Merge pull request #1982 from vmware-tanzu/pinny/bump-deps

Bump dependencies

.github/dependabot.yml

@@ -9,12 +9,25 @@ updates:
     schedule:
       interval: "daily"
 
-# Our own CI job is responsible for updating this go.mod file now.
-#  - package-ecosystem: "gomod"
-#    open-pull-requests-limit: 100
-#    directory: "/"
-#    schedule:
-#      interval: "daily"
+  # Use dependabot to automate major-only dependency bumps
+  - package-ecosystem: "gomod"
+    open-pull-requests-limit: 2 # Not sure why there would ever be more than 1, just would not want to hide anything
+    directory: "/"
+    schedule:
+      interval: "daily"
+    # group all major dependency bumps together so there's only one pull request
+    groups:
+      go-modules:
+        patterns:
+        - "*"
+        update-types:
+        - "major"
+    ignore:
+    # For all packages, ignore all minor and patch updates
+    - dependency-name: "*"
+      update-types:
+      - "version-update:semver-minor"
+      - "version-update:semver-patch"
 
 # Our own CI job is responsible for updating this Docker file now.
 #  - package-ecosystem: "docker"

.golangci.yaml

@@ -1,8 +1,6 @@
-# https://github.com/golangci/golangci-lint#config-file
+# https://golangci-lint.run/usage/configuration/
 run:
-  deadline: 1m
-  skip-dirs:
-    - generated
+  timeout: 1m
 
 linters:
   disable-all: true
@@ -45,14 +43,25 @@ linters:
     - sqlclosecheck
     - unconvert
     - whitespace
+    - copyloopvar
+    - intrange
+    - fatcontext
+    # - canonicalheader Can't do this one since it alerts on valid headers such as X-XSS-Protection
+    - spancheck
 
 issues:
+  exclude-dirs:
+    - generated
   exclude-rules:
     # exclude tests from some rules for things that are useful in a testing context.
     - path: _test\.go
       linters:
         - funlen
         - gochecknoglobals
+        - revive
+    - path: internal/testutil/
+      linters:
+      - revive
 
 linters-settings:
   funlen:
@@ -76,3 +85,9 @@ linters-settings:
           # Allow unused params that start with underscore. It can be nice to keep unused param names when implementing
           # an interface sometimes, to help readers understand why it is unused in that particular implementation.
           - allowRegex: "^_"
+  spancheck:
+    # https://golangci-lint.run/usage/linters/#spancheck
+    checks:
+    - end
+    - record-error
+    - set-status

Dockerfile

@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile:1
 
-# Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-ARG BUILD_IMAGE=golang:1.22.3@sha256:b1e05e2c918f52c59d39ce7d5844f73b2f4511f7734add8bb98c9ecdd4443365
+ARG BUILD_IMAGE=golang:1.22.4@sha256:969349b8121a56d51c74f4c273ab974c15b3a8ae246a5cffc1df7d28b66cf978
 ARG BASE_IMAGE=gcr.io/distroless/static:nonroot@sha256:e9ac71e2b8e279a8372741b7a0293afda17650d926900233ec3a7b2b7c22a246
 
 # Prepare to cross-compile by always running the build stage in the build platform, not the target platform.

MAINTAINERS.md

@@ -2,17 +2,17 @@
 
 | Maintainer      | GitHub ID                                                 | Affiliation                              |
 |-----------------|-----------------------------------------------------------|------------------------------------------|
-| Ben Petersen    | [benjaminapetersen](https://github.com/benjaminapetersen) | [VMware](https://www.github.com/vmware/) |
 | Ryan Richard    | [cfryanr](https://github.com/cfryanr)                     | [VMware](https://www.github.com/vmware/) |
 | Joshua T. Casey | [joshuatcasey](https://github.com/joshuatcasey)           | [VMware](https://www.github.com/vmware/) |
 
 ## Emeritus Maintainers
 
-| Maintainer        | GitHub ID                                               |
-|-------------------|---------------------------------------------------------|
-| Andrew Keesler    | [ankeesler](https://github.com/ankeesler)               |
-| Anjali Telang     | [anjaltelang](https://github.com/anjaltelang)           |
-| Margo Crawford    | [margocrawf](https://github.com/margocrawf)             |
-| Matt Moyer        | [mattmoyer](https://github.com/mattmoyer)               |
-| Mo Khan           | [enj](https://github.com/enj)                           |
-| Pablo Schuhmacher | [pabloschuhmacher](https://github.com/pabloschuhmacher) |
+| Maintainer        | GitHub ID                                                 |
+|-------------------|-----------------------------------------------------------|
+| Andrew Keesler    | [ankeesler](https://github.com/ankeesler)                 |
+| Anjali Telang     | [anjaltelang](https://github.com/anjaltelang)             |
+| Ben Petersen      | [benjaminapetersen](https://github.com/benjaminapetersen) |
+| Margo Crawford    | [margocrawf](https://github.com/margocrawf)               |
+| Matt Moyer        | [mattmoyer](https://github.com/mattmoyer)                 |
+| Mo Khan           | [enj](https://github.com/enj)                             |
+| Pablo Schuhmacher | [pabloschuhmacher](https://github.com/pabloschuhmacher)   |

README.md

@@ -47,4 +47,4 @@ Please follow the procedure described in [SECURITY.md](SECURITY.md).
 
 Pinniped is open source and licensed under Apache License Version 2.0. See [LICENSE](LICENSE).
 
-Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.

ROADMAP.md

@@ -5,8 +5,6 @@
 This document provides a high-level overview of the next big features the maintainers are planning to work on. This
 should serve as a reference point for Pinniped users and contributors to understand where the project is heading, and
 help determine if a contribution could be conflicting with a longer term plan.
-The [Pinniped project backlog](https://github.com/orgs/vmware-tanzu/projects/43/) is prioritized based on this roadmap,
-and it provides a more granular view of what the maintainers are working on a day-to-day basis.
 
 ### How to help
 
@@ -23,19 +21,6 @@ a [proposal](https://github.com/vmware-tanzu/pinniped/tree/main/proposals) in ou
 For smaller enhancements, you can open an issue to track that initiative or feature request.
 We work with and rely on community feedback to focus our efforts to improve Pinniped and maintain a healthy roadmap.
 
-### Current Roadmap
-
-The following table includes the current roadmap for Pinniped. Please take the timelines and dates as proposals and
-goals. Priorities and requirements change based on community feedback, roadblocks encountered, community contributions,
+Priorities and requirements change based on community feedback, roadblocks encountered, community contributions,
 etc. If you depend on a specific item, we encourage you to reach out for updated status information, or help us deliver
 that feature by [contributing](https://github.com/vmware-tanzu/pinniped/blob/main/CONTRIBUTING.md) to Pinniped.
-
-Last Updated: Sept 2022
-|Theme|Description|Timeline|
-|--|--|--|
-|Improving Usability|Dynamic Oauth Client Support for integrating with UI/Dashboards |Sept/Oct 2022|
-|Improving Usability|Support for custom claim mappings in OIDCIdentityProvider |Q4 2022|
-|Improving Usability|Support for Multiple Identity Providers |Q4 2022|
-|Improving Security Posture|Support Audit logging of security events related to Authentication |Q4 2022|
-|Improving Security Posture|Session Management |2022/2023|
-|Improving Security Posture|Secrets Rotation and Management |2022/2023|

SCOPE.md

@@ -21,12 +21,3 @@ The following items are out of scope for the Pinniped project.
 - Standalone identity provider for general use.
 - Machine-to-machine (service) identity.
 - Running outside of Kubernetes.
-
-## Roadmap
-
-See our [open milestones][milestones] and the [`priority/backlog` label][backlog] for an idea about what's next on our roadmap.
-
-For more details on proposing features and bugs, check out our [contributing](./CONTRIBUTING.md) doc.
-
-[milestones]: https://github.com/vmware-tanzu/pinniped/milestones
-[backlog]: https://github.com/vmware-tanzu/pinniped/labels/priority%2Fbacklog

apis/supervisor/idp/v1alpha1/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -36,6 +36,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&LDAPIdentityProviderList{},
 		&ActiveDirectoryIdentityProvider{},
 		&ActiveDirectoryIdentityProviderList{},
+		&GitHubIdentityProvider{},
+		&GitHubIdentityProviderList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

apis/supervisor/idp/v1alpha1/types_githubidentityprovider.go.tmpl

@@ -0,0 +1,256 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type GitHubIdentityProviderPhase string
+
+const (
+	// GitHubPhasePending is the default phase for newly-created GitHubIdentityProvider resources.
+	GitHubPhasePending GitHubIdentityProviderPhase = "Pending"
+
+	// GitHubPhaseReady is the phase for an GitHubIdentityProvider resource in a healthy state.
+	GitHubPhaseReady GitHubIdentityProviderPhase = "Ready"
+
+	// GitHubPhaseError is the phase for an GitHubIdentityProvider in an unhealthy state.
+	GitHubPhaseError GitHubIdentityProviderPhase = "Error"
+)
+
+type GitHubAllowedAuthOrganizationsPolicy string
+
+const (
+	// GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers means any GitHub user is allowed to log in using this identity
+	// provider, regardless of their organization membership or lack thereof.
+	GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers GitHubAllowedAuthOrganizationsPolicy = "AllGitHubUsers"
+
+	// GitHubAllowedAuthOrganizationsPolicyOnlyUsersFromAllowedOrganizations means only those users with membership in
+	// the listed GitHub organizations are allowed to log in.
+	GitHubAllowedAuthOrganizationsPolicyOnlyUsersFromAllowedOrganizations GitHubAllowedAuthOrganizationsPolicy = "OnlyUsersFromAllowedOrganizations"
+)
+
+// GitHubIdentityProviderStatus is the status of an GitHub identity provider.
+type GitHubIdentityProviderStatus struct {
+	// Phase summarizes the overall status of the GitHubIdentityProvider.
+	//
+	// +kubebuilder:default=Pending
+	// +kubebuilder:validation:Enum=Pending;Ready;Error
+	Phase GitHubIdentityProviderPhase `json:"phase,omitempty"`
+
+	// Conditions represents the observations of an identity provider's current state.
+	//
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+}
+
+// GitHubAPIConfig allows configuration for GitHub Enterprise Server
+type GitHubAPIConfig struct {
+	// Host is required only for GitHub Enterprise Server.
+	// Defaults to using GitHub's public API ("github.com").
+	// Do not specify a protocol or scheme since "https://" will always be used.
+	// Port is optional. Do not specify a path, query, fragment, or userinfo.
+	// Only domain name or IP address, subdomains (optional), and port (optional).
+	// IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
+	// in square brackets. Example: "[::1]:443".
+	//
+	// +kubebuilder:default="github.com"
+	// +kubebuilder:validation:MinLength=1
+	// +optional
+	Host *string `json:"host"`
+
+	// TLS configuration for GitHub Enterprise Server.
+	//
+	// +optional
+	TLS *TLSSpec `json:"tls,omitempty"`
+}
+
+// GitHubUsernameAttribute allows the user to specify which attribute(s) from GitHub to use for the username to present
+// to Kubernetes. See the response schema for
+// [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+type GitHubUsernameAttribute string
+
+const (
+	// GitHubUsernameID specifies using the `id` attribute from the GitHub user for the username to present to Kubernetes.
+	GitHubUsernameID GitHubUsernameAttribute = "id"
+
+	// GitHubUsernameLogin specifies using the `login` attribute from the GitHub user as the username to present to Kubernetes.
+	GitHubUsernameLogin GitHubUsernameAttribute = "login"
+
+	// GitHubUsernameLoginAndID specifies combining the `login` and `id` attributes from the GitHub user as the
+	// username to present to Kubernetes, separated by a colon. Example: "my-login:1234"
+	GitHubUsernameLoginAndID GitHubUsernameAttribute = "login:id"
+)
+
+// GitHubGroupNameAttribute allows the user to specify which attribute from GitHub to use for the group
+// names to present to Kubernetes. See the response schema for
+// [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+type GitHubGroupNameAttribute string
+
+const (
+	// GitHubUseTeamNameForGroupName specifies using the GitHub team's `name` attribute as the group name to present to Kubernetes.
+	GitHubUseTeamNameForGroupName GitHubGroupNameAttribute = "name"
+
+	// GitHubUseTeamSlugForGroupName specifies using the GitHub team's `slug` attribute as the group name to present to Kubernetes.
+	GitHubUseTeamSlugForGroupName GitHubGroupNameAttribute = "slug"
+)
+
+// GitHubClaims allows customization of the username and groups claims.
+type GitHubClaims struct {
+	// Username configures which property of the GitHub user record shall determine the username in Kubernetes.
+	//
+	// Can be either "id", "login", or "login:id". Defaults to "login:id".
+	//
+	// GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
+	// and may not start or end with hyphens. GitHub users are allowed to change their login name,
+	// although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
+	// then a second user might change their name from "baz" to "foo" in order to take the old
+	// username of the first user. For this reason, it is not as safe to make authorization decisions
+	// based only on the user's login attribute.
+	//
+	// If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+	// FederationDomain to further customize how these usernames are presented to Kubernetes.
+	//
+	// Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
+	// unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
+	// from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
+	// choice to concatenate the two values.
+	//
+	// See the response schema for
+	// [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+	//
+	// +kubebuilder:default="login:id"
+	// +kubebuilder:validation:Enum={"id","login","login:id"}
+	// +optional
+	Username *GitHubUsernameAttribute `json:"username"`
+
+	// Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
+	//
+	// Can be either "name" or "slug". Defaults to "slug".
+	//
+	// GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
+	//
+	// GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
+	//
+	// Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
+	// forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
+	// or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
+	// the team name or slug.
+	//
+	// If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+	// FederationDomain to further customize how these group names are presented to Kubernetes.
+	//
+	// See the response schema for
+	// [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+	//
+	// +kubebuilder:default=slug
+	// +kubebuilder:validation:Enum=name;slug
+	// +optional
+	Groups *GitHubGroupNameAttribute `json:"groups"`
+}
+
+// GitHubClientSpec contains information about the GitHub client that this identity provider will use
+// for web-based login flows.
+type GitHubClientSpec struct {
+	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
+	// clientSecret for an GitHub App or GitHub OAuth2 client.
+	//
+	// This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
+	//
+	// +kubebuilder:validation:MinLength=1
+	SecretName string `json:"secretName"`
+}
+
+type GitHubOrganizationsSpec struct {
+	// Policy must be set to "AllGitHubUsers" if allowed is empty.
+	//
+	// This field only exists to ensure that Pinniped administrators are aware that an empty list of
+	// allowedOrganizations means all GitHub users are allowed to log in.
+	//
+	// +kubebuilder:default=OnlyUsersFromAllowedOrganizations
+	// +kubebuilder:validation:Enum=OnlyUsersFromAllowedOrganizations;AllGitHubUsers
+	// +optional
+	Policy *GitHubAllowedAuthOrganizationsPolicy `json:"policy"`
+
+	// Allowed, when specified, indicates that only users with membership in at least one of the listed
+	// GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include
+	// teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
+	// provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
+	//
+	// The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
+	// otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
+	// within that organization.
+	//
+	// If no organizations are listed, you must set organizations: AllGitHubUsers.
+	//
+	// +kubebuilder:validation:MaxItems=64
+	// +listType=set
+	// +optional
+	Allowed []string `json:"allowed,omitempty"`
+}
+
+// GitHubAllowAuthenticationSpec allows customization of who can authenticate using this IDP and how.
+type GitHubAllowAuthenticationSpec struct {
+	// Organizations allows customization of which organizations can authenticate using this IDP.
+	// +kubebuilder:validation:XValidation:message="spec.allowAuthentication.organizations.policy must be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed has organizations listed",rule="!(has(self.allowed) && size(self.allowed) > 0 && self.policy == 'AllGitHubUsers')"
+	// +kubebuilder:validation:XValidation:message="spec.allowAuthentication.organizations.policy must be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed is empty",rule="!((!has(self.allowed) || size(self.allowed) == 0) && self.policy == 'OnlyUsersFromAllowedOrganizations')"
+	Organizations GitHubOrganizationsSpec `json:"organizations"`
+}
+
+// GitHubIdentityProviderSpec is the spec for configuring an GitHub identity provider.
+type GitHubIdentityProviderSpec struct {
+	// GitHubAPI allows configuration for GitHub Enterprise Server
+	//
+	// +kubebuilder:default={}
+	GitHubAPI GitHubAPIConfig `json:"githubAPI,omitempty"`
+
+	// Claims allows customization of the username and groups claims.
+	//
+	// +kubebuilder:default={}
+	Claims GitHubClaims `json:"claims,omitempty"`
+
+	// AllowAuthentication allows customization of who can authenticate using this IDP and how.
+	AllowAuthentication GitHubAllowAuthenticationSpec `json:"allowAuthentication"`
+
+	// Client identifies the secret with credentials for a GitHub App or GitHub OAuth2 App (a GitHub client).
+	Client GitHubClientSpec `json:"client"`
+}
+
+// GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+// This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+//
+// Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+// as OIDCClients.
+//
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=pinniped;pinniped-idp;pinniped-idps
+// +kubebuilder:printcolumn:name="Host",type=string,JSONPath=`.spec.githubAPI.host`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+// +kubebuilder:subresource:status
+type GitHubIdentityProvider struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec for configuring the identity provider.
+	Spec GitHubIdentityProviderSpec `json:"spec"`
+
+	// Status of the identity provider.
+	Status GitHubIdentityProviderStatus `json:"status,omitempty"`
+}
+
+// GitHubIdentityProviderList lists GitHubIdentityProvider objects.
+//
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type GitHubIdentityProviderList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []GitHubIdentityProvider `json:"items"`
+}

apis/supervisor/idp/v1alpha1/types_tls.go.tmpl

@@ -1,9 +1,9 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
 
-// Configuration for TLS parameters related to identity provider integration.
+// TLSSpec provides TLS configuration for identity provider integration.
 type TLSSpec struct {
 	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
 	// +optional

apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -15,6 +15,7 @@ const (
 	IDPTypeOIDC            IDPType = "oidc"
 	IDPTypeLDAP            IDPType = "ldap"
 	IDPTypeActiveDirectory IDPType = "activedirectory"
+	IDPTypeGitHub          IDPType = "github"
 
 	IDPFlowCLIPassword     IDPFlow = "cli_password"
 	IDPFlowBrowserAuthcode IDPFlow = "browser_authcode"
@@ -54,7 +55,8 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
-	PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
+	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +66,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

cmd/pinniped-concierge-kube-cert-agent/main_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package main
@@ -90,7 +90,6 @@ func TestEntrypoint(t *testing.T) {
 			}`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var logBuf bytes.Buffer
 			testLog := log.New(&logBuf, "", 0)

cmd/pinniped-server/main_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package main
@@ -38,7 +38,6 @@ func TestEntrypoint(t *testing.T) {
 			wantArgs: []string{"/path/to/valid-test-binary", "foo", "bar"},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var logBuf bytes.Buffer
 			testLog := log.New(&logBuf, "", 0)

cmd/pinniped/cmd/kubeconfig.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
@@ -143,7 +143,18 @@ func kubeconfigCommand(deps kubeconfigDeps) *cobra.Command {
 	f.BoolVar(&flags.oidc.debugSessionCache, "oidc-debug-session-cache", false, "Print debug logs related to the OpenID Connect session cache")
 	f.StringVar(&flags.oidc.requestAudience, "oidc-request-audience", "", "Request a token with an alternate audience using RFC8693 token exchange")
 	f.StringVar(&flags.oidc.upstreamIDPName, "upstream-identity-provider-name", "", "The name of the upstream identity provider used during login with a Supervisor")
-	f.StringVar(&flags.oidc.upstreamIDPType, "upstream-identity-provider-type", "", fmt.Sprintf("The type of the upstream identity provider used during login with a Supervisor (e.g. '%s', '%s', '%s')", idpdiscoveryv1alpha1.IDPTypeOIDC, idpdiscoveryv1alpha1.IDPTypeLDAP, idpdiscoveryv1alpha1.IDPTypeActiveDirectory))
+	f.StringVar(
+		&flags.oidc.upstreamIDPType,
+		"upstream-identity-provider-type",
+		"",
+		fmt.Sprintf(
+			"The type of the upstream identity provider used during login with a Supervisor (e.g. '%s', '%s', '%s', '%s')",
+			idpdiscoveryv1alpha1.IDPTypeOIDC,
+			idpdiscoveryv1alpha1.IDPTypeLDAP,
+			idpdiscoveryv1alpha1.IDPTypeActiveDirectory,
+			idpdiscoveryv1alpha1.IDPTypeGitHub,
+		),
+	)
 	f.StringVar(&flags.oidc.upstreamIDPFlow, "upstream-identity-provider-flow", "", fmt.Sprintf("The type of client flow to use with the upstream identity provider during login with a Supervisor (e.g. '%s', '%s')", idpdiscoveryv1alpha1.IDPFlowCLIPassword, idpdiscoveryv1alpha1.IDPFlowBrowserAuthcode))
 	f.StringVar(&flags.kubeconfigPath, "kubeconfig", os.Getenv("KUBECONFIG"), "Path to kubeconfig file")
 	f.StringVar(&flags.kubeconfigContextOverride, "kubeconfig-context", "", "Kubeconfig context name (default: current active context)")
@@ -163,7 +174,7 @@ func kubeconfigCommand(deps kubeconfigDeps) *cobra.Command {
 
 	mustMarkDeprecated(cmd, "concierge-namespace", "not needed anymore")
 
-	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+	cmd.RunE = func(cmd *cobra.Command, _args []string) error {
 		if flags.outputPath != "" {
 			out, err := os.Create(flags.outputPath)
 			if err != nil {

cmd/pinniped/cmd/kubeconfig_test.go

@@ -156,7 +156,7 @@ func TestGetKubeconfig(t *testing.T) {
 				      --timeout duration                         Timeout for autodiscovery and validation (default 10m0s)
 				      --upstream-identity-provider-flow string   The type of client flow to use with the upstream identity provider during login with a Supervisor (e.g. 'cli_password', 'browser_authcode')
 				      --upstream-identity-provider-name string   The name of the upstream identity provider used during login with a Supervisor
-				      --upstream-identity-provider-type string   The type of the upstream identity provider used during login with a Supervisor (e.g. 'oidc', 'ldap', 'activedirectory')
+				      --upstream-identity-provider-type string   The type of the upstream identity provider used during login with a Supervisor (e.g. 'oidc', 'ldap', 'activedirectory', 'github')
 			`)
 			},
 		},
@@ -908,7 +908,8 @@ func TestGetKubeconfig(t *testing.T) {
 			idpsDiscoveryResponse: here.Docf(`{
 				"pinniped_identity_providers": [
 					{"name": "some-ldap-idp", "type": "ldap"},
-					{"name": "some-oidc-idp", "type": "oidc"}
+					{"name": "some-oidc-idp", "type": "oidc", "flows": ["flow1", "flow2"]},
+					{"name": "some-github-idp", "type": "github"}
 				]
 			}`),
 			wantLogs: func(issuerCABundle string, issuerURL string) []string {
@@ -927,7 +928,7 @@ func TestGetKubeconfig(t *testing.T) {
 			wantStderr: func(issuerCABundle string, issuerURL string) testutil.RequireErrorStringFunc {
 				return testutil.WantExactErrorString(`Error: multiple Supervisor upstream identity providers were found, ` +
 					`so the --upstream-identity-provider-name/--upstream-identity-provider-type flags must be specified. ` +
-					`Found these upstreams: [{"name":"some-ldap-idp","type":"ldap"},{"name":"some-oidc-idp","type":"oidc"}]` + "\n")
+					`Found these upstreams: [{"name":"some-ldap-idp","type":"ldap"},{"name":"some-oidc-idp","type":"oidc","flows":["flow1","flow2"]},{"name":"some-github-idp","type":"github"}]` + "\n")
 			},
 		},
 		{
@@ -1029,8 +1030,8 @@ func TestGetKubeconfig(t *testing.T) {
 				}
 			},
 			wantError: true,
-			wantStderr: func(issuerCABundle string, issuerURL string) testutil.RequireErrorStringFunc {
-				return testutil.WantX509UntrustedCertErrorString(fmt.Sprintf("Error: while fetching OIDC discovery data from issuer: Get \"%s/.well-known/openid-configuration\": %%s\n", issuerURL), "Acme Co")
+			wantStderr: func(_issuerCABundle string, issuerURL string) testutil.RequireErrorStringFunc {
+				return testutil.WantSprintfErrorString(`Error: while fetching OIDC discovery data from issuer: Get "%s/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority%s`, issuerURL, "\n")
 			},
 		},
 		{
@@ -3197,7 +3198,6 @@ func TestGetKubeconfig(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var issuerEndpointPtr *string
 			testServer, testServerCA := tlsserver.TestServerIPv4(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

cmd/pinniped/cmd/login_oidc.go

@@ -12,7 +12,6 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	"github.com/spf13/cobra"
@@ -59,9 +58,10 @@ func init() {
 }
 
 type oidcLoginCommandDeps struct {
-	lookupEnv     func(string) (string, bool)
-	login         func(string, string, ...oidcclient.Option) (*oidctypes.Token, error)
-	exchangeToken func(context.Context, *conciergeclient.Client, string) (*clientauthv1beta1.ExecCredential, error)
+	lookupEnv      func(string) (string, bool)
+	login          func(string, string, ...oidcclient.Option) (*oidctypes.Token, error)
+	exchangeToken  func(context.Context, *conciergeclient.Client, string) (*clientauthv1beta1.ExecCredential, error)
+	optionsFactory OIDCClientOptions
 }
 
 func oidcLoginCommandRealDeps() oidcLoginCommandDeps {
@@ -71,6 +71,7 @@ func oidcLoginCommandRealDeps() oidcLoginCommandDeps {
 		exchangeToken: func(ctx context.Context, client *conciergeclient.Client, token string) (*clientauthv1beta1.ExecCredential, error) {
 			return client.ExchangeToken(ctx, token)
 		},
+		optionsFactory: &clientOptions{},
 	}
 }
 
@@ -140,14 +141,23 @@ func oidcLoginCommand(deps oidcLoginCommandDeps) *cobra.Command {
 	cmd.Flags().StringVar(&flags.conciergeAPIGroupSuffix, "concierge-api-group-suffix", groupsuffix.PinnipedDefaultSuffix, "Concierge API group suffix")
 	cmd.Flags().StringVar(&flags.credentialCachePath, "credential-cache", filepath.Join(mustGetConfigDir(), "credentials.yaml"), "Path to cluster-specific credentials cache (\"\" disables the cache)")
 	cmd.Flags().StringVar(&flags.upstreamIdentityProviderName, "upstream-identity-provider-name", "", "The name of the upstream identity provider used during login with a Supervisor")
-	cmd.Flags().StringVar(&flags.upstreamIdentityProviderType, "upstream-identity-provider-type", idpdiscoveryv1alpha1.IDPTypeOIDC.String(), fmt.Sprintf("The type of the upstream identity provider used during login with a Supervisor (e.g. '%s', '%s', '%s')", idpdiscoveryv1alpha1.IDPTypeOIDC, idpdiscoveryv1alpha1.IDPTypeLDAP, idpdiscoveryv1alpha1.IDPTypeActiveDirectory))
+	cmd.Flags().StringVar(&flags.upstreamIdentityProviderType,
+		"upstream-identity-provider-type",
+		idpdiscoveryv1alpha1.IDPTypeOIDC.String(),
+		fmt.Sprintf(
+			"The type of the upstream identity provider used during login with a Supervisor (e.g. '%s', '%s', '%s', '%s')",
+			idpdiscoveryv1alpha1.IDPTypeOIDC,
+			idpdiscoveryv1alpha1.IDPTypeLDAP,
+			idpdiscoveryv1alpha1.IDPTypeActiveDirectory,
+			idpdiscoveryv1alpha1.IDPTypeGitHub,
+		))
 	cmd.Flags().StringVar(&flags.upstreamIdentityProviderFlow, "upstream-identity-provider-flow", "", fmt.Sprintf("The type of client flow to use with the upstream identity provider during login with a Supervisor (e.g. '%s', '%s')", idpdiscoveryv1alpha1.IDPFlowBrowserAuthcode, idpdiscoveryv1alpha1.IDPFlowCLIPassword))
 
 	// --skip-listen is mainly needed for testing. We'll leave it hidden until we have a non-testing use case.
 	mustMarkHidden(cmd, "skip-listen")
 	mustMarkHidden(cmd, "debug-session-cache")
 	mustMarkRequired(cmd, "issuer")
-	cmd.RunE = func(cmd *cobra.Command, args []string) error { return runOIDCLogin(cmd, deps, flags) }
+	cmd.RunE = func(cmd *cobra.Command, _args []string) error { return runOIDCLogin(cmd, deps, flags) }
 
 	mustMarkDeprecated(cmd, "concierge-namespace", "not needed anymore")
 	mustMarkHidden(cmd, "concierge-namespace")
@@ -175,39 +185,37 @@ func runOIDCLogin(cmd *cobra.Command, deps oidcLoginCommandDeps, flags oidcLogin
 
 	// Initialize the login handler.
 	opts := []oidcclient.Option{
-		oidcclient.WithContext(cmd.Context()),
-		oidcclient.WithLogger(plog.Logr()), //nolint:staticcheck // old code with lots of log statements
-		oidcclient.WithScopes(flags.scopes),
-		oidcclient.WithSessionCache(sessionCache),
+		deps.optionsFactory.WithContext(cmd.Context()),
+		deps.optionsFactory.WithLogger(plog.Logr()), //nolint:staticcheck // old code with lots of log statements
+		deps.optionsFactory.WithScopes(flags.scopes),
+		deps.optionsFactory.WithSessionCache(sessionCache),
 	}
 
 	skipPrintLoginURL, _ := deps.lookupEnv(skipPrintLoginURLEnvVarName)
 	if skipPrintLoginURL == envVarTruthyValue {
-		opts = append(opts, oidcclient.WithSkipPrintLoginURL())
+		opts = append(opts, deps.optionsFactory.WithSkipPrintLoginURL())
 	}
 
 	if flags.listenPort != 0 {
-		opts = append(opts, oidcclient.WithListenPort(flags.listenPort))
+		opts = append(opts, deps.optionsFactory.WithListenPort(flags.listenPort))
 	}
 
 	if flags.requestAudience != "" {
-		opts = append(opts, oidcclient.WithRequestAudience(flags.requestAudience))
+		opts = append(opts, deps.optionsFactory.WithRequestAudience(flags.requestAudience))
 	}
 
 	if flags.upstreamIdentityProviderName != "" {
-		opts = append(opts, oidcclient.WithUpstreamIdentityProvider(
+		opts = append(opts, deps.optionsFactory.WithUpstreamIdentityProvider(
 			flags.upstreamIdentityProviderName, flags.upstreamIdentityProviderType))
 	}
 
-	flowOpts, err := flowOptions(
-		idpdiscoveryv1alpha1.IDPType(flags.upstreamIdentityProviderType),
-		idpdiscoveryv1alpha1.IDPFlow(flags.upstreamIdentityProviderFlow),
-		deps,
-	)
-	if err != nil {
-		return err
+	requestedFlow, flowSource := idpdiscoveryv1alpha1.IDPFlow(flags.upstreamIdentityProviderFlow), "--upstream-identity-provider-flow"
+	if flowOverride, hasFlowOverride := deps.lookupEnv(upstreamIdentityProviderFlowEnvVarName); hasFlowOverride {
+		requestedFlow, flowSource = idpdiscoveryv1alpha1.IDPFlow(flowOverride), upstreamIdentityProviderFlowEnvVarName
+	}
+	if requestedFlow != "" {
+		opts = append(opts, deps.optionsFactory.WithLoginFlow(requestedFlow, flowSource))
 	}
-	opts = append(opts, flowOpts...)
 
 	var concierge *conciergeclient.Client
 	if flags.conciergeEnabled {
@@ -225,12 +233,12 @@ func runOIDCLogin(cmd *cobra.Command, deps oidcLoginCommandDeps, flags oidcLogin
 
 	// --skip-browser skips opening the browser.
 	if flags.skipBrowser {
-		opts = append(opts, oidcclient.WithSkipBrowserOpen())
+		opts = append(opts, deps.optionsFactory.WithSkipBrowserOpen())
 	}
 
 	// --skip-listen skips starting the localhost callback listener.
 	if flags.skipListen {
-		opts = append(opts, oidcclient.WithSkipListen())
+		opts = append(opts, deps.optionsFactory.WithSkipListen())
 	}
 
 	if len(flags.caBundlePaths) > 0 || len(flags.caBundleData) > 0 {
@@ -238,7 +246,7 @@ func runOIDCLogin(cmd *cobra.Command, deps oidcLoginCommandDeps, flags oidcLogin
 		if err != nil {
 			return err
 		}
-		opts = append(opts, oidcclient.WithClient(client))
+		opts = append(opts, deps.optionsFactory.WithClient(client))
 	}
 	// Look up cached credentials based on a hash of all the CLI arguments and the cluster info.
 	cacheKey := struct {
@@ -288,60 +296,6 @@ func runOIDCLogin(cmd *cobra.Command, deps oidcLoginCommandDeps, flags oidcLogin
 	return json.NewEncoder(cmd.OutOrStdout()).Encode(cred)
 }
 
-func flowOptions(
-	requestedIDPType idpdiscoveryv1alpha1.IDPType,
-	requestedFlow idpdiscoveryv1alpha1.IDPFlow,
-	deps oidcLoginCommandDeps,
-) ([]oidcclient.Option, error) {
-	useCLIFlow := []oidcclient.Option{oidcclient.WithCLISendingCredentials()}
-
-	// If the env var is set to override the --upstream-identity-provider-type flag, then override it.
-	flowOverride, hasFlowOverride := deps.lookupEnv(upstreamIdentityProviderFlowEnvVarName)
-	flowSource := "--upstream-identity-provider-flow"
-	if hasFlowOverride {
-		requestedFlow = idpdiscoveryv1alpha1.IDPFlow(flowOverride)
-		flowSource = upstreamIdentityProviderFlowEnvVarName
-	}
-
-	switch requestedIDPType {
-	case idpdiscoveryv1alpha1.IDPTypeOIDC:
-		switch requestedFlow {
-		case idpdiscoveryv1alpha1.IDPFlowCLIPassword:
-			return useCLIFlow, nil
-		case idpdiscoveryv1alpha1.IDPFlowBrowserAuthcode, "":
-			return nil, nil // browser authcode flow is the default Option, so don't need to return an Option here
-		default:
-			return nil, fmt.Errorf(
-				"%s value not recognized for identity provider type %q: %s (supported values: %s)",
-				flowSource, requestedIDPType, requestedFlow,
-				strings.Join([]string{idpdiscoveryv1alpha1.IDPFlowBrowserAuthcode.String(), idpdiscoveryv1alpha1.IDPFlowCLIPassword.String()}, ", "))
-		}
-	case idpdiscoveryv1alpha1.IDPTypeLDAP, idpdiscoveryv1alpha1.IDPTypeActiveDirectory:
-		switch requestedFlow {
-		case idpdiscoveryv1alpha1.IDPFlowCLIPassword, "":
-			return useCLIFlow, nil
-		case idpdiscoveryv1alpha1.IDPFlowBrowserAuthcode:
-			return nil, nil // browser authcode flow is the default Option, so don't need to return an Option here
-		default:
-			return nil, fmt.Errorf(
-				"%s value not recognized for identity provider type %q: %s (supported values: %s)",
-				flowSource, requestedIDPType, requestedFlow,
-				strings.Join([]string{idpdiscoveryv1alpha1.IDPFlowCLIPassword.String(), idpdiscoveryv1alpha1.IDPFlowBrowserAuthcode.String()}, ", "))
-		}
-	default:
-		// Surprisingly cobra does not support this kind of flag validation. See https://github.com/spf13/pflag/issues/236
-		return nil, fmt.Errorf(
-			"--upstream-identity-provider-type value not recognized: %s (supported values: %s)",
-			requestedIDPType,
-			strings.Join([]string{
-				idpdiscoveryv1alpha1.IDPTypeOIDC.String(),
-				idpdiscoveryv1alpha1.IDPTypeLDAP.String(),
-				idpdiscoveryv1alpha1.IDPTypeActiveDirectory.String(),
-			}, ", "),
-		)
-	}
-}
-
 func makeClient(caBundlePaths []string, caBundleData []string) (*http.Client, error) {
 	pool := x509.NewCertPool()
 	for _, p := range caBundlePaths {

cmd/pinniped/cmd/login_oidc_test.go

@@ -14,12 +14,16 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	clientauthv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
 	clocktesting "k8s.io/utils/clock/testing"
 
+	idpdiscoveryv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idpdiscovery/v1alpha1"
+	oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	"go.pinniped.dev/internal/certauthority"
 	"go.pinniped.dev/internal/here"
+	"go.pinniped.dev/internal/mocks/mockoidcclientoptions"
 	"go.pinniped.dev/internal/plog"
 	"go.pinniped.dev/internal/testutil"
 	"go.pinniped.dev/pkg/conciergeclient"
@@ -42,6 +46,13 @@ func TestLoginOIDCCommand(t *testing.T) {
 	require.NoError(t, err)
 	nowStr := now.Local().Format(time.RFC1123)
 
+	defaultWantedOptions := func(f *mockoidcclientoptions.MockOIDCClientOptions) {
+		f.EXPECT().WithContext(gomock.Any())
+		f.EXPECT().WithLogger(gomock.Any())
+		f.EXPECT().WithScopes([]string{oidcapi.ScopeOfflineAccess, oidcapi.ScopeOpenID, oidcapi.ScopeRequestAudience, oidcapi.ScopeUsername, oidcapi.ScopeGroups})
+		f.EXPECT().WithSessionCache(gomock.Any())
+	}
+
 	tests := []struct {
 		name             string
 		args             []string
@@ -51,6 +62,7 @@ func TestLoginOIDCCommand(t *testing.T) {
 		wantError        bool
 		wantStdout       string
 		wantStderr       string
+		wantOptions      func(f *mockoidcclientoptions.MockOIDCClientOptions)
 		wantOptionsCount int
 		wantLogs         []string
 	}{
@@ -91,7 +103,7 @@ func TestLoginOIDCCommand(t *testing.T) {
 				      --skip-browser                             Skip opening the browser (just print the URL)
 					  --upstream-identity-provider-flow string   The type of client flow to use with the upstream identity provider during login with a Supervisor (e.g. 'browser_authcode', 'cli_password')
 					  --upstream-identity-provider-name string   The name of the upstream identity provider used during login with a Supervisor
-					  --upstream-identity-provider-type string   The type of the upstream identity provider used during login with a Supervisor (e.g. 'oidc', 'ldap', 'activedirectory') (default "oidc")
+					  --upstream-identity-provider-type string   The type of the upstream identity provider used during login with a Supervisor (e.g. 'oidc', 'ldap', 'activedirectory', 'github') (default "oidc")
 			`),
 		},
 		{
@@ -109,7 +121,8 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--issuer", "test-issuer",
 				"--enable-concierge",
 			},
-			wantError: true,
+			wantOptions: defaultWantedOptions,
+			wantError:   true,
 			wantStderr: here.Doc(`
 				Error: invalid Concierge parameters: endpoint must not be empty
 			`),
@@ -121,7 +134,8 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--issuer", "test-issuer",
 				"--ca-bundle", "./does/not/exist",
 			},
-			wantError: true,
+			wantOptions: defaultWantedOptions,
+			wantError:   true,
 			wantStderr: here.Doc(`
 				Error: could not read --ca-bundle: open ./does/not/exist: no such file or directory
 			`),
@@ -133,7 +147,8 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--issuer", "test-issuer",
 				"--ca-bundle-data", "invalid-base64",
 			},
-			wantError: true,
+			wantOptions: defaultWantedOptions,
+			wantError:   true,
 			wantStderr: here.Doc(`
 				Error: could not read --ca-bundle-data: illegal base64 data at input byte 7
 			`),
@@ -148,34 +163,12 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--concierge-authenticator-name", "test-authenticator",
 				"--concierge-endpoint", "https://127.0.0.1:1234/",
 			},
-			wantError: true,
+			wantOptions: defaultWantedOptions,
+			wantError:   true,
 			wantStderr: here.Doc(`
 				Error: invalid Concierge parameters: invalid API group suffix: a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')
 			`),
 		},
-		{
-			name: "invalid upstream type is an error",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--upstream-identity-provider-type", "invalid",
-			},
-			wantError: true,
-			wantStderr: here.Doc(`
-				Error: --upstream-identity-provider-type value not recognized: invalid (supported values: oidc, ldap, activedirectory)
-			`),
-		},
-		{
-			name: "invalid upstream type when flow override env var is used is still an error",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--upstream-identity-provider-type", "invalid",
-			},
-			env:       map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "browser_authcode"},
-			wantError: true,
-			wantStderr: here.Doc(`
-				Error: --upstream-identity-provider-type value not recognized: invalid (supported values: oidc, ldap, activedirectory)
-			`),
-		},
 		{
 			name: "oidc upstream type with default flow is allowed",
 			args: []string{
@@ -184,6 +177,7 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--upstream-identity-provider-type", "oidc",
 				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
 			},
+			wantOptions:      defaultWantedOptions,
 			wantOptionsCount: 4,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
 		},
@@ -195,269 +189,45 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--upstream-identity-provider-type", "oidc",
 				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
 			},
-			env:              map[string]string{"PINNIPED_SKIP_PRINT_LOGIN_URL": "true"},
+			env: map[string]string{"PINNIPED_SKIP_PRINT_LOGIN_URL": "true"},
+			wantOptions: func(f *mockoidcclientoptions.MockOIDCClientOptions) {
+				defaultWantedOptions(f)
+				f.EXPECT().WithSkipPrintLoginURL()
+			},
 			wantOptionsCount: 5,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
 		},
 		{
-			name: "oidc upstream type with CLI flow is allowed",
+			name: "--upstream-identity-provider-flow adds an option",
 			args: []string{
 				"--issuer", "test-issuer",
 				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "oidc",
 				"--upstream-identity-provider-flow", "cli_password",
 				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
 			},
-			wantOptionsCount: 5,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "oidc upstream type with browser flow is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "oidc",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			wantOptionsCount: 4,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "oidc upstream type with CLI flow in flow override env var is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "oidc",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:              map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "cli_password"},
-			wantOptionsCount: 5,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "oidc upstream type with with browser flow in flow override env var is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "oidc",
-				"--upstream-identity-provider-flow", "cli_password",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:              map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "browser_authcode"},
-			wantOptionsCount: 4,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "oidc upstream type with unsupported flow is an error",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "oidc",
-				"--upstream-identity-provider-flow", "foobar",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			wantError: true,
-			wantStderr: here.Doc(`
-				Error: --upstream-identity-provider-flow value not recognized for identity provider type "oidc": foobar (supported values: browser_authcode, cli_password)
-			`),
-		},
-		{
-			name: "oidc upstream type with unsupported flow in flow override env var is an error",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "oidc",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:       map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "foo"},
-			wantError: true,
-			wantStderr: here.Doc(`
-				Error: PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW value not recognized for identity provider type "oidc": foo (supported values: browser_authcode, cli_password)
-			`),
-		},
-		{
-			name: "ldap upstream type with default flow is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "ldap",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
+			wantOptions: func(f *mockoidcclientoptions.MockOIDCClientOptions) {
+				defaultWantedOptions(f)
+				f.EXPECT().WithLoginFlow(idpdiscoveryv1alpha1.IDPFlowCLIPassword, "--upstream-identity-provider-flow")
 			},
 			wantOptionsCount: 5,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
 		},
 		{
-			name: "activedirectory upstream type with default flow is allowed",
+			name: "PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW adds an option that overrides --upstream-identity-provider-flow",
 			args: []string{
 				"--issuer", "test-issuer",
 				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "activedirectory",
+				"--upstream-identity-provider-flow", "ignored-value-from-param",
 				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
 			},
+			env: map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "actual-value-from-env"},
+			wantOptions: func(f *mockoidcclientoptions.MockOIDCClientOptions) {
+				defaultWantedOptions(f)
+				f.EXPECT().WithLoginFlow(idpdiscoveryv1alpha1.IDPFlow("actual-value-from-env"), "PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW")
+			},
 			wantOptionsCount: 5,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
 		},
-		{
-			name: "ldap upstream type with CLI flow is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "ldap",
-				"--upstream-identity-provider-flow", "cli_password",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			wantOptionsCount: 5,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "ldap upstream type with browser_authcode flow is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "ldap",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			wantOptionsCount: 4,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "ldap upstream type with CLI flow in flow override env var is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "ldap",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:              map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "cli_password"},
-			wantOptionsCount: 5,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "ldap upstream type with browser_authcode flow in flow override env var is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "ldap",
-				"--upstream-identity-provider-flow", "cli_password",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:              map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "browser_authcode"},
-			wantOptionsCount: 4,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "ldap upstream type with unsupported flow is an error",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "ldap",
-				"--upstream-identity-provider-flow", "foo",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			wantError: true,
-			wantStderr: here.Doc(`
-				Error: --upstream-identity-provider-flow value not recognized for identity provider type "ldap": foo (supported values: cli_password, browser_authcode)
-			`),
-		},
-		{
-			name: "ldap upstream type with unsupported flow in flow override env var is an error",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "ldap",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:       map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "foo"},
-			wantError: true,
-			wantStderr: here.Doc(`
-				Error: PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW value not recognized for identity provider type "ldap": foo (supported values: cli_password, browser_authcode)
-			`),
-		},
-		{
-			name: "active directory upstream type with CLI flow is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "activedirectory",
-				"--upstream-identity-provider-flow", "cli_password",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			wantOptionsCount: 5,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "active directory upstream type with browser_authcode is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "activedirectory",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			wantOptionsCount: 4,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "active directory upstream type with CLI flow in flow override env var is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "activedirectory",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:              map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "cli_password"},
-			wantOptionsCount: 5,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "active directory upstream type with browser_authcode in flow override env var is allowed",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "activedirectory",
-				"--upstream-identity-provider-flow", "cli_password",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:              map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "browser_authcode"},
-			wantOptionsCount: 4,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
-		},
-		{
-			name: "active directory upstream type with unsupported flow is an error",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "activedirectory",
-				"--upstream-identity-provider-flow", "foo",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			wantError: true,
-			wantStderr: here.Doc(`
-				Error: --upstream-identity-provider-flow value not recognized for identity provider type "activedirectory": foo (supported values: cli_password, browser_authcode)
-			`),
-		},
-		{
-			name: "active directory upstream type with unsupported flow in flow override env var is an error",
-			args: []string{
-				"--issuer", "test-issuer",
-				"--client-id", "test-client-id",
-				"--upstream-identity-provider-type", "activedirectory",
-				"--upstream-identity-provider-flow", "browser_authcode",
-				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
-			},
-			env:       map[string]string{"PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW": "foo"},
-			wantError: true,
-			wantStderr: here.Doc(`
-				Error: PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW value not recognized for identity provider type "activedirectory": foo (supported values: cli_password, browser_authcode)
-			`),
-		},
 		{
 			name: "login error",
 			args: []string{
@@ -466,6 +236,7 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
 			},
 			loginErr:         fmt.Errorf("some login error"),
+			wantOptions:      defaultWantedOptions,
 			wantOptionsCount: 4,
 			wantError:        true,
 			wantStderr: here.Doc(`
@@ -484,6 +255,7 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
 			},
 			conciergeErr:     fmt.Errorf("some concierge error"),
+			wantOptions:      defaultWantedOptions,
 			wantOptionsCount: 4,
 			wantError:        true,
 			wantStderr: here.Doc(`
@@ -498,11 +270,12 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--credential-cache", "", // must specify --credential-cache or else the cache file on disk causes test pollution
 			},
 			env:              map[string]string{"PINNIPED_DEBUG": "true"},
+			wantOptions:      defaultWantedOptions,
 			wantOptionsCount: 4,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
 			wantLogs: []string{
-				nowStr + `  pinniped-login  cmd/login_oidc.go:260  Performing OIDC login  {"issuer": "test-issuer", "client id": "test-client-id"}`,
-				nowStr + `  pinniped-login  cmd/login_oidc.go:280  No concierge configured, skipping token credential exchange`,
+				nowStr + `  pinniped-login  cmd/login_oidc.go:268  Performing OIDC login  {"issuer": "test-issuer", "client id": "test-client-id"}`,
+				nowStr + `  pinniped-login  cmd/login_oidc.go:288  No concierge configured, skipping token credential exchange`,
 			},
 		},
 		{
@@ -526,24 +299,45 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--credential-cache", t.TempDir() + "/credentials.yaml", // must specify --credential-cache or else the cache file on disk causes test pollution
 				"--upstream-identity-provider-name", "some-upstream-name",
 				"--upstream-identity-provider-type", "ldap",
+				"--upstream-identity-provider-flow", "some-flow-type",
+			},
+			env: map[string]string{"PINNIPED_DEBUG": "true", "PINNIPED_SKIP_PRINT_LOGIN_URL": "true"},
+			wantOptions: func(f *mockoidcclientoptions.MockOIDCClientOptions) {
+				f.EXPECT().WithContext(gomock.Any())
+				f.EXPECT().WithLogger(gomock.Any())
+				f.EXPECT().WithScopes([]string{oidcapi.ScopeOfflineAccess, oidcapi.ScopeOpenID, oidcapi.ScopeRequestAudience, oidcapi.ScopeUsername, oidcapi.ScopeGroups})
+				f.EXPECT().WithSessionCache(gomock.Any())
+				f.EXPECT().WithListenPort(uint16(1234))
+				f.EXPECT().WithSkipBrowserOpen()
+				f.EXPECT().WithSkipListen()
+				f.EXPECT().WithSkipPrintLoginURL()
+				f.EXPECT().WithClient(gomock.Any())
+				f.EXPECT().WithRequestAudience("cluster-1234")
+				f.EXPECT().WithLoginFlow(idpdiscoveryv1alpha1.IDPFlow("some-flow-type"), "--upstream-identity-provider-flow")
+				f.EXPECT().WithUpstreamIdentityProvider("some-upstream-name", "ldap")
 			},
-			env:              map[string]string{"PINNIPED_DEBUG": "true", "PINNIPED_SKIP_PRINT_LOGIN_URL": "true"},
 			wantOptionsCount: 12,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"token":"exchanged-token"}}` + "\n",
 			wantLogs: []string{
-				nowStr + `  pinniped-login  cmd/login_oidc.go:260  Performing OIDC login  {"issuer": "test-issuer", "client id": "test-client-id"}`,
-				nowStr + `  pinniped-login  cmd/login_oidc.go:270  Exchanging token for cluster credential  {"endpoint": "https://127.0.0.1:1234/", "authenticator type": "webhook", "authenticator name": "test-authenticator"}`,
-				nowStr + `  pinniped-login  cmd/login_oidc.go:278  Successfully exchanged token for cluster credential.`,
-				nowStr + `  pinniped-login  cmd/login_oidc.go:285  caching cluster credential for future use.`,
+				nowStr + `  pinniped-login  cmd/login_oidc.go:268  Performing OIDC login  {"issuer": "test-issuer", "client id": "test-client-id"}`,
+				nowStr + `  pinniped-login  cmd/login_oidc.go:278  Exchanging token for cluster credential  {"endpoint": "https://127.0.0.1:1234/", "authenticator type": "webhook", "authenticator name": "test-authenticator"}`,
+				nowStr + `  pinniped-login  cmd/login_oidc.go:286  Successfully exchanged token for cluster credential.`,
+				nowStr + `  pinniped-login  cmd/login_oidc.go:293  caching cluster credential for future use.`,
 			},
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var buf bytes.Buffer
 			ctx := plog.AddZapOverridesToContext(context.Background(), t, &buf, nil, clocktesting.NewFakeClock(now))
 
+			ctrl := gomock.NewController(t)
+			t.Cleanup(ctrl.Finish)
+			optionsFactory := mockoidcclientoptions.NewMockOIDCClientOptions(ctrl)
+			if tt.wantOptions != nil {
+				tt.wantOptions(optionsFactory)
+			}
+
 			var gotOptions []oidcclient.Option
 			cmd := oidcLoginCommand(oidcLoginCommandDeps{
 				lookupEnv: func(s string) (string, bool) {
@@ -579,6 +373,7 @@ func TestLoginOIDCCommand(t *testing.T) {
 						},
 					}, nil
 				},
+				optionsFactory: optionsFactory,
 			})
 			require.NotNil(t, cmd)
 

cmd/pinniped/cmd/login_static.go

@@ -86,7 +86,7 @@ func staticLoginCommand(deps staticLoginDeps) *cobra.Command {
 	cmd.Flags().StringVar(&flags.conciergeAPIGroupSuffix, "concierge-api-group-suffix", groupsuffix.PinnipedDefaultSuffix, "Concierge API group suffix")
 	cmd.Flags().StringVar(&flags.credentialCachePath, "credential-cache", filepath.Join(mustGetConfigDir(), "credentials.yaml"), "Path to cluster-specific credentials cache (\"\" disables the cache)")
 
-	cmd.RunE = func(cmd *cobra.Command, args []string) error { return runStaticLogin(cmd, deps, flags) }
+	cmd.RunE = func(cmd *cobra.Command, _args []string) error { return runStaticLogin(cmd, deps, flags) }
 
 	mustMarkDeprecated(cmd, "concierge-namespace", "not needed anymore")
 	mustMarkHidden(cmd, "concierge-namespace")

cmd/pinniped/cmd/login_static_test.go

@@ -175,7 +175,6 @@ func TestLoginStaticCommand(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var buf bytes.Buffer
 			ctx := plog.AddZapOverridesToContext(context.Background(), t, &buf, nil, clocktesting.NewFakeClock(now))

cmd/pinniped/cmd/oidc_client_options.go

@@ -0,0 +1,85 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-logr/logr"
+
+	"go.pinniped.dev/generated/latest/apis/supervisor/idpdiscovery/v1alpha1"
+	"go.pinniped.dev/pkg/oidcclient"
+)
+
+// OIDCClientOptions is an interface that wraps the creation of Options for the purpose of making them
+// more friendly to unit tests. Because the Option type refers to a private struct type, it is hard
+// to create mocks for them in tests of other packages. This provides a seam that can be mocked.
+type OIDCClientOptions interface {
+	WithContext(ctx context.Context) oidcclient.Option
+	WithLogger(logger logr.Logger) oidcclient.Option
+	WithListenPort(port uint16) oidcclient.Option
+	WithSkipBrowserOpen() oidcclient.Option
+	WithSkipListen() oidcclient.Option
+	WithSkipPrintLoginURL() oidcclient.Option
+	WithSessionCache(cache oidcclient.SessionCache) oidcclient.Option
+	WithClient(httpClient *http.Client) oidcclient.Option
+	WithScopes(scopes []string) oidcclient.Option
+	WithRequestAudience(audience string) oidcclient.Option
+	WithLoginFlow(loginFlow v1alpha1.IDPFlow, flowSource string) oidcclient.Option
+	WithUpstreamIdentityProvider(upstreamName, upstreamType string) oidcclient.Option
+}
+
+// clientOptions implements OIDCClientOptions for production use.
+type clientOptions struct{}
+
+var _ OIDCClientOptions = (*clientOptions)(nil)
+
+func (o *clientOptions) WithContext(ctx context.Context) oidcclient.Option {
+	return oidcclient.WithContext(ctx)
+}
+
+func (o *clientOptions) WithLogger(logger logr.Logger) oidcclient.Option {
+	return oidcclient.WithLogger(logger)
+}
+
+func (o *clientOptions) WithListenPort(port uint16) oidcclient.Option {
+	return oidcclient.WithListenPort(port)
+}
+
+func (o *clientOptions) WithSkipBrowserOpen() oidcclient.Option {
+	return oidcclient.WithSkipBrowserOpen()
+}
+
+func (o *clientOptions) WithSkipListen() oidcclient.Option {
+	return oidcclient.WithSkipListen()
+}
+
+func (o *clientOptions) WithSkipPrintLoginURL() oidcclient.Option {
+	return oidcclient.WithSkipPrintLoginURL()
+}
+
+func (o *clientOptions) WithSessionCache(cache oidcclient.SessionCache) oidcclient.Option {
+	return oidcclient.WithSessionCache(cache)
+}
+
+func (o *clientOptions) WithClient(httpClient *http.Client) oidcclient.Option {
+	return oidcclient.WithClient(httpClient)
+}
+
+func (o *clientOptions) WithScopes(scopes []string) oidcclient.Option {
+	return oidcclient.WithScopes(scopes)
+}
+
+func (o *clientOptions) WithRequestAudience(audience string) oidcclient.Option {
+	return oidcclient.WithRequestAudience(audience)
+}
+
+func (o *clientOptions) WithLoginFlow(loginFlow v1alpha1.IDPFlow, flowSource string) oidcclient.Option {
+	return oidcclient.WithLoginFlow(loginFlow, flowSource)
+}
+
+func (o *clientOptions) WithUpstreamIdentityProvider(upstreamName, upstreamType string) oidcclient.Option {
+	return oidcclient.WithUpstreamIdentityProvider(upstreamName, upstreamType)
+}

cmd/pinniped/cmd/version_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
@@ -126,7 +126,6 @@ func TestNewVersionCmd(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			if tt.getBuildInfo != nil {
 				getBuildInfo = tt.getBuildInfo

cmd/pinniped/cmd/whoami_test.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
@@ -107,8 +107,7 @@ func TestWhoami(t *testing.T) {
 				Current user info:
 
 				Username: some-username
-				Groups: 
-			`),
+				Groups:` + " \n"), // Linters and codeformatters don't like the extra space after "Groups:" and before the newline
 		},
 		{
 			name: "json output",
@@ -280,7 +279,6 @@ func TestWhoami(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			getClientset := func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, error) {
 				if test.gettingClientsetErr != nil {

deploy/concierge/authentication.concierge.pinniped.dev_jwtauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: jwtauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev

deploy/concierge/authentication.concierge.pinniped.dev_webhookauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhookauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev

deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: credentialissuers.config.concierge.pinniped.dev
 spec:
   group: config.concierge.pinniped.dev

deploy/supervisor/config.supervisor.pinniped.dev_federationdomains.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: federationdomains.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev
@@ -421,10 +421,15 @@ spec:
                       exist.
                     properties:
                       name:
+                        default: ""
                         description: |-
                           Name of the referent.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
                           TODO: Add other useful fields. apiVersion, kind, uid?
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic
@@ -434,10 +439,15 @@ spec:
                       encrypting state parameters is stored.
                     properties:
                       name:
+                        default: ""
                         description: |-
                           Name of the referent.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
                           TODO: Add other useful fields. apiVersion, kind, uid?
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic
@@ -447,10 +457,15 @@ spec:
                       signing state parameters is stored.
                     properties:
                       name:
+                        default: ""
                         description: |-
                           Name of the referent.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
                           TODO: Add other useful fields. apiVersion, kind, uid?
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic
@@ -460,10 +475,15 @@ spec:
                       signing tokens is stored.
                     properties:
                       name:
+                        default: ""
                         description: |-
                           Name of the referent.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
                           TODO: Add other useful fields. apiVersion, kind, uid?
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic

deploy/supervisor/config.supervisor.pinniped.dev_oidcclients.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: oidcclients.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev

deploy/supervisor/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: activedirectoryidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

deploy/supervisor/idp.supervisor.pinniped.dev_githubidentityproviders.yaml

@@ -0,0 +1,326 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.15.0
+  name: githubidentityproviders.idp.supervisor.pinniped.dev
+spec:
+  group: idp.supervisor.pinniped.dev
+  names:
+    categories:
+    - pinniped
+    - pinniped-idp
+    - pinniped-idps
+    kind: GitHubIdentityProvider
+    listKind: GitHubIdentityProviderList
+    plural: githubidentityproviders
+    singular: githubidentityprovider
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.githubAPI.host
+      name: Host
+      type: string
+    - jsonPath: .status.phase
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+          This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+
+
+          Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+          as OIDCClients.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec for configuring the identity provider.
+            properties:
+              allowAuthentication:
+                description: AllowAuthentication allows customization of who can authenticate
+                  using this IDP and how.
+                properties:
+                  organizations:
+                    description: Organizations allows customization of which organizations
+                      can authenticate using this IDP.
+                    properties:
+                      allowed:
+                        description: |-
+                          Allowed, when specified, indicates that only users with membership in at least one of the listed
+                          GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include
+                          teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
+                          provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
+
+
+                          The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
+                          otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
+                          within that organization.
+
+
+                          If no organizations are listed, you must set organizations: AllGitHubUsers.
+                        items:
+                          type: string
+                        maxItems: 64
+                        type: array
+                        x-kubernetes-list-type: set
+                      policy:
+                        default: OnlyUsersFromAllowedOrganizations
+                        description: |-
+                          Policy must be set to "AllGitHubUsers" if allowed is empty.
+
+
+                          This field only exists to ensure that Pinniped administrators are aware that an empty list of
+                          allowedOrganizations means all GitHub users are allowed to log in.
+                        enum:
+                        - OnlyUsersFromAllowedOrganizations
+                        - AllGitHubUsers
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: spec.allowAuthentication.organizations.policy must
+                        be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed
+                        has organizations listed
+                      rule: '!(has(self.allowed) && size(self.allowed) > 0 && self.policy
+                        == ''AllGitHubUsers'')'
+                    - message: spec.allowAuthentication.organizations.policy must
+                        be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed
+                        is empty
+                      rule: '!((!has(self.allowed) || size(self.allowed) == 0) &&
+                        self.policy == ''OnlyUsersFromAllowedOrganizations'')'
+                required:
+                - organizations
+                type: object
+              claims:
+                default: {}
+                description: Claims allows customization of the username and groups
+                  claims.
+                properties:
+                  groups:
+                    default: slug
+                    description: |-
+                      Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
+
+
+                      Can be either "name" or "slug". Defaults to "slug".
+
+
+                      GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
+
+
+                      GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
+
+
+                      Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
+                      forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
+                      or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
+                      the team name or slug.
+
+
+                      If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+                      FederationDomain to further customize how these group names are presented to Kubernetes.
+
+
+                      See the response schema for
+                      [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+                    enum:
+                    - name
+                    - slug
+                    type: string
+                  username:
+                    default: login:id
+                    description: |-
+                      Username configures which property of the GitHub user record shall determine the username in Kubernetes.
+
+
+                      Can be either "id", "login", or "login:id". Defaults to "login:id".
+
+
+                      GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
+                      and may not start or end with hyphens. GitHub users are allowed to change their login name,
+                      although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
+                      then a second user might change their name from "baz" to "foo" in order to take the old
+                      username of the first user. For this reason, it is not as safe to make authorization decisions
+                      based only on the user's login attribute.
+
+
+                      If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+                      FederationDomain to further customize how these usernames are presented to Kubernetes.
+
+
+                      Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
+                      unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
+                      from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
+                      choice to concatenate the two values.
+
+
+                      See the response schema for
+                      [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+                    enum:
+                    - id
+                    - login
+                    - login:id
+                    type: string
+                type: object
+              client:
+                description: Client identifies the secret with credentials for a GitHub
+                  App or GitHub OAuth2 App (a GitHub client).
+                properties:
+                  secretName:
+                    description: |-
+                      SecretName contains the name of a namespace-local Secret object that provides the clientID and
+                      clientSecret for an GitHub App or GitHub OAuth2 client.
+
+
+                      This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
+                    minLength: 1
+                    type: string
+                required:
+                - secretName
+                type: object
+              githubAPI:
+                default: {}
+                description: GitHubAPI allows configuration for GitHub Enterprise
+                  Server
+                properties:
+                  host:
+                    default: github.com
+                    description: |-
+                      Host is required only for GitHub Enterprise Server.
+                      Defaults to using GitHub's public API ("github.com").
+                      Do not specify a protocol or scheme since "https://" will always be used.
+                      Port is optional. Do not specify a path, query, fragment, or userinfo.
+                      Only domain name or IP address, subdomains (optional), and port (optional).
+                      IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
+                      in square brackets. Example: "[::1]:443".
+                    minLength: 1
+                    type: string
+                  tls:
+                    description: TLS configuration for GitHub Enterprise Server.
+                    properties:
+                      certificateAuthorityData:
+                        description: X.509 Certificate Authority (base64-encoded PEM
+                          bundle). If omitted, a default set of system roots will
+                          be trusted.
+                        type: string
+                    type: object
+                type: object
+            required:
+            - allowAuthentication
+            - client
+            type: object
+          status:
+            description: Status of the identity provider.
+            properties:
+              conditions:
+                description: Conditions represents the observations of an identity
+                  provider's current state.
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource.\n---\nThis struct is intended for
+                    direct use as an array at the field path .status.conditions.  For
+                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
+                    observations of a foo's current state.\n\t    // Known .status.conditions.type
+                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
+                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
+                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
+                    \   // other fields\n\t}"
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: |-
+                        type of condition in CamelCase or in foo.example.com/CamelCase.
+                        ---
+                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+                        useful (see .node.status.conditions), the ability to deconflict is important.
+                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              phase:
+                default: Pending
+                description: Phase summarizes the overall status of the GitHubIdentityProvider.
+                enum:
+                - Pending
+                - Ready
+                - Error
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

deploy/supervisor/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ldapidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

deploy/supervisor/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: oidcidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

deploy/supervisor/rbac.yaml

@@ -56,6 +56,14 @@ rules:
       - #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
     resources: [activedirectoryidentityproviders/status]
     verbs: [get, patch, update]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
+    resources: [githubidentityproviders]
+    verbs: [get, list, watch]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
+    resources: [githubidentityproviders/status]
+    verbs: [get, patch, update]
     #! We want to be able to read pods/replicasets/deployment so we can learn who our deployment is to set
     #! as an owner reference.
   - apiGroups: [""]

deploy/supervisor/z0_crd_overlay.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:overlay", "overlay")
@@ -41,6 +41,15 @@ metadata:
 spec:
   group: #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
 
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"githubidentityproviders.idp.supervisor.pinniped.dev"}}), expects=1
+---
+metadata:
+  #@overlay/match missing_ok=True
+  labels: #@ labels()
+  name: #@ pinnipedDevAPIGroupWithPrefix("githubidentityproviders.idp.supervisor")
+spec:
+  group: #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
+
 #@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"oidcclients.config.supervisor.pinniped.dev"}}), expects=1
 ---
 metadata:

generated/1.24/README.adoc

@@ -1645,6 +1645,285 @@ Optional, when empty this defaults to "objectGUID". +
 |===
 
 
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubapiconfig"]
+==== GitHubAPIConfig 
+
+GitHubAPIConfig allows configuration for GitHub Enterprise Server
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`host`* __string__ | Host is required only for GitHub Enterprise Server. +
+Defaults to using GitHub's public API ("github.com"). +
+Do not specify a protocol or scheme since "https://" will always be used. +
+Port is optional. Do not specify a path, query, fragment, or userinfo. +
+Only domain name or IP address, subdomains (optional), and port (optional). +
+IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address +
+in square brackets. Example: "[::1]:443". +
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration for GitHub Enterprise Server. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec"]
+==== GitHubAllowAuthenticationSpec 
+
+GitHubAllowAuthenticationSpec allows customization of who can authenticate using this IDP and how.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`organizations`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githuborganizationsspec[$$GitHubOrganizationsSpec$$]__ | Organizations allows customization of which organizations can authenticate using this IDP. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githuballowedauthorganizationspolicy"]
+==== GitHubAllowedAuthOrganizationsPolicy (string) 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githuborganizationsspec[$$GitHubOrganizationsSpec$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubclaims"]
+==== GitHubClaims 
+
+GitHubClaims allows customization of the username and groups claims.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`username`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubusernameattribute[$$GitHubUsernameAttribute$$]__ | Username configures which property of the GitHub user record shall determine the username in Kubernetes. +
+
+
+Can be either "id", "login", or "login:id". Defaults to "login:id". +
+
+
+GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens, +
+and may not start or end with hyphens. GitHub users are allowed to change their login name, +
+although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar", +
+then a second user might change their name from "baz" to "foo" in order to take the old +
+username of the first user. For this reason, it is not as safe to make authorization decisions +
+based only on the user's login attribute. +
+
+
+If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's +
+FederationDomain to further customize how these usernames are presented to Kubernetes. +
+
+
+Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and +
+unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value +
+from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable +
+choice to concatenate the two values. +
+
+
+See the response schema for +
+[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user). +
+| *`groups`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubgroupnameattribute[$$GitHubGroupNameAttribute$$]__ | Groups configures which property of the GitHub team record shall determine the group names in Kubernetes. +
+
+
+Can be either "name" or "slug". Defaults to "slug". +
+
+
+GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!"). +
+
+
+GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins"). +
+
+
+Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a +
+forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters +
+or single hyphens, so the first forward slash `/` will be the separator between the organization login name and +
+the team name or slug. +
+
+
+If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's +
+FederationDomain to further customize how these group names are presented to Kubernetes. +
+
+
+See the response schema for +
+[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user). +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubclientspec"]
+==== GitHubClientSpec 
+
+GitHubClientSpec contains information about the GitHub client that this identity provider will use
+for web-based login flows.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and +
+clientSecret for an GitHub App or GitHub OAuth2 client. +
+
+
+This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret". +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubgroupnameattribute"]
+==== GitHubGroupNameAttribute (string) 
+
+GitHubGroupNameAttribute allows the user to specify which attribute from GitHub to use for the group
+names to present to Kubernetes. See the response schema for
+[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityprovider"]
+==== GitHubIdentityProvider 
+
+GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+
+
+Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+as OIDCClients.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderlist[$$GitHubIdentityProviderList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]__ | Spec for configuring the identity provider. +
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus[$$GitHubIdentityProviderStatus$$]__ | Status of the identity provider. +
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderphase"]
+==== GitHubIdentityProviderPhase (string) 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus[$$GitHubIdentityProviderStatus$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderspec"]
+==== GitHubIdentityProviderSpec 
+
+GitHubIdentityProviderSpec is the spec for configuring an GitHub identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityprovider[$$GitHubIdentityProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`githubAPI`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubapiconfig[$$GitHubAPIConfig$$]__ | GitHubAPI allows configuration for GitHub Enterprise Server +
+| *`claims`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]__ | Claims allows customization of the username and groups claims. +
+| *`allowAuthentication`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec[$$GitHubAllowAuthenticationSpec$$]__ | AllowAuthentication allows customization of who can authenticate using this IDP and how. +
+| *`client`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubclientspec[$$GitHubClientSpec$$]__ | Client identifies the secret with credentials for a GitHub App or GitHub OAuth2 App (a GitHub client). +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus"]
+==== GitHubIdentityProviderStatus 
+
+GitHubIdentityProviderStatus is the status of an GitHub identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityprovider[$$GitHubIdentityProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubidentityproviderphase[$$GitHubIdentityProviderPhase$$]__ | Phase summarizes the overall status of the GitHubIdentityProvider. +
+| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#condition-v1-meta[$$Condition$$] array__ | Conditions represents the observations of an identity provider's current state. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githuborganizationsspec"]
+==== GitHubOrganizationsSpec 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec[$$GitHubAllowAuthenticationSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`policy`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githuballowedauthorganizationspolicy[$$GitHubAllowedAuthOrganizationsPolicy$$]__ | Policy must be set to "AllGitHubUsers" if allowed is empty. +
+
+
+This field only exists to ensure that Pinniped administrators are aware that an empty list of +
+allowedOrganizations means all GitHub users are allowed to log in. +
+| *`allowed`* __string array__ | Allowed, when specified, indicates that only users with membership in at least one of the listed +
+GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include +
+teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be +
+provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP. +
+
+
+The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations, +
+otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams +
+within that organization. +
+
+
+If no organizations are listed, you must set organizations: AllGitHubUsers. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubusernameattribute"]
+==== GitHubUsernameAttribute (string) 
+
+GitHubUsernameAttribute allows the user to specify which attribute(s) from GitHub to use for the username to present
+to Kubernetes. See the response schema for
+[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]
+****
+
+
+
 [id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-ldapidentityprovider"]
 ==== LDAPIdentityProvider 
 
@@ -2108,11 +2387,12 @@ Parameter is a key/value pair which represents a parameter in an HTTP request.
 [id="{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-tlsspec"]
 ==== TLSSpec 
 
-Configuration for TLS parameters related to identity provider integration.
+TLSSpec provides TLS configuration for identity provider integration.
 
 .Appears In:
 ****
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec[$$ActiveDirectoryIdentityProviderSpec$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-githubapiconfig[$$GitHubAPIConfig$$]
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec[$$LDAPIdentityProviderSpec$$]
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
 ****

generated/1.24/apis/supervisor/idp/v1alpha1/register.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -36,6 +36,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&LDAPIdentityProviderList{},
 		&ActiveDirectoryIdentityProvider{},
 		&ActiveDirectoryIdentityProviderList{},
+		&GitHubIdentityProvider{},
+		&GitHubIdentityProviderList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

generated/1.24/apis/supervisor/idp/v1alpha1/types_githubidentityprovider.go

@@ -0,0 +1,256 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type GitHubIdentityProviderPhase string
+
+const (
+	// GitHubPhasePending is the default phase for newly-created GitHubIdentityProvider resources.
+	GitHubPhasePending GitHubIdentityProviderPhase = "Pending"
+
+	// GitHubPhaseReady is the phase for an GitHubIdentityProvider resource in a healthy state.
+	GitHubPhaseReady GitHubIdentityProviderPhase = "Ready"
+
+	// GitHubPhaseError is the phase for an GitHubIdentityProvider in an unhealthy state.
+	GitHubPhaseError GitHubIdentityProviderPhase = "Error"
+)
+
+type GitHubAllowedAuthOrganizationsPolicy string
+
+const (
+	// GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers means any GitHub user is allowed to log in using this identity
+	// provider, regardless of their organization membership or lack thereof.
+	GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers GitHubAllowedAuthOrganizationsPolicy = "AllGitHubUsers"
+
+	// GitHubAllowedAuthOrganizationsPolicyOnlyUsersFromAllowedOrganizations means only those users with membership in
+	// the listed GitHub organizations are allowed to log in.
+	GitHubAllowedAuthOrganizationsPolicyOnlyUsersFromAllowedOrganizations GitHubAllowedAuthOrganizationsPolicy = "OnlyUsersFromAllowedOrganizations"
+)
+
+// GitHubIdentityProviderStatus is the status of an GitHub identity provider.
+type GitHubIdentityProviderStatus struct {
+	// Phase summarizes the overall status of the GitHubIdentityProvider.
+	//
+	// +kubebuilder:default=Pending
+	// +kubebuilder:validation:Enum=Pending;Ready;Error
+	Phase GitHubIdentityProviderPhase `json:"phase,omitempty"`
+
+	// Conditions represents the observations of an identity provider's current state.
+	//
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+}
+
+// GitHubAPIConfig allows configuration for GitHub Enterprise Server
+type GitHubAPIConfig struct {
+	// Host is required only for GitHub Enterprise Server.
+	// Defaults to using GitHub's public API ("github.com").
+	// Do not specify a protocol or scheme since "https://" will always be used.
+	// Port is optional. Do not specify a path, query, fragment, or userinfo.
+	// Only domain name or IP address, subdomains (optional), and port (optional).
+	// IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
+	// in square brackets. Example: "[::1]:443".
+	//
+	// +kubebuilder:default="github.com"
+	// +kubebuilder:validation:MinLength=1
+	// +optional
+	Host *string `json:"host"`
+
+	// TLS configuration for GitHub Enterprise Server.
+	//
+	// +optional
+	TLS *TLSSpec `json:"tls,omitempty"`
+}
+
+// GitHubUsernameAttribute allows the user to specify which attribute(s) from GitHub to use for the username to present
+// to Kubernetes. See the response schema for
+// [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+type GitHubUsernameAttribute string
+
+const (
+	// GitHubUsernameID specifies using the `id` attribute from the GitHub user for the username to present to Kubernetes.
+	GitHubUsernameID GitHubUsernameAttribute = "id"
+
+	// GitHubUsernameLogin specifies using the `login` attribute from the GitHub user as the username to present to Kubernetes.
+	GitHubUsernameLogin GitHubUsernameAttribute = "login"
+
+	// GitHubUsernameLoginAndID specifies combining the `login` and `id` attributes from the GitHub user as the
+	// username to present to Kubernetes, separated by a colon. Example: "my-login:1234"
+	GitHubUsernameLoginAndID GitHubUsernameAttribute = "login:id"
+)
+
+// GitHubGroupNameAttribute allows the user to specify which attribute from GitHub to use for the group
+// names to present to Kubernetes. See the response schema for
+// [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+type GitHubGroupNameAttribute string
+
+const (
+	// GitHubUseTeamNameForGroupName specifies using the GitHub team's `name` attribute as the group name to present to Kubernetes.
+	GitHubUseTeamNameForGroupName GitHubGroupNameAttribute = "name"
+
+	// GitHubUseTeamSlugForGroupName specifies using the GitHub team's `slug` attribute as the group name to present to Kubernetes.
+	GitHubUseTeamSlugForGroupName GitHubGroupNameAttribute = "slug"
+)
+
+// GitHubClaims allows customization of the username and groups claims.
+type GitHubClaims struct {
+	// Username configures which property of the GitHub user record shall determine the username in Kubernetes.
+	//
+	// Can be either "id", "login", or "login:id". Defaults to "login:id".
+	//
+	// GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
+	// and may not start or end with hyphens. GitHub users are allowed to change their login name,
+	// although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
+	// then a second user might change their name from "baz" to "foo" in order to take the old
+	// username of the first user. For this reason, it is not as safe to make authorization decisions
+	// based only on the user's login attribute.
+	//
+	// If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+	// FederationDomain to further customize how these usernames are presented to Kubernetes.
+	//
+	// Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
+	// unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
+	// from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
+	// choice to concatenate the two values.
+	//
+	// See the response schema for
+	// [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+	//
+	// +kubebuilder:default="login:id"
+	// +kubebuilder:validation:Enum={"id","login","login:id"}
+	// +optional
+	Username *GitHubUsernameAttribute `json:"username"`
+
+	// Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
+	//
+	// Can be either "name" or "slug". Defaults to "slug".
+	//
+	// GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
+	//
+	// GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
+	//
+	// Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
+	// forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
+	// or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
+	// the team name or slug.
+	//
+	// If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+	// FederationDomain to further customize how these group names are presented to Kubernetes.
+	//
+	// See the response schema for
+	// [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+	//
+	// +kubebuilder:default=slug
+	// +kubebuilder:validation:Enum=name;slug
+	// +optional
+	Groups *GitHubGroupNameAttribute `json:"groups"`
+}
+
+// GitHubClientSpec contains information about the GitHub client that this identity provider will use
+// for web-based login flows.
+type GitHubClientSpec struct {
+	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
+	// clientSecret for an GitHub App or GitHub OAuth2 client.
+	//
+	// This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
+	//
+	// +kubebuilder:validation:MinLength=1
+	SecretName string `json:"secretName"`
+}
+
+type GitHubOrganizationsSpec struct {
+	// Policy must be set to "AllGitHubUsers" if allowed is empty.
+	//
+	// This field only exists to ensure that Pinniped administrators are aware that an empty list of
+	// allowedOrganizations means all GitHub users are allowed to log in.
+	//
+	// +kubebuilder:default=OnlyUsersFromAllowedOrganizations
+	// +kubebuilder:validation:Enum=OnlyUsersFromAllowedOrganizations;AllGitHubUsers
+	// +optional
+	Policy *GitHubAllowedAuthOrganizationsPolicy `json:"policy"`
+
+	// Allowed, when specified, indicates that only users with membership in at least one of the listed
+	// GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include
+	// teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
+	// provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
+	//
+	// The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
+	// otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
+	// within that organization.
+	//
+	// If no organizations are listed, you must set organizations: AllGitHubUsers.
+	//
+	// +kubebuilder:validation:MaxItems=64
+	// +listType=set
+	// +optional
+	Allowed []string `json:"allowed,omitempty"`
+}
+
+// GitHubAllowAuthenticationSpec allows customization of who can authenticate using this IDP and how.
+type GitHubAllowAuthenticationSpec struct {
+	// Organizations allows customization of which organizations can authenticate using this IDP.
+	// +kubebuilder:validation:XValidation:message="spec.allowAuthentication.organizations.policy must be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed has organizations listed",rule="!(has(self.allowed) && size(self.allowed) > 0 && self.policy == 'AllGitHubUsers')"
+	// +kubebuilder:validation:XValidation:message="spec.allowAuthentication.organizations.policy must be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed is empty",rule="!((!has(self.allowed) || size(self.allowed) == 0) && self.policy == 'OnlyUsersFromAllowedOrganizations')"
+	Organizations GitHubOrganizationsSpec `json:"organizations"`
+}
+
+// GitHubIdentityProviderSpec is the spec for configuring an GitHub identity provider.
+type GitHubIdentityProviderSpec struct {
+	// GitHubAPI allows configuration for GitHub Enterprise Server
+	//
+	// +kubebuilder:default={}
+	GitHubAPI GitHubAPIConfig `json:"githubAPI,omitempty"`
+
+	// Claims allows customization of the username and groups claims.
+	//
+	// +kubebuilder:default={}
+	Claims GitHubClaims `json:"claims,omitempty"`
+
+	// AllowAuthentication allows customization of who can authenticate using this IDP and how.
+	AllowAuthentication GitHubAllowAuthenticationSpec `json:"allowAuthentication"`
+
+	// Client identifies the secret with credentials for a GitHub App or GitHub OAuth2 App (a GitHub client).
+	Client GitHubClientSpec `json:"client"`
+}
+
+// GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+// This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+//
+// Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+// as OIDCClients.
+//
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=pinniped;pinniped-idp;pinniped-idps
+// +kubebuilder:printcolumn:name="Host",type=string,JSONPath=`.spec.githubAPI.host`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+// +kubebuilder:subresource:status
+type GitHubIdentityProvider struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec for configuring the identity provider.
+	Spec GitHubIdentityProviderSpec `json:"spec"`
+
+	// Status of the identity provider.
+	Status GitHubIdentityProviderStatus `json:"status,omitempty"`
+}
+
+// GitHubIdentityProviderList lists GitHubIdentityProvider objects.
+//
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type GitHubIdentityProviderList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []GitHubIdentityProvider `json:"items"`
+}

generated/1.24/apis/supervisor/idp/v1alpha1/types_tls.go

@@ -1,9 +1,9 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
 
-// Configuration for TLS parameters related to identity provider integration.
+// TLSSpec provides TLS configuration for identity provider integration.
 type TLSSpec struct {
 	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
 	// +optional

generated/1.24/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -203,6 +203,221 @@ func (in *ActiveDirectoryIdentityProviderUserSearchAttributes) DeepCopy() *Activ
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubAPIConfig) DeepCopyInto(out *GitHubAPIConfig) {
+	*out = *in
+	if in.Host != nil {
+		in, out := &in.Host, &out.Host
+		*out = new(string)
+		**out = **in
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSSpec)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubAPIConfig.
+func (in *GitHubAPIConfig) DeepCopy() *GitHubAPIConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubAPIConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubAllowAuthenticationSpec) DeepCopyInto(out *GitHubAllowAuthenticationSpec) {
+	*out = *in
+	in.Organizations.DeepCopyInto(&out.Organizations)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubAllowAuthenticationSpec.
+func (in *GitHubAllowAuthenticationSpec) DeepCopy() *GitHubAllowAuthenticationSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubAllowAuthenticationSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubClaims) DeepCopyInto(out *GitHubClaims) {
+	*out = *in
+	if in.Username != nil {
+		in, out := &in.Username, &out.Username
+		*out = new(GitHubUsernameAttribute)
+		**out = **in
+	}
+	if in.Groups != nil {
+		in, out := &in.Groups, &out.Groups
+		*out = new(GitHubGroupNameAttribute)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubClaims.
+func (in *GitHubClaims) DeepCopy() *GitHubClaims {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubClaims)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubClientSpec) DeepCopyInto(out *GitHubClientSpec) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubClientSpec.
+func (in *GitHubClientSpec) DeepCopy() *GitHubClientSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubClientSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProvider) DeepCopyInto(out *GitHubIdentityProvider) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProvider.
+func (in *GitHubIdentityProvider) DeepCopy() *GitHubIdentityProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GitHubIdentityProvider) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderList) DeepCopyInto(out *GitHubIdentityProviderList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]GitHubIdentityProvider, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderList.
+func (in *GitHubIdentityProviderList) DeepCopy() *GitHubIdentityProviderList {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GitHubIdentityProviderList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderSpec) DeepCopyInto(out *GitHubIdentityProviderSpec) {
+	*out = *in
+	in.GitHubAPI.DeepCopyInto(&out.GitHubAPI)
+	in.Claims.DeepCopyInto(&out.Claims)
+	in.AllowAuthentication.DeepCopyInto(&out.AllowAuthentication)
+	out.Client = in.Client
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderSpec.
+func (in *GitHubIdentityProviderSpec) DeepCopy() *GitHubIdentityProviderSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderStatus) DeepCopyInto(out *GitHubIdentityProviderStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderStatus.
+func (in *GitHubIdentityProviderStatus) DeepCopy() *GitHubIdentityProviderStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubOrganizationsSpec) DeepCopyInto(out *GitHubOrganizationsSpec) {
+	*out = *in
+	if in.Policy != nil {
+		in, out := &in.Policy, &out.Policy
+		*out = new(GitHubAllowedAuthOrganizationsPolicy)
+		**out = **in
+	}
+	if in.Allowed != nil {
+		in, out := &in.Allowed, &out.Allowed
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubOrganizationsSpec.
+func (in *GitHubOrganizationsSpec) DeepCopy() *GitHubOrganizationsSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubOrganizationsSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LDAPIdentityProvider) DeepCopyInto(out *LDAPIdentityProvider) {
 	*out = *in

generated/1.24/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -15,6 +15,7 @@ const (
 	IDPTypeOIDC            IDPType = "oidc"
 	IDPTypeLDAP            IDPType = "ldap"
 	IDPTypeActiveDirectory IDPType = "activedirectory"
+	IDPTypeGitHub          IDPType = "github"
 
 	IDPFlowCLIPassword     IDPFlow = "cli_password"
 	IDPFlowBrowserAuthcode IDPFlow = "browser_authcode"
@@ -54,7 +55,8 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
-	PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
+	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +66,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.24/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_githubidentityprovider.go

@@ -0,0 +1,129 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+
+	v1alpha1 "go.pinniped.dev/generated/1.24/apis/supervisor/idp/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeGitHubIdentityProviders implements GitHubIdentityProviderInterface
+type FakeGitHubIdentityProviders struct {
+	Fake *FakeIDPV1alpha1
+	ns   string
+}
+
+var githubidentityprovidersResource = schema.GroupVersionResource{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "githubidentityproviders"}
+
+var githubidentityprovidersKind = schema.GroupVersionKind{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "GitHubIdentityProvider"}
+
+// Get takes name of the gitHubIdentityProvider, and returns the corresponding gitHubIdentityProvider object, and an error if there is any.
+func (c *FakeGitHubIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(githubidentityprovidersResource, c.ns, name), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// List takes label and field selectors, and returns the list of GitHubIdentityProviders that match those selectors.
+func (c *FakeGitHubIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.GitHubIdentityProviderList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(githubidentityprovidersResource, githubidentityprovidersKind, c.ns, opts), &v1alpha1.GitHubIdentityProviderList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.GitHubIdentityProviderList{ListMeta: obj.(*v1alpha1.GitHubIdentityProviderList).ListMeta}
+	for _, item := range obj.(*v1alpha1.GitHubIdentityProviderList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested gitHubIdentityProviders.
+func (c *FakeGitHubIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(githubidentityprovidersResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a gitHubIdentityProvider and creates it.  Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *FakeGitHubIdentityProviders) Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(githubidentityprovidersResource, c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// Update takes the representation of a gitHubIdentityProvider and updates it. Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *FakeGitHubIdentityProviders) Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(githubidentityprovidersResource, c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeGitHubIdentityProviders) UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(githubidentityprovidersResource, "status", c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// Delete takes name of the gitHubIdentityProvider and deletes it. Returns an error if one occurs.
+func (c *FakeGitHubIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteActionWithOptions(githubidentityprovidersResource, c.ns, name, opts), &v1alpha1.GitHubIdentityProvider{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeGitHubIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(githubidentityprovidersResource, c.ns, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.GitHubIdentityProviderList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched gitHubIdentityProvider.
+func (c *FakeGitHubIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(githubidentityprovidersResource, c.ns, name, pt, data, subresources...), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}

generated/1.24/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_idp_client.go

@@ -19,6 +19,10 @@ func (c *FakeIDPV1alpha1) ActiveDirectoryIdentityProviders(namespace string) v1a
 	return &FakeActiveDirectoryIdentityProviders{c, namespace}
 }
 
+func (c *FakeIDPV1alpha1) GitHubIdentityProviders(namespace string) v1alpha1.GitHubIdentityProviderInterface {
+	return &FakeGitHubIdentityProviders{c, namespace}
+}
+
 func (c *FakeIDPV1alpha1) LDAPIdentityProviders(namespace string) v1alpha1.LDAPIdentityProviderInterface {
 	return &FakeLDAPIdentityProviders{c, namespace}
 }

generated/1.24/client/supervisor/clientset/versioned/typed/idp/v1alpha1/generated_expansion.go

@@ -7,6 +7,8 @@ package v1alpha1
 
 type ActiveDirectoryIdentityProviderExpansion interface{}
 
+type GitHubIdentityProviderExpansion interface{}
+
 type LDAPIdentityProviderExpansion interface{}
 
 type OIDCIdentityProviderExpansion interface{}

generated/1.24/client/supervisor/clientset/versioned/typed/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,182 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	"time"
+
+	v1alpha1 "go.pinniped.dev/generated/1.24/apis/supervisor/idp/v1alpha1"
+	scheme "go.pinniped.dev/generated/1.24/client/supervisor/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// GitHubIdentityProvidersGetter has a method to return a GitHubIdentityProviderInterface.
+// A group's client should implement this interface.
+type GitHubIdentityProvidersGetter interface {
+	GitHubIdentityProviders(namespace string) GitHubIdentityProviderInterface
+}
+
+// GitHubIdentityProviderInterface has methods to work with GitHubIdentityProvider resources.
+type GitHubIdentityProviderInterface interface {
+	Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.GitHubIdentityProviderList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error)
+	GitHubIdentityProviderExpansion
+}
+
+// gitHubIdentityProviders implements GitHubIdentityProviderInterface
+type gitHubIdentityProviders struct {
+	client rest.Interface
+	ns     string
+}
+
+// newGitHubIdentityProviders returns a GitHubIdentityProviders
+func newGitHubIdentityProviders(c *IDPV1alpha1Client, namespace string) *gitHubIdentityProviders {
+	return &gitHubIdentityProviders{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the gitHubIdentityProvider, and returns the corresponding gitHubIdentityProvider object, and an error if there is any.
+func (c *gitHubIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of GitHubIdentityProviders that match those selectors.
+func (c *gitHubIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.GitHubIdentityProviderList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha1.GitHubIdentityProviderList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested gitHubIdentityProviders.
+func (c *gitHubIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a gitHubIdentityProvider and creates it.  Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *gitHubIdentityProviders) Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a gitHubIdentityProvider and updates it. Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *gitHubIdentityProviders) Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(gitHubIdentityProvider.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *gitHubIdentityProviders) UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(gitHubIdentityProvider.Name).
+		SubResource("status").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the gitHubIdentityProvider and deletes it. Returns an error if one occurs.
+func (c *gitHubIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *gitHubIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched gitHubIdentityProvider.
+func (c *gitHubIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

generated/1.24/client/supervisor/clientset/versioned/typed/idp/v1alpha1/idp_client.go

@@ -16,6 +16,7 @@ import (
 type IDPV1alpha1Interface interface {
 	RESTClient() rest.Interface
 	ActiveDirectoryIdentityProvidersGetter
+	GitHubIdentityProvidersGetter
 	LDAPIdentityProvidersGetter
 	OIDCIdentityProvidersGetter
 }
@@ -29,6 +30,10 @@ func (c *IDPV1alpha1Client) ActiveDirectoryIdentityProviders(namespace string) A
 	return newActiveDirectoryIdentityProviders(c, namespace)
 }
 
+func (c *IDPV1alpha1Client) GitHubIdentityProviders(namespace string) GitHubIdentityProviderInterface {
+	return newGitHubIdentityProviders(c, namespace)
+}
+
 func (c *IDPV1alpha1Client) LDAPIdentityProviders(namespace string) LDAPIdentityProviderInterface {
 	return newLDAPIdentityProviders(c, namespace)
 }

generated/1.24/client/supervisor/informers/externalversions/generic.go

@@ -49,6 +49,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		// Group=idp.supervisor.pinniped.dev, Version=v1alpha1
 	case idpv1alpha1.SchemeGroupVersion.WithResource("activedirectoryidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().ActiveDirectoryIdentityProviders().Informer()}, nil
+	case idpv1alpha1.SchemeGroupVersion.WithResource("githubidentityproviders"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().GitHubIdentityProviders().Informer()}, nil
 	case idpv1alpha1.SchemeGroupVersion.WithResource("ldapidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().LDAPIdentityProviders().Informer()}, nil
 	case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"):

generated/1.24/client/supervisor/informers/externalversions/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,77 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	time "time"
+
+	idpv1alpha1 "go.pinniped.dev/generated/1.24/apis/supervisor/idp/v1alpha1"
+	versioned "go.pinniped.dev/generated/1.24/client/supervisor/clientset/versioned"
+	internalinterfaces "go.pinniped.dev/generated/1.24/client/supervisor/informers/externalversions/internalinterfaces"
+	v1alpha1 "go.pinniped.dev/generated/1.24/client/supervisor/listers/idp/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// GitHubIdentityProviderInformer provides access to a shared informer and lister for
+// GitHubIdentityProviders.
+type GitHubIdentityProviderInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.GitHubIdentityProviderLister
+}
+
+type gitHubIdentityProviderInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewGitHubIdentityProviderInformer constructs a new informer for GitHubIdentityProvider type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewGitHubIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredGitHubIdentityProviderInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredGitHubIdentityProviderInformer constructs a new informer for GitHubIdentityProvider type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredGitHubIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IDPV1alpha1().GitHubIdentityProviders(namespace).List(context.TODO(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IDPV1alpha1().GitHubIdentityProviders(namespace).Watch(context.TODO(), options)
+			},
+		},
+		&idpv1alpha1.GitHubIdentityProvider{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *gitHubIdentityProviderInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredGitHubIdentityProviderInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *gitHubIdentityProviderInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&idpv1alpha1.GitHubIdentityProvider{}, f.defaultInformer)
+}
+
+func (f *gitHubIdentityProviderInformer) Lister() v1alpha1.GitHubIdentityProviderLister {
+	return v1alpha1.NewGitHubIdentityProviderLister(f.Informer().GetIndexer())
+}

generated/1.24/client/supervisor/informers/externalversions/idp/v1alpha1/interface.go

@@ -13,6 +13,8 @@ import (
 type Interface interface {
 	// ActiveDirectoryIdentityProviders returns a ActiveDirectoryIdentityProviderInformer.
 	ActiveDirectoryIdentityProviders() ActiveDirectoryIdentityProviderInformer
+	// GitHubIdentityProviders returns a GitHubIdentityProviderInformer.
+	GitHubIdentityProviders() GitHubIdentityProviderInformer
 	// LDAPIdentityProviders returns a LDAPIdentityProviderInformer.
 	LDAPIdentityProviders() LDAPIdentityProviderInformer
 	// OIDCIdentityProviders returns a OIDCIdentityProviderInformer.
@@ -35,6 +37,11 @@ func (v *version) ActiveDirectoryIdentityProviders() ActiveDirectoryIdentityProv
 	return &activeDirectoryIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
+// GitHubIdentityProviders returns a GitHubIdentityProviderInformer.
+func (v *version) GitHubIdentityProviders() GitHubIdentityProviderInformer {
+	return &gitHubIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
 // LDAPIdentityProviders returns a LDAPIdentityProviderInformer.
 func (v *version) LDAPIdentityProviders() LDAPIdentityProviderInformer {
 	return &lDAPIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}

generated/1.24/client/supervisor/listers/idp/v1alpha1/expansion_generated.go

@@ -13,6 +13,14 @@ type ActiveDirectoryIdentityProviderListerExpansion interface{}
 // ActiveDirectoryIdentityProviderNamespaceLister.
 type ActiveDirectoryIdentityProviderNamespaceListerExpansion interface{}
 
+// GitHubIdentityProviderListerExpansion allows custom methods to be added to
+// GitHubIdentityProviderLister.
+type GitHubIdentityProviderListerExpansion interface{}
+
+// GitHubIdentityProviderNamespaceListerExpansion allows custom methods to be added to
+// GitHubIdentityProviderNamespaceLister.
+type GitHubIdentityProviderNamespaceListerExpansion interface{}
+
 // LDAPIdentityProviderListerExpansion allows custom methods to be added to
 // LDAPIdentityProviderLister.
 type LDAPIdentityProviderListerExpansion interface{}

generated/1.24/client/supervisor/listers/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,86 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "go.pinniped.dev/generated/1.24/apis/supervisor/idp/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// GitHubIdentityProviderLister helps list GitHubIdentityProviders.
+// All objects returned here must be treated as read-only.
+type GitHubIdentityProviderLister interface {
+	// List lists all GitHubIdentityProviders in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error)
+	// GitHubIdentityProviders returns an object that can list and get GitHubIdentityProviders.
+	GitHubIdentityProviders(namespace string) GitHubIdentityProviderNamespaceLister
+	GitHubIdentityProviderListerExpansion
+}
+
+// gitHubIdentityProviderLister implements the GitHubIdentityProviderLister interface.
+type gitHubIdentityProviderLister struct {
+	indexer cache.Indexer
+}
+
+// NewGitHubIdentityProviderLister returns a new GitHubIdentityProviderLister.
+func NewGitHubIdentityProviderLister(indexer cache.Indexer) GitHubIdentityProviderLister {
+	return &gitHubIdentityProviderLister{indexer: indexer}
+}
+
+// List lists all GitHubIdentityProviders in the indexer.
+func (s *gitHubIdentityProviderLister) List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.GitHubIdentityProvider))
+	})
+	return ret, err
+}
+
+// GitHubIdentityProviders returns an object that can list and get GitHubIdentityProviders.
+func (s *gitHubIdentityProviderLister) GitHubIdentityProviders(namespace string) GitHubIdentityProviderNamespaceLister {
+	return gitHubIdentityProviderNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// GitHubIdentityProviderNamespaceLister helps list and get GitHubIdentityProviders.
+// All objects returned here must be treated as read-only.
+type GitHubIdentityProviderNamespaceLister interface {
+	// List lists all GitHubIdentityProviders in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error)
+	// Get retrieves the GitHubIdentityProvider from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1alpha1.GitHubIdentityProvider, error)
+	GitHubIdentityProviderNamespaceListerExpansion
+}
+
+// gitHubIdentityProviderNamespaceLister implements the GitHubIdentityProviderNamespaceLister
+// interface.
+type gitHubIdentityProviderNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all GitHubIdentityProviders in the indexer for a given namespace.
+func (s gitHubIdentityProviderNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.GitHubIdentityProvider))
+	})
+	return ret, err
+}
+
+// Get retrieves the GitHubIdentityProvider from the indexer for a given namespace and name.
+func (s gitHubIdentityProviderNamespaceLister) Get(name string) (*v1alpha1.GitHubIdentityProvider, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha1.Resource("githubidentityprovider"), name)
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), nil
+}

generated/1.24/crds/authentication.concierge.pinniped.dev_jwtauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: jwtauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev

generated/1.24/crds/authentication.concierge.pinniped.dev_webhookauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhookauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev

generated/1.24/crds/config.concierge.pinniped.dev_credentialissuers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: credentialissuers.config.concierge.pinniped.dev
 spec:
   group: config.concierge.pinniped.dev

generated/1.24/crds/config.supervisor.pinniped.dev_federationdomains.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: federationdomains.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev

generated/1.24/crds/config.supervisor.pinniped.dev_oidcclients.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: oidcclients.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev

generated/1.24/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: activedirectoryidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

generated/1.24/crds/idp.supervisor.pinniped.dev_githubidentityproviders.yaml

@@ -0,0 +1,326 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.15.0
+  name: githubidentityproviders.idp.supervisor.pinniped.dev
+spec:
+  group: idp.supervisor.pinniped.dev
+  names:
+    categories:
+    - pinniped
+    - pinniped-idp
+    - pinniped-idps
+    kind: GitHubIdentityProvider
+    listKind: GitHubIdentityProviderList
+    plural: githubidentityproviders
+    singular: githubidentityprovider
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.githubAPI.host
+      name: Host
+      type: string
+    - jsonPath: .status.phase
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+          This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+
+
+          Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+          as OIDCClients.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec for configuring the identity provider.
+            properties:
+              allowAuthentication:
+                description: AllowAuthentication allows customization of who can authenticate
+                  using this IDP and how.
+                properties:
+                  organizations:
+                    description: Organizations allows customization of which organizations
+                      can authenticate using this IDP.
+                    properties:
+                      allowed:
+                        description: |-
+                          Allowed, when specified, indicates that only users with membership in at least one of the listed
+                          GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include
+                          teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
+                          provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
+
+
+                          The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
+                          otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
+                          within that organization.
+
+
+                          If no organizations are listed, you must set organizations: AllGitHubUsers.
+                        items:
+                          type: string
+                        maxItems: 64
+                        type: array
+                        x-kubernetes-list-type: set
+                      policy:
+                        default: OnlyUsersFromAllowedOrganizations
+                        description: |-
+                          Policy must be set to "AllGitHubUsers" if allowed is empty.
+
+
+                          This field only exists to ensure that Pinniped administrators are aware that an empty list of
+                          allowedOrganizations means all GitHub users are allowed to log in.
+                        enum:
+                        - OnlyUsersFromAllowedOrganizations
+                        - AllGitHubUsers
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: spec.allowAuthentication.organizations.policy must
+                        be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed
+                        has organizations listed
+                      rule: '!(has(self.allowed) && size(self.allowed) > 0 && self.policy
+                        == ''AllGitHubUsers'')'
+                    - message: spec.allowAuthentication.organizations.policy must
+                        be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed
+                        is empty
+                      rule: '!((!has(self.allowed) || size(self.allowed) == 0) &&
+                        self.policy == ''OnlyUsersFromAllowedOrganizations'')'
+                required:
+                - organizations
+                type: object
+              claims:
+                default: {}
+                description: Claims allows customization of the username and groups
+                  claims.
+                properties:
+                  groups:
+                    default: slug
+                    description: |-
+                      Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
+
+
+                      Can be either "name" or "slug". Defaults to "slug".
+
+
+                      GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
+
+
+                      GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
+
+
+                      Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
+                      forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
+                      or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
+                      the team name or slug.
+
+
+                      If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+                      FederationDomain to further customize how these group names are presented to Kubernetes.
+
+
+                      See the response schema for
+                      [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+                    enum:
+                    - name
+                    - slug
+                    type: string
+                  username:
+                    default: login:id
+                    description: |-
+                      Username configures which property of the GitHub user record shall determine the username in Kubernetes.
+
+
+                      Can be either "id", "login", or "login:id". Defaults to "login:id".
+
+
+                      GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
+                      and may not start or end with hyphens. GitHub users are allowed to change their login name,
+                      although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
+                      then a second user might change their name from "baz" to "foo" in order to take the old
+                      username of the first user. For this reason, it is not as safe to make authorization decisions
+                      based only on the user's login attribute.
+
+
+                      If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+                      FederationDomain to further customize how these usernames are presented to Kubernetes.
+
+
+                      Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
+                      unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
+                      from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
+                      choice to concatenate the two values.
+
+
+                      See the response schema for
+                      [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+                    enum:
+                    - id
+                    - login
+                    - login:id
+                    type: string
+                type: object
+              client:
+                description: Client identifies the secret with credentials for a GitHub
+                  App or GitHub OAuth2 App (a GitHub client).
+                properties:
+                  secretName:
+                    description: |-
+                      SecretName contains the name of a namespace-local Secret object that provides the clientID and
+                      clientSecret for an GitHub App or GitHub OAuth2 client.
+
+
+                      This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
+                    minLength: 1
+                    type: string
+                required:
+                - secretName
+                type: object
+              githubAPI:
+                default: {}
+                description: GitHubAPI allows configuration for GitHub Enterprise
+                  Server
+                properties:
+                  host:
+                    default: github.com
+                    description: |-
+                      Host is required only for GitHub Enterprise Server.
+                      Defaults to using GitHub's public API ("github.com").
+                      Do not specify a protocol or scheme since "https://" will always be used.
+                      Port is optional. Do not specify a path, query, fragment, or userinfo.
+                      Only domain name or IP address, subdomains (optional), and port (optional).
+                      IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
+                      in square brackets. Example: "[::1]:443".
+                    minLength: 1
+                    type: string
+                  tls:
+                    description: TLS configuration for GitHub Enterprise Server.
+                    properties:
+                      certificateAuthorityData:
+                        description: X.509 Certificate Authority (base64-encoded PEM
+                          bundle). If omitted, a default set of system roots will
+                          be trusted.
+                        type: string
+                    type: object
+                type: object
+            required:
+            - allowAuthentication
+            - client
+            type: object
+          status:
+            description: Status of the identity provider.
+            properties:
+              conditions:
+                description: Conditions represents the observations of an identity
+                  provider's current state.
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource.\n---\nThis struct is intended for
+                    direct use as an array at the field path .status.conditions.  For
+                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
+                    observations of a foo's current state.\n\t    // Known .status.conditions.type
+                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
+                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
+                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
+                    \   // other fields\n\t}"
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: |-
+                        type of condition in CamelCase or in foo.example.com/CamelCase.
+                        ---
+                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+                        useful (see .node.status.conditions), the ability to deconflict is important.
+                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              phase:
+                default: Pending
+                description: Phase summarizes the overall status of the GitHubIdentityProvider.
+                enum:
+                - Pending
+                - Ready
+                - Error
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

generated/1.24/crds/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ldapidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

generated/1.24/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: oidcidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

generated/1.25/README.adoc

@@ -1645,6 +1645,285 @@ Optional, when empty this defaults to "objectGUID". +
 |===
 
 
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubapiconfig"]
+==== GitHubAPIConfig 
+
+GitHubAPIConfig allows configuration for GitHub Enterprise Server
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`host`* __string__ | Host is required only for GitHub Enterprise Server. +
+Defaults to using GitHub's public API ("github.com"). +
+Do not specify a protocol or scheme since "https://" will always be used. +
+Port is optional. Do not specify a path, query, fragment, or userinfo. +
+Only domain name or IP address, subdomains (optional), and port (optional). +
+IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address +
+in square brackets. Example: "[::1]:443". +
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration for GitHub Enterprise Server. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec"]
+==== GitHubAllowAuthenticationSpec 
+
+GitHubAllowAuthenticationSpec allows customization of who can authenticate using this IDP and how.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`organizations`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githuborganizationsspec[$$GitHubOrganizationsSpec$$]__ | Organizations allows customization of which organizations can authenticate using this IDP. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githuballowedauthorganizationspolicy"]
+==== GitHubAllowedAuthOrganizationsPolicy (string) 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githuborganizationsspec[$$GitHubOrganizationsSpec$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubclaims"]
+==== GitHubClaims 
+
+GitHubClaims allows customization of the username and groups claims.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`username`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubusernameattribute[$$GitHubUsernameAttribute$$]__ | Username configures which property of the GitHub user record shall determine the username in Kubernetes. +
+
+
+Can be either "id", "login", or "login:id". Defaults to "login:id". +
+
+
+GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens, +
+and may not start or end with hyphens. GitHub users are allowed to change their login name, +
+although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar", +
+then a second user might change their name from "baz" to "foo" in order to take the old +
+username of the first user. For this reason, it is not as safe to make authorization decisions +
+based only on the user's login attribute. +
+
+
+If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's +
+FederationDomain to further customize how these usernames are presented to Kubernetes. +
+
+
+Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and +
+unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value +
+from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable +
+choice to concatenate the two values. +
+
+
+See the response schema for +
+[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user). +
+| *`groups`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubgroupnameattribute[$$GitHubGroupNameAttribute$$]__ | Groups configures which property of the GitHub team record shall determine the group names in Kubernetes. +
+
+
+Can be either "name" or "slug". Defaults to "slug". +
+
+
+GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!"). +
+
+
+GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins"). +
+
+
+Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a +
+forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters +
+or single hyphens, so the first forward slash `/` will be the separator between the organization login name and +
+the team name or slug. +
+
+
+If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's +
+FederationDomain to further customize how these group names are presented to Kubernetes. +
+
+
+See the response schema for +
+[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user). +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubclientspec"]
+==== GitHubClientSpec 
+
+GitHubClientSpec contains information about the GitHub client that this identity provider will use
+for web-based login flows.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and +
+clientSecret for an GitHub App or GitHub OAuth2 client. +
+
+
+This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret". +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubgroupnameattribute"]
+==== GitHubGroupNameAttribute (string) 
+
+GitHubGroupNameAttribute allows the user to specify which attribute from GitHub to use for the group
+names to present to Kubernetes. See the response schema for
+[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityprovider"]
+==== GitHubIdentityProvider 
+
+GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+
+
+Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+as OIDCClients.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderlist[$$GitHubIdentityProviderList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]__ | Spec for configuring the identity provider. +
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus[$$GitHubIdentityProviderStatus$$]__ | Status of the identity provider. +
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderphase"]
+==== GitHubIdentityProviderPhase (string) 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus[$$GitHubIdentityProviderStatus$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderspec"]
+==== GitHubIdentityProviderSpec 
+
+GitHubIdentityProviderSpec is the spec for configuring an GitHub identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityprovider[$$GitHubIdentityProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`githubAPI`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubapiconfig[$$GitHubAPIConfig$$]__ | GitHubAPI allows configuration for GitHub Enterprise Server +
+| *`claims`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]__ | Claims allows customization of the username and groups claims. +
+| *`allowAuthentication`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec[$$GitHubAllowAuthenticationSpec$$]__ | AllowAuthentication allows customization of who can authenticate using this IDP and how. +
+| *`client`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubclientspec[$$GitHubClientSpec$$]__ | Client identifies the secret with credentials for a GitHub App or GitHub OAuth2 App (a GitHub client). +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus"]
+==== GitHubIdentityProviderStatus 
+
+GitHubIdentityProviderStatus is the status of an GitHub identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityprovider[$$GitHubIdentityProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubidentityproviderphase[$$GitHubIdentityProviderPhase$$]__ | Phase summarizes the overall status of the GitHubIdentityProvider. +
+| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#condition-v1-meta[$$Condition$$] array__ | Conditions represents the observations of an identity provider's current state. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githuborganizationsspec"]
+==== GitHubOrganizationsSpec 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec[$$GitHubAllowAuthenticationSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`policy`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githuballowedauthorganizationspolicy[$$GitHubAllowedAuthOrganizationsPolicy$$]__ | Policy must be set to "AllGitHubUsers" if allowed is empty. +
+
+
+This field only exists to ensure that Pinniped administrators are aware that an empty list of +
+allowedOrganizations means all GitHub users are allowed to log in. +
+| *`allowed`* __string array__ | Allowed, when specified, indicates that only users with membership in at least one of the listed +
+GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include +
+teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be +
+provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP. +
+
+
+The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations, +
+otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams +
+within that organization. +
+
+
+If no organizations are listed, you must set organizations: AllGitHubUsers. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubusernameattribute"]
+==== GitHubUsernameAttribute (string) 
+
+GitHubUsernameAttribute allows the user to specify which attribute(s) from GitHub to use for the username to present
+to Kubernetes. See the response schema for
+[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]
+****
+
+
+
 [id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-ldapidentityprovider"]
 ==== LDAPIdentityProvider 
 
@@ -2108,11 +2387,12 @@ Parameter is a key/value pair which represents a parameter in an HTTP request.
 [id="{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-tlsspec"]
 ==== TLSSpec 
 
-Configuration for TLS parameters related to identity provider integration.
+TLSSpec provides TLS configuration for identity provider integration.
 
 .Appears In:
 ****
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec[$$ActiveDirectoryIdentityProviderSpec$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-githubapiconfig[$$GitHubAPIConfig$$]
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec[$$LDAPIdentityProviderSpec$$]
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-25-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
 ****

generated/1.25/apis/supervisor/idp/v1alpha1/register.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -36,6 +36,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&LDAPIdentityProviderList{},
 		&ActiveDirectoryIdentityProvider{},
 		&ActiveDirectoryIdentityProviderList{},
+		&GitHubIdentityProvider{},
+		&GitHubIdentityProviderList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

generated/1.25/apis/supervisor/idp/v1alpha1/types_githubidentityprovider.go

@@ -0,0 +1,256 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type GitHubIdentityProviderPhase string
+
+const (
+	// GitHubPhasePending is the default phase for newly-created GitHubIdentityProvider resources.
+	GitHubPhasePending GitHubIdentityProviderPhase = "Pending"
+
+	// GitHubPhaseReady is the phase for an GitHubIdentityProvider resource in a healthy state.
+	GitHubPhaseReady GitHubIdentityProviderPhase = "Ready"
+
+	// GitHubPhaseError is the phase for an GitHubIdentityProvider in an unhealthy state.
+	GitHubPhaseError GitHubIdentityProviderPhase = "Error"
+)
+
+type GitHubAllowedAuthOrganizationsPolicy string
+
+const (
+	// GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers means any GitHub user is allowed to log in using this identity
+	// provider, regardless of their organization membership or lack thereof.
+	GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers GitHubAllowedAuthOrganizationsPolicy = "AllGitHubUsers"
+
+	// GitHubAllowedAuthOrganizationsPolicyOnlyUsersFromAllowedOrganizations means only those users with membership in
+	// the listed GitHub organizations are allowed to log in.
+	GitHubAllowedAuthOrganizationsPolicyOnlyUsersFromAllowedOrganizations GitHubAllowedAuthOrganizationsPolicy = "OnlyUsersFromAllowedOrganizations"
+)
+
+// GitHubIdentityProviderStatus is the status of an GitHub identity provider.
+type GitHubIdentityProviderStatus struct {
+	// Phase summarizes the overall status of the GitHubIdentityProvider.
+	//
+	// +kubebuilder:default=Pending
+	// +kubebuilder:validation:Enum=Pending;Ready;Error
+	Phase GitHubIdentityProviderPhase `json:"phase,omitempty"`
+
+	// Conditions represents the observations of an identity provider's current state.
+	//
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+}
+
+// GitHubAPIConfig allows configuration for GitHub Enterprise Server
+type GitHubAPIConfig struct {
+	// Host is required only for GitHub Enterprise Server.
+	// Defaults to using GitHub's public API ("github.com").
+	// Do not specify a protocol or scheme since "https://" will always be used.
+	// Port is optional. Do not specify a path, query, fragment, or userinfo.
+	// Only domain name or IP address, subdomains (optional), and port (optional).
+	// IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
+	// in square brackets. Example: "[::1]:443".
+	//
+	// +kubebuilder:default="github.com"
+	// +kubebuilder:validation:MinLength=1
+	// +optional
+	Host *string `json:"host"`
+
+	// TLS configuration for GitHub Enterprise Server.
+	//
+	// +optional
+	TLS *TLSSpec `json:"tls,omitempty"`
+}
+
+// GitHubUsernameAttribute allows the user to specify which attribute(s) from GitHub to use for the username to present
+// to Kubernetes. See the response schema for
+// [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+type GitHubUsernameAttribute string
+
+const (
+	// GitHubUsernameID specifies using the `id` attribute from the GitHub user for the username to present to Kubernetes.
+	GitHubUsernameID GitHubUsernameAttribute = "id"
+
+	// GitHubUsernameLogin specifies using the `login` attribute from the GitHub user as the username to present to Kubernetes.
+	GitHubUsernameLogin GitHubUsernameAttribute = "login"
+
+	// GitHubUsernameLoginAndID specifies combining the `login` and `id` attributes from the GitHub user as the
+	// username to present to Kubernetes, separated by a colon. Example: "my-login:1234"
+	GitHubUsernameLoginAndID GitHubUsernameAttribute = "login:id"
+)
+
+// GitHubGroupNameAttribute allows the user to specify which attribute from GitHub to use for the group
+// names to present to Kubernetes. See the response schema for
+// [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+type GitHubGroupNameAttribute string
+
+const (
+	// GitHubUseTeamNameForGroupName specifies using the GitHub team's `name` attribute as the group name to present to Kubernetes.
+	GitHubUseTeamNameForGroupName GitHubGroupNameAttribute = "name"
+
+	// GitHubUseTeamSlugForGroupName specifies using the GitHub team's `slug` attribute as the group name to present to Kubernetes.
+	GitHubUseTeamSlugForGroupName GitHubGroupNameAttribute = "slug"
+)
+
+// GitHubClaims allows customization of the username and groups claims.
+type GitHubClaims struct {
+	// Username configures which property of the GitHub user record shall determine the username in Kubernetes.
+	//
+	// Can be either "id", "login", or "login:id". Defaults to "login:id".
+	//
+	// GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
+	// and may not start or end with hyphens. GitHub users are allowed to change their login name,
+	// although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
+	// then a second user might change their name from "baz" to "foo" in order to take the old
+	// username of the first user. For this reason, it is not as safe to make authorization decisions
+	// based only on the user's login attribute.
+	//
+	// If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+	// FederationDomain to further customize how these usernames are presented to Kubernetes.
+	//
+	// Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
+	// unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
+	// from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
+	// choice to concatenate the two values.
+	//
+	// See the response schema for
+	// [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+	//
+	// +kubebuilder:default="login:id"
+	// +kubebuilder:validation:Enum={"id","login","login:id"}
+	// +optional
+	Username *GitHubUsernameAttribute `json:"username"`
+
+	// Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
+	//
+	// Can be either "name" or "slug". Defaults to "slug".
+	//
+	// GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
+	//
+	// GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
+	//
+	// Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
+	// forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
+	// or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
+	// the team name or slug.
+	//
+	// If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+	// FederationDomain to further customize how these group names are presented to Kubernetes.
+	//
+	// See the response schema for
+	// [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+	//
+	// +kubebuilder:default=slug
+	// +kubebuilder:validation:Enum=name;slug
+	// +optional
+	Groups *GitHubGroupNameAttribute `json:"groups"`
+}
+
+// GitHubClientSpec contains information about the GitHub client that this identity provider will use
+// for web-based login flows.
+type GitHubClientSpec struct {
+	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
+	// clientSecret for an GitHub App or GitHub OAuth2 client.
+	//
+	// This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
+	//
+	// +kubebuilder:validation:MinLength=1
+	SecretName string `json:"secretName"`
+}
+
+type GitHubOrganizationsSpec struct {
+	// Policy must be set to "AllGitHubUsers" if allowed is empty.
+	//
+	// This field only exists to ensure that Pinniped administrators are aware that an empty list of
+	// allowedOrganizations means all GitHub users are allowed to log in.
+	//
+	// +kubebuilder:default=OnlyUsersFromAllowedOrganizations
+	// +kubebuilder:validation:Enum=OnlyUsersFromAllowedOrganizations;AllGitHubUsers
+	// +optional
+	Policy *GitHubAllowedAuthOrganizationsPolicy `json:"policy"`
+
+	// Allowed, when specified, indicates that only users with membership in at least one of the listed
+	// GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include
+	// teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
+	// provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
+	//
+	// The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
+	// otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
+	// within that organization.
+	//
+	// If no organizations are listed, you must set organizations: AllGitHubUsers.
+	//
+	// +kubebuilder:validation:MaxItems=64
+	// +listType=set
+	// +optional
+	Allowed []string `json:"allowed,omitempty"`
+}
+
+// GitHubAllowAuthenticationSpec allows customization of who can authenticate using this IDP and how.
+type GitHubAllowAuthenticationSpec struct {
+	// Organizations allows customization of which organizations can authenticate using this IDP.
+	// +kubebuilder:validation:XValidation:message="spec.allowAuthentication.organizations.policy must be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed has organizations listed",rule="!(has(self.allowed) && size(self.allowed) > 0 && self.policy == 'AllGitHubUsers')"
+	// +kubebuilder:validation:XValidation:message="spec.allowAuthentication.organizations.policy must be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed is empty",rule="!((!has(self.allowed) || size(self.allowed) == 0) && self.policy == 'OnlyUsersFromAllowedOrganizations')"
+	Organizations GitHubOrganizationsSpec `json:"organizations"`
+}
+
+// GitHubIdentityProviderSpec is the spec for configuring an GitHub identity provider.
+type GitHubIdentityProviderSpec struct {
+	// GitHubAPI allows configuration for GitHub Enterprise Server
+	//
+	// +kubebuilder:default={}
+	GitHubAPI GitHubAPIConfig `json:"githubAPI,omitempty"`
+
+	// Claims allows customization of the username and groups claims.
+	//
+	// +kubebuilder:default={}
+	Claims GitHubClaims `json:"claims,omitempty"`
+
+	// AllowAuthentication allows customization of who can authenticate using this IDP and how.
+	AllowAuthentication GitHubAllowAuthenticationSpec `json:"allowAuthentication"`
+
+	// Client identifies the secret with credentials for a GitHub App or GitHub OAuth2 App (a GitHub client).
+	Client GitHubClientSpec `json:"client"`
+}
+
+// GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+// This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+//
+// Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+// as OIDCClients.
+//
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=pinniped;pinniped-idp;pinniped-idps
+// +kubebuilder:printcolumn:name="Host",type=string,JSONPath=`.spec.githubAPI.host`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+// +kubebuilder:subresource:status
+type GitHubIdentityProvider struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec for configuring the identity provider.
+	Spec GitHubIdentityProviderSpec `json:"spec"`
+
+	// Status of the identity provider.
+	Status GitHubIdentityProviderStatus `json:"status,omitempty"`
+}
+
+// GitHubIdentityProviderList lists GitHubIdentityProvider objects.
+//
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type GitHubIdentityProviderList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []GitHubIdentityProvider `json:"items"`
+}

generated/1.25/apis/supervisor/idp/v1alpha1/types_tls.go

@@ -1,9 +1,9 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
 
-// Configuration for TLS parameters related to identity provider integration.
+// TLSSpec provides TLS configuration for identity provider integration.
 type TLSSpec struct {
 	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
 	// +optional

generated/1.25/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -203,6 +203,221 @@ func (in *ActiveDirectoryIdentityProviderUserSearchAttributes) DeepCopy() *Activ
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubAPIConfig) DeepCopyInto(out *GitHubAPIConfig) {
+	*out = *in
+	if in.Host != nil {
+		in, out := &in.Host, &out.Host
+		*out = new(string)
+		**out = **in
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSSpec)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubAPIConfig.
+func (in *GitHubAPIConfig) DeepCopy() *GitHubAPIConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubAPIConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubAllowAuthenticationSpec) DeepCopyInto(out *GitHubAllowAuthenticationSpec) {
+	*out = *in
+	in.Organizations.DeepCopyInto(&out.Organizations)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubAllowAuthenticationSpec.
+func (in *GitHubAllowAuthenticationSpec) DeepCopy() *GitHubAllowAuthenticationSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubAllowAuthenticationSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubClaims) DeepCopyInto(out *GitHubClaims) {
+	*out = *in
+	if in.Username != nil {
+		in, out := &in.Username, &out.Username
+		*out = new(GitHubUsernameAttribute)
+		**out = **in
+	}
+	if in.Groups != nil {
+		in, out := &in.Groups, &out.Groups
+		*out = new(GitHubGroupNameAttribute)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubClaims.
+func (in *GitHubClaims) DeepCopy() *GitHubClaims {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubClaims)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubClientSpec) DeepCopyInto(out *GitHubClientSpec) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubClientSpec.
+func (in *GitHubClientSpec) DeepCopy() *GitHubClientSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubClientSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProvider) DeepCopyInto(out *GitHubIdentityProvider) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProvider.
+func (in *GitHubIdentityProvider) DeepCopy() *GitHubIdentityProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GitHubIdentityProvider) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderList) DeepCopyInto(out *GitHubIdentityProviderList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]GitHubIdentityProvider, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderList.
+func (in *GitHubIdentityProviderList) DeepCopy() *GitHubIdentityProviderList {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GitHubIdentityProviderList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderSpec) DeepCopyInto(out *GitHubIdentityProviderSpec) {
+	*out = *in
+	in.GitHubAPI.DeepCopyInto(&out.GitHubAPI)
+	in.Claims.DeepCopyInto(&out.Claims)
+	in.AllowAuthentication.DeepCopyInto(&out.AllowAuthentication)
+	out.Client = in.Client
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderSpec.
+func (in *GitHubIdentityProviderSpec) DeepCopy() *GitHubIdentityProviderSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderStatus) DeepCopyInto(out *GitHubIdentityProviderStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderStatus.
+func (in *GitHubIdentityProviderStatus) DeepCopy() *GitHubIdentityProviderStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubOrganizationsSpec) DeepCopyInto(out *GitHubOrganizationsSpec) {
+	*out = *in
+	if in.Policy != nil {
+		in, out := &in.Policy, &out.Policy
+		*out = new(GitHubAllowedAuthOrganizationsPolicy)
+		**out = **in
+	}
+	if in.Allowed != nil {
+		in, out := &in.Allowed, &out.Allowed
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubOrganizationsSpec.
+func (in *GitHubOrganizationsSpec) DeepCopy() *GitHubOrganizationsSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubOrganizationsSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LDAPIdentityProvider) DeepCopyInto(out *LDAPIdentityProvider) {
 	*out = *in

generated/1.25/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -15,6 +15,7 @@ const (
 	IDPTypeOIDC            IDPType = "oidc"
 	IDPTypeLDAP            IDPType = "ldap"
 	IDPTypeActiveDirectory IDPType = "activedirectory"
+	IDPTypeGitHub          IDPType = "github"
 
 	IDPFlowCLIPassword     IDPFlow = "cli_password"
 	IDPFlowBrowserAuthcode IDPFlow = "browser_authcode"
@@ -54,7 +55,8 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
-	PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
+	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +66,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.25/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_githubidentityprovider.go

@@ -0,0 +1,129 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+
+	v1alpha1 "go.pinniped.dev/generated/1.25/apis/supervisor/idp/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeGitHubIdentityProviders implements GitHubIdentityProviderInterface
+type FakeGitHubIdentityProviders struct {
+	Fake *FakeIDPV1alpha1
+	ns   string
+}
+
+var githubidentityprovidersResource = schema.GroupVersionResource{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "githubidentityproviders"}
+
+var githubidentityprovidersKind = schema.GroupVersionKind{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "GitHubIdentityProvider"}
+
+// Get takes name of the gitHubIdentityProvider, and returns the corresponding gitHubIdentityProvider object, and an error if there is any.
+func (c *FakeGitHubIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(githubidentityprovidersResource, c.ns, name), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// List takes label and field selectors, and returns the list of GitHubIdentityProviders that match those selectors.
+func (c *FakeGitHubIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.GitHubIdentityProviderList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(githubidentityprovidersResource, githubidentityprovidersKind, c.ns, opts), &v1alpha1.GitHubIdentityProviderList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.GitHubIdentityProviderList{ListMeta: obj.(*v1alpha1.GitHubIdentityProviderList).ListMeta}
+	for _, item := range obj.(*v1alpha1.GitHubIdentityProviderList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested gitHubIdentityProviders.
+func (c *FakeGitHubIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(githubidentityprovidersResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a gitHubIdentityProvider and creates it.  Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *FakeGitHubIdentityProviders) Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(githubidentityprovidersResource, c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// Update takes the representation of a gitHubIdentityProvider and updates it. Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *FakeGitHubIdentityProviders) Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(githubidentityprovidersResource, c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeGitHubIdentityProviders) UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(githubidentityprovidersResource, "status", c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// Delete takes name of the gitHubIdentityProvider and deletes it. Returns an error if one occurs.
+func (c *FakeGitHubIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteActionWithOptions(githubidentityprovidersResource, c.ns, name, opts), &v1alpha1.GitHubIdentityProvider{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeGitHubIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(githubidentityprovidersResource, c.ns, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.GitHubIdentityProviderList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched gitHubIdentityProvider.
+func (c *FakeGitHubIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(githubidentityprovidersResource, c.ns, name, pt, data, subresources...), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}

generated/1.25/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_idp_client.go

@@ -19,6 +19,10 @@ func (c *FakeIDPV1alpha1) ActiveDirectoryIdentityProviders(namespace string) v1a
 	return &FakeActiveDirectoryIdentityProviders{c, namespace}
 }
 
+func (c *FakeIDPV1alpha1) GitHubIdentityProviders(namespace string) v1alpha1.GitHubIdentityProviderInterface {
+	return &FakeGitHubIdentityProviders{c, namespace}
+}
+
 func (c *FakeIDPV1alpha1) LDAPIdentityProviders(namespace string) v1alpha1.LDAPIdentityProviderInterface {
 	return &FakeLDAPIdentityProviders{c, namespace}
 }

generated/1.25/client/supervisor/clientset/versioned/typed/idp/v1alpha1/generated_expansion.go

@@ -7,6 +7,8 @@ package v1alpha1
 
 type ActiveDirectoryIdentityProviderExpansion interface{}
 
+type GitHubIdentityProviderExpansion interface{}
+
 type LDAPIdentityProviderExpansion interface{}
 
 type OIDCIdentityProviderExpansion interface{}

generated/1.25/client/supervisor/clientset/versioned/typed/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,182 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	"time"
+
+	v1alpha1 "go.pinniped.dev/generated/1.25/apis/supervisor/idp/v1alpha1"
+	scheme "go.pinniped.dev/generated/1.25/client/supervisor/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// GitHubIdentityProvidersGetter has a method to return a GitHubIdentityProviderInterface.
+// A group's client should implement this interface.
+type GitHubIdentityProvidersGetter interface {
+	GitHubIdentityProviders(namespace string) GitHubIdentityProviderInterface
+}
+
+// GitHubIdentityProviderInterface has methods to work with GitHubIdentityProvider resources.
+type GitHubIdentityProviderInterface interface {
+	Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.GitHubIdentityProviderList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error)
+	GitHubIdentityProviderExpansion
+}
+
+// gitHubIdentityProviders implements GitHubIdentityProviderInterface
+type gitHubIdentityProviders struct {
+	client rest.Interface
+	ns     string
+}
+
+// newGitHubIdentityProviders returns a GitHubIdentityProviders
+func newGitHubIdentityProviders(c *IDPV1alpha1Client, namespace string) *gitHubIdentityProviders {
+	return &gitHubIdentityProviders{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the gitHubIdentityProvider, and returns the corresponding gitHubIdentityProvider object, and an error if there is any.
+func (c *gitHubIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of GitHubIdentityProviders that match those selectors.
+func (c *gitHubIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.GitHubIdentityProviderList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha1.GitHubIdentityProviderList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested gitHubIdentityProviders.
+func (c *gitHubIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a gitHubIdentityProvider and creates it.  Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *gitHubIdentityProviders) Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a gitHubIdentityProvider and updates it. Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *gitHubIdentityProviders) Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(gitHubIdentityProvider.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *gitHubIdentityProviders) UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(gitHubIdentityProvider.Name).
+		SubResource("status").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the gitHubIdentityProvider and deletes it. Returns an error if one occurs.
+func (c *gitHubIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *gitHubIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched gitHubIdentityProvider.
+func (c *gitHubIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

generated/1.25/client/supervisor/clientset/versioned/typed/idp/v1alpha1/idp_client.go

@@ -16,6 +16,7 @@ import (
 type IDPV1alpha1Interface interface {
 	RESTClient() rest.Interface
 	ActiveDirectoryIdentityProvidersGetter
+	GitHubIdentityProvidersGetter
 	LDAPIdentityProvidersGetter
 	OIDCIdentityProvidersGetter
 }
@@ -29,6 +30,10 @@ func (c *IDPV1alpha1Client) ActiveDirectoryIdentityProviders(namespace string) A
 	return newActiveDirectoryIdentityProviders(c, namespace)
 }
 
+func (c *IDPV1alpha1Client) GitHubIdentityProviders(namespace string) GitHubIdentityProviderInterface {
+	return newGitHubIdentityProviders(c, namespace)
+}
+
 func (c *IDPV1alpha1Client) LDAPIdentityProviders(namespace string) LDAPIdentityProviderInterface {
 	return newLDAPIdentityProviders(c, namespace)
 }

generated/1.25/client/supervisor/informers/externalversions/generic.go

@@ -49,6 +49,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		// Group=idp.supervisor.pinniped.dev, Version=v1alpha1
 	case idpv1alpha1.SchemeGroupVersion.WithResource("activedirectoryidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().ActiveDirectoryIdentityProviders().Informer()}, nil
+	case idpv1alpha1.SchemeGroupVersion.WithResource("githubidentityproviders"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().GitHubIdentityProviders().Informer()}, nil
 	case idpv1alpha1.SchemeGroupVersion.WithResource("ldapidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().LDAPIdentityProviders().Informer()}, nil
 	case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"):

generated/1.25/client/supervisor/informers/externalversions/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,77 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	time "time"
+
+	idpv1alpha1 "go.pinniped.dev/generated/1.25/apis/supervisor/idp/v1alpha1"
+	versioned "go.pinniped.dev/generated/1.25/client/supervisor/clientset/versioned"
+	internalinterfaces "go.pinniped.dev/generated/1.25/client/supervisor/informers/externalversions/internalinterfaces"
+	v1alpha1 "go.pinniped.dev/generated/1.25/client/supervisor/listers/idp/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// GitHubIdentityProviderInformer provides access to a shared informer and lister for
+// GitHubIdentityProviders.
+type GitHubIdentityProviderInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.GitHubIdentityProviderLister
+}
+
+type gitHubIdentityProviderInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewGitHubIdentityProviderInformer constructs a new informer for GitHubIdentityProvider type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewGitHubIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredGitHubIdentityProviderInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredGitHubIdentityProviderInformer constructs a new informer for GitHubIdentityProvider type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredGitHubIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IDPV1alpha1().GitHubIdentityProviders(namespace).List(context.TODO(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IDPV1alpha1().GitHubIdentityProviders(namespace).Watch(context.TODO(), options)
+			},
+		},
+		&idpv1alpha1.GitHubIdentityProvider{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *gitHubIdentityProviderInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredGitHubIdentityProviderInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *gitHubIdentityProviderInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&idpv1alpha1.GitHubIdentityProvider{}, f.defaultInformer)
+}
+
+func (f *gitHubIdentityProviderInformer) Lister() v1alpha1.GitHubIdentityProviderLister {
+	return v1alpha1.NewGitHubIdentityProviderLister(f.Informer().GetIndexer())
+}

generated/1.25/client/supervisor/informers/externalversions/idp/v1alpha1/interface.go

@@ -13,6 +13,8 @@ import (
 type Interface interface {
 	// ActiveDirectoryIdentityProviders returns a ActiveDirectoryIdentityProviderInformer.
 	ActiveDirectoryIdentityProviders() ActiveDirectoryIdentityProviderInformer
+	// GitHubIdentityProviders returns a GitHubIdentityProviderInformer.
+	GitHubIdentityProviders() GitHubIdentityProviderInformer
 	// LDAPIdentityProviders returns a LDAPIdentityProviderInformer.
 	LDAPIdentityProviders() LDAPIdentityProviderInformer
 	// OIDCIdentityProviders returns a OIDCIdentityProviderInformer.
@@ -35,6 +37,11 @@ func (v *version) ActiveDirectoryIdentityProviders() ActiveDirectoryIdentityProv
 	return &activeDirectoryIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
+// GitHubIdentityProviders returns a GitHubIdentityProviderInformer.
+func (v *version) GitHubIdentityProviders() GitHubIdentityProviderInformer {
+	return &gitHubIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
 // LDAPIdentityProviders returns a LDAPIdentityProviderInformer.
 func (v *version) LDAPIdentityProviders() LDAPIdentityProviderInformer {
 	return &lDAPIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}

generated/1.25/client/supervisor/listers/idp/v1alpha1/expansion_generated.go

@@ -13,6 +13,14 @@ type ActiveDirectoryIdentityProviderListerExpansion interface{}
 // ActiveDirectoryIdentityProviderNamespaceLister.
 type ActiveDirectoryIdentityProviderNamespaceListerExpansion interface{}
 
+// GitHubIdentityProviderListerExpansion allows custom methods to be added to
+// GitHubIdentityProviderLister.
+type GitHubIdentityProviderListerExpansion interface{}
+
+// GitHubIdentityProviderNamespaceListerExpansion allows custom methods to be added to
+// GitHubIdentityProviderNamespaceLister.
+type GitHubIdentityProviderNamespaceListerExpansion interface{}
+
 // LDAPIdentityProviderListerExpansion allows custom methods to be added to
 // LDAPIdentityProviderLister.
 type LDAPIdentityProviderListerExpansion interface{}

generated/1.25/client/supervisor/listers/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,86 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "go.pinniped.dev/generated/1.25/apis/supervisor/idp/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// GitHubIdentityProviderLister helps list GitHubIdentityProviders.
+// All objects returned here must be treated as read-only.
+type GitHubIdentityProviderLister interface {
+	// List lists all GitHubIdentityProviders in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error)
+	// GitHubIdentityProviders returns an object that can list and get GitHubIdentityProviders.
+	GitHubIdentityProviders(namespace string) GitHubIdentityProviderNamespaceLister
+	GitHubIdentityProviderListerExpansion
+}
+
+// gitHubIdentityProviderLister implements the GitHubIdentityProviderLister interface.
+type gitHubIdentityProviderLister struct {
+	indexer cache.Indexer
+}
+
+// NewGitHubIdentityProviderLister returns a new GitHubIdentityProviderLister.
+func NewGitHubIdentityProviderLister(indexer cache.Indexer) GitHubIdentityProviderLister {
+	return &gitHubIdentityProviderLister{indexer: indexer}
+}
+
+// List lists all GitHubIdentityProviders in the indexer.
+func (s *gitHubIdentityProviderLister) List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.GitHubIdentityProvider))
+	})
+	return ret, err
+}
+
+// GitHubIdentityProviders returns an object that can list and get GitHubIdentityProviders.
+func (s *gitHubIdentityProviderLister) GitHubIdentityProviders(namespace string) GitHubIdentityProviderNamespaceLister {
+	return gitHubIdentityProviderNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// GitHubIdentityProviderNamespaceLister helps list and get GitHubIdentityProviders.
+// All objects returned here must be treated as read-only.
+type GitHubIdentityProviderNamespaceLister interface {
+	// List lists all GitHubIdentityProviders in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error)
+	// Get retrieves the GitHubIdentityProvider from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1alpha1.GitHubIdentityProvider, error)
+	GitHubIdentityProviderNamespaceListerExpansion
+}
+
+// gitHubIdentityProviderNamespaceLister implements the GitHubIdentityProviderNamespaceLister
+// interface.
+type gitHubIdentityProviderNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all GitHubIdentityProviders in the indexer for a given namespace.
+func (s gitHubIdentityProviderNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.GitHubIdentityProvider))
+	})
+	return ret, err
+}
+
+// Get retrieves the GitHubIdentityProvider from the indexer for a given namespace and name.
+func (s gitHubIdentityProviderNamespaceLister) Get(name string) (*v1alpha1.GitHubIdentityProvider, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha1.Resource("githubidentityprovider"), name)
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), nil
+}

generated/1.25/crds/authentication.concierge.pinniped.dev_jwtauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: jwtauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev

generated/1.25/crds/authentication.concierge.pinniped.dev_webhookauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhookauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev

generated/1.25/crds/config.concierge.pinniped.dev_credentialissuers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: credentialissuers.config.concierge.pinniped.dev
 spec:
   group: config.concierge.pinniped.dev

generated/1.25/crds/config.supervisor.pinniped.dev_federationdomains.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: federationdomains.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev

generated/1.25/crds/config.supervisor.pinniped.dev_oidcclients.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: oidcclients.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev

generated/1.25/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: activedirectoryidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

generated/1.25/crds/idp.supervisor.pinniped.dev_githubidentityproviders.yaml

@@ -0,0 +1,326 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.15.0
+  name: githubidentityproviders.idp.supervisor.pinniped.dev
+spec:
+  group: idp.supervisor.pinniped.dev
+  names:
+    categories:
+    - pinniped
+    - pinniped-idp
+    - pinniped-idps
+    kind: GitHubIdentityProvider
+    listKind: GitHubIdentityProviderList
+    plural: githubidentityproviders
+    singular: githubidentityprovider
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.githubAPI.host
+      name: Host
+      type: string
+    - jsonPath: .status.phase
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+          This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+
+
+          Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+          as OIDCClients.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec for configuring the identity provider.
+            properties:
+              allowAuthentication:
+                description: AllowAuthentication allows customization of who can authenticate
+                  using this IDP and how.
+                properties:
+                  organizations:
+                    description: Organizations allows customization of which organizations
+                      can authenticate using this IDP.
+                    properties:
+                      allowed:
+                        description: |-
+                          Allowed, when specified, indicates that only users with membership in at least one of the listed
+                          GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include
+                          teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
+                          provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
+
+
+                          The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
+                          otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
+                          within that organization.
+
+
+                          If no organizations are listed, you must set organizations: AllGitHubUsers.
+                        items:
+                          type: string
+                        maxItems: 64
+                        type: array
+                        x-kubernetes-list-type: set
+                      policy:
+                        default: OnlyUsersFromAllowedOrganizations
+                        description: |-
+                          Policy must be set to "AllGitHubUsers" if allowed is empty.
+
+
+                          This field only exists to ensure that Pinniped administrators are aware that an empty list of
+                          allowedOrganizations means all GitHub users are allowed to log in.
+                        enum:
+                        - OnlyUsersFromAllowedOrganizations
+                        - AllGitHubUsers
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: spec.allowAuthentication.organizations.policy must
+                        be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed
+                        has organizations listed
+                      rule: '!(has(self.allowed) && size(self.allowed) > 0 && self.policy
+                        == ''AllGitHubUsers'')'
+                    - message: spec.allowAuthentication.organizations.policy must
+                        be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed
+                        is empty
+                      rule: '!((!has(self.allowed) || size(self.allowed) == 0) &&
+                        self.policy == ''OnlyUsersFromAllowedOrganizations'')'
+                required:
+                - organizations
+                type: object
+              claims:
+                default: {}
+                description: Claims allows customization of the username and groups
+                  claims.
+                properties:
+                  groups:
+                    default: slug
+                    description: |-
+                      Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
+
+
+                      Can be either "name" or "slug". Defaults to "slug".
+
+
+                      GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
+
+
+                      GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
+
+
+                      Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
+                      forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
+                      or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
+                      the team name or slug.
+
+
+                      If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+                      FederationDomain to further customize how these group names are presented to Kubernetes.
+
+
+                      See the response schema for
+                      [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+                    enum:
+                    - name
+                    - slug
+                    type: string
+                  username:
+                    default: login:id
+                    description: |-
+                      Username configures which property of the GitHub user record shall determine the username in Kubernetes.
+
+
+                      Can be either "id", "login", or "login:id". Defaults to "login:id".
+
+
+                      GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
+                      and may not start or end with hyphens. GitHub users are allowed to change their login name,
+                      although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
+                      then a second user might change their name from "baz" to "foo" in order to take the old
+                      username of the first user. For this reason, it is not as safe to make authorization decisions
+                      based only on the user's login attribute.
+
+
+                      If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+                      FederationDomain to further customize how these usernames are presented to Kubernetes.
+
+
+                      Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
+                      unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
+                      from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
+                      choice to concatenate the two values.
+
+
+                      See the response schema for
+                      [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+                    enum:
+                    - id
+                    - login
+                    - login:id
+                    type: string
+                type: object
+              client:
+                description: Client identifies the secret with credentials for a GitHub
+                  App or GitHub OAuth2 App (a GitHub client).
+                properties:
+                  secretName:
+                    description: |-
+                      SecretName contains the name of a namespace-local Secret object that provides the clientID and
+                      clientSecret for an GitHub App or GitHub OAuth2 client.
+
+
+                      This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
+                    minLength: 1
+                    type: string
+                required:
+                - secretName
+                type: object
+              githubAPI:
+                default: {}
+                description: GitHubAPI allows configuration for GitHub Enterprise
+                  Server
+                properties:
+                  host:
+                    default: github.com
+                    description: |-
+                      Host is required only for GitHub Enterprise Server.
+                      Defaults to using GitHub's public API ("github.com").
+                      Do not specify a protocol or scheme since "https://" will always be used.
+                      Port is optional. Do not specify a path, query, fragment, or userinfo.
+                      Only domain name or IP address, subdomains (optional), and port (optional).
+                      IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
+                      in square brackets. Example: "[::1]:443".
+                    minLength: 1
+                    type: string
+                  tls:
+                    description: TLS configuration for GitHub Enterprise Server.
+                    properties:
+                      certificateAuthorityData:
+                        description: X.509 Certificate Authority (base64-encoded PEM
+                          bundle). If omitted, a default set of system roots will
+                          be trusted.
+                        type: string
+                    type: object
+                type: object
+            required:
+            - allowAuthentication
+            - client
+            type: object
+          status:
+            description: Status of the identity provider.
+            properties:
+              conditions:
+                description: Conditions represents the observations of an identity
+                  provider's current state.
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource.\n---\nThis struct is intended for
+                    direct use as an array at the field path .status.conditions.  For
+                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
+                    observations of a foo's current state.\n\t    // Known .status.conditions.type
+                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
+                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
+                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
+                    \   // other fields\n\t}"
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: |-
+                        type of condition in CamelCase or in foo.example.com/CamelCase.
+                        ---
+                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+                        useful (see .node.status.conditions), the ability to deconflict is important.
+                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              phase:
+                default: Pending
+                description: Phase summarizes the overall status of the GitHubIdentityProvider.
+                enum:
+                - Pending
+                - Ready
+                - Error
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

generated/1.25/crds/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ldapidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

generated/1.25/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: oidcidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

generated/1.26/README.adoc

@@ -1645,6 +1645,285 @@ Optional, when empty this defaults to "objectGUID". +
 |===
 
 
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubapiconfig"]
+==== GitHubAPIConfig 
+
+GitHubAPIConfig allows configuration for GitHub Enterprise Server
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`host`* __string__ | Host is required only for GitHub Enterprise Server. +
+Defaults to using GitHub's public API ("github.com"). +
+Do not specify a protocol or scheme since "https://" will always be used. +
+Port is optional. Do not specify a path, query, fragment, or userinfo. +
+Only domain name or IP address, subdomains (optional), and port (optional). +
+IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address +
+in square brackets. Example: "[::1]:443". +
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration for GitHub Enterprise Server. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec"]
+==== GitHubAllowAuthenticationSpec 
+
+GitHubAllowAuthenticationSpec allows customization of who can authenticate using this IDP and how.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`organizations`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githuborganizationsspec[$$GitHubOrganizationsSpec$$]__ | Organizations allows customization of which organizations can authenticate using this IDP. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githuballowedauthorganizationspolicy"]
+==== GitHubAllowedAuthOrganizationsPolicy (string) 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githuborganizationsspec[$$GitHubOrganizationsSpec$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubclaims"]
+==== GitHubClaims 
+
+GitHubClaims allows customization of the username and groups claims.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`username`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubusernameattribute[$$GitHubUsernameAttribute$$]__ | Username configures which property of the GitHub user record shall determine the username in Kubernetes. +
+
+
+Can be either "id", "login", or "login:id". Defaults to "login:id". +
+
+
+GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens, +
+and may not start or end with hyphens. GitHub users are allowed to change their login name, +
+although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar", +
+then a second user might change their name from "baz" to "foo" in order to take the old +
+username of the first user. For this reason, it is not as safe to make authorization decisions +
+based only on the user's login attribute. +
+
+
+If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's +
+FederationDomain to further customize how these usernames are presented to Kubernetes. +
+
+
+Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and +
+unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value +
+from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable +
+choice to concatenate the two values. +
+
+
+See the response schema for +
+[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user). +
+| *`groups`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubgroupnameattribute[$$GitHubGroupNameAttribute$$]__ | Groups configures which property of the GitHub team record shall determine the group names in Kubernetes. +
+
+
+Can be either "name" or "slug". Defaults to "slug". +
+
+
+GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!"). +
+
+
+GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins"). +
+
+
+Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a +
+forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters +
+or single hyphens, so the first forward slash `/` will be the separator between the organization login name and +
+the team name or slug. +
+
+
+If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's +
+FederationDomain to further customize how these group names are presented to Kubernetes. +
+
+
+See the response schema for +
+[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user). +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubclientspec"]
+==== GitHubClientSpec 
+
+GitHubClientSpec contains information about the GitHub client that this identity provider will use
+for web-based login flows.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and +
+clientSecret for an GitHub App or GitHub OAuth2 client. +
+
+
+This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret". +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubgroupnameattribute"]
+==== GitHubGroupNameAttribute (string) 
+
+GitHubGroupNameAttribute allows the user to specify which attribute from GitHub to use for the group
+names to present to Kubernetes. See the response schema for
+[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityprovider"]
+==== GitHubIdentityProvider 
+
+GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+
+
+Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+as OIDCClients.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderlist[$$GitHubIdentityProviderList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]__ | Spec for configuring the identity provider. +
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus[$$GitHubIdentityProviderStatus$$]__ | Status of the identity provider. +
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderphase"]
+==== GitHubIdentityProviderPhase (string) 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus[$$GitHubIdentityProviderStatus$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderspec"]
+==== GitHubIdentityProviderSpec 
+
+GitHubIdentityProviderSpec is the spec for configuring an GitHub identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityprovider[$$GitHubIdentityProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`githubAPI`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubapiconfig[$$GitHubAPIConfig$$]__ | GitHubAPI allows configuration for GitHub Enterprise Server +
+| *`claims`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]__ | Claims allows customization of the username and groups claims. +
+| *`allowAuthentication`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec[$$GitHubAllowAuthenticationSpec$$]__ | AllowAuthentication allows customization of who can authenticate using this IDP and how. +
+| *`client`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubclientspec[$$GitHubClientSpec$$]__ | Client identifies the secret with credentials for a GitHub App or GitHub OAuth2 App (a GitHub client). +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus"]
+==== GitHubIdentityProviderStatus 
+
+GitHubIdentityProviderStatus is the status of an GitHub identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityprovider[$$GitHubIdentityProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubidentityproviderphase[$$GitHubIdentityProviderPhase$$]__ | Phase summarizes the overall status of the GitHubIdentityProvider. +
+| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#condition-v1-meta[$$Condition$$] array__ | Conditions represents the observations of an identity provider's current state. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githuborganizationsspec"]
+==== GitHubOrganizationsSpec 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec[$$GitHubAllowAuthenticationSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`policy`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githuballowedauthorganizationspolicy[$$GitHubAllowedAuthOrganizationsPolicy$$]__ | Policy must be set to "AllGitHubUsers" if allowed is empty. +
+
+
+This field only exists to ensure that Pinniped administrators are aware that an empty list of +
+allowedOrganizations means all GitHub users are allowed to log in. +
+| *`allowed`* __string array__ | Allowed, when specified, indicates that only users with membership in at least one of the listed +
+GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include +
+teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be +
+provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP. +
+
+
+The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations, +
+otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams +
+within that organization. +
+
+
+If no organizations are listed, you must set organizations: AllGitHubUsers. +
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubusernameattribute"]
+==== GitHubUsernameAttribute (string) 
+
+GitHubUsernameAttribute allows the user to specify which attribute(s) from GitHub to use for the username to present
+to Kubernetes. See the response schema for
+[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]
+****
+
+
+
 [id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-ldapidentityprovider"]
 ==== LDAPIdentityProvider 
 
@@ -2108,11 +2387,12 @@ Parameter is a key/value pair which represents a parameter in an HTTP request.
 [id="{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-tlsspec"]
 ==== TLSSpec 
 
-Configuration for TLS parameters related to identity provider integration.
+TLSSpec provides TLS configuration for identity provider integration.
 
 .Appears In:
 ****
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec[$$ActiveDirectoryIdentityProviderSpec$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-githubapiconfig[$$GitHubAPIConfig$$]
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec[$$LDAPIdentityProviderSpec$$]
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-26-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
 ****

generated/1.26/apis/supervisor/idp/v1alpha1/register.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -36,6 +36,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&LDAPIdentityProviderList{},
 		&ActiveDirectoryIdentityProvider{},
 		&ActiveDirectoryIdentityProviderList{},
+		&GitHubIdentityProvider{},
+		&GitHubIdentityProviderList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

generated/1.26/apis/supervisor/idp/v1alpha1/types_githubidentityprovider.go

@@ -0,0 +1,256 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type GitHubIdentityProviderPhase string
+
+const (
+	// GitHubPhasePending is the default phase for newly-created GitHubIdentityProvider resources.
+	GitHubPhasePending GitHubIdentityProviderPhase = "Pending"
+
+	// GitHubPhaseReady is the phase for an GitHubIdentityProvider resource in a healthy state.
+	GitHubPhaseReady GitHubIdentityProviderPhase = "Ready"
+
+	// GitHubPhaseError is the phase for an GitHubIdentityProvider in an unhealthy state.
+	GitHubPhaseError GitHubIdentityProviderPhase = "Error"
+)
+
+type GitHubAllowedAuthOrganizationsPolicy string
+
+const (
+	// GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers means any GitHub user is allowed to log in using this identity
+	// provider, regardless of their organization membership or lack thereof.
+	GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers GitHubAllowedAuthOrganizationsPolicy = "AllGitHubUsers"
+
+	// GitHubAllowedAuthOrganizationsPolicyOnlyUsersFromAllowedOrganizations means only those users with membership in
+	// the listed GitHub organizations are allowed to log in.
+	GitHubAllowedAuthOrganizationsPolicyOnlyUsersFromAllowedOrganizations GitHubAllowedAuthOrganizationsPolicy = "OnlyUsersFromAllowedOrganizations"
+)
+
+// GitHubIdentityProviderStatus is the status of an GitHub identity provider.
+type GitHubIdentityProviderStatus struct {
+	// Phase summarizes the overall status of the GitHubIdentityProvider.
+	//
+	// +kubebuilder:default=Pending
+	// +kubebuilder:validation:Enum=Pending;Ready;Error
+	Phase GitHubIdentityProviderPhase `json:"phase,omitempty"`
+
+	// Conditions represents the observations of an identity provider's current state.
+	//
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+}
+
+// GitHubAPIConfig allows configuration for GitHub Enterprise Server
+type GitHubAPIConfig struct {
+	// Host is required only for GitHub Enterprise Server.
+	// Defaults to using GitHub's public API ("github.com").
+	// Do not specify a protocol or scheme since "https://" will always be used.
+	// Port is optional. Do not specify a path, query, fragment, or userinfo.
+	// Only domain name or IP address, subdomains (optional), and port (optional).
+	// IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
+	// in square brackets. Example: "[::1]:443".
+	//
+	// +kubebuilder:default="github.com"
+	// +kubebuilder:validation:MinLength=1
+	// +optional
+	Host *string `json:"host"`
+
+	// TLS configuration for GitHub Enterprise Server.
+	//
+	// +optional
+	TLS *TLSSpec `json:"tls,omitempty"`
+}
+
+// GitHubUsernameAttribute allows the user to specify which attribute(s) from GitHub to use for the username to present
+// to Kubernetes. See the response schema for
+// [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+type GitHubUsernameAttribute string
+
+const (
+	// GitHubUsernameID specifies using the `id` attribute from the GitHub user for the username to present to Kubernetes.
+	GitHubUsernameID GitHubUsernameAttribute = "id"
+
+	// GitHubUsernameLogin specifies using the `login` attribute from the GitHub user as the username to present to Kubernetes.
+	GitHubUsernameLogin GitHubUsernameAttribute = "login"
+
+	// GitHubUsernameLoginAndID specifies combining the `login` and `id` attributes from the GitHub user as the
+	// username to present to Kubernetes, separated by a colon. Example: "my-login:1234"
+	GitHubUsernameLoginAndID GitHubUsernameAttribute = "login:id"
+)
+
+// GitHubGroupNameAttribute allows the user to specify which attribute from GitHub to use for the group
+// names to present to Kubernetes. See the response schema for
+// [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+type GitHubGroupNameAttribute string
+
+const (
+	// GitHubUseTeamNameForGroupName specifies using the GitHub team's `name` attribute as the group name to present to Kubernetes.
+	GitHubUseTeamNameForGroupName GitHubGroupNameAttribute = "name"
+
+	// GitHubUseTeamSlugForGroupName specifies using the GitHub team's `slug` attribute as the group name to present to Kubernetes.
+	GitHubUseTeamSlugForGroupName GitHubGroupNameAttribute = "slug"
+)
+
+// GitHubClaims allows customization of the username and groups claims.
+type GitHubClaims struct {
+	// Username configures which property of the GitHub user record shall determine the username in Kubernetes.
+	//
+	// Can be either "id", "login", or "login:id". Defaults to "login:id".
+	//
+	// GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
+	// and may not start or end with hyphens. GitHub users are allowed to change their login name,
+	// although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
+	// then a second user might change their name from "baz" to "foo" in order to take the old
+	// username of the first user. For this reason, it is not as safe to make authorization decisions
+	// based only on the user's login attribute.
+	//
+	// If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+	// FederationDomain to further customize how these usernames are presented to Kubernetes.
+	//
+	// Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
+	// unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
+	// from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
+	// choice to concatenate the two values.
+	//
+	// See the response schema for
+	// [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
+	//
+	// +kubebuilder:default="login:id"
+	// +kubebuilder:validation:Enum={"id","login","login:id"}
+	// +optional
+	Username *GitHubUsernameAttribute `json:"username"`
+
+	// Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
+	//
+	// Can be either "name" or "slug". Defaults to "slug".
+	//
+	// GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
+	//
+	// GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
+	//
+	// Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
+	// forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
+	// or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
+	// the team name or slug.
+	//
+	// If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
+	// FederationDomain to further customize how these group names are presented to Kubernetes.
+	//
+	// See the response schema for
+	// [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
+	//
+	// +kubebuilder:default=slug
+	// +kubebuilder:validation:Enum=name;slug
+	// +optional
+	Groups *GitHubGroupNameAttribute `json:"groups"`
+}
+
+// GitHubClientSpec contains information about the GitHub client that this identity provider will use
+// for web-based login flows.
+type GitHubClientSpec struct {
+	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
+	// clientSecret for an GitHub App or GitHub OAuth2 client.
+	//
+	// This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
+	//
+	// +kubebuilder:validation:MinLength=1
+	SecretName string `json:"secretName"`
+}
+
+type GitHubOrganizationsSpec struct {
+	// Policy must be set to "AllGitHubUsers" if allowed is empty.
+	//
+	// This field only exists to ensure that Pinniped administrators are aware that an empty list of
+	// allowedOrganizations means all GitHub users are allowed to log in.
+	//
+	// +kubebuilder:default=OnlyUsersFromAllowedOrganizations
+	// +kubebuilder:validation:Enum=OnlyUsersFromAllowedOrganizations;AllGitHubUsers
+	// +optional
+	Policy *GitHubAllowedAuthOrganizationsPolicy `json:"policy"`
+
+	// Allowed, when specified, indicates that only users with membership in at least one of the listed
+	// GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include
+	// teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
+	// provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
+	//
+	// The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
+	// otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
+	// within that organization.
+	//
+	// If no organizations are listed, you must set organizations: AllGitHubUsers.
+	//
+	// +kubebuilder:validation:MaxItems=64
+	// +listType=set
+	// +optional
+	Allowed []string `json:"allowed,omitempty"`
+}
+
+// GitHubAllowAuthenticationSpec allows customization of who can authenticate using this IDP and how.
+type GitHubAllowAuthenticationSpec struct {
+	// Organizations allows customization of which organizations can authenticate using this IDP.
+	// +kubebuilder:validation:XValidation:message="spec.allowAuthentication.organizations.policy must be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed has organizations listed",rule="!(has(self.allowed) && size(self.allowed) > 0 && self.policy == 'AllGitHubUsers')"
+	// +kubebuilder:validation:XValidation:message="spec.allowAuthentication.organizations.policy must be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed is empty",rule="!((!has(self.allowed) || size(self.allowed) == 0) && self.policy == 'OnlyUsersFromAllowedOrganizations')"
+	Organizations GitHubOrganizationsSpec `json:"organizations"`
+}
+
+// GitHubIdentityProviderSpec is the spec for configuring an GitHub identity provider.
+type GitHubIdentityProviderSpec struct {
+	// GitHubAPI allows configuration for GitHub Enterprise Server
+	//
+	// +kubebuilder:default={}
+	GitHubAPI GitHubAPIConfig `json:"githubAPI,omitempty"`
+
+	// Claims allows customization of the username and groups claims.
+	//
+	// +kubebuilder:default={}
+	Claims GitHubClaims `json:"claims,omitempty"`
+
+	// AllowAuthentication allows customization of who can authenticate using this IDP and how.
+	AllowAuthentication GitHubAllowAuthenticationSpec `json:"allowAuthentication"`
+
+	// Client identifies the secret with credentials for a GitHub App or GitHub OAuth2 App (a GitHub client).
+	Client GitHubClientSpec `json:"client"`
+}
+
+// GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
+// This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
+//
+// Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
+// as OIDCClients.
+//
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=pinniped;pinniped-idp;pinniped-idps
+// +kubebuilder:printcolumn:name="Host",type=string,JSONPath=`.spec.githubAPI.host`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+// +kubebuilder:subresource:status
+type GitHubIdentityProvider struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec for configuring the identity provider.
+	Spec GitHubIdentityProviderSpec `json:"spec"`
+
+	// Status of the identity provider.
+	Status GitHubIdentityProviderStatus `json:"status,omitempty"`
+}
+
+// GitHubIdentityProviderList lists GitHubIdentityProvider objects.
+//
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type GitHubIdentityProviderList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []GitHubIdentityProvider `json:"items"`
+}

generated/1.26/apis/supervisor/idp/v1alpha1/types_tls.go

@@ -1,9 +1,9 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
 
-// Configuration for TLS parameters related to identity provider integration.
+// TLSSpec provides TLS configuration for identity provider integration.
 type TLSSpec struct {
 	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
 	// +optional

generated/1.26/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -203,6 +203,221 @@ func (in *ActiveDirectoryIdentityProviderUserSearchAttributes) DeepCopy() *Activ
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubAPIConfig) DeepCopyInto(out *GitHubAPIConfig) {
+	*out = *in
+	if in.Host != nil {
+		in, out := &in.Host, &out.Host
+		*out = new(string)
+		**out = **in
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSSpec)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubAPIConfig.
+func (in *GitHubAPIConfig) DeepCopy() *GitHubAPIConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubAPIConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubAllowAuthenticationSpec) DeepCopyInto(out *GitHubAllowAuthenticationSpec) {
+	*out = *in
+	in.Organizations.DeepCopyInto(&out.Organizations)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubAllowAuthenticationSpec.
+func (in *GitHubAllowAuthenticationSpec) DeepCopy() *GitHubAllowAuthenticationSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubAllowAuthenticationSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubClaims) DeepCopyInto(out *GitHubClaims) {
+	*out = *in
+	if in.Username != nil {
+		in, out := &in.Username, &out.Username
+		*out = new(GitHubUsernameAttribute)
+		**out = **in
+	}
+	if in.Groups != nil {
+		in, out := &in.Groups, &out.Groups
+		*out = new(GitHubGroupNameAttribute)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubClaims.
+func (in *GitHubClaims) DeepCopy() *GitHubClaims {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubClaims)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubClientSpec) DeepCopyInto(out *GitHubClientSpec) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubClientSpec.
+func (in *GitHubClientSpec) DeepCopy() *GitHubClientSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubClientSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProvider) DeepCopyInto(out *GitHubIdentityProvider) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProvider.
+func (in *GitHubIdentityProvider) DeepCopy() *GitHubIdentityProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GitHubIdentityProvider) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderList) DeepCopyInto(out *GitHubIdentityProviderList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]GitHubIdentityProvider, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderList.
+func (in *GitHubIdentityProviderList) DeepCopy() *GitHubIdentityProviderList {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GitHubIdentityProviderList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderSpec) DeepCopyInto(out *GitHubIdentityProviderSpec) {
+	*out = *in
+	in.GitHubAPI.DeepCopyInto(&out.GitHubAPI)
+	in.Claims.DeepCopyInto(&out.Claims)
+	in.AllowAuthentication.DeepCopyInto(&out.AllowAuthentication)
+	out.Client = in.Client
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderSpec.
+func (in *GitHubIdentityProviderSpec) DeepCopy() *GitHubIdentityProviderSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubIdentityProviderStatus) DeepCopyInto(out *GitHubIdentityProviderStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubIdentityProviderStatus.
+func (in *GitHubIdentityProviderStatus) DeepCopy() *GitHubIdentityProviderStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubIdentityProviderStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubOrganizationsSpec) DeepCopyInto(out *GitHubOrganizationsSpec) {
+	*out = *in
+	if in.Policy != nil {
+		in, out := &in.Policy, &out.Policy
+		*out = new(GitHubAllowedAuthOrganizationsPolicy)
+		**out = **in
+	}
+	if in.Allowed != nil {
+		in, out := &in.Allowed, &out.Allowed
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubOrganizationsSpec.
+func (in *GitHubOrganizationsSpec) DeepCopy() *GitHubOrganizationsSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubOrganizationsSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LDAPIdentityProvider) DeepCopyInto(out *LDAPIdentityProvider) {
 	*out = *in

generated/1.26/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -15,6 +15,7 @@ const (
 	IDPTypeOIDC            IDPType = "oidc"
 	IDPTypeLDAP            IDPType = "ldap"
 	IDPTypeActiveDirectory IDPType = "activedirectory"
+	IDPTypeGitHub          IDPType = "github"
 
 	IDPFlowCLIPassword     IDPFlow = "cli_password"
 	IDPFlowBrowserAuthcode IDPFlow = "browser_authcode"
@@ -54,7 +55,8 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
-	PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
+	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +66,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_githubidentityprovider.go

@@ -0,0 +1,129 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+
+	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeGitHubIdentityProviders implements GitHubIdentityProviderInterface
+type FakeGitHubIdentityProviders struct {
+	Fake *FakeIDPV1alpha1
+	ns   string
+}
+
+var githubidentityprovidersResource = schema.GroupVersionResource{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "githubidentityproviders"}
+
+var githubidentityprovidersKind = schema.GroupVersionKind{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "GitHubIdentityProvider"}
+
+// Get takes name of the gitHubIdentityProvider, and returns the corresponding gitHubIdentityProvider object, and an error if there is any.
+func (c *FakeGitHubIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(githubidentityprovidersResource, c.ns, name), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// List takes label and field selectors, and returns the list of GitHubIdentityProviders that match those selectors.
+func (c *FakeGitHubIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.GitHubIdentityProviderList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(githubidentityprovidersResource, githubidentityprovidersKind, c.ns, opts), &v1alpha1.GitHubIdentityProviderList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.GitHubIdentityProviderList{ListMeta: obj.(*v1alpha1.GitHubIdentityProviderList).ListMeta}
+	for _, item := range obj.(*v1alpha1.GitHubIdentityProviderList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested gitHubIdentityProviders.
+func (c *FakeGitHubIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(githubidentityprovidersResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a gitHubIdentityProvider and creates it.  Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *FakeGitHubIdentityProviders) Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(githubidentityprovidersResource, c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// Update takes the representation of a gitHubIdentityProvider and updates it. Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *FakeGitHubIdentityProviders) Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(githubidentityprovidersResource, c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeGitHubIdentityProviders) UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(githubidentityprovidersResource, "status", c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}
+
+// Delete takes name of the gitHubIdentityProvider and deletes it. Returns an error if one occurs.
+func (c *FakeGitHubIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteActionWithOptions(githubidentityprovidersResource, c.ns, name, opts), &v1alpha1.GitHubIdentityProvider{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeGitHubIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(githubidentityprovidersResource, c.ns, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.GitHubIdentityProviderList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched gitHubIdentityProvider.
+func (c *FakeGitHubIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(githubidentityprovidersResource, c.ns, name, pt, data, subresources...), &v1alpha1.GitHubIdentityProvider{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), err
+}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_idp_client.go

@@ -19,6 +19,10 @@ func (c *FakeIDPV1alpha1) ActiveDirectoryIdentityProviders(namespace string) v1a
 	return &FakeActiveDirectoryIdentityProviders{c, namespace}
 }
 
+func (c *FakeIDPV1alpha1) GitHubIdentityProviders(namespace string) v1alpha1.GitHubIdentityProviderInterface {
+	return &FakeGitHubIdentityProviders{c, namespace}
+}
+
 func (c *FakeIDPV1alpha1) LDAPIdentityProviders(namespace string) v1alpha1.LDAPIdentityProviderInterface {
 	return &FakeLDAPIdentityProviders{c, namespace}
 }

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/generated_expansion.go

@@ -7,6 +7,8 @@ package v1alpha1
 
 type ActiveDirectoryIdentityProviderExpansion interface{}
 
+type GitHubIdentityProviderExpansion interface{}
+
 type LDAPIdentityProviderExpansion interface{}
 
 type OIDCIdentityProviderExpansion interface{}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,182 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	"time"
+
+	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
+	scheme "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// GitHubIdentityProvidersGetter has a method to return a GitHubIdentityProviderInterface.
+// A group's client should implement this interface.
+type GitHubIdentityProvidersGetter interface {
+	GitHubIdentityProviders(namespace string) GitHubIdentityProviderInterface
+}
+
+// GitHubIdentityProviderInterface has methods to work with GitHubIdentityProvider resources.
+type GitHubIdentityProviderInterface interface {
+	Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.GitHubIdentityProvider, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.GitHubIdentityProviderList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error)
+	GitHubIdentityProviderExpansion
+}
+
+// gitHubIdentityProviders implements GitHubIdentityProviderInterface
+type gitHubIdentityProviders struct {
+	client rest.Interface
+	ns     string
+}
+
+// newGitHubIdentityProviders returns a GitHubIdentityProviders
+func newGitHubIdentityProviders(c *IDPV1alpha1Client, namespace string) *gitHubIdentityProviders {
+	return &gitHubIdentityProviders{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the gitHubIdentityProvider, and returns the corresponding gitHubIdentityProvider object, and an error if there is any.
+func (c *gitHubIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of GitHubIdentityProviders that match those selectors.
+func (c *gitHubIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.GitHubIdentityProviderList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha1.GitHubIdentityProviderList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested gitHubIdentityProviders.
+func (c *gitHubIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a gitHubIdentityProvider and creates it.  Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *gitHubIdentityProviders) Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a gitHubIdentityProvider and updates it. Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
+func (c *gitHubIdentityProviders) Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(gitHubIdentityProvider.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *gitHubIdentityProviders) UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(gitHubIdentityProvider.Name).
+		SubResource("status").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(gitHubIdentityProvider).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the gitHubIdentityProvider and deletes it. Returns an error if one occurs.
+func (c *gitHubIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *gitHubIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched gitHubIdentityProvider.
+func (c *gitHubIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error) {
+	result = &v1alpha1.GitHubIdentityProvider{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("githubidentityproviders").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/idp_client.go

@@ -16,6 +16,7 @@ import (
 type IDPV1alpha1Interface interface {
 	RESTClient() rest.Interface
 	ActiveDirectoryIdentityProvidersGetter
+	GitHubIdentityProvidersGetter
 	LDAPIdentityProvidersGetter
 	OIDCIdentityProvidersGetter
 }
@@ -29,6 +30,10 @@ func (c *IDPV1alpha1Client) ActiveDirectoryIdentityProviders(namespace string) A
 	return newActiveDirectoryIdentityProviders(c, namespace)
 }
 
+func (c *IDPV1alpha1Client) GitHubIdentityProviders(namespace string) GitHubIdentityProviderInterface {
+	return newGitHubIdentityProviders(c, namespace)
+}
+
 func (c *IDPV1alpha1Client) LDAPIdentityProviders(namespace string) LDAPIdentityProviderInterface {
 	return newLDAPIdentityProviders(c, namespace)
 }

generated/1.26/client/supervisor/informers/externalversions/generic.go

@@ -49,6 +49,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		// Group=idp.supervisor.pinniped.dev, Version=v1alpha1
 	case idpv1alpha1.SchemeGroupVersion.WithResource("activedirectoryidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().ActiveDirectoryIdentityProviders().Informer()}, nil
+	case idpv1alpha1.SchemeGroupVersion.WithResource("githubidentityproviders"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().GitHubIdentityProviders().Informer()}, nil
 	case idpv1alpha1.SchemeGroupVersion.WithResource("ldapidentityproviders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().LDAPIdentityProviders().Informer()}, nil
 	case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"):

generated/1.26/client/supervisor/informers/externalversions/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,77 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	time "time"
+
+	idpv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
+	versioned "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned"
+	internalinterfaces "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/internalinterfaces"
+	v1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/listers/idp/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// GitHubIdentityProviderInformer provides access to a shared informer and lister for
+// GitHubIdentityProviders.
+type GitHubIdentityProviderInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.GitHubIdentityProviderLister
+}
+
+type gitHubIdentityProviderInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewGitHubIdentityProviderInformer constructs a new informer for GitHubIdentityProvider type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewGitHubIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredGitHubIdentityProviderInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredGitHubIdentityProviderInformer constructs a new informer for GitHubIdentityProvider type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredGitHubIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IDPV1alpha1().GitHubIdentityProviders(namespace).List(context.TODO(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IDPV1alpha1().GitHubIdentityProviders(namespace).Watch(context.TODO(), options)
+			},
+		},
+		&idpv1alpha1.GitHubIdentityProvider{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *gitHubIdentityProviderInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredGitHubIdentityProviderInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *gitHubIdentityProviderInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&idpv1alpha1.GitHubIdentityProvider{}, f.defaultInformer)
+}
+
+func (f *gitHubIdentityProviderInformer) Lister() v1alpha1.GitHubIdentityProviderLister {
+	return v1alpha1.NewGitHubIdentityProviderLister(f.Informer().GetIndexer())
+}

generated/1.26/client/supervisor/informers/externalversions/idp/v1alpha1/interface.go

@@ -13,6 +13,8 @@ import (
 type Interface interface {
 	// ActiveDirectoryIdentityProviders returns a ActiveDirectoryIdentityProviderInformer.
 	ActiveDirectoryIdentityProviders() ActiveDirectoryIdentityProviderInformer
+	// GitHubIdentityProviders returns a GitHubIdentityProviderInformer.
+	GitHubIdentityProviders() GitHubIdentityProviderInformer
 	// LDAPIdentityProviders returns a LDAPIdentityProviderInformer.
 	LDAPIdentityProviders() LDAPIdentityProviderInformer
 	// OIDCIdentityProviders returns a OIDCIdentityProviderInformer.
@@ -35,6 +37,11 @@ func (v *version) ActiveDirectoryIdentityProviders() ActiveDirectoryIdentityProv
 	return &activeDirectoryIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
+// GitHubIdentityProviders returns a GitHubIdentityProviderInformer.
+func (v *version) GitHubIdentityProviders() GitHubIdentityProviderInformer {
+	return &gitHubIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
 // LDAPIdentityProviders returns a LDAPIdentityProviderInformer.
 func (v *version) LDAPIdentityProviders() LDAPIdentityProviderInformer {
 	return &lDAPIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}

generated/1.26/client/supervisor/listers/idp/v1alpha1/expansion_generated.go

@@ -13,6 +13,14 @@ type ActiveDirectoryIdentityProviderListerExpansion interface{}
 // ActiveDirectoryIdentityProviderNamespaceLister.
 type ActiveDirectoryIdentityProviderNamespaceListerExpansion interface{}
 
+// GitHubIdentityProviderListerExpansion allows custom methods to be added to
+// GitHubIdentityProviderLister.
+type GitHubIdentityProviderListerExpansion interface{}
+
+// GitHubIdentityProviderNamespaceListerExpansion allows custom methods to be added to
+// GitHubIdentityProviderNamespaceLister.
+type GitHubIdentityProviderNamespaceListerExpansion interface{}
+
 // LDAPIdentityProviderListerExpansion allows custom methods to be added to
 // LDAPIdentityProviderLister.
 type LDAPIdentityProviderListerExpansion interface{}

generated/1.26/client/supervisor/listers/idp/v1alpha1/githubidentityprovider.go

@@ -0,0 +1,86 @@
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// GitHubIdentityProviderLister helps list GitHubIdentityProviders.
+// All objects returned here must be treated as read-only.
+type GitHubIdentityProviderLister interface {
+	// List lists all GitHubIdentityProviders in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error)
+	// GitHubIdentityProviders returns an object that can list and get GitHubIdentityProviders.
+	GitHubIdentityProviders(namespace string) GitHubIdentityProviderNamespaceLister
+	GitHubIdentityProviderListerExpansion
+}
+
+// gitHubIdentityProviderLister implements the GitHubIdentityProviderLister interface.
+type gitHubIdentityProviderLister struct {
+	indexer cache.Indexer
+}
+
+// NewGitHubIdentityProviderLister returns a new GitHubIdentityProviderLister.
+func NewGitHubIdentityProviderLister(indexer cache.Indexer) GitHubIdentityProviderLister {
+	return &gitHubIdentityProviderLister{indexer: indexer}
+}
+
+// List lists all GitHubIdentityProviders in the indexer.
+func (s *gitHubIdentityProviderLister) List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.GitHubIdentityProvider))
+	})
+	return ret, err
+}
+
+// GitHubIdentityProviders returns an object that can list and get GitHubIdentityProviders.
+func (s *gitHubIdentityProviderLister) GitHubIdentityProviders(namespace string) GitHubIdentityProviderNamespaceLister {
+	return gitHubIdentityProviderNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// GitHubIdentityProviderNamespaceLister helps list and get GitHubIdentityProviders.
+// All objects returned here must be treated as read-only.
+type GitHubIdentityProviderNamespaceLister interface {
+	// List lists all GitHubIdentityProviders in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error)
+	// Get retrieves the GitHubIdentityProvider from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1alpha1.GitHubIdentityProvider, error)
+	GitHubIdentityProviderNamespaceListerExpansion
+}
+
+// gitHubIdentityProviderNamespaceLister implements the GitHubIdentityProviderNamespaceLister
+// interface.
+type gitHubIdentityProviderNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all GitHubIdentityProviders in the indexer for a given namespace.
+func (s gitHubIdentityProviderNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.GitHubIdentityProvider))
+	})
+	return ret, err
+}
+
+// Get retrieves the GitHubIdentityProvider from the indexer for a given namespace and name.
+func (s gitHubIdentityProviderNamespaceLister) Get(name string) (*v1alpha1.GitHubIdentityProvider, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha1.Resource("githubidentityprovider"), name)
+	}
+	return obj.(*v1alpha1.GitHubIdentityProvider), nil
+}

generated/1.26/crds/authentication.concierge.pinniped.dev_jwtauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: jwtauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev