Merge pull request #154 from vmware-tanzu/change_release_static_yaml_names

Rename static yaml files in release process

.gitattributes

@@ -0,0 +1,2 @@
+*.go.tmpl linguist-language=Go
+generated/** linguist-generated

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,42 @@
+---
+name: Bug report
+about: Explain a problem you are experiencing
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+<!--
+
+Hey! Thanks for opening an issue!
+
+IMPORTANT: If you believe this bug is a security issue, please don't use this template and follow our [security guidelines](/doc/security.md).
+
+It is recommended that you include screenshots and logs to help everyone achieve a shared understanding of the bug.
+
+-->
+
+**What happened?**
+
+> Please be specific and include screenshots and logs!
+
+**What did you expect to happen?**
+
+> Please be specific and include proposed behavior!
+
+**What is the simplest way to reproduce this behavior?**
+
+**In what environment did you see this bug?**
+- Pinniped server version:
+- Pinniped client version:
+- Pinniped container image (if using a public container image):
+- Pinniped configuration (what IDP(s) are you using? what downstream credential minting mechanisms are you using?):
+- Kubernetes version (use `kubectl version`):
+- Kubernetes installer & version (e.g., `kubeadm version`):
+- Cloud provider or hardware configuration:
+- OS (e.g: `cat /etc/os-release`):
+- Kernel (e.g. `uname -a`):
+- Others:
+
+**What else is there to know about this bug?**

.github/ISSUE_TEMPLATE/feature-proposal.md

@@ -0,0 +1,35 @@
+---
+name: Feature proposal
+about: Suggest a way to improve this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+<!--
+
+Hey! Thanks for opening an issue!
+
+It is recommended that you include screenshots and logs to help everyone achieve a shared understanding of the improvement.
+
+-->
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Are you considering submitting a PR for this feature?**
+
+- **How will this project improvement be tested?**
+- **How does this change the current architecture?**
+- **How will this change be backwards compatible?**
+- **How will this feature be documented?**
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/dependabot.yml

@@ -0,0 +1,13 @@
+# See https://docs.github.com/en/github/administering-a-repository/enabling-and-disabling-version-updates
+
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "daily"

.github/pull_request_template.md

@@ -0,0 +1,41 @@
+<!--
+Thank you for submitting a pull request for Pinniped!
+
+Before submitting, please see the guidelines in CONTRIBUTING.md in this repo.
+
+Please note that a project maintainer will need to review and provide an
+initial approval on the PR to cause CI tests to automatically start.
+Also note that if you push additional commits to the PR, those commits
+will need another initial approval before CI will pick them up.
+
+Reminder: Did you remember to run all the linter, unit tests, and integration tests
+described in CONTRIBUTING.md on your branch before submitting this PR?
+
+Below is a template to help you describe your PR.
+-->
+
+<!--
+Provide a summary of your change. Feel free to use paragraphs or a bulleted list, for example:
+
+- Improves performance by 10,000%.
+- Fixes all bugs.
+- Boils the oceans.
+
+-->
+
+<!--
+Does this PR fix one or more reported issues?
+If yes, use `Fixes #<issue number>` to automatically close the fixed issue(s) when the PR is merged.
+-->
+
+**Release note**:
+
+<!--
+Does this PR introduce a user-facing change?
+
+If no, just write "NONE" in the release-note block below.
+If yes, a release note is required. Enter your extended release note in the block below.
+-->
+```release-note
+
+```

.gitignore

@@ -13,3 +13,9 @@
 
 # Dependency directories (remove the comment below to include it)
 # vendor/
+
+# goland
+.idea
+
+# Intermediate files used by Tilt
+/hack/lib/tilt/build

.golangci.yaml

@@ -0,0 +1,70 @@
+# https://github.com/golangci/golangci-lint#config-file
+run:
+  deadline: 1m
+
+linters:
+  disable-all: true
+  enable:
+  # default linters
+  - deadcode
+  - errcheck
+  - gosimple
+  - govet
+  - ineffassign
+  - staticcheck
+  - structcheck
+  - typecheck
+  - unused
+  - varcheck
+
+  # additional linters for this project (we should disable these if they get annoying).
+  - asciicheck
+  - bodyclose
+  - depguard
+  - dogsled
+  - exhaustive
+  - exportloopref
+  - funlen
+  - gochecknoglobals
+  - gochecknoinits
+  - gocritic
+  - gocyclo
+  - godot
+  - goerr113
+  - goheader
+  - goimports
+  - golint
+  - goprintffuncname
+  - gosec
+  - misspell
+  - nakedret
+  - nestif
+  - noctx
+  - nolintlint
+  - prealloc
+  - rowserrcheck
+  - scopelint
+  - sqlclosecheck
+  - unconvert
+  - unparam
+  - whitespace
+
+issues:
+  exclude-rules:
+    # exclude tests from some rules for things that are useful in a testing context.
+  - path: _test\.go
+    linters:
+    - funlen
+    - gochecknoglobals
+    - goerr113
+
+linters-settings:
+  funlen:
+    lines: 125
+    statements: 50
+  goheader:
+    template: |-
+        Copyright 2020 the Pinniped contributors. All Rights Reserved.
+        SPDX-License-Identifier: Apache-2.0
+  goimports:
+    local-prefixes: go.pinniped.dev

.pre-commit-config.yaml

@@ -0,0 +1,17 @@
+exclude: '^(generated|hack/lib/tilt/tilt_modules)/'
+repos:
+- repo: git://github.com/pre-commit/pre-commit-hooks
+  rev: v3.2.0
+  hooks:
+  # TODO: find a version of this to validate ytt templates?
+  # - id: check-yaml
+  #   args: ['--allow-multiple-documents']
+  - id: check-json
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
+  - id: check-merge-conflict
+  - id: check-added-large-files
+  - id: check-byte-order-marker
+  - id: detect-private-key
+    exclude: testdata
+  - id: mixed-line-ending

ADOPTERS.md

@@ -0,0 +1,9 @@
+# Pinniped Adopters
+
+These organizations are using Pinniped.
+
+* [VMware Tanzu](https://tanzu.vmware.com/) ([Tanzu Mission Control](https://tanzu.vmware.com/mission-control))
+
+If you are using Pinniped and are not on this list, you can open a [pull
+request](https://github.com/vmware-tanzu/pinniped/issues/new?template=feature-proposal.md)
+to add yourself.

CODE_OF_CONDUCT.md

@@ -0,0 +1,84 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at [oss-coc@vmware.com](mailto:oss-coc@vmware.com). All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior,  harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0,
+available at https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -0,0 +1,165 @@
+# Contributing to Pinniped
+
+Contributions to Pinniped are welcome. Here are some things to help you get started.
+
+## Code of Conduct
+
+Please see the [Code of Conduct](./CODE_OF_CONDUCT.md).
+
+## Project Scope
+
+Learn about the [scope](doc/scope.md) of the project.
+
+## Meeting with the Maintainers
+
+The maintainers aspire to hold a video conference every other week with the Pinniped community.
+Any community member may request to add topics to the agenda by contacting a [maintainer](MAINTAINERS.md)
+in advance, or by attending and raising the topic during time remaining after the agenda is covered.
+Typical agenda items include topics regarding the roadmap, feature requests, bug reports, pull requests, etc.
+A [public document](https://docs.google.com/document/d/1qYA35wZV-6bxcH5375vOnIGkNBo7e4OROgsV4Sj8WjQ)
+tracks the agendas and notes for these meetings.
+
+These meetings are currently scheduled for the first and third Thursday mornings of each month
+at 9 AM Pacific Time, using this [Zoom meeting](https://VMware.zoom.us/j/94638309756?pwd=V3NvRXJIdDg5QVc0TUdFM2dYRzgrUT09).
+If the meeting day falls on a US holiday, please consider that occurrence of the meeting to be canceled.
+
+## Discussion
+
+Got a question, comment, or idea? Please don't hesitate to reach out via the GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions) tab at the top of this page.
+
+## Issues
+
+Need an idea for a project to get started contributing? Take a look at the open
+[issues](https://github.com/vmware-tanzu/pinniped/issues).
+Also check to see if any open issues are labeled with
+["good first issue"](https://github.com/vmware-tanzu/pinniped/labels/good%20first%20issue)
+or ["help wanted"](https://github.com/vmware-tanzu/pinniped/labels/help%20wanted).
+
+### Bugs
+
+To file a bug report, please first open an
+[issue](https://github.com/vmware-tanzu/pinniped/issues/new?template=bug_report.md). The project team
+will work with you on your bug report.
+
+Once the bug has been validated, a [pull request](https://github.com/vmware-tanzu/pinniped/compare)
+can be opened to fix the bug.
+
+For specifics on what to include in your bug report, please follow the
+guidelines in the issue and pull request templates.
+
+### Features
+
+To suggest a feature, please first open an
+[issue](https://github.com/vmware-tanzu/pinniped/issues/new?template=feature-proposal.md)
+and tag it with `proposal`, or create a new [Discussion](https://github.com/vmware-tanzu/pinniped/discussions).
+The project team will work with you on your feature request.
+
+Once the feature request has been validated, a [pull request](https://github.com/vmware-tanzu/pinniped/compare)
+can be opened to implement the feature.
+
+For specifics on what to include in your feature request, please follow the
+guidelines in the issue and pull request templates.
+
+## CLA
+
+We welcome contributions from everyone but we can only accept them if you sign
+our Contributor License Agreement (CLA). If you would like to contribute and you
+have not signed it, our CLA-bot will walk you through the process when you open
+a Pull Request. For questions about the CLA process, see the
+[FAQ](https://cla.vmware.com/faq) or submit a question through the GitHub issue
+tracker.
+
+## Building
+
+The [Dockerfile](Dockerfile) at the root of the repo can be used to build and
+package the code. After making a change to the code, rebuild the docker image with the following command.
+
+```bash
+# From the root directory of the repo...
+docker build .
+```
+
+## Testing
+
+### Running Lint
+
+```bash
+./hack/module.sh lint
+```
+
+### Running Unit Tests
+
+```bash
+./hack/module.sh units
+```
+
+### Running Integration Tests
+
+1. Install dependencies:
+
+   - [`kind`](https://kind.sigs.k8s.io/docs/user/quick-start)
+   - [`tilt`](https://docs.tilt.dev/install.html)
+   - [`ytt`](https://carvel.dev/#getting-started)
+   - [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
+   - [`chromedriver`](https://chromedriver.chromium.org/) (and [Chrome](https://www.google.com/chrome/))
+
+   On macOS, these tools can be installed with [Homebrew](https://brew.sh/) (assuming you have Chrome installed already):
+
+   ```bash
+   brew install kind tilt-dev/tap/tilt k14s/tap/ytt kubectl chromedriver
+   ```
+
+1. Create a local Kubernetes cluster using `kind`:
+
+   ```bash
+   ./hack/kind-up.sh
+   ```
+
+1. Install Pinniped and supporting dependencies using `tilt`:
+
+   ```bash
+   ./hack/tilt-up.sh
+   ```
+
+   Tilt will continue running and live-updating the Pinniped deployment whenever the code changes.
+
+1. Run the Pinniped integration tests:
+
+   ```bash
+   source /tmp/integration-test-env && go test -v -count 1 ./test/integration
+   ```
+
+To uninstall the test environment, run `./hack/tilt-down.sh`.
+To destroy the local Kubernetes cluster, run `./hack/kind-down.sh`.
+
+### Observing Tests on the Continuous Integration Environment
+
+[CI](https://hush-house.pivotal.io/teams/tanzu-user-auth/pipelines/pinniped-pull-requests)
+will not be triggered on a pull request until the pull request is reviewed and
+approved for CI by a project [maintainer](MAINTAINERS.md). Once CI is triggered,
+the progress and results will appear on the Github page for that
+[pull request](https://github.com/vmware-tanzu/pinniped/pulls) as checks. Links
+will appear to view the details of each check.
+
+## Documentation
+
+Any pull request which adds a new feature or changes the behavior of any feature which was previously documented
+should include updates to the documentation. All documentation lives in this repository. This project aspires to
+follow the Kubernetes [documentation style guide](https://kubernetes.io/docs/contribute/style/style-guide).
+
+## Pre-commit Hooks
+
+This project uses [pre-commit](https://pre-commit.com/) to agree on some conventions about whitespace/file encoding.
+
+```bash
+$ brew install pre-commit
+[...]
+$ pre-commit install
+pre-commit installed at .git/hooks/pre-commit
+```
+
+## Becoming a Pinniped Maintainer
+
+Regular contributors who are active in the Pinniped community and who have contributed at least several
+significant pull requests may be considered for promotion to become a maintainer upon request. Please
+contact an existing [maintainer](MAINTAINERS.md) if you would like to be considered.

Dockerfile

@@ -0,0 +1,41 @@
+# Copyright 2020 the Pinniped contributors. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+FROM golang:1.15.3 as build-env
+
+WORKDIR /work
+# Get dependencies first so they can be cached as a layer
+COPY go.* ./
+COPY generated/1.19/apis/go.* ./generated/1.19/apis/
+COPY generated/1.19/client/go.* ./generated/1.19/client/
+RUN go mod download
+
+# Copy only the production source code to avoid cache misses when editing other files
+COPY generated ./generated
+COPY cmd ./cmd
+COPY internal ./internal
+COPY tools ./tools
+COPY hack ./hack
+
+# Build the executable binary (CGO_ENABLED=0 means static linking)
+RUN mkdir out \
+  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$(hack/get-ldflags.sh)" -o out ./cmd/pinniped-concierge/... \
+  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$(hack/get-ldflags.sh)" -o out ./cmd/pinniped-supervisor/... \
+  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out ./cmd/local-user-authenticator/...
+
+# Use a runtime image based on Debian slim
+FROM debian:10.6-slim
+
+# Copy the binaries from the build-env stage
+COPY --from=build-env /work/out/pinniped-concierge /usr/local/bin/pinniped-concierge
+COPY --from=build-env /work/out/pinniped-supervisor /usr/local/bin/pinniped-supervisor
+COPY --from=build-env /work/out/local-user-authenticator /usr/local/bin/local-user-authenticator
+
+# Document the ports
+EXPOSE 8080 8443
+
+# Run as non-root for security posture
+USER 1001:1001
+
+# Set the entrypoint
+ENTRYPOINT ["/usr/local/bin/pinniped-concierge"]

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

MAINTAINERS.md

@@ -0,0 +1,17 @@
+# Pinniped Maintainers
+
+This is the current list of maintainers for the Pinniped project.
+
+| Maintainer | GitHub ID | Affiliation |
+| --------------- | --------- | ----------- |
+| Andrew Keesler | [ankeesler](https://github.com/ankeesler) | [VMware](https://www.github.com/vmware/) |
+| Matt Moyer | [mattmoyer](https://github.com/mattmoyer) | [VMware](https://www.github.com/vmware/) |
+| Pablo Schuhmacher | [pabloschuhmacher](https://github.com/pabloschuhmacher) | [VMware](https://www.github.com/vmware/) |
+| Ryan Richard | [cfryanr](https://github.com/cfryanr) | [VMware](https://www.github.com/vmware/) |
+
+## Pinniped Contributors & Stakeholders
+
+| Feature Area | Lead |
+| ----------------------------- | :---------------------: |
+| Technical Lead | Matt Moyer (mattmoyer) |
+| Product Management | Pablo Schuhmacher (pabloschuhmacher) |

README.md

@@ -1 +1,55 @@
-# placeholder-name
+<img src="doc/img/pinniped_logo.svg" alt="Pinniped Logo" width="100%"/>
+
+## Overview
+
+Pinniped provides identity services to Kubernetes.
+
+Pinniped allows cluster administrators to easily plug in external identity
+providers (IDPs) into Kubernetes clusters. This is achieved via a uniform
+install procedure across all types and origins of Kubernetes clusters,
+declarative configuration via Kubernetes APIs, enterprise-grade integrations
+with IDPs, and distribution-specific integration strategies.
+
+### Example Use Cases
+
+* Your team uses a large enterprise IDP, and has many clusters that they
+  manage. Pinniped provides:
+  * Seamless and robust integration with the IDP
+  * Easy installation across clusters of any type and origin
+  * A simplified login flow across all clusters
+* Your team shares a single cluster. Pinniped provides:
+  * Simple configuration to integrate an IDP
+  * Individual, revocable identities
+
+### Architecture
+
+Pinniped offers credential exchange to enable a user to exchange an external IDP
+credential for a short-lived, cluster-specific credential. Pinniped supports various
+IDP types and implements different integration strategies for various Kubernetes
+distributions to make authentication possible.
+
+To learn more, see [doc/architecture.md](doc/architecture.md).
+
+<img src="doc/img/pinniped_architecture.svg" alt="Pinniped Architecture Sketch" width="300px"/>
+
+## Trying Pinniped
+
+Care to kick the tires? It's easy to [install and try Pinniped](doc/demo.md).
+
+## Discussion
+
+Got a question, comment, or idea? Please don't hesitate to reach out via the GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions) tab at the top of this page.
+
+## Contributions
+
+Contributions are welcome. Before contributing, please see the [contributing guide](CONTRIBUTING.md).
+
+## Reporting Security Vulnerabilities
+
+Please follow the procedure described in [SECURITY.md](SECURITY.md).
+
+## License
+
+Pinniped is open source and licensed under Apache License Version 2.0. See [LICENSE](LICENSE).
+
+Copyright 2020 the Pinniped contributors. All Rights Reserved.

SECURITY.md

@@ -0,0 +1,12 @@
+# Reporting a Vulnerability
+
+Pinniped development is sponsored by VMware, and the Pinniped team encourages users
+who become aware of a security vulnerability in Pinniped to report any potential
+vulnerabilities found to security@vmware.com. If possible, please include a description
+of the effects of the vulnerability, reproduction steps, and a description of in which
+version of Pinniped or its dependencies the vulnerability was discovered.
+The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
+
+The Pinniped team hopes that users encountering a new vulnerability will contact
+us privately as it is in the best interests of our users that the Pinniped team has
+an opportunity to investigate and confirm a suspected vulnerability before it becomes public knowledge.

apis/README.md

@@ -0,0 +1,5 @@
+# API Generation Templates
+
+This directory contains a template for generating our Kubernetes API code across several Kubernetes versions.
+
+See the [`./generated`](../generated) directory for the rendered output.

apis/concierge/authentication/doc.go.tmpl

@@ -0,0 +1,8 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:deepcopy-gen=package
+// +groupName=authentication.concierge.pinniped.dev
+
+// Package authentication is the internal version of the Pinniped concierge authentication API.
+package authentication

apis/concierge/authentication/v1alpha1/conversion.go.tmpl

@@ -0,0 +1,4 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1

apis/concierge/authentication/v1alpha1/defaults.go.tmpl

@@ -0,0 +1,12 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}

apis/concierge/authentication/v1alpha1/doc.go.tmpl

@@ -0,0 +1,11 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/authentication
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=authentication.concierge.pinniped.dev
+
+// Package v1alpha1 is the v1alpha1 version of the Pinniped concierge authentication API.
+package v1alpha1

apis/concierge/authentication/v1alpha1/register.go.tmpl

@@ -0,0 +1,43 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const GroupName = "authentication.concierge.pinniped.dev"
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+var (
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&WebhookAuthenticator{},
+		&WebhookAuthenticatorList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource.
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}

apis/concierge/authentication/v1alpha1/types_meta.go.tmpl

@@ -0,0 +1,75 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// ConditionStatus is effectively an enum type for Condition.Status.
+type ConditionStatus string
+
+// These are valid condition statuses. "ConditionTrue" means a resource is in the condition.
+// "ConditionFalse" means a resource is not in the condition. "ConditionUnknown" means kubernetes
+// can't decide if a resource is in the condition or not. In the future, we could add other
+// intermediate conditions, e.g. ConditionDegraded.
+const (
+	ConditionTrue    ConditionStatus = "True"
+	ConditionFalse   ConditionStatus = "False"
+	ConditionUnknown ConditionStatus = "Unknown"
+)
+
+// Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API
+// version we can switch to using the upstream type.
+// See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
+type Condition struct {
+	// type of condition in CamelCase or in foo.example.com/CamelCase.
+	// ---
+	// Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+	// useful (see .node.status.conditions), the ability to deconflict is important.
+	// The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
+	// +kubebuilder:validation:MaxLength=316
+	Type string `json:"type"`
+
+	// status of the condition, one of True, False, Unknown.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=True;False;Unknown
+	Status ConditionStatus `json:"status"`
+
+	// observedGeneration represents the .metadata.generation that the condition was set based upon.
+	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+	// with respect to the current state of the instance.
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// lastTransitionTime is the last time the condition transitioned from one status to another.
+	// This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Type=string
+	// +kubebuilder:validation:Format=date-time
+	LastTransitionTime metav1.Time `json:"lastTransitionTime"`
+
+	// reason contains a programmatic identifier indicating the reason for the condition's last transition.
+	// Producers of specific condition types may define expected values and meanings for this field,
+	// and whether the values are considered a guaranteed API.
+	// The value should be a CamelCase string.
+	// This field may not be empty.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=1024
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+	Reason string `json:"reason"`
+
+	// message is a human readable message indicating details about the transition.
+	// This may be an empty string.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=32768
+	Message string `json:"message"`
+}

apis/concierge/authentication/v1alpha1/types_tls.go.tmpl

@@ -0,0 +1,11 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+// Configuration for configuring TLS on various authenticators.
+type TLSSpec struct {
+	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
+	// +optional
+	CertificateAuthorityData string `json:"certificateAuthorityData,omitempty"`
+}

apis/concierge/authentication/v1alpha1/types_webhook.go.tmpl

@@ -0,0 +1,53 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// Status of a webhook authenticator.
+type WebhookAuthenticatorStatus struct {
+	// Represents the observations of the authenticator's current state.
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	Conditions []Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+}
+
+// Spec for configuring a webhook authenticator.
+type WebhookAuthenticatorSpec struct {
+	// Webhook server endpoint URL.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^https://`
+	Endpoint string `json:"endpoint"`
+
+	// TLS configuration.
+	// +optional
+	TLS *TLSSpec `json:"tls,omitempty"`
+}
+
+// WebhookAuthenticator describes the configuration of a webhook authenticator.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=all;authenticator;authenticators
+// +kubebuilder:printcolumn:name="Endpoint",type=string,JSONPath=`.spec.endpoint`
+type WebhookAuthenticator struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec for configuring the authenticator.
+	Spec WebhookAuthenticatorSpec `json:"spec"`
+
+	// Status of the authenticator.
+	Status WebhookAuthenticatorStatus `json:"status,omitempty"`
+}
+
+// List of WebhookAuthenticator objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type WebhookAuthenticatorList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []WebhookAuthenticator `json:"items"`
+}

apis/concierge/config/doc.go.tmpl

@@ -0,0 +1,8 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:deepcopy-gen=package
+// +groupName=config.concierge.pinniped.dev
+
+// Package config is the internal version of the Pinniped concierge configuration API.
+package config

apis/concierge/config/types.go.tmpl

@@ -0,0 +1,4 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package config

apis/concierge/config/v1alpha1/conversion.go.tmpl

@@ -0,0 +1,4 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1

apis/concierge/config/v1alpha1/defaults.go.tmpl

@@ -0,0 +1,12 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}

apis/concierge/config/v1alpha1/doc.go.tmpl

@@ -0,0 +1,11 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/config
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=config.concierge.pinniped.dev
+
+// Package v1alpha1 is the v1alpha1 version of the Pinniped concierge configuration API.
+package v1alpha1

apis/concierge/config/v1alpha1/register.go.tmpl

@@ -0,0 +1,43 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const GroupName = "config.concierge.pinniped.dev"
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+var (
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&CredentialIssuer{},
+		&CredentialIssuerList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource.
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}

apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl

@@ -0,0 +1,88 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +kubebuilder:validation:Enum=KubeClusterSigningCertificate
+type StrategyType string
+
+// +kubebuilder:validation:Enum=Success;Error
+type StrategyStatus string
+
+// +kubebuilder:validation:Enum=FetchedKey;CouldNotFetchKey
+type StrategyReason string
+
+const (
+	KubeClusterSigningCertificateStrategyType = StrategyType("KubeClusterSigningCertificate")
+
+	SuccessStrategyStatus = StrategyStatus("Success")
+	ErrorStrategyStatus   = StrategyStatus("Error")
+
+	CouldNotFetchKeyStrategyReason = StrategyReason("CouldNotFetchKey")
+	FetchedKeyStrategyReason       = StrategyReason("FetchedKey")
+)
+
+// Status of a credential issuer.
+type CredentialIssuerStatus struct {
+	// List of integration strategies that were attempted by Pinniped.
+	Strategies []CredentialIssuerStrategy `json:"strategies"`
+
+	// Information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
+	// +optional
+	KubeConfigInfo *CredentialIssuerKubeConfigInfo `json:"kubeConfigInfo,omitempty"`
+}
+
+// Information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
+type CredentialIssuerKubeConfigInfo struct {
+	// The K8s API server URL.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^https://|^http://`
+	Server string `json:"server"`
+
+	// The K8s API server CA bundle.
+	// +kubebuilder:validation:MinLength=1
+	CertificateAuthorityData string `json:"certificateAuthorityData"`
+}
+
+// Status of an integration strategy that was attempted by Pinniped.
+type CredentialIssuerStrategy struct {
+	// Type of integration attempted.
+	Type StrategyType `json:"type"`
+
+	// Status of the attempted integration strategy.
+	Status StrategyStatus `json:"status"`
+
+	// Reason for the current status.
+	Reason StrategyReason `json:"reason"`
+
+	// Human-readable description of the current status.
+	// +kubebuilder:validation:MinLength=1
+	Message string `json:"message"`
+
+	// When the status was last checked.
+	LastUpdateTime metav1.Time `json:"lastUpdateTime"`
+}
+
+// Describes the configuration status of a Pinniped credential issuer.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type CredentialIssuer struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Status of the credential issuer.
+	Status CredentialIssuerStatus `json:"status"`
+}
+
+// List of CredentialIssuer objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type CredentialIssuerList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []CredentialIssuer `json:"items"`
+}

apis/concierge/login/doc.go.tmpl

@@ -0,0 +1,8 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:deepcopy-gen=package
+// +groupName=login.concierge.pinniped.dev
+
+// Package login is the internal version of the Pinniped login API.
+package login

apis/concierge/login/register.go.tmpl

@@ -0,0 +1,38 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package login
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const GroupName = "login.concierge.pinniped.dev"
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
+
+// Kind takes an unqualified kind and returns back a Group qualified GroupKind.
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns back a Group qualified GroupResource.
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TokenCredentialRequest{},
+		&TokenCredentialRequestList{},
+	)
+	return nil
+}

apis/concierge/login/types_clustercred.go.tmpl

@@ -0,0 +1,21 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package login
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// ClusterCredential is a credential (token or certificate) which is valid on the Kubernetes cluster.
+type ClusterCredential struct {
+	// ExpirationTimestamp indicates a time when the provided credentials expire.
+	ExpirationTimestamp metav1.Time
+
+	// Token is a bearer token used by the client for request authentication.
+	Token string
+
+	// PEM-encoded client TLS certificates (including intermediates, if any).
+	ClientCertificateData string
+
+	// PEM-encoded private key for the above certificate.
+	ClientKeyData string
+}

apis/concierge/login/types_token.go.tmpl

@@ -0,0 +1,48 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package login
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type TokenCredentialRequestSpec struct {
+	// Bearer token supplied with the credential request.
+	Token string
+
+	// Reference to an authenticator which can validate this credential request.
+	Authenticator corev1.TypedLocalObjectReference
+}
+
+type TokenCredentialRequestStatus struct {
+	// A ClusterCredential will be returned for a successful credential request.
+	// +optional
+	Credential *ClusterCredential
+
+	// An error message will be returned for an unsuccessful credential request.
+	// +optional
+	Message *string
+}
+
+// TokenCredentialRequest submits an IDP-specific credential to Pinniped in exchange for a cluster-specific credential.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TokenCredentialRequest struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+
+	Spec   TokenCredentialRequestSpec
+	Status TokenCredentialRequestStatus
+}
+
+// TokenCredentialRequestList is a list of TokenCredentialRequest objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TokenCredentialRequestList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+
+	// Items is a list of TokenCredentialRequest
+	Items []TokenCredentialRequest
+}

apis/concierge/login/v1alpha1/conversion.go.tmpl

@@ -0,0 +1,4 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1

apis/concierge/login/v1alpha1/defaults.go.tmpl

@@ -0,0 +1,12 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}

apis/concierge/login/v1alpha1/doc.go.tmpl

@@ -0,0 +1,11 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/login
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=login.concierge.pinniped.dev
+
+// Package v1alpha1 is the v1alpha1 version of the Pinniped login API.
+package v1alpha1

apis/concierge/login/v1alpha1/register.go.tmpl

@@ -0,0 +1,43 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const GroupName = "login.concierge.pinniped.dev"
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+var (
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TokenCredentialRequest{},
+		&TokenCredentialRequestList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource.
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}

apis/concierge/login/v1alpha1/types_clustercred.go.tmpl

@@ -0,0 +1,22 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// ClusterCredential is the cluster-specific credential returned on a successful credential request. It
+// contains either a valid bearer token or a valid TLS certificate and corresponding private key for the cluster.
+type ClusterCredential struct {
+	// ExpirationTimestamp indicates a time when the provided credentials expire.
+	ExpirationTimestamp metav1.Time `json:"expirationTimestamp,omitempty"`
+
+	// Token is a bearer token used by the client for request authentication.
+	Token string `json:"token,omitempty"`
+
+	// PEM-encoded client TLS certificates (including intermediates, if any).
+	ClientCertificateData string `json:"clientCertificateData,omitempty"`
+
+	// PEM-encoded private key for the above certificate.
+	ClientKeyData string `json:"clientKeyData,omitempty"`
+}

apis/concierge/login/v1alpha1/types_token.go.tmpl

@@ -0,0 +1,49 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// TokenCredentialRequestSpec is the specification of a TokenCredentialRequest, expected on requests to the Pinniped API.
+type TokenCredentialRequestSpec struct {
+	// Bearer token supplied with the credential request.
+	Token string `json:"token,omitempty"`
+
+	// Reference to an authenticator which can validate this credential request.
+	Authenticator corev1.TypedLocalObjectReference `json:"authenticator"`
+}
+
+// TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned on responses to the Pinniped API.
+type TokenCredentialRequestStatus struct {
+	// A Credential will be returned for a successful credential request.
+	// +optional
+	Credential *ClusterCredential `json:"credential,omitempty"`
+
+	// An error message will be returned for an unsuccessful credential request.
+	// +optional
+	Message *string `json:"message,omitempty"`
+}
+
+// TokenCredentialRequest submits an IDP-specific credential to Pinniped in exchange for a cluster-specific credential.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TokenCredentialRequest struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   TokenCredentialRequestSpec   `json:"spec,omitempty"`
+	Status TokenCredentialRequestStatus `json:"status,omitempty"`
+}
+
+// TokenCredentialRequestList is a list of TokenCredentialRequest objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TokenCredentialRequestList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TokenCredentialRequest `json:"items"`
+}

apis/supervisor/config/doc.go.tmpl

@@ -0,0 +1,8 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:deepcopy-gen=package
+// +groupName=config.supervisor.pinniped.dev
+
+// Package config is the internal version of the Pinniped configuration API.
+package config

apis/supervisor/config/types.go.tmpl

@@ -0,0 +1,4 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package config

apis/supervisor/config/v1alpha1/conversion.go.tmpl

@@ -0,0 +1,4 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1

apis/supervisor/config/v1alpha1/defaults.go.tmpl

@@ -0,0 +1,12 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}

apis/supervisor/config/v1alpha1/doc.go.tmpl

@@ -0,0 +1,11 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/supervisor/config
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=config.supervisor.pinniped.dev
+
+// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor configuration API.
+package v1alpha1

apis/supervisor/config/v1alpha1/register.go.tmpl

@@ -0,0 +1,43 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const GroupName = "config.supervisor.pinniped.dev"
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+var (
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&OIDCProvider{},
+		&OIDCProviderList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource.
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}

apis/supervisor/config/v1alpha1/types_oidcprovider.go.tmpl

@@ -0,0 +1,107 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +kubebuilder:validation:Enum=Success;Duplicate;Invalid
+type OIDCProviderStatusCondition string
+
+const (
+	SuccessOIDCProviderStatusCondition                         = OIDCProviderStatusCondition("Success")
+	DuplicateOIDCProviderStatusCondition                       = OIDCProviderStatusCondition("Duplicate")
+	SameIssuerHostMustUseSameSecretOIDCProviderStatusCondition = OIDCProviderStatusCondition("SameIssuerHostMustUseSameSecret")
+	InvalidOIDCProviderStatusCondition                         = OIDCProviderStatusCondition("Invalid")
+)
+
+// OIDCProviderTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
+type OIDCProviderTLSSpec struct {
+	// SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains
+	// the TLS serving certificate for the HTTPS endpoints served by this OIDCProvider. When provided, the TLS Secret
+	// named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use
+	// for TLS.
+	//
+	// Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) supported by all major browsers.
+	//
+	// SecretName is required if you would like to use different TLS certificates for issuers of different hostnames.
+	// SNI requests do not include port numbers, so all issuers with the same DNS hostname must use the same
+	// SecretName value even if they have different port numbers.
+	//
+	// SecretName is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an
+	// Ingress). It is also not required when you would like all requests to this OIDC Provider's HTTPS endpoints to
+	// use the default TLS certificate, which is configured elsewhere.
+	//
+	// When your Issuer URL's host is an IP address, then this field is ignored. SNI does not work for IP addresses.
+	//
+	// +optional
+	SecretName string `json:"secretName,omitempty"`
+}
+
+// OIDCProviderSpec is a struct that describes an OIDC Provider.
+type OIDCProviderSpec struct {
+	// Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the
+	// identifier that it will use for the iss claim in issued JWTs. This field will also be used as
+	// the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is
+	// https://example.com/foo, then your authorization endpoint will look like
+	// https://example.com/foo/some/path/to/auth/endpoint).
+	//
+	// See
+	// https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
+	// +kubebuilder:validation:MinLength=1
+	Issuer string `json:"issuer"`
+
+	// TLS configures how this OIDCProvider is served over Transport Layer Security (TLS).
+	// +optional
+	TLS *OIDCProviderTLSSpec `json:"tls,omitempty"`
+}
+
+// OIDCProviderStatus is a struct that describes the actual state of an OIDC Provider.
+type OIDCProviderStatus struct {
+	// Status holds an enum that describes the state of this OIDC Provider. Note that this Status can
+	// represent success or failure.
+	// +optional
+	Status OIDCProviderStatusCondition `json:"status,omitempty"`
+
+	// Message provides human-readable details about the Status.
+	// +optional
+	Message string `json:"message,omitempty"`
+
+	// LastUpdateTime holds the time at which the Status was last updated. It is a pointer to get
+	// around some undesirable behavior with respect to the empty metav1.Time value (see
+	// https://github.com/kubernetes/kubernetes/issues/86811).
+	// +optional
+	LastUpdateTime *metav1.Time `json:"lastUpdateTime,omitempty"`
+
+	// JWKSSecret holds the name of the secret in which this OIDC Provider's signing/verification keys
+	// are stored. If it is empty, then the signing/verification keys are either unknown or they don't
+	// exist.
+	// +optional
+	JWKSSecret corev1.LocalObjectReference `json:"jwksSecret,omitempty"`
+}
+
+// OIDCProvider describes the configuration of an OIDC provider.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type OIDCProvider struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec of the OIDC provider.
+	Spec OIDCProviderSpec `json:"spec"`
+
+	// Status of the OIDC provider.
+	Status OIDCProviderStatus `json:"status,omitempty"`
+}
+
+// List of OIDCProvider objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type OIDCProviderList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []OIDCProvider `json:"items"`
+}

cmd/local-user-authenticator/main.go

@@ -0,0 +1,400 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package main provides a authentication webhook program.
+//
+// This webhook is meant to be used in demo settings to play around with
+// Pinniped. As well, it can come in handy in integration tests.
+//
+// This webhook is NOT meant for use in production systems.
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"encoding/csv"
+	"encoding/json"
+	"fmt"
+	"mime"
+	"net"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+	authenticationv1beta1 "k8s.io/api/authentication/v1beta1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kubeinformers "k8s.io/client-go/informers"
+	corev1informers "k8s.io/client-go/informers/core/v1"
+	"k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/klog/v2"
+
+	"go.pinniped.dev/internal/constable"
+	"go.pinniped.dev/internal/controller/apicerts"
+	"go.pinniped.dev/internal/controllerlib"
+	"go.pinniped.dev/internal/dynamiccert"
+)
+
+const (
+	// This string must match the name of the Namespace declared in the deployment yaml.
+	namespace = "local-user-authenticator"
+	// This string must match the name of the Service declared in the deployment yaml.
+	serviceName = "local-user-authenticator"
+
+	singletonWorker       = 1
+	defaultResyncInterval = 3 * time.Minute
+
+	invalidRequest = constable.Error("invalid request")
+)
+
+type webhook struct {
+	certProvider   dynamiccert.Provider
+	secretInformer corev1informers.SecretInformer
+}
+
+func newWebhook(
+	certProvider dynamiccert.Provider,
+	secretInformer corev1informers.SecretInformer,
+) *webhook {
+	return &webhook{
+		certProvider:   certProvider,
+		secretInformer: secretInformer,
+	}
+}
+
+// start runs the webhook in a separate goroutine and returns whether or not the
+// webhook was started successfully.
+func (w *webhook) start(ctx context.Context, l net.Listener) error {
+	server := http.Server{
+		Handler: w,
+		TLSConfig: &tls.Config{
+			MinVersion: tls.VersionTLS13,
+			GetCertificate: func(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+				certPEM, keyPEM := w.certProvider.CurrentCertKeyContent()
+				cert, err := tls.X509KeyPair(certPEM, keyPEM)
+				return &cert, err
+			},
+		},
+	}
+
+	errCh := make(chan error)
+	go func() {
+		// Per ListenAndServeTLS doc, the {cert,key}File parameters can be empty
+		// since we want to use the certs from http.Server.TLSConfig.
+		errCh <- server.ServeTLS(l, "", "")
+	}()
+
+	go func() {
+		select {
+		case err := <-errCh:
+			klog.InfoS("server exited", "err", err)
+		case <-ctx.Done():
+			klog.InfoS("server context cancelled", "err", ctx.Err())
+			if err := server.Shutdown(context.Background()); err != nil {
+				klog.InfoS("server shutdown failed", "err", err)
+			}
+		}
+	}()
+
+	return nil
+}
+
+func (w *webhook) ServeHTTP(rsp http.ResponseWriter, req *http.Request) {
+	username, password, err := getUsernameAndPasswordFromRequest(rsp, req)
+	if err != nil {
+		return
+	}
+	defer func() { _ = req.Body.Close() }()
+
+	secret, err := w.secretInformer.Lister().Secrets(namespace).Get(username)
+	notFound := k8serrors.IsNotFound(err)
+	if err != nil && !notFound {
+		klog.InfoS("could not get secret", "err", err)
+		rsp.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	if notFound {
+		klog.InfoS("user not found")
+		respondWithUnauthenticated(rsp)
+		return
+	}
+
+	passwordMatches := bcrypt.CompareHashAndPassword(
+		secret.Data["passwordHash"],
+		[]byte(password),
+	) == nil
+	if !passwordMatches {
+		klog.InfoS("authentication failed: wrong password")
+		respondWithUnauthenticated(rsp)
+		return
+	}
+
+	groups := []string{}
+	groupsBuf := bytes.NewBuffer(secret.Data["groups"])
+	if groupsBuf.Len() > 0 {
+		groupsCSVReader := csv.NewReader(groupsBuf)
+		groups, err = groupsCSVReader.Read()
+		if err != nil {
+			klog.InfoS("could not read groups", "err", err)
+			rsp.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		trimLeadingAndTrailingWhitespace(groups)
+	}
+
+	klog.InfoS("successful authentication")
+	respondWithAuthenticated(rsp, secret.ObjectMeta.Name, string(secret.UID), groups)
+}
+
+func getUsernameAndPasswordFromRequest(rsp http.ResponseWriter, req *http.Request) (string, string, error) {
+	if req.URL.Path != "/authenticate" {
+		klog.InfoS("received request path other than /authenticate", "path", req.URL.Path)
+		rsp.WriteHeader(http.StatusNotFound)
+		return "", "", invalidRequest
+	}
+
+	if req.Method != http.MethodPost {
+		klog.InfoS("received request method other than post", "method", req.Method)
+		rsp.WriteHeader(http.StatusMethodNotAllowed)
+		return "", "", invalidRequest
+	}
+
+	if !headerContains(req, "Content-Type", "application/json") {
+		klog.InfoS("content type is not application/json", "Content-Type", req.Header.Values("Content-Type"))
+		rsp.WriteHeader(http.StatusUnsupportedMediaType)
+		return "", "", invalidRequest
+	}
+
+	if !headerContains(req, "Accept", "application/json") &&
+		!headerContains(req, "Accept", "application/*") &&
+		!headerContains(req, "Accept", "*/*") {
+		klog.InfoS("client does not accept application/json", "Accept", req.Header.Values("Accept"))
+		rsp.WriteHeader(http.StatusUnsupportedMediaType)
+		return "", "", invalidRequest
+	}
+
+	if req.Body == nil {
+		klog.InfoS("invalid nil body")
+		rsp.WriteHeader(http.StatusBadRequest)
+		return "", "", invalidRequest
+	}
+
+	var body authenticationv1beta1.TokenReview
+	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+		klog.InfoS("failed to decode body", "err", err)
+		rsp.WriteHeader(http.StatusBadRequest)
+		return "", "", invalidRequest
+	}
+
+	if body.APIVersion != authenticationv1beta1.SchemeGroupVersion.String() {
+		klog.InfoS("invalid TokenReview apiVersion", "apiVersion", body.APIVersion)
+		rsp.WriteHeader(http.StatusBadRequest)
+		return "", "", invalidRequest
+	}
+
+	if body.Kind != "TokenReview" {
+		klog.InfoS("invalid TokenReview kind", "kind", body.Kind)
+		rsp.WriteHeader(http.StatusBadRequest)
+		return "", "", invalidRequest
+	}
+
+	tokenSegments := strings.SplitN(body.Spec.Token, ":", 2)
+	if len(tokenSegments) != 2 {
+		klog.InfoS("bad token format in request")
+		rsp.WriteHeader(http.StatusBadRequest)
+		return "", "", invalidRequest
+	}
+
+	return tokenSegments[0], tokenSegments[1], nil
+}
+
+func headerContains(req *http.Request, headerName, s string) bool {
+	headerValues := req.Header.Values(headerName)
+	for i := range headerValues {
+		mimeTypes := strings.Split(headerValues[i], ",")
+		for _, mimeType := range mimeTypes {
+			mediaType, _, _ := mime.ParseMediaType(mimeType)
+			if mediaType == s {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func trimLeadingAndTrailingWhitespace(ss []string) {
+	for i := range ss {
+		ss[i] = strings.TrimSpace(ss[i])
+	}
+}
+
+func respondWithUnauthenticated(rsp http.ResponseWriter) {
+	rsp.Header().Add("Content-Type", "application/json")
+
+	body := authenticationv1beta1.TokenReview{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "TokenReview",
+			APIVersion: authenticationv1beta1.SchemeGroupVersion.String(),
+		},
+		Status: authenticationv1beta1.TokenReviewStatus{
+			Authenticated: false,
+		},
+	}
+	if err := json.NewEncoder(rsp).Encode(body); err != nil {
+		klog.InfoS("could not encode response", "err", err)
+		rsp.WriteHeader(http.StatusInternalServerError)
+	}
+}
+
+func respondWithAuthenticated(
+	rsp http.ResponseWriter,
+	username, uid string,
+	groups []string,
+) {
+	rsp.Header().Add("Content-Type", "application/json")
+	body := authenticationv1beta1.TokenReview{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "TokenReview",
+			APIVersion: authenticationv1beta1.SchemeGroupVersion.String(),
+		},
+		Status: authenticationv1beta1.TokenReviewStatus{
+			Authenticated: true,
+			User: authenticationv1beta1.UserInfo{
+				Username: username,
+				Groups:   groups,
+				UID:      uid,
+			},
+		},
+	}
+	if err := json.NewEncoder(rsp).Encode(body); err != nil {
+		klog.InfoS("could not encode response", "err", err)
+		rsp.WriteHeader(http.StatusInternalServerError)
+	}
+}
+
+func newK8sClient() (kubernetes.Interface, error) {
+	kubeConfig, err := restclient.InClusterConfig()
+	if err != nil {
+		return nil, fmt.Errorf("could not load in-cluster configuration: %w", err)
+	}
+
+	// Connect to the core Kubernetes API.
+	kubeClient, err := kubernetes.NewForConfig(kubeConfig)
+	if err != nil {
+		return nil, fmt.Errorf("could not load in-cluster configuration: %w", err)
+	}
+
+	return kubeClient, nil
+}
+
+func startControllers(
+	ctx context.Context,
+	dynamicCertProvider dynamiccert.Provider,
+	kubeClient kubernetes.Interface,
+	kubeInformers kubeinformers.SharedInformerFactory,
+) {
+	aVeryLongTime := time.Hour * 24 * 365 * 100
+
+	const certsSecretResourceName = "local-user-authenticator-tls-serving-certificate"
+
+	// Create controller manager.
+	controllerManager := controllerlib.
+		NewManager().
+		WithController(
+			apicerts.NewCertsManagerController(
+				namespace,
+				certsSecretResourceName,
+				map[string]string{
+					"app": "local-user-authenticator",
+				},
+				kubeClient,
+				kubeInformers.Core().V1().Secrets(),
+				controllerlib.WithInformer,
+				controllerlib.WithInitialEvent,
+				aVeryLongTime,
+				"local-user-authenticator CA",
+				serviceName,
+			),
+			singletonWorker,
+		).
+		WithController(
+			apicerts.NewCertsObserverController(
+				namespace,
+				certsSecretResourceName,
+				dynamicCertProvider,
+				kubeInformers.Core().V1().Secrets(),
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		)
+
+	kubeInformers.Start(ctx.Done())
+
+	go controllerManager.Start(ctx)
+}
+
+func startWebhook(
+	ctx context.Context,
+	l net.Listener,
+	dynamicCertProvider dynamiccert.Provider,
+	secretInformer corev1informers.SecretInformer,
+) error {
+	return newWebhook(dynamicCertProvider, secretInformer).start(ctx, l)
+}
+
+func waitForSignal() os.Signal {
+	signalCh := make(chan os.Signal, 1)
+	signal.Notify(signalCh, os.Interrupt)
+	return <-signalCh
+}
+
+func run() error {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	kubeClient, err := newK8sClient()
+	if err != nil {
+		return fmt.Errorf("cannot create k8s client: %w", err)
+	}
+
+	kubeInformers := kubeinformers.NewSharedInformerFactoryWithOptions(
+		kubeClient,
+		defaultResyncInterval,
+		kubeinformers.WithNamespace(namespace),
+	)
+
+	dynamicCertProvider := dynamiccert.New()
+
+	startControllers(ctx, dynamicCertProvider, kubeClient, kubeInformers)
+	klog.InfoS("controllers are ready")
+
+	//nolint: gosec // Intentionally binding to all network interfaces.
+	l, err := net.Listen("tcp", ":8443")
+	if err != nil {
+		return fmt.Errorf("cannot create listener: %w", err)
+	}
+	defer func() { _ = l.Close() }()
+
+	err = startWebhook(ctx, l, dynamicCertProvider, kubeInformers.Core().V1().Secrets())
+	if err != nil {
+		return fmt.Errorf("cannot start webhook: %w", err)
+	}
+	klog.InfoS("webhook is ready", "address", l.Addr().String())
+
+	gotSignal := waitForSignal()
+	klog.InfoS("webhook exiting", "signal", gotSignal)
+
+	return nil
+}
+
+func main() {
+	if err := run(); err != nil {
+		klog.Fatal(err)
+	}
+}

cmd/local-user-authenticator/main_test.go

@@ -0,0 +1,578 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/url"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/bcrypt"
+	authenticationv1beta1 "k8s.io/api/authentication/v1beta1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	kubeinformers "k8s.io/client-go/informers"
+	corev1informers "k8s.io/client-go/informers/core/v1"
+	"k8s.io/client-go/kubernetes"
+	kubernetesfake "k8s.io/client-go/kubernetes/fake"
+
+	"go.pinniped.dev/internal/certauthority"
+	"go.pinniped.dev/internal/dynamiccert"
+)
+
+func TestWebhook(t *testing.T) {
+	t.Parallel()
+
+	const namespace = "local-user-authenticator"
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	user, otherUser, colonUser, noGroupUser, oneGroupUser, passwordUndefinedUser, emptyPasswordUser, invalidPasswordHashUser, undefinedGroupsUser :=
+		"some-user", "other-user", "colon-user", "no-group-user", "one-group-user", "password-undefined-user", "empty-password-user", "invalid-password-hash-user", "undefined-groups-user"
+	uid, otherUID, colonUID, noGroupUID, oneGroupUID, passwordUndefinedUID, emptyPasswordUID, invalidPasswordHashUID, undefinedGroupsUID :=
+		"some-uid", "other-uid", "colon-uid", "no-group-uid", "one-group-uid", "password-undefined-uid", "empty-password-uid", "invalid-password-hash-uid", "undefined-groups-uid"
+	password, otherPassword, colonPassword, noGroupPassword, oneGroupPassword, undefinedGroupsPassword :=
+		"some-password", "other-password", "some-:-password", "no-group-password", "one-group-password", "undefined-groups-password"
+
+	group0, group1 := "some-group-0", "some-group-1"
+	groups := group0 + " , " + group1
+
+	kubeClient := kubernetesfake.NewSimpleClientset()
+	addSecretToFakeClientTracker(t, kubeClient, user, uid, password, groups)
+	addSecretToFakeClientTracker(t, kubeClient, otherUser, otherUID, otherPassword, groups)
+	addSecretToFakeClientTracker(t, kubeClient, colonUser, colonUID, colonPassword, groups)
+	addSecretToFakeClientTracker(t, kubeClient, noGroupUser, noGroupUID, noGroupPassword, "")
+	addSecretToFakeClientTracker(t, kubeClient, oneGroupUser, oneGroupUID, oneGroupPassword, group0)
+	addSecretToFakeClientTracker(t, kubeClient, emptyPasswordUser, emptyPasswordUID, "", groups)
+
+	require.NoError(t, kubeClient.Tracker().Add(&corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       types.UID(passwordUndefinedUID),
+			Name:      passwordUndefinedUser,
+			Namespace: namespace,
+		},
+		Data: map[string][]byte{
+			"groups": []byte(groups),
+		},
+	}))
+
+	undefinedGroupsUserPasswordHash, err := bcrypt.GenerateFromPassword([]byte(undefinedGroupsPassword), bcrypt.MinCost)
+	require.NoError(t, err)
+
+	require.NoError(t, kubeClient.Tracker().Add(&corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       types.UID(undefinedGroupsUID),
+			Name:      undefinedGroupsUser,
+			Namespace: namespace,
+		},
+		Data: map[string][]byte{
+			"passwordHash": undefinedGroupsUserPasswordHash,
+		},
+	}))
+
+	require.NoError(t, kubeClient.Tracker().Add(&corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       types.UID(invalidPasswordHashUID),
+			Name:      invalidPasswordHashUser,
+			Namespace: namespace,
+		},
+		Data: map[string][]byte{
+			"groups":       []byte(groups),
+			"passwordHash": []byte("not a valid password hash"),
+		},
+	}))
+
+	secretInformer := createSecretInformer(t, kubeClient)
+
+	certProvider, caBundle, serverName := newCertProvider(t)
+	w := newWebhook(certProvider, secretInformer)
+
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer func() { _ = l.Close() }()
+	require.NoError(t, w.start(ctx, l))
+
+	client := newClient(caBundle, serverName)
+
+	goodURL := fmt.Sprintf("https://%s/authenticate", l.Addr().String())
+	goodRequestHeaders := map[string][]string{
+		"Content-Type": {"application/json; charset=UTF-8"},
+		"Accept":       {"application/json, */*"},
+	}
+
+	tests := []struct {
+		name    string
+		url     string
+		method  string
+		headers map[string][]string
+		body    func() (io.ReadCloser, error)
+
+		wantStatus  int
+		wantHeaders map[string][]string
+		wantBody    *authenticationv1beta1.TokenReview
+	}{
+		{
+			name:        "success for a user who belongs to multiple groups",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(user + ":" + password) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    authenticatedResponseJSON(user, uid, []string{group0, group1}),
+		},
+		{
+			name:        "success for a user who belongs to one groups",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(oneGroupUser + ":" + oneGroupPassword) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    authenticatedResponseJSON(oneGroupUser, oneGroupUID, []string{group0}),
+		},
+		{
+			name:        "success for a user who belongs to no groups",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(noGroupUser + ":" + noGroupPassword) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    authenticatedResponseJSON(noGroupUser, noGroupUID, nil),
+		},
+		{
+			name:        "wrong username for password",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(otherUser + ":" + password) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    unauthenticatedResponseJSON(),
+		},
+		{
+			name:        "when a user has no password hash in the secret",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(passwordUndefinedUser + ":foo") },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    unauthenticatedResponseJSON(),
+		},
+		{
+			name:        "when a user has an invalid password hash in the secret",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(invalidPasswordHashUser + ":foo") },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    unauthenticatedResponseJSON(),
+		},
+		{
+			name:    "success for a user has no groups defined in the secret",
+			url:     goodURL,
+			method:  http.MethodPost,
+			headers: goodRequestHeaders,
+			body: func() (io.ReadCloser, error) {
+				return newTokenReviewBody(undefinedGroupsUser + ":" + undefinedGroupsPassword)
+			},
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    authenticatedResponseJSON(undefinedGroupsUser, undefinedGroupsUID, nil),
+		},
+		{
+			name:        "when a user has empty string as their password",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(passwordUndefinedUser + ":foo") },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    unauthenticatedResponseJSON(),
+		},
+		{
+			name:        "wrong password for username",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(user + ":" + otherPassword) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    unauthenticatedResponseJSON(),
+		},
+		{
+			name:        "non-existent password for username",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(user + ":" + "some-non-existent-password") },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    unauthenticatedResponseJSON(),
+		},
+		{
+			name:        "non-existent username",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody("some-non-existent-user" + ":" + password) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    unauthenticatedResponseJSON(),
+		},
+		{
+			name:       "bad token format (missing colon)",
+			url:        goodURL,
+			method:     http.MethodPost,
+			headers:    goodRequestHeaders,
+			body:       func() (io.ReadCloser, error) { return newTokenReviewBody(user) },
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name:        "password contains colon",
+			url:         goodURL,
+			method:      http.MethodPost,
+			headers:     goodRequestHeaders,
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(colonUser + ":" + colonPassword) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    authenticatedResponseJSON(colonUser, colonUID, []string{group0, group1}),
+		},
+		{
+			name:    "bad TokenReview group",
+			url:     goodURL,
+			method:  http.MethodPost,
+			headers: goodRequestHeaders,
+			body: func() (io.ReadCloser, error) {
+				return newTokenReviewBodyWithGVK(
+					user+":"+password,
+					&schema.GroupVersionKind{
+						Group:   "bad group",
+						Version: authenticationv1beta1.SchemeGroupVersion.Version,
+						Kind:    "TokenReview",
+					},
+				)
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name:    "bad TokenReview version",
+			url:     goodURL,
+			method:  http.MethodPost,
+			headers: goodRequestHeaders,
+			body: func() (io.ReadCloser, error) {
+				return newTokenReviewBodyWithGVK(
+					user+":"+password,
+					&schema.GroupVersionKind{
+						Group:   authenticationv1beta1.SchemeGroupVersion.Group,
+						Version: "bad version",
+						Kind:    "TokenReview",
+					},
+				)
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name:    "bad TokenReview kind",
+			url:     goodURL,
+			method:  http.MethodPost,
+			headers: goodRequestHeaders,
+			body: func() (io.ReadCloser, error) {
+				return newTokenReviewBodyWithGVK(
+					user+":"+password,
+					&schema.GroupVersionKind{
+						Group:   authenticationv1beta1.SchemeGroupVersion.Group,
+						Version: authenticationv1beta1.SchemeGroupVersion.Version,
+						Kind:    "wrong-kind",
+					},
+				)
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name:       "bad path",
+			url:        fmt.Sprintf("https://%s/tuna", l.Addr().String()),
+			method:     http.MethodPost,
+			headers:    goodRequestHeaders,
+			body:       func() (io.ReadCloser, error) { return newTokenReviewBody("some-token") },
+			wantStatus: http.StatusNotFound,
+		},
+		{
+			name:       "bad method",
+			url:        goodURL,
+			method:     http.MethodGet,
+			headers:    goodRequestHeaders,
+			body:       func() (io.ReadCloser, error) { return newTokenReviewBody("some-token") },
+			wantStatus: http.StatusMethodNotAllowed,
+		},
+		{
+			name:   "bad content type",
+			url:    goodURL,
+			method: http.MethodPost,
+			headers: map[string][]string{
+				"Content-Type": {"application/xml"},
+				"Accept":       {"application/json"},
+			},
+			body:       func() (io.ReadCloser, error) { return newTokenReviewBody("some-token") },
+			wantStatus: http.StatusUnsupportedMediaType,
+		},
+		{
+			name:   "bad accept",
+			url:    goodURL,
+			method: http.MethodPost,
+			headers: map[string][]string{
+				"Content-Type": {"application/json"},
+				"Accept":       {"application/xml"},
+			},
+			body:       func() (io.ReadCloser, error) { return newTokenReviewBody("some-token") },
+			wantStatus: http.StatusUnsupportedMediaType,
+		},
+		{
+			name:   "success when there are multiple accepts and one of them is json",
+			url:    goodURL,
+			method: http.MethodPost,
+			headers: map[string][]string{
+				"Content-Type": {"application/json"},
+				"Accept":       {"something/else, application/xml, application/json"},
+			},
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(user + ":" + password) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    authenticatedResponseJSON(user, uid, []string{group0, group1}),
+		},
+		{
+			name:   "success when there are multiple accepts and one of them is */*",
+			url:    goodURL,
+			method: http.MethodPost,
+			headers: map[string][]string{
+				"Content-Type": {"application/json"},
+				"Accept":       {"something/else, */*, application/foo"},
+			},
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(user + ":" + password) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    authenticatedResponseJSON(user, uid, []string{group0, group1}),
+		},
+		{
+			name:   "success when there are multiple accepts and one of them is application/*",
+			url:    goodURL,
+			method: http.MethodPost,
+			headers: map[string][]string{
+				"Content-Type": {"application/json"},
+				"Accept":       {"something/else, application/*, application/foo"},
+			},
+			body:        func() (io.ReadCloser, error) { return newTokenReviewBody(user + ":" + password) },
+			wantStatus:  http.StatusOK,
+			wantHeaders: map[string][]string{"Content-Type": {"application/json"}},
+			wantBody:    authenticatedResponseJSON(user, uid, []string{group0, group1}),
+		},
+		{
+			name:       "bad body",
+			url:        goodURL,
+			method:     http.MethodPost,
+			headers:    goodRequestHeaders,
+			body:       func() (io.ReadCloser, error) { return ioutil.NopCloser(bytes.NewBuffer([]byte("invalid body"))), nil },
+			wantStatus: http.StatusBadRequest,
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			parsedURL, err := url.Parse(test.url)
+			require.NoError(t, err)
+
+			body, err := test.body()
+			require.NoError(t, err)
+
+			rsp, err := client.Do(&http.Request{
+				Method: test.method,
+				URL:    parsedURL,
+				Header: test.headers,
+				Body:   body,
+			})
+			require.NoError(t, err)
+			defer func() { _ = rsp.Body.Close() }()
+
+			require.Equal(t, test.wantStatus, rsp.StatusCode)
+
+			if test.wantHeaders != nil {
+				for k, v := range test.wantHeaders {
+					require.Equal(t, v, rsp.Header.Values(k))
+				}
+			}
+
+			responseBody, err := ioutil.ReadAll(rsp.Body)
+			require.NoError(t, err)
+			if test.wantBody != nil {
+				require.NoError(t, err)
+
+				var tr authenticationv1beta1.TokenReview
+				require.NoError(t, json.Unmarshal(responseBody, &tr))
+				require.Equal(t, test.wantBody, &tr)
+			} else {
+				require.Empty(t, responseBody)
+			}
+		})
+	}
+}
+
+func createSecretInformer(t *testing.T, kubeClient kubernetes.Interface) corev1informers.SecretInformer {
+	t.Helper()
+
+	kubeInformers := kubeinformers.NewSharedInformerFactory(kubeClient, 0)
+
+	secretInformer := kubeInformers.Core().V1().Secrets()
+
+	// We need to call Informer() on the secretInformer to lazily instantiate the
+	// informer factory before syncing it.
+	secretInformer.Informer()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*3)
+	defer cancel()
+
+	kubeInformers.Start(ctx.Done())
+
+	informerTypesSynced := kubeInformers.WaitForCacheSync(ctx.Done())
+	require.True(t, informerTypesSynced[reflect.TypeOf(&corev1.Secret{})])
+
+	return secretInformer
+}
+
+// newClientProvider returns a dynamiccert.Provider configured
+// with valid serving cert, the CA bundle that can be used to verify the serving
+// cert, and the server name that can be used to verify the TLS peer.
+func newCertProvider(t *testing.T) (dynamiccert.Provider, []byte, string) {
+	t.Helper()
+
+	serverName := "local-user-authenticator"
+
+	ca, err := certauthority.New(pkix.Name{CommonName: serverName + " CA"}, time.Hour*24)
+	require.NoError(t, err)
+
+	cert, err := ca.Issue(pkix.Name{CommonName: serverName}, []string{serverName}, nil, time.Hour*24)
+	require.NoError(t, err)
+
+	certPEM, keyPEM, err := certauthority.ToPEM(cert)
+	require.NoError(t, err)
+
+	certProvider := dynamiccert.New()
+	certProvider.Set(certPEM, keyPEM)
+
+	return certProvider, ca.Bundle(), serverName
+}
+
+// newClient creates an http.Client that can be used to make an HTTPS call to a
+// service whose serving certs can be verified by the provided CA bundle.
+func newClient(caBundle []byte, serverName string) *http.Client {
+	rootCAs := x509.NewCertPool()
+	rootCAs.AppendCertsFromPEM(caBundle)
+	return &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				MinVersion: tls.VersionTLS13,
+				RootCAs:    rootCAs,
+				ServerName: serverName,
+			},
+		},
+	}
+}
+
+// newTokenReviewBody creates an io.ReadCloser that contains a JSON-encodeed
+// TokenReview request with expected APIVersion and Kind fields.
+func newTokenReviewBody(token string) (io.ReadCloser, error) {
+	return newTokenReviewBodyWithGVK(
+		token,
+		&schema.GroupVersionKind{
+			Group:   authenticationv1beta1.SchemeGroupVersion.Group,
+			Version: authenticationv1beta1.SchemeGroupVersion.Version,
+			Kind:    "TokenReview",
+		},
+	)
+}
+
+// newTokenReviewBodyWithGVK creates an io.ReadCloser that contains a
+// JSON-encoded TokenReview request. The TypeMeta fields of the TokenReview are
+// filled in with the provided gvk.
+func newTokenReviewBodyWithGVK(token string, gvk *schema.GroupVersionKind) (io.ReadCloser, error) {
+	buf := bytes.NewBuffer([]byte{})
+	tr := authenticationv1beta1.TokenReview{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: gvk.GroupVersion().String(),
+			Kind:       gvk.Kind,
+		},
+		Spec: authenticationv1beta1.TokenReviewSpec{
+			Token: token,
+		},
+	}
+	err := json.NewEncoder(buf).Encode(&tr)
+	return ioutil.NopCloser(buf), err
+}
+
+func unauthenticatedResponseJSON() *authenticationv1beta1.TokenReview {
+	return &authenticationv1beta1.TokenReview{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "TokenReview",
+			APIVersion: "authentication.k8s.io/v1beta1",
+		},
+		Status: authenticationv1beta1.TokenReviewStatus{
+			Authenticated: false,
+		},
+	}
+}
+
+func authenticatedResponseJSON(user, uid string, groups []string) *authenticationv1beta1.TokenReview {
+	return &authenticationv1beta1.TokenReview{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "TokenReview",
+			APIVersion: "authentication.k8s.io/v1beta1",
+		},
+		Status: authenticationv1beta1.TokenReviewStatus{
+			Authenticated: true,
+			User: authenticationv1beta1.UserInfo{
+				Username: user,
+				Groups:   groups,
+				UID:      uid,
+			},
+		},
+	}
+}
+
+func addSecretToFakeClientTracker(t *testing.T, kubeClient *kubernetesfake.Clientset, username, uid, password, groups string) {
+	passwordHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.MinCost)
+	require.NoError(t, err)
+
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       types.UID(uid),
+			Name:      username,
+			Namespace: namespace,
+		},
+		Data: map[string][]byte{
+			"passwordHash": passwordHash,
+			"groups":       []byte(groups),
+		},
+	}
+
+	require.NoError(t, kubeClient.Tracker().Add(secret))
+}

cmd/pinniped-concierge/main.go

@@ -0,0 +1,35 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"os"
+	"time"
+
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	"k8s.io/client-go/pkg/version"
+	"k8s.io/client-go/rest"
+	"k8s.io/component-base/logs"
+	"k8s.io/klog/v2"
+
+	"go.pinniped.dev/internal/concierge/server"
+)
+
+func main() {
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	// Dump out the time since compile (mostly useful for benchmarking our local development cycle latency).
+	var timeSinceCompile time.Duration
+	if buildDate, err := time.Parse(time.RFC3339, version.Get().BuildDate); err == nil {
+		timeSinceCompile = time.Since(buildDate).Round(time.Second)
+	}
+	klog.Infof("Running %s at %#v (%s since build)", rest.DefaultKubernetesUserAgent(), version.Get(), timeSinceCompile)
+
+	ctx := genericapiserver.SetupSignalContext()
+
+	if err := server.New(ctx, os.Args[1:], os.Stdout, os.Stderr).Run(); err != nil {
+		klog.Fatal(err)
+	}
+}

cmd/pinniped-supervisor/main.go

@@ -0,0 +1,264 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/clock"
+	kubeinformers "k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/pkg/version"
+	"k8s.io/client-go/rest"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/component-base/logs"
+	"k8s.io/klog/v2"
+
+	pinnipedclientset "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned"
+	pinnipedinformers "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions"
+	"go.pinniped.dev/internal/config/supervisor"
+	"go.pinniped.dev/internal/controller/supervisorconfig"
+	"go.pinniped.dev/internal/controllerlib"
+	"go.pinniped.dev/internal/downward"
+	"go.pinniped.dev/internal/oidc/jwks"
+	"go.pinniped.dev/internal/oidc/provider"
+	"go.pinniped.dev/internal/oidc/provider/manager"
+)
+
+const (
+	singletonWorker       = 1
+	defaultResyncInterval = 3 * time.Minute
+)
+
+func start(ctx context.Context, l net.Listener, handler http.Handler) {
+	server := http.Server{Handler: handler}
+
+	errCh := make(chan error)
+	go func() {
+		errCh <- server.Serve(l)
+	}()
+
+	go func() {
+		select {
+		case err := <-errCh:
+			klog.InfoS("server exited", "err", err)
+		case <-ctx.Done():
+			klog.InfoS("server context cancelled", "err", ctx.Err())
+			if err := server.Shutdown(context.Background()); err != nil {
+				klog.InfoS("server shutdown failed", "err", err)
+			}
+		}
+	}()
+}
+
+func waitForSignal() os.Signal {
+	signalCh := make(chan os.Signal, 1)
+	signal.Notify(signalCh, os.Interrupt)
+	return <-signalCh
+}
+
+func startControllers(
+	ctx context.Context,
+	cfg *supervisor.Config,
+	issuerManager *manager.Manager,
+	dynamicJWKSProvider jwks.DynamicJWKSProvider,
+	dynamicTLSCertProvider provider.DynamicTLSCertProvider,
+	kubeClient kubernetes.Interface,
+	pinnipedClient pinnipedclientset.Interface,
+	kubeInformers kubeinformers.SharedInformerFactory,
+	pinnipedInformers pinnipedinformers.SharedInformerFactory,
+) {
+	// Create controller manager.
+	controllerManager := controllerlib.
+		NewManager().
+		WithController(
+			supervisorconfig.NewOIDCProviderWatcherController(
+				issuerManager,
+				clock.RealClock{},
+				pinnipedClient,
+				pinnipedInformers.Config().V1alpha1().OIDCProviders(),
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		).
+		WithController(
+			supervisorconfig.NewJWKSWriterController(
+				cfg.Labels,
+				kubeClient,
+				pinnipedClient,
+				kubeInformers.Core().V1().Secrets(),
+				pinnipedInformers.Config().V1alpha1().OIDCProviders(),
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		).
+		WithController(
+			supervisorconfig.NewJWKSObserverController(
+				dynamicJWKSProvider,
+				kubeInformers.Core().V1().Secrets(),
+				pinnipedInformers.Config().V1alpha1().OIDCProviders(),
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		).
+		WithController(
+			supervisorconfig.NewTLSCertObserverController(
+				dynamicTLSCertProvider,
+				cfg.NamesConfig.DefaultTLSCertificateSecret,
+				kubeInformers.Core().V1().Secrets(),
+				pinnipedInformers.Config().V1alpha1().OIDCProviders(),
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		)
+
+	kubeInformers.Start(ctx.Done())
+	pinnipedInformers.Start(ctx.Done())
+
+	// Wait until the caches are synced before returning.
+	kubeInformers.WaitForCacheSync(ctx.Done())
+	pinnipedInformers.WaitForCacheSync(ctx.Done())
+
+	go controllerManager.Start(ctx)
+}
+
+func newClients() (kubernetes.Interface, pinnipedclientset.Interface, error) {
+	kubeConfig, err := restclient.InClusterConfig()
+	if err != nil {
+		return nil, nil, fmt.Errorf("could not load in-cluster configuration: %w", err)
+	}
+
+	// Connect to the core Kubernetes API.
+	kubeClient, err := kubernetes.NewForConfig(kubeConfig)
+	if err != nil {
+		return nil, nil, fmt.Errorf("could not create kube client: %w", err)
+	}
+
+	// Connect to the Pinniped API.
+	pinnipedClient, err := pinnipedclientset.NewForConfig(kubeConfig)
+	if err != nil {
+		return nil, nil, fmt.Errorf("could not create pinniped client: %w", err)
+	}
+
+	return kubeClient, pinnipedClient, nil
+}
+
+func run(serverInstallationNamespace string, cfg *supervisor.Config) error {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	kubeClient, pinnipedClient, err := newClients()
+	if err != nil {
+		return fmt.Errorf("cannot create k8s client: %w", err)
+	}
+
+	kubeInformers := kubeinformers.NewSharedInformerFactoryWithOptions(
+		kubeClient,
+		defaultResyncInterval,
+		kubeinformers.WithNamespace(serverInstallationNamespace),
+	)
+
+	pinnipedInformers := pinnipedinformers.NewSharedInformerFactoryWithOptions(
+		pinnipedClient,
+		defaultResyncInterval,
+		pinnipedinformers.WithNamespace(serverInstallationNamespace),
+	)
+
+	// Serve the /healthz endpoint and make all other paths result in 404.
+	healthMux := http.NewServeMux()
+	healthMux.Handle("/healthz", http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		_, _ = writer.Write([]byte("ok"))
+	}))
+
+	dynamicJWKSProvider := jwks.NewDynamicJWKSProvider()
+	dynamicTLSCertProvider := provider.NewDynamicTLSCertProvider()
+
+	// OIDC endpoints will be served by the oidProvidersManager, and any non-OIDC paths will fallback to the healthMux.
+	oidProvidersManager := manager.NewManager(healthMux, dynamicJWKSProvider)
+
+	startControllers(
+		ctx,
+		cfg,
+		oidProvidersManager,
+		dynamicJWKSProvider,
+		dynamicTLSCertProvider,
+		kubeClient,
+		pinnipedClient,
+		kubeInformers,
+		pinnipedInformers,
+	)
+
+	//nolint: gosec // Intentionally binding to all network interfaces.
+	httpListener, err := net.Listen("tcp", ":8080")
+	if err != nil {
+		return fmt.Errorf("cannot create listener: %w", err)
+	}
+	defer func() { _ = httpListener.Close() }()
+	start(ctx, httpListener, oidProvidersManager)
+
+	//nolint: gosec // Intentionally binding to all network interfaces.
+	httpsListener, err := tls.Listen("tcp", ":8443", &tls.Config{
+		MinVersion: tls.VersionTLS12, // Allow v1.2 because clients like the default `curl` on MacOS don't support 1.3 yet.
+		GetCertificate: func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+			cert := dynamicTLSCertProvider.GetTLSCert(strings.ToLower(info.ServerName))
+			defaultCert := dynamicTLSCertProvider.GetDefaultTLSCert()
+			klog.InfoS("GetCertificate called for port 8443",
+				"info.ServerName", info.ServerName,
+				"foundSNICert", cert != nil,
+				"foundDefaultCert", defaultCert != nil,
+			)
+			if cert == nil {
+				cert = defaultCert
+			}
+			return cert, nil
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("cannot create listener: %w", err)
+	}
+	defer func() { _ = httpsListener.Close() }()
+	start(ctx, httpsListener, oidProvidersManager)
+
+	klog.InfoS("supervisor is ready",
+		"httpAddress", httpListener.Addr().String(),
+		"httpsAddress", httpsListener.Addr().String(),
+	)
+
+	gotSignal := waitForSignal()
+	klog.InfoS("supervisor exiting", "signal", gotSignal)
+
+	return nil
+}
+
+func main() {
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	klog.Infof("Running %s at %#v", rest.DefaultKubernetesUserAgent(), version.Get())
+	klog.Infof("Command-line arguments were: %s %s %s", os.Args[0], os.Args[1], os.Args[2])
+
+	// Discover in which namespace we are installed.
+	podInfo, err := downward.Load(os.Args[1])
+	if err != nil {
+		klog.Fatal(fmt.Errorf("could not read pod metadata: %w", err))
+	}
+
+	// Read the server config file.
+	cfg, err := supervisor.FromPath(os.Args[2])
+	if err != nil {
+		klog.Fatal(fmt.Errorf("could not load config: %w", err))
+	}
+
+	if err := run(podInfo.Namespace, cfg); err != nil {
+		klog.Fatal(err)
+	}
+}

cmd/pinniped/cmd/alpha.go

@@ -0,0 +1,22 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+//nolint: gochecknoglobals
+var alphaCmd = &cobra.Command{
+	Use:          "alpha",
+	Short:        "alpha",
+	Long:         "alpha subcommands (syntax or flags are still subject to change)",
+	SilenceUsage: true, // do not print usage message when commands fail
+	Hidden:       true,
+}
+
+//nolint: gochecknoinits
+func init() {
+	rootCmd.AddCommand(alphaCmd)
+}

cmd/pinniped/cmd/cobra_util.go

@@ -0,0 +1,24 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import "github.com/spf13/cobra"
+
+// mustMarkRequired marks the given flags as required on the provided cobra.Command. If any of the names are wrong, it panics.
+func mustMarkRequired(cmd *cobra.Command, flags ...string) {
+	for _, flag := range flags {
+		if err := cmd.MarkFlagRequired(flag); err != nil {
+			panic(err)
+		}
+	}
+}
+
+// mustMarkHidden marks the given flags as hidden on the provided cobra.Command. If any of the names are wrong, it panics.
+func mustMarkHidden(cmd *cobra.Command, flags ...string) {
+	for _, flag := range flags {
+		if err := cmd.Flags().MarkHidden(flag); err != nil {
+			panic(err)
+		}
+	}
+}

cmd/pinniped/cmd/cobra_util_test.go

@@ -0,0 +1,21 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMustMarkRequired(t *testing.T) {
+	require.NotPanics(t, func() { mustMarkRequired(&cobra.Command{}) })
+	require.NotPanics(t, func() {
+		cmd := &cobra.Command{}
+		cmd.Flags().String("known-flag", "", "")
+		mustMarkRequired(cmd, "known-flag")
+	})
+	require.Panics(t, func() { mustMarkRequired(&cobra.Command{}, "unknown-flag") })
+}

cmd/pinniped/cmd/exchange_credential.go

@@ -0,0 +1,167 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+	corev1 "k8s.io/api/core/v1"
+	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
+
+	auth1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/authentication/v1alpha1"
+	"go.pinniped.dev/internal/client"
+	"go.pinniped.dev/internal/constable"
+	"go.pinniped.dev/internal/here"
+)
+
+//nolint: gochecknoinits
+func init() {
+	rootCmd.AddCommand(newExchangeCredentialCmd(os.Args, os.Stdout, os.Stderr).cmd)
+}
+
+type exchangeCredentialCommand struct {
+	// runFunc is called by the cobra.Command.Run hook. It is included here for
+	// testability.
+	runFunc func(stdout, stderr io.Writer)
+
+	// cmd is the cobra.Command for this CLI command. It is included here for
+	// testability.
+	cmd *cobra.Command
+}
+
+func newExchangeCredentialCmd(args []string, stdout, stderr io.Writer) *exchangeCredentialCommand {
+	c := &exchangeCredentialCommand{
+		runFunc: runExchangeCredential,
+	}
+
+	c.cmd = &cobra.Command{
+		Run: func(cmd *cobra.Command, _ []string) {
+			c.runFunc(stdout, stderr)
+		},
+		Args:  cobra.NoArgs, // do not accept positional arguments for this command
+		Use:   "exchange-credential",
+		Short: "Exchange a credential for a cluster-specific access credential",
+		Long: here.Doc(`
+			Exchange a credential which proves your identity for a time-limited,
+			cluster-specific access credential.
+
+			Designed to be conveniently used as an credential plugin for kubectl.
+			See the help message for 'pinniped get-kubeconfig' for more
+			information about setting up a kubeconfig file using Pinniped.
+
+			Requires all of the following environment variables, which are
+			typically set in the kubeconfig:
+			  - PINNIPED_TOKEN: the token to send to Pinniped for exchange
+			  - PINNIPED_NAMESPACE: the namespace of the authenticator to authenticate
+			    against
+			  - PINNIPED_AUTHENTICATOR_TYPE: the type of authenticator to authenticate
+			    against (e.g., "webhook")
+			  - PINNIPED_AUTHENTICATOR_NAME: the name of the authenticator to authenticate
+			    against
+			  - PINNIPED_CA_BUNDLE: the CA bundle to trust when calling
+				Pinniped's HTTPS endpoint
+			  - PINNIPED_K8S_API_ENDPOINT: the URL for the Pinniped credential
+				exchange API
+
+			For more information about credential plugins in general, see
+			https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
+		`),
+	}
+
+	c.cmd.SetArgs(args)
+	c.cmd.SetOut(stdout)
+	c.cmd.SetErr(stderr)
+
+	return c
+}
+
+type envGetter func(string) (string, bool)
+type tokenExchanger func(
+	ctx context.Context,
+	namespace string,
+	authenticator corev1.TypedLocalObjectReference,
+	token string,
+	caBundle string,
+	apiEndpoint string,
+) (*clientauthenticationv1beta1.ExecCredential, error)
+
+const (
+	ErrMissingEnvVar            = constable.Error("failed to get credential: environment variable not set")
+	ErrInvalidAuthenticatorType = constable.Error("invalid authenticator type")
+)
+
+func runExchangeCredential(stdout, _ io.Writer) {
+	err := exchangeCredential(os.LookupEnv, client.ExchangeToken, stdout, 30*time.Second)
+	if err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "%s\n", err.Error())
+		os.Exit(1)
+	}
+}
+
+func exchangeCredential(envGetter envGetter, tokenExchanger tokenExchanger, outputWriter io.Writer, timeout time.Duration) error {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	namespace, varExists := envGetter("PINNIPED_NAMESPACE")
+	if !varExists {
+		return envVarNotSetError("PINNIPED_NAMESPACE")
+	}
+
+	authenticatorType, varExists := envGetter("PINNIPED_AUTHENTICATOR_TYPE")
+	if !varExists {
+		return envVarNotSetError("PINNIPED_AUTHENTICATOR_TYPE")
+	}
+
+	authenticatorName, varExists := envGetter("PINNIPED_AUTHENTICATOR_NAME")
+	if !varExists {
+		return envVarNotSetError("PINNIPED_AUTHENTICATOR_NAME")
+	}
+
+	token, varExists := envGetter("PINNIPED_TOKEN")
+	if !varExists {
+		return envVarNotSetError("PINNIPED_TOKEN")
+	}
+
+	caBundle, varExists := envGetter("PINNIPED_CA_BUNDLE")
+	if !varExists {
+		return envVarNotSetError("PINNIPED_CA_BUNDLE")
+	}
+
+	apiEndpoint, varExists := envGetter("PINNIPED_K8S_API_ENDPOINT")
+	if !varExists {
+		return envVarNotSetError("PINNIPED_K8S_API_ENDPOINT")
+	}
+
+	authenticator := corev1.TypedLocalObjectReference{Name: authenticatorName}
+	switch strings.ToLower(authenticatorType) {
+	case "webhook":
+		authenticator.APIGroup = &auth1alpha1.SchemeGroupVersion.Group
+		authenticator.Kind = "WebhookAuthenticator"
+	default:
+		return fmt.Errorf(`%w: %q, supported values are "webhook"`, ErrInvalidAuthenticatorType, authenticatorType)
+	}
+
+	cred, err := tokenExchanger(ctx, namespace, authenticator, token, caBundle, apiEndpoint)
+	if err != nil {
+		return fmt.Errorf("failed to get credential: %w", err)
+	}
+
+	err = json.NewEncoder(outputWriter).Encode(cred)
+	if err != nil {
+		return fmt.Errorf("failed to marshal response to stdout: %w", err)
+	}
+
+	return nil
+}
+
+func envVarNotSetError(varName string) error {
+	return fmt.Errorf("%w: %s", ErrMissingEnvVar, varName)
+}

cmd/pinniped/cmd/exchange_credential_test.go

@@ -0,0 +1,296 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/sclevine/spec"
+	"github.com/sclevine/spec/report"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
+
+	"go.pinniped.dev/internal/here"
+	"go.pinniped.dev/internal/testutil"
+)
+
+var (
+	knownGoodUsageForExchangeCredential = here.Doc(`
+		Usage:
+		  exchange-credential [flags]
+
+		Flags:
+		  -h, --help   help for exchange-credential
+
+		`)
+
+	knownGoodHelpForExchangeCredential = here.Doc(`
+		Exchange a credential which proves your identity for a time-limited,
+		cluster-specific access credential.
+
+		Designed to be conveniently used as an credential plugin for kubectl.
+		See the help message for 'pinniped get-kubeconfig' for more
+		information about setting up a kubeconfig file using Pinniped.
+
+		Requires all of the following environment variables, which are
+		typically set in the kubeconfig:
+		  - PINNIPED_TOKEN: the token to send to Pinniped for exchange
+		  - PINNIPED_NAMESPACE: the namespace of the authenticator to authenticate
+		    against
+		  - PINNIPED_AUTHENTICATOR_TYPE: the type of authenticator to authenticate
+		    against (e.g., "webhook")
+		  - PINNIPED_AUTHENTICATOR_NAME: the name of the authenticator to authenticate
+		    against
+		  - PINNIPED_CA_BUNDLE: the CA bundle to trust when calling
+			Pinniped's HTTPS endpoint
+		  - PINNIPED_K8S_API_ENDPOINT: the URL for the Pinniped credential
+			exchange API
+
+		For more information about credential plugins in general, see
+		https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
+
+		Usage:
+		  exchange-credential [flags]
+
+		Flags:
+		  -h, --help   help for exchange-credential
+	`)
+)
+
+func TestNewCredentialExchangeCmd(t *testing.T) {
+	spec.Run(t, "newCredentialExchangeCmd", func(t *testing.T, when spec.G, it spec.S) {
+		var r *require.Assertions
+		var stdout, stderr *bytes.Buffer
+
+		it.Before(func() {
+			r = require.New(t)
+
+			stdout, stderr = bytes.NewBuffer([]byte{}), bytes.NewBuffer([]byte{})
+		})
+
+		it("calls runFunc and does not print usage or help when correct arguments and flags are used", func() {
+			c := newExchangeCredentialCmd([]string{}, stdout, stderr)
+
+			runFuncCalled := false
+			c.runFunc = func(out, err io.Writer) {
+				runFuncCalled = true
+			}
+
+			r.NoError(c.cmd.Execute())
+			r.True(runFuncCalled)
+			r.Empty(stdout.String())
+			r.Empty(stderr.String())
+		})
+
+		it("fails when args are passed", func() {
+			c := newExchangeCredentialCmd([]string{"some-arg"}, stdout, stderr)
+
+			runFuncCalled := false
+			c.runFunc = func(out, err io.Writer) {
+				runFuncCalled = true
+			}
+
+			errorMessage := `unknown command "some-arg" for "exchange-credential"`
+			r.EqualError(c.cmd.Execute(), errorMessage)
+			r.False(runFuncCalled)
+
+			output := "Error: " + errorMessage + "\n" + knownGoodUsageForExchangeCredential
+			r.Equal(output, stdout.String())
+			r.Empty(stderr.String())
+		})
+
+		it("prints a nice help message", func() {
+			c := newExchangeCredentialCmd([]string{"--help"}, stdout, stderr)
+
+			runFuncCalled := false
+			c.runFunc = func(out, err io.Writer) {
+				runFuncCalled = true
+			}
+
+			r.NoError(c.cmd.Execute())
+			r.False(runFuncCalled)
+			r.Equal(knownGoodHelpForExchangeCredential, stdout.String())
+			r.Empty(stderr.String())
+		})
+	}, spec.Parallel(), spec.Report(report.Terminal{}))
+}
+
+func TestExchangeCredential(t *testing.T) {
+	spec.Run(t, "cmd.exchangeCredential", func(t *testing.T, when spec.G, it spec.S) {
+		var r *require.Assertions
+		var buffer *bytes.Buffer
+		var tokenExchanger tokenExchanger
+		var fakeEnv map[string]string
+
+		var envGetter envGetter = func(envVarName string) (string, bool) {
+			value, present := fakeEnv[envVarName]
+			if !present {
+				return "", false
+			}
+			return value, true
+		}
+
+		it.Before(func() {
+			r = require.New(t)
+			buffer = new(bytes.Buffer)
+			fakeEnv = map[string]string{
+				"PINNIPED_NAMESPACE":          "namespace from env",
+				"PINNIPED_AUTHENTICATOR_TYPE": "Webhook",
+				"PINNIPED_AUTHENTICATOR_NAME": "webhook name from env",
+				"PINNIPED_TOKEN":              "token from env",
+				"PINNIPED_CA_BUNDLE":          "ca bundle from env",
+				"PINNIPED_K8S_API_ENDPOINT":   "k8s api from env",
+			}
+		})
+
+		when("env vars are missing", func() {
+			it("returns an error when PINNIPED_NAMESPACE is missing", func() {
+				delete(fakeEnv, "PINNIPED_NAMESPACE")
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_NAMESPACE")
+			})
+
+			it("returns an error when PINNIPED_AUTHENTICATOR_TYPE is missing", func() {
+				delete(fakeEnv, "PINNIPED_AUTHENTICATOR_TYPE")
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_AUTHENTICATOR_TYPE")
+			})
+
+			it("returns an error when PINNIPED_AUTHENTICATOR_NAME is missing", func() {
+				delete(fakeEnv, "PINNIPED_AUTHENTICATOR_NAME")
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_AUTHENTICATOR_NAME")
+			})
+
+			it("returns an error when PINNIPED_TOKEN is missing", func() {
+				delete(fakeEnv, "PINNIPED_TOKEN")
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_TOKEN")
+			})
+
+			it("returns an error when PINNIPED_CA_BUNDLE is missing", func() {
+				delete(fakeEnv, "PINNIPED_CA_BUNDLE")
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_CA_BUNDLE")
+			})
+
+			it("returns an error when PINNIPED_K8S_API_ENDPOINT is missing", func() {
+				delete(fakeEnv, "PINNIPED_K8S_API_ENDPOINT")
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_K8S_API_ENDPOINT")
+			})
+		})
+
+		when("env vars are invalid", func() {
+			it("returns an error when PINNIPED_AUTHENTICATOR_TYPE is missing", func() {
+				fakeEnv["PINNIPED_AUTHENTICATOR_TYPE"] = "invalid"
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.EqualError(err, `invalid authenticator type: "invalid", supported values are "webhook"`)
+			})
+		})
+
+		when("the token exchange fails", func() {
+			it.Before(func() {
+				tokenExchanger = func(ctx context.Context, namespace string, authenticator corev1.TypedLocalObjectReference, token, caBundle, apiEndpoint string) (*clientauthenticationv1beta1.ExecCredential, error) {
+					return nil, fmt.Errorf("some error")
+				}
+			})
+
+			it("returns an error", func() {
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.EqualError(err, "failed to get credential: some error")
+			})
+		})
+
+		when("the JSON encoder fails", func() {
+			it.Before(func() {
+				tokenExchanger = func(ctx context.Context, namespace string, authenticator corev1.TypedLocalObjectReference, token, caBundle, apiEndpoint string) (*clientauthenticationv1beta1.ExecCredential, error) {
+					return &clientauthenticationv1beta1.ExecCredential{
+						Status: &clientauthenticationv1beta1.ExecCredentialStatus{
+							Token: "some token",
+						},
+					}, nil
+				}
+			})
+
+			it("returns an error", func() {
+				err := exchangeCredential(envGetter, tokenExchanger, &testutil.ErrorWriter{ReturnError: fmt.Errorf("some IO error")}, 30*time.Second)
+				r.EqualError(err, "failed to marshal response to stdout: some IO error")
+			})
+		})
+
+		when("the token exchange times out", func() {
+			it.Before(func() {
+				tokenExchanger = func(ctx context.Context, namespace string, authenticator corev1.TypedLocalObjectReference, token, caBundle, apiEndpoint string) (*clientauthenticationv1beta1.ExecCredential, error) {
+					select {
+					case <-time.After(100 * time.Millisecond):
+						return &clientauthenticationv1beta1.ExecCredential{
+							Status: &clientauthenticationv1beta1.ExecCredentialStatus{
+								Token: "some token",
+							},
+						}, nil
+					case <-ctx.Done():
+						return nil, ctx.Err()
+					}
+				}
+			})
+
+			it("returns an error", func() {
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 1*time.Millisecond)
+				r.EqualError(err, "failed to get credential: context deadline exceeded")
+			})
+		})
+
+		when("the token exchange succeeds", func() {
+			var actualNamespace, actualToken, actualCaBundle, actualAPIEndpoint string
+
+			it.Before(func() {
+				tokenExchanger = func(ctx context.Context, namespace string, authenticator corev1.TypedLocalObjectReference, token, caBundle, apiEndpoint string) (*clientauthenticationv1beta1.ExecCredential, error) {
+					actualNamespace, actualToken, actualCaBundle, actualAPIEndpoint = namespace, token, caBundle, apiEndpoint
+					now := metav1.NewTime(time.Date(2020, 7, 29, 1, 2, 3, 0, time.UTC))
+					return &clientauthenticationv1beta1.ExecCredential{
+						TypeMeta: metav1.TypeMeta{
+							Kind:       "ExecCredential",
+							APIVersion: "client.authentication.k8s.io/v1beta1",
+						},
+						Status: &clientauthenticationv1beta1.ExecCredentialStatus{
+							ExpirationTimestamp:   &now,
+							ClientCertificateData: "some certificate",
+							ClientKeyData:         "some key",
+							Token:                 "some token",
+						},
+					}, nil
+				}
+			})
+
+			it("writes the execCredential to the given writer", func() {
+				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
+				r.NoError(err)
+				r.Equal(fakeEnv["PINNIPED_NAMESPACE"], actualNamespace)
+				r.Equal(fakeEnv["PINNIPED_TOKEN"], actualToken)
+				r.Equal(fakeEnv["PINNIPED_CA_BUNDLE"], actualCaBundle)
+				r.Equal(fakeEnv["PINNIPED_K8S_API_ENDPOINT"], actualAPIEndpoint)
+				expected := `{
+				  "kind": "ExecCredential",
+				  "apiVersion": "client.authentication.k8s.io/v1beta1",
+				  "spec": {},
+				  "status": {
+					"expirationTimestamp":"2020-07-29T01:02:03Z",
+					"clientCertificateData": "some certificate",
+					"clientKeyData":"some key",
+					"token": "some token"
+				  }
+				}`
+				r.JSONEq(expected, buffer.String())
+			})
+		})
+	}, spec.Parallel(), spec.Report(report.Terminal{}))
+}

cmd/pinniped/cmd/get_kubeconfig.go

@@ -0,0 +1,344 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"os"
+	"time"
+
+	"github.com/ghodss/yaml"
+	"github.com/spf13/cobra"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	v1 "k8s.io/client-go/tools/clientcmd/api/v1"
+
+	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/config/v1alpha1"
+	pinnipedclientset "go.pinniped.dev/generated/1.19/client/concierge/clientset/versioned"
+	"go.pinniped.dev/internal/constable"
+	"go.pinniped.dev/internal/here"
+)
+
+//nolint: gochecknoinits
+func init() {
+	rootCmd.AddCommand(newGetKubeConfigCommand().Command())
+}
+
+type getKubeConfigFlags struct {
+	token             string
+	kubeconfig        string
+	contextOverride   string
+	namespace         string
+	authenticatorName string
+	authenticatorType string
+}
+
+type getKubeConfigCommand struct {
+	flags getKubeConfigFlags
+	// 	Test mocking points
+	getPathToSelf     func() (string, error)
+	kubeClientCreator func(restConfig *rest.Config) (pinnipedclientset.Interface, error)
+}
+
+func newGetKubeConfigCommand() *getKubeConfigCommand {
+	return &getKubeConfigCommand{
+		flags: getKubeConfigFlags{
+			namespace: "pinniped",
+		},
+		getPathToSelf: os.Executable,
+		kubeClientCreator: func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
+			return pinnipedclientset.NewForConfig(restConfig)
+		},
+	}
+}
+
+func (c *getKubeConfigCommand) Command() *cobra.Command {
+	cmd := &cobra.Command{
+		RunE:  c.run,
+		Args:  cobra.NoArgs, // do not accept positional arguments for this command
+		Use:   "get-kubeconfig",
+		Short: "Print a kubeconfig for authenticating into a cluster via Pinniped",
+		Long: here.Doc(`
+			Print a kubeconfig for authenticating into a cluster via Pinniped.
+
+			Requires admin-like access to the cluster using the current
+			kubeconfig context in order to access Pinniped's metadata.
+			The current kubeconfig is found similar to how kubectl finds it:
+			using the value of the --kubeconfig option, or if that is not
+			specified then from the value of the KUBECONFIG environment
+			variable, or if that is not specified then it defaults to
+			.kube/config in your home directory.
+
+			Prints a kubeconfig which is suitable to access the cluster using
+			Pinniped as the authentication mechanism. This kubeconfig output
+			can be saved to a file and used with future kubectl commands, e.g.:
+				pinniped get-kubeconfig --token $MY_TOKEN > $HOME/mycluster-kubeconfig
+				kubectl --kubeconfig $HOME/mycluster-kubeconfig get pods
+		`),
+	}
+	cmd.Flags().StringVar(&c.flags.token, "token", "", "Credential to include in the resulting kubeconfig output (Required)")
+	cmd.Flags().StringVar(&c.flags.kubeconfig, "kubeconfig", c.flags.kubeconfig, "Path to the kubeconfig file")
+	cmd.Flags().StringVar(&c.flags.contextOverride, "kubeconfig-context", c.flags.contextOverride, "Kubeconfig context override")
+	cmd.Flags().StringVar(&c.flags.namespace, "pinniped-namespace", c.flags.namespace, "Namespace in which Pinniped was installed")
+	cmd.Flags().StringVar(&c.flags.authenticatorType, "authenticator-type", c.flags.authenticatorType, "Authenticator type (e.g., 'webhook')")
+	cmd.Flags().StringVar(&c.flags.authenticatorName, "authenticator-name", c.flags.authenticatorType, "Authenticator name")
+	mustMarkRequired(cmd, "token")
+	return cmd
+}
+
+func (c *getKubeConfigCommand) run(cmd *cobra.Command, args []string) error {
+	fullPathToSelf, err := c.getPathToSelf()
+	if err != nil {
+		return fmt.Errorf("could not find path to self: %w", err)
+	}
+
+	clientConfig := newClientConfig(c.flags.kubeconfig, c.flags.contextOverride)
+
+	currentKubeConfig, err := clientConfig.RawConfig()
+	if err != nil {
+		return err
+	}
+
+	restConfig, err := clientConfig.ClientConfig()
+	if err != nil {
+		return err
+	}
+	clientset, err := c.kubeClientCreator(restConfig)
+	if err != nil {
+		return err
+	}
+
+	authenticatorType, authenticatorName := c.flags.authenticatorType, c.flags.authenticatorName
+	if authenticatorType == "" || authenticatorName == "" {
+		authenticatorType, authenticatorName, err = getDefaultAuthenticator(clientset, c.flags.namespace)
+		if err != nil {
+			return err
+		}
+	}
+
+	credentialIssuer, err := fetchPinnipedCredentialIssuer(clientset, c.flags.namespace)
+	if err != nil {
+		return err
+	}
+
+	if credentialIssuer.Status.KubeConfigInfo == nil {
+		return constable.Error(`CredentialIssuer "pinniped-config" was missing KubeConfigInfo`)
+	}
+
+	v1Cluster, err := copyCurrentClusterFromExistingKubeConfig(currentKubeConfig, c.flags.contextOverride)
+	if err != nil {
+		return err
+	}
+
+	err = issueWarningForNonMatchingServerOrCA(v1Cluster, credentialIssuer, cmd.ErrOrStderr())
+	if err != nil {
+		return err
+	}
+
+	config := newPinnipedKubeconfig(v1Cluster, fullPathToSelf, c.flags.token, c.flags.namespace, authenticatorType, authenticatorName)
+
+	err = writeConfigAsYAML(cmd.OutOrStdout(), config)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func issueWarningForNonMatchingServerOrCA(v1Cluster v1.Cluster, credentialIssuer *configv1alpha1.CredentialIssuer, warningsWriter io.Writer) error {
+	credentialIssuerCA, err := base64.StdEncoding.DecodeString(credentialIssuer.Status.KubeConfigInfo.CertificateAuthorityData)
+	if err != nil {
+		return err
+	}
+	if v1Cluster.Server != credentialIssuer.Status.KubeConfigInfo.Server ||
+		!bytes.Equal(v1Cluster.CertificateAuthorityData, credentialIssuerCA) {
+		_, err := warningsWriter.Write([]byte("WARNING: Server and certificate authority did not match between local kubeconfig and Pinniped's CredentialIssuer on the cluster. Using local kubeconfig values.\n"))
+		if err != nil {
+			return fmt.Errorf("output write error: %w", err)
+		}
+	}
+	return nil
+}
+
+type noAuthenticatorError struct{ Namespace string }
+
+func (e noAuthenticatorError) Error() string {
+	return fmt.Sprintf(`no authenticators were found in namespace %q`, e.Namespace)
+}
+
+type indeterminateAuthenticatorError struct{ Namespace string }
+
+func (e indeterminateAuthenticatorError) Error() string {
+	return fmt.Sprintf(
+		`multiple authenticators were found in namespace %q, so --authenticator-name/--authenticator-type must be specified`,
+		e.Namespace,
+	)
+}
+
+func getDefaultAuthenticator(clientset pinnipedclientset.Interface, namespace string) (string, string, error) {
+	ctx, cancelFunc := context.WithTimeout(context.Background(), time.Second*20)
+	defer cancelFunc()
+
+	webhooks, err := clientset.AuthenticationV1alpha1().WebhookAuthenticators(namespace).List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return "", "", err
+	}
+
+	type ref struct{ authenticatorType, authenticatorName string }
+	authenticators := make([]ref, 0, len(webhooks.Items))
+	for _, webhook := range webhooks.Items {
+		authenticators = append(authenticators, ref{authenticatorType: "webhook", authenticatorName: webhook.Name})
+	}
+
+	if len(authenticators) == 0 {
+		return "", "", noAuthenticatorError{namespace}
+	}
+	if len(authenticators) > 1 {
+		return "", "", indeterminateAuthenticatorError{namespace}
+	}
+	return authenticators[0].authenticatorType, authenticators[0].authenticatorName, nil
+}
+
+func fetchPinnipedCredentialIssuer(clientset pinnipedclientset.Interface, pinnipedInstallationNamespace string) (*configv1alpha1.CredentialIssuer, error) {
+	ctx, cancelFunc := context.WithTimeout(context.Background(), time.Second*20)
+	defer cancelFunc()
+
+	credentialIssuers, err := clientset.ConfigV1alpha1().CredentialIssuers(pinnipedInstallationNamespace).List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	if len(credentialIssuers.Items) == 0 {
+		return nil, constable.Error(fmt.Sprintf(
+			`No CredentialIssuer was found in namespace "%s". Is Pinniped installed on this cluster in namespace "%s"?`,
+			pinnipedInstallationNamespace,
+			pinnipedInstallationNamespace,
+		))
+	}
+
+	if len(credentialIssuers.Items) > 1 {
+		return nil, constable.Error(fmt.Sprintf(
+			`More than one CredentialIssuer was found in namespace "%s"`,
+			pinnipedInstallationNamespace,
+		))
+	}
+
+	return &credentialIssuers.Items[0], nil
+}
+
+func newClientConfig(kubeconfigPathOverride string, currentContextName string) clientcmd.ClientConfig {
+	loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()
+	loadingRules.ExplicitPath = kubeconfigPathOverride
+	clientConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, &clientcmd.ConfigOverrides{
+		CurrentContext: currentContextName,
+	})
+	return clientConfig
+}
+
+func writeConfigAsYAML(outputWriter io.Writer, config v1.Config) error {
+	output, err := yaml.Marshal(&config)
+	if err != nil {
+		return fmt.Errorf("YAML serialization error: %w", err)
+	}
+
+	_, err = outputWriter.Write(output)
+	if err != nil {
+		return fmt.Errorf("output write error: %w", err)
+	}
+
+	return nil
+}
+
+func copyCurrentClusterFromExistingKubeConfig(currentKubeConfig clientcmdapi.Config, currentContextNameOverride string) (v1.Cluster, error) {
+	v1Cluster := v1.Cluster{}
+
+	contextName := currentKubeConfig.CurrentContext
+	if currentContextNameOverride != "" {
+		contextName = currentContextNameOverride
+	}
+
+	err := v1.Convert_api_Cluster_To_v1_Cluster(
+		currentKubeConfig.Clusters[currentKubeConfig.Contexts[contextName].Cluster],
+		&v1Cluster,
+		nil,
+	)
+	if err != nil {
+		return v1.Cluster{}, err
+	}
+
+	return v1Cluster, nil
+}
+
+func newPinnipedKubeconfig(v1Cluster v1.Cluster, fullPathToSelf string, token string, namespace string, authenticatorType string, authenticatorName string) v1.Config {
+	clusterName := "pinniped-cluster"
+	userName := "pinniped-user"
+
+	return v1.Config{
+		Kind:        "Config",
+		APIVersion:  v1.SchemeGroupVersion.Version,
+		Preferences: v1.Preferences{},
+		Clusters: []v1.NamedCluster{
+			{
+				Name:    clusterName,
+				Cluster: v1Cluster,
+			},
+		},
+		Contexts: []v1.NamedContext{
+			{
+				Name: clusterName,
+				Context: v1.Context{
+					Cluster:  clusterName,
+					AuthInfo: userName,
+				},
+			},
+		},
+		AuthInfos: []v1.NamedAuthInfo{
+			{
+				Name: userName,
+				AuthInfo: v1.AuthInfo{
+					Exec: &v1.ExecConfig{
+						Command: fullPathToSelf,
+						Args:    []string{"exchange-credential"},
+						Env: []v1.ExecEnvVar{
+							{
+								Name:  "PINNIPED_K8S_API_ENDPOINT",
+								Value: v1Cluster.Server,
+							},
+							{
+								Name:  "PINNIPED_CA_BUNDLE",
+								Value: string(v1Cluster.CertificateAuthorityData)},
+							{
+								Name:  "PINNIPED_NAMESPACE",
+								Value: namespace,
+							},
+							{
+								Name:  "PINNIPED_TOKEN",
+								Value: token,
+							},
+							{
+								Name:  "PINNIPED_AUTHENTICATOR_TYPE",
+								Value: authenticatorType,
+							},
+							{
+								Name:  "PINNIPED_AUTHENTICATOR_NAME",
+								Value: authenticatorName,
+							},
+						},
+						APIVersion: clientauthenticationv1beta1.SchemeGroupVersion.String(),
+						InstallHint: "The Pinniped CLI is required to authenticate to the current cluster.\n" +
+							"For more information, please visit https://pinniped.dev",
+					},
+				},
+			},
+		},
+		CurrentContext: clusterName,
+	}
+}

cmd/pinniped/cmd/get_kubeconfig_test.go

@@ -0,0 +1,401 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/rest"
+	coretesting "k8s.io/client-go/testing"
+
+	authv1alpha "go.pinniped.dev/generated/1.19/apis/concierge/authentication/v1alpha1"
+	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/config/v1alpha1"
+	pinnipedclientset "go.pinniped.dev/generated/1.19/client/concierge/clientset/versioned"
+	pinnipedfake "go.pinniped.dev/generated/1.19/client/concierge/clientset/versioned/fake"
+	"go.pinniped.dev/internal/here"
+)
+
+var (
+	knownGoodUsageForGetKubeConfig = here.Doc(`
+		Usage:
+		  get-kubeconfig [flags]
+
+		Flags:
+			  --authenticator-name string   Authenticator name
+			  --authenticator-type string   Authenticator type (e.g., 'webhook')
+		  -h, --help                        help for get-kubeconfig
+			  --kubeconfig string           Path to the kubeconfig file
+			  --kubeconfig-context string   Kubeconfig context override
+			  --pinniped-namespace string   Namespace in which Pinniped was installed (default "pinniped")
+			  --token string                Credential to include in the resulting kubeconfig output (Required)
+
+		`)
+
+	knownGoodHelpForGetKubeConfig = here.Doc(`
+		Print a kubeconfig for authenticating into a cluster via Pinniped.
+
+		Requires admin-like access to the cluster using the current
+		kubeconfig context in order to access Pinniped's metadata.
+		The current kubeconfig is found similar to how kubectl finds it:
+		using the value of the --kubeconfig option, or if that is not
+		specified then from the value of the KUBECONFIG environment
+		variable, or if that is not specified then it defaults to
+		.kube/config in your home directory.
+
+		Prints a kubeconfig which is suitable to access the cluster using
+		Pinniped as the authentication mechanism. This kubeconfig output
+		can be saved to a file and used with future kubectl commands, e.g.:
+			pinniped get-kubeconfig --token $MY_TOKEN > $HOME/mycluster-kubeconfig
+			kubectl --kubeconfig $HOME/mycluster-kubeconfig get pods
+
+		Usage:
+		  get-kubeconfig [flags]
+
+		Flags:
+			  --authenticator-name string   Authenticator name
+			  --authenticator-type string   Authenticator type (e.g., 'webhook')
+		  -h, --help                        help for get-kubeconfig
+			  --kubeconfig string           Path to the kubeconfig file
+			  --kubeconfig-context string   Kubeconfig context override
+			  --pinniped-namespace string   Namespace in which Pinniped was installed (default "pinniped")
+			  --token string                Credential to include in the resulting kubeconfig output (Required)
+		`)
+)
+
+func TestNewGetKubeConfigCmd(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name       string
+		args       []string
+		wantError  bool
+		wantStdout string
+		wantStderr string
+	}{
+		{
+			name:       "help flag passed",
+			args:       []string{"--help"},
+			wantStdout: knownGoodHelpForGetKubeConfig,
+		},
+		{
+			name:       "missing required flag",
+			args:       []string{},
+			wantError:  true,
+			wantStdout: `Error: required flag(s) "token" not set` + "\n" + knownGoodUsageForGetKubeConfig,
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			cmd := newGetKubeConfigCommand().Command()
+			require.NotNil(t, cmd)
+
+			var stdout, stderr bytes.Buffer
+			cmd.SetOut(&stdout)
+			cmd.SetErr(&stderr)
+			cmd.SetArgs(tt.args)
+			err := cmd.Execute()
+			if tt.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tt.wantStdout, stdout.String(), "unexpected stdout")
+			require.Equal(t, tt.wantStderr, stderr.String(), "unexpected stderr")
+		})
+	}
+}
+
+type expectedKubeconfigYAML struct {
+	clusterCAData     string
+	clusterServer     string
+	command           string
+	token             string
+	pinnipedEndpoint  string
+	pinnipedCABundle  string
+	namespace         string
+	authenticatorType string
+	authenticatorName string
+}
+
+func (e expectedKubeconfigYAML) String() string {
+	return here.Docf(`
+		apiVersion: v1
+		clusters:
+		- cluster:
+			certificate-authority-data: %s
+			server: %s
+		  name: pinniped-cluster
+		contexts:
+		- context:
+			cluster: pinniped-cluster
+			user: pinniped-user
+		  name: pinniped-cluster
+		current-context: pinniped-cluster
+		kind: Config
+		preferences: {}
+		users:
+		- name: pinniped-user
+		  user:
+			exec:
+			  apiVersion: client.authentication.k8s.io/v1beta1
+			  args:
+			  - exchange-credential
+			  command: %s
+			  env:
+			  - name: PINNIPED_K8S_API_ENDPOINT
+				value: %s
+			  - name: PINNIPED_CA_BUNDLE
+				value: %s
+			  - name: PINNIPED_NAMESPACE
+			    value: %s
+			  - name: PINNIPED_TOKEN
+				value: %s
+			  - name: PINNIPED_AUTHENTICATOR_TYPE
+				value: %s
+			  - name: PINNIPED_AUTHENTICATOR_NAME
+				value: %s
+			  installHint: |-
+				The Pinniped CLI is required to authenticate to the current cluster.
+				For more information, please visit https://pinniped.dev
+		`, e.clusterCAData, e.clusterServer, e.command, e.pinnipedEndpoint, e.pinnipedCABundle, e.namespace, e.token, e.authenticatorType, e.authenticatorName)
+}
+
+func newCredentialIssuer(name, namespace, server, certificateAuthorityData string) *configv1alpha1.CredentialIssuer {
+	return &configv1alpha1.CredentialIssuer{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "CredentialIssuer",
+			APIVersion: configv1alpha1.SchemeGroupVersion.String(),
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Status: configv1alpha1.CredentialIssuerStatus{
+			KubeConfigInfo: &configv1alpha1.CredentialIssuerKubeConfigInfo{
+				Server:                   server,
+				CertificateAuthorityData: base64.StdEncoding.EncodeToString([]byte(certificateAuthorityData)),
+			},
+		},
+	}
+}
+
+func TestRun(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name       string
+		mocks      func(*getKubeConfigCommand)
+		wantError  string
+		wantStdout string
+		wantStderr string
+	}{
+		{
+			name: "failure to get path to self",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.getPathToSelf = func() (string, error) {
+					return "", fmt.Errorf("some error getting path to self")
+				}
+			},
+			wantError: "could not find path to self: some error getting path to self",
+		},
+		{
+			name: "kubeconfig does not exist",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.flags.kubeconfig = "./testdata/does-not-exist.yaml"
+			},
+			wantError: "stat ./testdata/does-not-exist.yaml: no such file or directory",
+		},
+		{
+			name: "fail to get client",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return nil, fmt.Errorf("some error configuring clientset")
+				}
+			},
+			wantError: "some error configuring clientset",
+		},
+		{
+			name: "fail to get authenticators",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.flags.authenticatorName = ""
+				cmd.flags.authenticatorType = ""
+				clientset := pinnipedfake.NewSimpleClientset()
+				clientset.PrependReactor("*", "*", func(_ coretesting.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("some error getting authenticators")
+				})
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return clientset, nil
+				}
+			},
+			wantError: "some error getting authenticators",
+		},
+		{
+			name: "zero authenticators",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.flags.authenticatorName = ""
+				cmd.flags.authenticatorType = ""
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return pinnipedfake.NewSimpleClientset(), nil
+				}
+			},
+			wantError: `no authenticators were found in namespace "test-namespace"`,
+		},
+		{
+			name: "multiple authenticators",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.flags.authenticatorName = ""
+				cmd.flags.authenticatorType = ""
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return pinnipedfake.NewSimpleClientset(
+						&authv1alpha.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Namespace: "test-namespace", Name: "webhook-one"}},
+						&authv1alpha.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Namespace: "test-namespace", Name: "webhook-two"}},
+					), nil
+				}
+			},
+			wantError: `multiple authenticators were found in namespace "test-namespace", so --authenticator-name/--authenticator-type must be specified`,
+		},
+		{
+			name: "fail to get CredentialIssuers",
+			mocks: func(cmd *getKubeConfigCommand) {
+				clientset := pinnipedfake.NewSimpleClientset()
+				clientset.PrependReactor("*", "*", func(_ coretesting.Action) (bool, runtime.Object, error) {
+					return true, nil, fmt.Errorf("some error getting CredentialIssuers")
+				})
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return clientset, nil
+				}
+			},
+			wantError: "some error getting CredentialIssuers",
+		},
+		{
+			name: "zero CredentialIssuers found",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return pinnipedfake.NewSimpleClientset(
+						newCredentialIssuer("pinniped-config-1", "not-the-test-namespace", "", ""),
+					), nil
+				}
+			},
+			wantError: `No CredentialIssuer was found in namespace "test-namespace". Is Pinniped installed on this cluster in namespace "test-namespace"?`,
+		},
+		{
+			name: "multiple CredentialIssuers found",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return pinnipedfake.NewSimpleClientset(
+						newCredentialIssuer("pinniped-config-1", "test-namespace", "", ""),
+						newCredentialIssuer("pinniped-config-2", "test-namespace", "", ""),
+					), nil
+				}
+			},
+			wantError: `More than one CredentialIssuer was found in namespace "test-namespace"`,
+		},
+		{
+			name: "CredentialIssuer missing KubeConfigInfo",
+			mocks: func(cmd *getKubeConfigCommand) {
+				ci := newCredentialIssuer("pinniped-config", "test-namespace", "", "")
+				ci.Status.KubeConfigInfo = nil
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return pinnipedfake.NewSimpleClientset(ci), nil
+				}
+			},
+			wantError: `CredentialIssuer "pinniped-config" was missing KubeConfigInfo`,
+		},
+		{
+			name: "KubeConfigInfo has invalid base64",
+			mocks: func(cmd *getKubeConfigCommand) {
+				ci := newCredentialIssuer("pinniped-config", "test-namespace", "https://example.com", "")
+				ci.Status.KubeConfigInfo.CertificateAuthorityData = "invalid-base64-test-ca"
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return pinnipedfake.NewSimpleClientset(ci), nil
+				}
+			},
+			wantError: `illegal base64 data at input byte 7`,
+		},
+		{
+			name: "success using remote CA data",
+			mocks: func(cmd *getKubeConfigCommand) {
+				ci := newCredentialIssuer("pinniped-config", "test-namespace", "https://fake-server-url-value", "fake-certificate-authority-data-value")
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return pinnipedfake.NewSimpleClientset(ci), nil
+				}
+			},
+			wantStdout: expectedKubeconfigYAML{
+				clusterCAData:     "ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==",
+				clusterServer:     "https://fake-server-url-value",
+				command:           "/path/to/pinniped",
+				token:             "test-token",
+				pinnipedEndpoint:  "https://fake-server-url-value",
+				pinnipedCABundle:  "fake-certificate-authority-data-value",
+				namespace:         "test-namespace",
+				authenticatorType: "test-authenticator-type",
+				authenticatorName: "test-authenticator-name",
+			}.String(),
+		},
+		{
+			name: "success using local CA data and discovered authenticator",
+			mocks: func(cmd *getKubeConfigCommand) {
+				cmd.flags.authenticatorName = ""
+				cmd.flags.authenticatorType = ""
+
+				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
+					return pinnipedfake.NewSimpleClientset(
+						&authv1alpha.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Namespace: "test-namespace", Name: "discovered-authenticator"}},
+						newCredentialIssuer("pinniped-config", "test-namespace", "https://example.com", "test-ca"),
+					), nil
+				}
+			},
+			wantStderr: `WARNING: Server and certificate authority did not match between local kubeconfig and Pinniped's CredentialIssuer on the cluster. Using local kubeconfig values.`,
+			wantStdout: expectedKubeconfigYAML{
+				clusterCAData:     "ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==",
+				clusterServer:     "https://fake-server-url-value",
+				command:           "/path/to/pinniped",
+				token:             "test-token",
+				pinnipedEndpoint:  "https://fake-server-url-value",
+				pinnipedCABundle:  "fake-certificate-authority-data-value",
+				namespace:         "test-namespace",
+				authenticatorType: "webhook",
+				authenticatorName: "discovered-authenticator",
+			}.String(),
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			// Start with a default getKubeConfigCommand, set some defaults, then apply any mocks.
+			c := newGetKubeConfigCommand()
+			c.flags.token = "test-token"
+			c.flags.namespace = "test-namespace"
+			c.flags.authenticatorName = "test-authenticator-name"
+			c.flags.authenticatorType = "test-authenticator-type"
+			c.getPathToSelf = func() (string, error) { return "/path/to/pinniped", nil }
+			c.flags.kubeconfig = "./testdata/kubeconfig.yaml"
+			tt.mocks(c)
+
+			cmd := &cobra.Command{}
+			var stdout, stderr bytes.Buffer
+			cmd.SetOut(&stdout)
+			cmd.SetErr(&stderr)
+			cmd.SetArgs([]string{})
+			err := c.run(cmd, []string{})
+			if tt.wantError != "" {
+				require.EqualError(t, err, tt.wantError)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, strings.TrimSpace(tt.wantStdout), strings.TrimSpace(stdout.String()), "unexpected stdout")
+			require.Equal(t, strings.TrimSpace(tt.wantStderr), strings.TrimSpace(stderr.String()), "unexpected stderr")
+		})
+	}
+}

cmd/pinniped/cmd/login.go

@@ -0,0 +1,21 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+//nolint: gochecknoglobals
+var loginCmd = &cobra.Command{
+	Use:          "login",
+	Short:        "login",
+	Long:         "Login to a Pinniped server",
+	SilenceUsage: true, // do not print usage message when commands fail
+}
+
+//nolint: gochecknoinits
+func init() {
+	rootCmd.AddCommand(loginCmd)
+}

cmd/pinniped/cmd/login_oidc.go

@@ -0,0 +1,118 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
+	"k8s.io/klog/v2/klogr"
+
+	"go.pinniped.dev/internal/oidcclient"
+	"go.pinniped.dev/internal/oidcclient/filesession"
+)
+
+//nolint: gochecknoinits
+func init() {
+	loginCmd.AddCommand(oidcLoginCommand(oidcclient.Login))
+}
+
+func oidcLoginCommand(loginFunc func(issuer string, clientID string, opts ...oidcclient.Option) (*oidcclient.Token, error)) *cobra.Command {
+	var (
+		cmd = cobra.Command{
+			Args:         cobra.NoArgs,
+			Use:          "oidc --issuer ISSUER --client-id CLIENT_ID",
+			Short:        "Login using an OpenID Connect provider",
+			SilenceUsage: true,
+		}
+		issuer            string
+		clientID          string
+		listenPort        uint16
+		scopes            []string
+		skipBrowser       bool
+		sessionCachePath  string
+		debugSessionCache bool
+	)
+	cmd.Flags().StringVar(&issuer, "issuer", "", "OpenID Connect issuer URL.")
+	cmd.Flags().StringVar(&clientID, "client-id", "", "OpenID Connect client ID.")
+	cmd.Flags().Uint16Var(&listenPort, "listen-port", 0, "TCP port for localhost listener (authorization code flow only).")
+	cmd.Flags().StringSliceVar(&scopes, "scopes", []string{"offline_access", "openid", "email", "profile"}, "OIDC scopes to request during login.")
+	cmd.Flags().BoolVar(&skipBrowser, "skip-browser", false, "Skip opening the browser (just print the URL).")
+	cmd.Flags().StringVar(&sessionCachePath, "session-cache", filepath.Join(mustGetConfigDir(), "sessions.yaml"), "Path to session cache file.")
+	cmd.Flags().BoolVar(&debugSessionCache, "debug-session-cache", false, "Print debug logs related to the session cache.")
+	mustMarkHidden(&cmd, "debug-session-cache")
+	mustMarkRequired(&cmd, "issuer", "client-id")
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		// Initialize the session cache.
+		var sessionOptions []filesession.Option
+
+		// If the hidden --debug-session-cache option is passed, log all the errors from the session cache with klog.
+		if debugSessionCache {
+			logger := klogr.New().WithName("session")
+			sessionOptions = append(sessionOptions, filesession.WithErrorReporter(func(err error) {
+				logger.Error(err, "error during session cache operation")
+			}))
+		}
+		sessionCache := filesession.New(sessionCachePath, sessionOptions...)
+
+		// Initialize the login handler.
+		opts := []oidcclient.Option{
+			oidcclient.WithContext(cmd.Context()),
+			oidcclient.WithScopes(scopes),
+			oidcclient.WithSessionCache(sessionCache),
+		}
+
+		if listenPort != 0 {
+			opts = append(opts, oidcclient.WithListenPort(listenPort))
+		}
+
+		// --skip-browser replaces the default "browser open" function with one that prints to stderr.
+		if skipBrowser {
+			opts = append(opts, oidcclient.WithBrowserOpen(func(url string) error {
+				cmd.PrintErr("Please log in: ", url, "\n")
+				return nil
+			}))
+		}
+
+		tok, err := loginFunc(issuer, clientID, opts...)
+		if err != nil {
+			return err
+		}
+
+		// Convert the token out to Kubernetes ExecCredential JSON format for output.
+		return json.NewEncoder(cmd.OutOrStdout()).Encode(&clientauthenticationv1beta1.ExecCredential{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "ExecCredential",
+				APIVersion: "client.authentication.k8s.io/v1beta1",
+			},
+			Status: &clientauthenticationv1beta1.ExecCredentialStatus{
+				ExpirationTimestamp: &tok.IDToken.Expiry,
+				Token:               tok.IDToken.Token,
+			},
+		})
+	}
+	return &cmd
+}
+
+// mustGetConfigDir returns a directory that follows the XDG base directory convention:
+//   $XDG_CONFIG_HOME defines the base directory relative to which user specific configuration files should
+//   be stored. If $XDG_CONFIG_HOME is either not set or empty, a default equal to $HOME/.config should be used.
+// [1] https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
+func mustGetConfigDir() string {
+	const xdgAppName = "pinniped"
+
+	if path := os.Getenv("XDG_CONFIG_HOME"); path != "" {
+		return filepath.Join(path, xdgAppName)
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		panic(err)
+	}
+	return filepath.Join(home, ".config", xdgAppName)
+}

cmd/pinniped/cmd/login_oidc_test.go

@@ -0,0 +1,127 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"bytes"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"go.pinniped.dev/internal/here"
+	"go.pinniped.dev/internal/oidcclient"
+)
+
+func TestLoginOIDCCommand(t *testing.T) {
+	t.Parallel()
+
+	cfgDir := mustGetConfigDir()
+
+	time1 := time.Date(3020, 10, 12, 13, 14, 15, 16, time.UTC)
+
+	tests := []struct {
+		name             string
+		args             []string
+		wantError        bool
+		wantStdout       string
+		wantStderr       string
+		wantIssuer       string
+		wantClientID     string
+		wantOptionsCount int
+	}{
+		{
+			name: "help flag passed",
+			args: []string{"--help"},
+			wantStdout: here.Doc(`
+				Login using an OpenID Connect provider
+
+				Usage:
+				  oidc --issuer ISSUER --client-id CLIENT_ID [flags]
+
+				Flags:
+					  --client-id string       OpenID Connect client ID.
+				  -h, --help                   help for oidc
+					  --issuer string          OpenID Connect issuer URL.
+					  --listen-port uint16     TCP port for localhost listener (authorization code flow only).
+					  --scopes strings         OIDC scopes to request during login. (default [offline_access,openid,email,profile])
+					  --session-cache string   Path to session cache file. (default "` + cfgDir + `/sessions.yaml")
+					  --skip-browser           Skip opening the browser (just print the URL).
+			`),
+		},
+		{
+			name:      "missing required flags",
+			args:      []string{},
+			wantError: true,
+			wantStdout: here.Doc(`
+				Error: required flag(s) "client-id", "issuer" not set
+			`),
+		},
+		{
+			name: "success with minimal options",
+			args: []string{
+				"--client-id", "test-client-id",
+				"--issuer", "test-issuer",
+			},
+			wantIssuer:       "test-issuer",
+			wantClientID:     "test-client-id",
+			wantOptionsCount: 3,
+			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
+		},
+		{
+			name: "success with all options",
+			args: []string{
+				"--client-id", "test-client-id",
+				"--issuer", "test-issuer",
+				"--skip-browser",
+				"--listen-port", "1234",
+				"--debug-session-cache",
+			},
+			wantIssuer:       "test-issuer",
+			wantClientID:     "test-client-id",
+			wantOptionsCount: 5,
+			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			var (
+				gotIssuer   string
+				gotClientID string
+				gotOptions  []oidcclient.Option
+			)
+			cmd := oidcLoginCommand(func(issuer string, clientID string, opts ...oidcclient.Option) (*oidcclient.Token, error) {
+				gotIssuer = issuer
+				gotClientID = clientID
+				gotOptions = opts
+				return &oidcclient.Token{
+					IDToken: &oidcclient.IDToken{
+						Token:  "test-id-token",
+						Expiry: metav1.NewTime(time1),
+					},
+				}, nil
+			})
+			require.NotNil(t, cmd)
+
+			var stdout, stderr bytes.Buffer
+			cmd.SetOut(&stdout)
+			cmd.SetErr(&stderr)
+			cmd.SetArgs(tt.args)
+			err := cmd.Execute()
+			if tt.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tt.wantStdout, stdout.String(), "unexpected stdout")
+			require.Equal(t, tt.wantStderr, stderr.String(), "unexpected stderr")
+			require.Equal(t, tt.wantIssuer, gotIssuer, "unexpected issuer")
+			require.Equal(t, tt.wantClientID, gotClientID, "unexpected client ID")
+			require.Len(t, gotOptions, tt.wantOptionsCount)
+		})
+	}
+}

cmd/pinniped/cmd/root.go

@@ -0,0 +1,28 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+//nolint: gochecknoglobals
+var rootCmd = &cobra.Command{
+	Use:          "pinniped",
+	Short:        "pinniped",
+	Long:         "pinniped is the client-side binary for use with Pinniped-enabled Kubernetes clusters.",
+	SilenceUsage: true, // do not print usage message when commands fail
+}
+
+// Execute adds all child commands to the root command and sets flags appropriately.
+// This is called by main.main(). It only needs to happen once to the rootCmd.
+func Execute() {
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}

cmd/pinniped/cmd/testdata/kubeconfig.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+clusters:
+  - cluster:
+      certificate-authority-data: ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ== # fake-certificate-authority-data-value
+      server: https://fake-server-url-value
+    name: kind-kind
+  - cluster:
+      certificate-authority-data: c29tZS1vdGhlci1mYWtlLWNlcnRpZmljYXRlLWF1dGhvcml0eS1kYXRhLXZhbHVl # some-other-fake-certificate-authority-data-value
+      server: https://some-other-fake-server-url-value
+    name: some-other-cluster
+contexts:
+  - context:
+      cluster: kind-kind
+      user: kind-kind
+    name: kind-kind
+  - context:
+      cluster: some-other-cluster
+      user: some-other-user
+    name: some-other-context
+current-context: kind-kind
+kind: Config
+preferences: {}
+users:
+  - name: kind-kind
+    user:
+      client-certificate-data: ZmFrZS1jbGllbnQtY2VydGlmaWNhdGUtZGF0YS12YWx1ZQ== # fake-client-certificate-data-value
+      client-key-data: ZmFrZS1jbGllbnQta2V5LWRhdGEtdmFsdWU= # fake-client-key-data-value
+  - name: some-other-user
+    user:
+      client-certificate-data: c29tZS1vdGhlci1mYWtlLWNsaWVudC1jZXJ0aWZpY2F0ZS1kYXRhLXZhbHVl # some-other-fake-client-certificate-data-value
+      client-key-data: c29tZS1vdGhlci1mYWtlLWNsaWVudC1rZXktZGF0YS12YWx1ZQ== # some-other-fake-client-key-data-value

cmd/pinniped/cmd/version.go

@@ -0,0 +1,28 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+	"k8s.io/component-base/version"
+)
+
+//nolint: gochecknoinits
+func init() {
+	rootCmd.AddCommand(newVersionCommand())
+}
+
+func newVersionCommand() *cobra.Command {
+	return &cobra.Command{
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			fmt.Fprintf(cmd.OutOrStdout(), "%#v\n", version.Get())
+			return nil
+		},
+		Args:  cobra.NoArgs, // do not accept positional arguments for this command
+		Use:   "version",
+		Short: "Print the version of this Pinniped CLI",
+	}
+}

cmd/pinniped/cmd/version_test.go

@@ -0,0 +1,85 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"go.pinniped.dev/internal/here"
+)
+
+var (
+	knownGoodUsageRegexpForVersion = here.Doc(`
+		Usage:
+		  version \[flags\]
+
+		Flags:
+		  -h, --help   help for version
+
+		`)
+
+	knownGoodHelpRegexpForVersion = here.Doc(`
+		Print the version of this Pinniped CLI
+
+		Usage:
+		  version \[flags\]
+
+		Flags:
+		  -h, --help   help for version
+		`)
+
+	emptyVersionRegexp = `version.Info{Major:"", Minor:"", GitVersion:".*", GitCommit:".*", GitTreeState:"", BuildDate:".*", GoVersion:".*", Compiler:".*", Platform:".*/.*"}`
+)
+
+func TestNewVersionCmd(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name             string
+		args             []string
+		wantError        bool
+		wantStdoutRegexp string
+		wantStderr       string
+	}{
+		{
+			name:             "no flags",
+			args:             []string{},
+			wantStdoutRegexp: emptyVersionRegexp + "\n",
+		},
+		{
+			name:             "help flag passed",
+			args:             []string{"--help"},
+			wantStdoutRegexp: knownGoodHelpRegexpForVersion,
+		},
+		{
+			name:             "arg passed",
+			args:             []string{"tuna"},
+			wantError:        true,
+			wantStdoutRegexp: `Error: unknown command "tuna" for "version"` + "\n" + knownGoodUsageRegexpForVersion,
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			cmd := newVersionCommand()
+			require.NotNil(t, cmd)
+
+			var stdout, stderr bytes.Buffer
+			cmd.SetOut(&stdout)
+			cmd.SetErr(&stderr)
+			cmd.SetArgs(tt.args)
+			err := cmd.Execute()
+			if tt.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Regexp(t, tt.wantStdoutRegexp, stdout.String(), "unexpected stdout")
+			require.Equal(t, tt.wantStderr, stderr.String(), "unexpected stderr")
+		})
+	}
+}

cmd/pinniped/main.go

@@ -0,0 +1,10 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import "go.pinniped.dev/cmd/pinniped/cmd"
+
+func main() {
+	cmd.Execute()
+}

deploy/concierge/README.md

@@ -0,0 +1,39 @@
+# Deploying
+
+## Connecting Pinniped to an Identity Provider
+
+If you would like to try Pinniped, but you don't have a compatible identity provider,
+you can use Pinniped's test identity provider.
+See [deploy/local-user-authenticator/README.md](../../deploy/local-user-authenticator/README.md)
+for details.
+
+## Installing the Latest Version with Default Options
+
+```bash
+kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/$(curl https://api.github.com/repos/vmware-tanzu/pinniped/releases/latest -s | jq .name -r)/install-pinniped-concierge.yaml
+```
+
+## Installing an Older Version with Default Options
+
+Choose your preferred [release](https://github.com/vmware-tanzu/pinniped/releases) version number
+and use it to replace the version number in the URL below.
+
+```bash
+# Replace v0.2.0 with your preferred version in the URL below
+kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/v0.2.0/install-pinniped-concierge.yaml
+```
+
+## Installing with Custom Options
+
+Creating your own deployment YAML file requires `ytt` from [Carvel](https://carvel.dev/) to template the YAML files
+in the `deploy/concierge` directory.
+Either [install `ytt`](https://get-ytt.io/) or use the [container image from Dockerhub](https://hub.docker.com/r/k14s/image/tags).
+
+1. `git clone` this repo and `git checkout` the release version tag of the release that you would like to deploy.
+1. The configuration options are in [deploy/concierge/values.yml](values.yaml).
+   Fill in the values in that file, or override those values using additional `ytt` command-line options in
+   the command below. Use the release version tag as the `image_tag` value.
+2. In a terminal, cd to this `deploy/concierge` directory
+3. To generate the final YAML files, run `ytt --file .`
+4. Deploy the generated YAML using your preferred deployment tool, such as `kubectl` or [`kapp`](https://get-kapp.io/).
+   For example: `ytt --file . | kapp deploy --yes --app pinniped --diff-changes --file -`

deploy/concierge/authentication.concierge.pinniped.dev_webhookauthenticators.yaml

@@ -0,0 +1,146 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.0
+  creationTimestamp: null
+  name: webhookauthenticators.authentication.concierge.pinniped.dev
+spec:
+  group: authentication.concierge.pinniped.dev
+  names:
+    categories:
+    - all
+    - authenticator
+    - authenticators
+    kind: WebhookAuthenticator
+    listKind: WebhookAuthenticatorList
+    plural: webhookauthenticators
+    singular: webhookauthenticator
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.endpoint
+      name: Endpoint
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: WebhookAuthenticator describes the configuration of a webhook
+          authenticator.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec for configuring the authenticator.
+            properties:
+              endpoint:
+                description: Webhook server endpoint URL.
+                minLength: 1
+                pattern: ^https://
+                type: string
+              tls:
+                description: TLS configuration.
+                properties:
+                  certificateAuthorityData:
+                    description: X.509 Certificate Authority (base64-encoded PEM bundle).
+                      If omitted, a default set of system roots will be trusted.
+                    type: string
+                type: object
+            required:
+            - endpoint
+            type: object
+          status:
+            description: Status of the authenticator.
+            properties:
+              conditions:
+                description: Represents the observations of the authenticator's current
+                  state.
+                items:
+                  description: Condition status of a resource (mirrored from the metav1.Condition
+                    type added in Kubernetes 1.19). In a future API version we can
+                    switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml

@@ -0,0 +1,108 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.0
+  creationTimestamp: null
+  name: credentialissuers.config.concierge.pinniped.dev
+spec:
+  group: config.concierge.pinniped.dev
+  names:
+    kind: CredentialIssuer
+    listKind: CredentialIssuerList
+    plural: credentialissuers
+    singular: credentialissuer
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          status:
+            description: Status of the credential issuer.
+            properties:
+              kubeConfigInfo:
+                description: Information needed to form a valid Pinniped-based kubeconfig
+                  using this credential issuer.
+                properties:
+                  certificateAuthorityData:
+                    description: The K8s API server CA bundle.
+                    minLength: 1
+                    type: string
+                  server:
+                    description: The K8s API server URL.
+                    minLength: 1
+                    pattern: ^https://|^http://
+                    type: string
+                required:
+                - certificateAuthorityData
+                - server
+                type: object
+              strategies:
+                description: List of integration strategies that were attempted by
+                  Pinniped.
+                items:
+                  description: Status of an integration strategy that was attempted
+                    by Pinniped.
+                  properties:
+                    lastUpdateTime:
+                      description: When the status was last checked.
+                      format: date-time
+                      type: string
+                    message:
+                      description: Human-readable description of the current status.
+                      minLength: 1
+                      type: string
+                    reason:
+                      description: Reason for the current status.
+                      enum:
+                      - FetchedKey
+                      - CouldNotFetchKey
+                      type: string
+                    status:
+                      description: Status of the attempted integration strategy.
+                      enum:
+                      - Success
+                      - Error
+                      type: string
+                    type:
+                      description: Type of integration attempted.
+                      enum:
+                      - KubeClusterSigningCertificate
+                      type: string
+                  required:
+                  - lastUpdateTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+            required:
+            - strategies
+            type: object
+        required:
+        - status
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

deploy/concierge/deployment.yaml

@@ -0,0 +1,199 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+#@ load("@ytt:json", "json")
+#@ load("helpers.lib.yaml", "defaultLabel", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+
+#@ if not data.values.into_namespace:
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: #@ data.values.namespace
+  labels: #@ labels()
+#@ end
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: #@ defaultResourceName()
+  namespace: #@ namespace()
+  labels: #@ labels()
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: #@ defaultResourceNameWithSuffix("config")
+  namespace: #@ namespace()
+  labels: #@ labels()
+data:
+  #! If names.apiService is changed in this ConfigMap, must also change name of the ClusterIP Service resource below.
+  #@yaml/text-templated-strings
+  pinniped.yaml: |
+    discovery:
+      url: (@= data.values.discovery_url or "null" @)
+    api:
+      servingCertificate:
+        durationSeconds: (@= str(data.values.api_serving_certificate_duration_seconds) @)
+        renewBeforeSeconds: (@= str(data.values.api_serving_certificate_renew_before_seconds) @)
+    names:
+      servingCertificateSecret: (@= defaultResourceNameWithSuffix("api-tls-serving-certificate") @)
+      credentialIssuer: (@= defaultResourceNameWithSuffix("config") @)
+      apiService: (@= defaultResourceNameWithSuffix("api") @)
+    labels: (@= json.encode(labels()).rstrip() @)
+    kubeCertAgent:
+      namePrefix: (@= defaultResourceNameWithSuffix("kube-cert-agent-") @)
+      (@ if data.values.kube_cert_agent_image: @)
+      image: (@= data.values.kube_cert_agent_image @)
+      (@ else: @)
+      (@ if data.values.image_digest: @)
+      image: (@= data.values.image_repo + "@" + data.values.image_digest @)
+      (@ else: @)
+      image: (@= data.values.image_repo + ":" + data.values.image_tag @)
+      (@ end @)
+      (@ end @)
+      (@ if data.values.image_pull_dockerconfigjson: @)
+      imagePullSecrets:
+        - image-pull-secret
+      (@ end @)
+---
+#@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
+apiVersion: v1
+kind: Secret
+metadata:
+  name: image-pull-secret
+  namespace: #@ namespace()
+  labels: #@ labels()
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: #@ data.values.image_pull_dockerconfigjson
+#@ end
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: #@ defaultResourceName()
+  namespace: #@ namespace()
+  labels: #@ labels()
+spec:
+  replicas: #@ data.values.replicas
+  selector:
+    matchLabels: #@ defaultLabel()
+  template:
+    metadata:
+      labels: #@ defaultLabel()
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ""
+    spec:
+      securityContext:
+        runAsUser: 1001
+        runAsGroup: 1001
+      serviceAccountName: #@ defaultResourceName()
+      #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
+      imagePullSecrets:
+        - name: image-pull-secret
+      #@ end
+      containers:
+        - name: #@ defaultResourceName()
+          #@ if data.values.image_digest:
+          image:  #@ data.values.image_repo + "@" + data.values.image_digest
+          #@ else:
+          image: #@ data.values.image_repo + ":" + data.values.image_tag
+          #@ end
+          imagePullPolicy: IfNotPresent
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "100m"
+              memory: "128Mi"
+          args:
+            - --config=/etc/config/pinniped.yaml
+            - --downward-api-path=/etc/podinfo
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/config
+            - name: podinfo
+              mountPath: /etc/podinfo
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8443
+              scheme: HTTPS
+            initialDelaySeconds: 2
+            timeoutSeconds: 15
+            periodSeconds: 10
+            failureThreshold: 5
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8443
+              scheme: HTTPS
+            initialDelaySeconds: 2
+            timeoutSeconds: 3
+            periodSeconds: 10
+            failureThreshold: 3
+      volumes:
+        - name: config-volume
+          configMap:
+            name: #@ defaultResourceNameWithSuffix("config")
+        - name: podinfo
+          downwardAPI:
+            items:
+              - path: "labels"
+                fieldRef:
+                  fieldPath: metadata.labels
+              - path: "namespace"
+                fieldRef:
+                  fieldPath: metadata.namespace
+      tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/master #! Allow running on master nodes too
+          effect: NoSchedule
+      #! "system-cluster-critical" cannot be used outside the kube-system namespace until Kubernetes >= 1.17,
+      #! so we skip setting this for now (see https://github.com/kubernetes/kubernetes/issues/60596).
+      #!priorityClassName: system-cluster-critical
+      #! This will help make sure our multiple pods run on different nodes, making
+      #! our deployment "more" "HA".
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 50
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels: #@ defaultLabel()
+                topologyKey: kubernetes.io/hostname
+---
+apiVersion: v1
+kind: Service
+metadata:
+  #! If name is changed, must also change names.apiService in the ConfigMap above and spec.service.name in the APIService below.
+  name: #@ defaultResourceNameWithSuffix("api")
+  namespace: #@ namespace()
+  labels: #@ labels()
+spec:
+  type: ClusterIP
+  selector: #@ defaultLabel()
+  ports:
+    - protocol: TCP
+      port: 443
+      targetPort: 8443
+---
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1alpha1.login.concierge.pinniped.dev
+  labels: #@ labels()
+spec:
+  version: v1alpha1
+  group: login.concierge.pinniped.dev
+  groupPriorityMinimum: 2500
+  versionPriority: 10
+  #! caBundle: Do not include this key here. Starts out null, will be updated/owned by the golang code.
+  service:
+    name: #@ defaultResourceNameWithSuffix("api")
+    namespace: #@ namespace()
+    port: 443

deploy/concierge/helpers.lib.yaml

@@ -0,0 +1,30 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+#@ load("@ytt:template", "template")
+
+#@ def defaultResourceName():
+#@   return data.values.app_name
+#@ end
+
+#@ def defaultResourceNameWithSuffix(suffix):
+#@   return data.values.app_name + "-" + suffix
+#@ end
+
+#@ def namespace():
+#@   if data.values.into_namespace:
+#@     return data.values.into_namespace
+#@   else:
+#@     return data.values.namespace
+#@   end
+#@ end
+
+#@ def defaultLabel():
+app: #@ data.values.app_name
+#@ end
+
+#@ def labels():
+_: #@ template.replace(defaultLabel())
+_: #@ template.replace(data.values.custom_labels)
+#@ end

deploy/concierge/rbac.yaml

@@ -0,0 +1,200 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+#@ load("helpers.lib.yaml", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+
+#! Give permission to various cluster-scoped objects
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: #@ defaultResourceNameWithSuffix("aggregated-api-server")
+  labels: #@ labels()
+rules:
+  - apiGroups: [ "" ]
+    resources: [ namespaces ]
+    verbs: [ get, list, watch ]
+  - apiGroups: [ apiregistration.k8s.io ]
+    resources: [ apiservices ]
+    verbs: [ create, get, list, patch, update, watch ]
+  - apiGroups: [ admissionregistration.k8s.io ]
+    resources: [ validatingwebhookconfigurations, mutatingwebhookconfigurations ]
+    verbs: [ get, list, watch ]
+  - apiGroups: [ policy ]
+    resources: [ podsecuritypolicies ]
+    verbs: [ use ]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceNameWithSuffix("aggregated-api-server")
+  labels: #@ labels()
+subjects:
+  - kind: ServiceAccount
+    name: #@ defaultResourceName()
+    namespace: #@ namespace()
+roleRef:
+  kind: ClusterRole
+  name: #@ defaultResourceNameWithSuffix("aggregated-api-server")
+  apiGroup: rbac.authorization.k8s.io
+
+#! Give permission to various objects within the app's own namespace
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: #@ defaultResourceNameWithSuffix("aggregated-api-server")
+  namespace: #@ namespace()
+  labels: #@ labels()
+rules:
+  - apiGroups: [ "" ]
+    resources: [ services ]
+    verbs: [ create, get, list, patch, update, watch ]
+  - apiGroups: [ "" ]
+    resources: [ secrets ]
+    verbs: [ create, get, list, patch, update, watch, delete ]
+  #! We need to be able to CRUD pods in our namespace so we can reconcile the kube-cert-agent pods.
+  - apiGroups: [ "" ]
+    resources: [ pods ]
+    verbs: [ create, get, list, patch, update, watch, delete ]
+  #! We need to be able to exec into pods in our namespace so we can grab the API server's private key
+  - apiGroups: [ "" ]
+    resources: [ pods/exec ]
+    verbs: [ create ]
+  - apiGroups: [ config.concierge.pinniped.dev, authentication.concierge.pinniped.dev ]
+    resources: [ "*" ]
+    verbs: [ create, get, list, update, watch ]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceNameWithSuffix("aggregated-api-server")
+  namespace: #@ namespace()
+  labels: #@ labels()
+subjects:
+  - kind: ServiceAccount
+    name: #@ defaultResourceName()
+    namespace: #@ namespace()
+roleRef:
+  kind: Role
+  name: #@ defaultResourceNameWithSuffix("aggregated-api-server")
+  apiGroup: rbac.authorization.k8s.io
+
+#! Give permission to read pods in the kube-system namespace so we can find the API server's private key
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: #@ defaultResourceNameWithSuffix("kube-system-pod-read")
+  namespace: kube-system
+  labels: #@ labels()
+rules:
+  - apiGroups: [ "" ]
+    resources: [ pods ]
+    verbs: [ get, list, watch ]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceNameWithSuffix("kube-system-pod-read")
+  namespace: kube-system
+  labels: #@ labels()
+subjects:
+  - kind: ServiceAccount
+    name: #@ defaultResourceName()
+    namespace: #@ namespace()
+roleRef:
+  kind: Role
+  name: #@ defaultResourceNameWithSuffix("kube-system-pod-read")
+  apiGroup: rbac.authorization.k8s.io
+
+#! Allow both authenticated and unauthenticated TokenCredentialRequests (i.e. allow all requests)
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: #@ defaultResourceNameWithSuffix("create-token-credential-requests")
+  labels: #@ labels()
+rules:
+  - apiGroups: [ login.concierge.pinniped.dev ]
+    resources: [ tokencredentialrequests ]
+    verbs: [ create ]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceNameWithSuffix("create-token-credential-requests")
+  labels: #@ labels()
+subjects:
+  - kind: Group
+    name: system:authenticated
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: system:unauthenticated
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: #@ defaultResourceNameWithSuffix("create-token-credential-requests")
+  apiGroup: rbac.authorization.k8s.io
+
+#! Give permissions for subjectaccessreviews, tokenreview that is needed by aggregated api servers
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceName()
+  labels: #@ labels()
+subjects:
+  - kind: ServiceAccount
+    name: #@ defaultResourceName()
+    namespace: #@ namespace()
+roleRef:
+  kind: ClusterRole
+  name: system:auth-delegator
+  apiGroup: rbac.authorization.k8s.io
+
+#! Give permissions for a special configmap of CA bundles that is needed by aggregated api servers
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceNameWithSuffix("extension-apiserver-authentication-reader")
+  namespace: kube-system
+  labels: #@ labels()
+subjects:
+  - kind: ServiceAccount
+    name: #@ defaultResourceName()
+    namespace: #@ namespace()
+roleRef:
+  kind: Role
+  name: extension-apiserver-authentication-reader
+  apiGroup: rbac.authorization.k8s.io
+
+#! Give permission to list and watch ConfigMaps in kube-public
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceNameWithSuffix("cluster-info-lister-watcher")
+  namespace: kube-public
+  labels: #@ labels()
+rules:
+  - apiGroups: [ "" ]
+    resources: [ configmaps ]
+    verbs: [ list, watch ]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceNameWithSuffix("cluster-info-lister-watcher")
+  namespace: kube-public
+  labels: #@ labels()
+subjects:
+  - kind: ServiceAccount
+    name: #@ defaultResourceName()
+    namespace: #@ namespace()
+roleRef:
+  kind: Role
+  name: #@ defaultResourceNameWithSuffix("cluster-info-lister-watcher")
+  apiGroup: rbac.authorization.k8s.io

deploy/concierge/values.yaml

@@ -0,0 +1,52 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@data/values
+---
+
+app_name: pinniped-concierge
+
+#! Creates a new namespace statically in yaml with the given name and installs the app into that namespace.
+namespace: pinniped-concierge
+#! If specified, assumes that a namespace of the given name already exists and installs the app into that namespace.
+#! If both `namespace` and `into_namespace` are specified, then only `into_namespace` is used.
+into_namespace: #! e.g. my-preexisting-namespace
+
+#! All resources created statically by yaml at install-time and all resources created dynamically
+#! by controllers at runtime will be labelled with `app: $app_name` and also with the labels
+#! specified here. The value of `custom_labels` must be a map of string keys to string values.
+#! The app can be uninstalled either by:
+#! 1. Deleting the static install-time yaml resources including the static namespace, which will cascade and also delete
+#!    resources that were dynamically created by controllers at runtime
+#! 2. Or, deleting all resources by label, which does not assume that there was a static install-time yaml namespace.
+custom_labels: {} #! e.g. {myCustomLabelName: myCustomLabelValue, otherCustomLabelName: otherCustomLabelValue}
+
+#! Specify how many replicas of the Pinniped server to run.
+replicas: 2
+
+#! Specify either an image_digest or an image_tag. If both are given, only image_digest will be used.
+image_repo: docker.io/getpinniped/pinniped-server
+image_digest: #! e.g. sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8
+image_tag: latest
+
+#! Optionally specify a different image for the "kube-cert-agent" pod which is scheduled
+#! on the control plane. This image needs only to include `sleep` and `cat` binaries.
+#! By default, the same image specified for image_repo/image_digest/image_tag will be re-used.
+kube_cert_agent_image:
+
+#! Specifies a secret to be used when pulling the above `image_repo` container image.
+#! Can be used when the above image_repo is a private registry.
+#! Typically the value would be the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username="USERNAME" --docker-password="PASSWORD" --dry-run=client -o json | jq -r '.data[".dockerconfigjson"]'
+#! Optional.
+image_pull_dockerconfigjson: #! e.g. {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}
+
+#! Pinniped will try to guess the right K8s API URL for sharing that information with potential clients.
+#! This settings allows the guess to be overridden.
+#! Optional.
+discovery_url: #! e.g., https://example.com
+
+#! Specify the duration and renewal interval for the API serving certificate.
+#! The defaults are set to expire the cert about every 30 days, and to rotate it
+#! about every 25 days.
+api_serving_certificate_duration_seconds: 2592000
+api_serving_certificate_renew_before_seconds: 2160000

deploy/concierge/z0_crd_overlay.yaml

@@ -0,0 +1,17 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:overlay", "overlay")
+#@ load("helpers.lib.yaml", "labels")
+
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"credentialissuers.config.concierge.pinniped.dev"}}), expects=1
+---
+metadata:
+  #@overlay/match missing_ok=True
+  labels: #@ labels()
+
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"webhookauthenticators.authentication.concierge.pinniped.dev"}}), expects=1
+---
+metadata:
+  #@overlay/match missing_ok=True
+  labels: #@ labels()

deploy/local-user-authenticator/README.md

@@ -0,0 +1,163 @@
+# Deploying local-user-authenticator
+
+## What is local-user-authenticator?
+
+The local-user-authenticator app is an identity provider used for integration testing and demos.
+If you would like to demo Pinniped, but you don't have a compatible identity provider handy,
+you can use Pinniped's local-user-authenticator identity provider. Note that this is not recommended for
+production use.
+
+The local-user-authenticator is a Kubernetes Deployment which runs a webhook server that implements the Kubernetes
+[Webhook Token Authentication interface](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication).
+
+User accounts can be created and edited dynamically using `kubectl` commands (see below).
+
+## Installing the Latest Version with Default Options
+
+```bash
+kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/latest/download/install-local-user-authenticator.yaml
+```
+
+## Installing an Older Version with Default Options
+
+Choose your preferred [release](https://github.com/vmware-tanzu/pinniped/releases) version number
+and use it to replace the version number in the URL below.
+
+```bash
+# Replace v0.2.0 with your preferred version in the URL below
+kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/v0.2.0/install-local-user-authenticator.yaml
+```
+
+## Installing with Custom Options
+
+Creating your own deployment YAML file requires `ytt` from [Carvel](https://carvel.dev/) to template the YAML files
+in the `deploy/local-user-authenticator` directory.
+Either [install `ytt`](https://get-ytt.io/) or use the [container image from Dockerhub](https://hub.docker.com/r/k14s/image/tags).
+
+1. `git clone` this repo and `git checkout` the release version tag of the release that you would like to deploy.
+1. The configuration options are in [deploy/local-user-authenticator/values.yml](values.yaml).
+   Fill in the values in that file, or override those values using additional `ytt` command-line options in
+   the command below. Use the release version tag as the `image_tag` value.
+2. In a terminal, cd to this `deploy/local-user-authenticator` directory
+3. To generate the final YAML files, run `ytt --file .`
+4. Deploy the generated YAML using your preferred deployment tool, such as `kubectl` or [`kapp`](https://get-kapp.io/).
+   For example: `ytt --file . | kapp deploy --yes --app local-user-authenticator --diff-changes --file -`
+
+## Configuring After Installing
+
+### Create Users
+
+Use `kubectl` to create, edit, and delete user accounts by creating a `Secret` for each user account in the same
+namespace where local-user-authenticator is deployed.  The name of the `Secret` resource is the username.
+Store the user's group membership and `bcrypt` encrypted password as the contents of the `Secret`.
+For example, to create a user named `pinny-the-seal` with the password `password123`
+who belongs to the groups `group1` and `group2`, use:
+
+```bash
+kubectl create secret generic pinny-the-seal \
+  --namespace local-user-authenticator \
+  --from-literal=groups=group1,group2 \
+  --from-literal=passwordHash=$(htpasswd -nbBC 10 x password123 | sed -e "s/^x://")
+```
+
+Note that the above command requires a tool capable of generating a `bcrypt` hash. It uses `htpasswd`,
+which is installed on most macOS systems, and can be
+installed on some Linux systems via the `apache2-utils` package (e.g., `apt-get install apache2-utils`).
+
+### Get the local-user-authenticator App's Auto-Generated Certificate Authority Bundle
+
+Fetch the auto-generated CA bundle for the local-user-authenticator's HTTP TLS endpoint.
+
+```bash
+kubectl get secret local-user-authenticator-tls-serving-certificate --namespace local-user-authenticator \
+  -o jsonpath={.data.caCertificate} \
+  | base64 -d \
+  | tee /tmp/local-user-authenticator-ca
+```
+
+### Configuring Pinniped to Use local-user-authenticator as an Identity Provider
+
+When installing Pinniped on the same cluster, configure local-user-authenticator as an Identity Provider for Pinniped
+using the webhook URL `https://local-user-authenticator.local-user-authenticator.svc/authenticate`
+along with the CA bundle fetched by the above command. See [doc/demo.md](../../doc/demo.md) for an example.
+
+## Optional: Manually Testing the Webhook Endpoint After Installing
+
+The following steps demonstrate the API of the local-user-authenticator app. Typically, a user would not need to
+interact with this API directly. Pinniped will automatically integrate with this API if the local-user-authenticator
+is configured as an identity provider for Pinniped.
+
+  1. Start a pod from which you can curl the endpoint from inside the cluster.
+
+      ```bash
+      kubectl run curlpod --image=curlimages/curl --command -- /bin/sh -c "while true; do echo hi; sleep 120; done"
+      ```
+
+  1. Copy the CA bundle that was fetched above onto the new pod.
+
+      ```bash
+      kubectl cp /tmp/local-user-authenticator-ca curlpod:/tmp/local-user-authenticator-ca
+      ```
+
+  1. Run a `curl` command to try to authenticate as the user created above.
+
+      ```bash
+      kubectl -it exec curlpod -- curl https://local-user-authenticator.local-user-authenticator.svc/authenticate \
+        --cacert /tmp/local-user-authenticator-ca \
+        -H 'Content-Type: application/json' -H 'Accept: application/json' -d '
+      {
+        "apiVersion": "authentication.k8s.io/v1beta1",
+        "kind": "TokenReview",
+        "spec": {
+          "token": "pinny-the-seal:password123"
+        }
+      }'
+      ```
+
+      When authentication is successful the above command should return some JSON similar to the following.
+      Note that the value of `authenticated` is `true` to indicate a successful authentication.
+
+      ```json
+      {
+        "kind": "TokenReview",
+        "apiVersion": "authentication.k8s.io/v1beta1",
+        "metadata": {
+          "creationTimestamp": null
+        },
+        "spec": {},
+        "status": {
+          "authenticated": true,
+          "user": {
+            "username": "pinny-the-seal",
+            "uid": "19c433ec-8f58-44ca-9ef0-2d1081ccb876",
+            "groups": [
+              "group1",
+              "group2"
+            ]
+          }
+        }
+      }
+      ```
+
+      Trying the above `curl` command again with the wrong username or password in the body of the request
+      should result in a JSON response which indicates that the authentication failed.
+
+      ```json
+      {
+        "kind": "TokenReview",
+        "apiVersion": "authentication.k8s.io/v1beta1",
+        "metadata": {
+          "creationTimestamp": null
+        },
+        "spec": {},
+        "status": {
+          "user": {}
+        }
+      }
+      ```
+
+  1. Remove the curl pod.
+
+      ```bash
+      kubectl delete pod curlpod
+      ```

deploy/local-user-authenticator/deployment.yaml

@@ -0,0 +1,83 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: local-user-authenticator
+  labels:
+    name: local-user-authenticator
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: local-user-authenticator
+  namespace: local-user-authenticator
+---
+#@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
+apiVersion: v1
+kind: Secret
+metadata:
+  name: image-pull-secret
+  namespace: local-user-authenticator
+  labels:
+    app: local-user-authenticator
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: #@ data.values.image_pull_dockerconfigjson
+#@ end
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: local-user-authenticator
+  namespace: local-user-authenticator
+  labels:
+    app: local-user-authenticator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: local-user-authenticator
+  template:
+    metadata:
+      labels:
+        app: local-user-authenticator
+    spec:
+      securityContext:
+        runAsUser: 1001
+        runAsGroup: 1001
+      serviceAccountName: local-user-authenticator
+      #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
+      imagePullSecrets:
+        - name: image-pull-secret
+      #@ end
+      containers:
+        - name: local-user-authenticator
+          #@ if data.values.image_digest:
+          image:  #@ data.values.image_repo + "@" + data.values.image_digest
+          #@ else:
+          image: #@ data.values.image_repo + ":" + data.values.image_tag
+          #@ end
+          imagePullPolicy: IfNotPresent
+          command: #! override the default entrypoint
+            - /usr/local/bin/local-user-authenticator
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: local-user-authenticator
+  namespace: local-user-authenticator
+  labels:
+    app: local-user-authenticator
+spec:
+  type: ClusterIP
+  selector:
+    app: local-user-authenticator
+  ports:
+    - protocol: TCP
+      port: 443
+      targetPort: 8443

deploy/local-user-authenticator/rbac.yaml

@@ -0,0 +1,30 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+
+#! Give permission to various objects within the app's own namespace
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: local-user-authenticator
+  namespace: local-user-authenticator
+rules:
+  - apiGroups: [""]
+    resources: [secrets]
+    verbs: [create, get, list, patch, update, watch]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: local-user-authenticator
+  namespace: local-user-authenticator
+subjects:
+  - kind: ServiceAccount
+    name: local-user-authenticator
+    namespace: local-user-authenticator
+roleRef:
+  kind: Role
+  name: local-user-authenticator
+  apiGroup: rbac.authorization.k8s.io

deploy/local-user-authenticator/values.yaml

@@ -0,0 +1,16 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@data/values
+---
+
+#! Specify either an image_digest or an image_tag. If both are given, only image_digest will be used.
+image_repo: docker.io/getpinniped/pinniped-server
+image_digest: #! e.g. sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8
+image_tag: latest
+
+#! Specifies a secret to be used when pulling the above `image_repo` container image.
+#! Can be used when the above image_repo is a private registry.
+#! Typically the value would be the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username="USERNAME" --docker-password="PASSWORD" --dry-run=client -o json | jq -r '.data[".dockerconfigjson"]'
+#! Optional.
+image_pull_dockerconfigjson: #! e.g. {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}

deploy/supervisor/README.md

@@ -0,0 +1,184 @@
+# Deploying the Pinniped Supervisor
+
+## What is the Pinniped Supervisor?
+
+The Pinniped Supervisor app is a component of the Pinniped OIDC and Cluster Federation solutions.
+It can be deployed when those features are needed.
+
+## Installing the Latest Version with Default Options
+
+```bash
+kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/latest/download/install-pinniped-supervisor.yaml
+```
+
+## Installing an Older Version with Default Options
+
+Choose your preferred [release](https://github.com/vmware-tanzu/pinniped/releases) version number
+and use it to replace the version number in the URL below.
+
+```bash
+# Replace v0.3.0 with your preferred version in the URL below
+kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/v0.3.0/install-pinniped-supervisor.yaml
+```
+
+## Installing with Custom Options
+
+Creating your own deployment YAML file requires `ytt` from [Carvel](https://carvel.dev/) to template the YAML files
+in the `deploy/supervisor` directory.
+Either [install `ytt`](https://get-ytt.io/) or use the [container image from Dockerhub](https://hub.docker.com/r/k14s/image/tags).
+
+1. `git clone` this repo and `git checkout` the release version tag of the release that you would like to deploy.
+1. The configuration options are in [deploy/supervisor/values.yml](values.yaml).
+   Fill in the values in that file, or override those values using additional `ytt` command-line options in
+   the command below. Use the release version tag as the `image_tag` value.
+2. In a terminal, cd to this `deploy/supervisor` directory
+3. To generate the final YAML files, run `ytt --file .`
+4. Deploy the generated YAML using your preferred deployment tool, such as `kubectl` or [`kapp`](https://get-kapp.io/).
+   For example: `ytt --file . | kapp deploy --yes --app pinniped-supervisor --diff-changes --file -`
+
+## Configuring After Installing
+
+### Exposing the Supervisor App as a Service
+
+The Supervisor app's endpoints should be exposed as HTTPS endpoints with proper TLS certificates signed by a
+Certificate Authority which will be trusted by your user's web browsers. Because there are
+many ways to expose TLS services from a Kubernetes cluster, the Supervisor app leaves this up to the user.
+The most common ways are:
+
+1. Define an [`Ingress` resource](https://kubernetes.io/docs/concepts/services-networking/ingress/) with TLS certificates.
+   In this case, the ingress will terminate TLS. Typically, the ingress will then talk plain HTTP to its backend,
+   which would be a NodePort or LoadBalancer Service in front of the HTTP port 8080 of the Supervisor pods.
+
+   The required configuration of the Ingress is specific to your cluster's Ingress Controller, so please refer to the
+   documentation from your Kubernetes provider. If you are using a cluster from a cloud provider, then you'll probably
+   want to start with that provider's documentation. For example, if your cluster is a Google GKE cluster, refer to
+   the [GKE documentation for Ingress](https://cloud.google.com/kubernetes-engine/docs/concepts/ingress).
+   Otherwise, the Kubernetes documentation provides a list of popular
+   [Ingress Controllers](https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/), including
+   [Contour](https://projectcontour.io/) and many others.
+
+1. Or, define a [TCP LoadBalancer Service](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer)
+   which is a layer 4 load balancer and does not terminate TLS. In this case, the Supervisor app will need to be
+   configured with TLS certificates and will terminate the TLS connection itself (see the section about OIDCProvider
+   below). The LoadBalancer Service should be configured to use the HTTPS port 443 of the Supervisor pods as its `targetPort`.
+
+   *Warning:* Do not expose the Supervisor's port 8080 to the public. It would not be secure for the OIDC protocol
+   to use HTTP, because the user's secret OIDC tokens would be transmitted across the network without encryption.
+
+1. Or, expose the Supervisor app using a Kubernetes service mesh technology, e.g. [Istio](https://istio.io/).
+   Please see the documentation for your service mesh. Generally, the setup would be similar to the description
+   above for defining an ingress, expect the service mesh would probably provide both the ingress with TLS termination
+   and the service.
+
+For either of the first two options mentioned above, if you installed using `ytt` then you can use
+the related `service_*` options from [deploy/supervisor/values.yml](values.yaml) to create a Service.
+If you installed using `install-supervisor.yaml` then you can create
+the Service separately after installing the Supervisor app. There is no `Ingress` included in the `ytt` templates,
+so if you choose to use an Ingress then you'll need to create that separately after installing the Supervisor app.
+
+#### Example: Using a LoadBalancer Service
+
+This is an example of creating a LoadBalancer Service to expose port 8443 of the Supervisor app outside the cluster.
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: pinniped-supervisor-loadbalancer
+  # Assuming that this is the namespace where the supervisor was installed. This is the default in install-supervisor.yaml.
+  namespace: pinniped-supervisor
+spec:
+  type: LoadBalancer
+  selector:
+    # Assuming that this is how the supervisor pods are labeled. This is the default in install-supervisor.yaml.
+    app: pinniped-supervisor
+  ports:
+  - protocol: TCP
+    port: 443
+    targetPort: 8443
+```
+
+#### Example: Using a NodePort Service
+
+A NodePort Service exposes the app as a port on the nodes of the cluster.
+
+This is convenient for use with kind clusters, because kind can
+[expose node ports as localhost ports on the host machine](https://kind.sigs.k8s.io/docs/user/configuration/#extra-port-mappings)
+without requiring an Ingress, although
+[kind also supports several Ingress Controllers](https://kind.sigs.k8s.io/docs/user/ingress).
+
+A NodePort Service could also be used behind an Ingress which is terminating TLS.
+
+For example:
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: pinniped-supervisor-nodeport
+  # Assuming that this is the namespace where the supervisor was installed. This is the default in install-supervisor.yaml.
+  namespace: pinniped-supervisor
+spec:
+  type: NodePort
+  selector:
+    # Assuming that this is how the supervisor pods are labeled. This is the default in install-supervisor.yaml.
+    app: pinniped-supervisor
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 8080
+    nodePort: 31234 # This is the port that you would forward to the kind host. Or omit this key for a random port.
+```
+
+### Configuring the Supervisor to Act as an OIDC Provider
+
+The Supervisor can be configured as an OIDC provider by creating `OIDCProvider` resources
+in the same namespace where the Supervisor app was installed. For example:
+
+```yaml
+apiVersion: config.supervisor.pinniped.dev/v1alpha1
+kind: OIDCProvider
+metadata:
+  name: my-provider
+  # Assuming that this is the namespace where the supervisor was installed. This is the default in install-supervisor.yaml.
+  namespace: pinniped-supervisor
+spec:
+  # The hostname would typically match the DNS name of the public ingress or load balancer for the cluster.
+  # Any path can be specified, which allows a single hostname to have multiple different issuers. The path is optional.
+  issuer: https://my-issuer.example.com/any/path
+
+  # Optionally configure the name of a Secret in the same namespace, of type `kubernetes.io/tls`,
+  # which contains the TLS serving certificate for the HTTPS endpoints served by this OIDC Provider.
+  tls:
+    secretName: my-tls-cert-secret
+```
+
+#### Configuring TLS for the Supervisor OIDC Endpoints
+
+If you have terminated TLS outside the app, for example using an Ingress with TLS certificates, then you do not need to
+configure TLS certificates on the OIDCProvider.
+
+If you are using a LoadBalancer Service to expose the Supervisor app outside your cluster, then you will
+also need to configure the Supervisor app to terminate TLS. There are two places to configure TLS certificates:
+
+1. Each `OIDCProvider` can be configured with TLS certificates, using the `spec.tls.secretName` field.
+
+1. The default TLS certificate for all OIDC providers can be configured by creating a Secret called
+`pinniped-supervisor-default-tls-certificate` in the same namespace in which the Supervisor was installed.
+
+The default TLS certificate will be used for all OIDC providers which did not declare a `spec.tls.secretName`.
+Also, the `spec.tls.secretName` will be ignored for incoming requests to the OIDC endpoints
+that use an IP address as the host, so those requests will always present the default TLS certificates
+to the client. When the request includes the hostname, and that hostname matches the hostname of an `Issuer`,
+then the TLS certificate defined by the `spec.tls.secretName` will be used. If that issuer did not
+define `spec.tls.secretName` then the default TLS certificate will be used. If neither exists,
+then the client will get a TLS error because the server will not present any TLS certificate.
+
+It is recommended that you have a DNS entry for your load balancer or Ingress, and that you configure the
+OIDC provider's `Issuer` using that DNS hostname, and that the TLS certificate for that provider also
+covers that same hostname.
+
+You can create the certificate Secrets however you like, for example you could use [cert-manager](https://cert-manager.io/)
+or `kubectl create secret tls`.
+Keep in mind that your users will load some of these endpoints in their web browsers, so the TLS certificates
+should be signed by a Certificate Authority that will be trusted by their browsers.

deploy/supervisor/config.supervisor.pinniped.dev_oidcproviders.yaml

@@ -0,0 +1,121 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.0
+  creationTimestamp: null
+  name: oidcproviders.config.supervisor.pinniped.dev
+spec:
+  group: config.supervisor.pinniped.dev
+  names:
+    kind: OIDCProvider
+    listKind: OIDCProviderList
+    plural: oidcproviders
+    singular: oidcprovider
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: OIDCProvider describes the configuration of an OIDC provider.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec of the OIDC provider.
+            properties:
+              issuer:
+                description: "Issuer is the OIDC Provider's issuer, per the OIDC Discovery
+                  Metadata document, as well as the identifier that it will use for
+                  the iss claim in issued JWTs. This field will also be used as the
+                  base URL for any endpoints used by the OIDC Provider (e.g., if your
+                  issuer is https://example.com/foo, then your authorization endpoint
+                  will look like https://example.com/foo/some/path/to/auth/endpoint).
+                  \n See https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3
+                  for more information."
+                minLength: 1
+                type: string
+              tls:
+                description: TLS configures how this OIDCProvider is served over Transport
+                  Layer Security (TLS).
+                properties:
+                  secretName:
+                    description: "SecretName is an optional name of a Secret in the
+                      same namespace, of type `kubernetes.io/tls`, which contains
+                      the TLS serving certificate for the HTTPS endpoints served by
+                      this OIDCProvider. When provided, the TLS Secret named here
+                      must contain keys named `tls.crt` and `tls.key` that contain
+                      the certificate and private key to use for TLS. \n Server Name
+                      Indication (SNI) is an extension to the Transport Layer Security
+                      (TLS) supported by all major browsers. \n SecretName is required
+                      if you would like to use different TLS certificates for issuers
+                      of different hostnames. SNI requests do not include port numbers,
+                      so all issuers with the same DNS hostname must use the same
+                      SecretName value even if they have different port numbers. \n
+                      SecretName is not required when you would like to use only the
+                      HTTP endpoints (e.g. when terminating TLS at an Ingress). It
+                      is also not required when you would like all requests to this
+                      OIDC Provider's HTTPS endpoints to use the default TLS certificate,
+                      which is configured elsewhere. \n When your Issuer URL's host
+                      is an IP address, then this field is ignored. SNI does not work
+                      for IP addresses."
+                    type: string
+                type: object
+            required:
+            - issuer
+            type: object
+          status:
+            description: Status of the OIDC provider.
+            properties:
+              jwksSecret:
+                description: JWKSSecret holds the name of the secret in which this
+                  OIDC Provider's signing/verification keys are stored. If it is empty,
+                  then the signing/verification keys are either unknown or they don't
+                  exist.
+                properties:
+                  name:
+                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                      TODO: Add other useful fields. apiVersion, kind, uid?'
+                    type: string
+                type: object
+              lastUpdateTime:
+                description: LastUpdateTime holds the time at which the Status was
+                  last updated. It is a pointer to get around some undesirable behavior
+                  with respect to the empty metav1.Time value (see https://github.com/kubernetes/kubernetes/issues/86811).
+                format: date-time
+                type: string
+              message:
+                description: Message provides human-readable details about the Status.
+                type: string
+              status:
+                description: Status holds an enum that describes the state of this
+                  OIDC Provider. Note that this Status can represent success or failure.
+                enum:
+                - Success
+                - Duplicate
+                - Invalid
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

deploy/supervisor/deployment.yaml

@@ -0,0 +1,141 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+#@ load("@ytt:json", "json")
+#@ load("helpers.lib.yaml", "defaultLabel", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+
+#@ if not data.values.into_namespace:
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: #@ data.values.namespace
+  labels: #@ labels()
+#@ end
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: #@ defaultResourceName()
+  namespace: #@ namespace()
+  labels: #@ labels()
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: #@ defaultResourceNameWithSuffix("static-config")
+  namespace: #@ namespace()
+  labels: #@ labels()
+data:
+  #@yaml/text-templated-strings
+  pinniped.yaml: |
+    names:
+      defaultTLSCertificateSecret: (@= defaultResourceNameWithSuffix("default-tls-certificate") @)
+    labels: (@= json.encode(labels()).rstrip() @)
+---
+#@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
+apiVersion: v1
+kind: Secret
+metadata:
+  name: image-pull-secret
+  namespace: #@ namespace()
+  labels: #@ labels()
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: #@ data.values.image_pull_dockerconfigjson
+#@ end
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: #@ defaultResourceName()
+  namespace: #@ namespace()
+  labels: #@ labels()
+spec:
+  replicas: #@ data.values.replicas
+  selector:
+    matchLabels: #@ defaultLabel()
+  template:
+    metadata:
+      labels: #@ defaultLabel()
+    spec:
+      securityContext:
+        runAsUser: 1001
+        runAsGroup: 1001
+      serviceAccountName: #@ defaultResourceName()
+      #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
+      imagePullSecrets:
+        - name: image-pull-secret
+      #@ end
+      containers:
+        - name: #@ defaultResourceName()
+          #@ if data.values.image_digest:
+          image:  #@ data.values.image_repo + "@" + data.values.image_digest
+          #@ else:
+          image: #@ data.values.image_repo + ":" + data.values.image_tag
+          #@ end
+          imagePullPolicy: IfNotPresent
+          command: #! override the default entrypoint
+            - /usr/local/bin/pinniped-supervisor
+          args:
+            - /etc/podinfo
+            - /etc/config/pinniped.yaml
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "100m"
+              memory: "128Mi"
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/config
+            - name: podinfo
+              mountPath: /etc/podinfo
+          ports:
+            - containerPort: 8080
+              protocol: TCP
+            - containerPort: 8443
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+              scheme: HTTP
+            initialDelaySeconds: 2
+            timeoutSeconds: 15
+            periodSeconds: 10
+            failureThreshold: 5
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+              scheme: HTTP
+            initialDelaySeconds: 2
+            timeoutSeconds: 3
+            periodSeconds: 10
+            failureThreshold: 3
+      volumes:
+        - name: config-volume
+          configMap:
+            name: #@ defaultResourceNameWithSuffix("static-config")
+        - name: podinfo
+          downwardAPI:
+            items:
+              - path: "labels"
+                fieldRef:
+                  fieldPath: metadata.labels
+              - path: "namespace"
+                fieldRef:
+                  fieldPath: metadata.namespace
+      #! This will help make sure our multiple pods run on different nodes, making
+      #! our deployment "more" "HA".
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 50
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels: #@ defaultLabel()
+                topologyKey: kubernetes.io/hostname

deploy/supervisor/helpers.lib.yaml

@@ -0,0 +1,30 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+#@ load("@ytt:template", "template")
+
+#@ def defaultResourceName():
+#@   return data.values.app_name
+#@ end
+
+#@ def defaultResourceNameWithSuffix(suffix):
+#@   return data.values.app_name + "-" + suffix
+#@ end
+
+#@ def namespace():
+#@   if data.values.into_namespace:
+#@     return data.values.into_namespace
+#@   else:
+#@     return data.values.namespace
+#@   end
+#@ end
+
+#@ def defaultLabel():
+app: #@ data.values.app_name
+#@ end
+
+#@ def labels():
+_: #@ template.replace(defaultLabel())
+_: #@ template.replace(data.values.custom_labels)
+#@ end

deploy/supervisor/rbac.yaml

@@ -0,0 +1,36 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+#@ load("helpers.lib.yaml", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+
+#! Give permission to various objects within the app's own namespace
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: #@ defaultResourceName()
+  namespace: #@ namespace()
+  labels: #@ labels()
+rules:
+  - apiGroups: [""]
+    resources: [secrets]
+    verbs: [create, get, list, patch, update, watch, delete]
+  - apiGroups: [config.supervisor.pinniped.dev]
+    resources: [oidcproviders]
+    verbs: [update, get, list, watch]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ defaultResourceName()
+  namespace: #@ namespace()
+  labels: #@ labels()
+subjects:
+  - kind: ServiceAccount
+    name: #@ defaultResourceName()
+    namespace: #@ namespace()
+roleRef:
+  kind: Role
+  name: #@ defaultResourceName()
+  apiGroup: rbac.authorization.k8s.io

deploy/supervisor/service.yaml

@@ -0,0 +1,93 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:data", "data")
+#@ load("helpers.lib.yaml", "defaultLabel", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+
+#@ if data.values.service_http_nodeport_port or data.values.service_https_nodeport_port:
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: #@ defaultResourceNameWithSuffix("nodeport")
+  namespace: #@ namespace()
+  labels: #@ labels()
+spec:
+  type: NodePort
+  selector:
+    app: #@ data.values.app_name
+  ports:
+    #@ if data.values.service_http_nodeport_port:
+    - name: http
+      protocol: TCP
+      port: #@ data.values.service_http_nodeport_port
+      targetPort: 8080
+      #@ if data.values.service_http_nodeport_nodeport:
+      nodePort: #@ data.values.service_http_nodeport_nodeport
+      #@ end
+    #@ end
+    #@ if data.values.service_https_nodeport_port:
+    - name: https
+      protocol: TCP
+      port: #@ data.values.service_https_nodeport_port
+      targetPort: 8443
+      #@ if data.values.service_https_nodeport_nodeport:
+      nodePort: #@ data.values.service_https_nodeport_nodeport
+      #@ end
+    #@ end
+#@ end
+
+#@ if data.values.service_http_clusterip_port or data.values.service_https_clusterip_port:
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: #@ defaultResourceNameWithSuffix("clusterip")
+  namespace: #@ namespace()
+  labels: #@ labels()
+spec:
+  type: ClusterIP
+  selector: #@ defaultLabel()
+  ports:
+    #@ if data.values.service_http_clusterip_port:
+    - name: http
+      protocol: TCP
+      port: #@ data.values.service_http_clusterip_port
+      targetPort: 8080
+    #@ end
+    #@ if data.values.service_https_clusterip_port:
+    - name: https
+      protocol: TCP
+      port: #@ data.values.service_https_clusterip_port
+      targetPort: 8443
+    #@ end
+#@ end
+
+#@ if data.values.service_http_loadbalancer_port or data.values.service_https_loadbalancer_port:
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: #@ defaultResourceNameWithSuffix("loadbalancer")
+  namespace: #@ namespace()
+  labels: #@ labels()
+spec:
+  type: LoadBalancer
+  selector: #@ defaultLabel()
+  #@ if data.values.service_loadbalancer_ip:
+  loadBalancerIP: #@ data.values.service_loadbalancer_ip
+  #@ end
+  ports:
+    #@ if data.values.service_http_loadbalancer_port:
+    - name: http
+      protocol: TCP
+      port: #@ data.values.service_http_loadbalancer_port
+      targetPort: 8080
+    #@ end
+    #@ if data.values.service_https_loadbalancer_port:
+    - name: https
+      protocol: TCP
+      port: #@ data.values.service_https_loadbalancer_port
+      targetPort: 8443
+    #@ end
+#@ end

deploy/supervisor/values.yaml

@@ -0,0 +1,54 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@data/values
+---
+
+app_name: pinniped-supervisor
+
+#! Creates a new namespace statically in yaml with the given name and installs the app into that namespace.
+namespace: pinniped-supervisor
+#! If specified, assumes that a namespace of the given name already exists and installs the app into that namespace.
+#! If both `namespace` and `into_namespace` are specified, then only `into_namespace` is used.
+into_namespace: #! e.g. my-preexisting-namespace
+
+#! All resources created statically by yaml at install-time and all resources created dynamically
+#! by controllers at runtime will be labelled with `app: $app_name` and also with the labels
+#! specified here. The value of `custom_labels` must be a map of string keys to string values.
+#! The app can be uninstalled either by:
+#! 1. Deleting the static install-time yaml resources including the static namespace, which will cascade and also delete
+#!    resources that were dynamically created by controllers at runtime
+#! 2. Or, deleting all resources by label, which does not assume that there was a static install-time yaml namespace.
+custom_labels: {} #! e.g. {myCustomLabelName: myCustomLabelValue, otherCustomLabelName: otherCustomLabelValue}
+
+#! Specify how many replicas of the Pinniped server to run.
+replicas: 2
+
+#! Specify either an image_digest or an image_tag. If both are given, only image_digest will be used.
+image_repo: docker.io/getpinniped/pinniped-server
+image_digest: #! e.g. sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8
+image_tag: latest
+
+#! Specifies a secret to be used when pulling the above `image_repo` container image.
+#! Can be used when the above image_repo is a private registry.
+#! Typically the value would be the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username="USERNAME" --docker-password="PASSWORD" --dry-run=client -o json | jq -r '.data[".dockerconfigjson"]'
+#! Optional.
+image_pull_dockerconfigjson: #! e.g. {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}
+
+#! Specify how to expose the Supervisor app's HTTP and/or HTTPS ports as a Service.
+#! Typically you would set a value for only one of the following service types, for either HTTP or HTTPS depending on your needs.
+#! An HTTP service should not be exposed outside the cluster. It would not be secure to serve OIDC endpoints to end users via HTTP.
+#! Setting any of these values means that a Service of that type will be created.
+#! Note that all port numbers should be numbers (not strings), i.e. use ytt's `--data-value-yaml` instead of `--data-value`.
+service_http_nodeport_port: #! when specified, creates a NodePort Service with this `port` value, with port 8080 as its `targetPort`; e.g. 31234
+service_http_nodeport_nodeport: #! the `nodePort` value of the NodePort Service, optional when `service_http_nodeport_port` is specified; e.g. 31234
+service_http_loadbalancer_port: #! when specified, creates a LoadBalancer Service with this `port` value, with port 8080 as its `targetPort`; e.g. 8443
+service_http_clusterip_port: #! when specified, creates a ClusterIP Service with this `port` value, with port 8080 as its `targetPort`; e.g. 8443
+service_https_nodeport_port: #! when specified, creates a NodePort Service with this `port` value, with port 8443 as its `targetPort`; e.g. 31243
+service_https_nodeport_nodeport: #! the `nodePort` value of the NodePort Service, optional when `service_http_nodeport_port` is specified; e.g. 31243
+service_https_loadbalancer_port: #! when specified, creates a LoadBalancer Service with this `port` value, with port 8443 as its `targetPort`; e.g. 8443
+service_https_clusterip_port: #! when specified, creates a ClusterIP Service with this `port` value, with port 8443 as its `targetPort`; e.g. 8443
+#! The `loadBalancerIP` value of the LoadBalancer Service.
+#! Ignored unless service_http_loadbalancer_port and/or service_https_loadbalancer_port are provided.
+#! Optional.
+service_loadbalancer_ip: #! e.g. 1.2.3.4

deploy/supervisor/z0_crd_overlay.yaml

@@ -0,0 +1,11 @@
+#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! SPDX-License-Identifier: Apache-2.0
+
+#@ load("@ytt:overlay", "overlay")
+#@ load("helpers.lib.yaml", "labels")
+
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"oidcproviders.config.supervisor.pinniped.dev"}}), expects=1
+---
+metadata:
+  #@overlay/match missing_ok=True
+  labels: #@ labels()

doc/architecture.md

@@ -0,0 +1,75 @@
+# Architecture
+
+The principal purpose of Pinniped is to allow users to access Kubernetes
+clusters. Pinniped hopes to enable this access across a wide range of Kubernetes
+environments with zero configuration.
+
+This integration is implemented using a credential exchange API which takes as
+input a credential from the external IDP and returns a credential which is understood by the host
+Kubernetes cluster.
+
+<img src="img/pinniped_architecture.svg" alt="Pinniped Architecture Sketch" width="300px"/>
+
+Pinniped supports various IDP types and implements different integration strategies
+for various Kubernetes distributions to make authentication possible.
+
+## Supported Kubernetes Cluster Types
+
+Pinniped supports the following types of Kubernetes clusters:
+
+- Clusters where the Kube Controller Manager pod is accessible from Pinniped's pods.
+
+Support for other types of Kubernetes distributions is coming soon.
+
+## External Identity Provider Integrations
+
+Pinniped will consume identity from one or more external identity providers
+(IDPs). Administrators will configure external IDPs via Kubernetes custom
+resources allowing Pinniped to be managed using GitOps and standard Kubernetes tools.
+
+Pinniped supports the following external IDP types.
+
+1. Any webhook which implements the
+   [Kubernetes TokenReview API](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication).
+
+   In addition to allowing the integration of any existing IDP which implements this API, webhooks also
+   serve as an extension point for Pinniped by allowing for integration of arbitrary custom authenticators.
+   While a custom implementation may be in any language or framework, this project provides a
+   sample implementation in Golang. See the `ServeHTTP` method of
+   [cmd/local-user-authenticator/main.go](../cmd/local-user-authenticator/main.go).
+
+More IDP types are coming soon.
+
+## Cluster Integration Strategies
+
+Pinniped will issue a cluster credential by leveraging cluster-specific
+functionality.  In the near term, cluster integrations will happen via different
+cluster-specific flows depending on the type of cluster. In the longer term,
+Pinniped hopes to contribute and leverage upstream Kubernetes extension points that
+cleanly enable this integration.
+
+Pinniped supports the following cluster integration strategies.
+
+1. Pinniped hosts a credential exchange API endpoint via a Kubernetes aggregated API server.
+This API returns a new cluster-specific credential using the cluster's signing keypair to
+issue short-lived cluster certificates. (In the future, when the Kubernetes CSR API
+provides a way to issue short-lived certificates, then the Pinniped credential exchange API
+will use that instead of using the cluster's signing keypair.)
+
+More cluster integration strategies are coming soon, which will allow Pinniped to
+support more Kubernetes cluster types.
+
+## `kubectl` Integration
+
+With any of the above IDPs and integration strategies, `kubectl` commands receive the
+cluster-specific credential via a
+[Kubernetes client-go credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins).
+Users may use the Pinniped CLI as the credential plugin, or they may use any proprietary CLI
+built with the [Pinniped Go client library](../generated).
+
+## Example Cluster Authentication Sequence Diagram
+
+This diagram demonstrates using `kubectl get pods` with the Pinniped CLI configured as the credential plugin,
+and with a webhook IDP configured as the identity provider for the Pinniped server.
+
+![example-cluster-authentication-sequence-diagram](img/pinniped.svg)

doc/demo.md

@@ -0,0 +1,198 @@
+# Trying Pinniped
+
+## Prerequisites
+
+1. A Kubernetes cluster of a type supported by Pinniped as described in [doc/architecture.md](../doc/architecture.md).
+
+   Don't have a cluster handy? Consider using [kind](https://kind.sigs.k8s.io/) on your local machine.
+   See below for an example of using kind.
+
+1. An identity provider of a type supported by Pinniped as described in [doc/architecture.md](../doc/architecture.md).
+
+   Don't have an identity provider of a type supported by Pinniped handy? No problem, there is a demo identity provider
+   available. Start by installing local-user-authenticator on the same cluster where you would like to try Pinniped
+   by following the directions in [deploy/local-user-authenticator/README.md](../deploy/local-user-authenticator/README.md).
+   See below for an example of deploying this on kind.
+
+1. A kubeconfig where the current context points to the cluster and has admin-like
+   privileges on that cluster.
+
+## Overview
+
+Installing and trying Pinniped on any cluster will consist of the following general steps. See the next section below
+for a more specific example of installing onto a local kind cluster, including the exact commands to use for that case.
+
+1. Install Pinniped. See [deploy/concierge/README.md](../deploy/concierge/README.md).
+1. Download the Pinniped CLI from [Pinniped's github Releases page](https://github.com/vmware-tanzu/pinniped/releases/latest).
+1. Generate a kubeconfig using the Pinniped CLI. Run `pinniped get-kubeconfig --help` for more information.
+1. Run `kubectl` commands using the generated kubeconfig. Pinniped will automatically be used for authentication during those commands.
+
+## Example of Deploying on kind
+
+[kind](https://kind.sigs.k8s.io) is a tool for creating and managing Kubernetes clusters on your local machine
+which uses Docker containers as the cluster's "nodes". This is a convenient way to try out Pinniped on a local
+non-production cluster.
+
+The following steps will deploy the latest release of Pinniped on kind using the local-user-authenticator component
+as the identity provider.
+
+<!-- The following image was uploaded to GitHub's CDN using this awesome trick: https://gist.github.com/vinkla/dca76249ba6b73c5dd66a4e986df4c8d -->
+<p align="center" width="100%">
+<img
+  src="https://user-images.githubusercontent.com/25013435/95272990-b2ea9780-07f6-11eb-994d-872e3cb68457.gif"
+  alt="Pinniped Installation Demo"
+  width="80%"
+  />
+</p>
+
+1. Install the tools required for the following steps.
+
+   -  [Install kind](https://kind.sigs.k8s.io/docs/user/quick-start/), if not already installed. e.g. `brew install kind` on MacOS.
+
+   - kind depends on Docker. If not already installed, [install Docker](https://docs.docker.com/get-docker/), e.g. `brew cask install docker` on MacOS.
+
+   - This demo requires `kubectl`, which comes with Docker, or can be [installed separately](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
+
+   - This demo requires a tool capable of generating a `bcrypt` hash in order to interact with
+     the webhook. The example below uses `htpasswd`, which is installed on most macOS systems, and can be
+     installed on some Linux systems via the `apache2-utils` package (e.g., `apt-get install
+     apache2-utils`).
+
+   - One of the steps below optionally uses `jq` to help find the latest release version number. It is not required.
+     Install `jq` if you would like, e.g. `brew install jq` on MacOS.
+
+1. Create a new Kubernetes cluster using `kind create cluster`. Optionally provide a cluster name using the `--name` flag.
+   kind will automatically update your kubeconfig to point to the new cluster as a user with admin-like permissions.
+
+1. Query GitHub's API for the git tag of the latest Pinniped
+   [release](https://github.com/vmware-tanzu/pinniped/releases/latest).
+
+   ```bash
+   pinniped_version=$(curl https://api.github.com/repos/vmware-tanzu/pinniped/releases/latest -s | jq .name -r)
+   ```
+
+   Alternatively, [any release version](https://github.com/vmware-tanzu/pinniped/releases)
+   number can be manually selected.
+
+   ```bash
+   # Example of manually choosing a release version...
+   pinniped_version=v0.2.0
+   ```
+
+1. Deploy the local-user-authenticator app. This is a demo identity provider. In production, you would use your
+   real identity provider, and therefore would not need to deploy or configure local-user-authenticator.
+
+    ```bash
+    kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/$pinniped_version/install-local-user-authenticator.yaml
+    ```
+
+   The `install-local-user-authenticator.yaml` file includes the default deployment options.
+   If you would prefer to customize the available options, please
+   see [deploy/local-user-authenticator/README.md](../deploy/local-user-authenticator/README.md)
+   for instructions on how to deploy using `ytt`.
+
+1. Create a test user named `pinny-the-seal` in the local-user-authenticator identity provider.
+
+   ```bash
+   kubectl create secret generic pinny-the-seal \
+     --namespace local-user-authenticator \
+     --from-literal=groups=group1,group2 \
+     --from-literal=passwordHash=$(htpasswd -nbBC 10 x password123 | sed -e "s/^x://")
+   ```
+
+1. Fetch the auto-generated CA bundle for the local-user-authenticator's HTTP TLS endpoint.
+
+   ```bash
+   kubectl get secret local-user-authenticator-tls-serving-certificate --namespace local-user-authenticator \
+     -o jsonpath={.data.caCertificate} \
+     | tee /tmp/local-user-authenticator-ca-base64-encoded
+   ```
+
+1. Deploy Pinniped.
+
+   ```bash
+    kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/$pinniped_version/install-pinniped-concierge.yaml
+   ```
+
+   The `install-pinniped-concierge.yaml` file includes the default deployment options.
+   If you would prefer to customize the available options, please see [deploy/concierge/README.md](../deploy/concierge/README.md)
+   for instructions on how to deploy using `ytt`.
+
+1. Create a `WebhookAuthenticator` object to configure Pinniped to authenticate using local-user-authenticator.
+
+    ```bash
+    cat <<EOF | kubectl create --namespace pinniped -f -
+    apiVersion: authentication.concierge.pinniped.dev/v1alpha1
+    kind: WebhookAuthenticator
+    metadata:
+      name: local-user-authenticator
+    spec:
+      endpoint: https://local-user-authenticator.local-user-authenticator.svc/authenticate
+      tls:
+        certificateAuthorityData: $(cat /tmp/local-user-authenticator-ca-base64-encoded)
+    EOF
+    ```
+
+1. Download the latest version of the Pinniped CLI binary for your platform
+   from Pinniped's [latest release](https://github.com/vmware-tanzu/pinniped/releases/latest).
+
+1. Move the Pinniped CLI binary to your preferred filename and directory. Add the executable bit,
+   e.g. `chmod +x /usr/local/bin/pinniped`.
+
+1. Generate a kubeconfig for the current cluster. Use `--token` to include a token which should
+   allow you to authenticate as the user that you created above.
+
+   ```bash
+   pinniped get-kubeconfig --token "pinny-the-seal:password123" --authenticator-type webhook --authenticator-name local-user-authenticator > /tmp/pinniped-kubeconfig
+   ```
+
+   If you are using MacOS, you may get an error dialog that says
+   `“pinniped” cannot be opened because the developer cannot be verified`. Cancel this dialog, open System Preferences,
+   click on Security & Privacy, and click the Allow Anyway button next to the Pinniped message.
+   Run the above command again and another dialog will appear saying
+   `macOS cannot verify the developer of “pinniped”. Are you sure you want to open it?`.
+   Click Open to allow the command to proceed.
+
+   Note that the above command will print a warning to the screen. You can ignore this warning.
+   Pinniped tries to auto-discover the URL for the Kubernetes API server, but it is not able
+   to do so on kind clusters. The warning is just letting you know that the Pinniped CLI decided
+   to ignore the auto-discovery URL and instead use the URL from your existing kubeconfig.
+
+1. Try using the generated kubeconfig to issue arbitrary `kubectl` commands as
+   the `pinny-the-seal` user.
+
+   ```bash
+   kubectl --kubeconfig /tmp/pinniped-kubeconfig get pods -n pinniped
+   ```
+
+   Because this user has no RBAC permissions on this cluster, the previous command
+   results in the error `Error from server (Forbidden): pods is forbidden: User "pinny-the-seal" cannot list resource "pods" in API group "" in the namespace "pinniped"`.
+   However, this does prove that you are authenticated and acting as the `pinny-the-seal` user.
+
+1. As the admin user, create RBAC rules for the test user to give them permissions to perform actions on the cluster.
+   For example, grant the test user permission to view all cluster resources.
+
+   ```bash
+   kubectl create clusterrolebinding pinny-can-read --clusterrole view --user pinny-the-seal
+   ```
+
+1. Use the generated kubeconfig to issue arbitrary `kubectl` commands as the `pinny-the-seal` user.
+
+   ```bash
+   kubectl --kubeconfig /tmp/pinniped-kubeconfig get pods -n pinniped
+   ```
+
+   The user has permission to list pods, so the command succeeds this time.
+   Pinniped has provided authentication into the cluster for your `kubectl` command! 🎉
+
+1. Carry on issuing as many `kubectl` commands as you'd like as the `pinny-the-seal` user.
+   Each invocation will use Pinniped for authentication.
+   You may find it convenient to set the `KUBECONFIG` environment variable rather than passing `--kubeconfig` to each invocation.
+
+   ```bash
+   export KUBECONFIG=/tmp/pinniped-kubeconfig
+   kubectl get namespaces
+   kubectl get pods -A
+   ```
+
+1. Profit! 💰

doc/img/README.md

@@ -0,0 +1,12 @@
+# `doc/img` README
+
+## How to Update these Images
+
+- [pinniped.svg](pinniped.svg) was generated using [`plantuml`](https://plantuml.com/).
+  To regenerate the image, run `plantuml -tsvg pinniped.txt` from this directory.
+
+- [pinniped_architecture.svg](pinniped_architecture.svg) was created on [draw.io](https://draw.io).
+  It can be opened again for editing on that site by choosing "File" -> "Open from" -> "Device".
+  Because it includes embedded icons it should be exported using "File" -> "Export as" -> "SVG",
+  with the "Transparent Background", "Embed Images", and "Include a copy of my diagram" options
+  checked. The icons in this diagram are from their "CAE" shapes set.

doc/img/pinniped.txt

@@ -0,0 +1,61 @@
+@startuml "pinniped"
+
+!define K8S_BLUE #326CE5
+!define K8S_SPRITES_URL https://raw.githubusercontent.com/michiel/plantuml-kubernetes-sprites/master/resource
+!include K8S_SPRITES_URL/k8s-sprites-unlabeled-25pct.iuml
+
+participant "User" as USER << ($pod{scale=0.30},K8S_BLUE) >> #LightGreen
+participant "Kubectl" as KUBECTL << ($ing{scale=0.30},K8S_BLUE) >> #LightSteelBlue
+participant "Proprietary CLI" as CLI << ($svc{scale=0.30},K8S_BLUE) >> #LightPink
+participant "Pinniped" as PINNIPED << ($node{scale=0.30},K8S_BLUE) >> #LightGray
+participant "TokenReview Webhook" as WEBHOOK << ($pod{scale=0.30},K8S_BLUE) >> #LightPink
+participant "Kubernetes API" as API << ($node{scale=0.30},K8S_BLUE) >> #LightSteelBlue
+
+legend
+  # <back:lightsalmon>Message contains upstream IDP credentials</back>
+  # <back:lightgreen>Message contains cluster-specific credentials</back>
+end legend
+
+USER -> KUBECTL : ""kubectl get pods""
+activate KUBECTL
+
+group Acquire cluster-specific credential
+
+KUBECTL -> CLI : Get cluster-specific credential
+activate CLI
+
+CLI -> CLI : Retrieve upstream IDP credential in\norganization-specific way
+
+CLI -> PINNIPED : <back:lightsalmon>""POST /apis/pinniped.dev/...""</back>
+activate PINNIPED
+
+PINNIPED -> WEBHOOK : <back:lightsalmon>""POST /authenticate""</back>
+activate WEBHOOK
+
+WEBHOOK -> PINNIPED : ""200 OK"" with user and group information
+deactivate WEBHOOK
+
+PINNIPED -> PINNIPED : Issue short-lived cluster-specific credential\nwith user and group information
+
+PINNIPED -> CLI : <back:lightgreen>""200 OK""</back>
+deactivate PINNIPED
+
+CLI -> KUBECTL : Here is a cluster-specific credential
+
+end
+
+group Authenticate to cluster with cluster-specific credential
+
+KUBECTL -> API : <back:lightgreen>""GET /api/v1/pods""</back>
+activate API
+
+API -> API : Glean user and group information from\ncluster-specific credential
+
+API -> KUBECTL : ""200 OK"" with pods
+deactivate API
+
+deactivate KUBECTL
+
+end
+
+@enduml

doc/img/pinniped_logo.svg

@@ -0,0 +1,68 @@
+<svg id="artwork" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 486 158"><metadata><?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
+<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164352, 2020/01/30-15:50:38        ">
+   <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
+      <rdf:Description rdf:about=""
+            xmlns:lr="http://ns.adobe.com/lightroom/1.0/"
+            xmlns:dc="http://purl.org/dc/elements/1.1/"
+            xmlns:xmp="http://ns.adobe.com/xap/1.0/"
+            xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/"
+            xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#">
+         <lr:hierarchicalSubject>
+            <rdf:Bag>
+               <rdf:li>open source identity</rdf:li>
+               <rdf:li>open source identity|636062</rdf:li>
+               <rdf:li>open source identity|Pinniped</rdf:li>
+            </rdf:Bag>
+         </lr:hierarchicalSubject>
+         <dc:subject>
+            <rdf:Bag>
+               <rdf:li>open source identity</rdf:li>
+               <rdf:li>636062</rdf:li>
+               <rdf:li>Pinniped</rdf:li>
+            </rdf:Bag>
+         </dc:subject>
+         <xmp:MetadataDate>2020-09-17T16:06:40-07:00</xmp:MetadataDate>
+         <xmpMM:InstanceID>xmp.iid:932334bf-97ee-471a-96c9-c4e5ff526fe4</xmpMM:InstanceID>
+         <xmpMM:DocumentID>xmp.did:38396587-b56b-42c3-8f3e-f8e9c91f532b</xmpMM:DocumentID>
+         <xmpMM:OriginalDocumentID>xmp.did:38396587-b56b-42c3-8f3e-f8e9c91f532b</xmpMM:OriginalDocumentID>
+         <xmpMM:History>
+            <rdf:Seq>
+               <rdf:li>
+                  <rdf:Description>
+                     <stEvt:action>saved</stEvt:action>
+                     <stEvt:instanceID>xmp.iid:38396587-b56b-42c3-8f3e-f8e9c91f532b</stEvt:instanceID>
+                     <stEvt:when>2020-09-17T16:06:35-07:00</stEvt:when>
+                     <stEvt:softwareAgent>Adobe Bridge 2020 (Macintosh)</stEvt:softwareAgent>
+                     <stEvt:changed>/metadata</stEvt:changed>
+                  </rdf:Description>
+               </rdf:li>
+               <rdf:li>
+                  <rdf:Description>
+                     <stEvt:action>saved</stEvt:action>
+                     <stEvt:instanceID>xmp.iid:932334bf-97ee-471a-96c9-c4e5ff526fe4</stEvt:instanceID>
+                     <stEvt:when>2020-09-17T16:06:40-07:00</stEvt:when>
+                     <stEvt:softwareAgent>Adobe Bridge 2020 (Macintosh)</stEvt:softwareAgent>
+                     <stEvt:changed>/metadata</stEvt:changed>
+                  </rdf:Description>
+               </rdf:li>
+            </rdf:Seq>
+         </xmpMM:History>
+      </rdf:Description>
+   </rdf:RDF>
+</x:xmpmeta>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+<?xpacket end="w"?></metadata>
+<defs><style>.cls-1{fill:#717073;}.cls-2{fill:#727174;}.cls-3{fill:#fff;}.cls-4{fill:#78be43;}.cls-5{fill:#1abfd3;}.cls-6{fill:#79459b;}.cls-7{fill:#1e4488;}.cls-8{fill:#218fcf;}</style></defs><path class="cls-1" d="M170.52,58.21h16.74a17.43,17.43,0,0,1,7.68,1.68,13.45,13.45,0,0,1,5.49,4.71,12.54,12.54,0,0,1,0,13.62,13.45,13.45,0,0,1-5.49,4.71,17.43,17.43,0,0,1-7.68,1.68H175.2V99.43h-4.68Zm15.9,22a13.23,13.23,0,0,0,8.19-2.34,8.21,8.21,0,0,0,0-12.84,13.23,13.23,0,0,0-8.19-2.34H175.2V80.17Z"/><path class="cls-1" d="M209.82,58.21h4.68V99.43h-4.68Z"/><path class="cls-1" d="M225.78,58.21h4.68L256,91.75V58.21h4.68V99.43H256L230.46,65.89V99.43h-4.68Z"/><path class="cls-1" d="M272,58.21h4.68l25.56,33.54V58.21h4.68V99.43h-4.68L276.66,65.89V99.43H272Z"/><path class="cls-1" d="M318.18,58.21h4.68V99.43h-4.68Z"/><path class="cls-1" d="M334.14,58.21h16.74a17.46,17.46,0,0,1,7.68,1.68,13.51,13.51,0,0,1,5.49,4.71,12.54,12.54,0,0,1,0,13.62,13.51,13.51,0,0,1-5.49,4.71,17.46,17.46,0,0,1-7.68,1.68H338.82V99.43h-4.68Zm15.9,22a13.23,13.23,0,0,0,8.19-2.34,8.21,8.21,0,0,0,0-12.84A13.23,13.23,0,0,0,350,62.65H338.82V80.17Z"/><path class="cls-1" d="M378.18,62.65V76.21h22.38v4.44H378.18V95H403v4.44H373.44V58.21H403v4.44Z"/><path class="cls-1" d="M411.12,58.21H425a24.6,24.6,0,0,1,11.54,2.64,19.73,19.73,0,0,1,7.92,7.32,21.2,21.2,0,0,1,0,21.27,19.66,19.66,0,0,1-7.92,7.35A24.6,24.6,0,0,1,425,99.43H411.12Zm13.92,37a19.21,19.21,0,0,0,9.08-2.1,15.61,15.61,0,0,0,6.25-5.82,17,17,0,0,0,0-16.89,15.68,15.68,0,0,0-6.25-5.79,19.21,19.21,0,0,0-9.08-2.1h-9.25v32.7Z"/><path class="cls-2" d="M91.14,25.5A52.5,52.5,0,1,0,143.64,78,52.51,52.51,0,0,0,91.14,25.5Zm0,95.33A42.83,42.83,0,1,1,134,78,42.83,42.83,0,0,1,91.14,120.83Z"/><circle class="cls-3" cx="91.33" cy="77.84" r="45.75"/><circle class="cls-4" cx="91.16" cy="76.71" r="8"/><path class="cls-5" d="M118.92,58.45l1.66,6.89,5.12-.66-3-12.42-.15-.5v0l-11.73-5.08-1.53,5,6.48,2.8L101.26,66.65a14.14,14.14,0,0,1,2.9,4.24Z"/><path class="cls-6" d="M66.46,54.41,73,51.61l-1.53-5L59.68,51.73v0l-.15.5-3,12.42,5.13.66,1.65-6.89L78.13,70.94A14.23,14.23,0,0,1,81,66.68Z"/><path class="cls-7" d="M57.49,82.82,59.21,76l-4.87-1.8L51.23,86.56l0,0,.31.42,8,9.94,3.66-3.66-4.47-5.51,19.82-4.35A14.23,14.23,0,0,1,77,78.54Z"/><path class="cls-7" d="M128,74.17,123.11,76l1.72,6.85-19.54-4.28a14.23,14.23,0,0,1-1.56,4.89l19.81,4.35-4.46,5.51L122.73,97l8-9.94.31-.42,0,0Z"/><path class="cls-6" d="M103.35,109l-7.08-.33-.79,5.11,12.76.58h.56l8.14-9.86-4.34-2.85-4.5,5.45-8.43-19a14.36,14.36,0,0,1-4.58,2.28Z"/><path class="cls-5" d="M74.24,107.08l-4.5-5.45-4.34,2.85,8.14,9.86h.56l12.76-.58-.78-5.11L79,109l8.26-18.57a14.28,14.28,0,0,1-4.59-2.27Z"/><path class="cls-8" d="M93.78,62.7V43.84L100.12,47l2.79-4.35L91.49,37,91,36.74h0l-11.44,5.7,2.8,4.37,6.33-3.15v19a14.59,14.59,0,0,1,2.49-.23A15,15,0,0,1,93.78,62.7Z"/></svg>

doc/scope.md

@@ -0,0 +1,32 @@
+# Project Scope
+
+The Pinniped project is guided by the following principles.
+* Pinniped lets you plug any external identitiy providers into
+  Kubernetes. These integrations follow enterprise-grade security principles.
+* Pinniped is easy to install and use on any Kubernetes cluster via
+  distribution-specific integration mechanisms.
+* Pinniped uses a declarative configuration via Kubernetes APIs.
+* Pinniped provides optimal user experience when authenticating to many
+  clusters at one time.
+* Pinniped provides enterprise-grade security posture via secure defaults and
+  revocable or very short-lived credentials.
+* Where possible, Pinniped will contribute ideas and code to upstream
+  Kubernetes.
+
+When contributing to Pinniped, please consider whether your contribution follows
+these guiding principles.
+
+## Out Of Scope
+
+The following items are out of scope for the Pinniped project.
+* Authorization.
+* Standalone identity provider for general use.
+* Machine-to-machine (service) identity.
+* Running outside of Kubernetes.
+
+## Roadmap
+
+More details coming soon!
+
+For more details on proposing features and bugs, check out our
+[contributing](../CONTRIBUTING.md) doc.

generated/1.17/README.adoc

@@ -0,0 +1,387 @@
+// Generated documentation. Please do not edit.
+:anchor_prefix: k8s-api
+
+[id="{p}-api-reference"]
+== API Reference
+
+.Packages
+- xref:{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1[$$authentication.concierge.pinniped.dev/v1alpha1$$]
+- xref:{anchor_prefix}-config-concierge-pinniped-dev-config[$$config.concierge.pinniped.dev/config$$]
+- xref:{anchor_prefix}-config-concierge-pinniped-dev-v1alpha1[$$config.concierge.pinniped.dev/v1alpha1$$]
+- xref:{anchor_prefix}-config-supervisor-pinniped-dev-v1alpha1[$$config.supervisor.pinniped.dev/v1alpha1$$]
+- xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$]
+
+
+[id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"]
+=== authentication.concierge.pinniped.dev/v1alpha1
+
+Package v1alpha1 is the v1alpha1 version of the Pinniped concierge authentication API.
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-condition"]
+==== Condition 
+
+Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorstatus[$$WebhookAuthenticatorStatus$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`type`* __string__ | type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+| *`status`* __ConditionStatus__ | status of the condition, one of True, False, Unknown.
+| *`observedGeneration`* __integer__ | observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
+| *`lastTransitionTime`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#time-v1-meta[$$Time$$]__ | lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+| *`reason`* __string__ | reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
+| *`message`* __string__ | message is a human readable message indicating details about the transition. This may be an empty string.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-tlsspec"]
+==== TLSSpec 
+
+Configuration for configuring TLS on various authenticators.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorspec[$$WebhookAuthenticatorSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`certificateAuthorityData`* __string__ | X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticator"]
+==== WebhookAuthenticator 
+
+WebhookAuthenticator describes the configuration of a webhook authenticator.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorlist[$$WebhookAuthenticatorList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorspec[$$WebhookAuthenticatorSpec$$]__ | Spec for configuring the authenticator.
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorstatus[$$WebhookAuthenticatorStatus$$]__ | Status of the authenticator.
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorspec"]
+==== WebhookAuthenticatorSpec 
+
+Spec for configuring a webhook authenticator.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticator[$$WebhookAuthenticator$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`endpoint`* __string__ | Webhook server endpoint URL.
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorstatus"]
+==== WebhookAuthenticatorStatus 
+
+Status of a webhook authenticator.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticator[$$WebhookAuthenticator$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-condition[$$Condition$$]__ | Represents the observations of the authenticator's current state.
+|===
+
+
+
+[id="{anchor_prefix}-config-concierge-pinniped-dev-config"]
+=== config.concierge.pinniped.dev/config
+
+Package config is the internal version of the Pinniped concierge configuration API.
+
+
+
+
+[id="{anchor_prefix}-config-concierge-pinniped-dev-v1alpha1"]
+=== config.concierge.pinniped.dev/v1alpha1
+
+Package v1alpha1 is the v1alpha1 version of the Pinniped concierge configuration API.
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuer"]
+==== CredentialIssuer 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerlist[$$CredentialIssuerList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerstatus[$$CredentialIssuerStatus$$]__ | Status of the credential issuer.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerkubeconfiginfo"]
+==== CredentialIssuerKubeConfigInfo 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerstatus[$$CredentialIssuerStatus$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`server`* __string__ | The K8s API server URL.
+| *`certificateAuthorityData`* __string__ | The K8s API server CA bundle.
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerstatus"]
+==== CredentialIssuerStatus 
+
+Status of a credential issuer.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuer[$$CredentialIssuer$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`strategies`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerstrategy[$$CredentialIssuerStrategy$$] array__ | List of integration strategies that were attempted by Pinniped.
+| *`kubeConfigInfo`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerkubeconfiginfo[$$CredentialIssuerKubeConfigInfo$$]__ | Information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerstrategy"]
+==== CredentialIssuerStrategy 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuerstatus[$$CredentialIssuerStatus$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`type`* __StrategyType__ | Type of integration attempted.
+| *`status`* __StrategyStatus__ | Status of the attempted integration strategy.
+| *`reason`* __StrategyReason__ | Reason for the current status.
+| *`message`* __string__ | Human-readable description of the current status.
+| *`lastUpdateTime`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#time-v1-meta[$$Time$$]__ | When the status was last checked.
+|===
+
+
+
+[id="{anchor_prefix}-config-supervisor-pinniped-dev-v1alpha1"]
+=== config.supervisor.pinniped.dev/v1alpha1
+
+Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor configuration API.
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovider"]
+==== OIDCProvider 
+
+OIDCProvider describes the configuration of an OIDC provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderlist[$$OIDCProviderList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderspec[$$OIDCProviderSpec$$]__ | Spec of the OIDC provider.
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderstatus[$$OIDCProviderStatus$$]__ | Status of the OIDC provider.
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderspec"]
+==== OIDCProviderSpec 
+
+OIDCProviderSpec is a struct that describes an OIDC Provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovider[$$OIDCProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`issuer`* __string__ | Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the identifier that it will use for the iss claim in issued JWTs. This field will also be used as the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is https://example.com/foo, then your authorization endpoint will look like https://example.com/foo/some/path/to/auth/endpoint). 
+ See https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovidertlsspec[$$OIDCProviderTLSSpec$$]__ | TLS configures how this OIDCProvider is served over Transport Layer Security (TLS).
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderstatus"]
+==== OIDCProviderStatus 
+
+OIDCProviderStatus is a struct that describes the actual state of an OIDC Provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovider[$$OIDCProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`status`* __OIDCProviderStatusCondition__ | Status holds an enum that describes the state of this OIDC Provider. Note that this Status can represent success or failure.
+| *`message`* __string__ | Message provides human-readable details about the Status.
+| *`lastUpdateTime`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#time-v1-meta[$$Time$$]__ | LastUpdateTime holds the time at which the Status was last updated. It is a pointer to get around some undesirable behavior with respect to the empty metav1.Time value (see https://github.com/kubernetes/kubernetes/issues/86811).
+| *`jwksSecret`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | JWKSSecret holds the name of the secret in which this OIDC Provider's signing/verification keys are stored. If it is empty, then the signing/verification keys are either unknown or they don't exist.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovidertlsspec"]
+==== OIDCProviderTLSSpec 
+
+OIDCProviderTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderspec[$$OIDCProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`secretName`* __string__ | SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this OIDCProvider. When provided, the TLS Secret named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS. 
+ Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) supported by all major browsers. 
+ SecretName is required if you would like to use different TLS certificates for issuers of different hostnames. SNI requests do not include port numbers, so all issuers with the same DNS hostname must use the same SecretName value even if they have different port numbers. 
+ SecretName is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an Ingress). It is also not required when you would like all requests to this OIDC Provider's HTTPS endpoints to use the default TLS certificate, which is configured elsewhere. 
+ When your Issuer URL's host is an IP address, then this field is ignored. SNI does not work for IP addresses.
+|===
+
+
+
+[id="{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1"]
+=== login.concierge.pinniped.dev/v1alpha1
+
+Package v1alpha1 is the v1alpha1 version of the Pinniped login API.
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-clustercredential"]
+==== ClusterCredential 
+
+ClusterCredential is the cluster-specific credential returned on a successful credential request. It contains either a valid bearer token or a valid TLS certificate and corresponding private key for the cluster.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequeststatus[$$TokenCredentialRequestStatus$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`expirationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#time-v1-meta[$$Time$$]__ | ExpirationTimestamp indicates a time when the provided credentials expire.
+| *`token`* __string__ | Token is a bearer token used by the client for request authentication.
+| *`clientCertificateData`* __string__ | PEM-encoded client TLS certificates (including intermediates, if any).
+| *`clientKeyData`* __string__ | PEM-encoded private key for the above certificate.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequest"]
+==== TokenCredentialRequest 
+
+TokenCredentialRequest submits an IDP-specific credential to Pinniped in exchange for a cluster-specific credential.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequestlist[$$TokenCredentialRequestList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequestspec[$$TokenCredentialRequestSpec$$]__ | 
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequeststatus[$$TokenCredentialRequestStatus$$]__ | 
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequestspec"]
+==== TokenCredentialRequestSpec 
+
+TokenCredentialRequestSpec is the specification of a TokenCredentialRequest, expected on requests to the Pinniped API.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequest[$$TokenCredentialRequest$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`token`* __string__ | Bearer token supplied with the credential request.
+| *`authenticator`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#typedlocalobjectreference-v1-core[$$TypedLocalObjectReference$$]__ | Reference to an authenticator which can validate this credential request.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequeststatus"]
+==== TokenCredentialRequestStatus 
+
+TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned on responses to the Pinniped API.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-tokencredentialrequest[$$TokenCredentialRequest$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`credential`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-login-v1alpha1-clustercredential[$$ClusterCredential$$]__ | A Credential will be returned for a successful credential request.
+| *`message`* __string__ | An error message will be returned for an unsuccessful credential request.
+|===
+
+

generated/1.17/apis/concierge/authentication/doc.go

@@ -0,0 +1,8 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:deepcopy-gen=package
+// +groupName=authentication.concierge.pinniped.dev
+
+// Package authentication is the internal version of the Pinniped concierge authentication API.
+package authentication

generated/1.17/apis/concierge/authentication/v1alpha1/conversion.go

@@ -0,0 +1,4 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1

generated/1.17/apis/concierge/authentication/v1alpha1/defaults.go

@@ -0,0 +1,12 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}