Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'

Enforce importas: - go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1 - go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
2026-09-05 23:57:12 +00:00 · 2024-05-21 09:31:15 -05:00
parent bbe10004b4
commit f5116cddb4
98 changed files with 1889 additions and 1869 deletions
@@ -106,9 +106,9 @@ func TestCLIGetKubeconfigStaticToken_Parallel(t *testing.T) {

 type testingT interface {
 	Helper()
-	Errorf(format string, args ...interface{})
+	Errorf(format string, args ...any)
 	FailNow()
-	Logf(format string, args ...interface{})
+	Logf(format string, args ...any)
 }

 func runPinnipedCLI(t testingT, envVars []string, pinnipedExe string, args ...string) (string, string) {
@@ -194,7 +194,7 @@ func TestCLILoginOIDC_Browser(t *testing.T) {
 	require.NotEmpty(t, credOutput.Status.Token)
 	jws, err := jose.ParseSigned(credOutput.Status.Token)
 	require.NoError(t, err)
-	claims := map[string]interface{}{}
+	claims := map[string]any{}
 	require.NoError(t, json.Unmarshal(jws.UnsafePayloadWithoutVerification(), &claims))
 	require.Equal(t, env.CLIUpstreamOIDC.Issuer, claims["iss"])
 	require.Equal(t, env.CLIUpstreamOIDC.ClientID, claims["aud"])
@@ -35,7 +35,7 @@ import (
 	"k8s.io/utils/ptr"

 	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	supervisorclient "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/config/v1alpha1"
 	"go.pinniped.dev/internal/certauthority"
@@ -105,11 +105,11 @@ func TestE2EFullIntegration_Browser(t *testing.T) {

 	// Create the downstream FederationDomain and expect it to go into the success status condition.
 	federationDomain := testlib.CreateTestFederationDomain(topSetupCtx, t,
-		configv1alpha1.FederationDomainSpec{
+		supervisorconfigv1alpha1.FederationDomainSpec{
 			Issuer: issuerURL.String(),
-			TLS:    &configv1alpha1.FederationDomainTLSSpec{SecretName: certSecret.Name},
+			TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: certSecret.Name},
 		},
-		configv1alpha1.FederationDomainPhaseError, // in phase error until there is an IDP created
+		supervisorconfigv1alpha1.FederationDomainPhaseError, // in phase error until there is an IDP created
 	)

 	// Create a JWTAuthenticator that will validate the tokens from the downstream issuer.
@@ -163,7 +163,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 				SecretName: testlib.CreateClientCredsSecret(t, env.SupervisorUpstreamOIDC.ClientID, env.SupervisorUpstreamOIDC.ClientSecret).Name,
 			},
 		}, idpv1alpha1.PhaseReady)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -249,7 +249,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 				SecretName: testlib.CreateClientCredsSecret(t, env.SupervisorUpstreamOIDC.ClientID, env.SupervisorUpstreamOIDC.ClientSecret).Name,
 			},
 		}, idpv1alpha1.PhaseReady)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -337,7 +337,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 				SecretName: testlib.CreateClientCredsSecret(t, env.SupervisorUpstreamOIDC.ClientID, env.SupervisorUpstreamOIDC.ClientSecret).Name,
 			},
 		}, idpv1alpha1.PhaseReady)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -461,7 +461,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 				SecretName: testlib.CreateClientCredsSecret(t, env.SupervisorUpstreamOIDC.ClientID, env.SupervisorUpstreamOIDC.ClientSecret).Name,
 			},
 		}, idpv1alpha1.PhaseReady)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -592,7 +592,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 				SecretName: testlib.CreateClientCredsSecret(t, env.SupervisorUpstreamOIDC.ClientID, env.SupervisorUpstreamOIDC.ClientSecret).Name,
 			},
 		}, idpv1alpha1.PhaseReady)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -665,7 +665,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 				SecretName: testlib.CreateClientCredsSecret(t, env.SupervisorUpstreamOIDC.ClientID, env.SupervisorUpstreamOIDC.ClientSecret).Name,
 			},
 		}, idpv1alpha1.PhaseReady)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -729,7 +729,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		expectedGroups := env.SupervisorUpstreamLDAP.TestUserDirectGroupsDNs

 		createdProvider := setupClusterForEndToEndLDAPTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -788,7 +788,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		expectedGroups := env.SupervisorUpstreamLDAP.TestUserDirectGroupsDNs

 		createdProvider := setupClusterForEndToEndLDAPTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -851,7 +851,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		expectedGroups := env.SupervisorUpstreamLDAP.TestUserDirectGroupsDNs

 		createdProvider := setupClusterForEndToEndLDAPTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -922,7 +922,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		expectedGroups := env.SupervisorUpstreamActiveDirectory.TestUserIndirectGroupsSAMAccountPlusDomainNames

 		createdProvider := setupClusterForEndToEndActiveDirectoryTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -981,7 +981,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		expectedGroups := env.SupervisorUpstreamActiveDirectory.TestUserIndirectGroupsSAMAccountPlusDomainNames

 		createdProvider := setupClusterForEndToEndActiveDirectoryTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -1054,7 +1054,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		expectedGroups := env.SupervisorUpstreamLDAP.TestUserDirectGroupsDNs

 		createdProvider := setupClusterForEndToEndLDAPTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -1109,7 +1109,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		expectedGroups := env.SupervisorUpstreamActiveDirectory.TestUserIndirectGroupsSAMAccountPlusDomainNames

 		createdProvider := setupClusterForEndToEndActiveDirectoryTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -1164,7 +1164,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		expectedGroups := env.SupervisorUpstreamLDAP.TestUserDirectGroupsDNs

 		createdProvider := setupClusterForEndToEndLDAPTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -1241,7 +1241,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		createdLDAPProvider := setupClusterForEndToEndLDAPTest(t, expectedDownstreamLDAPUsername, env)

 		// Having one IDP should put the FederationDomain into a ready state.
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Create a ClusterRoleBinding to give our test user from the upstream read-only access to the cluster.
@@ -1275,7 +1275,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		}, idpv1alpha1.PhaseReady)

 		// Having a second IDP should put the FederationDomain back into an error state until we tell it which one to use.
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseError)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseError)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Update the FederationDomain to use the two IDPs.
@@ -1290,7 +1290,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		ldapIDPDisplayName := "My LDAP IDP 💾"
 		oidcIDPDisplayName := "My OIDC IDP 🚀"

-		gotFederationDomain.Spec.IdentityProviders = []configv1alpha1.FederationDomainIdentityProvider{
+		gotFederationDomain.Spec.IdentityProviders = []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 			{
 				DisplayName: ldapIDPDisplayName,
 				ObjectRef: corev1.TypedLocalObjectReference{
@@ -1298,21 +1298,21 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 					Kind:     "LDAPIdentityProvider",
 					Name:     createdLDAPProvider.Name,
 				},
-				Transforms: configv1alpha1.FederationDomainTransforms{
-					Constants: []configv1alpha1.FederationDomainTransformsConstant{
+				Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+					Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 						{Name: "allowedUser", Type: "string", StringValue: expectedUpstreamLDAPUsername},
 						{Name: "allowedUsers", Type: "stringList", StringListValue: []string{"someone else", expectedUpstreamLDAPUsername, "someone else"}},
 					},
-					Expressions: []configv1alpha1.FederationDomainTransformsExpression{
+					Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 						{Type: "policy/v1", Expression: `username == strConst.allowedUser && username in strListConst.allowedUsers`, Message: "only special users allowed"},
 						{Type: "username/v1", Expression: fmt.Sprintf(`"%s" + username`, downstreamPrefix)},
 						{Type: "groups/v1", Expression: fmt.Sprintf(`groups.map(g, "%s" + g)`, downstreamPrefix)},
 					},
-					Examples: []configv1alpha1.FederationDomainTransformsExample{
+					Examples: []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 						{
 							Username: expectedUpstreamLDAPUsername,
 							Groups:   []string{"a", "b"},
-							Expects: configv1alpha1.FederationDomainTransformsExampleExpects{
+							Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 								Username: expectedDownstreamLDAPUsername,
 								Groups:   []string{downstreamPrefix + "a", downstreamPrefix + "b"},
 							},
@@ -1320,7 +1320,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 						{
 							Username: "someone other user",
 							Groups:   []string{"a", "b"},
-							Expects: configv1alpha1.FederationDomainTransformsExampleExpects{
+							Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 								Rejected: true,
 								Message:  "only special users allowed",
 							},
@@ -1335,21 +1335,21 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 					Kind:     "OIDCIdentityProvider",
 					Name:     createdOIDCProvider.Name,
 				},
-				Transforms: configv1alpha1.FederationDomainTransforms{
-					Constants: []configv1alpha1.FederationDomainTransformsConstant{
+				Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+					Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 						{Name: "allowedUser", Type: "string", StringValue: expectedUpstreamOIDCUsername},
 						{Name: "allowedUsers", Type: "stringList", StringListValue: []string{"someone else", expectedUpstreamOIDCUsername, "someone else"}},
 					},
-					Expressions: []configv1alpha1.FederationDomainTransformsExpression{
+					Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 						{Type: "policy/v1", Expression: `username == strConst.allowedUser && username in strListConst.allowedUsers`, Message: "only special users allowed"},
 						{Type: "username/v1", Expression: fmt.Sprintf(`"%s" + username`, downstreamPrefix)},
 						{Type: "groups/v1", Expression: fmt.Sprintf(`groups.map(g, "%s" + g)`, downstreamPrefix)},
 					},
-					Examples: []configv1alpha1.FederationDomainTransformsExample{
+					Examples: []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 						{
 							Username: expectedUpstreamOIDCUsername,
 							Groups:   []string{"a", "b"},
-							Expects: configv1alpha1.FederationDomainTransformsExampleExpects{
+							Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 								Username: expectedDownstreamOIDCUsername,
 								Groups:   []string{downstreamPrefix + "a", downstreamPrefix + "b"},
 							},
@@ -1357,7 +1357,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 						{
 							Username: "someone other user",
 							Groups:   []string{"a", "b"},
-							Expects: configv1alpha1.FederationDomainTransformsExampleExpects{
+							Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 								Rejected: true,
 								Message:  "only special users allowed",
 							},
@@ -1370,7 +1370,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 		require.NoError(t, err)

 		// The FederationDomain should be valid after the above update.
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -1504,7 +1504,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 			requireEventually.Equal(fd.Generation, fd.Status.Conditions[0].ObservedGeneration)
 		}, 20*time.Second, 250*time.Millisecond)
 		// The FederationDomain should be valid after the above update.
-		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(testCtx, t, federationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(testCtx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Log out so we can try fresh logins again.
@@ -1968,7 +1968,7 @@ func requireUserCanUseKubectlWithoutAuthenticatingAgain(
 	ctx context.Context,
 	t *testing.T,
 	env *testlib.TestEnv,
-	downstream *configv1alpha1.FederationDomain,
+	downstream *supervisorconfigv1alpha1.FederationDomain,
 	upstreamProviderName string,
 	kubeconfigPath string,
 	sessionCachePath string,
@@ -2009,8 +2009,8 @@ func requireUserCanUseKubectlWithoutAuthenticatingAgain(
 	if expectedGroups == nil {
 		require.Nil(t, idTokenClaims["groups"])
 	} else {
-		// The groups claim in the file ends up as an []interface{}, so adjust our expectation to match.
-		expectedGroupsAsEmptyInterfaces := make([]interface{}, 0, len(expectedGroups))
+		// The groups claim in the file ends up as an []any, so adjust our expectation to match.
+		expectedGroupsAsEmptyInterfaces := make([]any, 0, len(expectedGroups))
 		for _, g := range expectedGroups {
 			expectedGroupsAsEmptyInterfaces = append(expectedGroupsAsEmptyInterfaces, g)
 		}
@@ -147,7 +147,7 @@ func (t *fakeT) FailNow() {
 	t.Errorf("fakeT ignored FailNow")
 }

-func (t *fakeT) Errorf(format string, args ...interface{}) {
+func (t *fakeT) Errorf(format string, args ...any) {
 	t.Cleanup(func() {
 		if !t.Failed() {
 			return
@@ -25,7 +25,7 @@ import (
 	"k8s.io/client-go/util/retry"
 	"k8s.io/utils/strings/slices"

-	"go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	supervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	"go.pinniped.dev/internal/certauthority"
@@ -131,15 +131,15 @@ func TestSupervisorOIDCDiscovery_Disruptive(t *testing.T) {

 			// When the same issuer is added twice, both issuers are marked as duplicates, and neither provider is serving.
 			config6Duplicate1, _ := requireCreatingFederationDomainCausesDiscoveryEndpointsToAppear(ctx, t, scheme, addr, caBundle, issuer6, client)
-			config6Duplicate2 := testlib.CreateTestFederationDomain(ctx, t, v1alpha1.FederationDomainSpec{Issuer: issuer6}, v1alpha1.FederationDomainPhaseError)
-			requireStatus(t, client, ns, config6Duplicate1.Name, v1alpha1.FederationDomainPhaseError, withFalseConditions([]string{"Ready", "IssuerIsUnique"}))
-			requireStatus(t, client, ns, config6Duplicate2.Name, v1alpha1.FederationDomainPhaseError, withFalseConditions([]string{"Ready", "IssuerIsUnique"}))
+			config6Duplicate2 := testlib.CreateTestFederationDomain(ctx, t, supervisorconfigv1alpha1.FederationDomainSpec{Issuer: issuer6}, supervisorconfigv1alpha1.FederationDomainPhaseError)
+			requireStatus(t, client, ns, config6Duplicate1.Name, supervisorconfigv1alpha1.FederationDomainPhaseError, withFalseConditions([]string{"Ready", "IssuerIsUnique"}))
+			requireStatus(t, client, ns, config6Duplicate2.Name, supervisorconfigv1alpha1.FederationDomainPhaseError, withFalseConditions([]string{"Ready", "IssuerIsUnique"}))
 			requireDiscoveryEndpointsAreNotFound(t, scheme, addr, caBundle, issuer6)

 			// If we delete the first duplicate issuer, the second duplicate issuer starts serving.
 			requireDelete(t, client, ns, config6Duplicate1.Name)
 			requireWellKnownEndpointIsWorking(t, scheme, addr, caBundle, issuer6, nil)
-			requireStatus(t, client, ns, config6Duplicate2.Name, v1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())
+			requireStatus(t, client, ns, config6Duplicate2.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())

 			// When we finally delete all issuers, the endpoint should be down.
 			requireDeletingFederationDomainCausesDiscoveryEndpointsToDisappear(t, config6Duplicate2, client, ns, scheme, addr, caBundle, issuer6)
@@ -150,8 +150,8 @@ func TestSupervisorOIDCDiscovery_Disruptive(t *testing.T) {
 			requireDeletingFederationDomainCausesDiscoveryEndpointsToDisappear(t, config7, client, ns, scheme, addr, caBundle, issuer7)

 			// When we create a provider with an invalid issuer, the status is set to invalid.
-			badConfig := testlib.CreateTestFederationDomain(ctx, t, v1alpha1.FederationDomainSpec{Issuer: badIssuer}, v1alpha1.FederationDomainPhaseError)
-			requireStatus(t, client, ns, badConfig.Name, v1alpha1.FederationDomainPhaseError, withFalseConditions([]string{"Ready", "IssuerURLValid"}))
+			badConfig := testlib.CreateTestFederationDomain(ctx, t, supervisorconfigv1alpha1.FederationDomainSpec{Issuer: badIssuer}, supervisorconfigv1alpha1.FederationDomainPhaseError)
+			requireStatus(t, client, ns, badConfig.Name, supervisorconfigv1alpha1.FederationDomainPhaseError, withFalseConditions([]string{"Ready", "IssuerURLValid"}))
 			requireDiscoveryEndpointsAreNotFound(t, scheme, addr, caBundle, badIssuer)
 			requireDeletingFederationDomainCausesDiscoveryEndpointsToDisappear(t, badConfig, client, ns, scheme, addr, caBundle, badIssuer)
 		})
@@ -185,11 +185,11 @@ func TestSupervisorTLSTerminationWithSNI_Disruptive(t *testing.T) {

 	// Create an FederationDomain with a spec.tls.secretName.
 	federationDomain1 := testlib.CreateTestFederationDomain(ctx, t,
-		v1alpha1.FederationDomainSpec{
+		supervisorconfigv1alpha1.FederationDomainSpec{
 			Issuer: issuer1,
-			TLS:    &v1alpha1.FederationDomainTLSSpec{SecretName: certSecretName1},
-		}, v1alpha1.FederationDomainPhaseReady)
-	requireStatus(t, pinnipedClient, federationDomain1.Namespace, federationDomain1.Name, v1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())
+			TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: certSecretName1},
+		}, supervisorconfigv1alpha1.FederationDomainPhaseReady)
+	requireStatus(t, pinnipedClient, federationDomain1.Namespace, federationDomain1.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())

 	// The spec.tls.secretName Secret does not exist, so the endpoints should fail with TLS errors.
 	requireEndpointHasBootstrapTLSErrorBecauseCertificatesAreNotReady(t, issuer1)
@@ -207,7 +207,7 @@ func TestSupervisorTLSTerminationWithSNI_Disruptive(t *testing.T) {
 		if err != nil {
 			return err
 		}
-		federationDomain1LatestVersion.Spec.TLS = &v1alpha1.FederationDomainTLSSpec{SecretName: certSecretName1update}
+		federationDomain1LatestVersion.Spec.TLS = &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: certSecretName1update}
 		_, err = pinnipedClient.ConfigV1alpha1().FederationDomains(ns).Update(ctx, federationDomain1LatestVersion, metav1.UpdateOptions{})
 		return err
 	}))
@@ -229,11 +229,11 @@ func TestSupervisorTLSTerminationWithSNI_Disruptive(t *testing.T) {

 	// Create an FederationDomain with a spec.tls.secretName.
 	federationDomain2 := testlib.CreateTestFederationDomain(ctx, t,
-		v1alpha1.FederationDomainSpec{
+		supervisorconfigv1alpha1.FederationDomainSpec{
 			Issuer: issuer2,
-			TLS:    &v1alpha1.FederationDomainTLSSpec{SecretName: certSecretName2},
-		}, v1alpha1.FederationDomainPhaseReady)
-	requireStatus(t, pinnipedClient, federationDomain2.Namespace, federationDomain2.Name, v1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())
+			TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: certSecretName2},
+		}, supervisorconfigv1alpha1.FederationDomainPhaseReady)
+	requireStatus(t, pinnipedClient, federationDomain2.Namespace, federationDomain2.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())

 	// Create the Secret.
 	ca2 := createTLSCertificateSecret(ctx, t, ns, hostname2, nil, certSecretName2, kubeClient)
@@ -282,8 +282,8 @@ func TestSupervisorTLSTerminationWithDefaultCerts_Disruptive(t *testing.T) {
 	issuerUsingHostname := fmt.Sprintf("%s://%s/issuer1", scheme, address)

 	// Create an FederationDomain without a spec.tls.secretName.
-	federationDomain1 := testlib.CreateTestFederationDomain(ctx, t, v1alpha1.FederationDomainSpec{Issuer: issuerUsingIPAddress}, v1alpha1.FederationDomainPhaseReady)
-	requireStatus(t, pinnipedClient, federationDomain1.Namespace, federationDomain1.Name, v1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())
+	federationDomain1 := testlib.CreateTestFederationDomain(ctx, t, supervisorconfigv1alpha1.FederationDomainSpec{Issuer: issuerUsingIPAddress}, supervisorconfigv1alpha1.FederationDomainPhaseReady)
+	requireStatus(t, pinnipedClient, federationDomain1.Namespace, federationDomain1.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())

 	// There is no default TLS cert and the spec.tls.secretName was not set, so the endpoints should fail with TLS errors.
 	requireEndpointHasBootstrapTLSErrorBecauseCertificatesAreNotReady(t, issuerUsingIPAddress)
@@ -297,11 +297,11 @@ func TestSupervisorTLSTerminationWithDefaultCerts_Disruptive(t *testing.T) {
 	// Create an FederationDomain with a spec.tls.secretName.
 	certSecretName := "integration-test-cert-1"
 	federationDomain2 := testlib.CreateTestFederationDomain(ctx, t,
-		v1alpha1.FederationDomainSpec{
+		supervisorconfigv1alpha1.FederationDomainSpec{
 			Issuer: issuerUsingHostname,
-			TLS:    &v1alpha1.FederationDomainTLSSpec{SecretName: certSecretName},
-		}, v1alpha1.FederationDomainPhaseReady)
-	requireStatus(t, pinnipedClient, federationDomain2.Namespace, federationDomain2.Name, v1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())
+			TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: certSecretName},
+		}, supervisorconfigv1alpha1.FederationDomainPhaseReady)
+	requireStatus(t, pinnipedClient, federationDomain2.Namespace, federationDomain2.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())

 	// Create the Secret.
 	certCA := createTLSCertificateSecret(ctx, t, ns, hostname, nil, certSecretName, kubeClient)
@@ -485,11 +485,11 @@ func requireCreatingFederationDomainCausesDiscoveryEndpointsToAppear(
 	supervisorScheme, supervisorAddress, supervisorCABundle string,
 	issuerName string,
 	client supervisorclientset.Interface,
-) (*v1alpha1.FederationDomain, *ExpectedJWKSResponseFormat) {
+) (*supervisorconfigv1alpha1.FederationDomain, *ExpectedJWKSResponseFormat) {
 	t.Helper()
-	newFederationDomain := testlib.CreateTestFederationDomain(ctx, t, v1alpha1.FederationDomainSpec{Issuer: issuerName}, v1alpha1.FederationDomainPhaseReady)
+	newFederationDomain := testlib.CreateTestFederationDomain(ctx, t, supervisorconfigv1alpha1.FederationDomainSpec{Issuer: issuerName}, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 	jwksResult := requireDiscoveryEndpointsAreWorking(t, supervisorScheme, supervisorAddress, supervisorCABundle, issuerName, nil)
-	requireStatus(t, client, newFederationDomain.Namespace, newFederationDomain.Name, v1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())
+	requireStatus(t, client, newFederationDomain.Namespace, newFederationDomain.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady, withAllSuccessfulConditions())
 	return newFederationDomain, jwksResult
 }

@@ -501,7 +501,7 @@ func requireDiscoveryEndpointsAreWorking(t *testing.T, supervisorScheme, supervi

 func requireDeletingFederationDomainCausesDiscoveryEndpointsToDisappear(
 	t *testing.T,
-	existingFederationDomain *v1alpha1.FederationDomain,
+	existingFederationDomain *supervisorconfigv1alpha1.FederationDomain,
 	client supervisorclientset.Interface,
 	ns string,
 	supervisorScheme, supervisorAddress, supervisorCABundle string,
@@ -626,16 +626,16 @@ func requireSuccessEndpointResponse(t *testing.T, endpointURL, issuer, caBundle

 func editFederationDomainIssuerName(
 	t *testing.T,
-	existingFederationDomain *v1alpha1.FederationDomain,
+	existingFederationDomain *supervisorconfigv1alpha1.FederationDomain,
 	client supervisorclientset.Interface,
 	ns string,
 	newIssuerName string,
-) *v1alpha1.FederationDomain {
+) *supervisorconfigv1alpha1.FederationDomain {
 	t.Helper()
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	defer cancel()

-	var updated *v1alpha1.FederationDomain
+	var updated *supervisorconfigv1alpha1.FederationDomain
 	require.NoError(t, retry.RetryOnConflict(retry.DefaultRetry, func() error {
 		mostRecentVersion, err := client.ConfigV1alpha1().FederationDomains(ns).Get(ctx, existingFederationDomain.Name, metav1.GetOptions{})
 		if err != nil {
@@ -684,7 +684,7 @@ func withFalseConditions(falseConditionTypes []string) map[string]metav1.Conditi
 	return c
 }

-func requireStatus(t *testing.T, client supervisorclientset.Interface, ns, name string, wantPhase v1alpha1.FederationDomainPhase, wantConditionTypeToStatus map[string]metav1.ConditionStatus) {
+func requireStatus(t *testing.T, client supervisorclientset.Interface, ns, name string, wantPhase supervisorconfigv1alpha1.FederationDomainPhase, wantConditionTypeToStatus map[string]metav1.ConditionStatus) {
 	t.Helper()

 	testlib.RequireEventually(t, func(requireEventually *require.Assertions) {
@@ -17,7 +17,7 @@ import (
 	"k8s.io/client-go/util/retry"
 	"k8s.io/utils/ptr"

-	"go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	"go.pinniped.dev/internal/here"
 	"go.pinniped.dev/internal/testutil"
@@ -43,9 +43,9 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 			name: "valid spec in without explicit identity providers makes status error unless there is exactly one identity provider",
 			run: func(t *testing.T) {
 				// Creating FederationDomain without any explicit IDPs should put the FederationDomain into an error status.
-				fd := testlib.CreateTestFederationDomain(ctx, t, v1alpha1.FederationDomainSpec{
+				fd := testlib.CreateTestFederationDomain(ctx, t, supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com/fake",
-				}, v1alpha1.FederationDomainPhaseError)
+				}, supervisorconfigv1alpha1.FederationDomainPhaseError)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
 					allSuccessfulLegacyFederationDomainConditions("", fd.Spec),
 					[]metav1.Condition{
@@ -65,7 +65,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					Issuer: "https://example.cluster.local/fake-issuer-url-does-not-matter",
 					Client: idpv1alpha1.OIDCClient{SecretName: "this-will-not-exist-but-does-not-matter"},
 				}, idpv1alpha1.PhaseError)
-				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, v1alpha1.FederationDomainPhaseReady)
+				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name,
 					allSuccessfulLegacyFederationDomainConditions(oidcIdentityProvider1.Name, fd.Spec))

@@ -74,7 +74,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					Issuer: "https://example.cluster.local/fake-issuer-url-does-not-matter",
 					Client: idpv1alpha1.OIDCClient{SecretName: "this-will-not-exist-but-does-not-matter"},
 				}, idpv1alpha1.PhaseError)
-				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, v1alpha1.FederationDomainPhaseError)
+				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseError)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
 					allSuccessfulLegacyFederationDomainConditions(oidcIdentityProvider2.Name, fd.Spec),
 					[]metav1.Condition{
@@ -98,9 +98,9 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 				oidcIDP1Meta := testlib.ObjectMetaWithRandomName(t, "upstream-oidc-idp")
 				oidcIDP2Meta := testlib.ObjectMetaWithRandomName(t, "upstream-oidc-idp")
 				// Creating FederationDomain with explicit IDPs that don't exist should put the FederationDomain into an error status.
-				fd := testlib.CreateTestFederationDomain(ctx, t, v1alpha1.FederationDomainSpec{
+				fd := testlib.CreateTestFederationDomain(ctx, t, supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com/fake",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "idp1",
 							ObjectRef: corev1.TypedLocalObjectReference{
@@ -108,7 +108,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 								Kind:     "OIDCIdentityProvider",
 								Name:     oidcIDP1Meta.Name,
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{},
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{},
 						},
 						{
 							DisplayName: "idp2",
@@ -117,10 +117,10 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 								Kind:     "OIDCIdentityProvider",
 								Name:     oidcIDP2Meta.Name,
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{},
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{},
 						},
 					},
-				}, v1alpha1.FederationDomainPhaseError)
+				}, supervisorconfigv1alpha1.FederationDomainPhaseError)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
 					allSuccessfulFederationDomainConditions(fd.Spec),
 					[]metav1.Condition{
@@ -144,7 +144,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					Issuer: "https://example.cluster.local/fake-issuer-url-does-not-matter",
 					Client: idpv1alpha1.OIDCClient{SecretName: "this-will-not-exist-but-does-not-matter"},
 				}, oidcIDP1Meta, idpv1alpha1.PhaseError)
-				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, v1alpha1.FederationDomainPhaseError)
+				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseError)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
 					allSuccessfulFederationDomainConditions(fd.Spec),
 					[]metav1.Condition{
@@ -164,7 +164,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					Issuer: "https://example.cluster.local/fake-issuer-url-does-not-matter",
 					Client: idpv1alpha1.OIDCClient{SecretName: "this-will-not-exist-but-does-not-matter"},
 				}, oidcIDP2Meta, idpv1alpha1.PhaseError)
-				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, v1alpha1.FederationDomainPhaseReady)
+				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name,
 					allSuccessfulFederationDomainConditions(fd.Spec))

@@ -172,7 +172,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 				oidcIDPClient := supervisorClient.IDPV1alpha1().OIDCIdentityProviders(env.SupervisorNamespace)
 				err := oidcIDPClient.Delete(ctx, oidcIdentityProvider1.Name, metav1.DeleteOptions{})
 				require.NoError(t, err)
-				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, v1alpha1.FederationDomainPhaseError)
+				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseError)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
 					allSuccessfulFederationDomainConditions(fd.Spec),
 					[]metav1.Condition{
@@ -198,9 +198,9 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					Client: idpv1alpha1.OIDCClient{SecretName: "this-will-not-exist-but-does-not-matter"},
 				}, idpv1alpha1.PhaseError)

-				fd := testlib.CreateTestFederationDomain(ctx, t, v1alpha1.FederationDomainSpec{
+				fd := testlib.CreateTestFederationDomain(ctx, t, supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com/fake",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "not unique",
 							ObjectRef: corev1.TypedLocalObjectReference{
@@ -208,17 +208,17 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 								Kind:     "OIDCIdentityProvider",
 								Name:     "will not be found",
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Constants: []v1alpha1.FederationDomainTransformsConstant{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 									{Name: "foo", Type: "string", StringValue: "bar"},
 								},
-								Expressions: []v1alpha1.FederationDomainTransformsExpression{
+								Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 									{Type: "username/v1", Expression: "this is not a valid cel expression"},
 									{Type: "groups/v1", Expression: "this is also not a valid cel expression"},
 									{Type: "username/v1", Expression: "username"}, // valid
 									{Type: "policy/v1", Expression: "still not a valid cel expression"},
 								},
-								Examples: []v1alpha1.FederationDomainTransformsExample{
+								Examples: []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 									{
 										Username: "does not matter because expressions did not compile",
 									},
@@ -240,23 +240,23 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 								Kind:     "this is the wrong kind",
 								Name:     "also will not be found",
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Constants: []v1alpha1.FederationDomainTransformsConstant{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 									{Name: "ryan", Type: "string", StringValue: "ryan"},
 									{Name: "unused", Type: "stringList", StringListValue: []string{"foo", "bar"}},
 									{Name: "rejectMe", Type: "string", StringValue: "rejectMeWithDefaultMessage"},
 								},
-								Expressions: []v1alpha1.FederationDomainTransformsExpression{
+								Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 									{Type: "policy/v1", Expression: `username == strConst.ryan || username == strConst.rejectMe`, Message: "only special users allowed"},
 									{Type: "policy/v1", Expression: `username != "rejectMeWithDefaultMessage"`}, // no message specified
 									{Type: "username/v1", Expression: `"pre:" + username`},
 									{Type: "groups/v1", Expression: `groups.map(g, "pre:" + g)`},
 								},
-								Examples: []v1alpha1.FederationDomainTransformsExample{
+								Examples: []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 									{ // this example should pass
 										Username: "ryan",
 										Groups:   []string{"a", "b"},
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Username: "pre:ryan",
 											Groups:   []string{"pre:b", "pre:a", "pre:b", "pre:a"}, // order and repeats don't matter, treated like a set
 											Rejected: false,
@@ -264,7 +264,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 									},
 									{ // this example should pass
 										Username: "other",
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Rejected: true,
 											Message:  "only special users allowed",
 										},
@@ -272,7 +272,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 									{ // this example should fail because it expects the user to be rejected but the user was actually not rejected
 										Username: "ryan",
 										Groups:   []string{"a", "b"},
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Rejected: true,
 											Message:  "this input is ignored in this case",
 										},
@@ -280,7 +280,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 									{ // this example should fail because it expects the user not to be rejected but they were actually rejected
 										Username: "other",
 										Groups:   []string{"a", "b"},
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Username: "pre:other",
 											Groups:   []string{"pre:a", "pre:b"},
 											Rejected: false,
@@ -289,7 +289,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 									{ // this example should fail because it expects the wrong rejection message
 										Username: "other",
 										Groups:   []string{"a", "b"},
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Rejected: true,
 											Message:  "wrong message",
 										},
@@ -298,14 +298,14 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 										// because the message assertions defaults to asserting the default rejection message
 										Username: "rejectMeWithDefaultMessage",
 										Groups:   []string{"a", "b"},
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Rejected: true,
 										},
 									},
 									{ // this example should fail because it expects both the wrong username and groups
 										Username: "ryan",
 										Groups:   []string{"b", "a"},
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Username: "wrong",
 											Groups:   []string{},
 											Rejected: false,
@@ -314,7 +314,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 									{ // this example should fail because it expects the wrong username only
 										Username: "ryan",
 										Groups:   []string{"a", "b"},
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Username: "wrong",
 											Groups:   []string{"pre:b", "pre:a"},
 											Rejected: false,
@@ -323,7 +323,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 									{ // this example should fail because it expects the wrong groups only
 										Username: "ryan",
 										Groups:   []string{"b", "a"},
-										Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+										Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 											Username: "pre:ryan",
 											Groups:   []string{"wrong2", "wrong1"},
 											Rejected: false,
@@ -332,13 +332,13 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 									{ // this example should fail because it does not expect anything but the auth actually was successful
 										Username: "ryan",
 										Groups:   []string{"b", "a"},
-										Expects:  v1alpha1.FederationDomainTransformsExampleExpects{},
+										Expects:  supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{},
 									},
 								},
 							},
 						},
 					},
-				}, v1alpha1.FederationDomainPhaseError)
+				}, supervisorconfigv1alpha1.FederationDomainPhaseError)

 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, replaceSomeConditions(
 					allSuccessfulFederationDomainConditions(fd.Spec),
@@ -437,7 +437,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 					gotFD, err := federationDomainsClient.Get(ctx, fd.Name, metav1.GetOptions{})
 					require.NoError(t, err)

-					gotFD.Spec.IdentityProviders[0] = v1alpha1.FederationDomainIdentityProvider{
+					gotFD.Spec.IdentityProviders[0] = supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						// Fix the display name.
 						DisplayName: "now made unique",
 						// Fix the objectRef.
@@ -446,19 +446,19 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 							Kind:     "OIDCIdentityProvider",
 							Name:     oidcIdentityProvider.Name,
 						},
-						Transforms: v1alpha1.FederationDomainTransforms{
-							Constants: []v1alpha1.FederationDomainTransformsConstant{
+						Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+							Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 								{Name: "foo", Type: "string", StringValue: "bar"},
 							},
-							Expressions: []v1alpha1.FederationDomainTransformsExpression{
+							Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 								// Fix the compile errors.
 								{Type: "username/v1", Expression: `"pre:" + username`},
 							},
-							Examples: []v1alpha1.FederationDomainTransformsExample{
+							Examples: []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 								{ // this example should fail because it expects both the wrong username and groups
 									Username: "ryan",
 									Groups:   []string{"b", "a"},
-									Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+									Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 										Username: "wrong",
 										Groups:   []string{},
 										Rejected: false,
@@ -468,10 +468,10 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 						},
 					}

-					gotFD.Spec.IdentityProviders[2].Transforms.Examples = []v1alpha1.FederationDomainTransformsExample{
+					gotFD.Spec.IdentityProviders[2].Transforms.Examples = []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 						{ // this example should pass
 							Username: "other",
-							Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+							Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 								Rejected: true,
 								Message:  "only special users allowed",
 							},
@@ -525,11 +525,11 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 						Name:     oidcIdentityProvider.Name,
 					}

-					gotFD.Spec.IdentityProviders[0].Transforms.Examples = []v1alpha1.FederationDomainTransformsExample{
+					gotFD.Spec.IdentityProviders[0].Transforms.Examples = []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 						{ // this example should pass
 							Username: "ryan",
 							Groups:   []string{"b", "a"},
-							Expects: v1alpha1.FederationDomainTransformsExampleExpects{
+							Expects: supervisorconfigv1alpha1.FederationDomainTransformsExampleExpects{
 								Username: "pre:ryan",
 								Groups:   []string{"a", "b"},
 							},
@@ -541,7 +541,7 @@ func TestSupervisorFederationDomainStatus_Disruptive(t *testing.T) {
 				})
 				require.NoError(t, err)

-				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, v1alpha1.FederationDomainPhaseReady)
+				testlib.WaitForFederationDomainStatusPhase(ctx, t, fd.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 				testlib.WaitForFederationDomainStatusConditions(ctx, t, fd.Name, allSuccessfulFederationDomainConditions(fd.Spec))
 			},
 		},
@@ -570,16 +570,16 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {

 	tests := []struct {
 		name                 string
-		fd                   *v1alpha1.FederationDomain
+		fd                   *supervisorconfigv1alpha1.FederationDomain
 		wantErr              string
 		wantOldKubeErr       string
 		wantReallyOldKubeErr string
 	}{
 		{
 			name: "issuer cannot be empty",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "",
 				},
 			},
@@ -589,11 +589,11 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP display names cannot be empty",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "",
 							ObjectRef: corev1.TypedLocalObjectReference{
@@ -610,18 +610,18 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP transform constants must have unique names",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Constants: []v1alpha1.FederationDomainTransformsConstant{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 									{Name: "notUnique", Type: "string", StringValue: "foo"},
 									{Name: "notUnique", Type: "string", StringValue: "bar"},
 								},
@@ -639,18 +639,18 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP transform constant names cannot be empty",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Constants: []v1alpha1.FederationDomainTransformsConstant{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 									{Name: "", Type: "string"},
 								},
 							},
@@ -665,18 +665,18 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP transform constant names cannot be more than 64 characters",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Constants: []v1alpha1.FederationDomainTransformsConstant{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 									{Name: "12345678901234567890123456789012345678901234567890123456789012345", Type: "string"},
 								},
 							},
@@ -698,18 +698,18 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP transform constant names must be a legal CEL variable name",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Constants: []v1alpha1.FederationDomainTransformsConstant{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 									{Name: "cannot have spaces", Type: "string"},
 									{Name: "1mustStartWithLetter", Type: "string"},
 									{Name: "_mustStartWithLetter", Type: "string"},
@@ -740,18 +740,18 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP transform constant types must be one of the allowed enum strings",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Constants: []v1alpha1.FederationDomainTransformsConstant{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 									{Name: "a", Type: "this is invalid"},
 									{Name: "b", Type: "string"},
 									{Name: "c", Type: "stringList"},
@@ -768,18 +768,18 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP transform expression types must be one of the allowed enum strings",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Expressions: []v1alpha1.FederationDomainTransformsExpression{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 									{Type: "this is invalid", Expression: "foo"},
 									{Type: "policy/v1", Expression: "foo"},
 									{Type: "username/v1", Expression: "foo"},
@@ -797,18 +797,18 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP transform expressions cannot be empty",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Expressions: []v1alpha1.FederationDomainTransformsExpression{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 									{Type: "username/v1", Expression: ""},
 								},
 							},
@@ -823,18 +823,18 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "IDP transform example usernames cannot be empty",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: objectMeta,
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Examples: []v1alpha1.FederationDomainTransformsExample{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Examples: []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 									{Username: ""},
 									{Username: "non-empty"},
 								},
@@ -850,20 +850,20 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "minimum valid",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: testlib.ObjectMetaWithRandomName(t, "fd"),
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
 				},
 			},
 		},
 		{
 			name: "minimum valid when IDPs are included",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: testlib.ObjectMetaWithRandomName(t, "fd"),
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
@@ -876,24 +876,24 @@ func TestSupervisorFederationDomainCRDValidations_Parallel(t *testing.T) {
 		},
 		{
 			name: "minimum valid when IDP has transform constants, expressions, and examples",
-			fd: &v1alpha1.FederationDomain{
+			fd: &supervisorconfigv1alpha1.FederationDomain{
 				ObjectMeta: testlib.ObjectMetaWithRandomName(t, "fd"),
-				Spec: v1alpha1.FederationDomainSpec{
+				Spec: supervisorconfigv1alpha1.FederationDomainSpec{
 					Issuer: "https://example.com",
-					IdentityProviders: []v1alpha1.FederationDomainIdentityProvider{
+					IdentityProviders: []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: "foo",
 							ObjectRef: corev1.TypedLocalObjectReference{
 								APIGroup: ptr.To("required in older versions of Kubernetes for each item in the identityProviders slice"),
 							},
-							Transforms: v1alpha1.FederationDomainTransforms{
-								Constants: []v1alpha1.FederationDomainTransformsConstant{
+							Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+								Constants: []supervisorconfigv1alpha1.FederationDomainTransformsConstant{
 									{Name: "foo", Type: "string"},
 								},
-								Expressions: []v1alpha1.FederationDomainTransformsExpression{
+								Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 									{Type: "username/v1", Expression: "foo"},
 								},
-								Examples: []v1alpha1.FederationDomainTransformsExample{
+								Examples: []supervisorconfigv1alpha1.FederationDomainTransformsExample{
 									{Username: "foo"},
 								},
 							},
@@ -964,7 +964,7 @@ func replaceSomeConditions(conditions []metav1.Condition, replaceWithTheseCondit
 	return cp
 }

-func allSuccessfulLegacyFederationDomainConditions(idpName string, federationDomainSpec v1alpha1.FederationDomainSpec) []metav1.Condition {
+func allSuccessfulLegacyFederationDomainConditions(idpName string, federationDomainSpec supervisorconfigv1alpha1.FederationDomainSpec) []metav1.Condition {
 	return replaceSomeConditions(
 		allSuccessfulFederationDomainConditions(federationDomainSpec),
 		[]metav1.Condition{
@@ -979,7 +979,7 @@ func allSuccessfulLegacyFederationDomainConditions(idpName string, federationDom
 	)
 }

-func allSuccessfulFederationDomainConditions(federationDomainSpec v1alpha1.FederationDomainSpec) []metav1.Condition {
+func allSuccessfulFederationDomainConditions(federationDomainSpec supervisorconfigv1alpha1.FederationDomainSpec) []metav1.Condition {
 	return []metav1.Condition{
 		{
 			Type: "IdentityProvidersDisplayNamesUnique", Status: "True", Reason: "Success",
@@ -29,7 +29,7 @@ import (
 	"k8s.io/utils/ptr"
 	"k8s.io/utils/strings/slices"

-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	"go.pinniped.dev/internal/certauthority"
 	"go.pinniped.dev/internal/federationdomain/oidc"
@@ -237,7 +237,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 		// Optionally specify the identityProviders part of the FederationDomain's spec by returning it from this function.
 		// Also return the displayName of the IDP that should be used during authentication (or empty string for no IDP name in the auth request).
 		// This function takes the name of the IDP CR which was returned by createIDP() as as argument.
-		federationDomainIDPs func(t *testing.T, idpName string) (idps []configv1alpha1.FederationDomainIdentityProvider, useIDPDisplayName string)
+		federationDomainIDPs func(t *testing.T, idpName string) (idps []supervisorconfigv1alpha1.FederationDomainIdentityProvider, useIDPDisplayName string)

 		// Optionally create an OIDCClient CR for the test to use. Return the client ID and client secret for the
 		// test to use. When not set, the test will default to using the "pinniped-cli" static client with no secret.
@@ -280,7 +280,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 		wantDownstreamIDTokenGroups []string
 		// The expected ID token additional claims, which will be nested under claim "additionalClaims",
 		// for the original ID token and the refreshed ID token.
-		wantDownstreamIDTokenAdditionalClaims map[string]interface{}
+		wantDownstreamIDTokenAdditionalClaims map[string]any
 		// The expected ID token lifetime, as calculated by token claim 'exp' subtracting token claim 'iat'.
 		// ID tokens issued through authcode exchange or token refresh should have the configured lifetime (or default if not configured).
 		// ID tokens issued through a token exchange should have the default lifetime.
@@ -454,7 +454,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 			wantDownstreamIDTokenSubjectToMatch: expectedIDTokenSubjectRegexForUpstreamOIDC,
 			// the ID token Username should include the upstream user ID after the upstream issuer name
 			wantDownstreamIDTokenUsernameToMatch: func(_ string) string { return "^" + regexp.QuoteMeta(env.SupervisorUpstreamOIDC.Issuer+"?sub=") + ".+" },
-			wantDownstreamIDTokenAdditionalClaims: wantGroupsInAdditionalClaimsIfGroupsExist(map[string]interface{}{
+			wantDownstreamIDTokenAdditionalClaims: wantGroupsInAdditionalClaimsIfGroupsExist(map[string]any{
 				"upstream_issuer✅":  env.SupervisorUpstreamOIDC.Issuer,
 				"upstream_username": env.SupervisorUpstreamOIDC.Username,
 			}, "upstream_groups", env.SupervisorUpstreamOIDC.ExpectedGroups),
@@ -479,7 +479,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 			wantDownstreamIDTokenSubjectToMatch: expectedIDTokenSubjectRegexForUpstreamOIDC,
 			// the ID token Username should include the upstream user ID after the upstream issuer name
 			wantDownstreamIDTokenUsernameToMatch: func(_ string) string { return "^" + regexp.QuoteMeta(env.SupervisorUpstreamOIDC.Issuer+"?sub=") + ".+" },
-			wantDownstreamIDTokenAdditionalClaims: wantGroupsInAdditionalClaimsIfGroupsExist(map[string]interface{}{
+			wantDownstreamIDTokenAdditionalClaims: wantGroupsInAdditionalClaimsIfGroupsExist(map[string]any{
 				"upstream_issuer✅":  env.SupervisorUpstreamOIDC.Issuer,
 				"upstream_username": env.SupervisorUpstreamOIDC.Username,
 			}, "upstream_groups", env.SupervisorUpstreamOIDC.ExpectedGroups),
@@ -1423,11 +1423,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return testlib.CreateTestOIDCIdentityProvider(t, spec, idpv1alpha1.PhaseReady).Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			requestAuthorization:                 requestAuthorizationUsingBrowserAuthcodeFlowOIDC,
 			wantDownstreamIDTokenSubjectToMatch:  expectedIDTokenSubjectRegexForUpstreamOIDC,
@@ -1449,14 +1449,14 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return testlib.CreateTestOIDCIdentityProvider(t, spec, idpv1alpha1.PhaseReady).Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-					TokenLifetimes: configv1alpha1.OIDCClientTokenLifetimes{
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+					TokenLifetimes: supervisorconfigv1alpha1.OIDCClientTokenLifetimes{
 						IDTokenSeconds: ptr.To[int32](1234),
 					},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			requestAuthorization:                 requestAuthorizationUsingBrowserAuthcodeFlowOIDC,
 			wantDownstreamIDTokenSubjectToMatch:  expectedIDTokenSubjectRegexForUpstreamOIDC,
@@ -1478,9 +1478,9 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				}
 				return testlib.CreateTestOIDCIdentityProvider(t, spec, idpv1alpha1.PhaseReady).Name
 			},
-			federationDomainIDPs: func(t *testing.T, idpName string) ([]configv1alpha1.FederationDomainIdentityProvider, string) {
+			federationDomainIDPs: func(t *testing.T, idpName string) ([]supervisorconfigv1alpha1.FederationDomainIdentityProvider, string) {
 				displayName := "my oidc idp"
-				return []configv1alpha1.FederationDomainIdentityProvider{
+				return []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 						{
 							DisplayName: displayName,
 							ObjectRef: corev1.TypedLocalObjectReference{
@@ -1494,11 +1494,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				// which should cause the authorize endpoint to show the IDP chooser page
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			requestAuthorization: requestAuthorizationUsingBrowserAuthcodeFlowOIDCWithIDPChooserPage,
 			wantDownstreamIDTokenSubjectToMatch: "^" +
@@ -1530,17 +1530,17 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return testlib.CreateTestOIDCIdentityProvider(t, spec, idpv1alpha1.PhaseReady).Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			requestAuthorization:                 requestAuthorizationUsingBrowserAuthcodeFlowOIDC,
 			wantDownstreamIDTokenSubjectToMatch:  expectedIDTokenSubjectRegexForUpstreamOIDC,
 			wantDownstreamIDTokenUsernameToMatch: func(_ string) string { return "^" + regexp.QuoteMeta(env.SupervisorUpstreamOIDC.Username) + "$" },
 			wantDownstreamIDTokenGroups:          env.SupervisorUpstreamOIDC.ExpectedGroups,
-			wantDownstreamIDTokenAdditionalClaims: wantGroupsInAdditionalClaimsIfGroupsExist(map[string]interface{}{
+			wantDownstreamIDTokenAdditionalClaims: wantGroupsInAdditionalClaimsIfGroupsExist(map[string]any{
 				"upstream_issuer✅":  env.SupervisorUpstreamOIDC.Issuer,
 				"upstream_username": env.SupervisorUpstreamOIDC.Username,
 			}, "upstream_groups", env.SupervisorUpstreamOIDC.ExpectedGroups),
@@ -1553,11 +1553,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1580,11 +1580,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "refresh_token"},        // token exchange grant type not allowed
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "username", "groups"}, // a validation requires that we also disallow the pinniped:request-audience scope
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"},        // token exchange grant type not allowed
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "username", "groups"}, // a validation requires that we also disallow the pinniped:request-audience scope
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1614,11 +1614,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1648,11 +1648,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "refresh_token"}, // token exchange not allowed (required to exclude groups scope)
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "groups"},      // username not allowed
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"}, // token exchange not allowed (required to exclude groups scope)
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "groups"},      // username not allowed
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1674,11 +1674,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "refresh_token"}, // token exchange not allowed (required to exclude groups scope)
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "username"},    // groups not allowed
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"}, // token exchange not allowed (required to exclude groups scope)
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "username"},    // groups not allowed
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1700,11 +1700,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1728,11 +1728,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1762,11 +1762,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access"}, // validations require that when username/groups are excluded, then token exchange must also not be allowed
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access"}, // validations require that when username/groups are excluded, then token exchange must also not be allowed
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1796,11 +1796,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				return testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				return testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 			},
 			testUser: func(t *testing.T) (string, string) {
 				// return the username and password of the existing user that we want to use for this test
@@ -1823,11 +1823,11 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				return idp.Name
 			},
 			createOIDCClient: func(t *testing.T, callbackURL string) (string, string) {
-				clientID, _ := testlib.CreateOIDCClient(t, configv1alpha1.OIDCClientSpec{
-					AllowedRedirectURIs: []configv1alpha1.RedirectURI{configv1alpha1.RedirectURI(callbackURL)},
-					AllowedGrantTypes:   []configv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
-					AllowedScopes:       []configv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
-				}, configv1alpha1.OIDCClientPhaseReady)
+				clientID, _ := testlib.CreateOIDCClient(t, supervisorconfigv1alpha1.OIDCClientSpec{
+					AllowedRedirectURIs: []supervisorconfigv1alpha1.RedirectURI{supervisorconfigv1alpha1.RedirectURI(callbackURL)},
+					AllowedGrantTypes:   []supervisorconfigv1alpha1.GrantType{"authorization_code", "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token"},
+					AllowedScopes:       []supervisorconfigv1alpha1.Scope{"openid", "offline_access", "pinniped:request-audience", "username", "groups"},
+				}, supervisorconfigv1alpha1.OIDCClientPhaseReady)
 				return clientID, "wrong-client-secret"
 			},
 			testUser: func(t *testing.T) (string, string) {
@@ -1852,9 +1852,9 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				}
 				return testlib.CreateTestOIDCIdentityProvider(t, spec, idpv1alpha1.PhaseReady).Name
 			},
-			federationDomainIDPs: func(t *testing.T, idpName string) ([]configv1alpha1.FederationDomainIdentityProvider, string) {
+			federationDomainIDPs: func(t *testing.T, idpName string) ([]supervisorconfigv1alpha1.FederationDomainIdentityProvider, string) {
 				displayName := "my oidc idp"
-				return []configv1alpha1.FederationDomainIdentityProvider{
+				return []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 					{
 						DisplayName: displayName,
 						ObjectRef: corev1.TypedLocalObjectReference{
@@ -1862,8 +1862,8 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 							Kind:     "OIDCIdentityProvider",
 							Name:     idpName,
 						},
-						Transforms: configv1alpha1.FederationDomainTransforms{
-							Expressions: []configv1alpha1.FederationDomainTransformsExpression{
+						Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+							Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 								{
 									Type: "username/v1",
 									Expression: fmt.Sprintf(`username == "%s" ? "username-prefix:" + username : username`,
@@ -1913,9 +1913,9 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				idp, _ := createLDAPIdentityProvider(t, nil)
 				return idp.Name
 			},
-			federationDomainIDPs: func(t *testing.T, idpName string) ([]configv1alpha1.FederationDomainIdentityProvider, string) {
+			federationDomainIDPs: func(t *testing.T, idpName string) ([]supervisorconfigv1alpha1.FederationDomainIdentityProvider, string) {
 				displayName := "my ldap idp"
-				return []configv1alpha1.FederationDomainIdentityProvider{
+				return []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 					{
 						DisplayName: displayName,
 						ObjectRef: corev1.TypedLocalObjectReference{
@@ -1923,8 +1923,8 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 							Kind:     "LDAPIdentityProvider",
 							Name:     idpName,
 						},
-						Transforms: configv1alpha1.FederationDomainTransforms{
-							Expressions: []configv1alpha1.FederationDomainTransformsExpression{
+						Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+							Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 								{
 									Type: "username/v1",
 									Expression: fmt.Sprintf(`username == "%s" ? "username-prefix:" + username : username`,
@@ -1980,9 +1980,9 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				idp, _ := createLDAPIdentityProvider(t, nil)
 				return idp.Name
 			},
-			federationDomainIDPs: func(t *testing.T, idpName string) ([]configv1alpha1.FederationDomainIdentityProvider, string) {
+			federationDomainIDPs: func(t *testing.T, idpName string) ([]supervisorconfigv1alpha1.FederationDomainIdentityProvider, string) {
 				displayName := "my ldap idp"
-				return []configv1alpha1.FederationDomainIdentityProvider{
+				return []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 					{
 						DisplayName: displayName,
 						ObjectRef: corev1.TypedLocalObjectReference{
@@ -1990,8 +1990,8 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 							Kind:     "LDAPIdentityProvider",
 							Name:     idpName,
 						},
-						Transforms: configv1alpha1.FederationDomainTransforms{
-							Expressions: []configv1alpha1.FederationDomainTransformsExpression{
+						Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+							Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 								{
 									Type: "username/v1",
 									Expression: fmt.Sprintf(`username == "%s" ? "username-prefix:" + username : username`,
@@ -2044,9 +2044,9 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				idp, _ := createActiveDirectoryIdentityProvider(t, nil)
 				return idp.Name
 			},
-			federationDomainIDPs: func(t *testing.T, idpName string) ([]configv1alpha1.FederationDomainIdentityProvider, string) {
+			federationDomainIDPs: func(t *testing.T, idpName string) ([]supervisorconfigv1alpha1.FederationDomainIdentityProvider, string) {
 				displayName := "my ad idp"
-				return []configv1alpha1.FederationDomainIdentityProvider{
+				return []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 					{
 						DisplayName: displayName,
 						ObjectRef: corev1.TypedLocalObjectReference{
@@ -2054,8 +2054,8 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 							Kind:     "ActiveDirectoryIdentityProvider",
 							Name:     idpName,
 						},
-						Transforms: configv1alpha1.FederationDomainTransforms{
-							Expressions: []configv1alpha1.FederationDomainTransformsExpression{
+						Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+							Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 								{
 									Type: "username/v1",
 									Expression: fmt.Sprintf(`username == "%s" ? "username-prefix:" + username : username`,
@@ -2113,9 +2113,9 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 				idp, _ := createActiveDirectoryIdentityProvider(t, nil)
 				return idp.Name
 			},
-			federationDomainIDPs: func(t *testing.T, idpName string) ([]configv1alpha1.FederationDomainIdentityProvider, string) {
+			federationDomainIDPs: func(t *testing.T, idpName string) ([]supervisorconfigv1alpha1.FederationDomainIdentityProvider, string) {
 				displayName := "my ad idp"
-				return []configv1alpha1.FederationDomainIdentityProvider{
+				return []supervisorconfigv1alpha1.FederationDomainIdentityProvider{
 					{
 						DisplayName: displayName,
 						ObjectRef: corev1.TypedLocalObjectReference{
@@ -2123,8 +2123,8 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 							Kind:     "ActiveDirectoryIdentityProvider",
 							Name:     idpName,
 						},
-						Transforms: configv1alpha1.FederationDomainTransforms{
-							Expressions: []configv1alpha1.FederationDomainTransformsExpression{
+						Transforms: supervisorconfigv1alpha1.FederationDomainTransforms{
+							Expressions: []supervisorconfigv1alpha1.FederationDomainTransformsExpression{
 								{
 									Type: "username/v1",
 									Expression: fmt.Sprintf(`username == "%s" ? "username-prefix:" + username : username`,
@@ -2206,9 +2206,9 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 	}
 }

-func wantGroupsInAdditionalClaimsIfGroupsExist(additionalClaims map[string]interface{}, wantGroupsAdditionalClaimName string, wantGroups []string) map[string]interface{} {
+func wantGroupsInAdditionalClaimsIfGroupsExist(additionalClaims map[string]any, wantGroupsAdditionalClaimName string, wantGroups []string) map[string]any {
 	if len(wantGroups) > 0 {
-		var wantGroupsAnyType []interface{}
+		var wantGroupsAnyType []any
 		for _, group := range wantGroups {
 			wantGroupsAnyType = append(wantGroupsAnyType, group)
 		}
@@ -2338,7 +2338,7 @@ func requireEventuallySuccessfulActiveDirectoryIdentityProviderConditions(t *tes
 func testSupervisorLogin(
 	t *testing.T,
 	createIDP func(t *testing.T) string,
-	federationDomainIDPs func(t *testing.T, idpName string) ([]configv1alpha1.FederationDomainIdentityProvider, string),
+	federationDomainIDPs func(t *testing.T, idpName string) ([]supervisorconfigv1alpha1.FederationDomainIdentityProvider, string),
 	requestAuthorization func(t *testing.T, downstreamIssuer string, downstreamAuthorizeURL string, downstreamCallbackURL string, username string, password string, httpClient *http.Client),
 	editRefreshSessionDataWithoutBreaking func(t *testing.T, pinnipedSession *psession.PinnipedSession, idpName string, username string) []string,
 	breakRefreshSessionData func(t *testing.T, pinnipedSession *psession.PinnipedSession, idpName string, username string),
@@ -2351,7 +2351,7 @@ func testSupervisorLogin(
 	wantDownstreamIDTokenSubjectToMatch string,
 	wantDownstreamIDTokenUsernameToMatch func(username string) string,
 	wantDownstreamIDTokenGroups []string,
-	wantDownstreamIDTokenAdditionalClaims map[string]interface{},
+	wantDownstreamIDTokenAdditionalClaims map[string]any,
 	wantDownstreamIDTokenLifetime *time.Duration,
 	wantAuthorizationErrorType string,
 	wantAuthorizationErrorDescription string,
@@ -2420,7 +2420,7 @@ func testSupervisorLogin(
 	idpName := createIDP(t)

 	// Determine if and how we should set spec.identityProviders for the FederationDomain.
-	var fdIDPSpec []configv1alpha1.FederationDomainIdentityProvider
+	var fdIDPSpec []supervisorconfigv1alpha1.FederationDomainIdentityProvider
 	useIDPDisplayName := ""
 	if federationDomainIDPs != nil {
 		fdIDPSpec, useIDPDisplayName = federationDomainIDPs(t, idpName)
@@ -2428,14 +2428,14 @@ func testSupervisorLogin(

 	// Create the downstream FederationDomain and expect it to go into the appropriate status condition.
 	downstream := testlib.CreateTestFederationDomain(ctx, t,
-		configv1alpha1.FederationDomainSpec{
+		supervisorconfigv1alpha1.FederationDomainSpec{
 			Issuer:            issuerURL.String(),
-			TLS:               &configv1alpha1.FederationDomainTLSSpec{SecretName: certSecret.Name},
+			TLS:               &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: certSecret.Name},
 			IdentityProviders: fdIDPSpec,
 		},
 		// The IDP CR already exists, so even for legacy FederationDomains which do not explicitly list
 		// the IDPs in the spec, the FederationDomain should be ready.
-		configv1alpha1.FederationDomainPhaseReady,
+		supervisorconfigv1alpha1.FederationDomainPhaseReady,
 	)

 	// Ensure that the JWKS data is created and ready for the new FederationDomain by waiting for
@@ -2739,9 +2739,9 @@ func verifyTokenResponse(
 	expectedIDTokenClaims []string,
 	wantDownstreamIDTokenSubjectToMatch, wantDownstreamIDTokenUsernameToMatch string,
 	wantDownstreamIDTokenGroups []string,
-	wantDownstreamIDTokenAdditionalClaims map[string]interface{},
+	wantDownstreamIDTokenAdditionalClaims map[string]any,
 	wantDownstreamIDTokenLifetime time.Duration,
-) map[string]interface{} {
+) map[string]any {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
 	defer cancel()

@@ -2762,7 +2762,7 @@ func verifyTokenResponse(
 	testutil.RequireTimeInDelta(t, time.Now().UTC().Add(wantDownstreamIDTokenLifetime), idToken.Expiry, time.Second*30)

 	// Check the full list of claim names of the ID token.
-	idTokenClaims := map[string]interface{}{}
+	idTokenClaims := map[string]any{}
 	err = idToken.Claims(&idTokenClaims)
 	require.NoError(t, err)
 	idTokenClaimNames := []string{}
@@ -2819,7 +2819,7 @@ func verifyTokenResponse(
 	return idTokenClaims
 }

-func getFloat64Claim(t *testing.T, claims map[string]interface{}, claim string) float64 {
+func getFloat64Claim(t *testing.T, claims map[string]any, claim string) float64 {
 	t.Helper()

 	v, ok := claims[claim]
@@ -3104,7 +3104,7 @@ func doTokenExchange(
 	httpClient *http.Client,
 	provider *coreosoidc.Provider,
 	wantTokenExchangeResponse func(t *testing.T, status int, body string),
-	previousIDTokenClaims map[string]interface{},
+	previousIDTokenClaims map[string]any,
 	wantIDTokenLifetime time.Duration,
 ) {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
@@ -3154,7 +3154,7 @@ func doTokenExchange(
 	exchangedToken, err := clusterVerifier.Verify(ctx, respBody.AccessToken)
 	require.NoError(t, err)

-	var claims map[string]interface{}
+	var claims map[string]any
 	require.NoError(t, exchangedToken.Claims(&claims))
 	indentedClaims, err := json.MarshalIndent(claims, "   ", "  ")
 	require.NoError(t, err)
@@ -104,7 +104,7 @@ func TestKubectlOIDCClientSecretRequest_Parallel(t *testing.T) {
 				return []string{"create", "-f", filePath, "-o", "yaml"}
 			},
 			assertOnStdOut: func(t *testing.T, oidcClientName string, stdOutString string) {
-				var yamlObj map[string]interface{}
+				var yamlObj map[string]any
 				err := yaml.Unmarshal([]byte(stdOutString), &yamlObj)
 				require.NoError(t, err)

@@ -112,7 +112,7 @@ func TestKubectlOIDCClientSecretRequest_Parallel(t *testing.T) {
 				require.Equal(t, yamlObj["apiVersion"], fmt.Sprintf("clientsecret.supervisor.%s/v1alpha1", env.APIGroupSuffix))
 				require.Equal(t, yamlObj["kind"], "OIDCClientSecretRequest")

-				metadataMap, ok := yamlObj["metadata"].(map[string]interface{})
+				metadataMap, ok := yamlObj["metadata"].(map[string]any)
 				require.True(t, ok, "metadata should be a map")
 				require.Len(t, metadataMap, 3, "metadata should contain only 3 keys (creationTimestamp, name, namespace): %v", metadataMap)
 				require.Equal(t, metadataMap["name"], oidcClientName)
@@ -124,13 +124,13 @@ func TestKubectlOIDCClientSecretRequest_Parallel(t *testing.T) {
 				require.NoError(t, err)
 				testutil.RequireTimeInDelta(t, parsedTime, time.Now(), 1*time.Minute)

-				specMap, ok := yamlObj["spec"].(map[string]interface{})
+				specMap, ok := yamlObj["spec"].(map[string]any)
 				require.True(t, ok, "spec should be a map")
 				require.Len(t, specMap, 2, "spec should contain only 2 keys (generateNewSecret, revokeOldSecrets): %v", specMap)
 				require.Equal(t, specMap["generateNewSecret"], true)
 				require.Equal(t, specMap["revokeOldSecrets"], false)

-				statusMap, ok := yamlObj["status"].(map[string]interface{})
+				statusMap, ok := yamlObj["status"].(map[string]any)
 				require.True(t, ok, "status should be a map")
 				require.Len(t, specMap, 2, "status should contain only 2 keys (generatedSecret, totalClientSecrets): %v", statusMap)
 				require.Regexp(t, "^[0-9a-z]{64}$", statusMap["generatedSecret"], "generated secret must be precisely 40 hex encoded characters")
@@ -15,7 +15,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	"go.pinniped.dev/test/testlib"
 )

@@ -30,48 +30,48 @@ func TestSupervisorSecrets_Parallel(t *testing.T) {

 	// Create our FederationDomain under test.
 	federationDomain := testlib.CreateTestFederationDomain(ctx, t,
-		configv1alpha1.FederationDomainSpec{
+		supervisorconfigv1alpha1.FederationDomainSpec{
 			Issuer: fmt.Sprintf("http://test-issuer-%s.pinniped.dev", testlib.RandHex(t, 8)),
 		},
-		configv1alpha1.FederationDomainPhaseError, // in phase error until there is an IDP created, but this test does not care
+		supervisorconfigv1alpha1.FederationDomainPhaseError, // in phase error until there is an IDP created, but this test does not care
 	)

 	tests := []struct {
 		name        string
-		secretName  func(federationDomain *configv1alpha1.FederationDomain) string
+		secretName  func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string
 		ensureValid func(t *testing.T, secret *corev1.Secret)
 	}{
 		{
 			name: "csrf cookie signing key",
-			secretName: func(federationDomain *configv1alpha1.FederationDomain) string {
+			secretName: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string {
 				return env.SupervisorAppName + "-key"
 			},
 			ensureValid: ensureValidSymmetricSecretOfTypeFunc("secrets.pinniped.dev/supervisor-csrf-signing-key"),
 		},
 		{
 			name: "jwks",
-			secretName: func(federationDomain *configv1alpha1.FederationDomain) string {
+			secretName: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string {
 				return federationDomain.Status.Secrets.JWKS.Name
 			},
 			ensureValid: ensureValidJWKS,
 		},
 		{
 			name: "hmac signing secret",
-			secretName: func(federationDomain *configv1alpha1.FederationDomain) string {
+			secretName: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string {
 				return federationDomain.Status.Secrets.TokenSigningKey.Name
 			},
 			ensureValid: ensureValidSymmetricSecretOfTypeFunc("secrets.pinniped.dev/federation-domain-token-signing-key"),
 		},
 		{
 			name: "state signature secret",
-			secretName: func(federationDomain *configv1alpha1.FederationDomain) string {
+			secretName: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string {
 				return federationDomain.Status.Secrets.StateSigningKey.Name
 			},
 			ensureValid: ensureValidSymmetricSecretOfTypeFunc("secrets.pinniped.dev/federation-domain-state-signing-key"),
 		},
 		{
 			name: "state encryption secret",
-			secretName: func(federationDomain *configv1alpha1.FederationDomain) string {
+			secretName: func(federationDomain *supervisorconfigv1alpha1.FederationDomain) string {
 				return federationDomain.Status.Secrets.StateEncryptionKey.Name
 			},
 			ensureValid: ensureValidSymmetricSecretOfTypeFunc("secrets.pinniped.dev/federation-domain-state-encryption-key"),
@@ -80,7 +80,7 @@ func TestSupervisorSecrets_Parallel(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			// Ensure a secret is created with the FederationDomain's JWKS.
-			var updatedFederationDomain *configv1alpha1.FederationDomain
+			var updatedFederationDomain *supervisorconfigv1alpha1.FederationDomain
 			testlib.RequireEventually(t, func(requireEventually *require.Assertions) {
 				resp, err := supervisorClient.
 					ConfigV1alpha1().
@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 package integration
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

-	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	"go.pinniped.dev/test/testlib"
 )

@@ -19,13 +19,13 @@ func TestSupervisorUpstreamOIDCDiscovery(t *testing.T) {

 	t.Run("invalid missing secret and bad issuer", func(t *testing.T) {
 		t.Parallel()
-		spec := v1alpha1.OIDCIdentityProviderSpec{
+		spec := idpv1alpha1.OIDCIdentityProviderSpec{
 			Issuer: "https://127.0.0.1:444444/invalid-url-that-is-really-really-long-nanananananananannanananan-batman-nanananananananananananananana-batman-lalalalalalalalalal-batman-weeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-			Client: v1alpha1.OIDCClient{
+			Client: idpv1alpha1.OIDCClient{
 				SecretName: "does-not-exist",
 			},
 		}
-		upstream := testlib.CreateTestOIDCIdentityProvider(t, spec, v1alpha1.PhaseError)
+		upstream := testlib.CreateTestOIDCIdentityProvider(t, spec, idpv1alpha1.PhaseError)
 		expectUpstreamConditions(t, upstream, []metav1.Condition{
 			{
 				Type:    "ClientCredentialsValid",
@@ -51,19 +51,19 @@ Get "https://127.0.0.1:444444/invalid-url-that-is-really-really-long-nananananan

 	t.Run("invalid issuer with trailing slash", func(t *testing.T) {
 		t.Parallel()
-		spec := v1alpha1.OIDCIdentityProviderSpec{
+		spec := idpv1alpha1.OIDCIdentityProviderSpec{
 			Issuer: env.SupervisorUpstreamOIDC.Issuer + "/",
-			TLS: &v1alpha1.TLSSpec{
+			TLS: &idpv1alpha1.TLSSpec{
 				CertificateAuthorityData: base64.StdEncoding.EncodeToString([]byte(env.SupervisorUpstreamOIDC.CABundle)),
 			},
-			AuthorizationConfig: v1alpha1.OIDCAuthorizationConfig{
+			AuthorizationConfig: idpv1alpha1.OIDCAuthorizationConfig{
 				AdditionalScopes: []string{"email", "profile"},
 			},
-			Client: v1alpha1.OIDCClient{
+			Client: idpv1alpha1.OIDCClient{
 				SecretName: testlib.CreateClientCredsSecret(t, "test-client-id", "test-client-secret").Name,
 			},
 		}
-		upstream := testlib.CreateTestOIDCIdentityProvider(t, spec, v1alpha1.PhaseError)
+		upstream := testlib.CreateTestOIDCIdentityProvider(t, spec, idpv1alpha1.PhaseError)
 		expectUpstreamConditions(t, upstream, []metav1.Condition{
 			{
 				Type:    "ClientCredentialsValid",
@@ -89,19 +89,19 @@ oidc: issuer did not match the issuer returned by provider, expected "` + env.Su

 	t.Run("valid", func(t *testing.T) {
 		t.Parallel()
-		spec := v1alpha1.OIDCIdentityProviderSpec{
+		spec := idpv1alpha1.OIDCIdentityProviderSpec{
 			Issuer: env.SupervisorUpstreamOIDC.Issuer,
-			TLS: &v1alpha1.TLSSpec{
+			TLS: &idpv1alpha1.TLSSpec{
 				CertificateAuthorityData: base64.StdEncoding.EncodeToString([]byte(env.SupervisorUpstreamOIDC.CABundle)),
 			},
-			AuthorizationConfig: v1alpha1.OIDCAuthorizationConfig{
+			AuthorizationConfig: idpv1alpha1.OIDCAuthorizationConfig{
 				AdditionalScopes: []string{"email", "profile"},
 			},
-			Client: v1alpha1.OIDCClient{
+			Client: idpv1alpha1.OIDCClient{
 				SecretName: testlib.CreateClientCredsSecret(t, "test-client-id", "test-client-secret").Name,
 			},
 		}
-		upstream := testlib.CreateTestOIDCIdentityProvider(t, spec, v1alpha1.PhaseReady)
+		upstream := testlib.CreateTestOIDCIdentityProvider(t, spec, idpv1alpha1.PhaseReady)
 		expectUpstreamConditions(t, upstream, []metav1.Condition{
 			{
 				Type:    "ClientCredentialsValid",
@@ -125,7 +125,7 @@ oidc: issuer did not match the issuer returned by provider, expected "` + env.Su
 	})
 }

-func expectUpstreamConditions(t *testing.T, upstream *v1alpha1.OIDCIdentityProvider, expected []metav1.Condition) {
+func expectUpstreamConditions(t *testing.T, upstream *idpv1alpha1.OIDCIdentityProvider, expected []metav1.Condition) {
 	t.Helper()
 	normalized := make([]metav1.Condition, 0, len(upstream.Status.Conditions))
 	for _, c := range upstream.Status.Conditions {
@@ -25,7 +25,7 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"

 	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	"go.pinniped.dev/internal/certauthority"
 	"go.pinniped.dev/internal/federationdomain/oidc"
@@ -83,11 +83,11 @@ func TestSupervisorWarnings_Browser(t *testing.T) {

 	// Create the downstream FederationDomain and expect it to go into the success status condition.
 	downstream := testlib.CreateTestFederationDomain(ctx, t,
-		configv1alpha1.FederationDomainSpec{
+		supervisorconfigv1alpha1.FederationDomainSpec{
 			Issuer: issuerURL.String(),
-			TLS:    &configv1alpha1.FederationDomainTLSSpec{SecretName: certSecret.Name},
+			TLS:    &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: certSecret.Name},
 		},
-		configv1alpha1.FederationDomainPhaseError, // in phase error until there is an IDP created
+		supervisorconfigv1alpha1.FederationDomainPhaseError, // in phase error until there is an IDP created
 	)

 	// Create a JWTAuthenticator that will validate the tokens from the downstream issuer.
@@ -110,7 +110,7 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 		expectedUsername := env.SupervisorUpstreamLDAP.TestUserMailAttributeValue

 		createdProvider := setupClusterForEndToEndLDAPTest(t, expectedUsername, env)
-		testlib.WaitForFederationDomainStatusPhase(ctx, t, downstream.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(ctx, t, downstream.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(ctx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -258,7 +258,7 @@ func TestSupervisorWarnings_Browser(t *testing.T) {

 		sAMAccountName := expectedUsername + "@" + env.SupervisorUpstreamActiveDirectory.Domain
 		createdProvider := setupClusterForEndToEndActiveDirectoryTest(t, sAMAccountName, env)
-		testlib.WaitForFederationDomainStatusPhase(ctx, t, downstream.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(ctx, t, downstream.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(ctx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -420,7 +420,7 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 				SecretName: testlib.CreateClientCredsSecret(t, env.SupervisorUpstreamOIDC.ClientID, env.SupervisorUpstreamOIDC.ClientSecret).Name,
 			},
 		}, idpv1alpha1.PhaseReady)
-		testlib.WaitForFederationDomainStatusPhase(ctx, t, downstream.Name, configv1alpha1.FederationDomainPhaseReady)
+		testlib.WaitForFederationDomainStatusPhase(ctx, t, downstream.Name, supervisorconfigv1alpha1.FederationDomainPhaseReady)
 		testlib.WaitForJWTAuthenticatorStatusPhase(ctx, t, authenticator.Name, authenticationv1alpha1.JWTAuthenticatorPhaseReady)

 		// Use a specific session cache for this test.
@@ -25,7 +25,7 @@ type (
 	// assertionFailure is a single error observed during an iteration of the RequireEventually() loop.
 	assertionFailure struct {
 		format string
-		args   []interface{}
+		args   []any
 	}
 )

@@ -33,7 +33,7 @@ type (
 var _ require.TestingT = (*loopTestingT)(nil)

 // Errorf is called by the assert.Assertions methods to record an error.
-func (e *loopTestingT) Errorf(format string, args ...interface{}) {
+func (e *loopTestingT) Errorf(format string, args ...any) {
 	*e = append(*e, assertionFailure{format, args})
 }

@@ -62,7 +62,7 @@ func RequireEventuallyf(
 	waitFor time.Duration,
 	tick time.Duration,
 	msg string,
-	args ...interface{},
+	args ...any,
 ) {
 	t.Helper()
 	RequireEventually(t, f, waitFor, tick, fmt.Sprintf(msg, args...))
@@ -75,7 +75,7 @@ func RequireEventually(
 	f func(requireEventually *require.Assertions),
 	waitFor time.Duration,
 	tick time.Duration,
-	msgAndArgs ...interface{},
+	msgAndArgs ...any,
 ) {
 	t.Helper()

@@ -129,7 +129,7 @@ func RequireEventuallyWithoutError(
 	f func() (bool, error),
 	waitFor time.Duration,
 	tick time.Duration,
-	msgAndArgs ...interface{},
+	msgAndArgs ...any,
 ) {
 	t.Helper()
 	// This previously used wait.PollImmediate (now deprecated), which did not take a ctx arg in the func.
@@ -146,7 +146,7 @@ func RequireNeverWithoutError(
 	f func() (bool, error),
 	waitFor time.Duration,
 	tick time.Duration,
-	msgAndArgs ...interface{},
+	msgAndArgs ...any,
 ) {
 	t.Helper()
 	// This previously used wait.PollImmediate (now deprecated), which did not take a ctx arg in the func.
@@ -104,7 +104,7 @@ func OpenBrowser(t *testing.T) *Browser {
 	b := &Browser{chromeCtx: chromeCtx}

 	// Subscribe to console events and exceptions to make them available later.
-	chromedp.ListenTarget(chromeCtx, func(ev interface{}) {
+	chromedp.ListenTarget(chromeCtx, func(ev any) {
 		switch ev := ev.(type) {
 		case *chromedpruntime.EventConsoleAPICalled:
 			args := make([]string, len(ev.Args))
@@ -30,7 +30,7 @@ import (
 	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	"go.pinniped.dev/generated/latest/apis/concierge/login/v1alpha1"
 	clientsecretv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/clientsecret/v1alpha1"
-	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	supervisorconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
 	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
 	conciergeclientset "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned"
 	pinnipedsupervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
@@ -357,9 +357,9 @@ func WaitForJWTAuthenticatorStatusConditions(ctx context.Context, t *testing.T,
 func CreateTestFederationDomain(
 	ctx context.Context,
 	t *testing.T,
-	spec configv1alpha1.FederationDomainSpec,
-	expectStatus configv1alpha1.FederationDomainPhase,
-) *configv1alpha1.FederationDomain {
+	spec supervisorconfigv1alpha1.FederationDomainSpec,
+	expectStatus supervisorconfigv1alpha1.FederationDomainPhase,
+) *supervisorconfigv1alpha1.FederationDomain {
 	t.Helper()
 	testEnv := IntegrationEnv(t)

@@ -367,7 +367,7 @@ func CreateTestFederationDomain(
 	defer cancel()

 	federationDomainsClient := NewSupervisorClientset(t).ConfigV1alpha1().FederationDomains(testEnv.SupervisorNamespace)
-	federationDomain, err := federationDomainsClient.Create(createContext, &configv1alpha1.FederationDomain{
+	federationDomain, err := federationDomainsClient.Create(createContext, &supervisorconfigv1alpha1.FederationDomain{
 		ObjectMeta: testObjectMeta(t, "oidc-provider"),
 		Spec:       spec,
 	}, metav1.CreateOptions{})
@@ -393,7 +393,7 @@ func CreateTestFederationDomain(
 	return federationDomain
 }

-func WaitForFederationDomainStatusPhase(ctx context.Context, t *testing.T, federationDomainName string, expectPhase configv1alpha1.FederationDomainPhase) {
+func WaitForFederationDomainStatusPhase(ctx context.Context, t *testing.T, federationDomainName string, expectPhase supervisorconfigv1alpha1.FederationDomainPhase) {
 	t.Helper()
 	testEnv := IntegrationEnv(t)
 	federationDomainsClient := NewSupervisorClientset(t).ConfigV1alpha1().FederationDomains(testEnv.SupervisorNamespace)
@@ -404,7 +404,7 @@ func WaitForFederationDomainStatusPhase(ctx context.Context, t *testing.T, feder
 		requireEventually.Equalf(expectPhase, fd.Status.Phase, "actual status conditions were: %#v", fd.Status.Conditions)

 		// If the FederationDomain was successfully created, ensure all secrets are present before continuing
-		if expectPhase == configv1alpha1.FederationDomainPhaseReady {
+		if expectPhase == supervisorconfigv1alpha1.FederationDomainPhaseReady {
 			requireEventually.NotEmpty(fd.Status.Secrets.JWKS.Name, "expected status.secrets.jwks.name not to be empty")
 			requireEventually.NotEmpty(fd.Status.Secrets.TokenSigningKey.Name, "expected status.secrets.tokenSigningKey.name not to be empty")
 			requireEventually.NotEmpty(fd.Status.Secrets.StateSigningKey.Name, "expected status.secrets.stateSigningKey.name not to be empty")
@@ -510,7 +510,7 @@ func CreateClientCredsSecret(t *testing.T, clientID string, clientSecret string)
 	)
 }

-func CreateOIDCClient(t *testing.T, spec configv1alpha1.OIDCClientSpec, expectedPhase configv1alpha1.OIDCClientPhase) (string, string) {
+func CreateOIDCClient(t *testing.T, spec supervisorconfigv1alpha1.OIDCClientSpec, expectedPhase supervisorconfigv1alpha1.OIDCClientPhase) (string, string) {
 	t.Helper()
 	env := IntegrationEnv(t)
 	client := NewSupervisorClientset(t)
@@ -520,7 +520,7 @@ func CreateOIDCClient(t *testing.T, spec configv1alpha1.OIDCClientSpec, expected
 	oidcClientClient := client.ConfigV1alpha1().OIDCClients(env.SupervisorNamespace)

 	// Create the OIDCClient using GenerateName to get a random name.
-	created, err := oidcClientClient.Create(ctx, &configv1alpha1.OIDCClient{
+	created, err := oidcClientClient.Create(ctx, &supervisorconfigv1alpha1.OIDCClient{
 		ObjectMeta: metav1.ObjectMeta{
 			GenerateName: "client.oauth.pinniped.dev-test-", // use the required name prefix
 			Labels:       map[string]string{"pinniped.dev/test": ""},
@@ -542,7 +542,7 @@ func CreateOIDCClient(t *testing.T, spec configv1alpha1.OIDCClientSpec, expected
 	clientSecret := createOIDCClientSecret(t, created)

 	// Wait for the OIDCClient to enter the expected phase (or time out).
-	var result *configv1alpha1.OIDCClient
+	var result *supervisorconfigv1alpha1.OIDCClient
 	RequireEventuallyf(t, func(requireEventually *require.Assertions) {
 		var err error
 		result, err = oidcClientClient.Get(ctx, created.Name, metav1.GetOptions{})
@@ -553,7 +553,7 @@ func CreateOIDCClient(t *testing.T, spec configv1alpha1.OIDCClientSpec, expected
 	return created.Name, clientSecret
 }

-func createOIDCClientSecret(t *testing.T, forOIDCClient *configv1alpha1.OIDCClient) string {
+func createOIDCClientSecret(t *testing.T, forOIDCClient *supervisorconfigv1alpha1.OIDCClient) string {
 	t.Helper()
 	env := IntegrationEnv(t)
 	supervisorClient := NewSupervisorClientset(t)
@@ -1,11 +1,11 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 package testlib

 import "github.com/davecgh/go-spew/spew"

-func Sdump(a ...interface{}) string {
+func Sdump(a ...any) string {
 	config := spew.ConfigState{
 		Indent:                  "\t",
 		MaxDepth:                10, // prevent log explosion