Merge pull request #2831 from vmware/pinny/bump-deps

Bump dependencies

.github/ISSUE_TEMPLATE/add_new_k8s_version.md

@@ -0,0 +1,36 @@
+---
+name: Add new K8s version
+about: 'Checklist for maintainers to add new K8s minor version'
+title: 'Add new K8s version vX.X'
+labels: ''
+assignees: ''
+
+---
+
+<!-- Note: Please update the issue title to include the new Kubernetes version number. -->
+
+# Adding a new Kubernetes Version
+
+## `pinniped's ci branch`
+
+- [ ] Update `dockerfile-builders` pipeline
+- [ ] Update `pull-requests` pipeline
+- [ ] Update `main` pipeline
+
+## `pinniped`
+
+- [ ] Bump all golang dependencies (especially the `k8s.io` dependencies to use the new minor version).
+  - [ ] Be sure to verify that everything compiles and unit tests pass locally. This is probably a good starting point.
+```shell
+./hack/update-go-mod/update-go-mod.sh
+./hack/module.sh unit
+./hack/prepare-for-integration-tests.sh
+```
+- [ ] Log in to github as pinniped-ci-bot, then go to [this page](https://github.com/pinniped-ci-bot?tab=packages) and change the settings for the new `k8s-code-generator-1.*` image to be publicly visible
+- [ ] Add the new K8s version to `hack/lib/kube-versions.txt` and run code generation.
+
+## General Tasks
+
+- [ ] Consider dropping support for any older versions of Kubernetes
+- [ ] Create stories or chores to take advantage of features in the new Kubernetes version
+- [ ] Close this issue

.github/ISSUE_TEMPLATE/release_checklist.md

@@ -0,0 +1,33 @@
+---
+name: Release checklist
+about: Checklist for maintainers to prepare for an upcoming release
+title: 'Release checklist for vX.X.X'
+labels: ''
+assignees: ''
+
+---
+
+<!-- Note: Please update the issue title to include the planned release's version number. -->
+
+# Release checklist
+
+- [ ] Ensure that Pinniped's dependencies have been upgraded, to the extent desired by the team (refer to the diff output from the latest run of the [all-golang-deps-updated](https://ci.pinniped.broadcom.net/teams/main/pipelines/security-scan/jobs/all-golang-deps-updated/) CI job)
+  - [ ] If you are updating golang in Pinniped, be sure to update golang in CI as well.  Do a search-and-replace to update the version number everywhere in the pinniped `ci` branch.
+  - [ ] If the Fosite library is being updated and the format of the content of the Supervisor's storage Secrets are changed, or if any change to our own code changes the format of the content of the Supervisor's session storage Secrets, then be sure to update the `accessTokenStorageVersion`, `authorizeCodeStorageVersion`, `oidcStorageVersion`, `pkceStorageVersion`, `refreshTokenStorageVersion`, variables in files such as `internal/fositestorage/accesstoken/accesstoken.go`.  Failing tests should signal the need to update these values.
+  - [ ] For go.mod direct dependencies that are v2 or above, such as `github.com/google/go-github/vXX`, check to see if there is a new major version available. Try using `hack/update-go-mod/update-majors.sh`.
+  - [ ] Evaluate all `replace` directives in the `go.mod` file. Are those versions up-to-date? Can any `replace` directives be removed?
+  - [ ] Evaluate all overrides in the `hack/update-go-mod/overrides.conf` file. Are those versions up-to-date? Can those overrides be removed?
+- [ ] Ensure that Pinniped's codegen is up-to-date with the latest Kubernetes releases by making sure this [file](https://github.com/vmware/pinniped/blob/main/hack/lib/kube-versions.txt) is updated compared to the latest releases listed [here for active branches](https://kubernetes.io/releases/) and [here for non-active branches](https://kubernetes.io/releases/patch-releases/#non-active-branch-history)
+- [ ] Ensure that the `k8s-code-generator` CI job definitions are up-to-date with the latest Go, K8s, and `controller-gen` versions
+- [ ] All relevant feature and docs PRs are merged
+- [ ] The [main pipeline](https://ci.pinniped.broadcom.net/teams/main/pipelines/main) is green, up to and including the `ready-to-release` job. Check that the expected git commit has passed the `ready-to-release` job.
+- [ ] Manually trigger the jobs `run-int-misc`, `run-int-cloud-providers`, and `run-int-k8s-versions` in the main pipeline to run other pre-release tests. Depending on the number of Concourse workers, you may need to run these one at a time.
+- [ ] Optional: a blog post for the release is written and submitted as a PR but not merged yet
+- [ ] All merged user stories are accepted (manually tested)
+- [ ] Only after all stories are accepted, manually trigger the `release` job to create a draft GitHub release
+- [ ] Manually edit the draft release notes on the [GitHub release](https://github.com/vmware/pinniped/releases) to describe the contents of the release, using the format which was automatically added to the draft release
+- [ ] Publish (i.e. make public) the draft release
+- [ ] After making the release public, the jobs in the [main pipeline](https://ci.pinniped.broadcom.net/teams/main/pipelines/main) beyond the release job should auto-trigger, so check to make sure that they passed
+- [ ] Edit the blog post's date to make it match the actual release date, and merge the blog post PR to make it live on the website
+- [ ] Publicize the release via tweets, etc.
+- [ ] Close this issue

.github/dependabot.yml

@@ -40,3 +40,100 @@ updates:
 #    directory: "/hack"  # this should keep the FIPS dockerfile updated per https://github.com/dependabot/feedback/issues/145#issuecomment-414738498
 #    schedule:
 #      interval: "daily"
+
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/code-coverage-uploader/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/crane/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/deployment-yaml-formatter/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/eks-deployer/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/gh-cli/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/integration-test-runner/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/integration-test-runner-beta/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/k8s-app-deployer/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/k8s-code-generator/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/pool-trigger-resource/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/test-bitnami-ldap/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/test-cfssl/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/test-dex/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/test-forward-proxy/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/dockerfiles/test-kubectl/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci
+  - package-ecosystem: "docker"
+    directory: "/pipelines/shared-helpers/test-binaries-image/"
+    open-pull-requests-limit: 100
+    schedule:
+      interval: "daily"
+    target-branch: ci

.golangci.yaml

@@ -1,26 +1,15 @@
 # https://golangci-lint.run/usage/configuration/
-run:
-  timeout: 1m
 
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
-    # default linters
-    - errcheck
-    - gosimple
-    - govet
-    - ineffassign
-    - staticcheck
-    - typecheck
-    - unused
-
-    # additional linters for this project (we should disable these if they get annoying).
     - asciicheck
     - bodyclose
-    # - depguard
+    - copyloopvar
     - dogsled
+    - errcheck
     - exhaustive
-    - exportloopref
     - funlen
     - gochecknoglobals
     - gochecknoinits
@@ -28,131 +17,151 @@ linters:
     - gocyclo
     - godot
     - goheader
-    - goimports
-    - revive
     - goprintffuncname
     - gosec
+    - govet
+    - importas
+    - ineffassign
+    - intrange
+    - makezero
     - misspell
     - nakedret
     - nestif
     - noctx
     - nolintlint
     - prealloc
+    - revive
     - rowserrcheck
-    - exportloopref
-    - sqlclosecheck
-    - unconvert
-    - whitespace
-    - copyloopvar
-    - intrange
-    - fatcontext
-    # - canonicalheader Can't do this one since it alerts on valid headers such as X-XSS-Protection
     - spancheck
-    - importas
-    - makezero
-    - prealloc
-    - gofmt
-
-issues:
-  exclude-dirs:
-    - generated
-  exclude-rules:
-    # exclude tests from some rules for things that are useful in a testing context.
-    - path: _test\.go
-      linters:
-        - funlen
-        - gochecknoglobals
-        - revive
-    - path: internal/testutil/
-      linters:
-      - revive
-
-linters-settings:
-  funlen:
-    lines: 150
-    statements: 50
-  goheader:
-    values:
-      regexp:
-        # YYYY or YYYY-YYYY
-        YEARS: \d\d\d\d(-\d\d\d\d)?
-    template: |-
-      Copyright {{YEARS}} the Pinniped contributors. All Rights Reserved.
-      SPDX-License-Identifier: Apache-2.0
-  goimports:
-    local-prefixes: go.pinniped.dev
-  revive:
-    max-open-files: 2048
+    - sqlclosecheck
+    - staticcheck
+    - unconvert
+    - unused
+    - whitespace
+  settings:
+    funlen:
+      lines: 150
+      statements: 50
+    goheader:
+      values:
+        regexp:
+          # YYYY or YYYY-YYYY
+          YEARS: \d\d\d\d(-\d\d\d\d)?
+      template: |-
+        Copyright {{YEARS}} the Pinniped contributors. All Rights Reserved.
+        SPDX-License-Identifier: Apache-2.0
+    importas:
+      alias:
+        - pkg: k8s.io/apimachinery/pkg/util/errors
+          alias: utilerrors
+        - pkg: k8s.io/apimachinery/pkg/api/errors
+          alias: apierrors
+        - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
+          alias: metav1
+        - pkg: k8s.io/api/core/v1
+          alias: corev1
+        - pkg: github.com/coreos/go-oidc/v3/oidc
+          alias: coreosoidc
+        - pkg: github.com/ory/fosite/handler/oauth2
+          alias: fositeoauth2
+        - pkg: github.com/ory/fosite/token/jwt
+          alias: fositejwt
+        - pkg: github.com/go-jose/go-jose/v4/jwt
+          alias: josejwt
+        - pkg: github.com/go-jose/go-jose/v3
+          alias: oldjosev3
+        - pkg: go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1
+          alias: authenticationv1alpha1
+        - pkg: go.pinniped.dev/generated/latest/apis/supervisor/clientsecret/v1alpha1
+          alias: clientsecretv1alpha1
+        - pkg: go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
+          alias: supervisorconfigv1alpha1
+        - pkg: go.pinniped.dev/generated/latest/apis/concierge/config/v1alpha1
+          alias: conciergeconfigv1alpha1
+        - pkg: go.pinniped.dev/generated/latest/client/concierge/clientset/versioned
+          alias: conciergeclientset
+        - pkg: go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/scheme
+          alias: conciergeclientsetscheme
+        - pkg: go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/fake
+          alias: conciergefake
+        - pkg: go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned
+          alias: supervisorclientset
+        - pkg: go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/scheme
+          alias: supervisorclientsetscheme
+        - pkg: go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake
+          alias: supervisorfake
+        - pkg: k8s.io/client-go/kubernetes/fake
+          alias: kubefake
+        - pkg: go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
+          alias: idpv1alpha1
+        - pkg: go.pinniped.dev/generated/latest/client/concierge/informers/externalversions
+          alias: conciergeinformers
+        - pkg: go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions
+          alias: supervisorinformers
+        - pkg: go.pinniped.dev/internal/concierge/scheme
+          alias: conciergescheme
+      no-unaliased: true # All packages explicitly listed above must be aliased
+      no-extra-aliases: false # Allow other aliases than the ones explicitly listed above
+    revive:
+      max-open-files: 2048
+      rules:
+        # Allow unused params that start with underscore. It can be nice to keep unused param names when implementing
+        # an interface sometimes, to help readers understand why it is unused in that particular implementation.
+        - name: unused-parameter
+          arguments:
+            - allowRegex: ^_
+    spancheck:
+      # https://golangci-lint.run/usage/linters/#spancheck
+      checks:
+        - end
+        - record-error
+        - set-status
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
     rules:
-      - name: unused-parameter
-        arguments:
-          # Allow unused params that start with underscore. It can be nice to keep unused param names when implementing
-          # an interface sometimes, to help readers understand why it is unused in that particular implementation.
-          - allowRegex: "^_"
-  spancheck:
-    # https://golangci-lint.run/usage/linters/#spancheck
-    checks:
-    - end
-    - record-error
-    - set-status
-  importas:
-    no-unaliased: true # All packages explicitly listed below must be aliased
-    no-extra-aliases: false # Allow other aliases than the ones explicitly listed below
-    alias:
-    # k8s.io/apimachinery
-    - pkg: k8s.io/apimachinery/pkg/util/errors
-      alias: utilerrors
-    - pkg: k8s.io/apimachinery/pkg/api/errors
-      alias: apierrors
-    - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
-      alias: metav1
-    # k8s.io
-    - pkg: k8s.io/api/core/v1
-      alias: corev1
-    # OAuth2/OIDC/Fosite
-    - pkg: github.com/coreos/go-oidc/v3/oidc
-      alias: coreosoidc
-    - pkg: github.com/ory/fosite/handler/oauth2
-      alias: fositeoauth2
-    # Generated Pinniped
-    - pkg: go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1
-      alias: authenticationv1alpha1
-    - pkg: go.pinniped.dev/generated/latest/apis/supervisor/clientsecret/v1alpha1
-      alias: clientsecretv1alpha1
-    - pkg: go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
-      alias: supervisorconfigv1alpha1
-    - pkg: go.pinniped.dev/generated/latest/apis/concierge/config/v1alpha1
-      alias: conciergeconfigv1alpha1
-    - pkg: go.pinniped.dev/generated/latest/client/concierge/clientset/versioned
-      alias: conciergeclientset
-    - pkg: go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/scheme
-      alias: conciergeclientsetscheme
-    - pkg: go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/fake
-      alias: conciergefake
-    - pkg: go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned
-      alias: supervisorclientset
-    - pkg: go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/scheme
-      alias: supervisorclientsetscheme
-    - pkg: go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake
-      alias: supervisorfake
-    - pkg: go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
-      alias: idpv1alpha1
-    - pkg: go.pinniped.dev/generated/latest/client/concierge/informers/externalversions
-      alias: conciergeinformers
-    - pkg: go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions
-      alias: supervisorinformers
-    # Pinniped internal
-    - pkg: go.pinniped.dev/internal/concierge/scheme
-      alias: conciergescheme
-  gofmt:
-    # Simplify code: gofmt with `-s` option.
-    # Default: true
-    simplify: false
-    # Apply the rewrite rules to the source before reformatting.
-    # https://pkg.go.dev/cmd/gofmt
-    # Default: []
-    rewrite-rules:
-    - pattern: 'interface{}'
-      replacement: 'any'
-    - pattern: 'a[b:len(a)]'
-      replacement: 'a[b:]'
+      # exclude tests from some rules for things that are useful in a testing context.
+      - linters:
+          - funlen
+          - gochecknoglobals
+          - revive
+        path: _test\.go
+      - linters:
+          - revive
+        path: internal/testutil/
+    paths:
+      - generated
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    gofmt:
+      # Simplify code: gofmt with `-s` option.
+      # Default: true
+      simplify: false
+      # Apply the rewrite rules to the source before reformatting.
+      # https://pkg.go.dev/cmd/gofmt
+      # Default: []
+      rewrite-rules:
+        - pattern: interface{}
+          replacement: any
+        - pattern: a[b:len(a)]
+          replacement: a[b:]
+    goimports:
+      local-prefixes:
+        - go.pinniped.dev
+  exclusions:
+    generated: lax
+    paths:
+      - generated
+      - third_party$
+      - builtin$
+      - examples$

ADOPTERS.md

@@ -30,5 +30,5 @@ TMC uses Pinniped to provide a uniform authentication experience across all atta
 ## Adding your organization to the list of adopters
 
 If you are using Pinniped and would like to be included in the list of Pinniped Adopters, add an SVG version of your logo that is less than 150 KB to
-the [img directory](https://github.com/vmware-tanzu/pinniped/tree/main/site/themes/pinniped/static/img) in this repo and submit a pull request with your change including 1-2 sentences describing how your organization is using Pinniped. Name the image file something that
+the [img directory](https://github.com/vmware/pinniped/tree/main/site/themes/pinniped/static/img) in this repo and submit a pull request with your change including 1-2 sentences describing how your organization is using Pinniped. Name the image file something that
 reflects your company (e.g., if your company is called Acme, name the image acme.svg). Please feel free to send us a message in [#pinniped](https://kubernetes.slack.com/archives/C01BW364RJA) with any questions you may have.

CONTRIBUTING.md

@@ -20,26 +20,26 @@ The near-term and mid-term roadmap for the work planned for the project [maintai
 ## Discussion
 
 Got a question, comment, or idea? Please don't hesitate to reach out
-via GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions),
-GitHub [Issues](https://github.com/vmware-tanzu/pinniped/issues),
+via GitHub [Discussions](https://github.com/vmware/pinniped/discussions),
+GitHub [Issues](https://github.com/vmware/pinniped/issues),
 or in the Kubernetes Slack Workspace within the [#pinniped channel](https://go.pinniped.dev/community/slack).
 Join our [Google Group](https://go.pinniped.dev/community/group) to receive updates and meeting invitations.
 
 ## Issues
 
 Need an idea for a project to get started contributing? Take a look at the open
-[issues](https://github.com/vmware-tanzu/pinniped/issues).
+[issues](https://github.com/vmware/pinniped/issues).
 Also check to see if any open issues are labeled with
-["good first issue"](https://github.com/vmware-tanzu/pinniped/labels/good%20first%20issue)
-or ["help wanted"](https://github.com/vmware-tanzu/pinniped/labels/help%20wanted).
+["good first issue"](https://github.com/vmware/pinniped/labels/good%20first%20issue)
+or ["help wanted"](https://github.com/vmware/pinniped/labels/help%20wanted).
 
 ### Bugs
 
 To file a bug report, please first open an
-[issue](https://github.com/vmware-tanzu/pinniped/issues/new?template=bug_report.md). The project team
+[issue](https://github.com/vmware/pinniped/issues/new?template=bug_report.md). The project team
 will work with you on your bug report.
 
-Once the bug has been validated, a [pull request](https://github.com/vmware-tanzu/pinniped/compare)
+Once the bug has been validated, a [pull request](https://github.com/vmware/pinniped/compare)
 can be opened to fix the bug.
 
 For specifics on what to include in your bug report, please follow the
@@ -48,11 +48,11 @@ guidelines in the issue and pull request templates.
 ### Features
 
 To suggest a feature, please first open an
-[issue](https://github.com/vmware-tanzu/pinniped/issues/new?template=feature-proposal.md)
-and tag it with `proposal`, or create a new [Discussion](https://github.com/vmware-tanzu/pinniped/discussions).
+[issue](https://github.com/vmware/pinniped/issues/new?template=feature-proposal.md)
+and tag it with `proposal`, or create a new [Discussion](https://github.com/vmware/pinniped/discussions).
 The project [maintainers](MAINTAINERS.md) will work with you on your feature request.
 
-Once the feature request has been validated, a [pull request](https://github.com/vmware-tanzu/pinniped/compare)
+Once the feature request has been validated, a [pull request](https://github.com/vmware/pinniped/compare)
 can be opened to implement the feature.
 
 For specifics on what to include in your feature request, please follow the
@@ -127,7 +127,7 @@ go build -o pinniped ./cmd/pinniped
    On macOS, these tools can be installed with [Homebrew](https://brew.sh/) (assuming you have Chrome installed already):
 
    ```bash
-   brew install kind vmware-tanzu/carvel/ytt vmware-tanzu/carvel/kapp kubectl nmap && brew cask install docker
+   brew install kind carvel-dev/carvel/ytt carvel-dev/carvel/kapp kubectl nmap && brew cask install docker
    ```
 
 1. Create a kind cluster, compile, create container images, and install Pinniped and supporting test dependencies using:
@@ -144,7 +144,7 @@ go build -o pinniped ./cmd/pinniped
 
    To run specific integration tests, add the `-run` flag to the above command to specify a regexp for the test names.
    Use a leading `/` on the regexp because the Pinniped integration tests are automatically nested under several parent tests
-   (see [integration/main_test.go](https://github.com/vmware-tanzu/pinniped/blob/main/test/integration/main_test.go)).
+   (see [integration/main_test.go](https://github.com/vmware/pinniped/blob/main/test/integration/main_test.go)).
    For example, to run an integration test called `TestE2E`, add `-run /TestE2E` to the command shown above.
 
 1. After making production code changes, recompile, redeploy, and run tests again by repeating the same
@@ -177,13 +177,21 @@ Each run of `hack/prepare-for-integration-tests.sh` can result in different valu
 
 ### Observing Tests on the Continuous Integration Environment
 
-[CI](https://ci.pinniped.dev/teams/main/pipelines/pull-requests)
-will not be triggered on a pull request until the pull request is reviewed and
+CI will not be triggered on a pull request until the pull request is reviewed and
 approved for CI by a project [maintainer](MAINTAINERS.md). Once CI is triggered,
 the progress and results will appear on the Github page for that
-[pull request](https://github.com/vmware-tanzu/pinniped/pulls) as checks. Links
+[pull request](https://github.com/vmware/pinniped/pulls) as checks. Links
 will appear to view the details of each check.
 
+Starting in mid-2025, Pinniped's CI system is no longer externally visible due to corporate policies.
+Please contact the maintainers for help with your PR if you encounter any CI failures.
+They will be happy to share CI logs with you directly for your PR.
+
+## CI
+
+Pinniped's CI configuration and code is in the [`ci`](https://github.com/vmware/pinniped/tree/ci)
+branch of this repo.
+
 ## Documentation
 
 Any pull request which adds a new feature or changes the behavior of any feature which was previously documented

Dockerfile

@@ -1,13 +1,13 @@
 # syntax=docker/dockerfile:1
 
-# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-ARG BUILD_IMAGE=golang:1.22.4@sha256:c2010b9c2342431a24a2e64e33d9eb2e484af49e72c820e200d332d214d5e61f
-ARG BASE_IMAGE=gcr.io/distroless/static:nonroot@sha256:e9ac71e2b8e279a8372741b7a0293afda17650d926900233ec3a7b2b7c22a246
+ARG BUILD_IMAGE=golang:1.25.5@sha256:6cc2338c038bc20f96ab32848da2b5c0641bb9bb5363f2c33e9b7c8838f9a208
+ARG BASE_IMAGE=gcr.io/distroless/static:nonroot@sha256:2b7c93f6d6648c11f0e80a48558c8f77885eb0445213b8e69a6a0d7c89fc6ae4
 
 # Prepare to cross-compile by always running the build stage in the build platform, not the target platform.
-FROM --platform=$BUILDPLATFORM $BUILD_IMAGE as build-env
+FROM --platform=$BUILDPLATFORM $BUILD_IMAGE AS build-env
 
 WORKDIR /work
 
@@ -21,6 +21,9 @@ ENV KUBE_GIT_VERSION=$KUBE_GIT_VERSION
 ARG TARGETOS
 ARG TARGETARCH
 
+# If provided, must be a comma-separated list of Go build tags.
+ARG ADDITIONAL_BUILD_TAGS
+
 # Build the statically linked (CGO_ENABLED=0) binary.
 # Mount source, build cache, and module cache for performance reasons.
 # See https://www.docker.com/blog/faster-multi-platform-builds-dockerfile-cross-compilation-guide/
@@ -29,8 +32,8 @@ RUN \
   --mount=type=cache,target=/cache/gocache \
   --mount=type=cache,target=/cache/gomodcache \
   export GOCACHE=/cache/gocache GOMODCACHE=/cache/gomodcache CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH && \
-  go build -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-concierge-kube-cert-agent ./cmd/pinniped-concierge-kube-cert-agent/... && \
-  go build -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-server ./cmd/pinniped-server/... && \
+  go build -tags $ADDITIONAL_BUILD_TAGS -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-concierge-kube-cert-agent ./cmd/pinniped-concierge-kube-cert-agent/... && \
+  go build -tags $ADDITIONAL_BUILD_TAGS -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-server ./cmd/pinniped-server/... && \
   ln -s /usr/local/bin/pinniped-server /usr/local/bin/pinniped-concierge && \
   ln -s /usr/local/bin/pinniped-server /usr/local/bin/pinniped-supervisor && \
   ln -s /usr/local/bin/pinniped-server /usr/local/bin/local-user-authenticator

GOVERNANCE.md

@@ -11,7 +11,7 @@ all members should work together to achieve this goal.
 # Code of Conduct
 
 The Pinniped community abides by this
-[code of conduct](https://github.com/vmware-tanzu/pinniped/blob/main/CODE_OF_CONDUCT.md).
+[code of conduct](https://github.com/vmware/pinniped/blob/main/CODE_OF_CONDUCT.md).
 
 # Community Roles
 
@@ -29,7 +29,7 @@ notifying one of the maintainers.
 
 **Note:** If a maintainer leaves their employer they are still considered a maintainer of Pinniped, unless they
 voluntarily resign. Employment is not taken into consideration when determining maintainer eligibility unless the
-company itself violates our [Code of Conduct](https://github.com/vmware-tanzu/pinniped/blob/main/CODE_OF_CONDUCT.md).
+company itself violates our [Code of Conduct](https://github.com/vmware/pinniped/blob/main/CODE_OF_CONDUCT.md).
 
 # Decision Making
 

README.md

@@ -19,8 +19,8 @@ Care to kick the tires? It's easy to [install and try Pinniped](https://pinniped
 ## Discussion
 
 Got a question, comment, or idea? Please don't hesitate to reach out
-via GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions),
-GitHub [Issues](https://github.com/vmware-tanzu/pinniped/issues),
+via GitHub [Discussions](https://github.com/vmware/pinniped/discussions),
+GitHub [Issues](https://github.com/vmware/pinniped/issues),
 or in the Kubernetes Slack Workspace within the [#pinniped channel](https://go.pinniped.dev/community/slack).
 Join our [Google Group](https://go.pinniped.dev/community/group) to receive updates and meeting invitations.
 
@@ -37,7 +37,7 @@ building and testing the code, submitting PRs, and other contributor topics.
 ## Adopters
 
 Some organizations and products using Pinniped are featured in [ADOPTERS.md](ADOPTERS.md).
-Add your own organization or product [here](https://github.com/vmware-tanzu/pinniped/discussions/152).
+Add your own organization or product [here](https://github.com/vmware/pinniped/discussions/152).
 
 ## Reporting security vulnerabilities
 
@@ -47,4 +47,4 @@ Please follow the procedure described in [SECURITY.md](SECURITY.md).
 
 Pinniped is open source and licensed under Apache License Version 2.0. See [LICENSE](LICENSE).
 
-Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.

ROADMAP.md

@@ -10,17 +10,17 @@ help determine if a contribution could be conflicting with a longer term plan.
 
 Discussion on the roadmap is welcomed. If you want to provide suggestions, use cases, and feedback to an item in the
 roadmap, please reach out to the maintainers using one of the methods described in the project's
-[README.md](https://github.com/vmware-tanzu/pinniped#discussion).
-[Contributions](https://github.com/vmware-tanzu/pinniped/blob/main/CONTRIBUTING.md) to Pinniped are also welcomed.
+[README.md](https://github.com/vmware/pinniped#discussion).
+[Contributions](https://github.com/vmware/pinniped/blob/main/CONTRIBUTING.md) to Pinniped are also welcomed.
 
 ### How to add an item to the roadmap
 
 One of the most important aspects in any open source community is the concept of proposals. Large changes to the
 codebase and / or new features should be preceded by
-a [proposal](https://github.com/vmware-tanzu/pinniped/tree/main/proposals) in our repo.
+a [proposal](https://github.com/vmware/pinniped/tree/main/proposals) in our repo.
 For smaller enhancements, you can open an issue to track that initiative or feature request.
 We work with and rely on community feedback to focus our efforts to improve Pinniped and maintain a healthy roadmap.
 
 Priorities and requirements change based on community feedback, roadblocks encountered, community contributions,
 etc. If you depend on a specific item, we encourage you to reach out for updated status information, or help us deliver
-that feature by [contributing](https://github.com/vmware-tanzu/pinniped/blob/main/CONTRIBUTING.md) to Pinniped.
+that feature by [contributing](https://github.com/vmware/pinniped/blob/main/CONTRIBUTING.md) to Pinniped.

SECURITY.md

@@ -10,11 +10,11 @@ As of right now, only the latest version of Pinniped is supported.
 
 Security is of the highest importance and all security vulnerabilities or suspected security vulnerabilities should be reported to Pinniped privately, to minimize attacks against current users of Pinniped before they are fixed. Vulnerabilities will be investigated and patched on the next patch (or minor) release as soon as possible. This information could be kept entirely internal to the project.
 
-If you know of a publicly disclosed security vulnerability for Pinniped, please **IMMEDIATELY** contact the VMware Security Team (security@vmware.com). The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
+If you know of a publicly disclosed security vulnerability for Pinniped, please **IMMEDIATELY** contact the VMware Security Team (vmware.psirt@broadcom.com). The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
 
 **IMPORTANT: Do not file public issues on GitHub for security vulnerabilities**
 
-To report a vulnerability or a security-related issue, please contact the VMware email address with the details of the vulnerability. The email will be fielded by the VMware Security Team and then shared with the Pinniped maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/vmware-tanzu/pinniped/issues/new/choose) instead.
+To report a vulnerability or a security-related issue, please contact the VMware email address with the details of the vulnerability. The email will be fielded by the VMware Security Team and then shared with the Pinniped maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/vmware/pinniped/issues/new/choose) instead.
 
 ## Proposed Email Content
 
@@ -48,13 +48,13 @@ The VMware Security Team will respond to vulnerability reports as follows:
 
 ## Public Disclosure Process
 
-The Security Team publishes a [public advisory](https://github.com/vmware-tanzu/pinniped/security/advisories) to the Pinniped community via GitHub. In most cases, additional communication via Slack, Twitter, mailing lists, blog and other channels will assist in educating Pinniped users and rolling out the patched release to affected users.
+The Security Team publishes a [public advisory](https://github.com/vmware/pinniped/security/advisories) to the Pinniped community via GitHub. In most cases, additional communication via Slack, Twitter, mailing lists, blog and other channels will assist in educating Pinniped users and rolling out the patched release to affected users.
 
 The Security Team will also publish any mitigating steps users can take until the fix can be applied to their Pinniped instances. Pinniped distributors will handle creating and publishing their own security advisories.
 
 ## Mailing lists
 
-*   Use security@vmware.com to report security concerns to the VMware Security Team, who uses the list to privately discuss security issues and fixes prior to disclosure. The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
+*   Use vmware.psirt@broadcom.com to report security concerns to the VMware Security Team, who uses the list to privately discuss security issues and fixes prior to disclosure. The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
 *   Join the [Pinniped Distributors](https://groups.google.com/g/project-pinniped-distributors) mailing list for early private information and vulnerability disclosure. Early disclosure may include mitigating steps and additional information on security patch releases. See below for information on how Pinniped distributors or vendors can apply to join this list.
 
 ## Early Disclosure to Pinniped Distributors List
@@ -81,7 +81,7 @@ The information that members receive on the Pinniped Distributors mailing list m
 
 Before you share any information from the list with members of your team who are required to fix the issue, these team members must agree to the same terms, and only be provided with information on a need-to-know basis.
 
-In the unfortunate event that you share information beyond what is permitted by this policy, you must urgently inform the VMware Security Team (security@vmware.com) of exactly what information was leaked and to whom. If you continue to leak information and break the policy outlined here, you will be permanently removed from the list.
+In the unfortunate event that you share information beyond what is permitted by this policy, you must urgently inform the VMware Security Team (vmware.psirt@broadcom.com) of exactly what information was leaked and to whom. If you continue to leak information and break the policy outlined here, you will be permanently removed from the list.
 
 ## Requesting to Join
 

apis/concierge/authentication/v1alpha1/doc.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package

apis/concierge/authentication/v1alpha1/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/authentication/v1alpha1/types_jwtauthenticator.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -18,7 +18,7 @@ const (
 	JWTAuthenticatorPhaseError JWTAuthenticatorPhase = "Error"
 )
 
-// Status of a JWT authenticator.
+// JWTAuthenticatorStatus is the status of a JWT authenticator.
 type JWTAuthenticatorStatus struct {
 	// Represents the observations of the authenticator's current state.
 	// +patchMergeKey=type
@@ -26,46 +26,255 @@ type JWTAuthenticatorStatus struct {
 	// +listType=map
 	// +listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+
 	// Phase summarizes the overall status of the JWTAuthenticator.
 	// +kubebuilder:default=Pending
 	// +kubebuilder:validation:Enum=Pending;Ready;Error
 	Phase JWTAuthenticatorPhase `json:"phase,omitempty"`
 }
 
-// Spec for configuring a JWT authenticator.
+// JWTAuthenticatorSpec is the spec for configuring a JWT authenticator.
 type JWTAuthenticatorSpec struct {
-	// Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
+	// issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
 	// also used to validate the "iss" JWT claim.
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:Pattern=`^https://`
 	Issuer string `json:"issuer"`
 
-	// Audience is the required value of the "aud" JWT claim.
+	// audience is the required value of the "aud" JWT claim.
 	// +kubebuilder:validation:MinLength=1
 	Audience string `json:"audience"`
 
-	// Claims allows customization of the claims that will be mapped to user identity
+	// claims allows customization of the claims that will be mapped to user identity
 	// for Kubernetes access.
 	// +optional
 	Claims JWTTokenClaims `json:"claims"`
 
-	// TLS configuration for communicating with the OIDC provider.
+	// claimValidationRules are rules that are applied to validate token claims to authenticate users.
+	// This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
+	// https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	// This is an advanced configuration option. During an end-user login flow, mistakes in this
+	// configuration will cause the user's login to fail.
+	// +optional
+	ClaimValidationRules []ClaimValidationRule `json:"claimValidationRules,omitempty"`
+
+	// userValidationRules are rules that are applied to final user before completing authentication.
+	// These allow invariants to be applied to incoming identities such as preventing the
+	// use of the system: prefix that is commonly used by Kubernetes components.
+	// The validation rules are logically ANDed together and must all return true for the validation to pass.
+	// This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
+	// https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	// This is an advanced configuration option. During an end-user login flow, mistakes in this
+	// configuration will cause the user's login to fail.
+	// +optional
+	UserValidationRules []UserValidationRule `json:"userValidationRules,omitempty"`
+
+	// tls is the configuration for communicating with the OIDC provider via TLS.
 	// +optional
 	TLS *TLSSpec `json:"tls,omitempty"`
 }
 
+// ClaimValidationRule provides the configuration for a single claim validation rule.
+type ClaimValidationRule struct {
+	// claim is the name of a required claim.
+	// Only string claim keys are supported.
+	// Mutually exclusive with expression and message.
+	// +optional
+	Claim string `json:"claim,omitempty"`
+
+	// requiredValue is the value of a required claim.
+	// Only string claim values are supported.
+	// If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string.
+	// Mutually exclusive with expression and message.
+	// +optional
+	RequiredValue string `json:"requiredValue,omitempty"`
+
+	// expression represents the expression which will be evaluated by CEL.
+	// Must produce a boolean.
+	//
+	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
+	// - 'claims' is a map of claim names to claim values.
+	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
+	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+	// Must return true for the validation to pass.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// Mutually exclusive with claim and requiredValue.
+	// +optional
+	Expression string `json:"expression,omitempty"`
+
+	// message customizes the returned error message when expression returns false.
+	// message is a literal string.
+	// Mutually exclusive with claim and requiredValue.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
+// UserValidationRule provides the configuration for a single user info validation rule.
+type UserValidationRule struct {
+	// expression represents the expression which will be evaluated by CEL.
+	// Must return true for the validation to pass.
+	//
+	// CEL expressions have access to the contents of UserInfo, organized into CEL variable:
+	// - 'user' - authentication.k8s.io/v1, Kind=UserInfo object
+	//    Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition.
+	//    API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// +required
+	Expression string `json:"expression"`
+
+	// message customizes the returned error message when rule returns false.
+	// message is a literal string.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
 // JWTTokenClaims allows customization of the claims that will be mapped to user identity
 // for Kubernetes access.
 type JWTTokenClaims struct {
-	// Groups is the name of the claim which should be read to extract the user's
-	// group membership from the JWT token. When not specified, it will default to "groups".
+	// username is the name of the claim which should be read to extract the
+	// username from the JWT token. When not specified, it will default to "username",
+	// unless usernameExpression is specified.
+	//
+	// Mutually exclusive with usernameExpression. Use either username or usernameExpression to
+	// determine the user's username from the JWT token.
+	// +optional
+	Username string `json:"username"`
+
+	// usernameExpression represents an expression which will be evaluated by CEL.
+	// The expression's result will become the user's username.
+	//
+	// usernameExpression is similar to claimMappings.username.expression from Kubernetes AuthenticationConfiguration
+	// as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	// This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+	// must evaluate to the expected type without errors, or else the user's login will fail.
+	// Additionally, mistakes in this configuration can cause the users to have unintended usernames.
+	//
+	// The expression must produce a non-empty string value.
+	// If the expression uses 'claims.email', then 'claims.email_verified' must be used in
+	// the expression or extra[*].valueExpression or claimValidationRules[*].expression.
+	// An example claim validation rule expression that matches the validation automatically
+	// applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'.
+	// By explicitly comparing the value to true, we let type-checking see the result will be a boolean,
+	// and to make sure a non-boolean email_verified claim will be caught at runtime.
+	//
+	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
+	// - 'claims' is a map of claim names to claim values.
+	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
+	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// Mutually exclusive with username. Use either username or usernameExpression to
+	// determine the user's username from the JWT token.
+	// +optional
+	UsernameExpression string `json:"usernameExpression,omitempty"`
+
+	// groups is the name of the claim which should be read to extract the user's
+	// group membership from the JWT token. When not specified, it will default to "groups",
+	// unless groupsExpression is specified.
+	//
+	// Mutually exclusive with groupsExpression. Use either groups or groupsExpression to
+	// determine the user's group membership from the JWT token.
 	// +optional
 	Groups string `json:"groups"`
 
-	// Username is the name of the claim which should be read to extract the
-	// username from the JWT token. When not specified, it will default to "username".
+	// groupsExpression represents an expression which will be evaluated by CEL.
+	// The expression's result will become the user's group memberships.
+	//
+	// groupsExpression is similar to claimMappings.groups.expression from Kubernetes AuthenticationConfiguration
+	// as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	// This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+	// must evaluate to one of the expected types without errors, or else the user's login will fail.
+	// Additionally, mistakes in this configuration can cause the users to have unintended group memberships.
+	//
+	// The expression must produce a string or string array value.
+	//  "", [], and null values are treated as the group mapping not being present.
+	//
+	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
+	// - 'claims' is a map of claim names to claim values.
+	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
+	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// Mutually exclusive with groups. Use either groups or groupsExpression to
+	// determine the user's group membership from the JWT token.
 	// +optional
-	Username string `json:"username"`
+	GroupsExpression string `json:"groupsExpression,omitempty"`
+
+	// extra is similar to claimMappings.extra from Kubernetes AuthenticationConfiguration
+	// as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	//
+	// However, note that the Pinniped Concierge issues client certificates to users for the purpose
+	// of authenticating, and the Kubernetes API server does not have any mechanism for transmitting
+	// auth extras via client certificates. When configured, these extras will appear in client
+	// certificates issued by the Pinniped Supervisor in the x509 Subject field as Organizational
+	// Units (OU). However, when this client certificate is presented to Kubernetes for authentication,
+	// Kubernetes will ignore these extras. This is probably only useful if you are using a custom
+	// authenticating proxy in front of your Kubernetes API server which can translate these OUs into
+	// auth extras, as described by
+	// https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy.
+	// This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+	// must evaluate to either a string or an array of strings, or else the user's login will fail.
+	//
+	// These keys must be a domain-prefixed path (such as "acme.io/foo") and must not contain an equals sign ("=").
+	//
+	// expression must produce a string or string array value.
+	// If the value is empty, the extra mapping will not be present.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// hard-coded extra key/value
+	// - key: "acme.io/foo"
+	//   valueExpression: "'bar'"
+	// This will result in an extra attribute - acme.io/foo: ["bar"]
+	//
+	// hard-coded key, value copying claim value
+	// - key: "acme.io/foo"
+	//   valueExpression: "claims.some_claim"
+	// This will result in an extra attribute - acme.io/foo: [value of some_claim]
+	//
+	// hard-coded key, value derived from claim value
+	// - key: "acme.io/admin"
+	//   valueExpression: '(has(claims.is_admin) && claims.is_admin) ? "true":""'
+	// This will result in:
+	//  - if is_admin claim is present and true, extra attribute - acme.io/admin: ["true"]
+	//  - if is_admin claim is present and false or is_admin claim is not present, no extra attribute will be added
+	//
+	// +optional
+	Extra []ExtraMapping `json:"extra,omitempty"`
+}
+
+// ExtraMapping provides the configuration for a single extra mapping.
+type ExtraMapping struct {
+	// key is a string to use as the extra attribute key.
+	// key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid
+	// subdomain as defined by RFC 1123. All characters trailing the first "/" must
+	// be valid HTTP Path characters as defined by RFC 3986.
+	// key must be lowercase.
+	// Required to be unique.
+	// Additionally, the key must not contain an equals sign ("=").
+	// +required
+	Key string `json:"key"`
+
+	// valueExpression is a CEL expression to extract extra attribute value.
+	// valueExpression must produce a string or string array value.
+	// "", [], and null values are treated as the extra mapping not being present.
+	// Empty string values contained within a string array are filtered out.
+	//
+	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
+	// - 'claims' is a map of claim names to claim values.
+	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
+	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// +required
+	ValueExpression string `json:"valueExpression"`
 }
 
 // JWTAuthenticator describes the configuration of a JWT authenticator.
@@ -79,20 +288,21 @@ type JWTTokenClaims struct {
 // +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
 // +kubebuilder:printcolumn:name="Issuer",type=string,JSONPath=`.spec.issuer`
 // +kubebuilder:printcolumn:name="Audience",type=string,JSONPath=`.spec.audience`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
 // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
 // +kubebuilder:subresource:status
 type JWTAuthenticator struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	// Spec for configuring the authenticator.
+	// spec for configuring the authenticator.
 	Spec JWTAuthenticatorSpec `json:"spec"`
 
-	// Status of the authenticator.
+	// status of the authenticator.
 	Status JWTAuthenticatorStatus `json:"status,omitempty"`
 }
 
-// List of JWTAuthenticator objects.
+// JWTAuthenticatorList is a list of JWTAuthenticator objects.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type JWTAuthenticatorList struct {
 	metav1.TypeMeta `json:",inline"`

apis/concierge/authentication/v1alpha1/types_tls.go.tmpl

@@ -1,11 +1,47 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
 
-// Configuration for configuring TLS on various authenticators.
+// CertificateAuthorityDataSourceKind enumerates the sources for CA Bundles.
+//
+// +kubebuilder:validation:Enum=Secret;ConfigMap
+type CertificateAuthorityDataSourceKind string
+
+const (
+	// CertificateAuthorityDataSourceKindConfigMap uses a Kubernetes configmap to source CA Bundles.
+	CertificateAuthorityDataSourceKindConfigMap = CertificateAuthorityDataSourceKind("ConfigMap")
+
+	// CertificateAuthorityDataSourceKindSecret uses a Kubernetes secret to source CA Bundles.
+	// Secrets used to source CA Bundles must be of type kubernetes.io/tls or Opaque.
+	CertificateAuthorityDataSourceKindSecret = CertificateAuthorityDataSourceKind("Secret")
+)
+
+// CertificateAuthorityDataSourceSpec provides a source for CA bundle used for client-side TLS verification.
+type CertificateAuthorityDataSourceSpec struct {
+	// Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
+	// Allowed values are "Secret" or "ConfigMap".
+	// "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
+	// "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
+	Kind CertificateAuthorityDataSourceKind `json:"kind"`
+	// Name is the resource name of the secret or configmap from which to read the CA bundle.
+	// The referenced secret or configmap must be created in the same namespace where Pinniped Concierge is installed.
+	// +kubebuilder:validation:MinLength=1
+	Name string `json:"name"`
+	// Key is the key name within the secret or configmap from which to read the CA bundle.
+	// The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
+	// certificate bundle.
+	// +kubebuilder:validation:MinLength=1
+	Key string `json:"key"`
+}
+
+// TLSSpec provides TLS configuration on various authenticators.
 type TLSSpec struct {
 	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
 	// +optional
 	CertificateAuthorityData string `json:"certificateAuthorityData,omitempty"`
+	// Reference to a CA bundle in a secret or a configmap.
+	// Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
+	// +optional
+	CertificateAuthorityDataSource *CertificateAuthorityDataSourceSpec `json:"certificateAuthorityDataSource,omitempty"`
 }

apis/concierge/authentication/v1alpha1/types_webhookauthenticator.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -50,6 +50,7 @@ type WebhookAuthenticatorSpec struct {
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
 // +kubebuilder:printcolumn:name="Endpoint",type=string,JSONPath=`.spec.endpoint`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
 // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
 // +kubebuilder:subresource:status
 type WebhookAuthenticator struct {

apis/concierge/config/v1alpha1/doc.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package

apis/concierge/config/v1alpha1/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -49,6 +49,7 @@ type CredentialIssuerSpec struct {
 }
 
 // ImpersonationProxyMode enumerates the configuration modes for the impersonation proxy.
+// Allowed values are "auto", "enabled", or "disabled".
 //
 // +kubebuilder:validation:Enum=auto;enabled;disabled
 type ImpersonationProxyMode string
@@ -65,6 +66,7 @@ const (
 )
 
 // ImpersonationProxyServiceType enumerates the types of service that can be provisioned for the impersonation proxy.
+// Allowed values are "LoadBalancer", "ClusterIP", or "None".
 //
 // +kubebuilder:validation:Enum=LoadBalancer;ClusterIP;None
 type ImpersonationProxyServiceType string
@@ -159,24 +161,6 @@ type ImpersonationProxyServiceSpec struct {
 type CredentialIssuerStatus struct {
 	// List of integration strategies that were attempted by Pinniped.
 	Strategies []CredentialIssuerStrategy `json:"strategies"`
-
-	// Information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
-	// This field is deprecated and will be removed in a future version.
-	// +optional
-	KubeConfigInfo *CredentialIssuerKubeConfigInfo `json:"kubeConfigInfo,omitempty"`
-}
-
-// CredentialIssuerKubeConfigInfo provides the information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
-// This type is deprecated and will be removed in a future version.
-type CredentialIssuerKubeConfigInfo struct {
-	// The K8s API server URL.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:Pattern=`^https://|^http://`
-	Server string `json:"server"`
-
-	// The K8s API server CA bundle.
-	// +kubebuilder:validation:MinLength=1
-	CertificateAuthorityData string `json:"certificateAuthorityData"`
 }
 
 // CredentialIssuerStrategy describes the status of an integration strategy that was attempted by Pinniped.

apis/concierge/identity/doc.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package

apis/concierge/identity/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package identity

apis/concierge/identity/types_userinfo.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package identity

apis/concierge/identity/types_whoamirequest.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package identity

apis/concierge/identity/v1alpha1/conversion.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/identity/v1alpha1/defaults.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/identity/v1alpha1/doc.go.tmpl

@@ -1,10 +1,11 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
 // +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/identity
 // +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=dev.pinniped.apis.concierge.identity.v1alpha1
 // +groupName=identity.concierge.pinniped.dev
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped identity API.

apis/concierge/identity/v1alpha1/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/identity/v1alpha1/types_userinfo.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/identity/v1alpha1/types_whoamirequest.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/identity/validation/validation.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package validation

apis/concierge/login/doc.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package

apis/concierge/login/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package login

apis/concierge/login/types_clustercredential.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package login

apis/concierge/login/types_tokencredentialrequest.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package login

apis/concierge/login/v1alpha1/conversion.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/login/v1alpha1/defaults.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/login/v1alpha1/doc.go.tmpl

@@ -1,10 +1,11 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
 // +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/login
 // +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=dev.pinniped.apis.concierge.login.v1alpha1
 // +groupName=login.concierge.pinniped.dev
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped login API.

apis/concierge/login/v1alpha1/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/login/v1alpha1/types_clustercredential.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/concierge/login/v1alpha1/types_tokencredentialrequest.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/clientsecret/doc.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package

apis/supervisor/clientsecret/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package clientsecret

apis/supervisor/clientsecret/types_oidcclientsecretrequest.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package clientsecret

apis/supervisor/clientsecret/v1alpha1/conversion.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/clientsecret/v1alpha1/defaults.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/clientsecret/v1alpha1/doc.go.tmpl

@@ -1,10 +1,11 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
 // +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/supervisor/clientsecret
 // +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=dev.pinniped.apis.supervisor.clientsecret.v1alpha1
 // +groupName=clientsecret.supervisor.pinniped.dev
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped client secret API.

apis/supervisor/clientsecret/v1alpha1/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/clientsecret/v1alpha1/types_oidcclientsecretrequest.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/config/v1alpha1/doc.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package

apis/supervisor/config/v1alpha1/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/config/v1alpha1/types_federationdomain.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type FederationDomainTransformsConstant struct {
 	Name string `json:"name"`
 
 	// Type determines the type of the constant, and indicates which other field should be non-empty.
+	// Allowed values are "string" or "stringList".
 	// +kubebuilder:validation:Enum=string;stringList
 	Type string `json:"type"`
 
@@ -70,6 +71,7 @@ type FederationDomainTransformsConstant struct {
 // FederationDomainTransformsExpression defines a transform expression.
 type FederationDomainTransformsExpression struct {
 	// Type determines the type of the expression. It must be one of the supported types.
+	// Allowed values are "policy/v1", "username/v1", or "groups/v1".
 	// +kubebuilder:validation:Enum=policy/v1;username/v1;groups/v1
 	Type string `json:"type"`
 
@@ -207,6 +209,7 @@ type FederationDomainSpec struct {
 	// See
 	// https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
 	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:XValidation:message="issuer must be an HTTPS URL",rule="isURL(self) && url(self).getScheme() == 'https'"
 	Issuer string `json:"issuer"`
 
 	// TLS specifies a secret which will contain Transport Layer Security (TLS) configuration for the FederationDomain.

apis/supervisor/config/v1alpha1/types_oidcclient.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/idp/v1alpha1/doc.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // +k8s:deepcopy-gen=package

apis/supervisor/idp/v1alpha1/register.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/idp/v1alpha1/types_githubidentityprovider.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2024-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -53,9 +53,10 @@ type GitHubIdentityProviderStatus struct {
 type GitHubAPIConfig struct {
 	// Host is required only for GitHub Enterprise Server.
 	// Defaults to using GitHub's public API ("github.com").
+	// For convenience, specifying "github.com" is equivalent to specifying "api.github.com".
 	// Do not specify a protocol or scheme since "https://" will always be used.
 	// Port is optional. Do not specify a path, query, fragment, or userinfo.
-	// Only domain name or IP address, subdomains (optional), and port (optional).
+	// Only specify domain name or IP address, subdomains (optional), and port (optional).
 	// IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
 	// in square brackets. Example: "[::1]:443".
 	//
@@ -65,6 +66,9 @@ type GitHubAPIConfig struct {
 	Host *string `json:"host"`
 
 	// TLS configuration for GitHub Enterprise Server.
+	// Note that this field should not be needed when using GitHub's public API ("github.com").
+	// However, if you choose to specify this field when using GitHub's public API, you must
+	// specify a CA bundle that will verify connections to "api.github.com".
 	//
 	// +optional
 	TLS *TLSSpec `json:"tls,omitempty"`
@@ -167,7 +171,10 @@ type GitHubClientSpec struct {
 }
 
 type GitHubOrganizationsSpec struct {
-	// Policy must be set to "AllGitHubUsers" if allowed is empty.
+	// Allowed values are "OnlyUsersFromAllowedOrganizations" or "AllGitHubUsers".
+	// Defaults to "OnlyUsersFromAllowedOrganizations".
+	//
+	// Must be set to "AllGitHubUsers" if the allowed field is empty.
 	//
 	// This field only exists to ensure that Pinniped administrators are aware that an empty list of
 	// allowedOrganizations means all GitHub users are allowed to log in.

apis/supervisor/idp/v1alpha1/types_ldapidentityprovider.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/idp/v1alpha1/types_tls.go.tmpl

@@ -1,11 +1,47 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
 
+// CertificateAuthorityDataSourceKind enumerates the sources for CA Bundles.
+//
+// +kubebuilder:validation:Enum=Secret;ConfigMap
+type CertificateAuthorityDataSourceKind string
+
+const (
+	// CertificateAuthorityDataSourceKindConfigMap uses a Kubernetes configmap to source CA Bundles.
+	CertificateAuthorityDataSourceKindConfigMap = CertificateAuthorityDataSourceKind("ConfigMap")
+
+	// CertificateAuthorityDataSourceKindSecret uses a Kubernetes secret to source CA Bundles.
+	// Secrets used to source CA Bundles must be of type kubernetes.io/tls or Opaque.
+	CertificateAuthorityDataSourceKindSecret = CertificateAuthorityDataSourceKind("Secret")
+)
+
+// CertificateAuthorityDataSourceSpec provides a source for CA bundle used for client-side TLS verification.
+type CertificateAuthorityDataSourceSpec struct {
+	// Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
+	// Allowed values are "Secret" or "ConfigMap".
+	// "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
+	// "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
+	Kind CertificateAuthorityDataSourceKind `json:"kind"`
+	// Name is the resource name of the secret or configmap from which to read the CA bundle.
+	// The referenced secret or configmap must be created in the same namespace where Pinniped Supervisor is installed.
+	// +kubebuilder:validation:MinLength=1
+	Name string `json:"name"`
+	// Key is the key name within the secret or configmap from which to read the CA bundle.
+	// The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
+	// certificate bundle.
+	// +kubebuilder:validation:MinLength=1
+	Key string `json:"key"`
+}
+
 // TLSSpec provides TLS configuration for identity provider integration.
 type TLSSpec struct {
 	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
 	// +optional
 	CertificateAuthorityData string `json:"certificateAuthorityData,omitempty"`
+	// Reference to a CA bundle in a secret or a configmap.
+	// Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
+	// +optional
+	CertificateAuthorityDataSource *CertificateAuthorityDataSourceSpec `json:"certificateAuthorityDataSource,omitempty"`
 }

apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1

apis/supervisor/oidc/types_supervisor_oidc.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package oidc

cmd/pinniped/cmd/audit_id.go

@@ -0,0 +1,46 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"net/http"
+
+	"go.pinniped.dev/internal/httputil/roundtripper"
+	"go.pinniped.dev/internal/plog"
+)
+
+type auditIDLoggerFunc func(path string, statusCode int, auditID string)
+
+func logAuditID(path string, statusCode int, auditID string) {
+	plog.Info("Received auditID for failed request",
+		"path", path,
+		"statusCode", statusCode,
+		"auditID", auditID)
+}
+
+func LogAuditIDTransportWrapper(rt http.RoundTripper) http.RoundTripper {
+	return logAuditIDTransportWrapper(rt, logAuditID)
+}
+
+func logAuditIDTransportWrapper(rt http.RoundTripper, auditIDLoggerFunc auditIDLoggerFunc) http.RoundTripper {
+	return roundtripper.WrapFunc(rt, func(r *http.Request) (*http.Response, error) {
+		response, responseErr := rt.RoundTrip(r)
+
+		if responseErr != nil ||
+			response == nil ||
+			response.Header.Get("audit-ID") == "" ||
+			response.Request == nil ||
+			response.Request.URL == nil {
+			return response, responseErr
+		}
+
+		// Use the request path from the response's request, in case the
+		// original request was modified by any other roudtrippers in the chain.
+		auditIDLoggerFunc(response.Request.URL.Path,
+			response.StatusCode,
+			response.Header.Get("audit-ID"))
+
+		return response, responseErr
+	})
+}

cmd/pinniped/cmd/audit_id_test.go

@@ -0,0 +1,116 @@
+// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"errors"
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"go.pinniped.dev/internal/httputil/roundtripper"
+)
+
+func TestLogAuditIDTransportWrapper(t *testing.T) {
+	canonicalAuditIdHeaderName := "Audit-Id"
+
+	tests := []struct {
+		name        string
+		response    *http.Response
+		responseErr error
+		want        func(t *testing.T, called func()) auditIDLoggerFunc
+		wantCalled  bool
+	}{
+		{
+			name: "happy HTTP response - no error and no log",
+			response: &http.Response{ // no headers
+				StatusCode: http.StatusOK,
+				Request: &http.Request{
+					URL: &url.URL{
+						Path: "some-path-from-response-request",
+					},
+				},
+			},
+			responseErr: nil,
+			want: func(t *testing.T, called func()) auditIDLoggerFunc {
+				return func(_ string, _ int, _ string) {
+					called()
+				}
+			},
+			wantCalled: false, // make it obvious
+		},
+		{
+			name:        "nil HTTP response - no error and no log",
+			response:    nil,
+			responseErr: nil,
+			want: func(t *testing.T, called func()) auditIDLoggerFunc {
+				return func(_ string, _ int, _ string) {
+					called()
+				}
+			},
+			wantCalled: false, // make it obvious
+		},
+		{
+			name:        "err HTTP response - no error and no log",
+			response:    nil,
+			responseErr: errors.New("some error"),
+			want: func(t *testing.T, called func()) auditIDLoggerFunc {
+				return func(_ string, _ int, _ string) {
+					called()
+				}
+			},
+			wantCalled: false, // make it obvious
+		},
+		{
+			name: "happy HTTP response with audit-ID - logs",
+			response: &http.Response{
+				Header: http.Header{
+					canonicalAuditIdHeaderName: []string{"some-audit-id", "some-other-audit-id-that-will-never-be-seen"},
+				},
+				StatusCode: http.StatusBadGateway, // statusCode does not matter
+				Request: &http.Request{
+					URL: &url.URL{
+						Path: "some-path-from-response-request",
+					},
+				},
+			},
+			want: func(t *testing.T, called func()) auditIDLoggerFunc {
+				return func(path string, statusCode int, auditID string) {
+					called()
+					require.Equal(t, "some-path-from-response-request", path)
+					require.Equal(t, http.StatusBadGateway, statusCode)
+					require.Equal(t, "some-audit-id", auditID)
+				}
+			},
+			wantCalled: true, // make it obvious
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			require.NotNil(t, test.want)
+
+			mockRequest := &http.Request{
+				URL: &url.URL{
+					Path: "should-never-use-this-path",
+				},
+			}
+			var mockRt roundtripper.Func = func(r *http.Request) (*http.Response, error) {
+				require.Equal(t, mockRequest, r)
+				return test.response, test.responseErr
+			}
+			called := false
+			subjectRt := logAuditIDTransportWrapper(mockRt, test.want(t, func() {
+				called = true
+			}))
+			actualResponse, err := subjectRt.RoundTrip(mockRequest) //nolint:bodyclose // there is no Body.
+			require.Equal(t, test.responseErr, err)                 // This roundtripper only returns mocked errors.
+			require.Equal(t, test.response, actualResponse)
+			require.Equal(t, test.wantCalled, called,
+				"want logFunc to be called: %t, actually was called: %t", test.wantCalled, called)
+		})
+	}
+}

cmd/pinniped/cmd/kube_util.go

@@ -1,34 +1,36 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
 
 import (
+	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
+	aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
 
 	conciergeclientset "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned"
 	"go.pinniped.dev/internal/groupsuffix"
 	"go.pinniped.dev/internal/kubeclient"
 )
 
-// getConciergeClientsetFunc is a function that can return a clientset for the Concierge API given a
+// getClientsetsFunc is a function that can return clients for the Concierge and Kubernetes APIs given a
 // clientConfig and the apiGroupSuffix with which the API is running.
-type getConciergeClientsetFunc func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, error)
+type getClientsetsFunc func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, kubernetes.Interface, aggregatorclient.Interface, error)
 
-// getRealConciergeClientset returns a real implementation of a conciergeclientset.Interface.
-func getRealConciergeClientset(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, error) {
+// getRealClientsets returns real implementations of the Concierge and Kubernetes client interfaces.
+func getRealClientsets(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, kubernetes.Interface, aggregatorclient.Interface, error) {
 	restConfig, err := clientConfig.ClientConfig()
 	if err != nil {
-		return nil, err
+		return nil, nil, nil, err
 	}
 	client, err := kubeclient.New(
 		kubeclient.WithConfig(restConfig),
 		kubeclient.WithMiddleware(groupsuffix.New(apiGroupSuffix)),
 	)
 	if err != nil {
-		return nil, err
+		return nil, nil, nil, err
 	}
-	return client.PinnipedConcierge, nil
+	return client.PinnipedConcierge, client.Kubernetes, client.Aggregation, nil
 }
 
 // newClientConfig returns a clientcmd.ClientConfig given an optional kubeconfig path override and

cmd/pinniped/cmd/kubeconfig.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
@@ -20,10 +20,12 @@ import (
 	coreosoidc "github.com/coreos/go-oidc/v3/oidc"
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
 	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
 	_ "k8s.io/client-go/plugin/pkg/client/auth" // Adds handlers for various dynamic auth plugins in client-go
 	"k8s.io/client-go/tools/clientcmd"
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
 
 	authenticationv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	conciergeconfigv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/config/v1alpha1"
@@ -36,15 +38,17 @@ import (
 )
 
 type kubeconfigDeps struct {
+	getenv        func(key string) string
 	getPathToSelf func() (string, error)
-	getClientset  getConciergeClientsetFunc
+	getClientsets getClientsetsFunc
 	log           plog.MinLogger
 }
 
 func kubeconfigRealDeps() kubeconfigDeps {
 	return kubeconfigDeps{
+		getenv:        os.Getenv,
 		getPathToSelf: os.Executable,
-		getClientset:  getRealConciergeClientset,
+		getClientsets: getRealClientsets,
 		log:           plog.New(),
 	}
 }
@@ -156,7 +160,7 @@ func kubeconfigCommand(deps kubeconfigDeps) *cobra.Command {
 		),
 	)
 	f.StringVar(&flags.oidc.upstreamIDPFlow, "upstream-identity-provider-flow", "", fmt.Sprintf("The type of client flow to use with the upstream identity provider during login with a Supervisor (e.g. '%s', '%s')", idpdiscoveryv1alpha1.IDPFlowCLIPassword, idpdiscoveryv1alpha1.IDPFlowBrowserAuthcode))
-	f.StringVar(&flags.kubeconfigPath, "kubeconfig", os.Getenv("KUBECONFIG"), "Path to kubeconfig file")
+	f.StringVar(&flags.kubeconfigPath, "kubeconfig", deps.getenv("KUBECONFIG"), "Path to kubeconfig file")
 	f.StringVar(&flags.kubeconfigContextOverride, "kubeconfig-context", "", "Kubeconfig context name (default: current active context)")
 	f.BoolVar(&flags.skipValidate, "skip-validation", false, "Skip final validation of the kubeconfig (default: false)")
 	f.DurationVar(&flags.timeout, "timeout", 10*time.Minute, "Timeout for autodiscovery and validation")
@@ -213,7 +217,7 @@ func runGetKubeconfig(ctx context.Context, out io.Writer, deps kubeconfigDeps, f
 		return fmt.Errorf("could not load --kubeconfig/--kubeconfig-context: %w", err)
 	}
 	cluster := currentKubeConfig.Clusters[currentKubeconfigNames.ClusterName]
-	clientset, err := deps.getClientset(clientConfig, flags.concierge.apiGroupSuffix)
+	conciergeClient, kubeClient, aggregatorClient, err := deps.getClientsets(clientConfig, flags.concierge.apiGroupSuffix)
 	if err != nil {
 		return fmt.Errorf("could not configure Kubernetes client: %w", err)
 	}
@@ -226,13 +230,15 @@ func runGetKubeconfig(ctx context.Context, out io.Writer, deps kubeconfigDeps, f
 	}
 
 	if !flags.concierge.disabled {
-		credentialIssuer, err := waitForCredentialIssuer(ctx, clientset, flags, deps)
+		// Look up the Concierge's CredentialIssuer, and optionally wait for it to have no pending strategies showing in its status.
+		credentialIssuer, err := waitForCredentialIssuer(ctx, conciergeClient, flags, deps)
 		if err != nil {
 			return err
 		}
 
+		// Decide which Concierge authenticator should be used in the resulting kubeconfig.
 		authenticator, err := lookupAuthenticator(
-			clientset,
+			conciergeClient,
 			flags.concierge.authenticatorType,
 			flags.concierge.authenticatorName,
 			deps.log,
@@ -240,10 +246,15 @@ func runGetKubeconfig(ctx context.Context, out io.Writer, deps kubeconfigDeps, f
 		if err != nil {
 			return err
 		}
+
+		// Discover from the CredentialIssuer how the resulting kubeconfig should be configured to talk to this Concierge.
 		if err := discoverConciergeParams(credentialIssuer, &flags, cluster, deps.log); err != nil {
 			return err
 		}
-		if err := discoverAuthenticatorParams(authenticator, &flags, deps.log); err != nil {
+
+		// Discover how the resulting kubeconfig should interact with the selected authenticator.
+		// For a JWTAuthenticator, this includes discovering how to talk to the OIDC issuer configured in its spec fields.
+		if err := discoverAuthenticatorParams(ctx, authenticator, &flags, kubeClient, aggregatorClient, deps.log); err != nil {
 			return err
 		}
 
@@ -253,6 +264,7 @@ func runGetKubeconfig(ctx context.Context, out io.Writer, deps kubeconfigDeps, f
 	}
 
 	if len(flags.oidc.issuer) > 0 {
+		// The OIDC provider may or may not be a Pinniped Supervisor. Find out.
 		err = pinnipedSupervisorDiscovery(ctx, &flags, deps.log)
 		if err != nil {
 			return err
@@ -404,10 +416,7 @@ func waitForCredentialIssuer(ctx context.Context, clientset conciergeclientset.I
 		deadline, _ := ctx.Deadline()
 		attempts := 1
 
-		for {
-			if !hasPendingStrategy(credentialIssuer) {
-				break
-			}
+		for hasPendingStrategy(credentialIssuer) {
 			logStrategies(credentialIssuer, deps.log)
 			deps.log.Info("waiting for CredentialIssuer pending strategies to finish",
 				"attempts", attempts,
@@ -486,7 +495,14 @@ func logStrategies(credentialIssuer *conciergeconfigv1alpha1.CredentialIssuer, l
 	}
 }
 
-func discoverAuthenticatorParams(authenticator metav1.Object, flags *getKubeconfigParams, log plog.MinLogger) error {
+func discoverAuthenticatorParams(
+	ctx context.Context,
+	authenticator metav1.Object,
+	flags *getKubeconfigParams,
+	kubeClient kubernetes.Interface,
+	aggregatorClient aggregatorclient.Interface,
+	log plog.MinLogger,
+) error {
 	switch auth := authenticator.(type) {
 	case *authenticationv1alpha1.WebhookAuthenticator:
 		// If the --concierge-authenticator-type/--concierge-authenticator-name flags were not set explicitly, set
@@ -518,19 +534,130 @@ func discoverAuthenticatorParams(authenticator metav1.Object, flags *getKubeconf
 		}
 
 		// If the --oidc-ca-bundle flags was not set explicitly, default it to the
-		// spec.tls.certificateAuthorityData field of the JWTAuthenticator.
-		if len(flags.oidc.caBundle) == 0 && auth.Spec.TLS != nil && auth.Spec.TLS.CertificateAuthorityData != "" {
-			decoded, err := base64.StdEncoding.DecodeString(auth.Spec.TLS.CertificateAuthorityData)
+		// spec.tls.certificateAuthorityData field of the JWTAuthenticator, if that field is set, or else
+		// try to discover it from the spec.tls.certificateAuthorityDataSource, if that field is set.
+		if len(flags.oidc.caBundle) == 0 && auth.Spec.TLS != nil {
+			err := discoverOIDCCABundle(ctx, auth, flags, kubeClient, aggregatorClient, log)
 			if err != nil {
-				return fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but JWTAuthenticator %s has invalid spec.tls.certificateAuthorityData: %w", auth.Name, err)
+				return err
 			}
-			log.Info("discovered OIDC CA bundle", "roots", countCACerts(decoded))
-			flags.oidc.caBundle = decoded
 		}
 	}
 	return nil
 }
 
+func discoverOIDCCABundle(
+	ctx context.Context,
+	jwtAuthenticator *authenticationv1alpha1.JWTAuthenticator,
+	flags *getKubeconfigParams,
+	kubeClient kubernetes.Interface,
+	aggregatorClient aggregatorclient.Interface,
+	log plog.MinLogger,
+) error {
+	if jwtAuthenticator.Spec.TLS.CertificateAuthorityData != "" {
+		decodedCABundleData, err := base64.StdEncoding.DecodeString(jwtAuthenticator.Spec.TLS.CertificateAuthorityData)
+		if err != nil {
+			return fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but JWTAuthenticator %s has invalid spec.tls.certificateAuthorityData: %w", jwtAuthenticator.Name, err)
+		}
+		log.Info("discovered OIDC CA bundle", "roots", countCACerts(decodedCABundleData))
+		flags.oidc.caBundle = decodedCABundleData
+	} else if jwtAuthenticator.Spec.TLS.CertificateAuthorityDataSource != nil {
+		caBundleData, err := discoverOIDCCABundleFromCertificateAuthorityDataSource(
+			ctx, jwtAuthenticator, flags.concierge.apiGroupSuffix, kubeClient, aggregatorClient, log)
+		if err != nil {
+			return err
+		}
+		flags.oidc.caBundle = caBundleData
+	}
+	return nil
+}
+
+func discoverOIDCCABundleFromCertificateAuthorityDataSource(
+	ctx context.Context,
+	jwtAuthenticator *authenticationv1alpha1.JWTAuthenticator,
+	apiGroupSuffix string,
+	kubeClient kubernetes.Interface,
+	aggregatorClient aggregatorclient.Interface,
+	log plog.MinLogger,
+) ([]byte, error) {
+	conciergeNamespace, err := discoverConciergeNamespace(ctx, apiGroupSuffix, aggregatorClient)
+	if err != nil {
+		return nil, fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but encountered error discovering namespace of Concierge for JWTAuthenticator %s: %w", jwtAuthenticator.Name, err)
+	}
+	log.Info("discovered Concierge namespace for API group suffix", "apiGroupSuffix", apiGroupSuffix)
+
+	var caBundleData []byte
+	var keyExisted bool
+	caSource := jwtAuthenticator.Spec.TLS.CertificateAuthorityDataSource
+
+	// Note that the Kind, Name, and Key fields must all be non-empty, and Kind must be Secret or ConfigMap, due to CRD validations.
+	switch caSource.Kind {
+	case authenticationv1alpha1.CertificateAuthorityDataSourceKindConfigMap:
+		caBundleConfigMap, err := kubeClient.CoreV1().ConfigMaps(conciergeNamespace).Get(ctx, caSource.Name, metav1.GetOptions{})
+		if err != nil {
+			return nil, fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but encountered error getting %s %s/%s specified by JWTAuthenticator %s spec.tls.certificateAuthorityDataSource: %w",
+				caSource.Kind, conciergeNamespace, caSource.Name, jwtAuthenticator.Name, err)
+		}
+		var caBundleDataStr string
+		caBundleDataStr, keyExisted = caBundleConfigMap.Data[caSource.Key]
+		caBundleData = []byte(caBundleDataStr)
+	case authenticationv1alpha1.CertificateAuthorityDataSourceKindSecret:
+		caBundleSecret, err := kubeClient.CoreV1().Secrets(conciergeNamespace).Get(ctx, caSource.Name, metav1.GetOptions{})
+		if err != nil {
+			return nil, fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but encountered error getting %s %s/%s specified by JWTAuthenticator %s spec.tls.certificateAuthorityDataSource: %w",
+				caSource.Kind, conciergeNamespace, caSource.Name, jwtAuthenticator.Name, err)
+		}
+		caBundleData, keyExisted = caBundleSecret.Data[caSource.Key]
+	default:
+		return nil, fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but JWTAuthenticator %s spec.tls.certificateAuthorityDataSource.Kind value %q is not supported by this CLI version",
+			jwtAuthenticator.Name, caSource.Kind)
+	}
+
+	if !keyExisted {
+		return nil, fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but key %q specified by JWTAuthenticator %s spec.tls.certificateAuthorityDataSource.key does not exist in %s %s/%s",
+			caSource.Key, jwtAuthenticator.Name, caSource.Kind, conciergeNamespace, caSource.Name)
+	}
+
+	if len(caBundleData) == 0 {
+		return nil, fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but key %q specified by JWTAuthenticator %s spec.tls.certificateAuthorityDataSource.key exists but has empty value in %s %s/%s",
+			caSource.Key, jwtAuthenticator.Name, caSource.Kind, conciergeNamespace, caSource.Name)
+	}
+
+	numCACerts := countCACerts(caBundleData)
+	if numCACerts == 0 {
+		return nil, fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but value at key %q specified by JWTAuthenticator %s spec.tls.certificateAuthorityDataSource.key does not contain any CA certificates in %s %s/%s",
+			caSource.Key, jwtAuthenticator.Name, caSource.Kind, conciergeNamespace, caSource.Name)
+	}
+
+	log.Info("discovered OIDC CA bundle from JWTAuthenticator spec.tls.certificateAuthorityDataSource", "roots", numCACerts)
+	return caBundleData, nil
+}
+
+func discoverConciergeNamespace(ctx context.Context, apiGroupSuffix string, aggregatorClient aggregatorclient.Interface) (string, error) {
+	// Let's look for the APIService for the API group of the Concierge's TokenCredentialRequest aggregated API.
+	apiGroup := "login.concierge." + apiGroupSuffix
+
+	// List all APIServices.
+	apiServiceList, err := aggregatorClient.ApiregistrationV1().APIServices().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return "", fmt.Errorf("error listing APIServices: %w", err)
+	}
+
+	// Find one with the expected API group name.
+	for _, apiService := range apiServiceList.Items {
+		if apiService.Spec.Group == apiGroup {
+			if apiService.Spec.Service.Namespace != "" {
+				// We are assuming that all API versions (e.g. v1alpha1) of this API group are backed by service(s)
+				// in the same namespace, which is the namespace of the Concierge hosting this API suffix.
+				return apiService.Spec.Service.Namespace, nil
+			}
+		}
+	}
+
+	// Couldn't find any APIService for the expected API group name which contained a namespace reference in its spec.
+	return "", fmt.Errorf("could not find APIService with non-empty spec.service.namespace for API group %s", apiGroup)
+}
+
 func getConciergeFrontend(credentialIssuer *conciergeconfigv1alpha1.CredentialIssuer, mode conciergeModeFlag) (*conciergeconfigv1alpha1.CredentialIssuerFrontend, error) {
 	for _, strategy := range credentialIssuer.Status.Strategies {
 		// Skip unhealthy strategies.
@@ -538,26 +665,15 @@ func getConciergeFrontend(credentialIssuer *conciergeconfigv1alpha1.CredentialIs
 			continue
 		}
 
-		// Backfill the .status.strategies[].frontend field from .status.kubeConfigInfo for backwards compatibility.
-		if strategy.Type == conciergeconfigv1alpha1.KubeClusterSigningCertificateStrategyType && strategy.Frontend == nil && credentialIssuer.Status.KubeConfigInfo != nil {
-			strategy = *strategy.DeepCopy()
-			strategy.Frontend = &conciergeconfigv1alpha1.CredentialIssuerFrontend{
-				Type: conciergeconfigv1alpha1.TokenCredentialRequestAPIFrontendType,
-				TokenCredentialRequestAPIInfo: &conciergeconfigv1alpha1.TokenCredentialRequestAPIInfo{
-					Server:                   credentialIssuer.Status.KubeConfigInfo.Server,
-					CertificateAuthorityData: credentialIssuer.Status.KubeConfigInfo.CertificateAuthorityData,
-				},
-			}
-		}
-
-		// If the strategy frontend is still nil, skip.
+		// If the strategy frontend is nil, skip.
 		if strategy.Frontend == nil {
 			continue
 		}
 
 		//	Skip any unknown frontend types.
 		switch strategy.Frontend.Type {
-		case conciergeconfigv1alpha1.TokenCredentialRequestAPIFrontendType, conciergeconfigv1alpha1.ImpersonationProxyFrontendType:
+		case conciergeconfigv1alpha1.TokenCredentialRequestAPIFrontendType,
+			conciergeconfigv1alpha1.ImpersonationProxyFrontendType:
 		default:
 			continue
 		}
@@ -743,8 +859,7 @@ func validateKubeconfig(ctx context.Context, flags getKubeconfigParams, kubeconf
 func countCACerts(pemData []byte) int {
 	pool := x509.NewCertPool()
 	pool.AppendCertsFromPEM(pemData)
-	//nolint:staticcheck // since we're not using .Subjects() to access the system pool
-	return len(pool.Subjects())
+	return len(pool.Subjects()) //nolint:staticcheck // there's no other clear way to mimic this legacy behavior
 }
 
 func hasPendingStrategy(credentialIssuer *conciergeconfigv1alpha1.CredentialIssuer) bool {

cmd/pinniped/cmd/login_oidc.go

@@ -224,6 +224,7 @@ func runOIDCLogin(cmd *cobra.Command, deps oidcLoginCommandDeps, flags oidcLogin
 			conciergeclient.WithBase64CABundle(flags.conciergeCABundle),
 			conciergeclient.WithAuthenticator(flags.conciergeAuthenticatorType, flags.conciergeAuthenticatorName),
 			conciergeclient.WithAPIGroupSuffix(flags.conciergeAPIGroupSuffix),
+			conciergeclient.WithTransportWrapper(LogAuditIDTransportWrapper),
 		)
 		if err != nil {
 			return fmt.Errorf("invalid Concierge parameters: %w", err)

cmd/pinniped/cmd/login_oidc_test.go

@@ -274,8 +274,8 @@ func TestLoginOIDCCommand(t *testing.T) {
 			wantOptionsCount: 4,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
 			wantLogs: []string{
-				nowStr + `  cmd/login_oidc.go:267  Performing OIDC login  {"issuer": "test-issuer", "client id": "test-client-id"}`,
-				nowStr + `  cmd/login_oidc.go:287  No concierge configured, skipping token credential exchange`,
+				nowStr + `  cmd/login_oidc.go:268  Performing OIDC login  {"issuer": "test-issuer", "client id": "test-client-id"}`,
+				nowStr + `  cmd/login_oidc.go:288  No concierge configured, skipping token credential exchange`,
 			},
 		},
 		{
@@ -319,10 +319,10 @@ func TestLoginOIDCCommand(t *testing.T) {
 			wantOptionsCount: 12,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"token":"exchanged-token"}}` + "\n",
 			wantLogs: []string{
-				nowStr + `  cmd/login_oidc.go:267  Performing OIDC login  {"issuer": "test-issuer", "client id": "test-client-id"}`,
-				nowStr + `  cmd/login_oidc.go:277  Exchanging token for cluster credential  {"endpoint": "https://127.0.0.1:1234/", "authenticator type": "webhook", "authenticator name": "test-authenticator"}`,
-				nowStr + `  cmd/login_oidc.go:285  Successfully exchanged token for cluster credential.`,
-				nowStr + `  cmd/login_oidc.go:292  caching cluster credential for future use.`,
+				nowStr + `  cmd/login_oidc.go:268  Performing OIDC login  {"issuer": "test-issuer", "client id": "test-client-id"}`,
+				nowStr + `  cmd/login_oidc.go:278  Exchanging token for cluster credential  {"endpoint": "https://127.0.0.1:1234/", "authenticator type": "webhook", "authenticator name": "test-authenticator"}`,
+				nowStr + `  cmd/login_oidc.go:286  Successfully exchanged token for cluster credential.`,
+				nowStr + `  cmd/login_oidc.go:293  caching cluster credential for future use.`,
 			},
 		},
 	}

cmd/pinniped/cmd/login_static.go

@@ -113,6 +113,7 @@ func runStaticLogin(cmd *cobra.Command, deps staticLoginDeps, flags staticLoginP
 			conciergeclient.WithBase64CABundle(flags.conciergeCABundle),
 			conciergeclient.WithAuthenticator(flags.conciergeAuthenticatorType, flags.conciergeAuthenticatorName),
 			conciergeclient.WithAPIGroupSuffix(flags.conciergeAPIGroupSuffix),
+			conciergeclient.WithTransportWrapper(LogAuditIDTransportWrapper),
 		)
 		if err != nil {
 			return fmt.Errorf("invalid Concierge parameters: %w", err)

cmd/pinniped/cmd/login_static_test.go

@@ -147,7 +147,7 @@ func TestLoginStaticCommand(t *testing.T) {
 				Error: could not complete Concierge credential exchange: some concierge error
 			`),
 			wantLogs: []string{
-				nowStr + `  cmd/login_static.go:159  exchanging static token for cluster credential  {"endpoint": "https://127.0.0.1/", "authenticator type": "webhook", "authenticator name": "test-authenticator"}`,
+				nowStr + `  cmd/login_static.go:160  exchanging static token for cluster credential  {"endpoint": "https://127.0.0.1/", "authenticator type": "webhook", "authenticator name": "test-authenticator"}`,
 			},
 		},
 		{

cmd/pinniped/cmd/whoami.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
@@ -24,9 +24,21 @@ import (
 	"go.pinniped.dev/internal/here"
 )
 
+type whoamiDeps struct {
+	getenv        func(key string) string
+	getClientsets getClientsetsFunc
+}
+
+func whoamiRealDeps() whoamiDeps {
+	return whoamiDeps{
+		getenv:        os.Getenv,
+		getClientsets: getRealClientsets,
+	}
+}
+
 //nolint:gochecknoinits
 func init() {
-	rootCmd.AddCommand(newWhoamiCommand(getRealConciergeClientset))
+	rootCmd.AddCommand(newWhoamiCommand(whoamiRealDeps()))
 }
 
 type whoamiFlags struct {
@@ -44,7 +56,7 @@ type clusterInfo struct {
 	url  string
 }
 
-func newWhoamiCommand(getClientset getConciergeClientsetFunc) *cobra.Command {
+func newWhoamiCommand(deps whoamiDeps) *cobra.Command {
 	cmd := &cobra.Command{
 		Args:         cobra.NoArgs, // do not accept positional arguments for this command
 		Use:          "whoami",
@@ -56,21 +68,21 @@ func newWhoamiCommand(getClientset getConciergeClientsetFunc) *cobra.Command {
 	// flags
 	f := cmd.Flags()
 	f.StringVarP(&flags.outputFormat, "output", "o", "text", "Output format (e.g., 'yaml', 'json', 'text')")
-	f.StringVar(&flags.kubeconfigPath, "kubeconfig", os.Getenv("KUBECONFIG"), "Path to kubeconfig file")
+	f.StringVar(&flags.kubeconfigPath, "kubeconfig", deps.getenv("KUBECONFIG"), "Path to kubeconfig file")
 	f.StringVar(&flags.kubeconfigContextOverride, "kubeconfig-context", "", "Kubeconfig context name (default: current active context)")
 	f.StringVar(&flags.apiGroupSuffix, "api-group-suffix", groupsuffix.PinnipedDefaultSuffix, "Concierge API group suffix")
 	f.DurationVar(&flags.timeout, "timeout", 0, "Timeout for the WhoAmI API request (default: 0, meaning no timeout)")
 
 	cmd.RunE = func(cmd *cobra.Command, _ []string) error {
-		return runWhoami(cmd.OutOrStdout(), getClientset, flags)
+		return runWhoami(cmd.OutOrStdout(), deps, flags)
 	}
 
 	return cmd
 }
 
-func runWhoami(output io.Writer, getClientset getConciergeClientsetFunc, flags *whoamiFlags) error {
+func runWhoami(output io.Writer, deps whoamiDeps, flags *whoamiFlags) error {
 	clientConfig := newClientConfig(flags.kubeconfigPath, flags.kubeconfigContextOverride)
-	clientset, err := getClientset(clientConfig, flags.apiGroupSuffix)
+	conciergeClient, _, _, err := deps.getClientsets(clientConfig, flags.apiGroupSuffix)
 	if err != nil {
 		return fmt.Errorf("could not configure Kubernetes client: %w", err)
 	}
@@ -96,7 +108,7 @@ func runWhoami(output io.Writer, getClientset getConciergeClientsetFunc, flags *
 		defer cancelFunc()
 	}
 
-	whoAmI, err := clientset.IdentityV1alpha1().WhoAmIRequests().Create(ctx, &identityv1alpha1.WhoAmIRequest{}, metav1.CreateOptions{})
+	whoAmI, err := conciergeClient.IdentityV1alpha1().WhoAmIRequests().Create(ctx, &identityv1alpha1.WhoAmIRequest{}, metav1.CreateOptions{})
 	if err != nil {
 		hint := ""
 		if apierrors.IsNotFound(err) {

cmd/pinniped/cmd/whoami_test.go

@@ -1,17 +1,20 @@
-// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
 
 import (
 	"bytes"
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes"
 	kubetesting "k8s.io/client-go/testing"
 	"k8s.io/client-go/tools/clientcmd"
+	aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
 
 	identityv1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/identity/v1alpha1"
 	conciergeclientset "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned"
@@ -21,9 +24,25 @@ import (
 )
 
 func TestWhoami(t *testing.T) {
+	helpOutputFormatString := here.Doc(`
+		Print information about the current user
+
+		Usage:
+		  whoami [flags]
+
+		Flags:
+			  --api-group-suffix string     Concierge API group suffix (default "pinniped.dev")
+		  -h, --help                        help for whoami
+			  --kubeconfig string           Path to kubeconfig file%s
+			  --kubeconfig-context string   Kubeconfig context name (default: current active context)
+		  -o, --output string               Output format (e.g., 'yaml', 'json', 'text') (default "text")
+			  --timeout duration            Timeout for the WhoAmI API request (default: 0, meaning no timeout)
+	`)
+
 	tests := []struct {
 		name                   string
 		args                   []string
+		env                    map[string]string
 		groupsOverride         []string
 		gettingClientsetErr    error
 		callingAPIErr          error
@@ -31,22 +50,17 @@ func TestWhoami(t *testing.T) {
 		wantStdout, wantStderr string
 	}{
 		{
-			name: "help flag",
-			args: []string{"--help"},
-			wantStdout: here.Doc(`
-				Print information about the current user
-
-				Usage:
-				  whoami [flags]
-
-				Flags:
-				      --api-group-suffix string     Concierge API group suffix (default "pinniped.dev")
-				  -h, --help                        help for whoami
-				      --kubeconfig string           Path to kubeconfig file
-				      --kubeconfig-context string   Kubeconfig context name (default: current active context)
-				  -o, --output string               Output format (e.g., 'yaml', 'json', 'text') (default "text")
-				      --timeout duration            Timeout for the WhoAmI API request (default: 0, meaning no timeout)
-			`),
+			name:       "help flag passed",
+			args:       []string{"--help"},
+			wantStdout: fmt.Sprintf(helpOutputFormatString, ""),
+		},
+		{
+			name: "help flag passed with KUBECONFIG env var set",
+			env: map[string]string{
+				"KUBECONFIG": "/path/to/kubeconfig",
+			},
+			args:       []string{"--help"},
+			wantStdout: fmt.Sprintf(helpOutputFormatString, ` (default "/path/to/kubeconfig")`),
 		},
 		{
 			name: "text output",
@@ -116,9 +130,7 @@ func TestWhoami(t *testing.T) {
 				{
 				  "kind": "WhoAmIRequest",
 				  "apiVersion": "identity.concierge.pinniped.dev/v1alpha1",
-				  "metadata": {
-				    "creationTimestamp": null
-				  },
+				  "metadata": {},
 				  "spec": {},
 				  "status": {
 				    "kubernetesUserInfo": {
@@ -140,9 +152,7 @@ func TestWhoami(t *testing.T) {
 				{
 				  "kind": "WhoAmIRequest",
 				  "apiVersion": "identity.concierge.tuna.io/v1alpha1",
-				  "metadata": {
-				    "creationTimestamp": null
-				  },
+				  "metadata": {},
 				  "spec": {},
 				  "status": {
 				    "kubernetesUserInfo": {
@@ -163,8 +173,7 @@ func TestWhoami(t *testing.T) {
 			wantStdout: here.Doc(`
 				apiVersion: identity.concierge.pinniped.dev/v1alpha1
 				kind: WhoAmIRequest
-				metadata:
-				  creationTimestamp: null
+				metadata: {}
 				spec: {}
 				status:
 				  kubernetesUserInfo:
@@ -181,8 +190,7 @@ func TestWhoami(t *testing.T) {
 			wantStdout: here.Doc(`
 				apiVersion: identity.concierge.tuna.io/v1alpha1
 				kind: WhoAmIRequest
-				metadata:
-				  creationTimestamp: null
+				metadata: {}
 				spec: {}
 				status:
 				  kubernetesUserInfo:
@@ -278,14 +286,16 @@ func TestWhoami(t *testing.T) {
 			wantStderr:    "Error: could not complete WhoAmIRequest (is the Pinniped WhoAmI API running and healthy?): whoamirequests.identity.concierge.pinniped.dev \"whatever\" not found\n",
 		},
 	}
+
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			getClientset := func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, error) {
+			getClientsetFunc := func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, kubernetes.Interface, aggregatorclient.Interface, error) {
 				if test.gettingClientsetErr != nil {
-					return nil, test.gettingClientsetErr
+					return nil, nil, nil, test.gettingClientsetErr
 				}
-				clientset := conciergefake.NewSimpleClientset()
-				clientset.PrependReactor("create", "whoamirequests", func(_ kubetesting.Action) (bool, runtime.Object, error) {
+				//nolint:staticcheck // our codegen does not yet generate a NewClientset() function
+				conciergeClient := conciergefake.NewSimpleClientset()
+				conciergeClient.PrependReactor("create", "whoamirequests", func(_ kubetesting.Action) (bool, runtime.Object, error) {
 					if test.callingAPIErr != nil {
 						return true, nil, test.callingAPIErr
 					}
@@ -304,9 +314,15 @@ func TestWhoami(t *testing.T) {
 						},
 					}, nil
 				})
-				return clientset, nil
+				return conciergeClient, nil, nil, nil
 			}
-			cmd := newWhoamiCommand(getClientset)
+
+			cmd := newWhoamiCommand(whoamiDeps{
+				getenv: func(key string) string {
+					return test.env[key]
+				},
+				getClientsets: getClientsetFunc,
+			})
 
 			stdout, stderr := bytes.NewBuffer([]byte{}), bytes.NewBuffer([]byte{})
 			cmd.SetOut(stdout)

deploy/concierge/authentication.concierge.pinniped.dev_jwtauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: jwtauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev
@@ -25,6 +25,9 @@ spec:
     - jsonPath: .spec.audience
       name: Audience
       type: string
+    - jsonPath: .status.phase
+      name: Status
+      type: string
     - jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
@@ -34,7 +37,6 @@ spec:
         description: |-
           JWTAuthenticator describes the configuration of a JWT authenticator.
 
-
           Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
           signature, existence of claims, etc.) and extract the username and groups from the token.
         properties:
@@ -56,64 +58,306 @@ spec:
           metadata:
             type: object
           spec:
-            description: Spec for configuring the authenticator.
+            description: spec for configuring the authenticator.
             properties:
               audience:
-                description: Audience is the required value of the "aud" JWT claim.
+                description: audience is the required value of the "aud" JWT claim.
                 minLength: 1
                 type: string
+              claimValidationRules:
+                description: |-
+                  claimValidationRules are rules that are applied to validate token claims to authenticate users.
+                  This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
+                  https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+                  This is an advanced configuration option. During an end-user login flow, mistakes in this
+                  configuration will cause the user's login to fail.
+                items:
+                  description: ClaimValidationRule provides the configuration for
+                    a single claim validation rule.
+                  properties:
+                    claim:
+                      description: |-
+                        claim is the name of a required claim.
+                        Only string claim keys are supported.
+                        Mutually exclusive with expression and message.
+                      type: string
+                    expression:
+                      description: |-
+                        expression represents the expression which will be evaluated by CEL.
+                        Must produce a boolean.
+
+                        CEL expressions have access to the contents of the token claims, organized into CEL variable:
+                        - 'claims' is a map of claim names to claim values.
+                          For example, a variable named 'sub' can be accessed as 'claims.sub'.
+                          Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+                        Must return true for the validation to pass.
+
+                        Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+
+                        Mutually exclusive with claim and requiredValue.
+                      type: string
+                    message:
+                      description: |-
+                        message customizes the returned error message when expression returns false.
+                        message is a literal string.
+                        Mutually exclusive with claim and requiredValue.
+                      type: string
+                    requiredValue:
+                      description: |-
+                        requiredValue is the value of a required claim.
+                        Only string claim values are supported.
+                        If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string.
+                        Mutually exclusive with expression and message.
+                      type: string
+                  type: object
+                type: array
               claims:
                 description: |-
-                  Claims allows customization of the claims that will be mapped to user identity
+                  claims allows customization of the claims that will be mapped to user identity
                   for Kubernetes access.
                 properties:
+                  extra:
+                    description: |-
+                      extra is similar to claimMappings.extra from Kubernetes AuthenticationConfiguration
+                      as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+
+                      However, note that the Pinniped Concierge issues client certificates to users for the purpose
+                      of authenticating, and the Kubernetes API server does not have any mechanism for transmitting
+                      auth extras via client certificates. When configured, these extras will appear in client
+                      certificates issued by the Pinniped Supervisor in the x509 Subject field as Organizational
+                      Units (OU). However, when this client certificate is presented to Kubernetes for authentication,
+                      Kubernetes will ignore these extras. This is probably only useful if you are using a custom
+                      authenticating proxy in front of your Kubernetes API server which can translate these OUs into
+                      auth extras, as described by
+                      https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy.
+                      This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+                      must evaluate to either a string or an array of strings, or else the user's login will fail.
+
+                      These keys must be a domain-prefixed path (such as "acme.io/foo") and must not contain an equals sign ("=").
+
+                      expression must produce a string or string array value.
+                      If the value is empty, the extra mapping will not be present.
+
+                      Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+
+                      hard-coded extra key/value
+                      - key: "acme.io/foo"
+                        valueExpression: "'bar'"
+                      This will result in an extra attribute - acme.io/foo: ["bar"]
+
+                      hard-coded key, value copying claim value
+                      - key: "acme.io/foo"
+                        valueExpression: "claims.some_claim"
+                      This will result in an extra attribute - acme.io/foo: [value of some_claim]
+
+                      hard-coded key, value derived from claim value
+                      - key: "acme.io/admin"
+                        valueExpression: '(has(claims.is_admin) && claims.is_admin) ? "true":""'
+                      This will result in:
+                       - if is_admin claim is present and true, extra attribute - acme.io/admin: ["true"]
+                       - if is_admin claim is present and false or is_admin claim is not present, no extra attribute will be added
+                    items:
+                      description: ExtraMapping provides the configuration for a single
+                        extra mapping.
+                      properties:
+                        key:
+                          description: |-
+                            key is a string to use as the extra attribute key.
+                            key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid
+                            subdomain as defined by RFC 1123. All characters trailing the first "/" must
+                            be valid HTTP Path characters as defined by RFC 3986.
+                            key must be lowercase.
+                            Required to be unique.
+                            Additionally, the key must not contain an equals sign ("=").
+                          type: string
+                        valueExpression:
+                          description: |-
+                            valueExpression is a CEL expression to extract extra attribute value.
+                            valueExpression must produce a string or string array value.
+                            "", [], and null values are treated as the extra mapping not being present.
+                            Empty string values contained within a string array are filtered out.
+
+                            CEL expressions have access to the contents of the token claims, organized into CEL variable:
+                            - 'claims' is a map of claim names to claim values.
+                              For example, a variable named 'sub' can be accessed as 'claims.sub'.
+                              Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+
+                            Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+                          type: string
+                      required:
+                      - key
+                      - valueExpression
+                      type: object
+                    type: array
                   groups:
                     description: |-
-                      Groups is the name of the claim which should be read to extract the user's
-                      group membership from the JWT token. When not specified, it will default to "groups".
+                      groups is the name of the claim which should be read to extract the user's
+                      group membership from the JWT token. When not specified, it will default to "groups",
+                      unless groupsExpression is specified.
+
+                      Mutually exclusive with groupsExpression. Use either groups or groupsExpression to
+                      determine the user's group membership from the JWT token.
+                    type: string
+                  groupsExpression:
+                    description: |-
+                      groupsExpression represents an expression which will be evaluated by CEL.
+                      The expression's result will become the user's group memberships.
+
+                      groupsExpression is similar to claimMappings.groups.expression from Kubernetes AuthenticationConfiguration
+                      as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+                      This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+                      must evaluate to one of the expected types without errors, or else the user's login will fail.
+                      Additionally, mistakes in this configuration can cause the users to have unintended group memberships.
+
+                      The expression must produce a string or string array value.
+                       "", [], and null values are treated as the group mapping not being present.
+
+                      CEL expressions have access to the contents of the token claims, organized into CEL variable:
+                      - 'claims' is a map of claim names to claim values.
+                        For example, a variable named 'sub' can be accessed as 'claims.sub'.
+                        Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+
+                      Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+
+                      Mutually exclusive with groups. Use either groups or groupsExpression to
+                      determine the user's group membership from the JWT token.
                     type: string
                   username:
                     description: |-
-                      Username is the name of the claim which should be read to extract the
-                      username from the JWT token. When not specified, it will default to "username".
+                      username is the name of the claim which should be read to extract the
+                      username from the JWT token. When not specified, it will default to "username",
+                      unless usernameExpression is specified.
+
+                      Mutually exclusive with usernameExpression. Use either username or usernameExpression to
+                      determine the user's username from the JWT token.
+                    type: string
+                  usernameExpression:
+                    description: |-
+                      usernameExpression represents an expression which will be evaluated by CEL.
+                      The expression's result will become the user's username.
+
+                      usernameExpression is similar to claimMappings.username.expression from Kubernetes AuthenticationConfiguration
+                      as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+                      This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+                      must evaluate to the expected type without errors, or else the user's login will fail.
+                      Additionally, mistakes in this configuration can cause the users to have unintended usernames.
+
+                      The expression must produce a non-empty string value.
+                      If the expression uses 'claims.email', then 'claims.email_verified' must be used in
+                      the expression or extra[*].valueExpression or claimValidationRules[*].expression.
+                      An example claim validation rule expression that matches the validation automatically
+                      applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'.
+                      By explicitly comparing the value to true, we let type-checking see the result will be a boolean,
+                      and to make sure a non-boolean email_verified claim will be caught at runtime.
+
+                      CEL expressions have access to the contents of the token claims, organized into CEL variable:
+                      - 'claims' is a map of claim names to claim values.
+                        For example, a variable named 'sub' can be accessed as 'claims.sub'.
+                        Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+
+                      Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+
+                      Mutually exclusive with username. Use either username or usernameExpression to
+                      determine the user's username from the JWT token.
                     type: string
                 type: object
               issuer:
                 description: |-
-                  Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
+                  issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
                   also used to validate the "iss" JWT claim.
                 minLength: 1
                 pattern: ^https://
                 type: string
               tls:
-                description: TLS configuration for communicating with the OIDC provider.
+                description: tls is the configuration for communicating with the OIDC
+                  provider via TLS.
                 properties:
                   certificateAuthorityData:
                     description: X.509 Certificate Authority (base64-encoded PEM bundle).
                       If omitted, a default set of system roots will be trusted.
                     type: string
+                  certificateAuthorityDataSource:
+                    description: |-
+                      Reference to a CA bundle in a secret or a configmap.
+                      Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
+                    properties:
+                      key:
+                        description: |-
+                          Key is the key name within the secret or configmap from which to read the CA bundle.
+                          The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
+                          certificate bundle.
+                        minLength: 1
+                        type: string
+                      kind:
+                        description: |-
+                          Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
+                          Allowed values are "Secret" or "ConfigMap".
+                          "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
+                          "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
+                        enum:
+                        - Secret
+                        - ConfigMap
+                        type: string
+                      name:
+                        description: |-
+                          Name is the resource name of the secret or configmap from which to read the CA bundle.
+                          The referenced secret or configmap must be created in the same namespace where Pinniped Concierge is installed.
+                        minLength: 1
+                        type: string
+                    required:
+                    - key
+                    - kind
+                    - name
+                    type: object
                 type: object
+              userValidationRules:
+                description: |-
+                  userValidationRules are rules that are applied to final user before completing authentication.
+                  These allow invariants to be applied to incoming identities such as preventing the
+                  use of the system: prefix that is commonly used by Kubernetes components.
+                  The validation rules are logically ANDed together and must all return true for the validation to pass.
+                  This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
+                  https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+                  This is an advanced configuration option. During an end-user login flow, mistakes in this
+                  configuration will cause the user's login to fail.
+                items:
+                  description: UserValidationRule provides the configuration for a
+                    single user info validation rule.
+                  properties:
+                    expression:
+                      description: |-
+                        expression represents the expression which will be evaluated by CEL.
+                        Must return true for the validation to pass.
+
+                        CEL expressions have access to the contents of UserInfo, organized into CEL variable:
+                        - 'user' - authentication.k8s.io/v1, Kind=UserInfo object
+                           Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition.
+                           API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io
+
+                        Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+                      type: string
+                    message:
+                      description: |-
+                        message customizes the returned error message when rule returns false.
+                        message is a literal string.
+                      type: string
+                  required:
+                  - expression
+                  type: object
+                type: array
             required:
             - audience
             - issuer
             type: object
           status:
-            description: Status of the authenticator.
+            description: status of the authenticator.
             properties:
               conditions:
                 description: Represents the observations of the authenticator's current
                   state.
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource.\n---\nThis struct is intended for
-                    direct use as an array at the field path .status.conditions.  For
-                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
-                    observations of a foo's current state.\n\t    // Known .status.conditions.type
-                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
-                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
-                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
-                    \   // other fields\n\t}"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
                       description: |-
@@ -154,12 +398,7 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: |-
-                        type of condition in CamelCase or in foo.example.com/CamelCase.
-                        ---
-                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
-                        useful (see .node.status.conditions), the ability to deconflict is important.
-                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

deploy/concierge/authentication.concierge.pinniped.dev_webhookauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: webhookauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev
@@ -22,6 +22,9 @@ spec:
     - jsonPath: .spec.endpoint
       name: Endpoint
       type: string
+    - jsonPath: .status.phase
+      name: Status
+      type: string
     - jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
@@ -63,6 +66,39 @@ spec:
                     description: X.509 Certificate Authority (base64-encoded PEM bundle).
                       If omitted, a default set of system roots will be trusted.
                     type: string
+                  certificateAuthorityDataSource:
+                    description: |-
+                      Reference to a CA bundle in a secret or a configmap.
+                      Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
+                    properties:
+                      key:
+                        description: |-
+                          Key is the key name within the secret or configmap from which to read the CA bundle.
+                          The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
+                          certificate bundle.
+                        minLength: 1
+                        type: string
+                      kind:
+                        description: |-
+                          Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
+                          Allowed values are "Secret" or "ConfigMap".
+                          "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
+                          "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
+                        enum:
+                        - Secret
+                        - ConfigMap
+                        type: string
+                      name:
+                        description: |-
+                          Name is the resource name of the secret or configmap from which to read the CA bundle.
+                          The referenced secret or configmap must be created in the same namespace where Pinniped Concierge is installed.
+                        minLength: 1
+                        type: string
+                    required:
+                    - key
+                    - kind
+                    - name
+                    type: object
                 type: object
             required:
             - endpoint
@@ -74,16 +110,8 @@ spec:
                 description: Represents the observations of the authenticator's current
                   state.
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource.\n---\nThis struct is intended for
-                    direct use as an array at the field path .status.conditions.  For
-                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
-                    observations of a foo's current state.\n\t    // Known .status.conditions.type
-                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
-                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
-                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
-                    \   // other fields\n\t}"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
                       description: |-
@@ -124,12 +152,7 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: |-
-                        type of condition in CamelCase or in foo.example.com/CamelCase.
-                        ---
-                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
-                        useful (see .node.status.conditions), the ability to deconflict is important.
-                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: credentialissuers.config.concierge.pinniped.dev
 spec:
   group: config.concierge.pinniped.dev
@@ -61,7 +61,6 @@ spec:
                       ExternalEndpoint describes the HTTPS endpoint where the proxy will be exposed. If not set, the proxy will
                       be served using the external name of the LoadBalancer service or the cluster service DNS name.
 
-
                       This field must be non-empty when spec.impersonationProxy.service.type is "None".
                     type: string
                   mode:
@@ -99,7 +98,6 @@ spec:
                         description: |-
                           Type specifies the type of Service to provision for the impersonation proxy.
 
-
                           If the type is "None", then the "spec.impersonationProxy.externalEndpoint" field must be set to a non-empty
                           value so that the Concierge can properly advertise the endpoint in the CredentialIssuer's status.
                         enum:
@@ -112,7 +110,6 @@ spec:
                     description: |-
                       TLS contains information about how the Concierge impersonation proxy should serve TLS.
 
-
                       If this field is empty, the impersonation proxy will generate its own TLS certificate.
                     properties:
                       certificateAuthorityData:
@@ -137,24 +134,6 @@ spec:
           status:
             description: CredentialIssuerStatus describes the status of the Concierge.
             properties:
-              kubeConfigInfo:
-                description: |-
-                  Information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
-                  This field is deprecated and will be removed in a future version.
-                properties:
-                  certificateAuthorityData:
-                    description: The K8s API server CA bundle.
-                    minLength: 1
-                    type: string
-                  server:
-                    description: The K8s API server URL.
-                    minLength: 1
-                    pattern: ^https://|^http://
-                    type: string
-                required:
-                - certificateAuthorityData
-                - server
-                type: object
               strategies:
                 description: List of integration strategies that were attempted by
                   Pinniped.

deploy/concierge/deployment.yaml

@@ -1,9 +1,18 @@
-#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
 #@ load("@ytt:json", "json")
-#@ load("helpers.lib.yaml", "defaultLabel", "labels", "deploymentPodLabel", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix", "getAndValidateLogLevel", "pinnipedDevAPIGroupWithPrefix")
+#@ load("helpers.lib.yaml",
+#@   "defaultLabel",
+#@   "labels",
+#@   "deploymentPodLabel",
+#@   "namespace",
+#@   "defaultResourceName",
+#@   "defaultResourceNameWithSuffix",
+#@   "getAndValidateLogLevel",
+#@   "pinnipedDevAPIGroupWithPrefix",
+#@ )
 #@ load("@ytt:template", "template")
 
 #@ if not data.values.into_namespace:
@@ -68,6 +77,7 @@ data:
     apiGroupSuffix: (@= data.values.api_group_suffix @)
     # aggregatedAPIServerPort may be set here, although other YAML references to the default port (10250) may also need to be updated
     # impersonationProxyServerPort may be set here, although other YAML references to the default port (8444) may also need to be updated
+    aggregatedAPIServerDisableAdmissionPlugins: []
     names:
       servingCertificateSecret: (@= defaultResourceNameWithSuffix("api-tls-serving-certificate") @)
       credentialIssuer: (@= defaultResourceNameWithSuffix("config") @)
@@ -83,6 +93,7 @@ data:
     labels: (@= json.encode(labels()).rstrip() @)
     kubeCertAgent:
       namePrefix: (@= defaultResourceNameWithSuffix("kube-cert-agent-") @)
+      priorityClassName: (@= data.values.kube_cert_agent_priority_class_name @)
       (@ if data.values.kube_cert_agent_image: @)
       image: (@= data.values.kube_cert_agent_image @)
       (@ else: @)
@@ -94,15 +105,17 @@ data:
       (@ end @)
       (@ if data.values.image_pull_dockerconfigjson: @)
       imagePullSecrets:
-        - image-pull-secret
+      - image-pull-secret
       (@ end @)
     (@ if data.values.log_level: @)
     log:
       level: (@= getAndValidateLogLevel() @)
-    (@ end @)
+      (@ end @)
     tls:
       onedottwo:
         allowedCiphers: (@= str(data.values.allowed_ciphers_for_tls_onedottwo) @)
+    audit:
+      logUsernamesAndGroups: (@= data.values.audit.log_usernames_and_groups @)
 ---
 #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
 apiVersion: v1

deploy/concierge/helpers.lib.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")

deploy/concierge/values.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ def validate_strings_map(obj):
@@ -52,7 +52,7 @@ replicas: 2
 #@schema/title "Image repo"
 #@schema/desc "The repository for the Concierge container image."
 #@schema/validation min_len=1
-image_repo: ghcr.io/vmware-tanzu/pinniped/pinniped-server
+image_repo: ghcr.io/vmware/pinniped/pinniped-server
 
 #@schema/title "Image digest"
 #@schema/desc "The image digest for the Concierge container image. If both image_digest or an image_tag are given, only image_digest will be used."
@@ -68,15 +68,24 @@ image_digest: ""
 image_tag: latest
 
 #@schema/title "Kube Cert Agent image"
-#@ kube_cert_agent_image = "Optionally specify a different image for the 'kube-cert-agent' pod which is scheduled \
+#@ kube_cert_agent_image_desc = "Optionally specify a different image for the 'kube-cert-agent' pod which is scheduled \
 #@ on the control plane. This image needs only to include `sleep` and `cat` binaries. \
 #@ By default, the same image specified for image_repo/image_digest/image_tag will be re-used."
-#@schema/desc kube_cert_agent_image
-#@schema/examples ("Image including tag or digest", "ghcr.io/vmware-tanzu/pinniped/pinniped-server:latest")
+#@schema/desc kube_cert_agent_image_desc
+#@schema/examples ("Image including tag or digest", "ghcr.io/vmware/pinniped/pinniped-server:latest")
 #@schema/nullable
 #@schema/validation min_len=1
 kube_cert_agent_image: ""
 
+#@schema/title "Kube Cert Agent Priority Class Name"
+#@ kube_cert_agent_priority_class_name_desc = "Optionally specify a PriorityClassName for the 'kube-cert-agent' pod. \
+#@ See https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/ for more details. \
+#@ By default, this is the empty string."
+#@schema/desc kube_cert_agent_priority_class_name_desc
+#@schema/examples ("name of a PriorityClass object", "high-priority")
+#@schema/validation min_len=0
+kube_cert_agent_priority_class_name: ""
+
 #@schema/title "Image pull dockerconfigjson"
 #@ image_pull_dockerconfigjson_desc = "A base64 encoded secret to be used when pulling the `image_repo` container image. \
 #@ Can be used when the image_repo is a private registry. Typically, the value would be the output of: \
@@ -231,3 +240,15 @@ no_proxy: "$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost,.svc,.
 #! An empty array is perfectly valid, as is any array of strings.
 allowed_ciphers_for_tls_onedottwo:
 - ""
+
+#@schema/title "Audit logging configuration"
+#@schema/desc "Customize the content of audit log events."
+audit:
+
+  #@schema/title "Log usernames and groups"
+  #@ log_usernames_and_groups_desc = "Enables or disables printing usernames and group names in audit logs. Options are 'enabled' or 'disabled'. \
+  #@ If enabled, usernames are group names may be printed in audit log events. \
+  #@ If disabled, usernames and group names will be redacted from audit logs because they might contain personally identifiable information."
+  #@schema/desc log_usernames_and_groups_desc
+  #@schema/validation one_of=["enabled", "disabled"]
+  log_usernames_and_groups: disabled

deploy/local-user-authenticator/README.md

@@ -20,7 +20,7 @@ kubectl apply -f https://get.pinniped.dev/latest/install-local-user-authenticato
 
 ## Installing a Specific Version with Default Options
 
-Choose your preferred [release](https://github.com/vmware-tanzu/pinniped/releases) version number
+Choose your preferred [release](https://github.com/vmware/pinniped/releases) version number
 and use it to replace the version number in the URL below.
 
 ```bash

deploy/local-user-authenticator/values.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@data/values-schema
@@ -6,7 +6,7 @@
 #@schema/title "Image repo"
 #@schema/desc "The repository for the local-user-authenticator container image."
 #@schema/validation min_len=1
-image_repo: ghcr.io/vmware-tanzu/pinniped/pinniped-server
+image_repo: ghcr.io/vmware/pinniped/pinniped-server
 
 #@schema/title "Image digest"
 #@schema/desc "The image digest for the local-user-authenticator container image. If both image_digest or an image_tag are given, only image_digest will be used."

deploy/supervisor/config.supervisor.pinniped.dev_federationdomains.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: federationdomains.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev
@@ -55,7 +55,6 @@ spec:
                 description: |-
                   IdentityProviders is the list of identity providers available for use by this FederationDomain.
 
-
                   An identity provider CR (e.g. OIDCIdentityProvider or LDAPIdentityProvider) describes how to connect to a server,
                   how to talk in a specific protocol for authentication, and how to use the schema of that server/protocol to
                   extract a normalized user identity. Normalized user identities include a username and a list of group names.
@@ -68,7 +67,6 @@ spec:
                   the authentication to the Kubernetes clusters that belong to this FederationDomain. For example, a policy could
                   disallow the authentication unless the user belongs to a specific group in the identity provider.
 
-
                   For backwards compatibility with versions of Pinniped which predate support for multiple identity providers,
                   an empty IdentityProviders list will cause the FederationDomain to use all available identity providers which
                   exist in the same namespace, but also to reject all authentication requests when there is more than one identity
@@ -143,8 +141,9 @@ spec:
                                   Type is "string", and is otherwise ignored.
                                 type: string
                               type:
-                                description: Type determines the type of the constant,
-                                  and indicates which other field should be non-empty.
+                                description: |-
+                                  Type determines the type of the constant, and indicates which other field should be non-empty.
+                                  Allowed values are "string" or "stringList".
                                 enum:
                                 - string
                                 - stringList
@@ -222,14 +221,12 @@ spec:
                             https://github.com/google/cel-spec/blob/master/doc/langdef.md plus the CEL string extensions defined in
                             https://github.com/google/cel-go/tree/master/ext#strings.
 
-
                             The username and groups extracted from the identity provider, and the constants defined in this CR, are
                             available as variables in all expressions. The username is provided via a variable called `username` and
                             the list of group names is provided via a variable called `groups` (which may be an empty list).
                             Each user-provided constants is provided via a variable named `strConst.varName` for string constants
                             and `strListConst.varName` for string list constants.
 
-
                             The only allowed types for expressions are currently policy/v1, username/v1, and groups/v1.
                             Each policy/v1 must return a boolean, and when it returns false, no more expressions from the list are evaluated
                             and the authentication attempt is rejected.
@@ -242,7 +239,6 @@ spec:
                             Transformations of type groups/v1 do not return usernames, and therefore cannot change the usernames.
                             After each expression, the new (potentially changed) username or groups get passed to the following expression.
 
-
                             Any compilation or static type-checking failure of any expression will cause an error status on the FederationDomain.
                             During an authentication attempt, any unexpected runtime evaluation errors (e.g. division by zero) cause the
                             authentication attempt to fail. When all expressions evaluate successfully, then the (potentially changed) username
@@ -262,8 +258,9 @@ spec:
                                   an authentication attempt. When empty, a default message will be used.
                                 type: string
                               type:
-                                description: Type determines the type of the expression.
-                                  It must be one of the supported types.
+                                description: |-
+                                  Type determines the type of the expression. It must be one of the supported types.
+                                  Allowed values are "policy/v1", "username/v1", or "groups/v1".
                                 enum:
                                 - policy/v1
                                 - username/v1
@@ -288,11 +285,13 @@ spec:
                   https://example.com/foo, then your authorization endpoint will look like
                   https://example.com/foo/some/path/to/auth/endpoint).
 
-
                   See
                   https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
                 minLength: 1
                 type: string
+                x-kubernetes-validations:
+                - message: issuer must be an HTTPS URL
+                  rule: isURL(self) && url(self).getScheme() == 'https'
               tls:
                 description: TLS specifies a secret which will contain Transport Layer
                   Security (TLS) configuration for the FederationDomain.
@@ -304,21 +303,17 @@ spec:
                       named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use
                       for TLS.
 
-
                       Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) supported by all major browsers.
 
-
                       SecretName is required if you would like to use different TLS certificates for issuers of different hostnames.
                       SNI requests do not include port numbers, so all issuers with the same DNS hostname must use the same
                       SecretName value even if they have different port numbers.
 
-
                       SecretName is not required when you would like to use only the HTTP endpoints (e.g. when the HTTP listener is
                       configured to listen on loopback interfaces or UNIX domain sockets for traffic from a service mesh sidecar).
                       It is also not required when you would like all requests to this OIDC Provider's HTTPS endpoints to
                       use the default TLS certificate, which is configured elsewhere.
 
-
                       When your Issuer URL's host is an IP address, then this field is ignored. SNI does not work for IP addresses.
                     type: string
                 type: object
@@ -332,16 +327,8 @@ spec:
                 description: Conditions represent the observations of an FederationDomain's
                   current state.
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource.\n---\nThis struct is intended for
-                    direct use as an array at the field path .status.conditions.  For
-                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
-                    observations of a foo's current state.\n\t    // Known .status.conditions.type
-                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
-                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
-                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
-                    \   // other fields\n\t}"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
                       description: |-
@@ -382,12 +369,7 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: |-
-                        type of condition in CamelCase or in foo.example.com/CamelCase.
-                        ---
-                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
-                        useful (see .node.status.conditions), the ability to deconflict is important.
-                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string
@@ -427,9 +409,7 @@ spec:
                           This field is effectively required, but due to backwards compatibility is
                           allowed to be empty. Instances of this type with an empty value here are
                           almost certainly wrong.
-                          TODO: Add other useful fields. apiVersion, kind, uid?
                           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic
@@ -445,9 +425,7 @@ spec:
                           This field is effectively required, but due to backwards compatibility is
                           allowed to be empty. Instances of this type with an empty value here are
                           almost certainly wrong.
-                          TODO: Add other useful fields. apiVersion, kind, uid?
                           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic
@@ -463,9 +441,7 @@ spec:
                           This field is effectively required, but due to backwards compatibility is
                           allowed to be empty. Instances of this type with an empty value here are
                           almost certainly wrong.
-                          TODO: Add other useful fields. apiVersion, kind, uid?
                           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic
@@ -481,9 +457,7 @@ spec:
                           This field is effectively required, but due to backwards compatibility is
                           allowed to be empty. Instances of this type with an empty value here are
                           almost certainly wrong.
-                          TODO: Add other useful fields. apiVersion, kind, uid?
                           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                         type: string
                     type: object
                     x-kubernetes-map-type: atomic

deploy/supervisor/config.supervisor.pinniped.dev_oidcclients.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: oidcclients.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev
@@ -59,7 +59,6 @@ spec:
                   allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this
                   client.
 
-
                   Must only contain the following values:
                   - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to
                     authenticate users. This grant must always be listed.
@@ -93,7 +92,6 @@ spec:
                 description: |-
                   allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client.
 
-
                   Must only contain the following values:
                   - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat).
                     This scope must always be listed.
@@ -152,16 +150,8 @@ spec:
                 description: conditions represent the observations of an OIDCClient's
                   current state.
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource.\n---\nThis struct is intended for
-                    direct use as an array at the field path .status.conditions.  For
-                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
-                    observations of a foo's current state.\n\t    // Known .status.conditions.type
-                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
-                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
-                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
-                    \   // other fields\n\t}"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
                       description: |-
@@ -202,12 +192,7 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: |-
-                        type of condition in CamelCase or in foo.example.com/CamelCase.
-                        ---
-                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
-                        useful (see .node.status.conditions), the ability to deconflict is important.
-                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

deploy/supervisor/deployment.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
@@ -13,7 +13,7 @@
 #@   "pinnipedDevAPIGroupWithPrefix",
 #@   "getPinnipedConfigMapData",
 #@   "hasUnixNetworkEndpoint",
-#@  )
+#@ )
 #@ load("@ytt:template", "template")
 
 #@ if not data.values.into_namespace:

deploy/supervisor/helpers.lib.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
@@ -57,7 +57,12 @@ _: #@ template.replace(data.values.custom_labels)
 #@       "onedottwo": {
 #@         "allowedCiphers": data.values.allowed_ciphers_for_tls_onedottwo
 #@       }
-#@     }
+#@     },
+#@     "audit": {
+#@       "logUsernamesAndGroups": data.values.audit.log_usernames_and_groups,
+#@       "logInternalPaths": data.values.audit.log_internal_paths
+#@     },
+#@     "aggregatedAPIServerDisableAdmissionPlugins": []
 #@   }
 #@   if data.values.log_level:
 #@     config["log"] = {}

deploy/supervisor/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: activedirectoryidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev
@@ -125,21 +125,18 @@ spec:
                       to keep the groups observed in Kubernetes clusters in-sync with the identity
                       provider.
 
-
                       In some environments, frequent group membership queries may result in a
                       significant performance impact on the identity provider and/or the supervisor.
                       The best approach to handle performance impacts is to tweak the group query
                       to be more performant, for example by disabling nested group search or by
                       using a more targeted group search base.
 
-
                       If the group search query cannot be made performant and you are willing to
                       have group memberships remain static for approximately a day, then set
                       skipGroupRefresh to true.  This is an insecure configuration as authorization
                       policies that are bound to group membership will not notice if a user has
                       been removed from a particular group until their next login.
 
-
                       This is an experimental feature that may be removed or significantly altered
                       in the future.  Consumers of this configuration should carefully read all
                       release notes before upgrading to ensure that the meaning of this field has
@@ -170,6 +167,39 @@ spec:
                     description: X.509 Certificate Authority (base64-encoded PEM bundle).
                       If omitted, a default set of system roots will be trusted.
                     type: string
+                  certificateAuthorityDataSource:
+                    description: |-
+                      Reference to a CA bundle in a secret or a configmap.
+                      Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
+                    properties:
+                      key:
+                        description: |-
+                          Key is the key name within the secret or configmap from which to read the CA bundle.
+                          The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
+                          certificate bundle.
+                        minLength: 1
+                        type: string
+                      kind:
+                        description: |-
+                          Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
+                          Allowed values are "Secret" or "ConfigMap".
+                          "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
+                          "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
+                        enum:
+                        - Secret
+                        - ConfigMap
+                        type: string
+                      name:
+                        description: |-
+                          Name is the resource name of the secret or configmap from which to read the CA bundle.
+                          The referenced secret or configmap must be created in the same namespace where Pinniped Supervisor is installed.
+                        minLength: 1
+                        type: string
+                    required:
+                    - key
+                    - kind
+                    - name
+                    type: object
                 type: object
               userSearch:
                 description: UserSearch contains the configuration for searching for
@@ -228,16 +258,8 @@ spec:
                 description: Represents the observations of an identity provider's
                   current state.
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource.\n---\nThis struct is intended for
-                    direct use as an array at the field path .status.conditions.  For
-                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
-                    observations of a foo's current state.\n\t    // Known .status.conditions.type
-                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
-                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
-                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
-                    \   // other fields\n\t}"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
                       description: |-
@@ -278,12 +300,7 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: |-
-                        type of condition in CamelCase or in foo.example.com/CamelCase.
-                        ---
-                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
-                        useful (see .node.status.conditions), the ability to deconflict is important.
-                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

deploy/supervisor/idp.supervisor.pinniped.dev_githubidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: githubidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev
@@ -35,7 +35,6 @@ spec:
           GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
           This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
 
-
           Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
           as OIDCClients.
         properties:
@@ -74,12 +73,10 @@ spec:
                           teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
                           provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
 
-
                           The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
                           otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
                           within that organization.
 
-
                           If no organizations are listed, you must set organizations: AllGitHubUsers.
                         items:
                           type: string
@@ -89,8 +86,10 @@ spec:
                       policy:
                         default: OnlyUsersFromAllowedOrganizations
                         description: |-
-                          Policy must be set to "AllGitHubUsers" if allowed is empty.
+                          Allowed values are "OnlyUsersFromAllowedOrganizations" or "AllGitHubUsers".
+                          Defaults to "OnlyUsersFromAllowedOrganizations".
 
+                          Must be set to "AllGitHubUsers" if the allowed field is empty.
 
                           This field only exists to ensure that Pinniped administrators are aware that an empty list of
                           allowedOrganizations means all GitHub users are allowed to log in.
@@ -123,26 +122,20 @@ spec:
                     description: |-
                       Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
 
-
                       Can be either "name" or "slug". Defaults to "slug".
 
-
                       GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
 
-
                       GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
 
-
                       Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
                       forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
                       or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
                       the team name or slug.
 
-
                       If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
                       FederationDomain to further customize how these group names are presented to Kubernetes.
 
-
                       See the response schema for
                       [List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
                     enum:
@@ -154,10 +147,8 @@ spec:
                     description: |-
                       Username configures which property of the GitHub user record shall determine the username in Kubernetes.
 
-
                       Can be either "id", "login", or "login:id". Defaults to "login:id".
 
-
                       GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
                       and may not start or end with hyphens. GitHub users are allowed to change their login name,
                       although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
@@ -165,17 +156,14 @@ spec:
                       username of the first user. For this reason, it is not as safe to make authorization decisions
                       based only on the user's login attribute.
 
-
                       If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
                       FederationDomain to further customize how these usernames are presented to Kubernetes.
 
-
                       Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
                       unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
                       from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
                       choice to concatenate the two values.
 
-
                       See the response schema for
                       [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
                     enum:
@@ -193,7 +181,6 @@ spec:
                       SecretName contains the name of a namespace-local Secret object that provides the clientID and
                       clientSecret for an GitHub App or GitHub OAuth2 client.
 
-
                       This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
                     minLength: 1
                     type: string
@@ -210,21 +197,59 @@ spec:
                     description: |-
                       Host is required only for GitHub Enterprise Server.
                       Defaults to using GitHub's public API ("github.com").
+                      For convenience, specifying "github.com" is equivalent to specifying "api.github.com".
                       Do not specify a protocol or scheme since "https://" will always be used.
                       Port is optional. Do not specify a path, query, fragment, or userinfo.
-                      Only domain name or IP address, subdomains (optional), and port (optional).
+                      Only specify domain name or IP address, subdomains (optional), and port (optional).
                       IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address
                       in square brackets. Example: "[::1]:443".
                     minLength: 1
                     type: string
                   tls:
-                    description: TLS configuration for GitHub Enterprise Server.
+                    description: |-
+                      TLS configuration for GitHub Enterprise Server.
+                      Note that this field should not be needed when using GitHub's public API ("github.com").
+                      However, if you choose to specify this field when using GitHub's public API, you must
+                      specify a CA bundle that will verify connections to "api.github.com".
                     properties:
                       certificateAuthorityData:
                         description: X.509 Certificate Authority (base64-encoded PEM
                           bundle). If omitted, a default set of system roots will
                           be trusted.
                         type: string
+                      certificateAuthorityDataSource:
+                        description: |-
+                          Reference to a CA bundle in a secret or a configmap.
+                          Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
+                        properties:
+                          key:
+                            description: |-
+                              Key is the key name within the secret or configmap from which to read the CA bundle.
+                              The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
+                              certificate bundle.
+                            minLength: 1
+                            type: string
+                          kind:
+                            description: |-
+                              Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
+                              Allowed values are "Secret" or "ConfigMap".
+                              "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
+                              "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
+                            enum:
+                            - Secret
+                            - ConfigMap
+                            type: string
+                          name:
+                            description: |-
+                              Name is the resource name of the secret or configmap from which to read the CA bundle.
+                              The referenced secret or configmap must be created in the same namespace where Pinniped Supervisor is installed.
+                            minLength: 1
+                            type: string
+                        required:
+                        - key
+                        - kind
+                        - name
+                        type: object
                     type: object
                 type: object
             required:
@@ -238,16 +263,8 @@ spec:
                 description: Conditions represents the observations of an identity
                   provider's current state.
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource.\n---\nThis struct is intended for
-                    direct use as an array at the field path .status.conditions.  For
-                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
-                    observations of a foo's current state.\n\t    // Known .status.conditions.type
-                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
-                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
-                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
-                    \   // other fields\n\t}"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
                       description: |-
@@ -288,12 +305,7 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: |-
-                        type of condition in CamelCase or in foo.example.com/CamelCase.
-                        ---
-                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
-                        useful (see .node.status.conditions), the ability to deconflict is important.
-                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

deploy/supervisor/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: ldapidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev
@@ -116,21 +116,18 @@ spec:
                       to keep the groups observed in Kubernetes clusters in-sync with the identity
                       provider.
 
-
                       In some environments, frequent group membership queries may result in a
                       significant performance impact on the identity provider and/or the supervisor.
                       The best approach to handle performance impacts is to tweak the group query
                       to be more performant, for example by disabling nested group search or by
                       using a more targeted group search base.
 
-
                       If the group search query cannot be made performant and you are willing to
                       have group memberships remain static for approximately a day, then set
                       skipGroupRefresh to true.  This is an insecure configuration as authorization
                       policies that are bound to group membership will not notice if a user has
                       been removed from a particular group until their next login.
 
-
                       This is an experimental feature that may be removed or significantly altered
                       in the future.  Consumers of this configuration should carefully read all
                       release notes before upgrading to ensure that the meaning of this field has
@@ -161,6 +158,39 @@ spec:
                     description: X.509 Certificate Authority (base64-encoded PEM bundle).
                       If omitted, a default set of system roots will be trusted.
                     type: string
+                  certificateAuthorityDataSource:
+                    description: |-
+                      Reference to a CA bundle in a secret or a configmap.
+                      Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
+                    properties:
+                      key:
+                        description: |-
+                          Key is the key name within the secret or configmap from which to read the CA bundle.
+                          The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
+                          certificate bundle.
+                        minLength: 1
+                        type: string
+                      kind:
+                        description: |-
+                          Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
+                          Allowed values are "Secret" or "ConfigMap".
+                          "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
+                          "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
+                        enum:
+                        - Secret
+                        - ConfigMap
+                        type: string
+                      name:
+                        description: |-
+                          Name is the resource name of the secret or configmap from which to read the CA bundle.
+                          The referenced secret or configmap must be created in the same namespace where Pinniped Supervisor is installed.
+                        minLength: 1
+                        type: string
+                    required:
+                    - key
+                    - kind
+                    - name
+                    type: object
                 type: object
               userSearch:
                 description: UserSearch contains the configuration for searching for
@@ -219,16 +249,8 @@ spec:
                 description: Represents the observations of an identity provider's
                   current state.
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource.\n---\nThis struct is intended for
-                    direct use as an array at the field path .status.conditions.  For
-                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
-                    observations of a foo's current state.\n\t    // Known .status.conditions.type
-                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
-                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
-                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
-                    \   // other fields\n\t}"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
                       description: |-
@@ -269,12 +291,7 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: |-
-                        type of condition in CamelCase or in foo.example.com/CamelCase.
-                        ---
-                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
-                        useful (see .node.status.conditions), the ability to deconflict is important.
-                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

deploy/supervisor/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.15.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: oidcidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev
@@ -211,6 +211,39 @@ spec:
                     description: X.509 Certificate Authority (base64-encoded PEM bundle).
                       If omitted, a default set of system roots will be trusted.
                     type: string
+                  certificateAuthorityDataSource:
+                    description: |-
+                      Reference to a CA bundle in a secret or a configmap.
+                      Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
+                    properties:
+                      key:
+                        description: |-
+                          Key is the key name within the secret or configmap from which to read the CA bundle.
+                          The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
+                          certificate bundle.
+                        minLength: 1
+                        type: string
+                      kind:
+                        description: |-
+                          Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
+                          Allowed values are "Secret" or "ConfigMap".
+                          "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
+                          "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
+                        enum:
+                        - Secret
+                        - ConfigMap
+                        type: string
+                      name:
+                        description: |-
+                          Name is the resource name of the secret or configmap from which to read the CA bundle.
+                          The referenced secret or configmap must be created in the same namespace where Pinniped Supervisor is installed.
+                        minLength: 1
+                        type: string
+                    required:
+                    - key
+                    - kind
+                    - name
+                    type: object
                 type: object
             required:
             - client
@@ -223,16 +256,8 @@ spec:
                 description: Represents the observations of an identity provider's
                   current state.
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource.\n---\nThis struct is intended for
-                    direct use as an array at the field path .status.conditions.  For
-                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
-                    observations of a foo's current state.\n\t    // Known .status.conditions.type
-                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
-                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
-                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
-                    \   // other fields\n\t}"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
                       description: |-
@@ -273,12 +298,7 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: |-
-                        type of condition in CamelCase or in foo.example.com/CamelCase.
-                        ---
-                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
-                        useful (see .node.status.conditions), the ability to deconflict is important.
-                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

deploy/supervisor/rbac.yaml

@@ -16,6 +16,9 @@ rules:
   - apiGroups: [""]
     resources: [secrets]
     verbs: [create, get, list, patch, update, watch, delete]
+  - apiGroups: [""]
+    resources: [configmaps]
+    verbs: [get, list, watch]
   - apiGroups:
       - #@ pinnipedDevAPIGroupWithPrefix("config.supervisor")
     resources: [federationdomains]

deploy/supervisor/values.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ def validate_strings_map(obj):
@@ -52,7 +52,7 @@ replicas: 2
 #@schema/title "Image repo"
 #@schema/desc "The repository for the Supervisor container image."
 #@schema/validation min_len=1
-image_repo: ghcr.io/vmware-tanzu/pinniped/pinniped-server
+image_repo: ghcr.io/vmware/pinniped/pinniped-server
 
 #@schema/title "Image digest"
 #@schema/desc "The image digest for the Supervisor container image. If both image_digest or an image_tag are given, only image_digest will be used."
@@ -220,3 +220,23 @@ endpoints: { }
 #! An empty array is perfectly valid, as is any array of strings.
 allowed_ciphers_for_tls_onedottwo:
 - ""
+
+#@schema/title "Audit logging configuration"
+#@schema/desc "Customize the content of audit log events."
+audit:
+
+  #@schema/title "Log usernames and groups"
+  #@ log_usernames_and_groups_desc = "Enables or disables printing usernames and group names in audit logs. Options are 'enabled' or 'disabled'. \
+  #@ If enabled, usernames are group names may be printed in audit log events. \
+  #@ If disabled, usernames and group names will be redacted from audit logs because they might contain personally identifiable information."
+  #@schema/desc log_usernames_and_groups_desc
+  #@schema/validation one_of=["enabled", "disabled"]
+  log_usernames_and_groups: disabled
+
+  #@schema/title "Log HTTPS requests for internal paths"
+  #@ log_internal_paths = "Enables or disables request logging for internal paths in audit logs. Options are 'enabled' or 'disabled'. \
+  #@ If enabled, requests to certain paths that are typically only used internal to the cluster (e.g. /healthz) will be enabled, which can be very verbose. \
+  #@ If disabled, requests to those paths will not be audit logged."
+  #@schema/desc log_internal_paths
+  #@schema/validation one_of=["enabled", "disabled"]
+  log_internal_paths: disabled

generated/1.24/apis/concierge/authentication/v1alpha1/doc.go

@@ -1,8 +0,0 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:deepcopy-gen=package
-// +groupName=authentication.concierge.pinniped.dev
-
-// Package v1alpha1 is the v1alpha1 version of the Pinniped concierge authentication API.
-package v1alpha1

generated/1.24/apis/concierge/authentication/v1alpha1/register.go

@@ -1,45 +0,0 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-const GroupName = "authentication.concierge.pinniped.dev"
-
-// SchemeGroupVersion is group version used to register these objects.
-var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
-
-var (
-	SchemeBuilder      runtime.SchemeBuilder
-	localSchemeBuilder = &SchemeBuilder
-	AddToScheme        = localSchemeBuilder.AddToScheme
-)
-
-func init() {
-	// We only register manually written functions here. The registration of the
-	// generated functions takes place in the generated files. The separation
-	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes)
-}
-
-// Adds the list of known types to the given scheme.
-func addKnownTypes(scheme *runtime.Scheme) error {
-	scheme.AddKnownTypes(SchemeGroupVersion,
-		&WebhookAuthenticator{},
-		&WebhookAuthenticatorList{},
-		&JWTAuthenticator{},
-		&JWTAuthenticatorList{},
-	)
-	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
-	return nil
-}
-
-// Resource takes an unqualified resource and returns a Group qualified GroupResource.
-func Resource(resource string) schema.GroupResource {
-	return SchemeGroupVersion.WithResource(resource).GroupResource()
-}

generated/1.24/apis/concierge/authentication/v1alpha1/types_jwtauthenticator.go

@@ -1,102 +0,0 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-type JWTAuthenticatorPhase string
-
-const (
-	// JWTAuthenticatorPhasePending is the default phase for newly-created JWTAuthenticator resources.
-	JWTAuthenticatorPhasePending JWTAuthenticatorPhase = "Pending"
-
-	// JWTAuthenticatorPhaseReady is the phase for an JWTAuthenticator resource in a healthy state.
-	JWTAuthenticatorPhaseReady JWTAuthenticatorPhase = "Ready"
-
-	// JWTAuthenticatorPhaseError is the phase for an JWTAuthenticator in an unhealthy state.
-	JWTAuthenticatorPhaseError JWTAuthenticatorPhase = "Error"
-)
-
-// Status of a JWT authenticator.
-type JWTAuthenticatorStatus struct {
-	// Represents the observations of the authenticator's current state.
-	// +patchMergeKey=type
-	// +patchStrategy=merge
-	// +listType=map
-	// +listMapKey=type
-	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
-	// Phase summarizes the overall status of the JWTAuthenticator.
-	// +kubebuilder:default=Pending
-	// +kubebuilder:validation:Enum=Pending;Ready;Error
-	Phase JWTAuthenticatorPhase `json:"phase,omitempty"`
-}
-
-// Spec for configuring a JWT authenticator.
-type JWTAuthenticatorSpec struct {
-	// Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
-	// also used to validate the "iss" JWT claim.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:Pattern=`^https://`
-	Issuer string `json:"issuer"`
-
-	// Audience is the required value of the "aud" JWT claim.
-	// +kubebuilder:validation:MinLength=1
-	Audience string `json:"audience"`
-
-	// Claims allows customization of the claims that will be mapped to user identity
-	// for Kubernetes access.
-	// +optional
-	Claims JWTTokenClaims `json:"claims"`
-
-	// TLS configuration for communicating with the OIDC provider.
-	// +optional
-	TLS *TLSSpec `json:"tls,omitempty"`
-}
-
-// JWTTokenClaims allows customization of the claims that will be mapped to user identity
-// for Kubernetes access.
-type JWTTokenClaims struct {
-	// Groups is the name of the claim which should be read to extract the user's
-	// group membership from the JWT token. When not specified, it will default to "groups".
-	// +optional
-	Groups string `json:"groups"`
-
-	// Username is the name of the claim which should be read to extract the
-	// username from the JWT token. When not specified, it will default to "username".
-	// +optional
-	Username string `json:"username"`
-}
-
-// JWTAuthenticator describes the configuration of a JWT authenticator.
-//
-// Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
-// signature, existence of claims, etc.) and extract the username and groups from the token.
-//
-// +genclient
-// +genclient:nonNamespaced
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
-// +kubebuilder:printcolumn:name="Issuer",type=string,JSONPath=`.spec.issuer`
-// +kubebuilder:printcolumn:name="Audience",type=string,JSONPath=`.spec.audience`
-// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
-// +kubebuilder:subresource:status
-type JWTAuthenticator struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	// Spec for configuring the authenticator.
-	Spec JWTAuthenticatorSpec `json:"spec"`
-
-	// Status of the authenticator.
-	Status JWTAuthenticatorStatus `json:"status,omitempty"`
-}
-
-// List of JWTAuthenticator objects.
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type JWTAuthenticatorList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []JWTAuthenticator `json:"items"`
-}

generated/1.24/apis/concierge/authentication/v1alpha1/types_tls.go

@@ -1,11 +0,0 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-// Configuration for configuring TLS on various authenticators.
-type TLSSpec struct {
-	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
-	// +optional
-	CertificateAuthorityData string `json:"certificateAuthorityData,omitempty"`
-}

generated/1.24/apis/concierge/authentication/v1alpha1/types_webhookauthenticator.go

@@ -1,73 +0,0 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-type WebhookAuthenticatorPhase string
-
-const (
-	// WebhookAuthenticatorPhasePending is the default phase for newly-created WebhookAuthenticator resources.
-	WebhookAuthenticatorPhasePending WebhookAuthenticatorPhase = "Pending"
-
-	// WebhookAuthenticatorPhaseReady is the phase for an WebhookAuthenticator resource in a healthy state.
-	WebhookAuthenticatorPhaseReady WebhookAuthenticatorPhase = "Ready"
-
-	// WebhookAuthenticatorPhaseError is the phase for an WebhookAuthenticator in an unhealthy state.
-	WebhookAuthenticatorPhaseError WebhookAuthenticatorPhase = "Error"
-)
-
-// Status of a webhook authenticator.
-type WebhookAuthenticatorStatus struct {
-	// Represents the observations of the authenticator's current state.
-	// +patchMergeKey=type
-	// +patchStrategy=merge
-	// +listType=map
-	// +listMapKey=type
-	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
-	// Phase summarizes the overall status of the WebhookAuthenticator.
-	// +kubebuilder:default=Pending
-	// +kubebuilder:validation:Enum=Pending;Ready;Error
-	Phase WebhookAuthenticatorPhase `json:"phase,omitempty"`
-}
-
-// Spec for configuring a webhook authenticator.
-type WebhookAuthenticatorSpec struct {
-	// Webhook server endpoint URL.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:Pattern=`^https://`
-	Endpoint string `json:"endpoint"`
-
-	// TLS configuration.
-	// +optional
-	TLS *TLSSpec `json:"tls,omitempty"`
-}
-
-// WebhookAuthenticator describes the configuration of a webhook authenticator.
-// +genclient
-// +genclient:nonNamespaced
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
-// +kubebuilder:printcolumn:name="Endpoint",type=string,JSONPath=`.spec.endpoint`
-// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
-// +kubebuilder:subresource:status
-type WebhookAuthenticator struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	// Spec for configuring the authenticator.
-	Spec WebhookAuthenticatorSpec `json:"spec"`
-
-	// Status of the authenticator.
-	Status WebhookAuthenticatorStatus `json:"status,omitempty"`
-}
-
-// List of WebhookAuthenticator objects.
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type WebhookAuthenticatorList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []WebhookAuthenticator `json:"items"`
-}

generated/1.24/apis/concierge/authentication/v1alpha1/zz_generated.deepcopy.go

@@ -1,257 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by deepcopy-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTAuthenticator) DeepCopyInto(out *JWTAuthenticator) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticator.
-func (in *JWTAuthenticator) DeepCopy() *JWTAuthenticator {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTAuthenticator)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *JWTAuthenticator) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTAuthenticatorList) DeepCopyInto(out *JWTAuthenticatorList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]JWTAuthenticator, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorList.
-func (in *JWTAuthenticatorList) DeepCopy() *JWTAuthenticatorList {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTAuthenticatorList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *JWTAuthenticatorList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTAuthenticatorSpec) DeepCopyInto(out *JWTAuthenticatorSpec) {
-	*out = *in
-	out.Claims = in.Claims
-	if in.TLS != nil {
-		in, out := &in.TLS, &out.TLS
-		*out = new(TLSSpec)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorSpec.
-func (in *JWTAuthenticatorSpec) DeepCopy() *JWTAuthenticatorSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTAuthenticatorSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTAuthenticatorStatus) DeepCopyInto(out *JWTAuthenticatorStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorStatus.
-func (in *JWTAuthenticatorStatus) DeepCopy() *JWTAuthenticatorStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTAuthenticatorStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTTokenClaims) DeepCopyInto(out *JWTTokenClaims) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTTokenClaims.
-func (in *JWTTokenClaims) DeepCopy() *JWTTokenClaims {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTTokenClaims)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TLSSpec) DeepCopyInto(out *TLSSpec) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSSpec.
-func (in *TLSSpec) DeepCopy() *TLSSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(TLSSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WebhookAuthenticator) DeepCopyInto(out *WebhookAuthenticator) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookAuthenticator.
-func (in *WebhookAuthenticator) DeepCopy() *WebhookAuthenticator {
-	if in == nil {
-		return nil
-	}
-	out := new(WebhookAuthenticator)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *WebhookAuthenticator) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WebhookAuthenticatorList) DeepCopyInto(out *WebhookAuthenticatorList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]WebhookAuthenticator, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookAuthenticatorList.
-func (in *WebhookAuthenticatorList) DeepCopy() *WebhookAuthenticatorList {
-	if in == nil {
-		return nil
-	}
-	out := new(WebhookAuthenticatorList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *WebhookAuthenticatorList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WebhookAuthenticatorSpec) DeepCopyInto(out *WebhookAuthenticatorSpec) {
-	*out = *in
-	if in.TLS != nil {
-		in, out := &in.TLS, &out.TLS
-		*out = new(TLSSpec)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookAuthenticatorSpec.
-func (in *WebhookAuthenticatorSpec) DeepCopy() *WebhookAuthenticatorSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(WebhookAuthenticatorSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WebhookAuthenticatorStatus) DeepCopyInto(out *WebhookAuthenticatorStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookAuthenticatorStatus.
-func (in *WebhookAuthenticatorStatus) DeepCopy() *WebhookAuthenticatorStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(WebhookAuthenticatorStatus)
-	in.DeepCopyInto(out)
-	return out
-}

generated/1.24/apis/concierge/config/v1alpha1/doc.go

@@ -1,8 +0,0 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:deepcopy-gen=package
-// +groupName=config.concierge.pinniped.dev
-
-// Package v1alpha1 is the v1alpha1 version of the Pinniped concierge configuration API.
-package v1alpha1

generated/1.24/apis/concierge/config/v1alpha1/register.go

@@ -1,43 +0,0 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-const GroupName = "config.concierge.pinniped.dev"
-
-// SchemeGroupVersion is group version used to register these objects.
-var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
-
-var (
-	SchemeBuilder      runtime.SchemeBuilder
-	localSchemeBuilder = &SchemeBuilder
-	AddToScheme        = localSchemeBuilder.AddToScheme
-)
-
-func init() {
-	// We only register manually written functions here. The registration of the
-	// generated functions takes place in the generated files. The separation
-	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes)
-}
-
-// Adds the list of known types to the given scheme.
-func addKnownTypes(scheme *runtime.Scheme) error {
-	scheme.AddKnownTypes(SchemeGroupVersion,
-		&CredentialIssuer{},
-		&CredentialIssuerList{},
-	)
-	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
-	return nil
-}
-
-// Resource takes an unqualified resource and returns a Group qualified GroupResource.
-func Resource(resource string) schema.GroupResource {
-	return SchemeGroupVersion.WithResource(resource).GroupResource()
-}

generated/1.24/apis/concierge/config/v1alpha1/types_credentialissuer.go

@@ -1,273 +0,0 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// StrategyType enumerates a type of "strategy" used to implement credential access on a cluster.
-// +kubebuilder:validation:Enum=KubeClusterSigningCertificate;ImpersonationProxy
-type StrategyType string
-
-// FrontendType enumerates a type of "frontend" used to provide access to users of a cluster.
-// +kubebuilder:validation:Enum=TokenCredentialRequestAPI;ImpersonationProxy
-type FrontendType string
-
-// StrategyStatus enumerates whether a strategy is working on a cluster.
-// +kubebuilder:validation:Enum=Success;Error
-type StrategyStatus string
-
-// StrategyReason enumerates the detailed reason why a strategy is in a particular status.
-// +kubebuilder:validation:Enum=Listening;Pending;Disabled;ErrorDuringSetup;CouldNotFetchKey;CouldNotGetClusterInfo;FetchedKey
-type StrategyReason string
-
-const (
-	KubeClusterSigningCertificateStrategyType = StrategyType("KubeClusterSigningCertificate")
-	ImpersonationProxyStrategyType            = StrategyType("ImpersonationProxy")
-
-	TokenCredentialRequestAPIFrontendType = FrontendType("TokenCredentialRequestAPI")
-	ImpersonationProxyFrontendType        = FrontendType("ImpersonationProxy")
-
-	SuccessStrategyStatus = StrategyStatus("Success")
-	ErrorStrategyStatus   = StrategyStatus("Error")
-
-	ListeningStrategyReason              = StrategyReason("Listening")
-	PendingStrategyReason                = StrategyReason("Pending")
-	DisabledStrategyReason               = StrategyReason("Disabled")
-	ErrorDuringSetupStrategyReason       = StrategyReason("ErrorDuringSetup")
-	CouldNotFetchKeyStrategyReason       = StrategyReason("CouldNotFetchKey")
-	CouldNotGetClusterInfoStrategyReason = StrategyReason("CouldNotGetClusterInfo")
-	FetchedKeyStrategyReason             = StrategyReason("FetchedKey")
-)
-
-// CredentialIssuerSpec describes the intended configuration of the Concierge.
-type CredentialIssuerSpec struct {
-	// ImpersonationProxy describes the intended configuration of the Concierge impersonation proxy.
-	ImpersonationProxy *ImpersonationProxySpec `json:"impersonationProxy"`
-}
-
-// ImpersonationProxyMode enumerates the configuration modes for the impersonation proxy.
-//
-// +kubebuilder:validation:Enum=auto;enabled;disabled
-type ImpersonationProxyMode string
-
-const (
-	// ImpersonationProxyModeDisabled explicitly disables the impersonation proxy.
-	ImpersonationProxyModeDisabled = ImpersonationProxyMode("disabled")
-
-	// ImpersonationProxyModeEnabled explicitly enables the impersonation proxy.
-	ImpersonationProxyModeEnabled = ImpersonationProxyMode("enabled")
-
-	// ImpersonationProxyModeAuto enables or disables the impersonation proxy based upon the cluster in which it is running.
-	ImpersonationProxyModeAuto = ImpersonationProxyMode("auto")
-)
-
-// ImpersonationProxyServiceType enumerates the types of service that can be provisioned for the impersonation proxy.
-//
-// +kubebuilder:validation:Enum=LoadBalancer;ClusterIP;None
-type ImpersonationProxyServiceType string
-
-const (
-	// ImpersonationProxyServiceTypeLoadBalancer provisions a service of type LoadBalancer.
-	ImpersonationProxyServiceTypeLoadBalancer = ImpersonationProxyServiceType("LoadBalancer")
-
-	// ImpersonationProxyServiceTypeClusterIP provisions a service of type ClusterIP.
-	ImpersonationProxyServiceTypeClusterIP = ImpersonationProxyServiceType("ClusterIP")
-
-	// ImpersonationProxyServiceTypeNone does not automatically provision any service.
-	ImpersonationProxyServiceTypeNone = ImpersonationProxyServiceType("None")
-)
-
-// ImpersonationProxyTLSSpec contains information about how the Concierge impersonation proxy should
-// serve TLS.
-//
-// If CertificateAuthorityData is not provided, the Concierge impersonation proxy will check the secret
-// for a field called "ca.crt", which will be used as the CertificateAuthorityData.
-//
-// If neither CertificateAuthorityData nor ca.crt is provided, no CA bundle will be advertised for
-// the impersonation proxy endpoint.
-type ImpersonationProxyTLSSpec struct {
-	// X.509 Certificate Authority (base64-encoded PEM bundle).
-	// Used to advertise the CA bundle for the impersonation proxy endpoint.
-	//
-	// +optional
-	CertificateAuthorityData string `json:"certificateAuthorityData,omitempty"`
-
-	// SecretName is the name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains
-	// the TLS serving certificate for the Concierge impersonation proxy endpoint.
-	//
-	// +kubebuilder:validation:MinLength=1
-	SecretName string `json:"secretName,omitempty"`
-}
-
-// ImpersonationProxySpec describes the intended configuration of the Concierge impersonation proxy.
-type ImpersonationProxySpec struct {
-	// Mode configures whether the impersonation proxy should be started:
-	// - "disabled" explicitly disables the impersonation proxy. This is the default.
-	// - "enabled" explicitly enables the impersonation proxy.
-	// - "auto" enables or disables the impersonation proxy based upon the cluster in which it is running.
-	Mode ImpersonationProxyMode `json:"mode"`
-
-	// Service describes the configuration of the Service provisioned to expose the impersonation proxy to clients.
-	//
-	// +kubebuilder:default:={"type": "LoadBalancer"}
-	Service ImpersonationProxyServiceSpec `json:"service"`
-
-	// ExternalEndpoint describes the HTTPS endpoint where the proxy will be exposed. If not set, the proxy will
-	// be served using the external name of the LoadBalancer service or the cluster service DNS name.
-	//
-	// This field must be non-empty when spec.impersonationProxy.service.type is "None".
-	//
-	// +optional
-	ExternalEndpoint string `json:"externalEndpoint,omitempty"`
-
-	// TLS contains information about how the Concierge impersonation proxy should serve TLS.
-	//
-	// If this field is empty, the impersonation proxy will generate its own TLS certificate.
-	//
-	// +optional
-	TLS *ImpersonationProxyTLSSpec `json:"tls,omitempty"`
-}
-
-// ImpersonationProxyServiceSpec describes how the Concierge should provision a Service to expose the impersonation proxy.
-type ImpersonationProxyServiceSpec struct {
-	// Type specifies the type of Service to provision for the impersonation proxy.
-	//
-	// If the type is "None", then the "spec.impersonationProxy.externalEndpoint" field must be set to a non-empty
-	// value so that the Concierge can properly advertise the endpoint in the CredentialIssuer's status.
-	//
-	// +kubebuilder:default:="LoadBalancer"
-	Type ImpersonationProxyServiceType `json:"type,omitempty"`
-
-	// LoadBalancerIP specifies the IP address to set in the spec.loadBalancerIP field of the provisioned Service.
-	// This is not supported on all cloud providers.
-	//
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength=255
-	// +optional
-	LoadBalancerIP string `json:"loadBalancerIP,omitempty"`
-
-	// Annotations specifies zero or more key/value pairs to set as annotations on the provisioned Service.
-	//
-	// +optional
-	Annotations map[string]string `json:"annotations,omitempty"`
-}
-
-// CredentialIssuerStatus describes the status of the Concierge.
-type CredentialIssuerStatus struct {
-	// List of integration strategies that were attempted by Pinniped.
-	Strategies []CredentialIssuerStrategy `json:"strategies"`
-
-	// Information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
-	// This field is deprecated and will be removed in a future version.
-	// +optional
-	KubeConfigInfo *CredentialIssuerKubeConfigInfo `json:"kubeConfigInfo,omitempty"`
-}
-
-// CredentialIssuerKubeConfigInfo provides the information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
-// This type is deprecated and will be removed in a future version.
-type CredentialIssuerKubeConfigInfo struct {
-	// The K8s API server URL.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:Pattern=`^https://|^http://`
-	Server string `json:"server"`
-
-	// The K8s API server CA bundle.
-	// +kubebuilder:validation:MinLength=1
-	CertificateAuthorityData string `json:"certificateAuthorityData"`
-}
-
-// CredentialIssuerStrategy describes the status of an integration strategy that was attempted by Pinniped.
-type CredentialIssuerStrategy struct {
-	// Type of integration attempted.
-	Type StrategyType `json:"type"`
-
-	// Status of the attempted integration strategy.
-	Status StrategyStatus `json:"status"`
-
-	// Reason for the current status.
-	Reason StrategyReason `json:"reason"`
-
-	// Human-readable description of the current status.
-	// +kubebuilder:validation:MinLength=1
-	Message string `json:"message"`
-
-	// When the status was last checked.
-	LastUpdateTime metav1.Time `json:"lastUpdateTime"`
-
-	// Frontend describes how clients can connect using this strategy.
-	Frontend *CredentialIssuerFrontend `json:"frontend,omitempty"`
-}
-
-// CredentialIssuerFrontend describes how to connect using a particular integration strategy.
-type CredentialIssuerFrontend struct {
-	// Type describes which frontend mechanism clients can use with a strategy.
-	Type FrontendType `json:"type"`
-
-	// TokenCredentialRequestAPIInfo describes the parameters for the TokenCredentialRequest API on this Concierge.
-	// This field is only set when Type is "TokenCredentialRequestAPI".
-	TokenCredentialRequestAPIInfo *TokenCredentialRequestAPIInfo `json:"tokenCredentialRequestInfo,omitempty"`
-
-	// ImpersonationProxyInfo describes the parameters for the impersonation proxy on this Concierge.
-	// This field is only set when Type is "ImpersonationProxy".
-	ImpersonationProxyInfo *ImpersonationProxyInfo `json:"impersonationProxyInfo,omitempty"`
-}
-
-// TokenCredentialRequestAPIInfo describes the parameters for the TokenCredentialRequest API on this Concierge.
-type TokenCredentialRequestAPIInfo struct {
-	// Server is the Kubernetes API server URL.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:Pattern=`^https://|^http://`
-	Server string `json:"server"`
-
-	// CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
-	// +kubebuilder:validation:MinLength=1
-	CertificateAuthorityData string `json:"certificateAuthorityData"`
-}
-
-// ImpersonationProxyInfo describes the parameters for the impersonation proxy on this Concierge.
-type ImpersonationProxyInfo struct {
-	// Endpoint is the HTTPS endpoint of the impersonation proxy.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:Pattern=`^https://`
-	Endpoint string `json:"endpoint"`
-
-	// CertificateAuthorityData is the base64-encoded PEM CA bundle of the impersonation proxy.
-	// +kubebuilder:validation:MinLength=1
-	CertificateAuthorityData string `json:"certificateAuthorityData"`
-}
-
-// CredentialIssuer describes the configuration and status of the Pinniped Concierge credential issuer.
-// +genclient
-// +genclient:nonNamespaced
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:resource:categories=pinniped,scope=Cluster
-// +kubebuilder:printcolumn:name="ProxyMode",type=string,JSONPath=`.spec.impersonationProxy.mode`
-// +kubebuilder:printcolumn:name="DefaultStrategy",type=string,JSONPath=`.status.strategies[?(@.status == "Success")].type`
-// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
-// +kubebuilder:subresource:status
-type CredentialIssuer struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	// Spec describes the intended configuration of the Concierge.
-	//
-	// +optional
-	Spec CredentialIssuerSpec `json:"spec"`
-
-	// CredentialIssuerStatus describes the status of the Concierge.
-	//
-	// +optional
-	Status CredentialIssuerStatus `json:"status"`
-}
-
-// CredentialIssuerList is a list of CredentialIssuer objects.
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type CredentialIssuerList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []CredentialIssuer `json:"items"`
-}