWriterControllerFilterSecret(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Kind:       "FederationDomain",
 							Name:       "some-name",
 						},
@@ -103,7 +103,7 @@ func TestJWKSWriterControllerFilterSecret(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Kind:       "FederationDomain",
 							Name:       "some-name",
 							Controller: boolPtr(true),
@@ -127,7 +127,7 @@ func TestJWKSWriterControllerFilterSecret(t *testing.T) {
 							Kind: "UnrelatedKind",
 						},
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Kind:       "FederationDomain",
 							Name:       "some-name",
 							Controller: boolPtr(true),
@@ -148,7 +148,7 @@ func TestJWKSWriterControllerFilterSecret(t *testing.T) {
 					Namespace: "some-namespace",
 					OwnerReferences: []metav1.OwnerReference{
 						{
-							APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+							APIVersion: supervisorconfigv1alpha1.SchemeGroupVersion.String(),
 							Kind:       "FederationDomain",
 							Name:       "some-name",
 							Controller: boolPtr(true),
@@ -204,7 +204,7 @@ func TestJWKSWriterControllerFilterFederationDomain(t *testing.T) {
 
 	tests := []struct {
 		name             string
-		federationDomain configv1alpha1.FederationDomain
+		federationDomain supervisorconfigv1alpha1.FederationDomain
 		wantAdd          bool
 		wantUpdate       bool
 		wantDelete       bool
@@ -212,7 +212,7 @@ func TestJWKSWriterControllerFilterFederationDomain(t *testing.T) {
 	}{
 		{
 			name:             "anything goes",
-			federationDomain: configv1alpha1.FederationDomain{},
+			federationDomain: supervisorconfigv1alpha1.FederationDomain{},
 			wantAdd:          true,
 			wantUpdate:       true,
 			wantDelete:       true,
@@ -241,7 +241,7 @@ func TestJWKSWriterControllerFilterFederationDomain(t *testing.T) {
 				withInformer.WithInformer,
 			)
 
-			unrelated := configv1alpha1.FederationDomain{}
+			unrelated := supervisorconfigv1alpha1.FederationDomain{}
 			filter := withInformer.GetFilterForInformer(federationDomainInformer)
 			require.Equal(t, test.wantAdd, filter.Add(test.federationDomain.DeepCopy()))
 			require.Equal(t, test.wantUpdate, filter.Update(&unrelated, test.federationDomain.DeepCopy()))
@@ -265,18 +265,18 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 	require.NoError(t, err)
 
 	federationDomainGVR := schema.GroupVersionResource{
-		Group:    configv1alpha1.SchemeGroupVersion.Group,
-		Version:  configv1alpha1.SchemeGroupVersion.Version,
+		Group:    supervisorconfigv1alpha1.SchemeGroupVersion.Group,
+		Version:  supervisorconfigv1alpha1.SchemeGroupVersion.Version,
 		Resource: "federationdomains",
 	}
 
-	goodFederationDomain := &configv1alpha1.FederationDomain{
+	goodFederationDomain := &supervisorconfigv1alpha1.FederationDomain{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "good-federationDomain",
 			Namespace: namespace,
 			UID:       "good-federationDomain-uid",
 		},
-		Spec: configv1alpha1.FederationDomainSpec{
+		Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 			Issuer: "https://some-issuer.com",
 		},
 	}
@@ -332,7 +332,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		secrets                     []*corev1.Secret
 		configKubeClient            func(*kubernetesfake.Clientset)
 		configPinnipedClient        func(*pinnipedfake.Clientset)
-		federationDomains           []*configv1alpha1.FederationDomain
+		federationDomains           []*supervisorconfigv1alpha1.FederationDomain
 		generateKeyErr              error
 		wantGenerateKeyCount        int
 		wantSecretActions           []kubetesting.Action
@@ -342,7 +342,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "new federationDomain with no secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomain,
 			},
 			wantGenerateKeyCount: 1,
@@ -358,7 +358,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "federationDomain without status with existing secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomain,
 			},
 			secrets: []*corev1.Secret{
@@ -376,7 +376,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "existing federationDomain with no secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			wantGenerateKeyCount: 1,
@@ -391,7 +391,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "existing federationDomain with existing secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -406,7 +406,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "missing jwk in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -424,7 +424,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "missing jwks in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -442,7 +442,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "wrong type in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -460,7 +460,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "invalid jwk JSON in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -478,7 +478,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "invalid jwks JSON in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -496,7 +496,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "public jwk in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -514,7 +514,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "private jwks in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -532,7 +532,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "invalid jwk key in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -550,7 +550,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "invalid jwks key in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -568,7 +568,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "missing active jwks in secret",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			secrets: []*corev1.Secret{
@@ -586,7 +586,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "generate key fails",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomainWithStatus,
 			},
 			generateKeyErr: errors.New("some generate error"),
@@ -595,7 +595,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "get secret fails",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomain,
 			},
 			configKubeClient: func(client *kubernetesfake.Clientset) {
@@ -608,7 +608,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "create secret fails",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomain,
 			},
 			configKubeClient: func(client *kubernetesfake.Clientset) {
@@ -621,7 +621,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "update secret fails",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomain,
 			},
 			secrets: []*corev1.Secret{
@@ -637,7 +637,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "get FederationDomain fails",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomain,
 			},
 			configPinnipedClient: func(client *pinnipedfake.Clientset) {
@@ -650,7 +650,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		{
 			name: "update federationDomain fails",
 			key:  controllerlib.Key{Namespace: goodFederationDomain.Namespace, Name: goodFederationDomain.Name},
-			federationDomains: []*configv1alpha1.FederationDomain{
+			federationDomains: []*supervisorconfigv1alpha1.FederationDomain{
 				goodFederationDomain,
 			},
 			configPinnipedClient: func(client *pinnipedfake.Clientset) {
@@ -665,7 +665,7 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			// We shouldn't run this test in parallel since it messes with a global function (generateKey).
 			generateKeyCount := 0
-			generateKey = func(_ io.Reader) (interface{}, error) {
+			generateKey = func(_ io.Reader) (any, error) {
 				generateKeyCount++
 				return goodKey, test.generateKeyErr
 			}

internal/controller/supervisorconfig/ldapupstreamwatcher/ldap_upstream_watcher.go

@@ -13,7 +13,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	corev1informers "k8s.io/client-go/informers/core/v1"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	supervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	idpinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/idp/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
@@ -30,7 +30,7 @@ const (
 )
 
 type ldapUpstreamGenericLDAPImpl struct {
-	ldapIdentityProvider v1alpha1.LDAPIdentityProvider
+	ldapIdentityProvider idpv1alpha1.LDAPIdentityProvider
 }
 
 func (g *ldapUpstreamGenericLDAPImpl) Spec() upstreamwatchers.UpstreamGenericLDAPSpec {
@@ -54,14 +54,14 @@ func (g *ldapUpstreamGenericLDAPImpl) Status() upstreamwatchers.UpstreamGenericL
 }
 
 type ldapUpstreamGenericLDAPSpec struct {
-	ldapIdentityProvider v1alpha1.LDAPIdentityProvider
+	ldapIdentityProvider idpv1alpha1.LDAPIdentityProvider
 }
 
 func (s *ldapUpstreamGenericLDAPSpec) Host() string {
 	return s.ldapIdentityProvider.Spec.Host
 }
 
-func (s *ldapUpstreamGenericLDAPSpec) TLSSpec() *v1alpha1.TLSSpec {
+func (s *ldapUpstreamGenericLDAPSpec) TLSSpec() *idpv1alpha1.TLSSpec {
 	return s.ldapIdentityProvider.Spec.TLS
 }
 
@@ -84,7 +84,7 @@ func (s *ldapUpstreamGenericLDAPSpec) DetectAndSetSearchBase(_ context.Context,
 }
 
 type ldapUpstreamGenericLDAPUserSearch struct {
-	userSearch v1alpha1.LDAPIdentityProviderUserSearch
+	userSearch idpv1alpha1.LDAPIdentityProviderUserSearch
 }
 
 func (u *ldapUpstreamGenericLDAPUserSearch) Base() string {
@@ -104,7 +104,7 @@ func (u *ldapUpstreamGenericLDAPUserSearch) UIDAttribute() string {
 }
 
 type ldapUpstreamGenericLDAPGroupSearch struct {
-	groupSearch v1alpha1.LDAPIdentityProviderGroupSearch
+	groupSearch idpv1alpha1.LDAPIdentityProviderGroupSearch
 }
 
 func (g *ldapUpstreamGenericLDAPGroupSearch) Base() string {
@@ -124,7 +124,7 @@ func (g *ldapUpstreamGenericLDAPGroupSearch) GroupNameAttribute() string {
 }
 
 type ldapUpstreamGenericLDAPStatus struct {
-	ldapIdentityProvider v1alpha1.LDAPIdentityProvider
+	ldapIdentityProvider idpv1alpha1.LDAPIdentityProvider
 }
 
 func (s *ldapUpstreamGenericLDAPStatus) Conditions() []metav1.Condition {
@@ -226,7 +226,7 @@ func (c *ldapWatcherController) Sync(ctx controllerlib.Context) error {
 	return nil
 }
 
-func (c *ldapWatcherController) validateUpstream(ctx context.Context, upstream *v1alpha1.LDAPIdentityProvider) (p upstreamprovider.UpstreamLDAPIdentityProviderI, requeue bool) {
+func (c *ldapWatcherController) validateUpstream(ctx context.Context, upstream *idpv1alpha1.LDAPIdentityProvider) (p upstreamprovider.UpstreamLDAPIdentityProviderI, requeue bool) {
 	spec := upstream.Spec
 
 	config := &upstreamldap.ProviderConfig{
@@ -256,15 +256,15 @@ func (c *ldapWatcherController) validateUpstream(ctx context.Context, upstream *
 	return upstreamwatchers.EvaluateConditions(conditions, config)
 }
 
-func (c *ldapWatcherController) updateStatus(ctx context.Context, upstream *v1alpha1.LDAPIdentityProvider, conditions []*metav1.Condition) {
+func (c *ldapWatcherController) updateStatus(ctx context.Context, upstream *idpv1alpha1.LDAPIdentityProvider, conditions []*metav1.Condition) {
 	log := plog.WithValues("namespace", upstream.Namespace, "name", upstream.Name)
 	updated := upstream.DeepCopy()
 
 	hadErrorCondition := conditionsutil.MergeIDPConditions(conditions, upstream.Generation, &updated.Status.Conditions, log)
 
-	updated.Status.Phase = v1alpha1.LDAPPhaseReady
+	updated.Status.Phase = idpv1alpha1.LDAPPhaseReady
 	if hadErrorCondition {
-		updated.Status.Phase = v1alpha1.LDAPPhaseError
+		updated.Status.Phase = idpv1alpha1.LDAPPhaseError
 	}
 
 	if equality.Semantic.DeepEqual(upstream, updated) {

internal/controller/supervisorconfig/ldapupstreamwatcher/ldap_upstream_watcher_test.go

@@ -21,7 +21,7 @@ import (
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes/fake"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/certauthority"
@@ -105,7 +105,7 @@ func TestLDAPUpstreamWatcherControllerFilterLDAPIdentityProviders(t *testing.T)
 	}{
 		{
 			name: "any LDAPIdentityProvider",
-			idp: &v1alpha1.LDAPIdentityProvider{
+			idp: &idpv1alpha1.LDAPIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Name: "some-name", Namespace: "some-namespace"},
 			},
 			wantAdd:    true,
@@ -175,37 +175,37 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 	testCABundle := testCA.Bundle()
 	testCABundleBase64Encoded := base64.StdEncoding.EncodeToString(testCABundle)
 
-	validUpstream := &v1alpha1.LDAPIdentityProvider{
+	validUpstream := &idpv1alpha1.LDAPIdentityProvider{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:       testName,
 			Namespace:  testNamespace,
 			Generation: 1234,
 			UID:        testResourceUID,
 		},
-		Spec: v1alpha1.LDAPIdentityProviderSpec{
+		Spec: idpv1alpha1.LDAPIdentityProviderSpec{
 			Host: testHost,
-			TLS:  &v1alpha1.TLSSpec{CertificateAuthorityData: testCABundleBase64Encoded},
-			Bind: v1alpha1.LDAPIdentityProviderBind{SecretName: testBindSecretName},
-			UserSearch: v1alpha1.LDAPIdentityProviderUserSearch{
+			TLS:  &idpv1alpha1.TLSSpec{CertificateAuthorityData: testCABundleBase64Encoded},
+			Bind: idpv1alpha1.LDAPIdentityProviderBind{SecretName: testBindSecretName},
+			UserSearch: idpv1alpha1.LDAPIdentityProviderUserSearch{
 				Base:   testUserSearchBase,
 				Filter: testUserSearchFilter,
-				Attributes: v1alpha1.LDAPIdentityProviderUserSearchAttributes{
+				Attributes: idpv1alpha1.LDAPIdentityProviderUserSearchAttributes{
 					Username: testUserSearchUsernameAttrName,
 					UID:      testUserSearchUIDAttrName,
 				},
 			},
-			GroupSearch: v1alpha1.LDAPIdentityProviderGroupSearch{
+			GroupSearch: idpv1alpha1.LDAPIdentityProviderGroupSearch{
 				Base:                   testGroupSearchBase,
 				Filter:                 testGroupSearchFilter,
 				UserAttributeForFilter: testGroupSearchUserAttributeForFilter,
-				Attributes: v1alpha1.LDAPIdentityProviderGroupSearchAttributes{
+				Attributes: idpv1alpha1.LDAPIdentityProviderGroupSearchAttributes{
 					GroupName: testGroupSearchNameAttrName,
 				},
 				SkipGroupRefresh: false,
 			},
 		},
 	}
-	editedValidUpstream := func(editFunc func(*v1alpha1.LDAPIdentityProvider)) *v1alpha1.LDAPIdentityProvider {
+	editedValidUpstream := func(editFunc func(*idpv1alpha1.LDAPIdentityProvider)) *idpv1alpha1.LDAPIdentityProvider {
 		deepCopy := validUpstream.DeepCopy()
 		editFunc(deepCopy)
 		return deepCopy
@@ -303,7 +303,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		dialErrors               map[string]error
 		wantErr                  string
 		wantResultingCache       []*upstreamldap.ProviderConfig
-		wantResultingUpstreams   []v1alpha1.LDAPIdentityProvider
+		wantResultingUpstreams   []idpv1alpha1.LDAPIdentityProvider
 		wantValidatedSettings    map[string]upstreamwatchers.ValidatedSettings
 	}{
 		{
@@ -320,9 +320,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -342,9 +342,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 			inputSecrets:       []runtime.Object{},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						{
@@ -370,9 +370,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 			}},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						{
@@ -397,9 +397,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 			}},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						{
@@ -417,15 +417,15 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "CertificateAuthorityData is not base64 encoded",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Spec.TLS.CertificateAuthorityData = "this-is-not-base64-encoded"
 			})},
 			inputSecrets:       []runtime.Object{validBindUserSecret("")},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -443,15 +443,15 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "CertificateAuthorityData is not valid pem data",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Spec.TLS.CertificateAuthorityData = base64.StdEncoding.EncodeToString([]byte("this is not pem data"))
 			})},
 			inputSecrets:       []runtime.Object{validBindUserSecret("")},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -469,7 +469,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "nil TLS configuration is valid",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Spec.TLS = nil
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -501,9 +501,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -530,7 +530,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when TLS connection fails it tries to use StartTLS instead: without a specified port it automatically switches ports",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Spec.Host = "ldap.example.com" // when the port is not specified, automatically switch ports for StartTLS
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -566,9 +566,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -604,7 +604,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when TLS connection fails it tries to use StartTLS instead: with a specified port it does not automatically switch ports",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Spec.Host = "ldap.example.com:5678" // when the port is specified, do not automatically switch ports for StartTLS
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -639,9 +639,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				},
 			},
 			wantErr: controllerlib.ErrSyntheticRequeue.Error(),
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -663,7 +663,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "non-nil TLS configuration with empty CertificateAuthorityData is valid",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Spec.TLS.CertificateAuthorityData = ""
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -695,9 +695,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -713,7 +713,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "one valid upstream and one invalid upstream updates the cache to include only the valid upstream",
-			inputUpstreams: []runtime.Object{validUpstream, editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{validUpstream, editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Name = "other-upstream"
 				upstream.Generation = 42
 				upstream.Spec.Bind.SecretName = "non-existent-secret"
@@ -727,10 +727,10 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 			},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{
 				{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "other-upstream", Generation: 42, UID: "other-uid"},
-					Status: v1alpha1.LDAPIdentityProviderStatus{
+					Status: idpv1alpha1.LDAPIdentityProviderStatus{
 						Phase: "Error",
 						Conditions: []metav1.Condition{
 							{
@@ -747,7 +747,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				},
 				{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-					Status: v1alpha1.LDAPIdentityProviderStatus{
+					Status: idpv1alpha1.LDAPIdentityProviderStatus{
 						Phase:      "Ready",
 						Conditions: allConditionsTrue(1234, "4242"),
 					},
@@ -774,9 +774,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 			},
 			wantErr:            controllerlib.ErrSyntheticRequeue.Error(),
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -798,7 +798,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was already validated using TLS for the current resource generation and secret version, then do not validate it again and keep using TLS",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					ldapConnectionValidTrueCondition(1234, "4242"),
@@ -817,9 +817,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				// Should not perform a test dial and bind. No mocking here means the test will fail if Bind() or Close() are called.
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -835,7 +835,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was already validated using StartTLS for the current resource generation and secret version, then do not validate it again and keep using StartTLS",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					ldapConnectionValidTrueCondition(1234, "4242"),
@@ -854,9 +854,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				// Should not perform a test dial and bind. No mocking here means the test will fail if Bind() or Close() are called.
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithStartTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -872,7 +872,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was validated for an older resource generation, then try to validate it again",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Generation = 1234 // current generation
 				upstream.Status.Conditions = []metav1.Condition{
 					ldapConnectionValidTrueCondition(1233, "4242"), // older spec generation!
@@ -892,9 +892,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -910,7 +910,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection condition failed to update previously, then write the cached condition from the previous connection validation",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Generation = 1234 // current generation
 				upstream.Status.Conditions = []metav1.Condition{
 					ldapConnectionValidTrueCondition(1234, "4200"), // old version of the condition, as if the previous update of conditions had failed
@@ -930,9 +930,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				// Should not perform a test dial and bind. No mocking here means the test will fail if Bind() or Close() are called.
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"), // updated version of the condition using the cached condition value
 				},
@@ -948,7 +948,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection validation previously failed for this resource generation, then try to validate it again",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					{
@@ -968,9 +968,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -987,7 +987,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		{
 			name: "when the validated settings cache is incomplete, then try to validate it again",
 			// this shouldn't happen, but if it does, just throw it out and try again.
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					{
@@ -1011,9 +1011,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -1029,7 +1029,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "when the LDAP server connection was already validated for this resource generation but the bind secret has changed, then try to validate it again",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Generation = 1234
 				upstream.Status.Conditions = []metav1.Condition{
 					ldapConnectionValidTrueCondition(1234, "4241"), // same spec generation, old secret version
@@ -1049,9 +1049,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 				conn.EXPECT().Close().Times(1)
 			},
 			wantResultingCache: []*upstreamldap.ProviderConfig{providerConfigForValidUpstreamWithTLS},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase:      "Ready",
 					Conditions: allConditionsTrue(1234, "4242"),
 				},
@@ -1066,7 +1066,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 			}}},
 		{
 			name: "skipping group refresh is valid",
-			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *v1alpha1.LDAPIdentityProvider) {
+			inputUpstreams: []runtime.Object{editedValidUpstream(func(upstream *idpv1alpha1.LDAPIdentityProvider) {
 				upstream.Spec.GroupSearch.SkipGroupRefresh = true
 			})},
 			inputSecrets: []runtime.Object{validBindUserSecret("4242")},
@@ -1099,9 +1099,9 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 					},
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.LDAPIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.LDAPIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testResourceUID},
-				Status: v1alpha1.LDAPIdentityProviderStatus{
+				Status: idpv1alpha1.LDAPIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						bindSecretValidTrueCondition(1234),
@@ -1226,13 +1226,13 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 	}
 }
 
-func normalizeLDAPUpstreams(upstreams []v1alpha1.LDAPIdentityProvider, now metav1.Time) []v1alpha1.LDAPIdentityProvider {
-	result := make([]v1alpha1.LDAPIdentityProvider, 0, len(upstreams))
+func normalizeLDAPUpstreams(upstreams []idpv1alpha1.LDAPIdentityProvider, now metav1.Time) []idpv1alpha1.LDAPIdentityProvider {
+	result := make([]idpv1alpha1.LDAPIdentityProvider, 0, len(upstreams))
 	for _, u := range upstreams {
 		normalized := u.DeepCopy()
 
 		// We're only interested in comparing the status, so zero out the spec.
-		normalized.Spec = v1alpha1.LDAPIdentityProviderSpec{}
+		normalized.Spec = idpv1alpha1.LDAPIdentityProviderSpec{}
 
 		// Round down the LastTransitionTime values to `now` if they were just updated. This makes
 		// it much easier to encode assertions about the expected timestamps.

internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher.go

@@ -14,7 +14,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	corev1informers "k8s.io/client-go/informers/core/v1"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	supervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	configInformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/config/v1alpha1"
@@ -127,7 +127,7 @@ func (c *oidcClientWatcherController) Sync(ctx controllerlib.Context) error {
 
 func (c *oidcClientWatcherController) updateStatus(
 	ctx context.Context,
-	upstream *v1alpha1.OIDCClient,
+	upstream *supervisorconfigv1alpha1.OIDCClient,
 	conditions []*metav1.Condition,
 	totalClientSecrets int,
 ) error {
@@ -136,9 +136,9 @@ func (c *oidcClientWatcherController) updateStatus(
 	hadErrorCondition := conditionsutil.MergeConfigConditions(conditions,
 		upstream.Generation, &updated.Status.Conditions, plog.New(), metav1.Now())
 
-	updated.Status.Phase = v1alpha1.OIDCClientPhaseReady
+	updated.Status.Phase = supervisorconfigv1alpha1.OIDCClientPhaseReady
 	if hadErrorCondition {
-		updated.Status.Phase = v1alpha1.OIDCClientPhaseError
+		updated.Status.Phase = supervisorconfigv1alpha1.OIDCClientPhaseError
 	}
 
 	updated.Status.TotalClientSecrets = int32(totalClientSecrets)

internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher_test.go

@@ -16,7 +16,7 @@ import (
 	k8sinformers "k8s.io/client-go/informers"
 	kubernetesfake "k8s.io/client-go/kubernetes/fake"
 
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/controllerlib"
@@ -93,14 +93,14 @@ func TestOIDCClientWatcherControllerFilterOIDCClient(t *testing.T) {
 
 	tests := []struct {
 		name       string
-		oidcClient configv1alpha1.OIDCClient
+		oidcClient supervisorconfigv1alpha1.OIDCClient
 		wantAdd    bool
 		wantUpdate bool
 		wantDelete bool
 	}{
 		{
 			name: "name has client.oauth.pinniped.dev- prefix",
-			oidcClient: configv1alpha1.OIDCClient{
+			oidcClient: supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Name: "client.oauth.pinniped.dev-foo"},
 			},
 			wantAdd:    true,
@@ -109,7 +109,7 @@ func TestOIDCClientWatcherControllerFilterOIDCClient(t *testing.T) {
 		},
 		{
 			name: "name does not have client.oauth.pinniped.dev- prefix",
-			oidcClient: configv1alpha1.OIDCClient{
+			oidcClient: supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Name: "something.oauth.pinniped.dev-foo"},
 			},
 			wantAdd:    false,
@@ -118,7 +118,7 @@ func TestOIDCClientWatcherControllerFilterOIDCClient(t *testing.T) {
 		},
 		{
 			name: "other names without any particular pinniped.dev prefixes",
-			oidcClient: configv1alpha1.OIDCClient{
+			oidcClient: supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Name: "something"},
 			},
 			wantAdd:    false,
@@ -147,7 +147,7 @@ func TestOIDCClientWatcherControllerFilterOIDCClient(t *testing.T) {
 				withInformer.WithInformer,
 			)
 
-			unrelated := configv1alpha1.OIDCClient{}
+			unrelated := supervisorconfigv1alpha1.OIDCClient{}
 			filter := withInformer.GetFilterForInformer(oidcClientsInformer)
 			require.Equal(t, tt.wantAdd, filter.Add(&tt.oidcClient))
 			require.Equal(t, tt.wantUpdate, filter.Update(&unrelated, &tt.oidcClient))
@@ -251,7 +251,7 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		inputObjects             []runtime.Object
 		inputSecrets             []runtime.Object
 		wantErr                  string
-		wantResultingOIDCClients []configv1alpha1.OIDCClient
+		wantResultingOIDCClients []supervisorconfigv1alpha1.OIDCClient
 		wantAPIActions           int
 	}{
 		{
@@ -260,37 +260,37 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "OIDCClient with wrong prefix is ignored",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "wrong-prefix-name", Generation: 1234, UID: testUID},
 			}},
 			wantAPIActions: 0, // no updates
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "wrong-prefix-name", Generation: 1234, UID: testUID},
 			}},
 		},
 		{
 			name: "successfully validate minimal OIDCClient and one client secret stored (while ignoring client with wrong prefix)",
 			inputObjects: []runtime.Object{
-				&configv1alpha1.OIDCClient{
+				&supervisorconfigv1alpha1.OIDCClient{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "wrong-prefix-name", Generation: 1234, UID: testUID},
 				},
-				&configv1alpha1.OIDCClient{
+				&supervisorconfigv1alpha1.OIDCClient{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-					Spec: configv1alpha1.OIDCClientSpec{
-						AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-						AllowedScopes:     []configv1alpha1.Scope{"openid"},
+					Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+						AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+						AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 					},
 				},
 			},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{
 				{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "wrong-prefix-name", Generation: 1234, UID: testUID},
 				},
 				{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-					Status: configv1alpha1.OIDCClientStatus{
+					Status: supervisorconfigv1alpha1.OIDCClientStatus{
 						Phase: "Ready",
 						Conditions: []metav1.Condition{
 							happyAllowedGrantTypesCondition(now, 1234),
@@ -304,18 +304,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate minimal OIDCClient and two client secrets stored",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost, testutil.HashedPassword2AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -328,13 +328,13 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "an already validated OIDCClient does not have its conditions updated when everything is still valid",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 				},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(earlier, 1234),
@@ -346,9 +346,9 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 0, // no updates
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(earlier, 1234),
@@ -361,14 +361,14 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "missing required minimum settings and missing client secret storage",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec:       configv1alpha1.OIDCClientSpec{},
+				Spec:       supervisorconfigv1alpha1.OIDCClientSpec{},
 			}},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						sadAllowedGrantTypesCondition(now, 1234, `"authorization_code" must always be included in "allowedGrantTypes"`),
@@ -380,18 +380,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "client secret storage exists but cannot be read",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUIDWithWrongVersion(t, testNamespace, testUID)},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -403,18 +403,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "client secret storage exists but does not contain any client secrets",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -427,11 +427,11 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "client secret storage exists but some of the client secrets are invalid bcrypt hashes",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 				},
 			}},
 			inputSecrets: []runtime.Object{
@@ -439,9 +439,9 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 					[]string{testutil.HashedPassword1AtSupervisorMinCost, testutil.HashedPassword1JustBelowSupervisorMinCost, testutil.HashedPassword1InvalidFormat}),
 			},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -458,24 +458,24 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		{
 			name: "can operate on multiple at a time, e.g. one is valid one another is missing required minimum settings",
 			inputObjects: []runtime.Object{
-				&configv1alpha1.OIDCClient{
+				&supervisorconfigv1alpha1.OIDCClient{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "client.oauth.pinniped.dev-test1", Generation: 1234, UID: "uid1"},
-					Spec: configv1alpha1.OIDCClientSpec{
-						AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-						AllowedScopes:     []configv1alpha1.Scope{"openid"},
+					Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+						AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+						AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 					},
 				},
-				&configv1alpha1.OIDCClient{
+				&supervisorconfigv1alpha1.OIDCClient{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "client.oauth.pinniped.dev-test2", Generation: 4567, UID: "uid2"},
-					Spec:       configv1alpha1.OIDCClientSpec{},
+					Spec:       supervisorconfigv1alpha1.OIDCClientSpec{},
 				},
 			},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, "uid1", []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 2, // one update for each OIDCClient
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{
 				{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "client.oauth.pinniped.dev-test1", Generation: 1234, UID: "uid1"},
-					Status: configv1alpha1.OIDCClientStatus{
+					Status: supervisorconfigv1alpha1.OIDCClientStatus{
 						Phase: "Ready",
 						Conditions: []metav1.Condition{
 							happyAllowedGrantTypesCondition(now, 1234),
@@ -487,7 +487,7 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 				},
 				{
 					ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "client.oauth.pinniped.dev-test2", Generation: 4567, UID: "uid2"},
-					Status: configv1alpha1.OIDCClientStatus{
+					Status: supervisorconfigv1alpha1.OIDCClientStatus{
 						Phase: "Error",
 						Conditions: []metav1.Condition{
 							sadAllowedGrantTypesCondition(now, 4567, `"authorization_code" must always be included in "allowedGrantTypes"`),
@@ -501,14 +501,14 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "a previously invalid OIDCClient has its spec changed to become valid so the conditions are updated",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 4567, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 				},
 				// was invalid on previous run of controller which observed an old generation at an earlier time
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						sadAllowedGrantTypesCondition(earlier, 1234, `"authorization_code" must always be included in "allowedGrantTypes"`),
@@ -520,10 +520,10 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 4567, UID: testUID},
 				// status was updated to reflect the current generation at the current time
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 4567),
@@ -536,18 +536,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "refresh_token must be included in allowedGrantTypes when offline_access is included in allowedScopes",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "offline_access"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "offline_access"},
 				},
 			}},
 			wantAPIActions: 1, // one update
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						sadAllowedGrantTypesCondition(now, 1234, `"refresh_token" must be included in "allowedGrantTypes" when "offline_access" is included in "allowedScopes"`),
@@ -560,18 +560,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "multiple errors on allowedScopes and allowedGrantTypes",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"refresh_token"},
-					AllowedScopes:     []configv1alpha1.Scope{"pinniped:request-audience"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"refresh_token"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"pinniped:request-audience"},
 				},
 			}},
 			wantAPIActions: 1, // one update
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						sadAllowedGrantTypesCondition(now, 1234,
@@ -589,18 +589,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "another combination of multiple errors on allowedScopes and allowedGrantTypes",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"urn:ietf:params:oauth:grant-type:token-exchange"},
-					AllowedScopes:     []configv1alpha1.Scope{"offline_access"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"urn:ietf:params:oauth:grant-type:token-exchange"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"offline_access"},
 				},
 			}},
 			wantAPIActions: 1, // one update
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						sadAllowedGrantTypesCondition(now, 1234,
@@ -617,18 +617,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "urn:ietf:params:oauth:grant-type:token-exchange must be included in allowedGrantTypes when pinniped:request-audience is included in allowedScopes",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "pinniped:request-audience", "username", "groups"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "pinniped:request-audience", "username", "groups"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						sadAllowedGrantTypesCondition(now, 1234, `"urn:ietf:params:oauth:grant-type:token-exchange" must be included in "allowedGrantTypes" when "pinniped:request-audience" is included in "allowedScopes"`),
@@ -641,18 +641,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "offline_access must be included in allowedScopes when refresh_token is included in allowedGrantTypes",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "refresh_token"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -665,18 +665,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "username and groups must also be included in allowedScopes when pinniped:request-audience is included in allowedScopes: both missing",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "pinniped:request-audience"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "pinniped:request-audience"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -689,18 +689,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "username and groups must also be included in allowedScopes when pinniped:request-audience is included in allowedScopes: username missing",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "pinniped:request-audience", "groups"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "pinniped:request-audience", "groups"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -713,18 +713,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "username and groups must also be included in allowedScopes when pinniped:request-audience is included in allowedScopes: groups missing",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "pinniped:request-audience", "username"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "pinniped:request-audience", "username"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -737,18 +737,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "pinniped:request-audience must be included in allowedScopes when urn:ietf:params:oauth:grant-type:token-exchange is included in allowedGrantTypes",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -761,18 +761,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate an OIDCClient with all allowedGrantTypes and all allowedScopes",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -785,18 +785,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate an OIDCClient for offline access without kube API access without username/groups",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "refresh_token"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "offline_access"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "offline_access"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -809,18 +809,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate an OIDCClient for offline access without kube API access with username",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "refresh_token"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "offline_access", "username"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "username"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -833,18 +833,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate an OIDCClient for offline access without kube API access with groups",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "refresh_token"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "offline_access", "groups"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "groups"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -857,18 +857,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate an OIDCClient for offline access without kube API access with both username and groups",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code", "refresh_token"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "offline_access", "username", "groups"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "username", "groups"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -881,18 +881,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate an OIDCClient without offline access without kube API access with username",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "username"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "username"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -905,18 +905,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate an OIDCClient without offline access without kube API access with groups",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "username"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "username"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -929,18 +929,18 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "successfully validate an OIDCClient without offline access without kube API access with both username and groups",
-			inputObjects: []runtime.Object{&configv1alpha1.OIDCClient{
+			inputObjects: []runtime.Object{&supervisorconfigv1alpha1.OIDCClient{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: configv1alpha1.OIDCClientSpec{
-					AllowedGrantTypes: []configv1alpha1.GrantType{"authorization_code"},
-					AllowedScopes:     []configv1alpha1.Scope{"openid", "username", "groups"},
+				Spec: supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedGrantTypes: []supervisorconfigv1alpha1.GrantType{"authorization_code"},
+					AllowedScopes:     []supervisorconfigv1alpha1.Scope{"openid", "username", "groups"},
 				},
 			}},
 			inputSecrets:   []runtime.Object{testutil.OIDCClientSecretStorageSecretForUID(t, testNamespace, testUID, []string{testutil.HashedPassword1AtSupervisorMinCost})},
 			wantAPIActions: 1, // one update
-			wantResultingOIDCClients: []configv1alpha1.OIDCClient{{
+			wantResultingOIDCClients: []supervisorconfigv1alpha1.OIDCClient{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: configv1alpha1.OIDCClientStatus{
+				Status: supervisorconfigv1alpha1.OIDCClientStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAllowedGrantTypesCondition(now, 1234),
@@ -995,13 +995,13 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 	}
 }
 
-func normalizeOIDCClients(oidcClients []configv1alpha1.OIDCClient, now metav1.Time) []configv1alpha1.OIDCClient {
-	result := make([]configv1alpha1.OIDCClient, 0, len(oidcClients))
+func normalizeOIDCClients(oidcClients []supervisorconfigv1alpha1.OIDCClient, now metav1.Time) []supervisorconfigv1alpha1.OIDCClient {
+	result := make([]supervisorconfigv1alpha1.OIDCClient, 0, len(oidcClients))
 	for _, u := range oidcClients {
 		normalized := u.DeepCopy()
 
 		// We're only interested in comparing the status, so zero out the spec.
-		normalized.Spec = configv1alpha1.OIDCClientSpec{}
+		normalized.Spec = supervisorconfigv1alpha1.OIDCClientSpec{}
 
 		// Round down the LastTransitionTime values to `now` if they were just updated. This makes
 		// it much easier to encode assertions about the expected timestamps.

internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher.go

@@ -25,7 +25,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 	corev1informers "k8s.io/client-go/informers/core/v1"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	supervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	idpinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/idp/v1alpha1"
@@ -102,7 +102,7 @@ type lruValidatorCacheEntry struct {
 	client   *http.Client
 }
 
-func (c *lruValidatorCache) getProvider(spec *v1alpha1.OIDCIdentityProviderSpec) (*coreosoidc.Provider, *http.Client) {
+func (c *lruValidatorCache) getProvider(spec *idpv1alpha1.OIDCIdentityProviderSpec) (*coreosoidc.Provider, *http.Client) {
 	if result, ok := c.cache.Get(c.cacheKey(spec)); ok {
 		entry := result.(*lruValidatorCacheEntry)
 		return entry.provider, entry.client
@@ -110,11 +110,11 @@ func (c *lruValidatorCache) getProvider(spec *v1alpha1.OIDCIdentityProviderSpec)
 	return nil, nil
 }
 
-func (c *lruValidatorCache) putProvider(spec *v1alpha1.OIDCIdentityProviderSpec, provider *coreosoidc.Provider, client *http.Client) {
+func (c *lruValidatorCache) putProvider(spec *idpv1alpha1.OIDCIdentityProviderSpec, provider *coreosoidc.Provider, client *http.Client) {
 	c.cache.Set(c.cacheKey(spec), &lruValidatorCacheEntry{provider: provider, client: client}, oidcValidatorCacheTTL)
 }
 
-func (c *lruValidatorCache) cacheKey(spec *v1alpha1.OIDCIdentityProviderSpec) interface{} {
+func (c *lruValidatorCache) cacheKey(spec *idpv1alpha1.OIDCIdentityProviderSpec) any {
 	var key struct{ issuer, caBundle string }
 	key.issuer = spec.Issuer
 	if spec.TLS != nil {
@@ -130,8 +130,8 @@ type oidcWatcherController struct {
 	oidcIdentityProviderInformer idpinformers.OIDCIdentityProviderInformer
 	secretInformer               corev1informers.SecretInformer
 	validatorCache               interface {
-		getProvider(*v1alpha1.OIDCIdentityProviderSpec) (*coreosoidc.Provider, *http.Client)
-		putProvider(*v1alpha1.OIDCIdentityProviderSpec, *coreosoidc.Provider, *http.Client)
+		getProvider(*idpv1alpha1.OIDCIdentityProviderSpec) (*coreosoidc.Provider, *http.Client)
+		putProvider(*idpv1alpha1.OIDCIdentityProviderSpec, *coreosoidc.Provider, *http.Client)
 	}
 }
 
@@ -191,9 +191,9 @@ func (c *oidcWatcherController) Sync(ctx controllerlib.Context) error {
 	return nil
 }
 
-// validateUpstream validates the provided v1alpha1.OIDCIdentityProvider and returns the validated configuration as a
-// provider.UpstreamOIDCIdentityProvider. As a side effect, it also updates the status of the v1alpha1.OIDCIdentityProvider.
-func (c *oidcWatcherController) validateUpstream(ctx controllerlib.Context, upstream *v1alpha1.OIDCIdentityProvider) *upstreamoidc.ProviderConfig {
+// validateUpstream validates the provided idpv1alpha1.OIDCIdentityProvider and returns the validated configuration as a
+// provider.UpstreamOIDCIdentityProvider. As a side effect, it also updates the status of the idpv1alpha1.OIDCIdentityProvider.
+func (c *oidcWatcherController) validateUpstream(ctx controllerlib.Context, upstream *idpv1alpha1.OIDCIdentityProvider) *upstreamoidc.ProviderConfig {
 	authorizationConfig := upstream.Spec.AuthorizationConfig
 
 	additionalAuthcodeAuthorizeParameters := map[string]string{}
@@ -261,7 +261,7 @@ func (c *oidcWatcherController) validateUpstream(ctx controllerlib.Context, upst
 }
 
 // validateSecret validates the .spec.client.secretName field and returns the appropriate ClientCredentialsValid condition.
-func (c *oidcWatcherController) validateSecret(upstream *v1alpha1.OIDCIdentityProvider, result *upstreamoidc.ProviderConfig) *metav1.Condition {
+func (c *oidcWatcherController) validateSecret(upstream *idpv1alpha1.OIDCIdentityProvider, result *upstreamoidc.ProviderConfig) *metav1.Condition {
 	secretName := upstream.Spec.Client.SecretName
 
 	// Fetch the Secret from informer cache.
@@ -309,7 +309,7 @@ func (c *oidcWatcherController) validateSecret(upstream *v1alpha1.OIDCIdentityPr
 }
 
 // validateIssuer validates the .spec.issuer field, performs OIDC discovery, and returns the appropriate OIDCDiscoverySucceeded condition.
-func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *v1alpha1.OIDCIdentityProvider, result *upstreamoidc.ProviderConfig) *metav1.Condition {
+func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *idpv1alpha1.OIDCIdentityProvider, result *upstreamoidc.ProviderConfig) *metav1.Condition {
 	// Get the provider and HTTP Client from cache if possible.
 	discoveredProvider, httpClient := c.validatorCache.getProvider(&upstream.Spec)
 
@@ -408,15 +408,15 @@ func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *v1
 	}
 }
 
-func (c *oidcWatcherController) updateStatus(ctx context.Context, upstream *v1alpha1.OIDCIdentityProvider, conditions []*metav1.Condition) {
+func (c *oidcWatcherController) updateStatus(ctx context.Context, upstream *idpv1alpha1.OIDCIdentityProvider, conditions []*metav1.Condition) {
 	log := c.log.WithValues("namespace", upstream.Namespace, "name", upstream.Name)
 	updated := upstream.DeepCopy()
 
 	hadErrorCondition := conditionsutil.MergeIDPConditions(conditions, upstream.Generation, &updated.Status.Conditions, log)
 
-	updated.Status.Phase = v1alpha1.PhaseReady
+	updated.Status.Phase = idpv1alpha1.PhaseReady
 	if hadErrorCondition {
-		updated.Status.Phase = v1alpha1.PhaseError
+		updated.Status.Phase = idpv1alpha1.PhaseError
 	}
 
 	if equality.Semantic.DeepEqual(upstream, updated) {
@@ -432,7 +432,7 @@ func (c *oidcWatcherController) updateStatus(ctx context.Context, upstream *v1al
 	}
 }
 
-func getClient(upstream *v1alpha1.OIDCIdentityProvider) (*http.Client, error) {
+func getClient(upstream *idpv1alpha1.OIDCIdentityProvider) (*http.Client, error) {
 	if upstream.Spec.TLS == nil || upstream.Spec.TLS.CertificateAuthorityData == "" {
 		return defaultClientShortTimeout(nil), nil
 	}

internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher_test.go

@@ -23,7 +23,7 @@ import (
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes/fake"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/certauthority"
@@ -140,7 +140,7 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		testAdditionalScopes         = []string{"scope1", "scope2", "scope3"}
 		testExpectedScopes           = []string{"openid", "scope1", "scope2", "scope3"}
 		testDefaultExpectedScopes    = []string{"openid", "offline_access", "email", "profile"}
-		testAdditionalParams         = []v1alpha1.Parameter{{Name: "prompt", Value: "consent"}, {Name: "foo", Value: "bar"}}
+		testAdditionalParams         = []idpv1alpha1.Parameter{{Name: "prompt", Value: "consent"}, {Name: "foo", Value: "bar"}}
 		testExpectedAdditionalParams = map[string]string{"prompt": "consent", "foo": "bar"}
 		testClientID                 = "test-oidc-client-id"
 		testClientSecret             = "test-oidc-client-secret"
@@ -156,19 +156,19 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		wantErr                string
 		wantLogs               []string
 		wantResultingCache     []*oidctestutil.TestUpstreamOIDCIdentityProvider
-		wantResultingUpstreams []v1alpha1.OIDCIdentityProvider
+		wantResultingUpstreams []idpv1alpha1.OIDCIdentityProvider
 	}{
 		{
 			name: "no upstreams",
 		},
 		{
 			name: "missing secret",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{},
@@ -180,9 +180,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="secret \"test-client-secret\" not found" "name"="test-name" "namespace"="test-namespace" "reason"="SecretNotFound" "type"="ClientCredentialsValid"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -206,12 +206,12 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "secret has wrong type",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -227,9 +227,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="referenced Secret \"test-client-secret\" has wrong type \"some-other-type\" (should be \"secrets.pinniped.dev/oidc-client\")" "name"="test-name" "namespace"="test-namespace" "reason"="SecretWrongType" "type"="ClientCredentialsValid"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -253,12 +253,12 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "secret is missing key",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -273,9 +273,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="referenced Secret \"test-client-secret\" is missing required keys [\"clientID\" \"clientSecret\"]" "name"="test-name" "namespace"="test-namespace" "reason"="SecretMissingKeys" "type"="ClientCredentialsValid"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -299,14 +299,14 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "TLS CA bundle is invalid base64",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "test-name"},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS: &v1alpha1.TLSSpec{
+					TLS: &idpv1alpha1.TLSSpec{
 						CertificateAuthorityData: "invalid-base64",
 					},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -322,9 +322,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="spec.certificateAuthorityData is invalid: illegal base64 data at input byte 7" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidTLSConfig" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -348,14 +348,14 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "TLS CA bundle does not have any certificates",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "test-name"},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS: &v1alpha1.TLSSpec{
+					TLS: &idpv1alpha1.TLSSpec{
 						CertificateAuthorityData: base64.StdEncoding.EncodeToString([]byte("not-a-pem-ca-bundle")),
 					},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -371,9 +371,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="spec.certificateAuthorityData is invalid: no certificates found" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidTLSConfig" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -397,11 +397,11 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "issuer is invalid URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: "%invalid-url-that-is-really-really-long-nanananananananannanananan-batman-nanananananananananananananana-batman-lalalalalalalalalal-batman-weeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -417,9 +417,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="failed to parse issuer URL: parse \"%invalid-url-that-is-really-really-long-nanananananananannanananan-batman-nanananananananananananananana-batman-lalalalalalalalalal-batman-weeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\": invalid URL escape \"%in\"" "name"="test-name" "namespace"="test-namespace" "reason"="Unreachable" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -443,11 +443,11 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "issuer is insecure http URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: strings.Replace(testIssuerURL, "https", "http", 1),
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -463,9 +463,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="issuer URL '` + strings.Replace(testIssuerURL, "https", "http", 1) + `' must have \"https\" scheme, not \"http\"" "name"="test-name" "namespace"="test-namespace" "reason"="Unreachable" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -489,11 +489,11 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "issuer contains a query param",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "?sub=foo",
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -509,9 +509,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="issuer URL '` + testIssuerURL + "?sub=foo" + `' cannot contain query or fragment component" "name"="test-name" "namespace"="test-namespace" "reason"="Unreachable" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -535,11 +535,11 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "issuer contains a fragment",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "#fragment",
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -555,9 +555,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="issuer URL '` + testIssuerURL + "#fragment" + `' cannot contain query or fragment component" "name"="test-name" "namespace"="test-namespace" "reason"="Unreachable" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -581,12 +581,12 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 		},
 		{
 			name: "really long issuer with invalid CA bundle",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/valid-url-that-is-really-really-long-nanananananananannanananan-batman-nanananananananananananananana-batman-lalalalalalalalalal-batman-weeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: wrongCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: wrongCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -603,9 +603,9 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="failed to perform OIDC discovery against \"` + testIssuerURL + `/valid-url-that-is-really-really-long-nanananananananannanananan-batman-nanananananananananananananana-batman-lalalalalalalalalal-batman-weeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\":\nGet \"` + testIssuerURL + `/valid-url-that-is-really-really-long-nanananananananannanananan-batman-nanananananananananananananana-batman-lalalalalalalalalal-batman-weeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/.well-known/openid-configuration\": tls: failed to verify certificate: x509: certificate signed by unknown authority" "name"="test-name" "namespace"="test-namespace" "reason"="Unreachable" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -630,12 +630,12 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "issuer returns invalid authorize URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/invalid",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -651,9 +651,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="failed to parse authorization endpoint URL: parse \"%\": invalid URL escape \"%\"" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidResponse" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -677,12 +677,12 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "issuer returns invalid revocation URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/invalid-revocation-url",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -698,9 +698,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="failed to parse revocation endpoint URL: parse \"%\": invalid URL escape \"%\"" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidResponse" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -724,12 +724,12 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "issuer returns insecure authorize URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/insecure",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -745,9 +745,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="authorization endpoint URL 'http://example.com/authorize' must have \"https\" scheme, not \"http\"" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidResponse" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -771,12 +771,12 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "issuer returns insecure revocation URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/insecure-revocation-url",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -792,9 +792,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="revocation endpoint URL 'http://example.com/revoke' must have \"https\" scheme, not \"http\"" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidResponse" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -818,12 +818,12 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "issuer returns insecure token URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/insecure-token-url",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -839,9 +839,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="token endpoint URL 'http://example.com/token' must have \"https\" scheme, not \"http\"" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidResponse" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -865,12 +865,12 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "issuer returns no token URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/missing-token-url",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -886,9 +886,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="token endpoint URL '' must have \"https\" scheme, not \"\"" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidResponse" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -912,12 +912,12 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "issuer returns no auth URL",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/missing-auth-url",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -933,9 +933,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="authorization endpoint URL '' must have \"https\" scheme, not \"\"" "name"="test-name" "namespace"="test-namespace" "reason"="InvalidResponse" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -959,19 +959,19 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "upstream with error becomes valid",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: "test-name", UID: testUID},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
-					AuthorizationConfig: v1alpha1.OIDCAuthorizationConfig{
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
+					AuthorizationConfig: idpv1alpha1.OIDCAuthorizationConfig{
 						AdditionalScopes:   append(testAdditionalScopes, "xyz", "openid"), // adds openid unnecessarily
 						AllowPasswordGrant: true,
 					},
-					Claims: v1alpha1.OIDCClaims{Groups: testGroupsClaim, Username: testUsernameClaim},
+					Claims: idpv1alpha1.OIDCClaims{Groups: testGroupsClaim, Username: testUsernameClaim},
 				},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						{Type: "ClientCredentialsValid", Status: "False", LastTransitionTime: earlier, Reason: "SomeError1", Message: "some previous error 1"},
@@ -1004,9 +1004,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 					ResourceUID:              testUID,
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, UID: testUID},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -1018,15 +1018,15 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "existing valid upstream with default authorizationConfig",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
-					Claims: v1alpha1.OIDCClaims{Groups: testGroupsClaim, Username: testUsernameClaim},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
+					Claims: idpv1alpha1.OIDCClaims{Groups: testGroupsClaim, Username: testUsernameClaim},
 				},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidConditionEarlier,
@@ -1060,9 +1060,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 					ResourceUID:              testUID,
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						{Type: "AdditionalAuthorizeParametersValid", Status: "True", LastTransitionTime: earlier, Reason: "Success", Message: "additionalAuthorizeParameters parameter names are allowed", ObservedGeneration: 1234},
@@ -1074,15 +1074,15 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "existing valid upstream with no revocation endpoint in the discovery document",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/valid-without-revocation",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
-					Claims: v1alpha1.OIDCClaims{Groups: testGroupsClaim, Username: testUsernameClaim},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
+					Claims: idpv1alpha1.OIDCClaims{Groups: testGroupsClaim, Username: testUsernameClaim},
 				},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidConditionEarlier,
@@ -1116,9 +1116,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 					ResourceUID:              testUID,
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						{Type: "AdditionalAuthorizeParametersValid", Status: "True", LastTransitionTime: earlier, Reason: "Success", Message: "additionalAuthorizeParameters parameter names are allowed", ObservedGeneration: 1234},
@@ -1130,18 +1130,18 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "existing valid upstream with additionalScopes set to override the default",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
-					Claims: v1alpha1.OIDCClaims{Groups: testGroupsClaim, Username: testUsernameClaim},
-					AuthorizationConfig: v1alpha1.OIDCAuthorizationConfig{
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
+					Claims: idpv1alpha1.OIDCClaims{Groups: testGroupsClaim, Username: testUsernameClaim},
+					AuthorizationConfig: idpv1alpha1.OIDCAuthorizationConfig{
 						AdditionalScopes: testAdditionalScopes,
 					},
 				},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidConditionEarlier,
@@ -1175,9 +1175,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 					ResourceUID:              testUID,
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						{Type: "AdditionalAuthorizeParametersValid", Status: "True", LastTransitionTime: earlier, Reason: "Success", Message: "additionalAuthorizeParameters parameter names are allowed", ObservedGeneration: 1234},
@@ -1189,18 +1189,18 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "existing valid upstream with trailing slash and more optional settings",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/ends-with-slash/",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
-					AuthorizationConfig: v1alpha1.OIDCAuthorizationConfig{
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
+					AuthorizationConfig: idpv1alpha1.OIDCAuthorizationConfig{
 						AdditionalScopes:              testAdditionalScopes,
 						AdditionalAuthorizeParameters: testAdditionalParams,
 						AllowPasswordGrant:            true,
 					},
-					Claims: v1alpha1.OIDCClaims{
+					Claims: idpv1alpha1.OIDCClaims{
 						Groups:   testGroupsClaim,
 						Username: testUsernameClaim,
 						AdditionalClaimMappings: map[string]string{
@@ -1208,7 +1208,7 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 						},
 					},
 				},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidConditionEarlier,
@@ -1244,9 +1244,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 					ResourceUID: testUID,
 				},
 			},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Ready",
 					Conditions: []metav1.Condition{
 						{Type: "AdditionalAuthorizeParametersValid", Status: "True", LastTransitionTime: earlier, Reason: "Success", Message: "additionalAuthorizeParameters parameter names are allowed", ObservedGeneration: 1234},
@@ -1258,14 +1258,14 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "has disallowed additionalAuthorizeParams keys",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL,
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
-					AuthorizationConfig: v1alpha1.OIDCAuthorizationConfig{
-						AdditionalAuthorizeParameters: []v1alpha1.Parameter{
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
+					AuthorizationConfig: idpv1alpha1.OIDCAuthorizationConfig{
+						AdditionalAuthorizeParameters: []idpv1alpha1.Parameter{
 							{Name: "response_type", Value: "foo"},
 							{Name: "scope", Value: "foo"},
 							{Name: "client_id", Value: "foo"},
@@ -1293,9 +1293,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="the following additionalAuthorizeParameters are not allowed: response_type,scope,client_id,state,nonce,code_challenge,code_challenge_method,redirect_uri,hd" "name"="test-name" "namespace"="test-namespace" "reason"="DisallowedParameterName" "type"="AdditionalAuthorizeParametersValid"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName, Generation: 1234, UID: testUID},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						{Type: "AdditionalAuthorizeParametersValid", Status: "False", LastTransitionTime: now, Reason: "DisallowedParameterName",
@@ -1309,12 +1309,12 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 		},
 		{
 			name: "issuer is invalid URL, missing trailing slash when the OIDC discovery endpoint returns the URL with a trailing slash",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/ends-with-slash", // this does not end with slash when it should, thus this is an error case
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -1331,9 +1331,9 @@ Get "` + testIssuerURL + `/valid-url-that-is-really-really-long-nananananananana
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="failed to perform OIDC discovery against \"` + testIssuerURL + `/ends-with-slash\":\noidc: issuer did not match the issuer returned by provider, expected \"` + testIssuerURL + `/ends-with-slash\" got \"` + testIssuerURL + `/ends-with-slash/\"" "name"="test-name" "namespace"="test-namespace" "reason"="Unreachable" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -1358,12 +1358,12 @@ oidc: issuer did not match the issuer returned by provider, expected "` + testIs
 		},
 		{
 			name: "issuer is invalid URL, extra trailing slash",
-			inputUpstreams: []runtime.Object{&v1alpha1.OIDCIdentityProvider{
+			inputUpstreams: []runtime.Object{&idpv1alpha1.OIDCIdentityProvider{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Spec: v1alpha1.OIDCIdentityProviderSpec{
+				Spec: idpv1alpha1.OIDCIdentityProviderSpec{
 					Issuer: testIssuerURL + "/",
-					TLS:    &v1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
-					Client: v1alpha1.OIDCClient{SecretName: testSecretName},
+					TLS:    &idpv1alpha1.TLSSpec{CertificateAuthorityData: testIssuerCABase64},
+					Client: idpv1alpha1.OIDCClient{SecretName: testSecretName},
 				},
 			}},
 			inputSecrets: []runtime.Object{&corev1.Secret{
@@ -1380,9 +1380,9 @@ oidc: issuer did not match the issuer returned by provider, expected "` + testIs
 				`oidc-upstream-observer "msg"="found failing condition" "error"="OIDCIdentityProvider has a failing condition" "message"="failed to perform OIDC discovery against \"` + testIssuerURL + `/\":\noidc: issuer did not match the issuer returned by provider, expected \"` + testIssuerURL + `/\" got \"` + testIssuerURL + `\"" "name"="test-name" "namespace"="test-namespace" "reason"="Unreachable" "type"="OIDCDiscoverySucceeded"`,
 			},
 			wantResultingCache: []*oidctestutil.TestUpstreamOIDCIdentityProvider{},
-			wantResultingUpstreams: []v1alpha1.OIDCIdentityProvider{{
+			wantResultingUpstreams: []idpv1alpha1.OIDCIdentityProvider{{
 				ObjectMeta: metav1.ObjectMeta{Namespace: testNamespace, Name: testName},
-				Status: v1alpha1.OIDCIdentityProviderStatus{
+				Status: idpv1alpha1.OIDCIdentityProviderStatus{
 					Phase: "Error",
 					Conditions: []metav1.Condition{
 						happyAdditionalAuthorizeParametersValidCondition,
@@ -1504,13 +1504,13 @@ func unwrapTransport(t *testing.T, rt http.RoundTripper) *http.Transport {
 	}
 }
 
-func normalizeOIDCUpstreams(upstreams []v1alpha1.OIDCIdentityProvider, now metav1.Time) []v1alpha1.OIDCIdentityProvider {
-	result := make([]v1alpha1.OIDCIdentityProvider, 0, len(upstreams))
+func normalizeOIDCUpstreams(upstreams []idpv1alpha1.OIDCIdentityProvider, now metav1.Time) []idpv1alpha1.OIDCIdentityProvider {
+	result := make([]idpv1alpha1.OIDCIdentityProvider, 0, len(upstreams))
 	for _, u := range upstreams {
 		normalized := u.DeepCopy()
 
 		// We're only interested in comparing the status, so zero out the spec.
-		normalized.Spec = v1alpha1.OIDCIdentityProviderSpec{}
+		normalized.Spec = idpv1alpha1.OIDCIdentityProviderSpec{}
 
 		// Round down the LastTransitionTime values to `now` if they were just updated. This makes
 		// it much easier to encode assertions about the expected timestamps.

internal/controller/supervisorconfig/tls_cert_observer_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package supervisorconfig
@@ -18,7 +18,7 @@ import (
 	k8sinformers "k8s.io/client-go/informers"
 	kubernetesfake "k8s.io/client-go/kubernetes/fake"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	pinnipedfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
 	pinnipedinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/controllerlib"
@@ -83,13 +83,13 @@ func TestTLSCertObserverControllerInformerFilters(t *testing.T) {
 		when("watching FederationDomain objects", func() {
 			var (
 				subject                 controllerlib.Filter
-				provider, otherProvider *v1alpha1.FederationDomain
+				provider, otherProvider *supervisorconfigv1alpha1.FederationDomain
 			)
 
 			it.Before(func() {
 				subject = federationDomainInformerFilter
-				provider = &v1alpha1.FederationDomain{ObjectMeta: metav1.ObjectMeta{Name: "any-name", Namespace: "any-namespace"}}
-				otherProvider = &v1alpha1.FederationDomain{ObjectMeta: metav1.ObjectMeta{Name: "any-other-name", Namespace: "any-other-namespace"}}
+				provider = &supervisorconfigv1alpha1.FederationDomain{ObjectMeta: metav1.ObjectMeta{Name: "any-name", Namespace: "any-namespace"}}
+				otherProvider = &supervisorconfigv1alpha1.FederationDomain{ObjectMeta: metav1.ObjectMeta{Name: "any-other-name", Namespace: "any-other-namespace"}}
 			})
 
 			when("any FederationDomain changes", func() {
@@ -219,75 +219,75 @@ func TestTLSCertObserverControllerSync(t *testing.T) {
 
 			it.Before(func() {
 				var err error
-				federationDomainWithoutSecret1 := &v1alpha1.FederationDomain{
+				federationDomainWithoutSecret1 := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "no-secret-federationdomain1",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{Issuer: "https://no-secret-issuer1.com"}, // no SNICertificateSecretName field
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{Issuer: "https://no-secret-issuer1.com"}, // no SNICertificateSecretName field
 				}
-				federationDomainWithoutSecret2 := &v1alpha1.FederationDomain{
+				federationDomainWithoutSecret2 := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "no-secret-federationdomain2",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 						Issuer: "https://no-secret-issuer2.com",
-						TLS:    &v1alpha1.FederationDomainTLSSpec{SecretName: ""},
+						TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: ""},
 					},
 				}
-				federationDomainWithBadSecret := &v1alpha1.FederationDomain{
+				federationDomainWithBadSecret := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "bad-secret-federationdomain",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 						Issuer: "https://bad-secret-issuer.com",
-						TLS:    &v1alpha1.FederationDomainTLSSpec{SecretName: "bad-tls-secret-name"},
+						TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: "bad-tls-secret-name"},
 					},
 				}
 				// Also add one with a URL that cannot be parsed to make sure that the controller is not confused by invalid URLs.
 				invalidIssuerURL := ":/host//path"
 				_, err = url.Parse(invalidIssuerURL) //nolint:staticcheck // Yes, this URL is intentionally invalid.
 				r.Error(err)
-				federationDomainWithBadIssuer := &v1alpha1.FederationDomain{
+				federationDomainWithBadIssuer := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "bad-issuer-federationdomain",
 						Namespace: installedInNamespace,
 					},
-					Spec: v1alpha1.FederationDomainSpec{Issuer: invalidIssuerURL},
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{Issuer: invalidIssuerURL},
 				}
-				federationDomainWithGoodSecret1 := &v1alpha1.FederationDomain{
+				federationDomainWithGoodSecret1 := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "good-secret-federationdomain1",
 						Namespace: installedInNamespace,
 					},
 					// Issuer hostname should be treated in a case-insensitive way and SNI ignores port numbers. Test without a port number.
-					Spec: v1alpha1.FederationDomainSpec{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 						Issuer: "https://www.iSSuer-wiTh-goOd-secRet1.cOm/path",
-						TLS:    &v1alpha1.FederationDomainTLSSpec{SecretName: "good-tls-secret-name1"},
+						TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: "good-tls-secret-name1"},
 					},
 				}
-				federationDomainWithGoodSecret2 := &v1alpha1.FederationDomain{
+				federationDomainWithGoodSecret2 := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "good-secret-federationdomain2",
 						Namespace: installedInNamespace,
 					},
 					// Issuer hostname should be treated in a case-insensitive way and SNI ignores port numbers. Test with a port number.
-					Spec: v1alpha1.FederationDomainSpec{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 						Issuer: "https://www.issUEr-WIth-gOOd-seCret2.com:1234/path",
-						TLS:    &v1alpha1.FederationDomainTLSSpec{SecretName: "good-tls-secret-name2"},
+						TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: "good-tls-secret-name2"},
 					},
 				}
-				federationDomainWithIPv6Issuer := &v1alpha1.FederationDomain{
+				federationDomainWithIPv6Issuer := &supervisorconfigv1alpha1.FederationDomain{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "ipv6-issuer-federationdomain",
 						Namespace: installedInNamespace,
 					},
 					// Issuer hostname should be treated correctly when it is an IPv6 address. Test with a port number.
-					Spec: v1alpha1.FederationDomainSpec{
+					Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 						Issuer: "https://[2001:db8::1]:1234/path",
-						TLS:    &v1alpha1.FederationDomainTLSSpec{SecretName: "good-tls-secret-name1"},
+						TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: "good-tls-secret-name1"},
 					},
 				}
 				testCrt1 := readTestFile("testdata/test.crt")

internal/controller/supervisorconfig/upstreamwatchers/upstream_watchers.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package upstreamwatchers
@@ -14,7 +14,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	corev1informers "k8s.io/client-go/informers/core/v1"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	"go.pinniped.dev/internal/constable"
 	"go.pinniped.dev/internal/federationdomain/upstreamprovider"
 	"go.pinniped.dev/internal/plog"
@@ -110,7 +110,7 @@ type UpstreamGenericLDAPIDP interface {
 
 type UpstreamGenericLDAPSpec interface {
 	Host() string
-	TLSSpec() *v1alpha1.TLSSpec
+	TLSSpec() *idpv1alpha1.TLSSpec
 	BindSecretName() string
 	UserSearch() UpstreamGenericLDAPUserSearch
 	GroupSearch() UpstreamGenericLDAPGroupSearch
@@ -135,7 +135,7 @@ type UpstreamGenericLDAPStatus interface {
 	Conditions() []metav1.Condition
 }
 
-func ValidateTLSConfig(tlsSpec *v1alpha1.TLSSpec, config *upstreamldap.ProviderConfig) *metav1.Condition {
+func ValidateTLSConfig(tlsSpec *idpv1alpha1.TLSSpec, config *upstreamldap.ProviderConfig) *metav1.Condition {
 	if tlsSpec == nil {
 		return validTLSCondition(noTLSConfigurationMessage)
 	}

internal/controller/supervisorstorage/garbage_collector.go

@@ -278,8 +278,8 @@ func (c *garbageCollectorController) tryRevokeUpstreamOIDCToken(ctx context.Cont
 	return nil
 }
 
-func logKV(secret *corev1.Secret) []interface{} {
-	return []interface{}{
+func logKV(secret *corev1.Secret) []any {
+	return []any{
 		"secretName", secret.Name,
 		"secretNamespace", secret.Namespace,
 		"secretType", string(secret.Type),