531d40a82e
fix some unit test failures caused by k8s bump
...
Signed-off-by: Ryan Richard <richardry@vmware.com >
2026-05-06 08:53:00 -07:00
d863e77b19
fix linters errors about deprecated functions
...
Signed-off-by: Ryan Richard <richardry@vmware.com >
2026-05-06 08:34:17 -07:00
9456461192
update lint ignores regarding no-longer deprecated NewClientset() func
2026-03-27 10:54:09 -07:00
9d1c65c3e6
fix deprecation of NewSimpleClientset by using NewClientset or ignoring
2025-12-19 12:00:56 -08:00
10444fb9a3
update unit test expectations for kube 1.35 libraries
2025-12-19 11:11:31 -08:00
2a83d00373
add claimValidationRules, userValidationRules, and claims.extra to JWTAuthenticator CRD
2025-07-16 14:56:44 -07:00
b8e7a64afe
Bump libs to k8s.io@v0.32.3, add codegen for k8s 1.32, and drop codegen for k8s 1.25
2025-05-12 16:36:46 -07:00
d90b3c23ef
introduce new configuration option to disable admission plugin types
2025-03-17 14:49:17 -07:00
ae5aad178d
TokenCredentialRequest uses actual cert expiry time instead of estimate
...
and also audit logs both the NotBefore and NotAfter of the issued cert.
Implemented by changing the return type of the cert issuer helpers
to make them also return the NotBefore and NotAfter values of the new
cert, along with the key PEM and cert PEM.
2024-11-27 13:53:03 -06:00
54b35c30da
rename tokenIdentifier to tokenID in the audit logs
...
Because `tokenID` is more consistent with the names of
the other correlation keys.
2024-11-27 13:53:03 -06:00
4423d472da
allow audit correlation between token being issued and being used
2024-11-27 13:53:03 -06:00
d0905c02dd
use test helper in rest_test.go to reduce some duplication
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
c2018717b6
audit log OIDCClientSecretRequests
2024-11-27 13:53:02 -06:00
438ca437ec
tokencredentialrequest audit logs failed requests
2024-11-27 13:53:01 -06:00
e21e1326b7
tokencredentialrequest audit logs successful responses
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
e126ee5495
all callers of Audit() identify which keys may contain PII
2024-11-27 13:53:01 -06:00
c5f4cce3ae
make Audit() take struct as param for all optional params and redact PII
2024-11-27 13:53:01 -06:00
ced8686d11
add config for audit logging, remove Audit() from Logger interface
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
8cf9c59957
refactor to move audit event message types to their own pkg
2024-11-27 13:53:01 -06:00
4f9530eec7
audit logging WIP
2024-11-27 13:53:00 -06:00
436112252d
Lint fixes
2024-08-27 13:26:39 -05:00
376b83050a
upgrade linter and fix new lint errors
2024-08-19 15:45:32 -07:00
011d6ba71b
Remove plog.Logr, make plog.TestZapr private, and CLI logs do not need a name
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-06-11 17:27:45 -05:00
0076f1251c
Move all mock files into internal/mocks and use mock prefix
2024-05-21 10:38:25 -05:00
fe911a7b7a
Prefer slices package and slices.Concat where possible
2024-05-21 09:31:16 -05:00
f5116cddb4
Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'
...
Enforce importas:
- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
2024-05-21 09:31:15 -05:00
7b36c8ab54
Enable 'copyloopvar' linter
2024-05-10 12:51:02 -05:00
67d3b5fb82
Fix misspell lint issues
2024-05-10 12:51:01 -05:00
0a63dd104d
fix test failures caused by dep bump and update replace statements
2024-05-01 11:01:13 -07:00
bc8aebeffe
Use go.uber.org/mock instead of github.com/golang/mock and rerun mock generation
2024-03-11 13:42:30 -05:00
c7299f4daf
Update dependencies, including Kube packages to v0.29.0
2024-01-04 12:30:22 -08:00
3160b5bad1
Reorganized FederationDomain packages to avoid circular dependency
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2023-09-11 11:09:50 -07:00
63b5f921e1
Use k8s.io/utils/ptr instead of k8s.io/utils/pointer, which is deprecated
2023-07-28 09:16:02 -05:00
bc9afc4554
Aggregated API endpoints now must implement rest.SingularNameProvider
...
This was a change in the interface requirements introduced in Kube 1.27.
2023-05-10 16:50:50 -07:00
976035115e
Stop using pointer pkg functions that were deprecated by dependency bump
2022-12-14 08:47:16 -08:00
12b3079377
integration tests for oidcclientsecretrequest endpoint
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2022-09-21 16:25:41 -07:00
a7ca2cf2dd
fix test name in clientsecretrequest unit tests
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2022-09-21 15:17:23 -07:00
ee3515f23b
Create OIDCClientSecretRequest returns metadata
...
Sets the Name, Namespace, CreationTimestamp fields in the object meta
of the return value.
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2022-09-21 15:17:10 -07:00
6d863a159b
Add unit tests for clientsecretrequest logs
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2022-09-21 15:17:02 -07:00
5e3a912200
Add unit tests for clientsecretrequest
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2022-09-21 15:16:48 -07:00
488296a480
adding tests
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2022-09-21 15:16:12 -07:00
af01c3aeb6
Make kubectl explain work for Pinniped aggregated APIs
...
- Change update-codegen.sh script to also generated openapi code for the
aggregated API types
- Update both aggregated API servers' configuration to make them serve
the openapi docs for the aggregated APIs
- Add new integration test which runs `kubectl explain` for all Pinniped
API resources, and all fields and subfields of those resources
- Update some the comments on the API structs
- Change some names of the tmpl files to make the filename better match
the struct names
2022-09-21 15:15:37 -07:00
1c296e5c4c
Implement the OIDCClientSecretRequest API
...
This commit is a WIP commit because it doesn't include many tests
for the new feature.
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2022-09-21 15:15:07 -07:00
8d8f980e86
Merge branch 'main' into dynamic_clients
2022-08-26 11:35:35 -07:00
c6c2c525a6
Upgrade the linter and fix all new linter warnings
...
Also fix some tests that were broken by bumping golang and dependencies
in the previous commits.
Note that in addition to changes made to satisfy the linter which do not
impact the behavior of the code, this commit also adds ReadHeaderTimeout
to all usages of http.Server to satisfy the linter (and because it
seemed like a good suggestion).
2022-08-24 14:45:55 -07:00
03694d78a8
Implement new Destroy() interface from rest.Storage from Kube v1.25
2022-08-24 12:04:38 -07:00
c117329553
Updates based on code review
...
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2022-06-15 09:38:21 -07:00
8f4285dbff
Change group names
...
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2022-06-13 14:28:05 -07:00
889348e999
WIP aggregated api for oidcclientsecretrequest
...
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2022-06-09 13:47:19 -07:00
0674215ef3
Switch to go.uber.org/zap for JSON formatted logging
...
Signed-off-by: Monis Khan <mok@vmware.com >
2022-05-24 11:17:42 -04:00
Ryan Richard
Joshua Casey
Joshua Casey
Benjamin A. Petersen
Margo Crawford
Monis Khan