Merge pull request #1385 from vmware-tanzu/update_kube_deps_0.26.1

Update Kube deps to 0.26.1
Increase lint timeout to 20m for CI
2026-01-30 01:22:30 +00:00 · 2023-01-19 15:48:41 -08:00 · 2023-01-19 14:41:42 -08:00 · 2023-01-19 14:03:37 -08:00 · 2023-01-19 13:47:12 -08:00 · 2023-01-18 16:00:16 -08:00
1570 changed files with 38805 additions and 4253 deletions
--- a/2
+++ b/2
@@ -3,7 +3,7 @@
 # Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0

-FROM golang:1.19.1 as build-env
+FROM golang:1.19.5 as build-env

 WORKDIR /work
 COPY . .
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -1,25 +1,24 @@
-# Pinniped Maintainers
+# Current Pinniped Maintainers

-This is the current list of maintainers for the Pinniped project.
-
-| Maintainer | GitHub ID | Affiliation |
-| --------------- | --------- | ----------- |
-| Anjali Telang | [anjaltelang](https://github.com/anjaltelang) | [VMware](https://www.github.com/vmware/) |
-| Ryan Richard | [cfryanr](https://github.com/cfryanr) | [VMware](https://www.github.com/vmware/) |
-| Ben Petersen | [benjaminapetersen](https://github.com/benjaminapetersen) | [VMware](https://www.github.com/vmware/) |
+| Maintainer      | GitHub ID                                                 | Affiliation                              |
+|-----------------|-----------------------------------------------------------|------------------------------------------|
+| Ben Petersen    | [benjaminapetersen](https://github.com/benjaminapetersen) | [VMware](https://www.github.com/vmware/) |
+| Ryan Richard    | [cfryanr](https://github.com/cfryanr)                     | [VMware](https://www.github.com/vmware/) |
+| Joshua T. Casey | [joshuatcasey](https://github.com/joshuatcasey)           | [VMware](https://www.github.com/vmware/) |

 ## Emeritus Maintainers

-* Andrew Keesler, [ankeesler](https://github.com/ankeesler)
-* Pablo Schuhmacher, [pabloschuhmacher](https://github.com/pabloschuhmacher)
-* Matt Moyer, [mattmoyer](https://github.com/mattmoyer)
-* Margo Crawford, [margocrawf](https://github.com/margocrawf)
-* Mo Khan, [enj](https://github.com/enj)
+| Maintainer        | GitHub ID                                               |
+|-------------------|---------------------------------------------------------|
+| Andrew Keesler    | [ankeesler](https://github.com/ankeesler)               |
+| Anjali Telang     | [anjaltelang](https://github.com/anjaltelang)           |
+| Margo Crawford    | [margocrawf](https://github.com/margocrawf)             |
+| Matt Moyer        | [mattmoyer](https://github.com/mattmoyer)               |
+| Mo Khan           | [enj](https://github.com/enj)                           |
+| Pablo Schuhmacher | [pabloschuhmacher](https://github.com/pabloschuhmacher) |

-## Pinniped Contributors & Stakeholders
+## Pinniped Community Management

-| Feature Area | Lead |
-| ----------------------------- | :---------------------: |
-| Technical Lead | Ryan Richard (cfryanr) |
-| Product Management | Anjali Telang (anjaltelang) |
-| Community Management | Nigel Brown (pnbrown) |
+| Community Manager | GitHub ID                             |
+|-------------------|---------------------------------------|
+| Nigel Brown       | [pnbrown](https://github.com/pnbrown) |
--- a/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go.tmpl
+++ b/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go.tmpl
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 package v1alpha1
@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }

 // OIDCClient contains information about an OIDC client (e.g., client ID and client
--- a/apis/supervisor/oidc/types_supervisor_oidc.go.tmpl
+++ b/apis/supervisor/oidc/types_supervisor_oidc.go.tmpl
@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 package oidc
@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"

+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"

--- a/cmd/pinniped-concierge-kube-cert-agent/main.go
+++ b/cmd/pinniped-concierge-kube-cert-agent/main.go
@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Package main is the combined entrypoint for the Pinniped "kube-cert-agent" component.
@@ -13,8 +13,23 @@ import (
 	"os"
 	"time"

-	// this side effect import ensures that we use fipsonly crypto in fips_strict mode.
-	_ "go.pinniped.dev/internal/crypto/ptls"
+	// This side effect import ensures that we use fipsonly crypto during TLS in fips_strict mode.
+	//
+	// Commenting this out because it causes the runtime memory consumption of this binary to increase
+	// from ~1 MB to ~8 MB (as measured when running the sleep subcommand). This binary does not use TLS,
+	// so it should not be needed. If this binary is ever changed to make use of TLS client and/or server
+	// code, then we should bring this import back to support the use of the ptls library for client and
+	// server code, and we should also increase the memory limits on the kube cert agent deployment (as
+	// decided by the kube cert agent controller in the Concierge).
+	//
+	//nolint:godot // This is not sentence, it is a commented out line of import code.
+	// _ "go.pinniped.dev/internal/crypto/ptls"
+
+	// This side effect imports cgo so that runtime/cgo gets linked, when in fips_strict mode.
+	// Without this line, the binary will exit 133 upon startup in fips_strict mode.
+	// It also enables fipsonly tls mode, just to be absolutely sure that the fips code is enabled,
+	// even though it shouldn't be used currently by this binary.
+	_ "go.pinniped.dev/internal/crypto/fips"
 )

 //nolint:gochecknoglobals // these are swapped during unit tests.
--- a/cmd/pinniped-server/main.go
+++ b/cmd/pinniped-server/main.go
@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Package main is the combined entrypoint for all Pinniped server components.
@@ -12,13 +12,12 @@ import (
 	"os"
 	"path/filepath"

-	"k8s.io/apimachinery/pkg/util/sets"
-
-	// this side effect import ensures that we use fipsonly crypto in fips_strict mode.
 	concierge "go.pinniped.dev/internal/concierge/server"
+	// this side effect import ensures that we use fipsonly crypto in fips_strict mode.
 	_ "go.pinniped.dev/internal/crypto/ptls"
 	lua "go.pinniped.dev/internal/localuserauthenticator"
 	"go.pinniped.dev/internal/plog"
+	"go.pinniped.dev/internal/psets"
 	supervisor "go.pinniped.dev/internal/supervisor/server"
 )

@@ -38,7 +37,7 @@ func main() {
 	}
 	binary := filepath.Base(os.Args[0])
 	if subcommands[binary] == nil {
-		fail(fmt.Errorf("must be invoked as one of %v, not %q", sets.StringKeySet(subcommands).List(), binary))
+		fail(fmt.Errorf("must be invoked as one of %v, not %q", psets.StringKeySet(subcommands).List(), binary))
 	}
 	subcommands[binary]()
 }
--- a/deploy/supervisor/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml
+++ b/deploy/supervisor/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml
@@ -185,6 +185,24 @@ spec:
                description: Claims provides the names of token claims that will be
                  used when inspecting an identity from this OIDC identity provider.
                properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                  groups:
                    description: Groups provides the name of the ID token claim or
                      userinfo endpoint response claim that will be used to ascertain
--- a/generated/1.17/README.adoc
+++ b/generated/1.17/README.adoc
@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===


--- a/generated/1.17/apis/concierge/authentication/v1alpha1/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/concierge/authentication/v1alpha1/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/config/v1alpha1/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/concierge/config/v1alpha1/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/identity/v1alpha1/zz_generated.conversion.go
+++ b/generated/1.17/apis/concierge/identity/v1alpha1/zz_generated.conversion.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by conversion-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/identity/v1alpha1/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/concierge/identity/v1alpha1/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/identity/v1alpha1/zz_generated.defaults.go
+++ b/generated/1.17/apis/concierge/identity/v1alpha1/zz_generated.defaults.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by defaulter-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/identity/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/concierge/identity/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/login/v1alpha1/zz_generated.conversion.go
+++ b/generated/1.17/apis/concierge/login/v1alpha1/zz_generated.conversion.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by conversion-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/login/v1alpha1/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/concierge/login/v1alpha1/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/login/v1alpha1/zz_generated.defaults.go
+++ b/generated/1.17/apis/concierge/login/v1alpha1/zz_generated.defaults.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by defaulter-gen. DO NOT EDIT.
--- a/generated/1.17/apis/concierge/login/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/concierge/login/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/supervisor/clientsecret/v1alpha1/zz_generated.conversion.go
+++ b/generated/1.17/apis/supervisor/clientsecret/v1alpha1/zz_generated.conversion.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by conversion-gen. DO NOT EDIT.
--- a/generated/1.17/apis/supervisor/clientsecret/v1alpha1/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/supervisor/clientsecret/v1alpha1/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/supervisor/clientsecret/v1alpha1/zz_generated.defaults.go
+++ b/generated/1.17/apis/supervisor/clientsecret/v1alpha1/zz_generated.defaults.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by defaulter-gen. DO NOT EDIT.
--- a/generated/1.17/apis/supervisor/clientsecret/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/supervisor/clientsecret/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/supervisor/config/v1alpha1/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/supervisor/config/v1alpha1/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
--- a/generated/1.17/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go
+++ b/generated/1.17/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 package v1alpha1
@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }

 // OIDCClient contains information about an OIDC client (e.g., client ID and client
--- a/generated/1.17/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go
+++ b/generated/1.17/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by deepcopy-gen. DO NOT EDIT.
@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }

@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }
--- a/generated/1.17/apis/supervisor/oidc/types_supervisor_oidc.go
+++ b/generated/1.17/apis/supervisor/oidc/types_supervisor_oidc.go
@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 package oidc
@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"

+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"

--- a/generated/1.17/client/concierge/clientset/versioned/clientset.go
+++ b/generated/1.17/client/concierge/clientset/versioned/clientset.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/fake/clientset_generated.go
+++ b/generated/1.17/client/concierge/clientset/versioned/fake/clientset_generated.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/fake/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/fake/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/fake/register.go
+++ b/generated/1.17/client/concierge/clientset/versioned/fake/register.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/scheme/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/scheme/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/scheme/register.go
+++ b/generated/1.17/client/concierge/clientset/versioned/scheme/register.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/authentication_client.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/authentication_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_authentication_client.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_authentication_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_jwtauthenticator.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_jwtauthenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_webhookauthenticator.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_webhookauthenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/generated_expansion.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/generated_expansion.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/jwtauthenticator.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/jwtauthenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/webhookauthenticator.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/authentication/v1alpha1/webhookauthenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/config_client.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/config_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/credentialissuer.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/credentialissuer.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/fake/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/fake/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/fake/fake_config_client.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/fake/fake_config_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/fake/fake_credentialissuer.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/fake/fake_credentialissuer.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/generated_expansion.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/config/v1alpha1/generated_expansion.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/fake/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/fake/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/fake/fake_identity_client.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/fake/fake_identity_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/fake/fake_whoamirequest.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/fake/fake_whoamirequest.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/generated_expansion.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/generated_expansion.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/identity_client.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/identity_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/whoamirequest.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/identity/v1alpha1/whoamirequest.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/fake/doc.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/fake/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/fake/fake_login_client.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/fake/fake_login_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/fake/fake_tokencredentialrequest.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/fake/fake_tokencredentialrequest.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/generated_expansion.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/generated_expansion.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/login_client.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/login_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/tokencredentialrequest.go
+++ b/generated/1.17/client/concierge/clientset/versioned/typed/login/v1alpha1/tokencredentialrequest.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/authentication/interface.go
+++ b/generated/1.17/client/concierge/informers/externalversions/authentication/interface.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/authentication/v1alpha1/interface.go
+++ b/generated/1.17/client/concierge/informers/externalversions/authentication/v1alpha1/interface.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/authentication/v1alpha1/jwtauthenticator.go
+++ b/generated/1.17/client/concierge/informers/externalversions/authentication/v1alpha1/jwtauthenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/authentication/v1alpha1/webhookauthenticator.go
+++ b/generated/1.17/client/concierge/informers/externalversions/authentication/v1alpha1/webhookauthenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/config/interface.go
+++ b/generated/1.17/client/concierge/informers/externalversions/config/interface.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/config/v1alpha1/credentialissuer.go
+++ b/generated/1.17/client/concierge/informers/externalversions/config/v1alpha1/credentialissuer.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/config/v1alpha1/interface.go
+++ b/generated/1.17/client/concierge/informers/externalversions/config/v1alpha1/interface.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/factory.go
+++ b/generated/1.17/client/concierge/informers/externalversions/factory.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/generic.go
+++ b/generated/1.17/client/concierge/informers/externalversions/generic.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/informers/externalversions/internalinterfaces/factory_interfaces.go
+++ b/generated/1.17/client/concierge/informers/externalversions/internalinterfaces/factory_interfaces.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by informer-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/listers/authentication/v1alpha1/expansion_generated.go
+++ b/generated/1.17/client/concierge/listers/authentication/v1alpha1/expansion_generated.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by lister-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/listers/authentication/v1alpha1/jwtauthenticator.go
+++ b/generated/1.17/client/concierge/listers/authentication/v1alpha1/jwtauthenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by lister-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/listers/authentication/v1alpha1/webhookauthenticator.go
+++ b/generated/1.17/client/concierge/listers/authentication/v1alpha1/webhookauthenticator.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by lister-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/listers/config/v1alpha1/credentialissuer.go
+++ b/generated/1.17/client/concierge/listers/config/v1alpha1/credentialissuer.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by lister-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/listers/config/v1alpha1/expansion_generated.go
+++ b/generated/1.17/client/concierge/listers/config/v1alpha1/expansion_generated.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by lister-gen. DO NOT EDIT.
--- a/generated/1.17/client/concierge/openapi/zz_generated.openapi.go
+++ b/generated/1.17/client/concierge/openapi/zz_generated.openapi.go
@@ -1,7 +1,7 @@
 //go:build !ignore_autogenerated
 // +build !ignore_autogenerated

-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by openapi-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/clientset.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/clientset.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/doc.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/fake/clientset_generated.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/fake/clientset_generated.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/fake/doc.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/fake/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/fake/register.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/fake/register.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/scheme/doc.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/scheme/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/scheme/register.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/scheme/register.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/clientsecret_client.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/clientsecret_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/doc.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake/doc.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake/fake_clientsecret_client.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake/fake_clientsecret_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake/fake_oidcclientsecretrequest.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake/fake_oidcclientsecretrequest.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/generated_expansion.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/generated_expansion.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/oidcclientsecretrequest.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/oidcclientsecretrequest.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/config_client.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/config_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/doc.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/doc.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/fake_config_client.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/fake_config_client.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/fake_federationdomain.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/fake_federationdomain.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/fake_oidcclient.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/fake_oidcclient.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/federationdomain.go
+++ b/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/federationdomain.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0

 // Code generated by client-gen. DO NOT EDIT.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ryan Richard	e6a18978d1	Merge pull request #1385 from vmware-tanzu/update_kube_deps_0.26.1 Update Kube deps to 0.26.1	2023-01-19 15:48:41 -08:00
Ryan Richard	14858a6db3	Increase lint timeout to 20m for CI	2023-01-19 14:41:42 -08:00
Ryan Richard	8cad5ea3c9	Update Kube deps to 0.26.1 Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>	2023-01-19 14:03:37 -08:00
Ryan Richard	0ffd01d993	Merge pull request #1372 from vmware-tanzu/jtc/support-k8s-0.26-and-bump-generated-code bump k8s deps to 0.26 and bump generated code to include 1.26	2023-01-19 13:47:12 -08:00
Ryan Richard	23f6dd44a0	Use Go 1.19 for fips builds Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>	2023-01-18 16:00:16 -08:00
Ryan Richard	7ff3b3d9cb	Code changes to support Kube 0.26 deps	2023-01-18 14:39:22 -08:00
Joshua Casey	a430f4b730	Bump K8s deps to 0.26 and add codegen for 0.26	2023-01-18 13:41:06 -08:00
Joshua Casey	585adc96d8	Bump generated files for K8s 1.22, 1.23, 1.24, 1.25	2023-01-18 13:38:36 -08:00
Ryan Richard	3b46547efc	add hack/update-copyright-year.sh	2023-01-18 13:36:23 -08:00
Ryan Richard	53f56f328b	Merge pull request #1371 from vmware-tanzu/jtc/bump-deps-except-k8s Bump Golang and Deps (except K8s)	2023-01-18 09:19:27 -08:00
Ryan Richard	9aafff78f1	bump two more direct deps	2023-01-18 08:26:55 -08:00
Joshua Casey	a49e48c6f7	Bump FIPS Golang to 1.18.10b7 Resolves #1367	2023-01-17 21:20:50 -06:00
Joshua Casey	6926c1ab64	Bump Golang to 1.19.5 Resolves #1368	2023-01-17 21:20:37 -06:00
Joshua Casey	f9e2212882	Bump all deps except K8s Resolves: - #1360 - #1361 - #1362 - #1363 - #1364 - #1365	2023-01-17 21:11:39 -06:00
Joshua Casey	95d35a174d	Merge pull request #1294 from vmware-tanzu/additional_claim_mapping Add `spec.claims.additionalClaimMappings` to OIDCIdentityProvider	2023-01-17 20:48:58 -06:00
Ryan Richard	2f9b8b105d	update copyright to 2023 in files changed by this PR	2023-01-17 15:54:16 -08:00
Ryan Richard	3d20fa79a7	Two more integration tests for additionalClaimMappings Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>	2023-01-17 15:36:39 -08:00
Ryan Richard	74c3156059	Assert more cluster-scoped ID token claims in supervisor_login_test.go	2023-01-17 13:10:51 -08:00
Joshua Casey	6156fdf175	Expect complex subclaims of additionalClaims to have type interface{} Co-authored-by: Ryan Richard <richardry@vmware.com>	2023-01-17 13:27:40 -06:00
Joshua Casey	f494c61790	additionalClaims claim should not be present when no sub claims are expected Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me>	2023-01-17 11:58:08 -06:00
Ryan Richard	2633d72ce2	Change some test variable names related to additional claims Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>	2023-01-13 14:59:59 -08:00
Joshua Casey	a94bbe70c7	Add integration test to verify that additionalClaims are present in an ID Token Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Joshua Casey <joshuatcasey@gmail.com> Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me>	2023-01-13 14:59:59 -08:00
Joshua Casey	9acc456fd7	Update token_handler_test to check additionalClaims for bools, numbers, and slices Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Joshua Casey <joshuatcasey@gmail.com> Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me>	2023-01-13 14:59:59 -08:00
Ryan Richard	8ff6ef32e9	Allow additional claims to map into an ID token issued by the supervisor - Specify mappings on OIDCIdentityProvider.spec.claims.additionalClaimMappings - Advertise additionalClaims in the OIDC discovery endpoint under claims_supported Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>	2023-01-13 14:59:50 -08:00
Joshua Casey	f4c9202f49	Merge pull request #1369 from vmware-tanzu/kube_cert_agent_reduce_memory Reduce memory consumption of pinniped-concierge-kube-cert-agent binary	2023-01-13 14:26:39 -06:00
Ryan Richard	bc7ffd37a6	Reduce memory consumption of pinniped-concierge-kube-cert-agent binary Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>	2023-01-13 11:07:42 -08:00
Pinny	f691baec74	Updated versions in docs for v0.21.0 release	2022-12-21 13:12:06 +00:00
Ryan Richard	39a95e1198	Merge pull request #1354 from vmware-tanzu/dump_more_deps_dec_2022 Bump Go 1.19.1 -> 1.19.4, and go-boringcrypto 1.18.6b7 -> 1.18.9b7	2022-12-15 10:35:54 -08:00
Ryan Richard	6d3ed73eee	Bump Go 1.19.1 -> 1.19.4, and go-boringcrypto 1.18.6b7 -> 1.18.9b7	2022-12-15 09:40:32 -08:00
Ryan Richard	e3a963b73f	Merge pull request #1340 from vmware-tanzu/jtc/update-maintainers Update maintainers	2022-12-15 09:31:14 -08:00
Ryan Richard	30818cb66d	Merge pull request #1353 from vmware-tanzu/dump_deps_dec_2022 Upgrade project Go dependencies	2022-12-15 09:23:16 -08:00
Ryan Richard	976035115e	Stop using pointer pkg functions that were deprecated by dependency bump	2022-12-14 08:47:16 -08:00
Ryan Richard	85b67f254c	Add more assertion to token_handler_test.go for token exchange exp claim	2022-12-14 08:47:16 -08:00
Ryan Richard	e1a0367b03	Upgrade project Go dependencies Most of the changes in this commit are because of these fosite PRs which changed behavior and/or APIs in fosite: - https://github.com/ory/fosite/pull/667 - https://github.com/ory/fosite/pull/679 (from me!) - https://github.com/ory/fosite/pull/675 - https://github.com/ory/fosite/pull/688 Due to the changes in fosite PR #688, we need to bump our storage version for anything which stores the DefaultSession struct as JSON.	2022-12-14 08:47:16 -08:00
Joshua Casey	a9aac69c65	Add https://github.com/joshuatcasey as a Maintainer. Remove Technical Lead role.	2022-12-08 11:47:06 -06:00
Joshua Casey	d88895c4a5	Prettify MAINTAINERS.md	2022-12-08 11:43:09 -06:00
Ryan Richard	d35306aa85	Merge pull request #1322 from rooso/main Update example configuration for Active Directory	2022-11-09 09:35:32 -08:00
rooso	3548362ce4	Update example configuration for Active Directory there was an typo in the example configuration for Microsoft Active Directory. Attribute was `userPrincipleName` but should be `userPrincipalName`	2022-10-20 14:34:12 +02:00
Ben Petersen	4951cbe5d4	Merge pull request #1306 from vmware-tanzu/ci-updates-for-external-idps Update TestLDAPSearch_Parallel to notice different var for external ldap server	2022-09-29 12:35:50 -04:00
Ryan Richard	66f4ee8a1b	Update more tests to notice different var for external ldap server	2022-09-28 14:32:10 -07:00
Benjamin A. Petersen	09b9075abb	Update TestLDAPSearch_Parallel to notice different var for external ldap server	2022-09-28 16:02:56 -04:00
Ben Petersen	99c635c38d	Merge pull request #1304 from vmware-tanzu/site-footers Update site footer and maintainers page	2022-09-27 16:18:18 -04:00
Benjamin A. Petersen	265c63fa54	Update site footer and maintainers page Co-authored-by: Ryan Richard <richardry@vmware.com> Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me>	2022-09-27 16:13:55 -04:00
Pinny	2995e6a48c	Updated versions in docs for v0.20.0 release	2022-09-27 17:16:32 +00:00