Add windows 32bit binary

2026-02-16 17:39:50 +00:00 · 2018-03-23 20:04:07 +09:00
176 changed files with 448 additions and 15151 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -0,0 +1,36 @@
+version: 2
+jobs:
+  build:
+    docker:
+      - image: circleci/golang:1.10
+    working_directory: /go/src/github.com/int128/kubelogin
+    steps:
+      - checkout
+      - run: go get -v -t -d
+      - run: go get github.com/golang/lint/golint
+      - run: golint
+      - run: go build -v
+
+  release:
+    docker:
+      - image: circleci/golang:1.10
+    working_directory: /go/src/github.com/int128/kubelogin
+    steps:
+      - checkout
+      - run: go get -v -t -d
+      - run: go get github.com/mitchellh/gox
+      - run: go get github.com/tcnksm/ghr
+      - run: gox --osarch 'darwin/amd64 linux/amd64 windows/amd64 windows/386' -output 'dist/{{.Dir}}_{{.OS}}_{{.Arch}}'
+      - run: ghr -u "$CIRCLE_PROJECT_USERNAME" -r "$CIRCLE_PROJECT_REPONAME" "$CIRCLE_TAG" dist
+
+workflows:
+  version: 2
+  build:
+    jobs:
+      - build
+      - release:
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /.*/
--- a/.editorconfig
+++ b/.editorconfig
@@ -0,0 +1,10 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+
+[*.go]
+indent_style = tab
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1,12 +0,0 @@
-# These are supported funding model platforms
-
-github: [int128] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,20 +0,0 @@
---
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: bug
-assignees: ''
-
---
-
-## Describe the issue
-A clear and concise description of what the issue is.
-
-## To reproduce
-A console log or steps to reproduce the issue.
-
-## Your environment
- OS: e.g. macOS
- kubelogin version: e.g. v1.19
- kubectl version: e.g. v1.19
- OpenID Connect provider: e.g. Google
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -1,15 +0,0 @@
---
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: enhancement
-assignees: ''
-
---
-
-## Purpose of the feature (why)
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-A clear and concise description of what you want to happen.
-
-## Your idea (how)
-A clear and concise description of any alternative solutions or features you've considered.
--- a/.github/ISSUE_TEMPLATE/question.md
+++ b/.github/ISSUE_TEMPLATE/question.md
@@ -1,20 +0,0 @@
---
-name: Question
-about: Feel free to ask a question
-title: ''
-labels: question
-assignees: ''
-
---
-
-## Describe the question
-A clear and concise description of what the issue is.
-
-## To reproduce
-A console log or steps to reproduce the issue.
-
-## Your environment
- OS: e.g. macOS
- kubelogin version: e.g. v1.19
- kubectl version: e.g. v1.19
- OpenID Connect provider: e.g. Google
--- a/.github/release.yml
+++ b/.github/release.yml
@@ -1,16 +0,0 @@
-# https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
-changelog:
-  categories:
-    - title: Features
-      labels:
-        - '*'
-      exclude:
-        labels:
-          - renovate
-          - refactoring
-    - title: Refactoring
-      labels:
-        - refactoring
-    - title: Dependencies
-      labels:
-        - renovate
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,12 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "github>int128/renovate-base",
-    "github>int128/go-renovate-config#v1.7.2",
-    "github>int128/go-renovate-config:go-directive#v1.7.2",
-    "github>int128/go-renovate-config:github-actions#v1.7.2",
-    "github>int128/go-renovate-config:kubernetes#v1.7.2",
-    "github>int128/go-renovate-config:kustomization-github-releases#v1.7.2",
-    "helpers:pinGitHubActionDigests",
-  ],
-}
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -1,70 +0,0 @@
-name: docker
-
-on:
-  pull_request:
-    branches:
-      - master
-    paths:
-      - .github/workflows/docker.yaml
-      - pkg/**
-      - go.*
-      - Dockerfile
-  push:
-    branches:
-      - master
-    paths:
-      - .github/workflows/docker.yaml
-      - pkg/**
-      - go.*
-      - Dockerfile
-    tags:
-      - v*
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      packages: write
-    outputs:
-      image-uri: ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
-        id: metadata
-        with:
-          images: ghcr.io/${{ github.repository }}
-      - uses: int128/docker-build-cache-config-action@622932dfa73db7d3a65e40d5fcc094f2101e659a # v1.37.0
-        id: cache
-        with:
-          image: ghcr.io/${{ github.repository }}/cache
-      - uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
-      - uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
-      - uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d # v6.12.0
-        id: build
-        with:
-          push: ${{ github.event_name == 'push' }}
-          tags: ${{ steps.metadata.outputs.tags }}
-          labels: ${{ steps.metadata.outputs.labels }}
-          cache-from: ${{ steps.cache.outputs.cache-from }}
-          cache-to: ${{ steps.cache.outputs.cache-to }}
-          platforms: |
-            linux/amd64
-            linux/arm64
-            linux/ppc64le
-
-  test:
-    if: github.event_name == 'push'
-    needs: build
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - run: docker run --rm "$IMAGE_URI" --help
-        env:
-          IMAGE_URI: ${{ needs.build.outputs.image-uri }}
--- a/.github/workflows/go.yaml
+++ b/.github/workflows/go.yaml
@@ -1,79 +0,0 @@
-name: go
-
-on:
-  push:
-    branches:
-      - master
-    paths:
-      - .github/workflows/go.yaml
-      - pkg/**
-      - integration_test/**
-      - mocks/**
-      - tools/**
-      - '**/go.*'
-    tags:
-      - v*
-  pull_request:
-    branches:
-      - master
-    paths:
-      - .github/workflows/go.yaml
-      - pkg/**
-      - integration_test/**
-      - mocks/**
-      - tools/**
-      - '**/go.*'
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
-        with:
-          go-version-file: go.mod
-          cache-dependency-path: go.sum
-      - run: make test
-
-  integration-test:
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - macos-latest
-          - windows-latest
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
-        with:
-          go-version-file: go.mod
-          cache-dependency-path: go.sum
-      - run: make integration-test
-
-  lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
-        with:
-          go-version-file: tools/go.mod
-          cache-dependency-path: tools/go.sum
-      - run: make lint
-
-  generate:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
-        with:
-          go-version-file: tools/go.mod
-          cache-dependency-path: tools/go.sum
-      - run: go mod tidy
-      - run: make generate
-      - uses: int128/update-generated-files-action@65b9a7ae3ededc5679d78343f58fbebcf1ebd785 # v2.57.0
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,78 +0,0 @@
-name: release
-
-on:
-  push:
-    branches:
-      - master
-    paths:
-      - .github/workflows/release.yaml
-      - pkg/**
-      - go.*
-    tags:
-      - v*
-  pull_request:
-    branches:
-      - master
-    paths:
-      - .github/workflows/release.yaml
-      - pkg/**
-      - go.*
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        platform:
-          - runs-on: ubuntu-latest
-            GOOS: linux
-            GOARCH: amd64
-            CGO_ENABLED: 0 # https://github.com/int128/kubelogin/issues/567
-          - runs-on: ubuntu-latest
-            GOOS: linux
-            GOARCH: arm64
-          - runs-on: ubuntu-latest
-            GOOS: linux
-            GOARCH: arm
-          - runs-on: ubuntu-latest
-            GOOS: linux
-            GOARCH: ppc64le
-          - runs-on: macos-latest
-            GOOS: darwin
-            GOARCH: amd64
-            CGO_ENABLED: 1 # https://github.com/int128/kubelogin/issues/249
-          - runs-on: macos-latest
-            GOOS: darwin
-            GOARCH: arm64
-            CGO_ENABLED: 1 # https://github.com/int128/kubelogin/issues/762
-          - runs-on: windows-latest
-            GOOS: windows
-            GOARCH: amd64
-          - runs-on: windows-latest
-            GOOS: windows
-            GOARCH: arm64
-    runs-on: ${{ matrix.platform.runs-on }}
-    env:
-      GOOS: ${{ matrix.platform.GOOS }}
-      GOARCH: ${{ matrix.platform.GOARCH }}
-      CGO_ENABLED: ${{ matrix.platform.CGO_ENABLED }}
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
-        with:
-          go-version-file: go.mod
-          cache-dependency-path: go.sum
-      - run: go build -ldflags '-X main.version=${{ github.ref_name }}'
-      - uses: int128/go-release-action@2979cc5b15ceb7ae458e95b0a9467afc7ae25259 # v2.0.0
-        with:
-          binary: kubelogin
-
-  publish:
-    if: github.ref_type == 'tag'
-    needs:
-      - build
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: rajatjindal/krew-release-bot@3d9faef30a82761d610544f62afddca00993eef9 # v0.0.47
--- a/.github/workflows/system-test.yaml
+++ b/.github/workflows/system-test.yaml
@@ -1,43 +0,0 @@
-name: system-test
-
-on:
-  pull_request:
-    branches:
-      - master
-    paths:
-      - .github/workflows/system-test.yaml
-      - system_test/**
-      - pkg/**
-      - go.*
-  push:
-    branches:
-      - master
-    paths:
-      - .github/workflows/system-test.yaml
-      - system_test/**
-      - pkg/**
-      - go.*
-
-jobs:
-  system-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
-        with:
-          go-version-file: go.mod
-          cache-dependency-path: go.sum
-
-      - run: sudo apt-get update
-      # Install certutil.
-      # https://packages.ubuntu.com/xenial/libnss3-tools
-      # Install keyring related packages.
-      # https://github.com/zalando/go-keyring/issues/45
-      - run: sudo apt-get install --no-install-recommends -y libnss3-tools dbus-x11 gnome-keyring
-
-      - run: echo '127.0.0.1 dex-server' | sudo tee -a /etc/hosts
-
-      - run: make -C system_test -j3
-
-      - run: make -C system_test logs
-        if: always()
--- a/.gitignore
+++ b/.gitignore
@@ -1,12 +1 @@
-/.idea
-
-/tools/bin
-
-/acceptance_test/output/
-
-/coverage.out
-
 /kubelogin
-/kubectl-oidc_login
-/kubelogin_*.zip
-/kubelogin_*.zip.sha256
--- a/.krew.yaml
+++ b/.krew.yaml
@@ -1,68 +0,0 @@
-apiVersion: krew.googlecontainertools.github.com/v1alpha2
-kind: Plugin
-metadata:
-  name: oidc-login
-spec:
-  homepage: https://github.com/int128/kubelogin
-  shortDescription: Log in to the OpenID Connect provider
-  description: |
-    This is a kubectl plugin for Kubernetes OpenID Connect (OIDC) authentication.
-
-    ## Credential plugin mode
-    kubectl executes oidc-login before calling the Kubernetes APIs.
-    oidc-login automatically opens the browser and you can log in to the provider.
-    After authentication, kubectl gets the token from oidc-login and you can access the cluster.
-    See https://github.com/int128/kubelogin#credential-plugin-mode for more.
-
-    ## Standalone mode
-    Run `kubectl oidc-login`.
-    It automatically opens the browser and you can log in to the provider.
-    After authentication, it writes the token to the kubeconfig and you can access the cluster.
-    See https://github.com/int128/kubelogin#standalone-mode for more.
-
-  caveats: |
-    You need to setup the OIDC provider, Kubernetes API server, role binding and kubeconfig.
-  version: {{ .TagName }}
-  platforms:
-  - bin: kubelogin
-    {{ addURIAndSha "https://github.com/int128/kubelogin/releases/download/{{ .TagName }}/kubelogin_linux_amd64.zip" .TagName }}
-    selector:
-      matchLabels:
-        os: linux
-        arch: amd64
-  - bin: kubelogin
-    {{ addURIAndSha "https://github.com/int128/kubelogin/releases/download/{{ .TagName }}/kubelogin_linux_arm64.zip" .TagName }}
-    selector:
-      matchLabels:
-        os: linux
-        arch: arm64
-  - bin: kubelogin
-    {{ addURIAndSha "https://github.com/int128/kubelogin/releases/download/{{ .TagName }}/kubelogin_linux_arm.zip" .TagName }}
-    selector:
-      matchLabels:
-        os: linux
-        arch: arm
-  - bin: kubelogin
-    {{ addURIAndSha "https://github.com/int128/kubelogin/releases/download/{{ .TagName }}/kubelogin_darwin_amd64.zip" .TagName }}
-    selector:
-      matchLabels:
-        os: darwin
-        arch: amd64
-  - bin: kubelogin
-    {{ addURIAndSha "https://github.com/int128/kubelogin/releases/download/{{ .TagName }}/kubelogin_darwin_arm64.zip" .TagName }}
-    selector:
-      matchLabels:
-        os: darwin
-        arch: arm64
-  - bin: kubelogin.exe
-    {{ addURIAndSha "https://github.com/int128/kubelogin/releases/download/{{ .TagName }}/kubelogin_windows_amd64.zip" .TagName }}
-    selector:
-      matchLabels:
-        os: windows
-        arch: amd64
-  - bin: kubelogin.exe
-    {{ addURIAndSha "https://github.com/int128/kubelogin/releases/download/{{ .TagName }}/kubelogin_windows_arm64.zip" .TagName }}
-    selector:
-      matchLabels:
-        os: windows
-        arch: arm64
--- a/.mockery.yaml
+++ b/.mockery.yaml
@@ -1,11 +0,0 @@
-outpkg: "{{.PackageName}}_mock"
-dir: "mocks/{{.PackagePath}}_mock"
-
-packages:
-  github.com/int128/kubelogin:
-    config:
-      all: true
-      recursive: true
-  io:
-    interfaces:
-      Closer:
--- a/20
+++ b/20
@@ -1,20 +0,0 @@
-FROM --platform=$BUILDPLATFORM golang:1.23 AS builder
-
-WORKDIR /builder
-
-# Copy the Go Modules manifests
-COPY go.mod go.mod
-COPY go.sum go.sum
-RUN go mod download
-
-# Copy the go source
-COPY main.go .
-COPY pkg pkg
-
-ARG TARGETOS
-ARG TARGETARCH
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build
-
-FROM gcr.io/distroless/base-debian12
-COPY --from=builder /builder/kubelogin /
-ENTRYPOINT ["/kubelogin"]
--- a/22
+++ b/22
@@ -1,22 +0,0 @@
-.PHONY: all
-all:
-
-.PHONY: test
-test:
-	go test -v -race ./pkg/...
-
-.PHONY: integration-test
-integration-test:
-	go test -v -race ./integration_test/...
-
-.PHONY: generate
-generate:
-	$(MAKE) -C tools
-	./tools/bin/wire ./pkg/di
-	rm -fr mocks/
-	./tools/bin/mockery
-
-.PHONY: lint
-lint:
-	$(MAKE) -C tools
-	./tools/bin/golangci-lint run
--- a/README.md
+++ b/README.md
@@ -1,146 +1,129 @@
-# kubelogin [![go](https://github.com/int128/kubelogin/actions/workflows/go.yaml/badge.svg)](https://github.com/int128/kubelogin/actions/workflows/go.yaml) [![Go Report Card](https://goreportcard.com/badge/github.com/int128/kubelogin)](https://goreportcard.com/report/github.com/int128/kubelogin)
+# kubelogin [![CircleCI](https://circleci.com/gh/int128/kubelogin.svg?style=shield)](https://circleci.com/gh/int128/kubelogin)

-This is a kubectl plugin for [Kubernetes OpenID Connect (OIDC) authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens), also known as `kubectl oidc-login`.
+`kubelogin` is a command to get an OpenID Connect (OIDC) token for `kubectl` authentication.

-Here is an example of Kubernetes authentication with the Google Identity Platform:
-
-<img alt="screencast" src="https://user-images.githubusercontent.com/321266/85427290-86e43700-b5b6-11ea-9e97-ffefd736c9b7.gif" width="572" height="391">
-
-Kubelogin is designed to run as a [client-go credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins).
-When you run kubectl, kubelogin opens the browser and you can log in to the provider.
-Then kubelogin gets a token from the provider and kubectl access Kubernetes APIs with the token.
-Take a look at the diagram:
-
-![Diagram of the credential plugin](docs/credential-plugin-diagram.svg)

 ## Getting Started

-### Setup
+Download [the latest release](https://github.com/int128/kubelogin/releases) and save it as `/usr/local/bin/kubelogin`.

-Install the latest release from [Homebrew](https://brew.sh/), [Krew](https://github.com/kubernetes-sigs/krew), [Chocolatey](https://chocolatey.org/packages/kubelogin) or [GitHub Releases](https://github.com/int128/kubelogin/releases).
+Run the command.

-```sh
-# Homebrew (macOS and Linux)
-brew install int128/kubelogin/kubelogin
+```
+% kubelogin
+2018/03/23 18:01:40 Reading config from /home/user/.kube/config
+2018/03/23 18:01:40 Using current context: hello.k8s.local
+2018/03/23 18:01:40 Using issuer: https://keycloak.example.com/auth/realms/hello
+2018/03/23 18:01:40 Using client ID: kubernetes
+2018/03/23 18:01:41 Starting OpenID Connect authentication:

-# Krew (macOS, Linux, Windows and ARM)
-kubectl krew install oidc-login
+## Automatic (recommended)

-# Chocolatey (Windows)
-choco install kubelogin
+Open the following URL in the web browser:
+
+http://localhost:8000/
+
+## Manual
+
+If you cannot access to localhost, instead open the following URL:
+
+https://keycloak.example.com/auth/realms/hello/protocol/openid-connect/auth?client_id=kubernetes&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&response_type=code&scope=openid+email&state=********
+
+Enter the code:
 ```

-If you install via GitHub releases, save the binary as the name `kubectl-oidc_login` on your path.
-When you invoke `kubectl oidc-login`, kubectl finds it by the [naming convention of kubectl plugins](https://kubernetes.io/docs/tasks/extend-kubectl/kubectl-plugins/).
-The other install methods do this for you.
+And then open http://localhost:8000.
+If you cannot access to localhost, you can choose manual interaction instead.

-You need to set up the OIDC provider, cluster role binding, Kubernetes API server and kubeconfig.
-Your kubeconfig looks like this:
+`kubelogin` will update your `~/.kube/config` with the ID token and refresh token, as follows:

 ```yaml
+# ~/.kube/config (snip)
+current-context: hello.k8s.local
+contexts:
+- context:
+    cluster: hello.k8s.local
+    user: hello.k8s.local
+  name: hello.k8s.local
 users:
-  - name: oidc
-    user:
-      exec:
-        apiVersion: client.authentication.k8s.io/v1
-        command: kubectl
-        args:
-          - oidc-login
-          - get-token
-          - --oidc-issuer-url=ISSUER_URL
-          - --oidc-client-id=YOUR_CLIENT_ID
+- name: hello.k8s.local
+  user:
+    auth-provider:
+      config:
+        idp-issuer-url: https://keycloak.example.com/auth/realms/hello
+        client-id: kubernetes
+        client-secret: YOUR_SECRET
+        id-token: ey...       # kubelogin will update ID token
+        refresh-token: ey...  # kubelogin will update refresh token
+      name: oidc
 ```

-See the [setup guide](docs/setup.md) for more.
+Make sure you can access to the cluster:

-### Run
-
-Run kubectl.
-
-```sh
-kubectl get pods
+```
+% kubectl version
+Client Version: version.Info{...}
+Server Version: version.Info{...}
 ```

-Kubectl executes kubelogin before calling the Kubernetes APIs.
-Kubelogin automatically opens the browser, and you can log in to the provider.

-After the authentication, kubelogin returns the credentials to kubectl.
-Kubectl then calls the Kubernetes APIs with the credentials.
+## Prerequisite

-```console
-% kubectl get pods
-Open http://localhost:8000 for authentication
-NAME                          READY   STATUS    RESTARTS   AGE
-echoserver-86c78fdccd-nzmd5   1/1     Running   0          26d
-```
+You have to setup your OIDC identity provider and Kubernetes cluster.

-Kubelogin stores the ID token and refresh token to the cache.
-If the ID token is valid, it just returns it.
-If the ID token has expired, it will refresh the token using the refresh token.
-If the refresh token has expired, it will perform re-authentication.
+### 1. Setup OIDC Identity Provider

-## Troubleshooting
+This tutorial assumes you have created an OIDC client with the following:

-### Token cache
+- Issuer URL: `https://keycloak.example.com/auth/realms/hello`
+- Client ID: `kubernetes`
+- Client Secret: `YOUR_CLIENT_SECRET`
+- Allowed redirect URLs:
+  - `http://localhost:8000/`
+  - `urn:ietf:wg:oauth:2.0:oob`
+- Groups claim: `groups` (optional for group based access controll)

-If the OS keyring is available, kubelogin stores the token cache to the OS keyring.
-Otherwise, kubelogin stores the token cache to the file system.
-See the [token cache](docs/usage.md#token-cache) for details.
+### 2. Setup Kubernetes API Server

-You can log out by deleting the token cache.
+Configure the Kubernetes API server allows your identity provider.

-```console
-% kubectl oidc-login clean
-Deleted the token cache at /home/user/.kube/cache/oidc-login
-Deleted the token cache in the keyring
-```
-
-Kubelogin will ask you to log in via the browser again.
-If the browser has a cookie for the provider, you need to log out from the provider or clear the cookie.
-
-### ID token claims
-
-You can run `setup` command to dump the claims of an ID token from the provider.
-
-```console
-% kubectl oidc-login setup --oidc-issuer-url=ISSUER_URL --oidc-client-id=REDACTED
-...
-You got a token with the following claims:
-
-{
-  "sub": "********",
-  "iss": "https://accounts.google.com",
-  "aud": "********",
-  ...
-}
-```
-
-You can set `-v1` option to increase the log level.
+If you are using kops, `kops edit cluster` and append the following settings:

 ```yaml
-users:
-  - name: oidc
-    user:
-      exec:
-        apiVersion: client.authentication.k8s.io/v1
-        command: kubectl
-        args:
-          - oidc-login
-          - get-token
-          - -v1
+spec:
+  kubeAPIServer:
+    oidcClientID: kubernetes
+    oidcGroupsClaim: groups
+    oidcIssuerURL: https://keycloak.example.com/auth/realms/hello
 ```

-You can run the [acceptance test](acceptance_test) to verify if kubelogin works with your provider.
+### 3. Setup kubectl

-## Docs
+Run the following script to configure `kubectl` uses your identity provider:
+
+```sh
+CLUSTER_NAME=hello.k8s.local
+
+kubectl config set-credentials $CLUSTER_NAME \
+  --auth-provider oidc \
+  --auth-provider-arg idp-issuer-url=https://keycloak.example.com/auth/realms/hello \
+  --auth-provider-arg client-id=kubernetes \
+  --auth-provider-arg client-secret=YOUR_CLIENT_SECRET
+
+# Set the context
+kubectl config set-context $CLUSTER_NAME --cluster $CLUSTER_NAME --user $CLUSTER_NAME
+```
+
+In actual team operation, you can distribute the script to your team members for easy setup.

- [Setup guide](docs/setup.md)
- [Usage and options](docs/usage.md)
- [Standalone mode](docs/standalone-mode.md)
- [System test](system_test)
- [Acceptance_test for identity providers](acceptance_test)

 ## Contributions

 This is an open source software licensed under Apache License 2.0.
-Feel free to open issues and pull requests for improving code and documents.
+Feel free to open issues and pull requests.
+
+### How to build
+
+```sh
+go get github.com/int128/kubelogin
+```
--- a/acceptance_test/Makefile
+++ b/acceptance_test/Makefile
@@ -1,42 +0,0 @@
-CLUSTER_NAME := kubelogin-acceptance-test
-OUTPUT_DIR := $(CURDIR)/output
-
-KUBECONFIG := $(OUTPUT_DIR)/kubeconfig.yaml
-export KUBECONFIG
-
-# create a Kubernetes cluster
-.PHONY: cluster
-cluster:
-	# create a cluster
-	mkdir -p $(OUTPUT_DIR)
-	sed -e "s|OIDC_ISSUER_URL|$(OIDC_ISSUER_URL)|" -e "s|OIDC_CLIENT_ID|$(OIDC_CLIENT_ID)|" cluster.yaml > $(OUTPUT_DIR)/cluster.yaml
-	kind create cluster --name $(CLUSTER_NAME) --config $(OUTPUT_DIR)/cluster.yaml
-	# set up access control
-	kubectl create clusterrole cluster-readonly --verb=get,watch,list --resource='*.*'
-	kubectl create clusterrolebinding cluster-readonly --clusterrole=cluster-readonly --user=$(YOUR_EMAIL)
-	# set up kubectl
-	kubectl config set-credentials oidc \
-		--exec-api-version=client.authentication.k8s.io/v1beta1 \
-		--exec-command=$(CURDIR)/../kubelogin \
-		--exec-arg=get-token \
-		--exec-arg=--token-cache-dir=$(OUTPUT_DIR)/token-cache \
-		--exec-arg=--oidc-issuer-url=$(OIDC_ISSUER_URL) \
-		--exec-arg=--oidc-client-id=$(OIDC_CLIENT_ID) \
-		--exec-arg=--oidc-client-secret=$(OIDC_CLIENT_SECRET) \
-		--exec-arg=--oidc-extra-scope=email
-	# switch the default user
-	kubectl config set-context --current --user=oidc
-
-# clean up the resources
-.PHONY: clean
-clean:
-	-rm -r $(OUTPUT_DIR)
-.PHONY: delete-cluster
-delete-cluster:
-	kind delete cluster --name $(CLUSTER_NAME)
-
-.PHONY: check
-check:
-	docker version
-	kind version
-	kubectl version --client
--- a/acceptance_test/README.md
+++ b/acceptance_test/README.md
@@ -1,75 +0,0 @@
-# kubelogin/acceptance_test
-
-This is a manual test for verifying Kubernetes OIDC authentication with your OIDC provider.
-
-
-## Purpose
-
-This test checks the following points:
-
-1. You can set up your OIDC provider using [setup guide](../docs/setup.md).
-1. The plugin works with your OIDC provider.
-
-
-## Getting Started
-
-### Prerequisite
-
-You need to build the plugin into the parent directory.
-
-```sh
-make -C ..
-```
-
-You need to set up your provider.
-See [setup guide](../docs/setup.md) for more.
-
-You need to install the following tools:
-
- Docker
- Kind
- kubectl
-
-You can check if the tools are available.
-
-```sh
-make check
-```
-
-### 1. Create a cluster
-
-Create a cluster.
-For example, you can create a cluster with Google account authentication.
-
-```sh
-make OIDC_ISSUER_URL=https://accounts.google.com \
-  OIDC_CLIENT_ID=REDACTED.apps.googleusercontent.com \
-  OIDC_CLIENT_SECRET=REDACTED \
-  YOUR_EMAIL=REDACTED@gmail.com
-```
-
-It will do the following steps:
-
-1. Create a cluster.
-1. Set up access control. It allows read-only access from your email address.
-1. Set up kubectl to enable the plugin.
-
-You can change kubectl configuration in generated `output/kubeconfig.yaml`.
-
-### 2. Run kubectl
-
-Make sure you can log in to the provider and access the cluster.
-
-```console
-% export KUBECONFIG=$PWD/output/kubeconfig.yaml
-% kubectl get pods -A
-```
-
-### Clean up
-
-To delete the cluster and generated files:
-
-```sh
-make delete-cluster
-make clean
-```
--- a/acceptance_test/cluster.yaml
+++ b/acceptance_test/cluster.yaml
@@ -1,13 +0,0 @@
-kind: Cluster
-apiVersion: kind.x-k8s.io/v1alpha4
-kubeadmConfigPatches:
-  - |
-    apiVersion: kubeadm.k8s.io/v1beta2
-    kind: ClusterConfiguration
-    metadata:
-      name: config
-    apiServer:
-      extraArgs:
-        oidc-issuer-url: OIDC_ISSUER_URL
-        oidc-client-id: OIDC_CLIENT_ID
-        oidc-username-claim: email
--- a/config.go
+++ b/config.go
@@ -0,0 +1,46 @@
+package main
+
+import (
+	"os"
+
+	"github.com/mitchellh/go-homedir"
+	"k8s.io/client-go/tools/clientcmd"
+	"k8s.io/client-go/tools/clientcmd/api"
+)
+
+// GetCurrentAuthInfo returns the current authInfo
+func GetCurrentAuthInfo(config api.Config) *api.AuthInfo {
+	context := config.Contexts[config.CurrentContext]
+	if context == nil {
+		return nil
+	}
+	authInfo := config.AuthInfos[context.AuthInfo]
+	return authInfo
+}
+
+// ReadKubeConfig returns the current config
+func ReadKubeConfig(path string) (*api.Config, error) {
+	config, err := clientcmd.LoadFromFile(path)
+	if err != nil {
+		return nil, err
+	}
+	return config, nil
+}
+
+// WriteKubeConfig writes the config
+func WriteKubeConfig(config api.Config, path string) error {
+	return clientcmd.WriteToFile(config, path)
+}
+
+// FindKubeConfig returns env:KUBECONFIG or ~/.kube/config
+func FindKubeConfig() (string, error) {
+	env := os.Getenv("KUBECONFIG")
+	if env != "" {
+		return env, nil
+	}
+	path, err := homedir.Expand("~/.kube/config")
+	if err != nil {
+		return "", err
+	}
+	return path, nil
+}
--- a/docs/credential-plugin-diagram.svg
+++ b/docs/credential-plugin-diagram.svg
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -1,226 +0,0 @@
-# Kubernetes OpenID Connection authentication
-
-This document guides how to set up Kubernetes OpenID Connect (OIDC) authentication.
-Let's see the following steps:
-
-1. Set up the OIDC provider
-1. Verify authentication
-1. Bind a cluster role
-1. Set up the Kubernetes API server
-1. Set up the kubeconfig
-1. Verify cluster access
-
-## 1. Set up the OIDC provider
-
-Kubelogin supports the following authentication flows:
-
- Authorization code flow
- Device authorization grant
- Resource owner password credentials grant
-
-See the [usage](usage.md) for the details.
-
-### Google Identity Platform
-
-You can log in with a Google account.
-
-Open [Google APIs Console](https://console.developers.google.com/apis/credentials) and create an OAuth client with the following setting:
-
- Application Type: Other
-
-Check the client ID and secret.
-Replace the following variables in the later sections.
-
-| Variable         | Value                            |
-| ---------------- | -------------------------------- |
-| `ISSUER_URL`     | `https://accounts.google.com`    |
-| `YOUR_CLIENT_ID` | `xxx.apps.googleusercontent.com` |
-
-### Keycloak
-
-You can log in with a user of Keycloak.
-Make sure you have an administrator role of the Keycloak realm.
-
-Open Keycloak and create an OIDC client as follows:
-
- Client ID: `YOUR_CLIENT_ID`
- Valid Redirect URLs:
-  - `http://localhost:8000`
-  - `http://localhost:18000` (used if the port 8000 is already in use)
- Issuer URL: `https://keycloak.example.com/auth/realms/YOUR_REALM`
-
-You can associate client roles by adding the following mapper:
-
- Name: `groups`
- Mapper Type: `User Client Role`
- Client ID: `YOUR_CLIENT_ID`
- Client Role prefix: `kubernetes:`
- Token Claim Name: `groups`
- Add to ID token: on
-
-For example, if you have `admin` role of the client, you will get a JWT with the claim `{"groups": ["kubernetes:admin"]}`.
-
-Replace the following variables in the later sections.
-
-| Variable         | Value                                                 |
-| ---------------- | ----------------------------------------------------- |
-| `ISSUER_URL`     | `https://keycloak.example.com/auth/realms/YOUR_REALM` |
-| `YOUR_CLIENT_ID` | `YOUR_CLIENT_ID`                                      |
-
-### Dex with GitHub
-
-You can log in with a GitHub account.
-
-Open [GitHub OAuth Apps](https://github.com/settings/developers) and create an application with the following setting:
-
- Application name: (any)
- Homepage URL: `https://dex.example.com`
- Authorization callback URL: `https://dex.example.com/callback`
-
-Deploy [Dex](https://github.com/dexidp/dex) with the following config:
-
-```yaml
-issuer: https://dex.example.com
-connectors:
-  - type: github
-    id: github
-    name: GitHub
-    config:
-      clientID: YOUR_GITHUB_CLIENT_ID
-      clientSecret: YOUR_GITHUB_CLIENT_SECRET
-      redirectURI: https://dex.example.com/callback
-staticClients:
-  - id: YOUR_CLIENT_ID
-    name: Kubernetes
-    redirectURIs:
-      - http://localhost:8000
-      - http://localhost:18000
-    secret: YOUR_DEX_CLIENT_SECRET
-```
-
-Replace the following variables in the later sections.
-
-| Variable             | Value                     |
-| -------------------- | ------------------------- |
-| `ISSUER_URL`         | `https://dex.example.com` |
-| `YOUR_CLIENT_ID`     | `YOUR_CLIENT_ID`          |
-| `YOUR_CLIENT_SECRET` | `YOUR_DEX_CLIENT_SECRET`  |
-
-### Okta
-
-You can log in with an Okta user.
-Okta supports [the authorization code flow with PKCE](https://developer.okta.com/docs/guides/implement-auth-code-pkce/overview/)
-and this section explains how to set up it.
-
-Open your Okta organization and create an application with the following options:
-
- Application type: Native
- Initiate login URI: `http://localhost:8000`
- Login redirect URIs:
-  - `http://localhost:8000`
-  - `http://localhost:18000` (used if the port 8000 is already in use)
- Allowed grant types: Authorization Code
- Client authentication: Use PKCE (for public clients)
-
-Replace the following variables in the later sections.
-
-| Variable         | Value                                |
-| ---------------- | ------------------------------------ |
-| `ISSUER_URL`     | `https://YOUR_ORGANIZATION.okta.com` |
-| `YOUR_CLIENT_ID` | random string                        |
-
-You do not need to set `YOUR_CLIENT_SECRET`.
-
-If you need `groups` claim for access control,
-see [jetstack/okta-kubectl-auth](https://github.com/jetstack/okta-kubectl-auth/blob/master/docs/okta-setup.md) and [#250](https://github.com/int128/kubelogin/issues/250).
-
-### Ping Identity
-
-Login with an account that has permissions to create applications.
-Create an OIDC application with the following configuration:
-
- Redirect URIs:
-  - `http://localhost:8000`
-  - `http://localhost:18000` (used if the port 8000 is already in use)
- Grant type: Authorization Code
- PKCE Enforcement: Required
-
-Leverage the following variables in the next steps.
-
-| Variable         | Value                                             |
-| ---------------- | ------------------------------------------------- |
-| `ISSUER_URL`     | `https://auth.pingone.com/<PingOne Tenant Id>/as` |
-| `YOUR_CLIENT_ID` | random string                                     |
-
-`YOUR_CLIENT_SECRET` is not required for this configuration.
-
-## 2. Verify authentication
-
-Run the following command:
-
-```sh
-kubectl oidc-login setup \
-  --oidc-issuer-url=ISSUER_URL \
-  --oidc-client-id=YOUR_CLIENT_ID
-```
-
-It launches the browser and navigates to `http://localhost:8000`.
-Please log in to the provider.
-
-You can set extra options, for example, extra scope or CA certificate.
-See also the full options.
-
-```sh
-kubectl oidc-login setup --help
-```
-
-## 3. Bind a cluster role
-
-Here bind `cluster-admin` role to you.
-
-```sh
-kubectl create clusterrolebinding oidc-cluster-admin --clusterrole=cluster-admin --user='ISSUER_URL#YOUR_SUBJECT'
-```
-
-As well as you can create a custom cluster role and bind it.
-
-## 4. Set up the Kubernetes API server
-
-Add the following flags to kube-apiserver:
-
-```
--oidc-issuer-url=ISSUER_URL
--oidc-client-id=YOUR_CLIENT_ID
-```
-
-See [Kubernetes Authenticating: OpenID Connect Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) for the all flags.
-
-## 5. Set up the kubeconfig
-
-Add `oidc` user to the kubeconfig.
-
-```sh
-kubectl config set-credentials oidc \
-  --exec-api-version=client.authentication.k8s.io/v1 \
-  --exec-command=kubectl \
-  --exec-arg=oidc-login \
-  --exec-arg=get-token \
-  --exec-arg=--oidc-issuer-url=ISSUER_URL \
-  --exec-arg=--oidc-client-id=YOUR_CLIENT_ID
-```
-
-## 6. Verify cluster access
-
-Make sure you can access the Kubernetes cluster.
-
-```sh
-kubectl --user=oidc cluster-info
-```
-
-You can switch the current context to oidc.
-
-```sh
-kubectl config set-context --current --user=oidc
-```
-
-You can share the kubeconfig to your team members for on-boarding.
--- a/docs/standalone-mode.md
+++ b/docs/standalone-mode.md
@@ -1,106 +0,0 @@
-# Standalone mode
-
-Kubelogin supports the standalone mode as well.
-It writes the token to the kubeconfig (typically `~/.kube/config`) after authentication.
-
-## Getting started
-
-Configure your kubeconfig like:
-
-```yaml
- name: keycloak
-  user:
-    auth-provider:
-      config:
-        client-id: YOUR_CLIENT_ID
-        client-secret: YOUR_CLIENT_SECRET
-        idp-issuer-url: https://issuer.example.com
-      name: oidc
-```
-
-Run kubelogin:
-
-```sh
-kubelogin
-
-# or run as a kubectl plugin
-kubectl oidc-login
-```
-
-It automatically opens the browser and you can log in to the provider.
-
-<img src="keycloak-login.png" alt="keycloak-login" width="455" height="329">
-
-After authentication, kubelogin writes the ID token and refresh token to the kubeconfig.
-
-```console
-% kubelogin
-Open http://localhost:8000 for authentication
-You got a valid token until 2019-05-18 10:28:51 +0900 JST
-Updated ~/.kubeconfig
-```
-
-Now you can access the cluster.
-
-```console
-% kubectl get pods
-NAME                          READY   STATUS    RESTARTS   AGE
-echoserver-86c78fdccd-nzmd5   1/1     Running   0          26d
-```
-
-Your kubeconfig looks like:
-
-```yaml
-users:
-  - name: keycloak
-    user:
-      auth-provider:
-        config:
-          client-id: YOUR_CLIENT_ID
-          client-secret: YOUR_CLIENT_SECRET
-          idp-issuer-url: https://issuer.example.com
-          id-token: ey... # kubelogin will add or update the ID token here
-          refresh-token: ey... # kubelogin will add or update the refresh token here
-        name: oidc
-```
-
-If the ID token is valid, kubelogin does nothing.
-
-```console
-% kubelogin
-You already have a valid token until 2019-05-18 10:28:51 +0900 JST
-```
-
-If the ID token has expired, kubelogin will refresh the token using the refresh token in the kubeconfig.
-If the refresh token has expired, kubelogin will proceed the authentication.
-
-## Usage
-
-You can set path to the kubeconfig file by the option or the environment variable just like kubectl.
-It defaults to `~/.kube/config`.
-
-```sh
-# by the option
-kubelogin --kubeconfig /path/to/kubeconfig
-
-# by the environment variable
-KUBECONFIG="/path/to/kubeconfig1:/path/to/kubeconfig2" kubelogin
-```
-
-If you set multiple files, kubelogin will find the file which has the current authentication (i.e. `user` and `auth-provider`) and write a token to it.
-
-Kubelogin supports the following keys of `auth-provider` in a kubeconfig.
-See [kubectl authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-kubectl) for more.
-
-| Key                              | Direction        | Value                                                |
-| -------------------------------- | ---------------- | ---------------------------------------------------- |
-| `idp-issuer-url`                 | Read (Mandatory) | Issuer URL of the provider.                          |
-| `client-id`                      | Read (Mandatory) | Client ID of the provider.                           |
-| `client-secret`                  | Read (Mandatory) | Client Secret of the provider.                       |
-| `idp-certificate-authority`      | Read             | CA certificate path of the provider.                 |
-| `idp-certificate-authority-data` | Read             | Base64 encoded CA certificate of the provider.       |
-| `extra-scopes`                   | Read             | Scopes to request to the provider (comma separated). |
-| `id-token`                       | Write            | ID token got from the provider.                      |
-| `refresh-token`                  | Write            | Refresh token got from the provider.                 |
-
-See also [usage.md](usage.md).
--- a/docs/system-test-diagram.svg
+++ b/docs/system-test-diagram.svg
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -1,328 +0,0 @@
-# Usage
-
-Kubelogin supports the following options:
-
-```
-Usage:
-  kubelogin get-token [flags]
-
-Flags:
-      --oidc-issuer-url string                          Issuer URL of the provider (mandatory)
-      --oidc-client-id string                           Client ID of the provider (mandatory)
-      --oidc-client-secret string                       Client secret of the provider
-      --oidc-extra-scope strings                        Scopes to request to the provider
-      --oidc-use-access-token                           Instead of using the id_token, use the access_token to authenticate to Kubernetes
-      --force-refresh                                   If set, refresh the ID token regardless of its expiration time
-      --token-cache-dir string                          Path to a directory of the token cache (default "~/.kube/cache/oidc-login")
-      --token-cache-storage string                      Storage for the token cache. One of (auto|keyring|disk) (default "auto")
-      --certificate-authority stringArray               Path to a cert file for the certificate authority
-      --certificate-authority-data stringArray          Base64 encoded cert for the certificate authority
-      --insecure-skip-tls-verify                        [SECURITY RISK] If set, the server's certificate will not be checked for validity
-      --tls-renegotiation-once                          If set, allow a remote server to request renegotiation once per connection
-      --tls-renegotiation-freely                        If set, allow a remote server to repeatedly request renegotiation
-      --oidc-pkce-method string                         PKCE code challenge method. Automatically determined by default. One of (auto|no|S256) (default "auto")
-      --grant-type string                               Authorization grant type to use. One of (auto|authcode|authcode-keyboard|password|device-code) (default "auto")
-      --listen-address strings                          [authcode] Address to bind to the local server. If multiple addresses are set, it will try binding in order (default [127.0.0.1:8000,127.0.0.1:18000])
-      --skip-open-browser                               [authcode] Do not open the browser automatically
-      --browser-command string                          [authcode] Command to open the browser
-      --authentication-timeout-sec int                  [authcode] Timeout of authentication in seconds (default 180)
-      --local-server-cert string                        [authcode] Certificate path for the local server
-      --local-server-key string                         [authcode] Certificate key path for the local server
-      --open-url-after-authentication string            [authcode] If set, open the URL in the browser after authentication
-      --oidc-redirect-url-hostname string               [authcode] Hostname of the redirect URL (default "localhost")
-      --oidc-redirect-url-authcode-keyboard string      [authcode-keyboard] Redirect URL (default "urn:ietf:wg:oauth:2.0:oob")
-      --oidc-auth-request-extra-params stringToString   [authcode, authcode-keyboard] Extra query parameters to send with an authentication request (default [])
-      --username string                                 [password] Username for resource owner password credentials grant
-      --password string                                 [password] Password for resource owner password credentials grant
-  -h, --help                                            help for get-token
-
-Global Flags:
-      --add_dir_header                   If true, adds the file directory to the header of the log messages
-      --alsologtostderr                  log to standard error as well as files (no effect when -logtostderr=true)
-      --log_backtrace_at traceLocation   when logging hits line file:N, emit a stack trace (default :0)
-      --log_dir string                   If non-empty, write log files in this directory (no effect when -logtostderr=true)
-      --log_file string                  If non-empty, use this log file (no effect when -logtostderr=true)
-      --log_file_max_size uint           Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
-      --logtostderr                      log to standard error instead of files (default true)
-      --one_output                       If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
-      --skip_headers                     If true, avoid header prefixes in the log messages
-      --skip_log_headers                 If true, avoid headers when opening log files (no effect when -logtostderr=true)
-      --stderrthreshold severity         logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2)
-  -v, --v Level                          number for the log level verbosity
-      --vmodule moduleSpec               comma-separated list of pattern=N settings for file-filtered logging
-```
-
-Here is the sequence diagram of the credential plugin.
-
-```mermaid
-sequenceDiagram
-  actor User
-  User ->>+ kubectl: Run
-  kubectl ->>+ kubelogin: Run the plugin
-  kubelogin ->>+ Provider: Authentication request
-  Note over User, Provider: Browser interaction
-  Provider -->>- kubelogin: Authentication response
-  kubelogin ->>+ Provider: Token request
-  Provider -->>- kubelogin: Token response
-  kubelogin -->>- kubectl: Credential
-  kubectl ->>+ kube-apiserver: Request with the credential
-  kube-apiserver -->>- kubectl: Response
-  kubectl -->>- User: Response
-```
-
-## Options
-
-### Authentication timeout
-
-By default, you need to log in to your provider in the browser within 3 minutes.
-This prevents a process from remaining forever.
-You can change the timeout by the following flag:
-
-```yaml
- --authentication-timeout-sec=60
-```
-
-For now this timeout works only for the authorization code flow.
-
-### Extra scopes
-
-You can set the extra scopes to request to the provider by `--oidc-extra-scope`.
-
-```yaml
- --oidc-extra-scope=email
- --oidc-extra-scope=profile
-```
-
-### PKCE
-
-Kubelogin automatically uses the PKCE if the provider supports it.
-It determines the code challenge method by the `code_challenge_methods_supported` claim of the OpenID Connect Discovery document.
-
-If your provider does not return a valid `code_challenge_methods_supported` claim,
-you can enforce the code challenge method by `--oidc-pkce-method`.
-
-```yaml
- --oidc-pkce-method=S256
-```
-
-For the most providers, you don't need to set this option explicitly.
-
-### CA certificate
-
-You can use your self-signed certificate for the provider.
-
-```yaml
- --certificate-authority=/home/user/.kube/keycloak-ca.pem
- --certificate-authority-data=LS0t...
-```
-
-### HTTP proxy
-
-You can set the following environment variables if you are behind a proxy: `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY`.
-See also [net/http#ProxyFromEnvironment](https://golang.org/pkg/net/http/#ProxyFromEnvironment).
-
-### Token cache
-
-Kubelogin stores the token cache to the OS keyring if available.
-It depends on [zalando/go-keyring](https://github.com/zalando/go-keyring) for the keyring storage.
-
-If you encounter a problem, try `--token-cache-storage` to set the storage.
-
-```yaml
-# Force to use the OS keyring
- --token-cache-storage=keyring
-# Force to use the file system
- --token-cache-storage=disk
-```
-
-### Home directory expansion
-
-If a value in the following options begins with a tilde character `~`, it is expanded to the home directory.
-
- `--certificate-authority`
- `--local-server-cert`
- `--local-server-key`
- `--token-cache-dir`
-
-## Authentication flows
-
-Kubelogin support the following flows:
-
- [Authorization code flow](#authorization-code-flow)
- [Authorization code flow with a keyboard](#authorization-code-flow-with-a-keyboard)
- [Device authorization grant](#device-authorization-grant)
- [Resource owner password credentials grant](#resource-owner-password-credentials-grant)
-
-### Authorization code flow
-
-Kubelogin performs the [authorization code flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) by default.
-
-It starts the local server at port 8000 or 18000 by default.
-You need to register the following redirect URIs to the provider:
-
- `http://localhost:8000`
- `http://localhost:18000` (used if port 8000 is already in use)
-
-You can change the listening address.
-
-```yaml
- --listen-address=127.0.0.1:12345
- --listen-address=127.0.0.1:23456
-```
-
-You can specify a certificate for the local webserver if HTTPS is required by your identity provider.
-
-```yaml
- --local-server-cert=localhost.crt
- --local-server-key=localhost.key
-```
-
-You can change the hostname of redirect URI from the default value `localhost`.
-
-```yaml
- --oidc-redirect-url-hostname=127.0.0.1
-```
-
-You can add extra parameters to the authentication request.
-
-```yaml
- --oidc-auth-request-extra-params=ttl=86400
-```
-
-When authentication completed, kubelogin shows a message to close the browser.
-You can change the URL to show after authentication.
-
-```yaml
- --open-url-after-authentication=https://example.com/success.html
-```
-
-If you encounter a problem with the browser, you can change the browser command or skip opening the browser.
-
-```yaml
-# Change the browser command
- --browser-command=google-chrome
-# Do not open the browser
- --skip-open-browser
-```
-
-### Authorization code flow with a keyboard
-
-If you cannot access the browser, instead use the authorization code flow with a keyboard.
-
-```yaml
- --grant-type=authcode-keyboard
-```
-
-Kubelogin will show the URL and prompt.
-Open the URL in the browser and then copy the code shown.
-
-```
-% kubectl get pods
-Open https://accounts.google.com/o/oauth2/v2/auth?access_type=offline&client_id=...
-Enter code: YOUR_CODE
-```
-
-The default of redirect URI is `urn:ietf:wg:oauth:2.0:oob`.
-You can overwrite it.
-
-```yaml
- oidc-redirect-url-authcode-keyboard=http://localhost
-```
-
-You can add extra parameters to the authentication request.
-
-```yaml
- --oidc-auth-request-extra-params=ttl=86400
-```
-
-### Device authorization grant
-
-Kubelogin performs the [device authorization grant](https://tools.ietf.org/html/rfc8628) when `--grant-type=device-code` is set.
-
-```yaml
- --grant-type=device-code
-```
-
-It automatically opens the browser.
-If the provider returns the `verification_uri_complete` parameter, you don't need to enter the code.
-Otherwise, you need to enter the code shown.
-
-If you encounter a problem with the browser, you can change the browser command or skip opening the browser.
-
-```yaml
-# Change the browser command
- --browser-command=google-chrome
-# Do not open the browser
- --skip-open-browser
-```
-
-### Resource owner password credentials grant
-
-Kubelogin performs the resource owner password credentials grant
-when `--grant-type=password` or `--username` is set.
-
-Note that most OIDC providers do not support this grant.
-Keycloak supports this grant but you need to explicitly enable the "Direct Access Grants" feature in the client settings.
-
-You can set the username and password.
-
-```yaml
- --username=USERNAME
- --password=PASSWORD
-```
-
-If the password is not set, kubelogin will show the prompt for the password.
-
-```yaml
- --username=USERNAME
-```
-
-```
-% kubectl get pods
-Password:
-```
-
-If the username is not set, kubelogin will show the prompt for the username and password.
-
-```yaml
- --grant-type=password
-```
-
-```
-% kubectl get pods
-Username: foo
-Password:
-```
-
-## Run in Docker
-
-You can run [the Docker image](https://ghcr.io/int128/kubelogin) instead of the binary.
-The kubeconfig looks like:
-
-```yaml
-users:
-  - name: oidc
-    user:
-      exec:
-        apiVersion: client.authentication.k8s.io/v1
-        command: docker
-        args:
-          - run
-          - --rm
-          - -v
-          - /tmp/.token-cache:/.token-cache
-          - -p
-          - 8000:8000
-          - ghcr.io/int128/kubelogin
-          - get-token
-          - --token-cache-dir=/.token-cache
-          - --listen-address=0.0.0.0:8000
-          - --oidc-issuer-url=ISSUER_URL
-          - --oidc-client-id=YOUR_CLIENT_ID
-          - --oidc-client-secret=YOUR_CLIENT_SECRET
-```
-
-Known limitations:
-
- It cannot open the browser automatically.
- The container port and listen port must be equal for consistency of the redirect URI.
--- a/go.mod
+++ b/go.mod
@@ -1,66 +0,0 @@
-module github.com/int128/kubelogin
-
-go 1.23.5
-
-require (
-	github.com/chromedp/chromedp v0.11.2
-	github.com/coreos/go-oidc/v3 v3.12.0
-	github.com/gofrs/flock v0.12.1
-	github.com/golang-jwt/jwt/v5 v5.2.1
-	github.com/google/go-cmp v0.6.0
-	github.com/google/wire v0.6.0
-	github.com/int128/oauth2cli v1.14.1
-	github.com/int128/oauth2dev v1.0.1
-	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
-	github.com/spf13/cobra v1.8.1
-	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.10.0
-	github.com/zalando/go-keyring v0.2.6
-	golang.org/x/oauth2 v0.25.0
-	golang.org/x/sync v0.10.0
-	golang.org/x/term v0.28.0
-	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/apimachinery v0.32.1
-	k8s.io/client-go v0.32.1
-	k8s.io/klog/v2 v2.130.1
-)
-
-require (
-	al.essio.dev/pkg/shellescape v1.5.1 // indirect
-	github.com/chromedp/cdproto v0.0.0-20241022234722-4d5d5faf59fb // indirect
-	github.com/chromedp/sysutil v1.1.0 // indirect
-	github.com/danieljoos/wincred v1.2.2 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.2 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
-	github.com/gobwas/httphead v0.1.0 // indirect
-	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/gobwas/ws v1.4.0 // indirect
-	github.com/godbus/dbus/v5 v5.1.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/int128/listener v1.1.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/rogpeppe/go-internal v1.13.1 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/crypto v0.28.0 // indirect
-	golang.org/x/net v0.30.0 // indirect
-	golang.org/x/sys v0.29.0 // indirect
-	golang.org/x/text v0.19.0 // indirect
-	golang.org/x/time v0.7.0 // indirect
-	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
-)
--- a/go.sum
+++ b/go.sum
@@ -1,237 +0,0 @@
-al.essio.dev/pkg/shellescape v1.5.1 h1:86HrALUujYS/h+GtqoB26SBEdkWfmMI6FubjXlsXyho=
-al.essio.dev/pkg/shellescape v1.5.1/go.mod h1:6sIqp7X2P6mThCQ7twERpZTuigpr6KbZWtls1U8I890=
-cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
-github.com/chromedp/cdproto v0.0.0-20241022234722-4d5d5faf59fb h1:noKVm2SsG4v0Yd0lHNtFYc9EUxIVvrr4kJ6hM8wvIYU=
-github.com/chromedp/cdproto v0.0.0-20241022234722-4d5d5faf59fb/go.mod h1:4XqMl3iIW08jtieURWL6Tt5924w21pxirC6th662XUM=
-github.com/chromedp/chromedp v0.11.2 h1:ZRHTh7DjbNTlfIv3NFTbB7eVeu5XCNkgrpcGSpn2oX0=
-github.com/chromedp/chromedp v0.11.2/go.mod h1:lr8dFRLKsdTTWb75C/Ttol2vnBKOSnt0BW8R9Xaupi8=
-github.com/chromedp/sysutil v1.1.0 h1:PUFNv5EcprjqXZD9nJb9b/c9ibAbxiYo4exNWZyipwM=
-github.com/chromedp/sysutil v1.1.0/go.mod h1:WiThHUdltqCNKGc4gaU50XgYjwjYIhKWoHGPTUfWTJ8=
-github.com/coreos/go-oidc/v3 v3.12.0 h1:sJk+8G2qq94rDI6ehZ71Bol3oUHy63qNYmkiSjrc/Jo=
-github.com/coreos/go-oidc/v3 v3.12.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/danieljoos/wincred v1.2.2 h1:774zMFJrqaeYCK2W57BgAem/MLi6mtSE47MB6BOJ0i0=
-github.com/danieljoos/wincred v1.2.2/go.mod h1:w7w4Utbrz8lqeMbDAK0lkNJUv5sAOkFi7nd/ogr0Uh8=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
-github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
-github.com/go-jose/go-jose/v4 v4.0.2 h1:R3l3kkBds16bO7ZFAEEcofK0MkrAJt3jlJznWZG0nvk=
-github.com/go-jose/go-jose/v4 v4.0.2/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
-github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
-github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
-github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
-github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
-github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
-github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
-github.com/google/subcommands v1.2.0/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/wire v0.6.0 h1:HBkoIh4BdSxoyo9PveV8giw7ZsaBOvzWKfcg/6MrVwI=
-github.com/google/wire v0.6.0/go.mod h1:F4QhpQ9EDIdJ1Mbop/NZBRB+5yrR6qg3BnctaoUk6NA=
-github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
-github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/int128/listener v1.1.0 h1:2Jb41DWLpkQ3I9bIdBzO8H/tNwMvyl/OBZWtCV5Pjuw=
-github.com/int128/listener v1.1.0/go.mod h1:68WkmTN8PQtLzc9DucIaagAKeGVyMnyyKIkW4Xn47UA=
-github.com/int128/oauth2cli v1.14.1 h1:MxkiSSMT1RcsVKxyzaJYGgmMXvGWPXTMduhG4a1OqTs=
-github.com/int128/oauth2cli v1.14.1/go.mod h1:ha/eC3cUAixVzJ0V+voMRNQejLWGvk49AWDWN4Gawsk=
-github.com/int128/oauth2dev v1.0.1 h1:TWokv4obxKuRZXvcXFMOYcaAcdZ/rcZYcbjkJNu+6Ek=
-github.com/int128/oauth2dev v1.0.1/go.mod h1:caoxoXz7nlt2nc7/o3GKgGCyuruOAmsViPSRmrUmV9o=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80 h1:6Yzfa6GP0rIo/kULo2bwGEkFvCePZ3qHDDTC3/J9Swo=
-github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhAVbbWWBzr41ElhJx5tXPWkIHA2HWPRuw=
-github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zalando/go-keyring v0.2.6 h1:r7Yc3+H+Ux0+M72zacZoItR3UDxeWfKTcabvkI8ua9s=
-github.com/zalando/go-keyring v0.2.6/go.mod h1:2TCrxYrbUNYfNS/Kgy/LSrkSQzZ5UPVH85RwfczwvcI=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
-golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
-golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
-golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
-golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
-golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
-golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
-golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
-google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
-gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.32.1 h1:f562zw9cy+GvXzXf0CKlVQ7yHJVYzLfL6JAS4kOAaOc=
-k8s.io/api v0.32.1/go.mod h1:/Yi/BqkuueW1BgpoePYBRdDYfjPF5sgTr5+YqDZra5k=
-k8s.io/apimachinery v0.32.1 h1:683ENpaCBjma4CYqsmZyhEzrGz6cjn1MY/X2jB2hkZs=
-k8s.io/apimachinery v0.32.1/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
-k8s.io/client-go v0.32.1 h1:otM0AxdhdBIaQh7l1Q0jQpmo7WOFIk5FFa4bg6YMdUU=
-k8s.io/client-go v0.32.1/go.mod h1:aTTKZY7MdxUaJ/KiUs8D+GssR9zJZi77ZqtzcGXIiDg=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
-k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.2 h1:MdmvkGuXi/8io6ixD5wud3vOLwc1rj0aNqRlpuvjmwA=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
--- a/integration_test/clean_test.go
+++ b/integration_test/clean_test.go
@@ -1,28 +0,0 @@
-package integration_test
-
-import (
-	"context"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/int128/kubelogin/integration_test/httpdriver"
-	"github.com/int128/kubelogin/pkg/di"
-	"github.com/int128/kubelogin/pkg/testing/clock"
-	"github.com/int128/kubelogin/pkg/testing/logger"
-)
-
-func TestClean(t *testing.T) {
-	tokenCacheDir := t.TempDir()
-
-	cmd := di.NewCmdForHeadless(clock.Fake(time.Now()), os.Stdin, os.Stdout, logger.New(t), httpdriver.Zero(t))
-	exitCode := cmd.Run(context.TODO(), []string{
-		"kubelogin",
-		"clean",
-		"--token-cache-dir", tokenCacheDir,
-		"--token-cache-storage", "disk",
-	}, "HEAD")
-	if exitCode != 0 {
-		t.Errorf("exit status wants 0 but %d", exitCode)
-	}
-}
--- a/integration_test/credetial_plugin_test.go
+++ b/integration_test/credetial_plugin_test.go
@@ -1,482 +0,0 @@
-package integration_test
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/int128/kubelogin/integration_test/httpdriver"
-	"github.com/int128/kubelogin/integration_test/keypair"
-	"github.com/int128/kubelogin/integration_test/oidcserver"
-	"github.com/int128/kubelogin/integration_test/oidcserver/testconfig"
-	"github.com/int128/kubelogin/pkg/di"
-	"github.com/int128/kubelogin/pkg/infrastructure/browser"
-	"github.com/int128/kubelogin/pkg/testing/clock"
-	"github.com/int128/kubelogin/pkg/testing/logger"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
-)
-
-// Run the integration tests of the credential plugin use-case.
-//
-// 1. Start the auth server.
-// 2. Run the Cmd.
-// 3. Open a request for the local server.
-// 4. Verify the output.
-func TestCredentialPlugin(t *testing.T) {
-	timeout := 10 * time.Second
-	now := time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC)
-	tokenCacheDir := t.TempDir()
-
-	for name, tc := range map[string]struct {
-		keyPair keypair.KeyPair
-		args    []string
-	}{
-		"NoTLS": {},
-		"TLS": {
-			keyPair: keypair.Server,
-			args:    []string{"--certificate-authority", keypair.Server.CACertPath},
-		},
-	} {
-		httpDriverConfig := httpdriver.Config{
-			TLSConfig:    tc.keyPair.TLSConfig,
-			BodyContains: "Authenticated",
-		}
-
-		t.Run(name, func(t *testing.T) {
-			t.Run("AuthCode", func(t *testing.T) {
-				t.Parallel()
-				ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-				defer cancel()
-				svc := oidcserver.New(t, tc.keyPair, testconfig.Config{
-					Want: testconfig.Want{
-						Scope:               "openid",
-						RedirectURIPrefix:   "http://localhost:",
-						CodeChallengeMethod: "S256",
-					},
-					Response: testconfig.Response{
-						IDTokenExpiry:                 now.Add(time.Hour),
-						CodeChallengeMethodsSupported: []string{"plain", "S256"},
-					},
-				})
-				var stdout bytes.Buffer
-				runGetToken(t, ctx, getTokenConfig{
-					tokenCacheDir: tokenCacheDir,
-					issuerURL:     svc.IssuerURL(),
-					httpDriver:    httpdriver.New(ctx, t, httpDriverConfig),
-					now:           now,
-					stdout:        &stdout,
-					args:          tc.args,
-				})
-				assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-			})
-
-			t.Run("ROPC", func(t *testing.T) {
-				t.Parallel()
-				ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-				defer cancel()
-				svc := oidcserver.New(t, tc.keyPair, testconfig.Config{
-					Want: testconfig.Want{
-						Scope:             "openid",
-						RedirectURIPrefix: "http://localhost:",
-						Username:          "USER1",
-						Password:          "PASS1",
-					},
-					Response: testconfig.Response{
-						IDTokenExpiry:                 now.Add(time.Hour),
-						CodeChallengeMethodsSupported: []string{"plain", "S256"},
-					},
-				})
-				var stdout bytes.Buffer
-				runGetToken(t, ctx, getTokenConfig{
-					tokenCacheDir: tokenCacheDir,
-					issuerURL:     svc.IssuerURL(),
-					httpDriver:    httpdriver.Zero(t),
-					now:           now,
-					stdout:        &stdout,
-					args: append([]string{
-						"--username", "USER1",
-						"--password", "PASS1",
-					}, tc.args...),
-				})
-				assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-			})
-
-			t.Run("TokenCacheLifecycle", func(t *testing.T) {
-				t.Parallel()
-				ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-				defer cancel()
-				svc := oidcserver.New(t, tc.keyPair, testconfig.Config{})
-
-				t.Run("NoCache", func(t *testing.T) {
-					svc.SetConfig(testconfig.Config{
-						Want: testconfig.Want{
-							Scope:               "openid",
-							RedirectURIPrefix:   "http://localhost:",
-							CodeChallengeMethod: "S256",
-						},
-						Response: testconfig.Response{
-							IDTokenExpiry:                 now.Add(time.Hour),
-							RefreshToken:                  "REFRESH_TOKEN_1",
-							CodeChallengeMethodsSupported: []string{"plain", "S256"},
-						},
-					})
-					var stdout bytes.Buffer
-					runGetToken(t, ctx, getTokenConfig{
-						tokenCacheDir: tokenCacheDir,
-						issuerURL:     svc.IssuerURL(),
-						httpDriver:    httpdriver.New(ctx, t, httpDriverConfig),
-						now:           now,
-						stdout:        &stdout,
-						args:          tc.args,
-					})
-					assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-				})
-				t.Run("Valid", func(t *testing.T) {
-					svc.SetConfig(testconfig.Config{})
-					var stdout bytes.Buffer
-					runGetToken(t, ctx, getTokenConfig{
-						tokenCacheDir: tokenCacheDir,
-						issuerURL:     svc.IssuerURL(),
-						httpDriver:    httpdriver.Zero(t),
-						now:           now,
-						stdout:        &stdout,
-						args:          tc.args,
-					})
-					assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-				})
-				t.Run("Refresh", func(t *testing.T) {
-					svc.SetConfig(testconfig.Config{
-						Want: testconfig.Want{
-							Scope:             "openid",
-							RedirectURIPrefix: "http://localhost:",
-							RefreshToken:      "REFRESH_TOKEN_1",
-						},
-						Response: testconfig.Response{
-							IDTokenExpiry:                 now.Add(3 * time.Hour),
-							RefreshToken:                  "REFRESH_TOKEN_2",
-							CodeChallengeMethodsSupported: []string{"plain", "S256"},
-						},
-					})
-					var stdout bytes.Buffer
-					runGetToken(t, ctx, getTokenConfig{
-						tokenCacheDir: tokenCacheDir,
-						issuerURL:     svc.IssuerURL(),
-						httpDriver:    httpdriver.New(ctx, t, httpDriverConfig),
-						now:           now.Add(2 * time.Hour),
-						stdout:        &stdout,
-						args:          tc.args,
-					})
-					assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(3*time.Hour))
-				})
-				t.Run("RefreshAgain", func(t *testing.T) {
-					svc.SetConfig(testconfig.Config{
-						Want: testconfig.Want{
-							Scope:             "openid",
-							RedirectURIPrefix: "http://localhost:",
-							RefreshToken:      "REFRESH_TOKEN_2",
-						},
-						Response: testconfig.Response{
-							IDTokenExpiry:                 now.Add(5 * time.Hour),
-							CodeChallengeMethodsSupported: []string{"plain", "S256"},
-						},
-					})
-					var stdout bytes.Buffer
-					runGetToken(t, ctx, getTokenConfig{
-						tokenCacheDir: tokenCacheDir,
-						issuerURL:     svc.IssuerURL(),
-						httpDriver:    httpdriver.New(ctx, t, httpDriverConfig),
-						now:           now.Add(4 * time.Hour),
-						stdout:        &stdout,
-						args:          tc.args,
-					})
-					assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(5*time.Hour))
-				})
-			})
-		})
-	}
-
-	t.Run("PKCE", func(t *testing.T) {
-		t.Run("Not supported by provider", func(t *testing.T) {
-			t.Parallel()
-			ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-			defer cancel()
-			svc := oidcserver.New(t, keypair.None, testconfig.Config{
-				Want: testconfig.Want{
-					Scope:               "openid",
-					RedirectURIPrefix:   "http://localhost:",
-					CodeChallengeMethod: "",
-				},
-				Response: testconfig.Response{
-					IDTokenExpiry:                 now.Add(time.Hour),
-					CodeChallengeMethodsSupported: nil,
-				},
-			})
-			var stdout bytes.Buffer
-			runGetToken(t, ctx, getTokenConfig{
-				tokenCacheDir: tokenCacheDir,
-				issuerURL:     svc.IssuerURL(),
-				httpDriver:    httpdriver.New(ctx, t, httpdriver.Config{BodyContains: "Authenticated"}),
-				now:           now,
-				stdout:        &stdout,
-			})
-			assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-		})
-
-		t.Run("Enforce", func(t *testing.T) {
-			t.Parallel()
-			ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-			defer cancel()
-			svc := oidcserver.New(t, keypair.None, testconfig.Config{
-				Want: testconfig.Want{
-					Scope:               "openid",
-					RedirectURIPrefix:   "http://localhost:",
-					CodeChallengeMethod: "S256",
-				},
-				Response: testconfig.Response{
-					IDTokenExpiry:                 now.Add(time.Hour),
-					CodeChallengeMethodsSupported: nil,
-				},
-			})
-			var stdout bytes.Buffer
-			runGetToken(t, ctx, getTokenConfig{
-				tokenCacheDir: tokenCacheDir,
-				issuerURL:     svc.IssuerURL(),
-				httpDriver:    httpdriver.New(ctx, t, httpdriver.Config{BodyContains: "Authenticated"}),
-				now:           now,
-				stdout:        &stdout,
-				args:          []string{"--oidc-use-pkce"},
-			})
-			assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-		})
-	})
-
-	t.Run("TLSData", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		svc := oidcserver.New(t, keypair.Server, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:               "openid",
-				RedirectURIPrefix:   "http://localhost:",
-				CodeChallengeMethod: "S256",
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry:                 now.Add(time.Hour),
-				CodeChallengeMethodsSupported: []string{"plain", "S256"},
-			},
-		})
-		var stdout bytes.Buffer
-		runGetToken(t, ctx, getTokenConfig{
-			tokenCacheDir: tokenCacheDir,
-			issuerURL:     svc.IssuerURL(),
-			httpDriver:    httpdriver.New(ctx, t, httpdriver.Config{TLSConfig: keypair.Server.TLSConfig, BodyContains: "Authenticated"}),
-			now:           now,
-			stdout:        &stdout,
-			args:          []string{"--certificate-authority-data", keypair.Server.CACertBase64},
-		})
-		assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-	})
-
-	t.Run("ExtraScopes", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		svc := oidcserver.New(t, keypair.None, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:               "email profile openid",
-				RedirectURIPrefix:   "http://localhost:",
-				CodeChallengeMethod: "S256",
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry:                 now.Add(time.Hour),
-				CodeChallengeMethodsSupported: []string{"plain", "S256"},
-			},
-		})
-		var stdout bytes.Buffer
-		runGetToken(t, ctx, getTokenConfig{
-			tokenCacheDir: tokenCacheDir,
-			issuerURL:     svc.IssuerURL(),
-			httpDriver:    httpdriver.New(ctx, t, httpdriver.Config{BodyContains: "Authenticated"}),
-			now:           now,
-			stdout:        &stdout,
-			args: []string{
-				"--oidc-extra-scope", "email",
-				"--oidc-extra-scope", "profile",
-			},
-		})
-		assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-	})
-
-	t.Run("OpenURLAfterAuthentication", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		svc := oidcserver.New(t, keypair.None, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:               "openid",
-				RedirectURIPrefix:   "http://localhost:",
-				CodeChallengeMethod: "S256",
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry:                 now.Add(time.Hour),
-				CodeChallengeMethodsSupported: []string{"plain", "S256"},
-			},
-		})
-		var stdout bytes.Buffer
-		runGetToken(t, ctx, getTokenConfig{
-			tokenCacheDir: tokenCacheDir,
-			issuerURL:     svc.IssuerURL(),
-			httpDriver:    httpdriver.New(ctx, t, httpdriver.Config{BodyContains: "URL=https://example.com/success"}),
-			now:           now,
-			stdout:        &stdout,
-			args:          []string{"--open-url-after-authentication", "https://example.com/success"},
-		})
-		assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-	})
-
-	t.Run("RedirectURLHostname", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		svc := oidcserver.New(t, keypair.None, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:               "openid",
-				RedirectURIPrefix:   "http://127.0.0.1:",
-				CodeChallengeMethod: "S256",
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry:                 now.Add(time.Hour),
-				CodeChallengeMethodsSupported: []string{"plain", "S256"},
-			},
-		})
-		var stdout bytes.Buffer
-		runGetToken(t, ctx, getTokenConfig{
-			tokenCacheDir: tokenCacheDir,
-			issuerURL:     svc.IssuerURL(),
-			httpDriver:    httpdriver.New(ctx, t, httpdriver.Config{BodyContains: "Authenticated"}),
-			now:           now,
-			stdout:        &stdout,
-			args:          []string{"--oidc-redirect-url-hostname", "127.0.0.1"},
-		})
-		assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-	})
-
-	t.Run("RedirectURLHTTPS", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		svc := oidcserver.New(t, keypair.None, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:               "openid",
-				RedirectURIPrefix:   "https://localhost:",
-				CodeChallengeMethod: "S256",
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry:                 now.Add(time.Hour),
-				CodeChallengeMethodsSupported: []string{"plain", "S256"},
-			},
-		})
-		var stdout bytes.Buffer
-		runGetToken(t, ctx, getTokenConfig{
-			tokenCacheDir: tokenCacheDir,
-			issuerURL:     svc.IssuerURL(),
-			httpDriver: httpdriver.New(ctx, t, httpdriver.Config{
-				TLSConfig:    keypair.Server.TLSConfig,
-				BodyContains: "Authenticated",
-			}),
-			now:    now,
-			stdout: &stdout,
-			args: []string{
-				"--local-server-cert", keypair.Server.CertPath,
-				"--local-server-key", keypair.Server.KeyPath,
-			},
-		})
-		assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-	})
-
-	t.Run("ExtraParams", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		svc := oidcserver.New(t, keypair.None, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:               "openid",
-				RedirectURIPrefix:   "http://localhost:",
-				CodeChallengeMethod: "S256",
-				ExtraParams: map[string]string{
-					"ttl":    "86400",
-					"reauth": "false",
-				},
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry:                 now.Add(time.Hour),
-				CodeChallengeMethodsSupported: []string{"plain", "S256"},
-			},
-		})
-		var stdout bytes.Buffer
-		runGetToken(t, ctx, getTokenConfig{
-			tokenCacheDir: tokenCacheDir,
-			issuerURL:     svc.IssuerURL(),
-			httpDriver:    httpdriver.New(ctx, t, httpdriver.Config{BodyContains: "Authenticated"}),
-			now:           now,
-			stdout:        &stdout,
-			args: []string{
-				"--oidc-auth-request-extra-params", "ttl=86400",
-				"--oidc-auth-request-extra-params", "reauth=false",
-			},
-		})
-		assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
-	})
-}
-
-type getTokenConfig struct {
-	tokenCacheDir string
-	issuerURL     string
-	httpDriver    browser.Interface
-	stdout        io.Writer
-	now           time.Time
-	args          []string
-}
-
-func runGetToken(t *testing.T, ctx context.Context, cfg getTokenConfig) {
-	cmd := di.NewCmdForHeadless(clock.Fake(cfg.now), os.Stdin, cfg.stdout, logger.New(t), cfg.httpDriver)
-	exitCode := cmd.Run(ctx, append([]string{
-		"kubelogin",
-		"get-token",
-		"--token-cache-dir", cfg.tokenCacheDir,
-		"--token-cache-storage", "disk",
-		"--oidc-issuer-url", cfg.issuerURL,
-		"--oidc-client-id", "kubernetes",
-		"--listen-address", "127.0.0.1:0",
-	}, cfg.args...), "latest")
-	if exitCode != 0 {
-		t.Errorf("exit status wants 0 but %d", exitCode)
-	}
-}
-
-func assertCredentialPluginStdout(t *testing.T, stdout io.Reader, token string, expiry time.Time) {
-	var got clientauthenticationv1beta1.ExecCredential
-	if err := json.NewDecoder(stdout).Decode(&got); err != nil {
-		t.Errorf("could not decode json of the credential plugin: %s", err)
-		return
-	}
-	want := clientauthenticationv1beta1.ExecCredential{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: "client.authentication.k8s.io/v1beta1",
-			Kind:       "ExecCredential",
-		},
-		Status: &clientauthenticationv1beta1.ExecCredentialStatus{
-			Token:               token,
-			ExpirationTimestamp: &metav1.Time{Time: expiry},
-		},
-	}
-	if diff := cmp.Diff(want, got); diff != "" {
-		t.Errorf("kubeconfig mismatch (-want +got):\n%s", diff)
-	}
-}
--- a/integration_test/httpdriver/http_driver.go
+++ b/integration_test/httpdriver/http_driver.go
@@ -1,78 +0,0 @@
-// Package httpdriver provides a test double of the browser.
-package httpdriver
-
-import (
-	"context"
-	"crypto/tls"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-)
-
-type Config struct {
-	TLSConfig    *tls.Config
-	BodyContains string
-}
-
-// New returns a client to simulate browser access.
-func New(ctx context.Context, t *testing.T, config Config) *client {
-	return &client{ctx, t, config}
-}
-
-// Zero returns a client which call is not expected.
-func Zero(t *testing.T) *zeroClient {
-	return &zeroClient{t}
-}
-
-type client struct {
-	ctx    context.Context
-	t      *testing.T
-	config Config
-}
-
-func (c *client) Open(url string) error {
-	client := http.Client{Transport: &http.Transport{TLSClientConfig: c.config.TLSConfig}}
-	req, err := http.NewRequest("GET", url, nil)
-	if err != nil {
-		c.t.Errorf("could not create a request: %s", err)
-		return nil
-	}
-	req = req.WithContext(c.ctx)
-	resp, err := client.Do(req)
-	if err != nil {
-		c.t.Errorf("could not send a request: %s", err)
-		return nil
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != 200 {
-		c.t.Errorf("StatusCode wants 200 but %d", resp.StatusCode)
-	}
-	b, err := io.ReadAll(resp.Body)
-	if err != nil {
-		c.t.Errorf("could not read body: %s", err)
-		return nil
-	}
-	body := string(b)
-	if !strings.Contains(body, c.config.BodyContains) {
-		c.t.Errorf("body should contain %s but was %s", c.config.BodyContains, body)
-	}
-	return nil
-}
-
-func (c *client) OpenCommand(_ context.Context, url, _ string) error {
-	return c.Open(url)
-}
-
-type zeroClient struct {
-	t *testing.T
-}
-
-func (c *zeroClient) Open(url string) error {
-	c.t.Errorf("unexpected function call Open(%s)", url)
-	return nil
-}
-
-func (c *zeroClient) OpenCommand(_ context.Context, url, _ string) error {
-	return c.Open(url)
-}
--- a/integration_test/keypair/keypair.go
+++ b/integration_test/keypair/keypair.go
@@ -1,61 +0,0 @@
-package keypair
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/base64"
-	"io"
-	"os"
-	"strings"
-)
-
-// KeyPair represents a pair of certificate and key.
-type KeyPair struct {
-	CertPath     string
-	KeyPath      string
-	CACertPath   string
-	CACertBase64 string
-	TLSConfig    *tls.Config
-}
-
-// None represents non-TLS.
-var None KeyPair
-
-// Server is a KeyPair for TLS server.
-// These files should be generated by Makefile before test.
-var Server = KeyPair{
-	CertPath:     "keypair/testdata/server.crt",
-	KeyPath:      "keypair/testdata/server.key",
-	CACertPath:   "keypair/testdata/ca.crt",
-	CACertBase64: readAsBase64("keypair/testdata/ca.crt"),
-	TLSConfig:    newTLSConfig("keypair/testdata/ca.crt"),
-}
-
-func readAsBase64(name string) string {
-	f, err := os.Open(name)
-	if err != nil {
-		panic(err)
-	}
-	defer f.Close()
-	var s strings.Builder
-	e := base64.NewEncoder(base64.StdEncoding, &s)
-	if _, err := io.Copy(e, f); err != nil {
-		panic(err)
-	}
-	if err := e.Close(); err != nil {
-		panic(err)
-	}
-	return s.String()
-}
-
-func newTLSConfig(name string) *tls.Config {
-	b, err := os.ReadFile(name)
-	if err != nil {
-		panic(err)
-	}
-	p := x509.NewCertPool()
-	if !p.AppendCertsFromPEM(b) {
-		panic("could not append the CA cert")
-	}
-	return &tls.Config{RootCAs: p}
-}
--- a/integration_test/keypair/testdata/Makefile
+++ b/integration_test/keypair/testdata/Makefile
@@ -1,26 +0,0 @@
-EXPIRY := 3650
-OUTPUT_DIR := testdata
-TARGETS := ca.key
-TARGETS += ca.crt
-TARGETS += server.key
-TARGETS += server.crt
-
-.PHONY: all
-all: $(TARGETS)
-
-ca.key:
-	openssl genrsa -out $@ 2048
-ca.csr: ca.key
-	openssl req -new -key ca.key -out $@ -subj "/CN=hello-ca" -config openssl.cnf
-ca.crt: ca.key ca.csr
-	openssl x509 -req -in ca.csr -signkey ca.key -out $@ -days $(EXPIRY)
-server.key:
-	openssl genrsa -out $@ 2048
-server.csr: openssl.cnf server.key
-	openssl req -new -key server.key -out $@ -subj "/CN=localhost" -config openssl.cnf
-server.crt: openssl.cnf server.csr ca.crt ca.key
-	openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out $@ -sha256 -days $(EXPIRY) -extensions v3_req -extfile openssl.cnf
-
-.PHONY: clean
-clean:
-	-rm -v $(TARGETS)
--- a/integration_test/keypair/testdata/ca.crt
+++ b/integration_test/keypair/testdata/ca.crt
@@ -1,17 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIICojCCAYoCCQCNsdXicWqF2DANBgkqhkiG9w0BAQUFADATMREwDwYDVQQDDAho
-ZWxsby1jYTAeFw0yMDAyMDYwMTMzMzNaFw0zMDAyMDMwMTMzMzNaMBMxETAPBgNV
-BAMMCGhlbGxvLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxcPN
-dS88B6ewqVn/m9yO74OLIwNrqMci8l7olP9XlcJhxUZs+3WZQpsSj5nC4yEx8uPQ
-bTtBKnXXVDe+8k7OsLTruu9+isTaYk4o/TZbuw/N31ZAiT0pJw8hdypTQyMLbeDr
-Vl4bbrfbYywx30DyrHxUkgzOWs459Uwc1wWu0W7M21GY4KENHFE3OAcD58FMvvrh
-vgkslATwwW4M2UtXUFJ8XHh26g/J450DU2gwNxpcSdIsvFE6zSyAxU55RElph7mE
-ru9cNWAYhCRZvlZQ2VlH7C6JQ3SHyA9RZmBbPpXhtl9zavFkGx2MEwDp/3FmUukR
-yJnS2KnAo0QdBeS1LQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQAXGfoDwuKY4TyF
-fhKg553Y5I6VDCDc97jyW9yyfc0kvPjQc4EGQV+1eQqMSeh2THpgEEKk9hH/g35a
-grPRcBTsEWpbQd16yWyulQeyOtPeWZB2FvAigMaAdMmeXlTs6++gJ6PjPuACa2Jl
-nJ/AjCqKFxkn0yEVkPTY0c/I9A12xhCmATqIrQiK1pPowiFxQb4M8Cm0z0AkaJZr
-iW0NCOJlLzBqRpFquL4umNaIsxTmOshfM70NpQGRjKREBuK6S0qWsRR0wz4b9Rvi
-62qW4zU94q2EDIoCItjHP4twGENXJDC0vLCsKfA5AvbPzszd5/4ifYe2C00Rn7/O
-lIxrspMm
-----END CERTIFICATE-----
--- a/integration_test/keypair/testdata/ca.csr
+++ b/integration_test/keypair/testdata/ca.csr
@@ -1,17 +0,0 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIICrDCCAZQCAQAwEzERMA8GA1UEAwwIaGVsbG8tY2EwggEiMA0GCSqGSIb3DQEB
-AQUAA4IBDwAwggEKAoIBAQDFw811LzwHp7CpWf+b3I7vg4sjA2uoxyLyXuiU/1eV
-wmHFRmz7dZlCmxKPmcLjITHy49BtO0EqdddUN77yTs6wtOu6736KxNpiTij9Nlu7
-D83fVkCJPSknDyF3KlNDIwtt4OtWXhtut9tjLDHfQPKsfFSSDM5azjn1TBzXBa7R
-bszbUZjgoQ0cUTc4BwPnwUy++uG+CSyUBPDBbgzZS1dQUnxceHbqD8njnQNTaDA3
-GlxJ0iy8UTrNLIDFTnlESWmHuYSu71w1YBiEJFm+VlDZWUfsLolDdIfID1FmYFs+
-leG2X3Nq8WQbHYwTAOn/cWZS6RHImdLYqcCjRB0F5LUtAgMBAAGgVDBSBgkqhkiG
-9w0BCQ4xRTBDMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXgMBQGA1UdEQQNMAuCCWxv
-Y2FsaG9zdDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAQEA
-o/Uthp3NWx0ydTn/GBZI+vA3gI7Qd9UwLvwkeinldRlPM9DOXpG6LR0C40f6u+fj
-mXvUDerveYJI8rpo+Ds0UVqy63AH/zZLG7M96L5Nv2KnK40bkfVNez858Yqp1u17
-/ci1ZsQIElU5v2qKozaHdQThDVtD5ZZdZoQwLvBLE/Dwpe/4VZZFh8smPMR+Mhcq
-+b7gpSy1RiUffk0ZMjuF9Nc9OODdQMTCf+86i0qWXGVzkhfHKAGv+xarHEztcmxF
-GUgUYW8DMvYBjEzaGRM1n0aIFkQO6y8SUXvGMIGBSMC4jfBH3ghIXg1+nD6Uah4D
-16r+CLjFsDUdn/DK/fIQVw==
-----END CERTIFICATE REQUEST-----
--- a/integration_test/keypair/testdata/ca.key
+++ b/integration_test/keypair/testdata/ca.key
@@ -1,27 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAxcPNdS88B6ewqVn/m9yO74OLIwNrqMci8l7olP9XlcJhxUZs
-+3WZQpsSj5nC4yEx8uPQbTtBKnXXVDe+8k7OsLTruu9+isTaYk4o/TZbuw/N31ZA
-iT0pJw8hdypTQyMLbeDrVl4bbrfbYywx30DyrHxUkgzOWs459Uwc1wWu0W7M21GY
-4KENHFE3OAcD58FMvvrhvgkslATwwW4M2UtXUFJ8XHh26g/J450DU2gwNxpcSdIs
-vFE6zSyAxU55RElph7mEru9cNWAYhCRZvlZQ2VlH7C6JQ3SHyA9RZmBbPpXhtl9z
-avFkGx2MEwDp/3FmUukRyJnS2KnAo0QdBeS1LQIDAQABAoIBAHSoWtMsaMnPNlu/
-thM32K0auIGP6/rkdQ3pxGLX+M9jmY7oSzNOHHj4xssklZyroS45CmLU2Ez2tG1+
-cMm4iR4dqwxbaBbtpjDlEDLF1PiUiwmadHlANb1PpJsJwZHR41UOn2QUITR/ig+H
-K2gZhM0QjkaU/Uj9a5zyJ/UC6iupmgCtj8ij65B49qKMODxV4gqZstRSZiJ3gb6R
-TBeR3PUWQS62MZueEQz2eF0eXkXKsFWcbLfHArjfIJ533zW68A0vabgqOhCwJTks
-+rkyaKUjEwJJQcgpCfUI4t9HAwICqYtw0fQdDDaMak2XTDFnGHn1/VfSi818U5Sa
-jZ+/uIECgYEA4uCd5ISsLWebSv2r5f97N8+WcW0MSJ0XP5MniiMvlaNOtJmoN3H0
-PlgR3uwpH9TNWHITZEEb/I93r2E3f24v2018g0uJuwiRDusxHs7yuxw/93Y5rwtG
-3twL1k0GyeLCxfM2y2QQU/awXISx7nNk2f0umvTWmjrEw632oQSWCSECgYEA3yaF
-zDk7k1u1GdZAh+pQAyUtjzHSvQjiE2JzLaH8BTorACrczRascX5yyMi0QfLYnoYt
-UL9dCb4Z8HUclj55kBSx8anvVtf3XAT3hZ3sm8LV3JLGDeURGS8rGdV+tyFk7zw9
-XgvaLj3xjB5CoJvtOhbXvqF9M9yp4TMBb5El7o0CgYBTx5Bm15thNPZCrgQxbbOJ
-u42ZmyRDGEeCgYvDVhT3VBP3WxqkRt9juk/3GwxgpcuikpWYmvaDwFL5H5RH6V+g
-wy9sqJNWzuYKNU2xS8iU0ezJLA5HFon4OBfi7hTIroUwZgzg9LWW2+zqbVHrdQ9T
-9Eumiy1ITNVmUTJW6YOiIQKBgBE4BsEAdZFkVTAeMTKLqQrlFoPjI1DE27UFNsAB
-rNG2cFT9+bW1ly7WxAKsQgSIuaBZ2CtP6Nz0l0nPr5oEThsJDcYJB9faqFKoa3Ua
-/4PxX9E6Xh/6WfxogFno+HMnF4PCUTXtkjNZQkc+moOMJJ0D4DfsfB3BXDZtWiIC
-wDuNAoGBAN5ZFTXwE1VpWxIWq5dV9+0aVOP/eB+h7Pt+u2xyRip31FGcpGEzGniu
-VmOzWApW7NmvD0QWtstJWlCpsw+rOptAL0oVunlB70KuYuA+2Q5g/Cw3kUrvXqbe
-mkCoV21eFAmpU+I6z/n7pUDXPuUsmTkzmwedv0HUuNSQJmHZOMPD
-----END RSA PRIVATE KEY-----
--- a/integration_test/keypair/testdata/ca.srl
+++ b/integration_test/keypair/testdata/ca.srl
@@ -1 +0,0 @@
-9E12C7A1AF348811
--- a/integration_test/keypair/testdata/openssl.cnf
+++ b/integration_test/keypair/testdata/openssl.cnf
@@ -1,14 +0,0 @@
-[ req ]
-distinguished_name = req_distinguished_name
-req_extensions = v3_req
-
-[ req_distinguished_name ]
-
-[ v3_req ]
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-subjectAltName = @alt_names
-extendedKeyUsage = serverAuth
-
-[alt_names]
-DNS.1 = localhost
--- a/integration_test/keypair/testdata/server.crt
+++ b/integration_test/keypair/testdata/server.crt
@@ -1,18 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIC7zCCAdegAwIBAgIJAJ4Sx6GvNIgRMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
-BAMMCGhlbGxvLWNhMB4XDTIwMDIwNjAxMzMzM1oXDTMwMDIwMzAxMzMzM1owFDES
-MBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEA3CJvDbbiiY/o9lgzeABLCtZe56h2w9Dzejy02M6F7yVyphLtJr+/AxI8k5Er
-MFRitkzgIUkLn/90CZjPI3k5OnLtUAJ4XLj4gUGjziy4TKyVaU0XK41ZSbDAchbW
-349lsEgW5ZnL4qNaZeCvvbYec+RroVc6ZXCcDp4BATTkC3gSVF92+TzrrlbkZ5+W
-YVeoMpAPWDPq2zwQx4RcYlpkpI/fzLezRqjRcZJx3FDgkGuwwhzXfVUpxJ/DYLXZ
-yHCKyaT7e8YIs8e7TRekOwrLCfssfhJSdWopf6aYRZFV+2ovP0Nggn6XJNh/g1QK
-o4wzJAf6v5WMc0jEvb7EuSG+nwIDAQABo0UwQzAJBgNVHRMEAjAAMAsGA1UdDwQE
-AwIF4DAUBgNVHREEDTALgglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
-DQYJKoZIhvcNAQELBQADggEBACqlq8b7trNRtKUm1PbY7dnrAFCOnV4OT2R98s17
-Q6tmCXM1DvQ101W0ih/lh6iPyU4JM2A0kvO+gizuL/Dmvb6oh+3ox0mMLposptso
-gCE1K3SXlvlcLdM6hXRJ5+XwlSCHM6o2Y4yABnKjT6Zr+CMh86a5abDx33hkJ4QR
-6I+/iBHVLiCVv0wUF3jD/T+HxinEQrB4cQsSgKmfPClrc8n7rkWWE+MdwEL4VZCH
-ufabw178aYibVvJ8k3rushjLlftkDyCNno2rz8YWrnaxabVR0EqSPInyYQenmv2r
-/CedVKpmdH2RV8ubkwqa0s6cmpRkyu6FS2g3LviJhmm0nwQ=
-----END CERTIFICATE-----
--- a/integration_test/keypair/testdata/server.csr
+++ b/integration_test/keypair/testdata/server.csr
@@ -1,17 +0,0 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIICrTCCAZUCAQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0B
-AQEFAAOCAQ8AMIIBCgKCAQEA3CJvDbbiiY/o9lgzeABLCtZe56h2w9Dzejy02M6F
-7yVyphLtJr+/AxI8k5ErMFRitkzgIUkLn/90CZjPI3k5OnLtUAJ4XLj4gUGjziy4
-TKyVaU0XK41ZSbDAchbW349lsEgW5ZnL4qNaZeCvvbYec+RroVc6ZXCcDp4BATTk
-C3gSVF92+TzrrlbkZ5+WYVeoMpAPWDPq2zwQx4RcYlpkpI/fzLezRqjRcZJx3FDg
-kGuwwhzXfVUpxJ/DYLXZyHCKyaT7e8YIs8e7TRekOwrLCfssfhJSdWopf6aYRZFV
-+2ovP0Nggn6XJNh/g1QKo4wzJAf6v5WMc0jEvb7EuSG+nwIDAQABoFQwUgYJKoZI
-hvcNAQkOMUUwQzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAUBgNVHREEDTALggls
-b2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggEB
-ACUQ0j3XuUZY3fso5tEgOGVjVsTU+C4pIsEw3e1KyIB93i56ANKaq1uBLtnlWtYi
-R4RxZ3Sf08GzoEHAHpWoQ4BQ3WGDQjxSdezbudWMuNnNyvyhkh36tmmp/PLA4iZD
-Q/d1odzGWg1HMqY0/Q3hfz40MQ9IEBBm+5zKw3tLsKNIKdSdlY7Ul3Z9PUsqsOVW
-uF0LKsTMEh1CpbYnOBS2EQjComVM5kYfdQwDNh+BMok8rH7mHFYRmrwYUrU9njsM
-eoKqhLkoSu6hw1Cgd9Yru5lC541KfxsSN4Cj6rkm+Qv/5zjvIPxYZ+akSQQR9hR3
-2O9THHKqaQS0xmD+y8NjfYk=
-----END CERTIFICATE REQUEST-----
--- a/integration_test/keypair/testdata/server.key
+++ b/integration_test/keypair/testdata/server.key
@@ -1,27 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEA3CJvDbbiiY/o9lgzeABLCtZe56h2w9Dzejy02M6F7yVyphLt
-Jr+/AxI8k5ErMFRitkzgIUkLn/90CZjPI3k5OnLtUAJ4XLj4gUGjziy4TKyVaU0X
-K41ZSbDAchbW349lsEgW5ZnL4qNaZeCvvbYec+RroVc6ZXCcDp4BATTkC3gSVF92
-+TzrrlbkZ5+WYVeoMpAPWDPq2zwQx4RcYlpkpI/fzLezRqjRcZJx3FDgkGuwwhzX
-fVUpxJ/DYLXZyHCKyaT7e8YIs8e7TRekOwrLCfssfhJSdWopf6aYRZFV+2ovP0Ng
-gn6XJNh/g1QKo4wzJAf6v5WMc0jEvb7EuSG+nwIDAQABAoIBAEYvWFb4C0wurOj2
-ABrvhP2Ekaesh4kxMp+zgTlqxzsTJnWarS/gjKcPBm9KJon3La3P3tnd7y3pBXcV
-2F0IBl4DTHRpBTUS6HBVnENc8LnJgK2dHZkOLPyYtRLrA0Et+A73PQ2hNmchC+5V
-b9K9oQH0Pvim1gCHocnrSIi480hQPazO9/gnHvFtu9Tdsx9kM9jgChhh5VaR+nzM
-uw6MpUSzCri3/W6K5Hz8F1lLQcZ6o3vyyFtLPjFrWT4J1UiHqAoxuCGeWTvMbGQl
-9Cg0SMX4FLBpbIoMonhM3hb9Cw3FVRGU/1i4oF+gEIGlX/v9CPT5HAZmD59rawc8
-11x7yTECgYEA8EYVGKauLHeI1nJdCoVrWI73W1wtwt6prJbzltpoAR4tb3Qu6gBX
-JQNd+Ifhl28lK6lPnCGk/SsmfiKSp/XE4IyS1GBd2LpxWj5R50GePCg4hAzk9Xyx
-M9SJAFQw73pODgu4RWFXTCOMo9crahJ6X/O+MckHqbFqqohJ8nChGDkCgYEA6oro
-Ql/ymO7UdYCay7OlzKeg8ud6XgkZ+wkpSG/5TQ0QZWVN3aSOLztEdVfh3PAqWob0
-KgVhLmq6CYwq+HSzU92bvFqCgYUMU8tYzeRboGLxyEdAGL+EW0j8wQyZKYR5cNz4
-yM0hpM6kbJ0zZqkYVM/XfRT2RTGwTMakF/FOHZcCgYEAmf4guTriuIcoAWEstniK
-Myj16ezrO1Df6Eia+B0kuUqxDhSlmL39HDDLQmU8NYU7in8qEcQSbVwBgKgB3HoM
-42nVFR5qJ2RfD9qPPar1klKo3iExgRCYtcJKyBYtgt6dNi1WvcjEXX0PP1bBcWtE
-WUjrphbUvXKDDabp1eNPrCkCgYBOw/F2APTeyS4Oe+8AQ8eFcDIMARLGK7ZO6Oe1
-TO1jI+UCuD+rFI0vbW7zHV1brkf6+OFcj0vwo6TweeMgZ0il/IFFgvva9UyLg3nC
-Q1NGDJR4Fv1+kiqn4V4IkuuI1tVVws/F16XZzA/J7g0KB/WE3fvXJMgDuskjL36C
-D+aU5wKBgQCvEg+mJYny1QiR/mQuowX34xf4CkMl7Xq9YDH7W/3AlwuPrPNHaZjh
-SvSCz9I8vV0E4ur6atazgCblnvA/G3d4r8YYx+e1l30WJHMgoZRxxHMH74tmUPAj
-Klic16BJikSQclMeFdlJqf2UHd37eEuYnxorpep8YGP7/eN1ghHWAw==
-----END RSA PRIVATE KEY-----
--- a/integration_test/kubeconfig/kubeconfig.go
+++ b/integration_test/kubeconfig/kubeconfig.go
@@ -1,81 +0,0 @@
-package kubeconfig
-
-import (
-	"html/template"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"gopkg.in/yaml.v3"
-)
-
-// Values represents values in .kubeconfig template.
-type Values struct {
-	Issuer                      string
-	ExtraScopes                 string
-	IDPCertificateAuthority     string
-	IDPCertificateAuthorityData string
-	IDToken                     string
-	RefreshToken                string
-}
-
-// Create creates a kubeconfig file and returns path to it.
-func Create(t *testing.T, v *Values) string {
-	t.Helper()
-	name := filepath.Join(t.TempDir(), "kubeconfig")
-	f, err := os.Create(name)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer f.Close()
-	tpl, err := template.ParseFiles("kubeconfig/testdata/kubeconfig.yaml")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := tpl.Execute(f, v); err != nil {
-		t.Fatal(err)
-	}
-	return name
-}
-
-type AuthProviderConfig struct {
-	IDToken      string `yaml:"id-token"`
-	RefreshToken string `yaml:"refresh-token"`
-}
-
-// Verify returns true if the kubeconfig has valid values.
-func Verify(t *testing.T, kubeconfig string, want AuthProviderConfig) {
-	t.Helper()
-	f, err := os.Open(kubeconfig)
-	if err != nil {
-		t.Errorf("could not open kubeconfig: %s", err)
-		return
-	}
-	defer f.Close()
-
-	var y struct {
-		Users []struct {
-			User struct {
-				AuthProvider struct {
-					Config AuthProviderConfig `yaml:"config"`
-				} `yaml:"auth-provider"`
-			} `yaml:"user"`
-		} `yaml:"users"`
-	}
-	d := yaml.NewDecoder(f)
-	if err := d.Decode(&y); err != nil {
-		t.Errorf("could not decode YAML: %s", err)
-		return
-	}
-	if len(y.Users) != 1 {
-		t.Errorf("len(users) wants 1 but %d", len(y.Users))
-		return
-	}
-	currentConfig := y.Users[0].User.AuthProvider.Config
-	if currentConfig.IDToken != want.IDToken {
-		t.Errorf("id-token wants %s but %s", want.IDToken, currentConfig.IDToken)
-	}
-	if currentConfig.RefreshToken != want.RefreshToken {
-		t.Errorf("refresh-token wants %s but %s", want.RefreshToken, currentConfig.RefreshToken)
-	}
-}
--- a/integration_test/kubeconfig/testdata/dummy.yaml
+++ b/integration_test/kubeconfig/testdata/dummy.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-current-context: dummy
-kind: Config
-preferences: {}
--- a/integration_test/kubeconfig/testdata/kubeconfig.yaml
+++ b/integration_test/kubeconfig/testdata/kubeconfig.yaml
@@ -1,37 +0,0 @@
-apiVersion: v1
-kind: Config
-clusters:
-  - cluster:
-      server: https://api.hello.k8s.example.com
-      name: hello.k8s.local
-contexts:
- context:
-    cluster: hello.k8s.local
-    user: hello.k8s.local
-  name: hello.k8s.local
-current-context: hello.k8s.local
-preferences: {}
-users:
- name: hello.k8s.local
-  user:
-    auth-provider:
-      config:
-        client-id: kubernetes
-        client-secret: a3c508c3-73c9-42e2-ab14-487a1bf67c33
-        idp-issuer-url: {{ .Issuer }}
-#{{ if .ExtraScopes }}
-        extra-scopes: {{ .ExtraScopes }}
-#{{ end }}
-#{{ if .IDPCertificateAuthority }}
-        idp-certificate-authority: {{ .IDPCertificateAuthority }}
-#{{ end }}
-#{{ if .IDPCertificateAuthorityData }}
-        idp-certificate-authority-data: {{ .IDPCertificateAuthorityData }}
-#{{ end }}
-#{{ if .IDToken }}
-        id-token: {{ .IDToken }}
-#{{ end }}
-#{{ if .RefreshToken }}
-        refresh-token: {{ .RefreshToken }}
-#{{ end }}
-      name: oidc
--- a/integration_test/oidcserver/handler/handler.go
+++ b/integration_test/oidcserver/handler/handler.go
@@ -1,156 +0,0 @@
-// Package handler provides HTTP handlers for the OpenID Connect Provider.
-package handler
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/url"
-	"testing"
-
-	"github.com/int128/kubelogin/integration_test/oidcserver/service"
-)
-
-func Register(t *testing.T, mux *http.ServeMux, provider service.Provider) {
-	h := &Handlers{t, provider}
-	mux.HandleFunc("GET /.well-known/openid-configuration", h.Discovery)
-	mux.HandleFunc("GET /certs", h.GetCertificates)
-	mux.HandleFunc("GET /auth", h.AuthenticateCode)
-	mux.HandleFunc("POST /token", h.Exchange)
-}
-
-// Handlers provides HTTP handlers for the OpenID Connect Provider.
-// You need to implement the Provider interface.
-// Note that this skips some security checks and is only for testing.
-type Handlers struct {
-	t        *testing.T
-	provider service.Provider
-}
-
-func (h *Handlers) handleError(w http.ResponseWriter, r *http.Request, f func() error) {
-	err := f()
-	if err == nil {
-		return
-	}
-	if errResp := new(service.ErrorResponse); errors.As(err, &errResp) {
-		h.t.Logf("400 %s %s: %s", r.Method, r.RequestURI, err)
-		w.Header().Add("Content-Type", "application/json")
-		w.WriteHeader(400)
-		e := json.NewEncoder(w)
-		if err := e.Encode(errResp); err != nil {
-			h.t.Errorf("idp/handler: could not write the response: %s", err)
-		}
-		return
-	}
-	h.t.Logf("500 %s %s: %s", r.Method, r.RequestURI, err)
-	http.Error(w, err.Error(), 500)
-}
-
-func (h *Handlers) Discovery(w http.ResponseWriter, r *http.Request) {
-	h.handleError(w, r, func() error {
-		discoveryResponse := h.provider.Discovery()
-		w.Header().Add("Content-Type", "application/json")
-		e := json.NewEncoder(w)
-		if err := e.Encode(discoveryResponse); err != nil {
-			return fmt.Errorf("could not render json: %w", err)
-		}
-		return nil
-	})
-}
-
-func (h *Handlers) GetCertificates(w http.ResponseWriter, r *http.Request) {
-	h.handleError(w, r, func() error {
-		certificatesResponse := h.provider.GetCertificates()
-		w.Header().Add("Content-Type", "application/json")
-		e := json.NewEncoder(w)
-		if err := e.Encode(certificatesResponse); err != nil {
-			return fmt.Errorf("could not render json: %w", err)
-		}
-		return nil
-	})
-}
-
-func (h *Handlers) AuthenticateCode(w http.ResponseWriter, r *http.Request) {
-	h.handleError(w, r, func() error {
-		q := r.URL.Query()
-		redirectURI, state := q.Get("redirect_uri"), q.Get("state")
-		code, err := h.provider.AuthenticateCode(service.AuthenticationRequest{
-			RedirectURI:         redirectURI,
-			State:               state,
-			Scope:               q.Get("scope"),
-			Nonce:               q.Get("nonce"),
-			CodeChallenge:       q.Get("code_challenge"),
-			CodeChallengeMethod: q.Get("code_challenge_method"),
-			RawQuery:            q,
-		})
-		if err != nil {
-			return fmt.Errorf("authentication error: %w", err)
-		}
-		redirectTo, err := url.Parse(redirectURI)
-		if err != nil {
-			return fmt.Errorf("invalid redirect_uri: %w", err)
-		}
-		redirectTo.RawQuery = url.Values{"state": {state}, "code": {code}}.Encode()
-		http.Redirect(w, r, redirectTo.String(), http.StatusFound)
-		return nil
-	})
-}
-
-func (h *Handlers) Exchange(w http.ResponseWriter, r *http.Request) {
-	h.handleError(w, r, func() error {
-		if err := r.ParseForm(); err != nil {
-			return fmt.Errorf("could not parse the form: %w", err)
-		}
-		grantType := r.Form.Get("grant_type")
-		switch grantType {
-		case "authorization_code":
-			tokenResponse, err := h.provider.Exchange(service.TokenRequest{
-				Code:         r.Form.Get("code"),
-				CodeVerifier: r.Form.Get("code_verifier"),
-			})
-			if err != nil {
-				return fmt.Errorf("token request error: %w", err)
-			}
-			w.Header().Add("Content-Type", "application/json")
-			e := json.NewEncoder(w)
-			if err := e.Encode(tokenResponse); err != nil {
-				return fmt.Errorf("could not render json: %w", err)
-			}
-		case "password":
-			// 4.3. Resource Owner Password Credentials Grant
-			// https://tools.ietf.org/html/rfc6749#section-4.3
-			username, password, scope := r.Form.Get("username"), r.Form.Get("password"), r.Form.Get("scope")
-			tokenResponse, err := h.provider.AuthenticatePassword(username, password, scope)
-			if err != nil {
-				return fmt.Errorf("authentication error: %w", err)
-			}
-			w.Header().Add("Content-Type", "application/json")
-			e := json.NewEncoder(w)
-			if err := e.Encode(tokenResponse); err != nil {
-				return fmt.Errorf("could not render json: %w", err)
-			}
-		case "refresh_token":
-			// 12.1. Refresh Request
-			// https://openid.net/specs/openid-connect-core-1_0.html#RefreshingAccessToken
-			refreshToken := r.Form.Get("refresh_token")
-			tokenResponse, err := h.provider.Refresh(refreshToken)
-			if err != nil {
-				return fmt.Errorf("token refresh error: %w", err)
-			}
-			w.Header().Add("Content-Type", "application/json")
-			e := json.NewEncoder(w)
-			if err := e.Encode(tokenResponse); err != nil {
-				return fmt.Errorf("could not render json: %w", err)
-			}
-		default:
-			// 5.2. Error Response
-			// https://tools.ietf.org/html/rfc6749#section-5.2
-			return &service.ErrorResponse{
-				Code:        "invalid_grant",
-				Description: fmt.Sprintf("unknown grant_type %s", grantType),
-			}
-		}
-		return nil
-	})
-}
--- a/integration_test/oidcserver/oidcserver.go
+++ b/integration_test/oidcserver/oidcserver.go
@@ -1,54 +0,0 @@
-// Package oidcserver provides a stub of OpenID Connect provider.
-package oidcserver
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/int128/kubelogin/integration_test/keypair"
-	"github.com/int128/kubelogin/integration_test/oidcserver/handler"
-	"github.com/int128/kubelogin/integration_test/oidcserver/service"
-	"github.com/int128/kubelogin/integration_test/oidcserver/testconfig"
-)
-
-// New starts a server for the OpenID Connect provider.
-func New(t *testing.T, kp keypair.KeyPair, config testconfig.Config) service.Service {
-	mux := http.NewServeMux()
-	serverURL := startServer(t, mux, kp)
-
-	svc := service.New(t, serverURL, config)
-	handler.Register(t, mux, svc)
-	return svc
-}
-
-func startServer(t *testing.T, h http.Handler, kp keypair.KeyPair) string {
-	if kp == keypair.None {
-		srv := httptest.NewServer(h)
-		t.Cleanup(srv.Close)
-		return srv.URL
-	}
-
-	// Unfortunately, httptest package did not work with keypair.KeyPair.
-	// We use httptest package only for allocating a new port.
-	portAllocator := httptest.NewUnstartedServer(h)
-	t.Cleanup(portAllocator.Close)
-	serverURL := fmt.Sprintf("https://localhost:%d", portAllocator.Listener.Addr().(*net.TCPAddr).Port)
-	srv := &http.Server{Handler: h}
-	go func() {
-		err := srv.ServeTLS(portAllocator.Listener, kp.CertPath, kp.KeyPath)
-		if err != nil && !errors.Is(err, http.ErrServerClosed) {
-			t.Error(err)
-		}
-	}()
-	t.Cleanup(func() {
-		if err := srv.Shutdown(context.TODO()); err != nil {
-			t.Errorf("could not shutdown the server: %s", err)
-		}
-	})
-	return serverURL
-}
--- a/integration_test/oidcserver/service/service.go
+++ b/integration_test/oidcserver/service/service.go
@@ -1,184 +0,0 @@
-package service
-
-import (
-	"crypto/sha256"
-	"encoding/base64"
-	"fmt"
-	"math/big"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/golang-jwt/jwt/v5"
-	"github.com/google/go-cmp/cmp"
-	"github.com/int128/kubelogin/integration_test/oidcserver/testconfig"
-	testingJWT "github.com/int128/kubelogin/pkg/testing/jwt"
-)
-
-func New(t *testing.T, issuerURL string, config testconfig.Config) Service {
-	return &service{
-		config:    config,
-		t:         t,
-		issuerURL: issuerURL,
-	}
-}
-
-type service struct {
-	config                    testconfig.Config
-	t                         *testing.T
-	issuerURL                 string
-	lastAuthenticationRequest *AuthenticationRequest
-	lastTokenResponse         *TokenResponse
-}
-
-func (svc *service) IssuerURL() string {
-	return svc.issuerURL
-}
-
-func (svc *service) SetConfig(cfg testconfig.Config) {
-	svc.config = cfg
-}
-
-func (svc *service) LastTokenResponse() *TokenResponse {
-	return svc.lastTokenResponse
-}
-
-func (svc *service) Discovery() *DiscoveryResponse {
-	// based on https://accounts.google.com/.well-known/openid-configuration
-	return &DiscoveryResponse{
-		Issuer:                            svc.issuerURL,
-		AuthorizationEndpoint:             svc.issuerURL + "/auth",
-		TokenEndpoint:                     svc.issuerURL + "/token",
-		JwksURI:                           svc.issuerURL + "/certs",
-		UserinfoEndpoint:                  svc.issuerURL + "/userinfo",
-		RevocationEndpoint:                svc.issuerURL + "/revoke",
-		ResponseTypesSupported:            []string{"code id_token"},
-		SubjectTypesSupported:             []string{"public"},
-		IDTokenSigningAlgValuesSupported:  []string{"RS256"},
-		ScopesSupported:                   []string{"openid", "email", "profile"},
-		TokenEndpointAuthMethodsSupported: []string{"client_secret_post", "client_secret_basic"},
-		CodeChallengeMethodsSupported:     svc.config.Response.CodeChallengeMethodsSupported,
-		ClaimsSupported:                   []string{"aud", "email", "exp", "iat", "iss", "name", "sub"},
-	}
-}
-
-func (svc *service) GetCertificates() *CertificatesResponse {
-	idTokenKeyPair := testingJWT.PrivateKey
-	return &CertificatesResponse{
-		Keys: []*CertificatesResponseKey{
-			{
-				Kty: "RSA",
-				Alg: "RS256",
-				Use: "sig",
-				Kid: "dummy",
-				E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(idTokenKeyPair.E)).Bytes()),
-				N:   base64.RawURLEncoding.EncodeToString(idTokenKeyPair.N.Bytes()),
-			},
-		},
-	}
-}
-
-func (svc *service) AuthenticateCode(req AuthenticationRequest) (code string, err error) {
-	if req.Scope != svc.config.Want.Scope {
-		svc.t.Errorf("scope wants `%s` but was `%s`", svc.config.Want.Scope, req.Scope)
-	}
-	if !strings.HasPrefix(req.RedirectURI, svc.config.Want.RedirectURIPrefix) {
-		svc.t.Errorf("redirectURI wants prefix `%s` but was `%s`", svc.config.Want.RedirectURIPrefix, req.RedirectURI)
-	}
-	if diff := cmp.Diff(svc.config.Want.CodeChallengeMethod, req.CodeChallengeMethod); diff != "" {
-		svc.t.Errorf("code_challenge_method mismatch (-want +got):\n%s", diff)
-	}
-	for k, v := range svc.config.Want.ExtraParams {
-		got := req.RawQuery.Get(k)
-		if got != v {
-			svc.t.Errorf("parameter %s wants `%s` but was `%s`", k, v, got)
-		}
-	}
-	svc.lastAuthenticationRequest = &req
-	return "YOUR_AUTH_CODE", nil
-}
-
-func (svc *service) Exchange(req TokenRequest) (*TokenResponse, error) {
-	if req.Code != "YOUR_AUTH_CODE" {
-		return nil, fmt.Errorf("code wants %s but was %s", "YOUR_AUTH_CODE", req.Code)
-	}
-	if svc.lastAuthenticationRequest.CodeChallengeMethod == "S256" {
-		// https://tools.ietf.org/html/rfc7636#section-4.6
-		challenge := computeS256Challenge(req.CodeVerifier)
-		if challenge != svc.lastAuthenticationRequest.CodeChallenge {
-			svc.t.Errorf("pkce S256 challenge did not match (want %s but was %s)", svc.lastAuthenticationRequest.CodeChallenge, challenge)
-		}
-	}
-	resp := &TokenResponse{
-		TokenType:    "Bearer",
-		ExpiresIn:    3600,
-		AccessToken:  "YOUR_ACCESS_TOKEN",
-		RefreshToken: svc.config.Response.RefreshToken,
-		IDToken: testingJWT.EncodeF(svc.t, func(claims *testingJWT.Claims) {
-			claims.Issuer = svc.issuerURL
-			claims.Subject = "SUBJECT"
-			claims.IssuedAt = jwt.NewNumericDate(svc.config.Response.IDTokenExpiry.Add(-time.Hour))
-			claims.ExpiresAt = jwt.NewNumericDate(svc.config.Response.IDTokenExpiry)
-			claims.Audience = []string{"kubernetes"}
-			claims.Nonce = svc.lastAuthenticationRequest.Nonce
-		}),
-	}
-	svc.lastTokenResponse = resp
-	return resp, nil
-}
-
-func computeS256Challenge(verifier string) string {
-	c := sha256.Sum256([]byte(verifier))
-	return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(c[:])
-}
-
-func (svc *service) AuthenticatePassword(username, password, scope string) (*TokenResponse, error) {
-	if scope != svc.config.Want.Scope {
-		svc.t.Errorf("scope wants `%s` but was `%s`", svc.config.Want.Scope, scope)
-	}
-	if username != svc.config.Want.Username {
-		svc.t.Errorf("username wants `%s` but was `%s`", svc.config.Want.Username, username)
-	}
-	if password != svc.config.Want.Password {
-		svc.t.Errorf("password wants `%s` but was `%s`", svc.config.Want.Password, password)
-	}
-	resp := &TokenResponse{
-		TokenType:    "Bearer",
-		ExpiresIn:    3600,
-		AccessToken:  "YOUR_ACCESS_TOKEN",
-		RefreshToken: svc.config.Response.RefreshToken,
-		IDToken: testingJWT.EncodeF(svc.t, func(claims *testingJWT.Claims) {
-			claims.Issuer = svc.issuerURL
-			claims.Subject = "SUBJECT"
-			claims.IssuedAt = jwt.NewNumericDate(svc.config.Response.IDTokenExpiry.Add(-time.Hour))
-			claims.ExpiresAt = jwt.NewNumericDate(svc.config.Response.IDTokenExpiry)
-			claims.Audience = []string{"kubernetes"}
-		}),
-	}
-	svc.lastTokenResponse = resp
-	return resp, nil
-}
-
-func (svc *service) Refresh(refreshToken string) (*TokenResponse, error) {
-	if refreshToken != svc.config.Want.RefreshToken {
-		svc.t.Errorf("refreshToken wants %s but was %s", svc.config.Want.RefreshToken, refreshToken)
-	}
-	if svc.config.Response.RefreshError != "" {
-		return nil, &ErrorResponse{Code: "invalid_request", Description: svc.config.Response.RefreshError}
-	}
-	resp := &TokenResponse{
-		TokenType:    "Bearer",
-		ExpiresIn:    3600,
-		AccessToken:  "YOUR_ACCESS_TOKEN",
-		RefreshToken: svc.config.Response.RefreshToken,
-		IDToken: testingJWT.EncodeF(svc.t, func(claims *testingJWT.Claims) {
-			claims.Issuer = svc.issuerURL
-			claims.Subject = "SUBJECT"
-			claims.IssuedAt = jwt.NewNumericDate(svc.config.Response.IDTokenExpiry.Add(-time.Hour))
-			claims.ExpiresAt = jwt.NewNumericDate(svc.config.Response.IDTokenExpiry)
-			claims.Audience = []string{"kubernetes"}
-		}),
-	}
-	svc.lastTokenResponse = resp
-	return resp, nil
-}
--- a/integration_test/oidcserver/service/types.go
+++ b/integration_test/oidcserver/service/types.go
@@ -1,108 +0,0 @@
-package service
-
-import (
-	"fmt"
-	"net/url"
-
-	"github.com/int128/kubelogin/integration_test/oidcserver/testconfig"
-)
-
-// Service represents the test service of OpenID Connect Provider.
-// It provides the feature of Provider and additional methods for testing.
-type Service interface {
-	Provider
-
-	IssuerURL() string
-	SetConfig(config testconfig.Config)
-	LastTokenResponse() *TokenResponse
-}
-
-// Provider represents an OpenID Connect Provider.
-//
-// If an implemented method returns an ErrorResponse,
-// the handler will respond 400 and corresponding json of the ErrorResponse.
-// Otherwise, the handler will respond 500 and fail the current test.
-type Provider interface {
-	Discovery() *DiscoveryResponse
-	GetCertificates() *CertificatesResponse
-	AuthenticateCode(req AuthenticationRequest) (code string, err error)
-	Exchange(req TokenRequest) (*TokenResponse, error)
-	AuthenticatePassword(username, password, scope string) (*TokenResponse, error)
-	Refresh(refreshToken string) (*TokenResponse, error)
-}
-
-// DiscoveryResponse represents the type of:
-// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
-type DiscoveryResponse struct {
-	Issuer                            string   `json:"issuer"`
-	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
-	TokenEndpoint                     string   `json:"token_endpoint"`
-	UserinfoEndpoint                  string   `json:"userinfo_endpoint"`
-	RevocationEndpoint                string   `json:"revocation_endpoint"`
-	JwksURI                           string   `json:"jwks_uri"`
-	ResponseTypesSupported            []string `json:"response_types_supported"`
-	SubjectTypesSupported             []string `json:"subject_types_supported"`
-	IDTokenSigningAlgValuesSupported  []string `json:"id_token_signing_alg_values_supported"`
-	ScopesSupported                   []string `json:"scopes_supported"`
-	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"`
-	ClaimsSupported                   []string `json:"claims_supported"`
-	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported"`
-}
-
-// CertificatesResponse represents the type of:
-// https://datatracker.ietf.org/doc/html/rfc7517#section-5
-type CertificatesResponse struct {
-	Keys []*CertificatesResponseKey `json:"keys"`
-}
-
-// CertificatesResponseKey represents the type of:
-// https://datatracker.ietf.org/doc/html/rfc7517#section-4
-type CertificatesResponseKey struct {
-	Kty string `json:"kty"`
-	Alg string `json:"alg"`
-	Use string `json:"use"`
-	Kid string `json:"kid"`
-	N   string `json:"n"`
-	E   string `json:"e"`
-}
-
-// AuthenticationRequest represents the type of:
-// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-type AuthenticationRequest struct {
-	RedirectURI         string
-	State               string
-	Scope               string // space separated string
-	Nonce               string
-	CodeChallenge       string
-	CodeChallengeMethod string
-	RawQuery            url.Values
-}
-
-// TokenRequest represents the type of:
-// https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest
-type TokenRequest struct {
-	Code         string
-	CodeVerifier string
-}
-
-// TokenResponse represents the type of:
-// https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
-type TokenResponse struct {
-	AccessToken  string `json:"access_token"`
-	TokenType    string `json:"token_type"`
-	RefreshToken string `json:"refresh_token"`
-	ExpiresIn    int    `json:"expires_in"`
-	IDToken      string `json:"id_token"`
-}
-
-// ErrorResponse represents the error response described in the following section:
-// 5.2 Error Response
-// https://tools.ietf.org/html/rfc6749#section-5.2
-type ErrorResponse struct {
-	Code        string `json:"error"`
-	Description string `json:"error_description"`
-}
-
-func (err *ErrorResponse) Error() string {
-	return fmt.Sprintf("%s(%s)", err.Code, err.Description)
-}
--- a/integration_test/oidcserver/testconfig/types.go
+++ b/integration_test/oidcserver/testconfig/types.go
@@ -1,28 +0,0 @@
-package testconfig
-
-import "time"
-
-// Want represents a set of expected values.
-type Want struct {
-	Scope               string
-	RedirectURIPrefix   string
-	CodeChallengeMethod string
-	ExtraParams         map[string]string // optional
-	Username            string            // optional
-	Password            string            // optional
-	RefreshToken        string            // optional
-}
-
-// Response represents a set of response values.
-type Response struct {
-	IDTokenExpiry                 time.Time
-	RefreshToken                  string
-	RefreshError                  string // if set, Refresh() will return the error
-	CodeChallengeMethodsSupported []string
-}
-
-// Config represents a configuration of the OpenID Connect provider.
-type Config struct {
-	Want     Want
-	Response Response
-}
--- a/integration_test/standalone_test.go
+++ b/integration_test/standalone_test.go
@@ -1,307 +0,0 @@
-package integration_test
-
-import (
-	"context"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/int128/kubelogin/integration_test/httpdriver"
-	"github.com/int128/kubelogin/integration_test/keypair"
-	"github.com/int128/kubelogin/integration_test/kubeconfig"
-	"github.com/int128/kubelogin/integration_test/oidcserver"
-	"github.com/int128/kubelogin/integration_test/oidcserver/testconfig"
-	"github.com/int128/kubelogin/pkg/di"
-	"github.com/int128/kubelogin/pkg/infrastructure/browser"
-	"github.com/int128/kubelogin/pkg/testing/clock"
-	"github.com/int128/kubelogin/pkg/testing/logger"
-)
-
-// Run the integration tests of the Login use-case.
-//
-// 1. Start the auth server.
-// 2. Run the Cmd.
-// 3. Open a request for the local server.
-// 4. Verify the kubeconfig.
-func TestStandalone(t *testing.T) {
-	timeout := 3 * time.Second
-	now := time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC)
-
-	for name, tc := range map[string]struct {
-		keyPair keypair.KeyPair
-		args    []string
-	}{
-		"NoTLS": {},
-		"TLS": {
-			keyPair: keypair.Server,
-		},
-	} {
-		httpDriverOption := httpdriver.Config{
-			TLSConfig:    tc.keyPair.TLSConfig,
-			BodyContains: "Authenticated",
-		}
-
-		t.Run(name, func(t *testing.T) {
-			t.Run("AuthCode", func(t *testing.T) {
-				t.Parallel()
-				ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-				defer cancel()
-				sv := oidcserver.New(t, tc.keyPair, testconfig.Config{
-					Want: testconfig.Want{
-						Scope:             "openid",
-						RedirectURIPrefix: "http://localhost:",
-					},
-					Response: testconfig.Response{
-						IDTokenExpiry: now.Add(time.Hour),
-					},
-				})
-				kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
-					Issuer:                  sv.IssuerURL(),
-					IDPCertificateAuthority: tc.keyPair.CACertPath,
-				})
-				runStandalone(t, ctx, standaloneConfig{
-					issuerURL:          sv.IssuerURL(),
-					kubeConfigFilename: kubeConfigFilename,
-					httpDriver:         httpdriver.New(ctx, t, httpDriverOption),
-					now:                now,
-				})
-				kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-					IDToken:      sv.LastTokenResponse().IDToken,
-					RefreshToken: sv.LastTokenResponse().RefreshToken,
-				})
-			})
-
-			t.Run("ROPC", func(t *testing.T) {
-				t.Parallel()
-				ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-				defer cancel()
-				sv := oidcserver.New(t, tc.keyPair, testconfig.Config{
-					Want: testconfig.Want{
-						Scope:             "openid",
-						RedirectURIPrefix: "http://localhost:",
-						Username:          "USER1",
-						Password:          "PASS1",
-					},
-					Response: testconfig.Response{
-						IDTokenExpiry: now.Add(time.Hour),
-					},
-				})
-				kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
-					Issuer:                  sv.IssuerURL(),
-					IDPCertificateAuthority: tc.keyPair.CACertPath,
-				})
-				runStandalone(t, ctx, standaloneConfig{
-					issuerURL:          sv.IssuerURL(),
-					kubeConfigFilename: kubeConfigFilename,
-					httpDriver:         httpdriver.Zero(t),
-					now:                now,
-					args: []string{
-						"--username", "USER1",
-						"--password", "PASS1",
-					},
-				})
-				kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-					IDToken:      sv.LastTokenResponse().IDToken,
-					RefreshToken: sv.LastTokenResponse().RefreshToken,
-				})
-			})
-
-			t.Run("TokenLifecycle", func(t *testing.T) {
-				t.Parallel()
-				ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-				defer cancel()
-				sv := oidcserver.New(t, tc.keyPair, testconfig.Config{})
-				kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
-					Issuer:                  sv.IssuerURL(),
-					IDPCertificateAuthority: tc.keyPair.CACertPath,
-				})
-
-				t.Run("NoToken", func(t *testing.T) {
-					sv.SetConfig(testconfig.Config{
-						Want: testconfig.Want{
-							Scope:             "openid",
-							RedirectURIPrefix: "http://localhost:",
-						},
-						Response: testconfig.Response{
-							IDTokenExpiry: now.Add(time.Hour),
-							RefreshToken:  "REFRESH_TOKEN_1",
-						},
-					})
-					runStandalone(t, ctx, standaloneConfig{
-						issuerURL:          sv.IssuerURL(),
-						kubeConfigFilename: kubeConfigFilename,
-						httpDriver:         httpdriver.New(ctx, t, httpDriverOption),
-						now:                now,
-					})
-					kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-						IDToken:      sv.LastTokenResponse().IDToken,
-						RefreshToken: "REFRESH_TOKEN_1",
-					})
-				})
-				t.Run("Valid", func(t *testing.T) {
-					sv.SetConfig(testconfig.Config{})
-					runStandalone(t, ctx, standaloneConfig{
-						issuerURL:          sv.IssuerURL(),
-						kubeConfigFilename: kubeConfigFilename,
-						httpDriver:         httpdriver.Zero(t),
-						now:                now,
-					})
-					kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-						IDToken:      sv.LastTokenResponse().IDToken,
-						RefreshToken: "REFRESH_TOKEN_1",
-					})
-				})
-				t.Run("Refresh", func(t *testing.T) {
-					sv.SetConfig(testconfig.Config{
-						Want: testconfig.Want{
-							Scope:             "openid",
-							RedirectURIPrefix: "http://localhost:",
-							RefreshToken:      "REFRESH_TOKEN_1",
-						},
-						Response: testconfig.Response{
-							IDTokenExpiry: now.Add(3 * time.Hour),
-							RefreshToken:  "REFRESH_TOKEN_2",
-						},
-					})
-					runStandalone(t, ctx, standaloneConfig{
-						issuerURL:          sv.IssuerURL(),
-						kubeConfigFilename: kubeConfigFilename,
-						httpDriver:         httpdriver.New(ctx, t, httpDriverOption),
-						now:                now.Add(2 * time.Hour),
-					})
-					kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-						IDToken:      sv.LastTokenResponse().IDToken,
-						RefreshToken: "REFRESH_TOKEN_2",
-					})
-				})
-				t.Run("RefreshAgain", func(t *testing.T) {
-					sv.SetConfig(testconfig.Config{
-						Want: testconfig.Want{
-							Scope:             "openid",
-							RedirectURIPrefix: "http://localhost:",
-							RefreshToken:      "REFRESH_TOKEN_2",
-						},
-						Response: testconfig.Response{
-							IDTokenExpiry: now.Add(5 * time.Hour),
-						},
-					})
-					runStandalone(t, ctx, standaloneConfig{
-						issuerURL:          sv.IssuerURL(),
-						kubeConfigFilename: kubeConfigFilename,
-						httpDriver:         httpdriver.New(ctx, t, httpDriverOption),
-						now:                now.Add(4 * time.Hour),
-					})
-					kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-						IDToken:      sv.LastTokenResponse().IDToken,
-						RefreshToken: "REFRESH_TOKEN_2",
-					})
-				})
-			})
-		})
-	}
-
-	t.Run("TLSData", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		sv := oidcserver.New(t, keypair.Server, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:             "openid",
-				RedirectURIPrefix: "http://localhost:",
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry: now.Add(time.Hour),
-			},
-		})
-		kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
-			Issuer:                      sv.IssuerURL(),
-			IDPCertificateAuthorityData: keypair.Server.CACertBase64,
-		})
-		runStandalone(t, ctx, standaloneConfig{
-			issuerURL:          sv.IssuerURL(),
-			kubeConfigFilename: kubeConfigFilename,
-			httpDriver:         httpdriver.New(ctx, t, httpdriver.Config{TLSConfig: keypair.Server.TLSConfig}),
-			now:                now,
-		})
-		kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-			IDToken:      sv.LastTokenResponse().IDToken,
-			RefreshToken: sv.LastTokenResponse().RefreshToken,
-		})
-	})
-
-	t.Run("env_KUBECONFIG", func(t *testing.T) {
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		sv := oidcserver.New(t, keypair.None, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:             "openid",
-				RedirectURIPrefix: "http://localhost:",
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry: now.Add(time.Hour),
-			},
-		})
-		kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
-			Issuer: sv.IssuerURL(),
-		})
-		t.Setenv("KUBECONFIG", kubeConfigFilename+string(os.PathListSeparator)+"kubeconfig/testdata/dummy.yaml")
-		runStandalone(t, ctx, standaloneConfig{
-			issuerURL:  sv.IssuerURL(),
-			httpDriver: httpdriver.New(ctx, t, httpdriver.Config{}),
-			now:        now,
-		})
-		kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-			IDToken:      sv.LastTokenResponse().IDToken,
-			RefreshToken: sv.LastTokenResponse().RefreshToken,
-		})
-	})
-
-	t.Run("ExtraScopes", func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
-		defer cancel()
-		sv := oidcserver.New(t, keypair.None, testconfig.Config{
-			Want: testconfig.Want{
-				Scope:             "profile groups openid",
-				RedirectURIPrefix: "http://localhost:",
-			},
-			Response: testconfig.Response{
-				IDTokenExpiry: now.Add(time.Hour),
-			},
-		})
-		kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
-			Issuer:      sv.IssuerURL(),
-			ExtraScopes: "profile,groups",
-		})
-		runStandalone(t, ctx, standaloneConfig{
-			issuerURL:          sv.IssuerURL(),
-			kubeConfigFilename: kubeConfigFilename,
-			httpDriver:         httpdriver.New(ctx, t, httpdriver.Config{}),
-			now:                now,
-		})
-		kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
-			IDToken:      sv.LastTokenResponse().IDToken,
-			RefreshToken: sv.LastTokenResponse().RefreshToken,
-		})
-	})
-}
-
-type standaloneConfig struct {
-	issuerURL          string
-	kubeConfigFilename string
-	httpDriver         browser.Interface
-	now                time.Time
-	args               []string
-}
-
-func runStandalone(t *testing.T, ctx context.Context, cfg standaloneConfig) {
-	cmd := di.NewCmdForHeadless(clock.Fake(cfg.now), os.Stdin, os.Stdout, logger.New(t), cfg.httpDriver)
-	exitCode := cmd.Run(ctx, append([]string{
-		"kubelogin",
-		"--kubeconfig", cfg.kubeConfigFilename,
-		"--listen-address", "127.0.0.1:0",
-	}, cfg.args...), "HEAD")
-	if exitCode != 0 {
-		t.Errorf("exit status wants 0 but %d", exitCode)
-	}
-}
--- a/main.go
+++ b/main.go
@@ -1,19 +1,57 @@
 package main

 import (
-	"context"
-	"os"
-	"os/signal"
-	"syscall"
+	"log"

-	"github.com/int128/kubelogin/pkg/di"
+	"k8s.io/client-go/tools/clientcmd/api"
 )

-var version = "HEAD"
-
 func main() {
-	ctx := context.Background()
-	ctx, stop := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
-	defer stop()
-	os.Exit(di.NewCmd().Run(ctx, os.Args, version))
+	kubeConfigPath, err := FindKubeConfig()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	log.Printf("Reading config from %s", kubeConfigPath)
+	kubeConfig, err := ReadKubeConfig(kubeConfigPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+	log.Printf("Using current context: %s", kubeConfig.CurrentContext)
+
+	authInfo := GetCurrentAuthInfo(*kubeConfig)
+	if authInfo == nil {
+		log.Fatal("Could not find the current user")
+	}
+	authProvider := authInfo.AuthProvider
+	if authProvider == nil {
+		log.Fatal("auth-provider is not set in the config")
+	}
+
+	switch authProvider.Name {
+	case "oidc":
+		if err := mutateConfigWithOIDC(authProvider); err != nil {
+			log.Fatal(err)
+		}
+		WriteKubeConfig(*kubeConfig, kubeConfigPath)
+		log.Printf("Updated %s", kubeConfigPath)
+
+	default:
+		log.Fatalf("Currently auth-provider `%s` is not supported", authProvider.Name)
+	}
+}
+
+func mutateConfigWithOIDC(authProvider *api.AuthProviderConfig) error {
+	issuer := authProvider.Config["idp-issuer-url"]
+	clientID := authProvider.Config["client-id"]
+	clientSecret := authProvider.Config["client-secret"]
+	log.Printf("Using issuer: %s", issuer)
+	log.Printf("Using client ID: %s", clientID)
+	oidcToken, err := GetOIDCToken(issuer, clientID, clientSecret)
+	if err != nil {
+		return err
+	}
+	authProvider.Config["id-token"] = oidcToken.IDToken
+	authProvider.Config["refresh-token"] = oidcToken.RefreshToken
+	return nil
 }
--- a/mocks/github.com/int128/kubelogin/integration_test/oidcserver/service_mock/mock_Provider.go
+++ b/mocks/github.com/int128/kubelogin/integration_test/oidcserver/service_mock/mock_Provider.go
@@ -1,361 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package service_mock
-
-import (
-	service "github.com/int128/kubelogin/integration_test/oidcserver/service"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockProvider is an autogenerated mock type for the Provider type
-type MockProvider struct {
-	mock.Mock
-}
-
-type MockProvider_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockProvider) EXPECT() *MockProvider_Expecter {
-	return &MockProvider_Expecter{mock: &_m.Mock}
-}
-
-// AuthenticateCode provides a mock function with given fields: req
-func (_m *MockProvider) AuthenticateCode(req service.AuthenticationRequest) (string, error) {
-	ret := _m.Called(req)
-
-	if len(ret) == 0 {
-		panic("no return value specified for AuthenticateCode")
-	}
-
-	var r0 string
-	var r1 error
-	if rf, ok := ret.Get(0).(func(service.AuthenticationRequest) (string, error)); ok {
-		return rf(req)
-	}
-	if rf, ok := ret.Get(0).(func(service.AuthenticationRequest) string); ok {
-		r0 = rf(req)
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-
-	if rf, ok := ret.Get(1).(func(service.AuthenticationRequest) error); ok {
-		r1 = rf(req)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockProvider_AuthenticateCode_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AuthenticateCode'
-type MockProvider_AuthenticateCode_Call struct {
-	*mock.Call
-}
-
-// AuthenticateCode is a helper method to define mock.On call
-//   - req service.AuthenticationRequest
-func (_e *MockProvider_Expecter) AuthenticateCode(req interface{}) *MockProvider_AuthenticateCode_Call {
-	return &MockProvider_AuthenticateCode_Call{Call: _e.mock.On("AuthenticateCode", req)}
-}
-
-func (_c *MockProvider_AuthenticateCode_Call) Run(run func(req service.AuthenticationRequest)) *MockProvider_AuthenticateCode_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(service.AuthenticationRequest))
-	})
-	return _c
-}
-
-func (_c *MockProvider_AuthenticateCode_Call) Return(code string, err error) *MockProvider_AuthenticateCode_Call {
-	_c.Call.Return(code, err)
-	return _c
-}
-
-func (_c *MockProvider_AuthenticateCode_Call) RunAndReturn(run func(service.AuthenticationRequest) (string, error)) *MockProvider_AuthenticateCode_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// AuthenticatePassword provides a mock function with given fields: username, password, scope
-func (_m *MockProvider) AuthenticatePassword(username string, password string, scope string) (*service.TokenResponse, error) {
-	ret := _m.Called(username, password, scope)
-
-	if len(ret) == 0 {
-		panic("no return value specified for AuthenticatePassword")
-	}
-
-	var r0 *service.TokenResponse
-	var r1 error
-	if rf, ok := ret.Get(0).(func(string, string, string) (*service.TokenResponse, error)); ok {
-		return rf(username, password, scope)
-	}
-	if rf, ok := ret.Get(0).(func(string, string, string) *service.TokenResponse); ok {
-		r0 = rf(username, password, scope)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.TokenResponse)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(string, string, string) error); ok {
-		r1 = rf(username, password, scope)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockProvider_AuthenticatePassword_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AuthenticatePassword'
-type MockProvider_AuthenticatePassword_Call struct {
-	*mock.Call
-}
-
-// AuthenticatePassword is a helper method to define mock.On call
-//   - username string
-//   - password string
-//   - scope string
-func (_e *MockProvider_Expecter) AuthenticatePassword(username interface{}, password interface{}, scope interface{}) *MockProvider_AuthenticatePassword_Call {
-	return &MockProvider_AuthenticatePassword_Call{Call: _e.mock.On("AuthenticatePassword", username, password, scope)}
-}
-
-func (_c *MockProvider_AuthenticatePassword_Call) Run(run func(username string, password string, scope string)) *MockProvider_AuthenticatePassword_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(string), args[1].(string), args[2].(string))
-	})
-	return _c
-}
-
-func (_c *MockProvider_AuthenticatePassword_Call) Return(_a0 *service.TokenResponse, _a1 error) *MockProvider_AuthenticatePassword_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockProvider_AuthenticatePassword_Call) RunAndReturn(run func(string, string, string) (*service.TokenResponse, error)) *MockProvider_AuthenticatePassword_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Discovery provides a mock function with no fields
-func (_m *MockProvider) Discovery() *service.DiscoveryResponse {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for Discovery")
-	}
-
-	var r0 *service.DiscoveryResponse
-	if rf, ok := ret.Get(0).(func() *service.DiscoveryResponse); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.DiscoveryResponse)
-		}
-	}
-
-	return r0
-}
-
-// MockProvider_Discovery_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Discovery'
-type MockProvider_Discovery_Call struct {
-	*mock.Call
-}
-
-// Discovery is a helper method to define mock.On call
-func (_e *MockProvider_Expecter) Discovery() *MockProvider_Discovery_Call {
-	return &MockProvider_Discovery_Call{Call: _e.mock.On("Discovery")}
-}
-
-func (_c *MockProvider_Discovery_Call) Run(run func()) *MockProvider_Discovery_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockProvider_Discovery_Call) Return(_a0 *service.DiscoveryResponse) *MockProvider_Discovery_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockProvider_Discovery_Call) RunAndReturn(run func() *service.DiscoveryResponse) *MockProvider_Discovery_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Exchange provides a mock function with given fields: req
-func (_m *MockProvider) Exchange(req service.TokenRequest) (*service.TokenResponse, error) {
-	ret := _m.Called(req)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Exchange")
-	}
-
-	var r0 *service.TokenResponse
-	var r1 error
-	if rf, ok := ret.Get(0).(func(service.TokenRequest) (*service.TokenResponse, error)); ok {
-		return rf(req)
-	}
-	if rf, ok := ret.Get(0).(func(service.TokenRequest) *service.TokenResponse); ok {
-		r0 = rf(req)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.TokenResponse)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(service.TokenRequest) error); ok {
-		r1 = rf(req)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockProvider_Exchange_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Exchange'
-type MockProvider_Exchange_Call struct {
-	*mock.Call
-}
-
-// Exchange is a helper method to define mock.On call
-//   - req service.TokenRequest
-func (_e *MockProvider_Expecter) Exchange(req interface{}) *MockProvider_Exchange_Call {
-	return &MockProvider_Exchange_Call{Call: _e.mock.On("Exchange", req)}
-}
-
-func (_c *MockProvider_Exchange_Call) Run(run func(req service.TokenRequest)) *MockProvider_Exchange_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(service.TokenRequest))
-	})
-	return _c
-}
-
-func (_c *MockProvider_Exchange_Call) Return(_a0 *service.TokenResponse, _a1 error) *MockProvider_Exchange_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockProvider_Exchange_Call) RunAndReturn(run func(service.TokenRequest) (*service.TokenResponse, error)) *MockProvider_Exchange_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetCertificates provides a mock function with no fields
-func (_m *MockProvider) GetCertificates() *service.CertificatesResponse {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetCertificates")
-	}
-
-	var r0 *service.CertificatesResponse
-	if rf, ok := ret.Get(0).(func() *service.CertificatesResponse); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.CertificatesResponse)
-		}
-	}
-
-	return r0
-}
-
-// MockProvider_GetCertificates_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetCertificates'
-type MockProvider_GetCertificates_Call struct {
-	*mock.Call
-}
-
-// GetCertificates is a helper method to define mock.On call
-func (_e *MockProvider_Expecter) GetCertificates() *MockProvider_GetCertificates_Call {
-	return &MockProvider_GetCertificates_Call{Call: _e.mock.On("GetCertificates")}
-}
-
-func (_c *MockProvider_GetCertificates_Call) Run(run func()) *MockProvider_GetCertificates_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockProvider_GetCertificates_Call) Return(_a0 *service.CertificatesResponse) *MockProvider_GetCertificates_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockProvider_GetCertificates_Call) RunAndReturn(run func() *service.CertificatesResponse) *MockProvider_GetCertificates_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Refresh provides a mock function with given fields: refreshToken
-func (_m *MockProvider) Refresh(refreshToken string) (*service.TokenResponse, error) {
-	ret := _m.Called(refreshToken)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Refresh")
-	}
-
-	var r0 *service.TokenResponse
-	var r1 error
-	if rf, ok := ret.Get(0).(func(string) (*service.TokenResponse, error)); ok {
-		return rf(refreshToken)
-	}
-	if rf, ok := ret.Get(0).(func(string) *service.TokenResponse); ok {
-		r0 = rf(refreshToken)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.TokenResponse)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(string) error); ok {
-		r1 = rf(refreshToken)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockProvider_Refresh_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Refresh'
-type MockProvider_Refresh_Call struct {
-	*mock.Call
-}
-
-// Refresh is a helper method to define mock.On call
-//   - refreshToken string
-func (_e *MockProvider_Expecter) Refresh(refreshToken interface{}) *MockProvider_Refresh_Call {
-	return &MockProvider_Refresh_Call{Call: _e.mock.On("Refresh", refreshToken)}
-}
-
-func (_c *MockProvider_Refresh_Call) Run(run func(refreshToken string)) *MockProvider_Refresh_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(string))
-	})
-	return _c
-}
-
-func (_c *MockProvider_Refresh_Call) Return(_a0 *service.TokenResponse, _a1 error) *MockProvider_Refresh_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockProvider_Refresh_Call) RunAndReturn(run func(string) (*service.TokenResponse, error)) *MockProvider_Refresh_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockProvider creates a new instance of MockProvider. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockProvider(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockProvider {
-	mock := &MockProvider{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/integration_test/oidcserver/service_mock/mock_Service.go
+++ b/mocks/github.com/int128/kubelogin/integration_test/oidcserver/service_mock/mock_Service.go
@@ -1,487 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package service_mock
-
-import (
-	service "github.com/int128/kubelogin/integration_test/oidcserver/service"
-	testconfig "github.com/int128/kubelogin/integration_test/oidcserver/testconfig"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockService is an autogenerated mock type for the Service type
-type MockService struct {
-	mock.Mock
-}
-
-type MockService_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockService) EXPECT() *MockService_Expecter {
-	return &MockService_Expecter{mock: &_m.Mock}
-}
-
-// AuthenticateCode provides a mock function with given fields: req
-func (_m *MockService) AuthenticateCode(req service.AuthenticationRequest) (string, error) {
-	ret := _m.Called(req)
-
-	if len(ret) == 0 {
-		panic("no return value specified for AuthenticateCode")
-	}
-
-	var r0 string
-	var r1 error
-	if rf, ok := ret.Get(0).(func(service.AuthenticationRequest) (string, error)); ok {
-		return rf(req)
-	}
-	if rf, ok := ret.Get(0).(func(service.AuthenticationRequest) string); ok {
-		r0 = rf(req)
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-
-	if rf, ok := ret.Get(1).(func(service.AuthenticationRequest) error); ok {
-		r1 = rf(req)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockService_AuthenticateCode_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AuthenticateCode'
-type MockService_AuthenticateCode_Call struct {
-	*mock.Call
-}
-
-// AuthenticateCode is a helper method to define mock.On call
-//   - req service.AuthenticationRequest
-func (_e *MockService_Expecter) AuthenticateCode(req interface{}) *MockService_AuthenticateCode_Call {
-	return &MockService_AuthenticateCode_Call{Call: _e.mock.On("AuthenticateCode", req)}
-}
-
-func (_c *MockService_AuthenticateCode_Call) Run(run func(req service.AuthenticationRequest)) *MockService_AuthenticateCode_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(service.AuthenticationRequest))
-	})
-	return _c
-}
-
-func (_c *MockService_AuthenticateCode_Call) Return(code string, err error) *MockService_AuthenticateCode_Call {
-	_c.Call.Return(code, err)
-	return _c
-}
-
-func (_c *MockService_AuthenticateCode_Call) RunAndReturn(run func(service.AuthenticationRequest) (string, error)) *MockService_AuthenticateCode_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// AuthenticatePassword provides a mock function with given fields: username, password, scope
-func (_m *MockService) AuthenticatePassword(username string, password string, scope string) (*service.TokenResponse, error) {
-	ret := _m.Called(username, password, scope)
-
-	if len(ret) == 0 {
-		panic("no return value specified for AuthenticatePassword")
-	}
-
-	var r0 *service.TokenResponse
-	var r1 error
-	if rf, ok := ret.Get(0).(func(string, string, string) (*service.TokenResponse, error)); ok {
-		return rf(username, password, scope)
-	}
-	if rf, ok := ret.Get(0).(func(string, string, string) *service.TokenResponse); ok {
-		r0 = rf(username, password, scope)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.TokenResponse)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(string, string, string) error); ok {
-		r1 = rf(username, password, scope)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockService_AuthenticatePassword_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AuthenticatePassword'
-type MockService_AuthenticatePassword_Call struct {
-	*mock.Call
-}
-
-// AuthenticatePassword is a helper method to define mock.On call
-//   - username string
-//   - password string
-//   - scope string
-func (_e *MockService_Expecter) AuthenticatePassword(username interface{}, password interface{}, scope interface{}) *MockService_AuthenticatePassword_Call {
-	return &MockService_AuthenticatePassword_Call{Call: _e.mock.On("AuthenticatePassword", username, password, scope)}
-}
-
-func (_c *MockService_AuthenticatePassword_Call) Run(run func(username string, password string, scope string)) *MockService_AuthenticatePassword_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(string), args[1].(string), args[2].(string))
-	})
-	return _c
-}
-
-func (_c *MockService_AuthenticatePassword_Call) Return(_a0 *service.TokenResponse, _a1 error) *MockService_AuthenticatePassword_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockService_AuthenticatePassword_Call) RunAndReturn(run func(string, string, string) (*service.TokenResponse, error)) *MockService_AuthenticatePassword_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Discovery provides a mock function with no fields
-func (_m *MockService) Discovery() *service.DiscoveryResponse {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for Discovery")
-	}
-
-	var r0 *service.DiscoveryResponse
-	if rf, ok := ret.Get(0).(func() *service.DiscoveryResponse); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.DiscoveryResponse)
-		}
-	}
-
-	return r0
-}
-
-// MockService_Discovery_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Discovery'
-type MockService_Discovery_Call struct {
-	*mock.Call
-}
-
-// Discovery is a helper method to define mock.On call
-func (_e *MockService_Expecter) Discovery() *MockService_Discovery_Call {
-	return &MockService_Discovery_Call{Call: _e.mock.On("Discovery")}
-}
-
-func (_c *MockService_Discovery_Call) Run(run func()) *MockService_Discovery_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockService_Discovery_Call) Return(_a0 *service.DiscoveryResponse) *MockService_Discovery_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockService_Discovery_Call) RunAndReturn(run func() *service.DiscoveryResponse) *MockService_Discovery_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Exchange provides a mock function with given fields: req
-func (_m *MockService) Exchange(req service.TokenRequest) (*service.TokenResponse, error) {
-	ret := _m.Called(req)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Exchange")
-	}
-
-	var r0 *service.TokenResponse
-	var r1 error
-	if rf, ok := ret.Get(0).(func(service.TokenRequest) (*service.TokenResponse, error)); ok {
-		return rf(req)
-	}
-	if rf, ok := ret.Get(0).(func(service.TokenRequest) *service.TokenResponse); ok {
-		r0 = rf(req)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.TokenResponse)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(service.TokenRequest) error); ok {
-		r1 = rf(req)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockService_Exchange_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Exchange'
-type MockService_Exchange_Call struct {
-	*mock.Call
-}
-
-// Exchange is a helper method to define mock.On call
-//   - req service.TokenRequest
-func (_e *MockService_Expecter) Exchange(req interface{}) *MockService_Exchange_Call {
-	return &MockService_Exchange_Call{Call: _e.mock.On("Exchange", req)}
-}
-
-func (_c *MockService_Exchange_Call) Run(run func(req service.TokenRequest)) *MockService_Exchange_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(service.TokenRequest))
-	})
-	return _c
-}
-
-func (_c *MockService_Exchange_Call) Return(_a0 *service.TokenResponse, _a1 error) *MockService_Exchange_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockService_Exchange_Call) RunAndReturn(run func(service.TokenRequest) (*service.TokenResponse, error)) *MockService_Exchange_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetCertificates provides a mock function with no fields
-func (_m *MockService) GetCertificates() *service.CertificatesResponse {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetCertificates")
-	}
-
-	var r0 *service.CertificatesResponse
-	if rf, ok := ret.Get(0).(func() *service.CertificatesResponse); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.CertificatesResponse)
-		}
-	}
-
-	return r0
-}
-
-// MockService_GetCertificates_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetCertificates'
-type MockService_GetCertificates_Call struct {
-	*mock.Call
-}
-
-// GetCertificates is a helper method to define mock.On call
-func (_e *MockService_Expecter) GetCertificates() *MockService_GetCertificates_Call {
-	return &MockService_GetCertificates_Call{Call: _e.mock.On("GetCertificates")}
-}
-
-func (_c *MockService_GetCertificates_Call) Run(run func()) *MockService_GetCertificates_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockService_GetCertificates_Call) Return(_a0 *service.CertificatesResponse) *MockService_GetCertificates_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockService_GetCertificates_Call) RunAndReturn(run func() *service.CertificatesResponse) *MockService_GetCertificates_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// IssuerURL provides a mock function with no fields
-func (_m *MockService) IssuerURL() string {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for IssuerURL")
-	}
-
-	var r0 string
-	if rf, ok := ret.Get(0).(func() string); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-
-	return r0
-}
-
-// MockService_IssuerURL_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'IssuerURL'
-type MockService_IssuerURL_Call struct {
-	*mock.Call
-}
-
-// IssuerURL is a helper method to define mock.On call
-func (_e *MockService_Expecter) IssuerURL() *MockService_IssuerURL_Call {
-	return &MockService_IssuerURL_Call{Call: _e.mock.On("IssuerURL")}
-}
-
-func (_c *MockService_IssuerURL_Call) Run(run func()) *MockService_IssuerURL_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockService_IssuerURL_Call) Return(_a0 string) *MockService_IssuerURL_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockService_IssuerURL_Call) RunAndReturn(run func() string) *MockService_IssuerURL_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// LastTokenResponse provides a mock function with no fields
-func (_m *MockService) LastTokenResponse() *service.TokenResponse {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for LastTokenResponse")
-	}
-
-	var r0 *service.TokenResponse
-	if rf, ok := ret.Get(0).(func() *service.TokenResponse); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.TokenResponse)
-		}
-	}
-
-	return r0
-}
-
-// MockService_LastTokenResponse_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'LastTokenResponse'
-type MockService_LastTokenResponse_Call struct {
-	*mock.Call
-}
-
-// LastTokenResponse is a helper method to define mock.On call
-func (_e *MockService_Expecter) LastTokenResponse() *MockService_LastTokenResponse_Call {
-	return &MockService_LastTokenResponse_Call{Call: _e.mock.On("LastTokenResponse")}
-}
-
-func (_c *MockService_LastTokenResponse_Call) Run(run func()) *MockService_LastTokenResponse_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockService_LastTokenResponse_Call) Return(_a0 *service.TokenResponse) *MockService_LastTokenResponse_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockService_LastTokenResponse_Call) RunAndReturn(run func() *service.TokenResponse) *MockService_LastTokenResponse_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Refresh provides a mock function with given fields: refreshToken
-func (_m *MockService) Refresh(refreshToken string) (*service.TokenResponse, error) {
-	ret := _m.Called(refreshToken)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Refresh")
-	}
-
-	var r0 *service.TokenResponse
-	var r1 error
-	if rf, ok := ret.Get(0).(func(string) (*service.TokenResponse, error)); ok {
-		return rf(refreshToken)
-	}
-	if rf, ok := ret.Get(0).(func(string) *service.TokenResponse); ok {
-		r0 = rf(refreshToken)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*service.TokenResponse)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(string) error); ok {
-		r1 = rf(refreshToken)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockService_Refresh_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Refresh'
-type MockService_Refresh_Call struct {
-	*mock.Call
-}
-
-// Refresh is a helper method to define mock.On call
-//   - refreshToken string
-func (_e *MockService_Expecter) Refresh(refreshToken interface{}) *MockService_Refresh_Call {
-	return &MockService_Refresh_Call{Call: _e.mock.On("Refresh", refreshToken)}
-}
-
-func (_c *MockService_Refresh_Call) Run(run func(refreshToken string)) *MockService_Refresh_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(string))
-	})
-	return _c
-}
-
-func (_c *MockService_Refresh_Call) Return(_a0 *service.TokenResponse, _a1 error) *MockService_Refresh_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockService_Refresh_Call) RunAndReturn(run func(string) (*service.TokenResponse, error)) *MockService_Refresh_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// SetConfig provides a mock function with given fields: config
-func (_m *MockService) SetConfig(config testconfig.Config) {
-	_m.Called(config)
-}
-
-// MockService_SetConfig_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SetConfig'
-type MockService_SetConfig_Call struct {
-	*mock.Call
-}
-
-// SetConfig is a helper method to define mock.On call
-//   - config testconfig.Config
-func (_e *MockService_Expecter) SetConfig(config interface{}) *MockService_SetConfig_Call {
-	return &MockService_SetConfig_Call{Call: _e.mock.On("SetConfig", config)}
-}
-
-func (_c *MockService_SetConfig_Call) Run(run func(config testconfig.Config)) *MockService_SetConfig_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(testconfig.Config))
-	})
-	return _c
-}
-
-func (_c *MockService_SetConfig_Call) Return() *MockService_SetConfig_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockService_SetConfig_Call) RunAndReturn(run func(testconfig.Config)) *MockService_SetConfig_Call {
-	_c.Run(run)
-	return _c
-}
-
-// NewMockService creates a new instance of MockService. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockService(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockService {
-	mock := &MockService{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/cmd_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/cmd_mock/mock_Interface.go
@@ -1,84 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package cmd_mock
-
-import (
-	context "context"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Run provides a mock function with given fields: ctx, args, version
-func (_m *MockInterface) Run(ctx context.Context, args []string, version string) int {
-	ret := _m.Called(ctx, args, version)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Run")
-	}
-
-	var r0 int
-	if rf, ok := ret.Get(0).(func(context.Context, []string, string) int); ok {
-		r0 = rf(ctx, args, version)
-	} else {
-		r0 = ret.Get(0).(int)
-	}
-
-	return r0
-}
-
-// MockInterface_Run_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Run'
-type MockInterface_Run_Call struct {
-	*mock.Call
-}
-
-// Run is a helper method to define mock.On call
-//   - ctx context.Context
-//   - args []string
-//   - version string
-func (_e *MockInterface_Expecter) Run(ctx interface{}, args interface{}, version interface{}) *MockInterface_Run_Call {
-	return &MockInterface_Run_Call{Call: _e.mock.On("Run", ctx, args, version)}
-}
-
-func (_c *MockInterface_Run_Call) Run(run func(ctx context.Context, args []string, version string)) *MockInterface_Run_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].([]string), args[2].(string))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Run_Call) Return(_a0 int) *MockInterface_Run_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_Run_Call) RunAndReturn(run func(context.Context, []string, string) int) *MockInterface_Run_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/credentialplugin/reader_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/credentialplugin/reader_mock/mock_Interface.go
@@ -1,90 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package reader_mock
-
-import (
-	credentialplugin "github.com/int128/kubelogin/pkg/credentialplugin"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Read provides a mock function with no fields
-func (_m *MockInterface) Read() (credentialplugin.Input, error) {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for Read")
-	}
-
-	var r0 credentialplugin.Input
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (credentialplugin.Input, error)); ok {
-		return rf()
-	}
-	if rf, ok := ret.Get(0).(func() credentialplugin.Input); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Get(0).(credentialplugin.Input)
-	}
-
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_Read_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Read'
-type MockInterface_Read_Call struct {
-	*mock.Call
-}
-
-// Read is a helper method to define mock.On call
-func (_e *MockInterface_Expecter) Read() *MockInterface_Read_Call {
-	return &MockInterface_Read_Call{Call: _e.mock.On("Read")}
-}
-
-func (_c *MockInterface_Read_Call) Run(run func()) *MockInterface_Read_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockInterface_Read_Call) Return(_a0 credentialplugin.Input, _a1 error) *MockInterface_Read_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_Read_Call) RunAndReturn(run func() (credentialplugin.Input, error)) *MockInterface_Read_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/credentialplugin/writer_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/credentialplugin/writer_mock/mock_Interface.go
@@ -1,81 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package writer_mock
-
-import (
-	credentialplugin "github.com/int128/kubelogin/pkg/credentialplugin"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Write provides a mock function with given fields: out
-func (_m *MockInterface) Write(out credentialplugin.Output) error {
-	ret := _m.Called(out)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Write")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(credentialplugin.Output) error); ok {
-		r0 = rf(out)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_Write_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Write'
-type MockInterface_Write_Call struct {
-	*mock.Call
-}
-
-// Write is a helper method to define mock.On call
-//   - out credentialplugin.Output
-func (_e *MockInterface_Expecter) Write(out interface{}) *MockInterface_Write_Call {
-	return &MockInterface_Write_Call{Call: _e.mock.On("Write", out)}
-}
-
-func (_c *MockInterface_Write_Call) Run(run func(out credentialplugin.Output)) *MockInterface_Write_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(credentialplugin.Output))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Write_Call) Return(_a0 error) *MockInterface_Write_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_Write_Call) RunAndReturn(run func(credentialplugin.Output) error) *MockInterface_Write_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/infrastructure/browser_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/infrastructure/browser_mock/mock_Interface.go
@@ -1,130 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package browser_mock
-
-import (
-	context "context"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Open provides a mock function with given fields: url
-func (_m *MockInterface) Open(url string) error {
-	ret := _m.Called(url)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Open")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(string) error); ok {
-		r0 = rf(url)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_Open_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Open'
-type MockInterface_Open_Call struct {
-	*mock.Call
-}
-
-// Open is a helper method to define mock.On call
-//   - url string
-func (_e *MockInterface_Expecter) Open(url interface{}) *MockInterface_Open_Call {
-	return &MockInterface_Open_Call{Call: _e.mock.On("Open", url)}
-}
-
-func (_c *MockInterface_Open_Call) Run(run func(url string)) *MockInterface_Open_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(string))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Open_Call) Return(_a0 error) *MockInterface_Open_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_Open_Call) RunAndReturn(run func(string) error) *MockInterface_Open_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// OpenCommand provides a mock function with given fields: ctx, url, command
-func (_m *MockInterface) OpenCommand(ctx context.Context, url string, command string) error {
-	ret := _m.Called(ctx, url, command)
-
-	if len(ret) == 0 {
-		panic("no return value specified for OpenCommand")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, string, string) error); ok {
-		r0 = rf(ctx, url, command)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_OpenCommand_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'OpenCommand'
-type MockInterface_OpenCommand_Call struct {
-	*mock.Call
-}
-
-// OpenCommand is a helper method to define mock.On call
-//   - ctx context.Context
-//   - url string
-//   - command string
-func (_e *MockInterface_Expecter) OpenCommand(ctx interface{}, url interface{}, command interface{}) *MockInterface_OpenCommand_Call {
-	return &MockInterface_OpenCommand_Call{Call: _e.mock.On("OpenCommand", ctx, url, command)}
-}
-
-func (_c *MockInterface_OpenCommand_Call) Run(run func(ctx context.Context, url string, command string)) *MockInterface_OpenCommand_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(string), args[2].(string))
-	})
-	return _c
-}
-
-func (_c *MockInterface_OpenCommand_Call) Return(_a0 error) *MockInterface_OpenCommand_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_OpenCommand_Call) RunAndReturn(run func(context.Context, string, string) error) *MockInterface_OpenCommand_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/infrastructure/clock_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/infrastructure/clock_mock/mock_Interface.go
@@ -1,81 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package clock_mock
-
-import (
-	time "time"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Now provides a mock function with no fields
-func (_m *MockInterface) Now() time.Time {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for Now")
-	}
-
-	var r0 time.Time
-	if rf, ok := ret.Get(0).(func() time.Time); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Get(0).(time.Time)
-	}
-
-	return r0
-}
-
-// MockInterface_Now_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Now'
-type MockInterface_Now_Call struct {
-	*mock.Call
-}
-
-// Now is a helper method to define mock.On call
-func (_e *MockInterface_Expecter) Now() *MockInterface_Now_Call {
-	return &MockInterface_Now_Call{Call: _e.mock.On("Now")}
-}
-
-func (_c *MockInterface_Now_Call) Run(run func()) *MockInterface_Now_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockInterface_Now_Call) Return(_a0 time.Time) *MockInterface_Now_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_Now_Call) RunAndReturn(run func() time.Time) *MockInterface_Now_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/infrastructure/logger_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/infrastructure/logger_mock/mock_Interface.go
@@ -1,208 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package logger_mock
-
-import (
-	logger "github.com/int128/kubelogin/pkg/infrastructure/logger"
-	mock "github.com/stretchr/testify/mock"
-
-	pflag "github.com/spf13/pflag"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// AddFlags provides a mock function with given fields: f
-func (_m *MockInterface) AddFlags(f *pflag.FlagSet) {
-	_m.Called(f)
-}
-
-// MockInterface_AddFlags_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AddFlags'
-type MockInterface_AddFlags_Call struct {
-	*mock.Call
-}
-
-// AddFlags is a helper method to define mock.On call
-//   - f *pflag.FlagSet
-func (_e *MockInterface_Expecter) AddFlags(f interface{}) *MockInterface_AddFlags_Call {
-	return &MockInterface_AddFlags_Call{Call: _e.mock.On("AddFlags", f)}
-}
-
-func (_c *MockInterface_AddFlags_Call) Run(run func(f *pflag.FlagSet)) *MockInterface_AddFlags_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(*pflag.FlagSet))
-	})
-	return _c
-}
-
-func (_c *MockInterface_AddFlags_Call) Return() *MockInterface_AddFlags_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockInterface_AddFlags_Call) RunAndReturn(run func(*pflag.FlagSet)) *MockInterface_AddFlags_Call {
-	_c.Run(run)
-	return _c
-}
-
-// IsEnabled provides a mock function with given fields: level
-func (_m *MockInterface) IsEnabled(level int) bool {
-	ret := _m.Called(level)
-
-	if len(ret) == 0 {
-		panic("no return value specified for IsEnabled")
-	}
-
-	var r0 bool
-	if rf, ok := ret.Get(0).(func(int) bool); ok {
-		r0 = rf(level)
-	} else {
-		r0 = ret.Get(0).(bool)
-	}
-
-	return r0
-}
-
-// MockInterface_IsEnabled_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'IsEnabled'
-type MockInterface_IsEnabled_Call struct {
-	*mock.Call
-}
-
-// IsEnabled is a helper method to define mock.On call
-//   - level int
-func (_e *MockInterface_Expecter) IsEnabled(level interface{}) *MockInterface_IsEnabled_Call {
-	return &MockInterface_IsEnabled_Call{Call: _e.mock.On("IsEnabled", level)}
-}
-
-func (_c *MockInterface_IsEnabled_Call) Run(run func(level int)) *MockInterface_IsEnabled_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(int))
-	})
-	return _c
-}
-
-func (_c *MockInterface_IsEnabled_Call) Return(_a0 bool) *MockInterface_IsEnabled_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_IsEnabled_Call) RunAndReturn(run func(int) bool) *MockInterface_IsEnabled_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Printf provides a mock function with given fields: format, args
-func (_m *MockInterface) Printf(format string, args ...interface{}) {
-	var _ca []interface{}
-	_ca = append(_ca, format)
-	_ca = append(_ca, args...)
-	_m.Called(_ca...)
-}
-
-// MockInterface_Printf_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Printf'
-type MockInterface_Printf_Call struct {
-	*mock.Call
-}
-
-// Printf is a helper method to define mock.On call
-//   - format string
-//   - args ...interface{}
-func (_e *MockInterface_Expecter) Printf(format interface{}, args ...interface{}) *MockInterface_Printf_Call {
-	return &MockInterface_Printf_Call{Call: _e.mock.On("Printf",
-		append([]interface{}{format}, args...)...)}
-}
-
-func (_c *MockInterface_Printf_Call) Run(run func(format string, args ...interface{})) *MockInterface_Printf_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		variadicArgs := make([]interface{}, len(args)-1)
-		for i, a := range args[1:] {
-			if a != nil {
-				variadicArgs[i] = a.(interface{})
-			}
-		}
-		run(args[0].(string), variadicArgs...)
-	})
-	return _c
-}
-
-func (_c *MockInterface_Printf_Call) Return() *MockInterface_Printf_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockInterface_Printf_Call) RunAndReturn(run func(string, ...interface{})) *MockInterface_Printf_Call {
-	_c.Run(run)
-	return _c
-}
-
-// V provides a mock function with given fields: level
-func (_m *MockInterface) V(level int) logger.Verbose {
-	ret := _m.Called(level)
-
-	if len(ret) == 0 {
-		panic("no return value specified for V")
-	}
-
-	var r0 logger.Verbose
-	if rf, ok := ret.Get(0).(func(int) logger.Verbose); ok {
-		r0 = rf(level)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(logger.Verbose)
-		}
-	}
-
-	return r0
-}
-
-// MockInterface_V_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'V'
-type MockInterface_V_Call struct {
-	*mock.Call
-}
-
-// V is a helper method to define mock.On call
-//   - level int
-func (_e *MockInterface_Expecter) V(level interface{}) *MockInterface_V_Call {
-	return &MockInterface_V_Call{Call: _e.mock.On("V", level)}
-}
-
-func (_c *MockInterface_V_Call) Run(run func(level int)) *MockInterface_V_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(int))
-	})
-	return _c
-}
-
-func (_c *MockInterface_V_Call) Return(_a0 logger.Verbose) *MockInterface_V_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_V_Call) RunAndReturn(run func(int) logger.Verbose) *MockInterface_V_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/infrastructure/logger_mock/mock_Verbose.go
+++ b/mocks/github.com/int128/kubelogin/pkg/infrastructure/logger_mock/mock_Verbose.go
@@ -1,76 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package logger_mock
-
-import mock "github.com/stretchr/testify/mock"
-
-// MockVerbose is an autogenerated mock type for the Verbose type
-type MockVerbose struct {
-	mock.Mock
-}
-
-type MockVerbose_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockVerbose) EXPECT() *MockVerbose_Expecter {
-	return &MockVerbose_Expecter{mock: &_m.Mock}
-}
-
-// Infof provides a mock function with given fields: format, args
-func (_m *MockVerbose) Infof(format string, args ...interface{}) {
-	var _ca []interface{}
-	_ca = append(_ca, format)
-	_ca = append(_ca, args...)
-	_m.Called(_ca...)
-}
-
-// MockVerbose_Infof_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Infof'
-type MockVerbose_Infof_Call struct {
-	*mock.Call
-}
-
-// Infof is a helper method to define mock.On call
-//   - format string
-//   - args ...interface{}
-func (_e *MockVerbose_Expecter) Infof(format interface{}, args ...interface{}) *MockVerbose_Infof_Call {
-	return &MockVerbose_Infof_Call{Call: _e.mock.On("Infof",
-		append([]interface{}{format}, args...)...)}
-}
-
-func (_c *MockVerbose_Infof_Call) Run(run func(format string, args ...interface{})) *MockVerbose_Infof_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		variadicArgs := make([]interface{}, len(args)-1)
-		for i, a := range args[1:] {
-			if a != nil {
-				variadicArgs[i] = a.(interface{})
-			}
-		}
-		run(args[0].(string), variadicArgs...)
-	})
-	return _c
-}
-
-func (_c *MockVerbose_Infof_Call) Return() *MockVerbose_Infof_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockVerbose_Infof_Call) RunAndReturn(run func(string, ...interface{})) *MockVerbose_Infof_Call {
-	_c.Run(run)
-	return _c
-}
-
-// NewMockVerbose creates a new instance of MockVerbose. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockVerbose(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockVerbose {
-	mock := &MockVerbose{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/infrastructure/logger_mock/mock_goLogger.go
+++ b/mocks/github.com/int128/kubelogin/pkg/infrastructure/logger_mock/mock_goLogger.go
@@ -1,76 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package logger_mock
-
-import mock "github.com/stretchr/testify/mock"
-
-// MockgoLogger is an autogenerated mock type for the goLogger type
-type MockgoLogger struct {
-	mock.Mock
-}
-
-type MockgoLogger_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockgoLogger) EXPECT() *MockgoLogger_Expecter {
-	return &MockgoLogger_Expecter{mock: &_m.Mock}
-}
-
-// Printf provides a mock function with given fields: format, v
-func (_m *MockgoLogger) Printf(format string, v ...interface{}) {
-	var _ca []interface{}
-	_ca = append(_ca, format)
-	_ca = append(_ca, v...)
-	_m.Called(_ca...)
-}
-
-// MockgoLogger_Printf_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Printf'
-type MockgoLogger_Printf_Call struct {
-	*mock.Call
-}
-
-// Printf is a helper method to define mock.On call
-//   - format string
-//   - v ...interface{}
-func (_e *MockgoLogger_Expecter) Printf(format interface{}, v ...interface{}) *MockgoLogger_Printf_Call {
-	return &MockgoLogger_Printf_Call{Call: _e.mock.On("Printf",
-		append([]interface{}{format}, v...)...)}
-}
-
-func (_c *MockgoLogger_Printf_Call) Run(run func(format string, v ...interface{})) *MockgoLogger_Printf_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		variadicArgs := make([]interface{}, len(args)-1)
-		for i, a := range args[1:] {
-			if a != nil {
-				variadicArgs[i] = a.(interface{})
-			}
-		}
-		run(args[0].(string), variadicArgs...)
-	})
-	return _c
-}
-
-func (_c *MockgoLogger_Printf_Call) Return() *MockgoLogger_Printf_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockgoLogger_Printf_Call) RunAndReturn(run func(string, ...interface{})) *MockgoLogger_Printf_Call {
-	_c.Run(run)
-	return _c
-}
-
-// NewMockgoLogger creates a new instance of MockgoLogger. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockgoLogger(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockgoLogger {
-	mock := &MockgoLogger{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/infrastructure/reader_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/infrastructure/reader_mock/mock_Interface.go
@@ -1,144 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package reader_mock
-
-import mock "github.com/stretchr/testify/mock"
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// ReadPassword provides a mock function with given fields: prompt
-func (_m *MockInterface) ReadPassword(prompt string) (string, error) {
-	ret := _m.Called(prompt)
-
-	if len(ret) == 0 {
-		panic("no return value specified for ReadPassword")
-	}
-
-	var r0 string
-	var r1 error
-	if rf, ok := ret.Get(0).(func(string) (string, error)); ok {
-		return rf(prompt)
-	}
-	if rf, ok := ret.Get(0).(func(string) string); ok {
-		r0 = rf(prompt)
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-
-	if rf, ok := ret.Get(1).(func(string) error); ok {
-		r1 = rf(prompt)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_ReadPassword_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ReadPassword'
-type MockInterface_ReadPassword_Call struct {
-	*mock.Call
-}
-
-// ReadPassword is a helper method to define mock.On call
-//   - prompt string
-func (_e *MockInterface_Expecter) ReadPassword(prompt interface{}) *MockInterface_ReadPassword_Call {
-	return &MockInterface_ReadPassword_Call{Call: _e.mock.On("ReadPassword", prompt)}
-}
-
-func (_c *MockInterface_ReadPassword_Call) Run(run func(prompt string)) *MockInterface_ReadPassword_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(string))
-	})
-	return _c
-}
-
-func (_c *MockInterface_ReadPassword_Call) Return(_a0 string, _a1 error) *MockInterface_ReadPassword_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_ReadPassword_Call) RunAndReturn(run func(string) (string, error)) *MockInterface_ReadPassword_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// ReadString provides a mock function with given fields: prompt
-func (_m *MockInterface) ReadString(prompt string) (string, error) {
-	ret := _m.Called(prompt)
-
-	if len(ret) == 0 {
-		panic("no return value specified for ReadString")
-	}
-
-	var r0 string
-	var r1 error
-	if rf, ok := ret.Get(0).(func(string) (string, error)); ok {
-		return rf(prompt)
-	}
-	if rf, ok := ret.Get(0).(func(string) string); ok {
-		r0 = rf(prompt)
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-
-	if rf, ok := ret.Get(1).(func(string) error); ok {
-		r1 = rf(prompt)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_ReadString_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ReadString'
-type MockInterface_ReadString_Call struct {
-	*mock.Call
-}
-
-// ReadString is a helper method to define mock.On call
-//   - prompt string
-func (_e *MockInterface_Expecter) ReadString(prompt interface{}) *MockInterface_ReadString_Call {
-	return &MockInterface_ReadString_Call{Call: _e.mock.On("ReadString", prompt)}
-}
-
-func (_c *MockInterface_ReadString_Call) Run(run func(prompt string)) *MockInterface_ReadString_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(string))
-	})
-	return _c
-}
-
-func (_c *MockInterface_ReadString_Call) Return(_a0 string, _a1 error) *MockInterface_ReadString_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_ReadString_Call) RunAndReturn(run func(string) (string, error)) *MockInterface_ReadString_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/infrastructure/stdio_mock/mock_Stdin.go
+++ b/mocks/github.com/int128/kubelogin/pkg/infrastructure/stdio_mock/mock_Stdin.go
@@ -1,88 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package stdio_mock
-
-import mock "github.com/stretchr/testify/mock"
-
-// MockStdin is an autogenerated mock type for the Stdin type
-type MockStdin struct {
-	mock.Mock
-}
-
-type MockStdin_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockStdin) EXPECT() *MockStdin_Expecter {
-	return &MockStdin_Expecter{mock: &_m.Mock}
-}
-
-// Read provides a mock function with given fields: p
-func (_m *MockStdin) Read(p []byte) (int, error) {
-	ret := _m.Called(p)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Read")
-	}
-
-	var r0 int
-	var r1 error
-	if rf, ok := ret.Get(0).(func([]byte) (int, error)); ok {
-		return rf(p)
-	}
-	if rf, ok := ret.Get(0).(func([]byte) int); ok {
-		r0 = rf(p)
-	} else {
-		r0 = ret.Get(0).(int)
-	}
-
-	if rf, ok := ret.Get(1).(func([]byte) error); ok {
-		r1 = rf(p)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockStdin_Read_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Read'
-type MockStdin_Read_Call struct {
-	*mock.Call
-}
-
-// Read is a helper method to define mock.On call
-//   - p []byte
-func (_e *MockStdin_Expecter) Read(p interface{}) *MockStdin_Read_Call {
-	return &MockStdin_Read_Call{Call: _e.mock.On("Read", p)}
-}
-
-func (_c *MockStdin_Read_Call) Run(run func(p []byte)) *MockStdin_Read_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].([]byte))
-	})
-	return _c
-}
-
-func (_c *MockStdin_Read_Call) Return(n int, err error) *MockStdin_Read_Call {
-	_c.Call.Return(n, err)
-	return _c
-}
-
-func (_c *MockStdin_Read_Call) RunAndReturn(run func([]byte) (int, error)) *MockStdin_Read_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockStdin creates a new instance of MockStdin. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockStdin(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockStdin {
-	mock := &MockStdin{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/infrastructure/stdio_mock/mock_Stdout.go
+++ b/mocks/github.com/int128/kubelogin/pkg/infrastructure/stdio_mock/mock_Stdout.go
@@ -1,88 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package stdio_mock
-
-import mock "github.com/stretchr/testify/mock"
-
-// MockStdout is an autogenerated mock type for the Stdout type
-type MockStdout struct {
-	mock.Mock
-}
-
-type MockStdout_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockStdout) EXPECT() *MockStdout_Expecter {
-	return &MockStdout_Expecter{mock: &_m.Mock}
-}
-
-// Write provides a mock function with given fields: p
-func (_m *MockStdout) Write(p []byte) (int, error) {
-	ret := _m.Called(p)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Write")
-	}
-
-	var r0 int
-	var r1 error
-	if rf, ok := ret.Get(0).(func([]byte) (int, error)); ok {
-		return rf(p)
-	}
-	if rf, ok := ret.Get(0).(func([]byte) int); ok {
-		r0 = rf(p)
-	} else {
-		r0 = ret.Get(0).(int)
-	}
-
-	if rf, ok := ret.Get(1).(func([]byte) error); ok {
-		r1 = rf(p)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockStdout_Write_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Write'
-type MockStdout_Write_Call struct {
-	*mock.Call
-}
-
-// Write is a helper method to define mock.On call
-//   - p []byte
-func (_e *MockStdout_Expecter) Write(p interface{}) *MockStdout_Write_Call {
-	return &MockStdout_Write_Call{Call: _e.mock.On("Write", p)}
-}
-
-func (_c *MockStdout_Write_Call) Run(run func(p []byte)) *MockStdout_Write_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].([]byte))
-	})
-	return _c
-}
-
-func (_c *MockStdout_Write_Call) Return(n int, err error) *MockStdout_Write_Call {
-	_c.Call.Return(n, err)
-	return _c
-}
-
-func (_c *MockStdout_Write_Call) RunAndReturn(run func([]byte) (int, error)) *MockStdout_Write_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockStdout creates a new instance of MockStdout. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockStdout(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockStdout {
-	mock := &MockStdout{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/jwt_mock/mock_Clock.go
+++ b/mocks/github.com/int128/kubelogin/pkg/jwt_mock/mock_Clock.go
@@ -1,81 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package jwt_mock
-
-import (
-	time "time"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockClock is an autogenerated mock type for the Clock type
-type MockClock struct {
-	mock.Mock
-}
-
-type MockClock_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockClock) EXPECT() *MockClock_Expecter {
-	return &MockClock_Expecter{mock: &_m.Mock}
-}
-
-// Now provides a mock function with no fields
-func (_m *MockClock) Now() time.Time {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for Now")
-	}
-
-	var r0 time.Time
-	if rf, ok := ret.Get(0).(func() time.Time); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Get(0).(time.Time)
-	}
-
-	return r0
-}
-
-// MockClock_Now_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Now'
-type MockClock_Now_Call struct {
-	*mock.Call
-}
-
-// Now is a helper method to define mock.On call
-func (_e *MockClock_Expecter) Now() *MockClock_Now_Call {
-	return &MockClock_Now_Call{Call: _e.mock.On("Now")}
-}
-
-func (_c *MockClock_Now_Call) Run(run func()) *MockClock_Now_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockClock_Now_Call) Return(_a0 time.Time) *MockClock_Now_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockClock_Now_Call) RunAndReturn(run func() time.Time) *MockClock_Now_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockClock creates a new instance of MockClock. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockClock(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockClock {
-	mock := &MockClock{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/kubeconfig/loader_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/kubeconfig/loader_mock/mock_Interface.go
@@ -1,96 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package loader_mock
-
-import (
-	kubeconfig "github.com/int128/kubelogin/pkg/kubeconfig"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// GetCurrentAuthProvider provides a mock function with given fields: explicitFilename, contextName, userName
-func (_m *MockInterface) GetCurrentAuthProvider(explicitFilename string, contextName kubeconfig.ContextName, userName kubeconfig.UserName) (*kubeconfig.AuthProvider, error) {
-	ret := _m.Called(explicitFilename, contextName, userName)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetCurrentAuthProvider")
-	}
-
-	var r0 *kubeconfig.AuthProvider
-	var r1 error
-	if rf, ok := ret.Get(0).(func(string, kubeconfig.ContextName, kubeconfig.UserName) (*kubeconfig.AuthProvider, error)); ok {
-		return rf(explicitFilename, contextName, userName)
-	}
-	if rf, ok := ret.Get(0).(func(string, kubeconfig.ContextName, kubeconfig.UserName) *kubeconfig.AuthProvider); ok {
-		r0 = rf(explicitFilename, contextName, userName)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*kubeconfig.AuthProvider)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(string, kubeconfig.ContextName, kubeconfig.UserName) error); ok {
-		r1 = rf(explicitFilename, contextName, userName)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_GetCurrentAuthProvider_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetCurrentAuthProvider'
-type MockInterface_GetCurrentAuthProvider_Call struct {
-	*mock.Call
-}
-
-// GetCurrentAuthProvider is a helper method to define mock.On call
-//   - explicitFilename string
-//   - contextName kubeconfig.ContextName
-//   - userName kubeconfig.UserName
-func (_e *MockInterface_Expecter) GetCurrentAuthProvider(explicitFilename interface{}, contextName interface{}, userName interface{}) *MockInterface_GetCurrentAuthProvider_Call {
-	return &MockInterface_GetCurrentAuthProvider_Call{Call: _e.mock.On("GetCurrentAuthProvider", explicitFilename, contextName, userName)}
-}
-
-func (_c *MockInterface_GetCurrentAuthProvider_Call) Run(run func(explicitFilename string, contextName kubeconfig.ContextName, userName kubeconfig.UserName)) *MockInterface_GetCurrentAuthProvider_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(string), args[1].(kubeconfig.ContextName), args[2].(kubeconfig.UserName))
-	})
-	return _c
-}
-
-func (_c *MockInterface_GetCurrentAuthProvider_Call) Return(_a0 *kubeconfig.AuthProvider, _a1 error) *MockInterface_GetCurrentAuthProvider_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_GetCurrentAuthProvider_Call) RunAndReturn(run func(string, kubeconfig.ContextName, kubeconfig.UserName) (*kubeconfig.AuthProvider, error)) *MockInterface_GetCurrentAuthProvider_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/kubeconfig/writer_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/kubeconfig/writer_mock/mock_Interface.go
@@ -1,81 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package writer_mock
-
-import (
-	kubeconfig "github.com/int128/kubelogin/pkg/kubeconfig"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// UpdateAuthProvider provides a mock function with given fields: p
-func (_m *MockInterface) UpdateAuthProvider(p kubeconfig.AuthProvider) error {
-	ret := _m.Called(p)
-
-	if len(ret) == 0 {
-		panic("no return value specified for UpdateAuthProvider")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(kubeconfig.AuthProvider) error); ok {
-		r0 = rf(p)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_UpdateAuthProvider_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UpdateAuthProvider'
-type MockInterface_UpdateAuthProvider_Call struct {
-	*mock.Call
-}
-
-// UpdateAuthProvider is a helper method to define mock.On call
-//   - p kubeconfig.AuthProvider
-func (_e *MockInterface_Expecter) UpdateAuthProvider(p interface{}) *MockInterface_UpdateAuthProvider_Call {
-	return &MockInterface_UpdateAuthProvider_Call{Call: _e.mock.On("UpdateAuthProvider", p)}
-}
-
-func (_c *MockInterface_UpdateAuthProvider_Call) Run(run func(p kubeconfig.AuthProvider)) *MockInterface_UpdateAuthProvider_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(kubeconfig.AuthProvider))
-	})
-	return _c
-}
-
-func (_c *MockInterface_UpdateAuthProvider_Call) Return(_a0 error) *MockInterface_UpdateAuthProvider_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_UpdateAuthProvider_Call) RunAndReturn(run func(kubeconfig.AuthProvider) error) *MockInterface_UpdateAuthProvider_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/oidc/client_mock/mock_FactoryInterface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/oidc/client_mock/mock_FactoryInterface.go
@@ -1,102 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package client_mock
-
-import (
-	context "context"
-
-	client "github.com/int128/kubelogin/pkg/oidc/client"
-
-	mock "github.com/stretchr/testify/mock"
-
-	oidc "github.com/int128/kubelogin/pkg/oidc"
-
-	tlsclientconfig "github.com/int128/kubelogin/pkg/tlsclientconfig"
-)
-
-// MockFactoryInterface is an autogenerated mock type for the FactoryInterface type
-type MockFactoryInterface struct {
-	mock.Mock
-}
-
-type MockFactoryInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockFactoryInterface) EXPECT() *MockFactoryInterface_Expecter {
-	return &MockFactoryInterface_Expecter{mock: &_m.Mock}
-}
-
-// New provides a mock function with given fields: ctx, prov, tlsClientConfig
-func (_m *MockFactoryInterface) New(ctx context.Context, prov oidc.Provider, tlsClientConfig tlsclientconfig.Config) (client.Interface, error) {
-	ret := _m.Called(ctx, prov, tlsClientConfig)
-
-	if len(ret) == 0 {
-		panic("no return value specified for New")
-	}
-
-	var r0 client.Interface
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, oidc.Provider, tlsclientconfig.Config) (client.Interface, error)); ok {
-		return rf(ctx, prov, tlsClientConfig)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, oidc.Provider, tlsclientconfig.Config) client.Interface); ok {
-		r0 = rf(ctx, prov, tlsClientConfig)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(client.Interface)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, oidc.Provider, tlsclientconfig.Config) error); ok {
-		r1 = rf(ctx, prov, tlsClientConfig)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockFactoryInterface_New_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'New'
-type MockFactoryInterface_New_Call struct {
-	*mock.Call
-}
-
-// New is a helper method to define mock.On call
-//   - ctx context.Context
-//   - prov oidc.Provider
-//   - tlsClientConfig tlsclientconfig.Config
-func (_e *MockFactoryInterface_Expecter) New(ctx interface{}, prov interface{}, tlsClientConfig interface{}) *MockFactoryInterface_New_Call {
-	return &MockFactoryInterface_New_Call{Call: _e.mock.On("New", ctx, prov, tlsClientConfig)}
-}
-
-func (_c *MockFactoryInterface_New_Call) Run(run func(ctx context.Context, prov oidc.Provider, tlsClientConfig tlsclientconfig.Config)) *MockFactoryInterface_New_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(oidc.Provider), args[2].(tlsclientconfig.Config))
-	})
-	return _c
-}
-
-func (_c *MockFactoryInterface_New_Call) Return(_a0 client.Interface, _a1 error) *MockFactoryInterface_New_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockFactoryInterface_New_Call) RunAndReturn(run func(context.Context, oidc.Provider, tlsclientconfig.Config) (client.Interface, error)) *MockFactoryInterface_New_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockFactoryInterface creates a new instance of MockFactoryInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockFactoryInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockFactoryInterface {
-	mock := &MockFactoryInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/oidc/client_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/oidc/client_mock/mock_Interface.go
@@ -1,490 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package client_mock
-
-import (
-	context "context"
-
-	client "github.com/int128/kubelogin/pkg/oidc/client"
-
-	mock "github.com/stretchr/testify/mock"
-
-	oauth2dev "github.com/int128/oauth2dev"
-
-	oidc "github.com/int128/kubelogin/pkg/oidc"
-
-	pkce "github.com/int128/kubelogin/pkg/pkce"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// ExchangeAuthCode provides a mock function with given fields: ctx, in
-func (_m *MockInterface) ExchangeAuthCode(ctx context.Context, in client.ExchangeAuthCodeInput) (*oidc.TokenSet, error) {
-	ret := _m.Called(ctx, in)
-
-	if len(ret) == 0 {
-		panic("no return value specified for ExchangeAuthCode")
-	}
-
-	var r0 *oidc.TokenSet
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, client.ExchangeAuthCodeInput) (*oidc.TokenSet, error)); ok {
-		return rf(ctx, in)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, client.ExchangeAuthCodeInput) *oidc.TokenSet); ok {
-		r0 = rf(ctx, in)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*oidc.TokenSet)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, client.ExchangeAuthCodeInput) error); ok {
-		r1 = rf(ctx, in)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_ExchangeAuthCode_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ExchangeAuthCode'
-type MockInterface_ExchangeAuthCode_Call struct {
-	*mock.Call
-}
-
-// ExchangeAuthCode is a helper method to define mock.On call
-//   - ctx context.Context
-//   - in client.ExchangeAuthCodeInput
-func (_e *MockInterface_Expecter) ExchangeAuthCode(ctx interface{}, in interface{}) *MockInterface_ExchangeAuthCode_Call {
-	return &MockInterface_ExchangeAuthCode_Call{Call: _e.mock.On("ExchangeAuthCode", ctx, in)}
-}
-
-func (_c *MockInterface_ExchangeAuthCode_Call) Run(run func(ctx context.Context, in client.ExchangeAuthCodeInput)) *MockInterface_ExchangeAuthCode_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(client.ExchangeAuthCodeInput))
-	})
-	return _c
-}
-
-func (_c *MockInterface_ExchangeAuthCode_Call) Return(_a0 *oidc.TokenSet, _a1 error) *MockInterface_ExchangeAuthCode_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_ExchangeAuthCode_Call) RunAndReturn(run func(context.Context, client.ExchangeAuthCodeInput) (*oidc.TokenSet, error)) *MockInterface_ExchangeAuthCode_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// ExchangeDeviceCode provides a mock function with given fields: ctx, authResponse
-func (_m *MockInterface) ExchangeDeviceCode(ctx context.Context, authResponse *oauth2dev.AuthorizationResponse) (*oidc.TokenSet, error) {
-	ret := _m.Called(ctx, authResponse)
-
-	if len(ret) == 0 {
-		panic("no return value specified for ExchangeDeviceCode")
-	}
-
-	var r0 *oidc.TokenSet
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *oauth2dev.AuthorizationResponse) (*oidc.TokenSet, error)); ok {
-		return rf(ctx, authResponse)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, *oauth2dev.AuthorizationResponse) *oidc.TokenSet); ok {
-		r0 = rf(ctx, authResponse)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*oidc.TokenSet)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, *oauth2dev.AuthorizationResponse) error); ok {
-		r1 = rf(ctx, authResponse)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_ExchangeDeviceCode_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ExchangeDeviceCode'
-type MockInterface_ExchangeDeviceCode_Call struct {
-	*mock.Call
-}
-
-// ExchangeDeviceCode is a helper method to define mock.On call
-//   - ctx context.Context
-//   - authResponse *oauth2dev.AuthorizationResponse
-func (_e *MockInterface_Expecter) ExchangeDeviceCode(ctx interface{}, authResponse interface{}) *MockInterface_ExchangeDeviceCode_Call {
-	return &MockInterface_ExchangeDeviceCode_Call{Call: _e.mock.On("ExchangeDeviceCode", ctx, authResponse)}
-}
-
-func (_c *MockInterface_ExchangeDeviceCode_Call) Run(run func(ctx context.Context, authResponse *oauth2dev.AuthorizationResponse)) *MockInterface_ExchangeDeviceCode_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(*oauth2dev.AuthorizationResponse))
-	})
-	return _c
-}
-
-func (_c *MockInterface_ExchangeDeviceCode_Call) Return(_a0 *oidc.TokenSet, _a1 error) *MockInterface_ExchangeDeviceCode_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_ExchangeDeviceCode_Call) RunAndReturn(run func(context.Context, *oauth2dev.AuthorizationResponse) (*oidc.TokenSet, error)) *MockInterface_ExchangeDeviceCode_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetAuthCodeURL provides a mock function with given fields: in
-func (_m *MockInterface) GetAuthCodeURL(in client.AuthCodeURLInput) string {
-	ret := _m.Called(in)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetAuthCodeURL")
-	}
-
-	var r0 string
-	if rf, ok := ret.Get(0).(func(client.AuthCodeURLInput) string); ok {
-		r0 = rf(in)
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-
-	return r0
-}
-
-// MockInterface_GetAuthCodeURL_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetAuthCodeURL'
-type MockInterface_GetAuthCodeURL_Call struct {
-	*mock.Call
-}
-
-// GetAuthCodeURL is a helper method to define mock.On call
-//   - in client.AuthCodeURLInput
-func (_e *MockInterface_Expecter) GetAuthCodeURL(in interface{}) *MockInterface_GetAuthCodeURL_Call {
-	return &MockInterface_GetAuthCodeURL_Call{Call: _e.mock.On("GetAuthCodeURL", in)}
-}
-
-func (_c *MockInterface_GetAuthCodeURL_Call) Run(run func(in client.AuthCodeURLInput)) *MockInterface_GetAuthCodeURL_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(client.AuthCodeURLInput))
-	})
-	return _c
-}
-
-func (_c *MockInterface_GetAuthCodeURL_Call) Return(_a0 string) *MockInterface_GetAuthCodeURL_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_GetAuthCodeURL_Call) RunAndReturn(run func(client.AuthCodeURLInput) string) *MockInterface_GetAuthCodeURL_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetDeviceAuthorization provides a mock function with given fields: ctx
-func (_m *MockInterface) GetDeviceAuthorization(ctx context.Context) (*oauth2dev.AuthorizationResponse, error) {
-	ret := _m.Called(ctx)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetDeviceAuthorization")
-	}
-
-	var r0 *oauth2dev.AuthorizationResponse
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context) (*oauth2dev.AuthorizationResponse, error)); ok {
-		return rf(ctx)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context) *oauth2dev.AuthorizationResponse); ok {
-		r0 = rf(ctx)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*oauth2dev.AuthorizationResponse)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
-		r1 = rf(ctx)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_GetDeviceAuthorization_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetDeviceAuthorization'
-type MockInterface_GetDeviceAuthorization_Call struct {
-	*mock.Call
-}
-
-// GetDeviceAuthorization is a helper method to define mock.On call
-//   - ctx context.Context
-func (_e *MockInterface_Expecter) GetDeviceAuthorization(ctx interface{}) *MockInterface_GetDeviceAuthorization_Call {
-	return &MockInterface_GetDeviceAuthorization_Call{Call: _e.mock.On("GetDeviceAuthorization", ctx)}
-}
-
-func (_c *MockInterface_GetDeviceAuthorization_Call) Run(run func(ctx context.Context)) *MockInterface_GetDeviceAuthorization_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context))
-	})
-	return _c
-}
-
-func (_c *MockInterface_GetDeviceAuthorization_Call) Return(_a0 *oauth2dev.AuthorizationResponse, _a1 error) *MockInterface_GetDeviceAuthorization_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_GetDeviceAuthorization_Call) RunAndReturn(run func(context.Context) (*oauth2dev.AuthorizationResponse, error)) *MockInterface_GetDeviceAuthorization_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetTokenByAuthCode provides a mock function with given fields: ctx, in, localServerReadyChan
-func (_m *MockInterface) GetTokenByAuthCode(ctx context.Context, in client.GetTokenByAuthCodeInput, localServerReadyChan chan<- string) (*oidc.TokenSet, error) {
-	ret := _m.Called(ctx, in, localServerReadyChan)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetTokenByAuthCode")
-	}
-
-	var r0 *oidc.TokenSet
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, client.GetTokenByAuthCodeInput, chan<- string) (*oidc.TokenSet, error)); ok {
-		return rf(ctx, in, localServerReadyChan)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, client.GetTokenByAuthCodeInput, chan<- string) *oidc.TokenSet); ok {
-		r0 = rf(ctx, in, localServerReadyChan)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*oidc.TokenSet)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, client.GetTokenByAuthCodeInput, chan<- string) error); ok {
-		r1 = rf(ctx, in, localServerReadyChan)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_GetTokenByAuthCode_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetTokenByAuthCode'
-type MockInterface_GetTokenByAuthCode_Call struct {
-	*mock.Call
-}
-
-// GetTokenByAuthCode is a helper method to define mock.On call
-//   - ctx context.Context
-//   - in client.GetTokenByAuthCodeInput
-//   - localServerReadyChan chan<- string
-func (_e *MockInterface_Expecter) GetTokenByAuthCode(ctx interface{}, in interface{}, localServerReadyChan interface{}) *MockInterface_GetTokenByAuthCode_Call {
-	return &MockInterface_GetTokenByAuthCode_Call{Call: _e.mock.On("GetTokenByAuthCode", ctx, in, localServerReadyChan)}
-}
-
-func (_c *MockInterface_GetTokenByAuthCode_Call) Run(run func(ctx context.Context, in client.GetTokenByAuthCodeInput, localServerReadyChan chan<- string)) *MockInterface_GetTokenByAuthCode_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(client.GetTokenByAuthCodeInput), args[2].(chan<- string))
-	})
-	return _c
-}
-
-func (_c *MockInterface_GetTokenByAuthCode_Call) Return(_a0 *oidc.TokenSet, _a1 error) *MockInterface_GetTokenByAuthCode_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_GetTokenByAuthCode_Call) RunAndReturn(run func(context.Context, client.GetTokenByAuthCodeInput, chan<- string) (*oidc.TokenSet, error)) *MockInterface_GetTokenByAuthCode_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetTokenByROPC provides a mock function with given fields: ctx, username, password
-func (_m *MockInterface) GetTokenByROPC(ctx context.Context, username string, password string) (*oidc.TokenSet, error) {
-	ret := _m.Called(ctx, username, password)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetTokenByROPC")
-	}
-
-	var r0 *oidc.TokenSet
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, string, string) (*oidc.TokenSet, error)); ok {
-		return rf(ctx, username, password)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, string, string) *oidc.TokenSet); ok {
-		r0 = rf(ctx, username, password)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*oidc.TokenSet)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, string, string) error); ok {
-		r1 = rf(ctx, username, password)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_GetTokenByROPC_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetTokenByROPC'
-type MockInterface_GetTokenByROPC_Call struct {
-	*mock.Call
-}
-
-// GetTokenByROPC is a helper method to define mock.On call
-//   - ctx context.Context
-//   - username string
-//   - password string
-func (_e *MockInterface_Expecter) GetTokenByROPC(ctx interface{}, username interface{}, password interface{}) *MockInterface_GetTokenByROPC_Call {
-	return &MockInterface_GetTokenByROPC_Call{Call: _e.mock.On("GetTokenByROPC", ctx, username, password)}
-}
-
-func (_c *MockInterface_GetTokenByROPC_Call) Run(run func(ctx context.Context, username string, password string)) *MockInterface_GetTokenByROPC_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(string), args[2].(string))
-	})
-	return _c
-}
-
-func (_c *MockInterface_GetTokenByROPC_Call) Return(_a0 *oidc.TokenSet, _a1 error) *MockInterface_GetTokenByROPC_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_GetTokenByROPC_Call) RunAndReturn(run func(context.Context, string, string) (*oidc.TokenSet, error)) *MockInterface_GetTokenByROPC_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NegotiatedPKCEMethod provides a mock function with no fields
-func (_m *MockInterface) NegotiatedPKCEMethod() pkce.Method {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for NegotiatedPKCEMethod")
-	}
-
-	var r0 pkce.Method
-	if rf, ok := ret.Get(0).(func() pkce.Method); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Get(0).(pkce.Method)
-	}
-
-	return r0
-}
-
-// MockInterface_NegotiatedPKCEMethod_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'NegotiatedPKCEMethod'
-type MockInterface_NegotiatedPKCEMethod_Call struct {
-	*mock.Call
-}
-
-// NegotiatedPKCEMethod is a helper method to define mock.On call
-func (_e *MockInterface_Expecter) NegotiatedPKCEMethod() *MockInterface_NegotiatedPKCEMethod_Call {
-	return &MockInterface_NegotiatedPKCEMethod_Call{Call: _e.mock.On("NegotiatedPKCEMethod")}
-}
-
-func (_c *MockInterface_NegotiatedPKCEMethod_Call) Run(run func()) *MockInterface_NegotiatedPKCEMethod_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockInterface_NegotiatedPKCEMethod_Call) Return(_a0 pkce.Method) *MockInterface_NegotiatedPKCEMethod_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_NegotiatedPKCEMethod_Call) RunAndReturn(run func() pkce.Method) *MockInterface_NegotiatedPKCEMethod_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Refresh provides a mock function with given fields: ctx, refreshToken
-func (_m *MockInterface) Refresh(ctx context.Context, refreshToken string) (*oidc.TokenSet, error) {
-	ret := _m.Called(ctx, refreshToken)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Refresh")
-	}
-
-	var r0 *oidc.TokenSet
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, string) (*oidc.TokenSet, error)); ok {
-		return rf(ctx, refreshToken)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, string) *oidc.TokenSet); ok {
-		r0 = rf(ctx, refreshToken)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*oidc.TokenSet)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
-		r1 = rf(ctx, refreshToken)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_Refresh_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Refresh'
-type MockInterface_Refresh_Call struct {
-	*mock.Call
-}
-
-// Refresh is a helper method to define mock.On call
-//   - ctx context.Context
-//   - refreshToken string
-func (_e *MockInterface_Expecter) Refresh(ctx interface{}, refreshToken interface{}) *MockInterface_Refresh_Call {
-	return &MockInterface_Refresh_Call{Call: _e.mock.On("Refresh", ctx, refreshToken)}
-}
-
-func (_c *MockInterface_Refresh_Call) Run(run func(ctx context.Context, refreshToken string)) *MockInterface_Refresh_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(string))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Refresh_Call) Return(_a0 *oidc.TokenSet, _a1 error) *MockInterface_Refresh_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_Refresh_Call) RunAndReturn(run func(context.Context, string) (*oidc.TokenSet, error)) *MockInterface_Refresh_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/testing/logger_mock/mock_testingLogger.go
+++ b/mocks/github.com/int128/kubelogin/pkg/testing/logger_mock/mock_testingLogger.go
@@ -1,76 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package logger_mock
-
-import mock "github.com/stretchr/testify/mock"
-
-// MocktestingLogger is an autogenerated mock type for the testingLogger type
-type MocktestingLogger struct {
-	mock.Mock
-}
-
-type MocktestingLogger_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MocktestingLogger) EXPECT() *MocktestingLogger_Expecter {
-	return &MocktestingLogger_Expecter{mock: &_m.Mock}
-}
-
-// Logf provides a mock function with given fields: format, v
-func (_m *MocktestingLogger) Logf(format string, v ...interface{}) {
-	var _ca []interface{}
-	_ca = append(_ca, format)
-	_ca = append(_ca, v...)
-	_m.Called(_ca...)
-}
-
-// MocktestingLogger_Logf_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Logf'
-type MocktestingLogger_Logf_Call struct {
-	*mock.Call
-}
-
-// Logf is a helper method to define mock.On call
-//   - format string
-//   - v ...interface{}
-func (_e *MocktestingLogger_Expecter) Logf(format interface{}, v ...interface{}) *MocktestingLogger_Logf_Call {
-	return &MocktestingLogger_Logf_Call{Call: _e.mock.On("Logf",
-		append([]interface{}{format}, v...)...)}
-}
-
-func (_c *MocktestingLogger_Logf_Call) Run(run func(format string, v ...interface{})) *MocktestingLogger_Logf_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		variadicArgs := make([]interface{}, len(args)-1)
-		for i, a := range args[1:] {
-			if a != nil {
-				variadicArgs[i] = a.(interface{})
-			}
-		}
-		run(args[0].(string), variadicArgs...)
-	})
-	return _c
-}
-
-func (_c *MocktestingLogger_Logf_Call) Return() *MocktestingLogger_Logf_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MocktestingLogger_Logf_Call) RunAndReturn(run func(string, ...interface{})) *MocktestingLogger_Logf_Call {
-	_c.Run(run)
-	return _c
-}
-
-// NewMocktestingLogger creates a new instance of MocktestingLogger. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMocktestingLogger(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MocktestingLogger {
-	mock := &MocktestingLogger{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/tlsclientconfig/loader_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/tlsclientconfig/loader_mock/mock_Interface.go
@@ -1,96 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package loader_mock
-
-import (
-	tls "crypto/tls"
-
-	mock "github.com/stretchr/testify/mock"
-
-	tlsclientconfig "github.com/int128/kubelogin/pkg/tlsclientconfig"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Load provides a mock function with given fields: config
-func (_m *MockInterface) Load(config tlsclientconfig.Config) (*tls.Config, error) {
-	ret := _m.Called(config)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Load")
-	}
-
-	var r0 *tls.Config
-	var r1 error
-	if rf, ok := ret.Get(0).(func(tlsclientconfig.Config) (*tls.Config, error)); ok {
-		return rf(config)
-	}
-	if rf, ok := ret.Get(0).(func(tlsclientconfig.Config) *tls.Config); ok {
-		r0 = rf(config)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*tls.Config)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(tlsclientconfig.Config) error); ok {
-		r1 = rf(config)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_Load_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Load'
-type MockInterface_Load_Call struct {
-	*mock.Call
-}
-
-// Load is a helper method to define mock.On call
-//   - config tlsclientconfig.Config
-func (_e *MockInterface_Expecter) Load(config interface{}) *MockInterface_Load_Call {
-	return &MockInterface_Load_Call{Call: _e.mock.On("Load", config)}
-}
-
-func (_c *MockInterface_Load_Call) Run(run func(config tlsclientconfig.Config)) *MockInterface_Load_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(tlsclientconfig.Config))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Load_Call) Return(_a0 *tls.Config, _a1 error) *MockInterface_Load_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_Load_Call) RunAndReturn(run func(tlsclientconfig.Config) (*tls.Config, error)) *MockInterface_Load_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/tokencache/repository_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/tokencache/repository_mock/mock_Interface.go
@@ -1,251 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package repository_mock
-
-import (
-	io "io"
-
-	oidc "github.com/int128/kubelogin/pkg/oidc"
-	mock "github.com/stretchr/testify/mock"
-
-	tokencache "github.com/int128/kubelogin/pkg/tokencache"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// DeleteAll provides a mock function with given fields: config
-func (_m *MockInterface) DeleteAll(config tokencache.Config) error {
-	ret := _m.Called(config)
-
-	if len(ret) == 0 {
-		panic("no return value specified for DeleteAll")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(tokencache.Config) error); ok {
-		r0 = rf(config)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_DeleteAll_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DeleteAll'
-type MockInterface_DeleteAll_Call struct {
-	*mock.Call
-}
-
-// DeleteAll is a helper method to define mock.On call
-//   - config tokencache.Config
-func (_e *MockInterface_Expecter) DeleteAll(config interface{}) *MockInterface_DeleteAll_Call {
-	return &MockInterface_DeleteAll_Call{Call: _e.mock.On("DeleteAll", config)}
-}
-
-func (_c *MockInterface_DeleteAll_Call) Run(run func(config tokencache.Config)) *MockInterface_DeleteAll_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(tokencache.Config))
-	})
-	return _c
-}
-
-func (_c *MockInterface_DeleteAll_Call) Return(_a0 error) *MockInterface_DeleteAll_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_DeleteAll_Call) RunAndReturn(run func(tokencache.Config) error) *MockInterface_DeleteAll_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// FindByKey provides a mock function with given fields: config, key
-func (_m *MockInterface) FindByKey(config tokencache.Config, key tokencache.Key) (*oidc.TokenSet, error) {
-	ret := _m.Called(config, key)
-
-	if len(ret) == 0 {
-		panic("no return value specified for FindByKey")
-	}
-
-	var r0 *oidc.TokenSet
-	var r1 error
-	if rf, ok := ret.Get(0).(func(tokencache.Config, tokencache.Key) (*oidc.TokenSet, error)); ok {
-		return rf(config, key)
-	}
-	if rf, ok := ret.Get(0).(func(tokencache.Config, tokencache.Key) *oidc.TokenSet); ok {
-		r0 = rf(config, key)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*oidc.TokenSet)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(tokencache.Config, tokencache.Key) error); ok {
-		r1 = rf(config, key)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_FindByKey_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'FindByKey'
-type MockInterface_FindByKey_Call struct {
-	*mock.Call
-}
-
-// FindByKey is a helper method to define mock.On call
-//   - config tokencache.Config
-//   - key tokencache.Key
-func (_e *MockInterface_Expecter) FindByKey(config interface{}, key interface{}) *MockInterface_FindByKey_Call {
-	return &MockInterface_FindByKey_Call{Call: _e.mock.On("FindByKey", config, key)}
-}
-
-func (_c *MockInterface_FindByKey_Call) Run(run func(config tokencache.Config, key tokencache.Key)) *MockInterface_FindByKey_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(tokencache.Config), args[1].(tokencache.Key))
-	})
-	return _c
-}
-
-func (_c *MockInterface_FindByKey_Call) Return(_a0 *oidc.TokenSet, _a1 error) *MockInterface_FindByKey_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_FindByKey_Call) RunAndReturn(run func(tokencache.Config, tokencache.Key) (*oidc.TokenSet, error)) *MockInterface_FindByKey_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Lock provides a mock function with given fields: config, key
-func (_m *MockInterface) Lock(config tokencache.Config, key tokencache.Key) (io.Closer, error) {
-	ret := _m.Called(config, key)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Lock")
-	}
-
-	var r0 io.Closer
-	var r1 error
-	if rf, ok := ret.Get(0).(func(tokencache.Config, tokencache.Key) (io.Closer, error)); ok {
-		return rf(config, key)
-	}
-	if rf, ok := ret.Get(0).(func(tokencache.Config, tokencache.Key) io.Closer); ok {
-		r0 = rf(config, key)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(io.Closer)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(tokencache.Config, tokencache.Key) error); ok {
-		r1 = rf(config, key)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_Lock_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Lock'
-type MockInterface_Lock_Call struct {
-	*mock.Call
-}
-
-// Lock is a helper method to define mock.On call
-//   - config tokencache.Config
-//   - key tokencache.Key
-func (_e *MockInterface_Expecter) Lock(config interface{}, key interface{}) *MockInterface_Lock_Call {
-	return &MockInterface_Lock_Call{Call: _e.mock.On("Lock", config, key)}
-}
-
-func (_c *MockInterface_Lock_Call) Run(run func(config tokencache.Config, key tokencache.Key)) *MockInterface_Lock_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(tokencache.Config), args[1].(tokencache.Key))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Lock_Call) Return(_a0 io.Closer, _a1 error) *MockInterface_Lock_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_Lock_Call) RunAndReturn(run func(tokencache.Config, tokencache.Key) (io.Closer, error)) *MockInterface_Lock_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Save provides a mock function with given fields: config, key, tokenSet
-func (_m *MockInterface) Save(config tokencache.Config, key tokencache.Key, tokenSet oidc.TokenSet) error {
-	ret := _m.Called(config, key, tokenSet)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Save")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(tokencache.Config, tokencache.Key, oidc.TokenSet) error); ok {
-		r0 = rf(config, key, tokenSet)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_Save_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Save'
-type MockInterface_Save_Call struct {
-	*mock.Call
-}
-
-// Save is a helper method to define mock.On call
-//   - config tokencache.Config
-//   - key tokencache.Key
-//   - tokenSet oidc.TokenSet
-func (_e *MockInterface_Expecter) Save(config interface{}, key interface{}, tokenSet interface{}) *MockInterface_Save_Call {
-	return &MockInterface_Save_Call{Call: _e.mock.On("Save", config, key, tokenSet)}
-}
-
-func (_c *MockInterface_Save_Call) Run(run func(config tokencache.Config, key tokencache.Key, tokenSet oidc.TokenSet)) *MockInterface_Save_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(tokencache.Config), args[1].(tokencache.Key), args[2].(oidc.TokenSet))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Save_Call) Return(_a0 error) *MockInterface_Save_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_Save_Call) RunAndReturn(run func(tokencache.Config, tokencache.Key, oidc.TokenSet) error) *MockInterface_Save_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/usecases/authentication_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/usecases/authentication_mock/mock_Interface.go
@@ -1,97 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package authentication_mock
-
-import (
-	context "context"
-
-	authentication "github.com/int128/kubelogin/pkg/usecases/authentication"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Do provides a mock function with given fields: ctx, in
-func (_m *MockInterface) Do(ctx context.Context, in authentication.Input) (*authentication.Output, error) {
-	ret := _m.Called(ctx, in)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Do")
-	}
-
-	var r0 *authentication.Output
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, authentication.Input) (*authentication.Output, error)); ok {
-		return rf(ctx, in)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, authentication.Input) *authentication.Output); ok {
-		r0 = rf(ctx, in)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*authentication.Output)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, authentication.Input) error); ok {
-		r1 = rf(ctx, in)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockInterface_Do_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Do'
-type MockInterface_Do_Call struct {
-	*mock.Call
-}
-
-// Do is a helper method to define mock.On call
-//   - ctx context.Context
-//   - in authentication.Input
-func (_e *MockInterface_Expecter) Do(ctx interface{}, in interface{}) *MockInterface_Do_Call {
-	return &MockInterface_Do_Call{Call: _e.mock.On("Do", ctx, in)}
-}
-
-func (_c *MockInterface_Do_Call) Run(run func(ctx context.Context, in authentication.Input)) *MockInterface_Do_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(authentication.Input))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Do_Call) Return(_a0 *authentication.Output, _a1 error) *MockInterface_Do_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockInterface_Do_Call) RunAndReturn(run func(context.Context, authentication.Input) (*authentication.Output, error)) *MockInterface_Do_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/usecases/clean_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/usecases/clean_mock/mock_Interface.go
@@ -1,85 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package clean_mock
-
-import (
-	context "context"
-
-	clean "github.com/int128/kubelogin/pkg/usecases/clean"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Do provides a mock function with given fields: ctx, in
-func (_m *MockInterface) Do(ctx context.Context, in clean.Input) error {
-	ret := _m.Called(ctx, in)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Do")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, clean.Input) error); ok {
-		r0 = rf(ctx, in)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_Do_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Do'
-type MockInterface_Do_Call struct {
-	*mock.Call
-}
-
-// Do is a helper method to define mock.On call
-//   - ctx context.Context
-//   - in clean.Input
-func (_e *MockInterface_Expecter) Do(ctx interface{}, in interface{}) *MockInterface_Do_Call {
-	return &MockInterface_Do_Call{Call: _e.mock.On("Do", ctx, in)}
-}
-
-func (_c *MockInterface_Do_Call) Run(run func(ctx context.Context, in clean.Input)) *MockInterface_Do_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(clean.Input))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Do_Call) Return(_a0 error) *MockInterface_Do_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_Do_Call) RunAndReturn(run func(context.Context, clean.Input) error) *MockInterface_Do_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/usecases/credentialplugin_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/usecases/credentialplugin_mock/mock_Interface.go
@@ -1,84 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package credentialplugin_mock
-
-import (
-	context "context"
-
-	credentialplugin "github.com/int128/kubelogin/pkg/usecases/credentialplugin"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Do provides a mock function with given fields: ctx, in
-func (_m *MockInterface) Do(ctx context.Context, in credentialplugin.Input) error {
-	ret := _m.Called(ctx, in)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Do")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, credentialplugin.Input) error); ok {
-		r0 = rf(ctx, in)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_Do_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Do'
-type MockInterface_Do_Call struct {
-	*mock.Call
-}
-
-// Do is a helper method to define mock.On call
-//   - ctx context.Context
-//   - in credentialplugin.Input
-func (_e *MockInterface_Expecter) Do(ctx interface{}, in interface{}) *MockInterface_Do_Call {
-	return &MockInterface_Do_Call{Call: _e.mock.On("Do", ctx, in)}
-}
-
-func (_c *MockInterface_Do_Call) Run(run func(ctx context.Context, in credentialplugin.Input)) *MockInterface_Do_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(credentialplugin.Input))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Do_Call) Return(_a0 error) *MockInterface_Do_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_Do_Call) RunAndReturn(run func(context.Context, credentialplugin.Input) error) *MockInterface_Do_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/usecases/setup_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/usecases/setup_mock/mock_Interface.go
@@ -1,116 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package setup_mock
-
-import (
-	context "context"
-
-	setup "github.com/int128/kubelogin/pkg/usecases/setup"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// DoStage1 provides a mock function with no fields
-func (_m *MockInterface) DoStage1() {
-	_m.Called()
-}
-
-// MockInterface_DoStage1_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DoStage1'
-type MockInterface_DoStage1_Call struct {
-	*mock.Call
-}
-
-// DoStage1 is a helper method to define mock.On call
-func (_e *MockInterface_Expecter) DoStage1() *MockInterface_DoStage1_Call {
-	return &MockInterface_DoStage1_Call{Call: _e.mock.On("DoStage1")}
-}
-
-func (_c *MockInterface_DoStage1_Call) Run(run func()) *MockInterface_DoStage1_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockInterface_DoStage1_Call) Return() *MockInterface_DoStage1_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockInterface_DoStage1_Call) RunAndReturn(run func()) *MockInterface_DoStage1_Call {
-	_c.Run(run)
-	return _c
-}
-
-// DoStage2 provides a mock function with given fields: ctx, in
-func (_m *MockInterface) DoStage2(ctx context.Context, in setup.Stage2Input) error {
-	ret := _m.Called(ctx, in)
-
-	if len(ret) == 0 {
-		panic("no return value specified for DoStage2")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, setup.Stage2Input) error); ok {
-		r0 = rf(ctx, in)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_DoStage2_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DoStage2'
-type MockInterface_DoStage2_Call struct {
-	*mock.Call
-}
-
-// DoStage2 is a helper method to define mock.On call
-//   - ctx context.Context
-//   - in setup.Stage2Input
-func (_e *MockInterface_Expecter) DoStage2(ctx interface{}, in interface{}) *MockInterface_DoStage2_Call {
-	return &MockInterface_DoStage2_Call{Call: _e.mock.On("DoStage2", ctx, in)}
-}
-
-func (_c *MockInterface_DoStage2_Call) Run(run func(ctx context.Context, in setup.Stage2Input)) *MockInterface_DoStage2_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(setup.Stage2Input))
-	})
-	return _c
-}
-
-func (_c *MockInterface_DoStage2_Call) Return(_a0 error) *MockInterface_DoStage2_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_DoStage2_Call) RunAndReturn(run func(context.Context, setup.Stage2Input) error) *MockInterface_DoStage2_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/github.com/int128/kubelogin/pkg/usecases/standalone_mock/mock_Interface.go
+++ b/mocks/github.com/int128/kubelogin/pkg/usecases/standalone_mock/mock_Interface.go
@@ -1,84 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package standalone_mock
-
-import (
-	context "context"
-
-	standalone "github.com/int128/kubelogin/pkg/usecases/standalone"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockInterface is an autogenerated mock type for the Interface type
-type MockInterface struct {
-	mock.Mock
-}
-
-type MockInterface_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockInterface) EXPECT() *MockInterface_Expecter {
-	return &MockInterface_Expecter{mock: &_m.Mock}
-}
-
-// Do provides a mock function with given fields: ctx, in
-func (_m *MockInterface) Do(ctx context.Context, in standalone.Input) error {
-	ret := _m.Called(ctx, in)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Do")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, standalone.Input) error); ok {
-		r0 = rf(ctx, in)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockInterface_Do_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Do'
-type MockInterface_Do_Call struct {
-	*mock.Call
-}
-
-// Do is a helper method to define mock.On call
-//   - ctx context.Context
-//   - in standalone.Input
-func (_e *MockInterface_Expecter) Do(ctx interface{}, in interface{}) *MockInterface_Do_Call {
-	return &MockInterface_Do_Call{Call: _e.mock.On("Do", ctx, in)}
-}
-
-func (_c *MockInterface_Do_Call) Run(run func(ctx context.Context, in standalone.Input)) *MockInterface_Do_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(standalone.Input))
-	})
-	return _c
-}
-
-func (_c *MockInterface_Do_Call) Return(_a0 error) *MockInterface_Do_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockInterface_Do_Call) RunAndReturn(run func(context.Context, standalone.Input) error) *MockInterface_Do_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockInterface creates a new instance of MockInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockInterface(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockInterface {
-	mock := &MockInterface{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/mocks/io_mock/mock_Closer.go
+++ b/mocks/io_mock/mock_Closer.go
@@ -1,77 +0,0 @@
-// Code generated by mockery v2.51.0. DO NOT EDIT.
-
-package io_mock
-
-import mock "github.com/stretchr/testify/mock"
-
-// MockCloser is an autogenerated mock type for the Closer type
-type MockCloser struct {
-	mock.Mock
-}
-
-type MockCloser_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockCloser) EXPECT() *MockCloser_Expecter {
-	return &MockCloser_Expecter{mock: &_m.Mock}
-}
-
-// Close provides a mock function with no fields
-func (_m *MockCloser) Close() error {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for Close")
-	}
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func() error); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// MockCloser_Close_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Close'
-type MockCloser_Close_Call struct {
-	*mock.Call
-}
-
-// Close is a helper method to define mock.On call
-func (_e *MockCloser_Expecter) Close() *MockCloser_Close_Call {
-	return &MockCloser_Close_Call{Call: _e.mock.On("Close")}
-}
-
-func (_c *MockCloser_Close_Call) Run(run func()) *MockCloser_Close_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
-	return _c
-}
-
-func (_c *MockCloser_Close_Call) Return(_a0 error) *MockCloser_Close_Call {
-	_c.Call.Return(_a0)
-	return _c
-}
-
-func (_c *MockCloser_Close_Call) RunAndReturn(run func() error) *MockCloser_Close_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockCloser creates a new instance of MockCloser. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockCloser(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockCloser {
-	mock := &MockCloser{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
--- a/oidc.go
+++ b/oidc.go
@@ -0,0 +1,130 @@
+package main
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/binary"
+	"fmt"
+	"log"
+
+	"github.com/coreos/go-oidc"
+	"golang.org/x/oauth2"
+)
+
+// OIDCToken is a token set
+type OIDCToken struct {
+	IDToken      string
+	RefreshToken string
+}
+
+// GetOIDCToken returns a token retrieved by auth code grant
+func GetOIDCToken(issuer string, clientID string, clientSecret string) (*OIDCToken, error) {
+	port := 8000
+	provider, err := oidc.NewProvider(oauth2.NoContext, issuer)
+	if err != nil {
+		return nil, err
+	}
+
+	state, err := generateState()
+	if err != nil {
+		return nil, err
+	}
+
+	webBrowserConfig := oauth2.Config{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		RedirectURL:  fmt.Sprintf("http://localhost:%d/", port),
+		Endpoint:     provider.Endpoint(),
+		Scopes:       []string{oidc.ScopeOpenID, "email"},
+	}
+
+	cliConfig := oauth2.Config{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		RedirectURL:  "urn:ietf:wg:oauth:2.0:oob",
+		Endpoint:     provider.Endpoint(),
+		Scopes:       []string{oidc.ScopeOpenID, "email"},
+	}
+
+	showInstructionToGetToken(webBrowserConfig.RedirectURL, cliConfig.AuthCodeURL(state))
+	token, err := getTokenByWebBrowserOrCLI(webBrowserConfig, cliConfig, state)
+	if err != nil {
+		return nil, err
+	}
+
+	rawIDToken, ok := token.Extra("id_token").(string)
+	if !ok {
+		return nil, fmt.Errorf("id_token is missing in the token response: %s", token)
+	}
+
+	log.Printf("Verifying ID token...")
+	verifier := provider.Verifier(&oidc.Config{ClientID: clientID})
+	idToken, err := verifier.Verify(oauth2.NoContext, rawIDToken)
+	if err != nil {
+		return nil, err
+	}
+
+	idTokenClaim := struct {
+		Email string `json:"email"`
+	}{}
+	if err := idToken.Claims(&idTokenClaim); err != nil {
+		return nil, err
+	}
+
+	log.Printf("You are logged in as %s (%s)", idTokenClaim.Email, idToken.Subject)
+	return &OIDCToken{
+		IDToken:      rawIDToken,
+		RefreshToken: token.RefreshToken,
+	}, nil
+}
+
+func getTokenByWebBrowserOrCLI(webBrowserConfig oauth2.Config, cliConfig oauth2.Config, state string) (*oauth2.Token, error) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	webBrowserAuthCodeCh := make(chan string)
+	cliAuthCodeCh := make(chan string)
+	errCh := make(chan error)
+
+	go ReceiveAuthCodeFromWebBrowser(ctx, webBrowserConfig.AuthCodeURL(state), state, webBrowserAuthCodeCh, errCh)
+	go ReceiveAuthCodeFromCLI(ctx, cliAuthCodeCh, errCh)
+
+	select {
+	case err := <-errCh:
+		return nil, err
+
+	case authCode := <-webBrowserAuthCodeCh:
+		log.Printf("Exchanging code and token...")
+		return webBrowserConfig.Exchange(ctx, authCode)
+
+	case authCode := <-cliAuthCodeCh:
+		log.Printf("Exchanging code and token...")
+		return cliConfig.Exchange(ctx, authCode)
+	}
+}
+
+func showInstructionToGetToken(localhostURL string, cliAuthCodeURL string) {
+	log.Printf("Starting OpenID Connect authentication:")
+	fmt.Printf(`
+## Automatic (recommended)
+
+Open the following URL in the web browser:
+
+%s
+
+## Manual
+
+If you cannot access to localhost, instead open the following URL:
+
+%s
+
+Enter the code: `, localhostURL, cliAuthCodeURL)
+}
+
+func generateState() (string, error) {
+	var n uint64
+	if err := binary.Read(rand.Reader, binary.LittleEndian, &n); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%x", n), nil
+}
--- a/oidc_cli.go
+++ b/oidc_cli.go
@@ -0,0 +1,16 @@
+package main
+
+import (
+	"context"
+	"fmt"
+)
+
+// ReceiveAuthCodeFromCLI receives an auth code from CLI
+func ReceiveAuthCodeFromCLI(ctx context.Context, authCodeCh chan<- string, errCh chan<- error) {
+	var authCode string
+	if _, err := fmt.Scanln(&authCode); err != nil {
+		errCh <- err
+	} else {
+		authCodeCh <- authCode
+	}
+}
--- a/oidc_http.go
+++ b/oidc_http.go
@@ -0,0 +1,70 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net/http"
+)
+
+// ReceiveAuthCodeFromWebBrowser starts a server and receives an auth code
+func ReceiveAuthCodeFromWebBrowser(ctx context.Context, authCodeURL string, state string, authCodeCh chan<- string, errCh chan<- error) {
+	server := http.Server{
+		Addr: ":8000",
+		Handler: &AuthCodeGrantHandler{
+			AuthCodeURL: authCodeURL,
+			State:       state,
+			Resolve:     func(authCode string) { authCodeCh <- authCode },
+			Reject:      func(err error) { errCh <- err },
+		},
+	}
+
+	go func() {
+		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			errCh <- err
+		}
+	}()
+
+	select {
+	case <-ctx.Done():
+		server.Shutdown(context.Background())
+	}
+}
+
+// AuthCodeGrantHandler handles requests for OIDC auth code grant
+type AuthCodeGrantHandler struct {
+	AuthCodeURL string
+	State       string
+	Resolve     func(string)
+	Reject      func(error)
+}
+
+func (s *AuthCodeGrantHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	log.Printf("%s %s", r.Method, r.RequestURI)
+	switch r.URL.Path {
+	case "/":
+		code := r.URL.Query().Get("code")
+		state := r.URL.Query().Get("state")
+		errorCode := r.URL.Query().Get("error")
+		errorDescription := r.URL.Query().Get("error_description")
+		switch {
+		case code != "" && state == s.State:
+			s.Resolve(code)
+			fmt.Fprintf(w, "Please back to the command line.")
+
+		case code != "" && state != s.State:
+			s.Reject(fmt.Errorf("OIDC state did not match. expected=%s, actual=%s", s.State, state))
+			fmt.Fprintf(w, "Please back to the command line.")
+
+		case errorCode != "":
+			s.Reject(fmt.Errorf("OIDC error: %s %s", errorCode, errorDescription))
+			fmt.Fprintf(w, "Please back to the command line.")
+
+		default:
+			http.Redirect(w, r, s.AuthCodeURL, 302)
+		}
+
+	default:
+		http.Error(w, "Not Found", 404)
+	}
+}
--- a/pkg/cmd/authentication.go
+++ b/pkg/cmd/authentication.go
@@ -1,95 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/int128/kubelogin/pkg/usecases/authentication"
-	"github.com/int128/kubelogin/pkg/usecases/authentication/authcode"
-	"github.com/int128/kubelogin/pkg/usecases/authentication/devicecode"
-	"github.com/int128/kubelogin/pkg/usecases/authentication/ropc"
-	"github.com/spf13/pflag"
-)
-
-const oobRedirectURI = "urn:ietf:wg:oauth:2.0:oob"
-
-type authenticationOptions struct {
-	GrantType                   string
-	ListenAddress               []string
-	AuthenticationTimeoutSec    int
-	SkipOpenBrowser             bool
-	BrowserCommand              string
-	LocalServerCertFile         string
-	LocalServerKeyFile          string
-	OpenURLAfterAuthentication  string
-	RedirectURLHostname         string
-	RedirectURLAuthCodeKeyboard string
-	AuthRequestExtraParams      map[string]string
-	Username                    string
-	Password                    string
-}
-
-var allGrantType = strings.Join([]string{
-	"auto",
-	"authcode",
-	"authcode-keyboard",
-	"password",
-	"device-code",
-}, "|")
-
-func (o *authenticationOptions) addFlags(f *pflag.FlagSet) {
-	f.StringVar(&o.GrantType, "grant-type", "auto", fmt.Sprintf("Authorization grant type to use. One of (%s)", allGrantType))
-	f.StringSliceVar(&o.ListenAddress, "listen-address", defaultListenAddress, "[authcode] Address to bind to the local server. If multiple addresses are set, it will try binding in order")
-	f.BoolVar(&o.SkipOpenBrowser, "skip-open-browser", false, "[authcode] Do not open the browser automatically")
-	f.StringVar(&o.BrowserCommand, "browser-command", "", "[authcode] Command to open the browser")
-	f.IntVar(&o.AuthenticationTimeoutSec, "authentication-timeout-sec", defaultAuthenticationTimeoutSec, "[authcode] Timeout of authentication in seconds")
-	f.StringVar(&o.LocalServerCertFile, "local-server-cert", "", "[authcode] Certificate path for the local server")
-	f.StringVar(&o.LocalServerKeyFile, "local-server-key", "", "[authcode] Certificate key path for the local server")
-	f.StringVar(&o.OpenURLAfterAuthentication, "open-url-after-authentication", "", "[authcode] If set, open the URL in the browser after authentication")
-	f.StringVar(&o.RedirectURLHostname, "oidc-redirect-url-hostname", "localhost", "[authcode] Hostname of the redirect URL")
-	f.StringVar(&o.RedirectURLAuthCodeKeyboard, "oidc-redirect-url-authcode-keyboard", oobRedirectURI, "[authcode-keyboard] Redirect URL")
-	f.StringToStringVar(&o.AuthRequestExtraParams, "oidc-auth-request-extra-params", nil, "[authcode, authcode-keyboard] Extra query parameters to send with an authentication request")
-	f.StringVar(&o.Username, "username", "", "[password] Username for resource owner password credentials grant")
-	f.StringVar(&o.Password, "password", "", "[password] Password for resource owner password credentials grant")
-}
-
-func (o *authenticationOptions) expandHomedir() {
-	o.LocalServerCertFile = expandHomedir(o.LocalServerCertFile)
-	o.LocalServerKeyFile = expandHomedir(o.LocalServerKeyFile)
-}
-
-func (o *authenticationOptions) grantOptionSet() (s authentication.GrantOptionSet, err error) {
-	switch {
-	case o.GrantType == "authcode" || (o.GrantType == "auto" && o.Username == ""):
-		s.AuthCodeBrowserOption = &authcode.BrowserOption{
-			BindAddress:                o.ListenAddress,
-			SkipOpenBrowser:            o.SkipOpenBrowser,
-			BrowserCommand:             o.BrowserCommand,
-			AuthenticationTimeout:      time.Duration(o.AuthenticationTimeoutSec) * time.Second,
-			LocalServerCertFile:        o.LocalServerCertFile,
-			LocalServerKeyFile:         o.LocalServerKeyFile,
-			OpenURLAfterAuthentication: o.OpenURLAfterAuthentication,
-			RedirectURLHostname:        o.RedirectURLHostname,
-			AuthRequestExtraParams:     o.AuthRequestExtraParams,
-		}
-	case o.GrantType == "authcode-keyboard":
-		s.AuthCodeKeyboardOption = &authcode.KeyboardOption{
-			AuthRequestExtraParams: o.AuthRequestExtraParams,
-			RedirectURL:            o.RedirectURLAuthCodeKeyboard,
-		}
-	case o.GrantType == "password" || (o.GrantType == "auto" && o.Username != ""):
-		s.ROPCOption = &ropc.Option{
-			Username: o.Username,
-			Password: o.Password,
-		}
-	case o.GrantType == "device-code":
-		s.DeviceCodeOption = &devicecode.Option{
-			SkipOpenBrowser: o.SkipOpenBrowser,
-			BrowserCommand:  o.BrowserCommand,
-		}
-	default:
-		err = fmt.Errorf("grant-type must be one of (%s)", allGrantType)
-	}
-	return
-}
--- a/pkg/cmd/authentication_test.go
+++ b/pkg/cmd/authentication_test.go
@@ -1,128 +0,0 @@
-package cmd
-
-import (
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/int128/kubelogin/pkg/usecases/authentication"
-	"github.com/int128/kubelogin/pkg/usecases/authentication/authcode"
-	"github.com/int128/kubelogin/pkg/usecases/authentication/ropc"
-	"github.com/spf13/pflag"
-)
-
-func Test_authenticationOptions_grantOptionSet(t *testing.T) {
-	tests := map[string]struct {
-		args []string
-		want authentication.GrantOptionSet
-	}{
-		"NoFlag": {
-			want: authentication.GrantOptionSet{
-				AuthCodeBrowserOption: &authcode.BrowserOption{
-					BindAddress:           defaultListenAddress,
-					AuthenticationTimeout: defaultAuthenticationTimeoutSec * time.Second,
-					RedirectURLHostname:   "localhost",
-				},
-			},
-		},
-		"FullOptions": {
-			args: []string{
-				"--grant-type", "authcode",
-				"--listen-address", "127.0.0.1:10080",
-				"--listen-address", "127.0.0.1:20080",
-				"--skip-open-browser",
-				"--browser-command", "firefox",
-				"--authentication-timeout-sec", "10",
-				"--local-server-cert", "/path/to/local-server-cert",
-				"--local-server-key", "/path/to/local-server-key",
-				"--open-url-after-authentication", "https://example.com/success.html",
-				"--oidc-redirect-url-hostname", "example",
-				"--oidc-auth-request-extra-params", "ttl=86400",
-				"--oidc-auth-request-extra-params", "reauth=true",
-				"--username", "USER",
-				"--password", "PASS",
-			},
-			want: authentication.GrantOptionSet{
-				AuthCodeBrowserOption: &authcode.BrowserOption{
-					BindAddress:                []string{"127.0.0.1:10080", "127.0.0.1:20080"},
-					SkipOpenBrowser:            true,
-					BrowserCommand:             "firefox",
-					AuthenticationTimeout:      10 * time.Second,
-					LocalServerCertFile:        "/path/to/local-server-cert",
-					LocalServerKeyFile:         "/path/to/local-server-key",
-					OpenURLAfterAuthentication: "https://example.com/success.html",
-					RedirectURLHostname:        "example",
-					AuthRequestExtraParams:     map[string]string{"ttl": "86400", "reauth": "true"},
-				},
-			},
-		},
-		"GrantType=authcode-keyboard": {
-			args: []string{
-				"--grant-type", "authcode-keyboard",
-			},
-			want: authentication.GrantOptionSet{
-				AuthCodeKeyboardOption: &authcode.KeyboardOption{
-					RedirectURL: oobRedirectURI,
-				},
-			},
-		},
-		"GrantType=authcode-keyboard with full options": {
-			args: []string{
-				"--grant-type", "authcode-keyboard",
-				"--oidc-redirect-url-authcode-keyboard", "http://localhost",
-			},
-			want: authentication.GrantOptionSet{
-				AuthCodeKeyboardOption: &authcode.KeyboardOption{
-					RedirectURL: "http://localhost",
-				},
-			},
-		},
-		"GrantType=password": {
-			args: []string{
-				"--grant-type", "password",
-				"--listen-address", "127.0.0.1:10080",
-				"--listen-address", "127.0.0.1:20080",
-				"--username", "USER",
-				"--password", "PASS",
-			},
-			want: authentication.GrantOptionSet{
-				ROPCOption: &ropc.Option{
-					Username: "USER",
-					Password: "PASS",
-				},
-			},
-		},
-		"GrantType=auto": {
-			args: []string{
-				"--listen-address", "127.0.0.1:10080",
-				"--listen-address", "127.0.0.1:20080",
-				"--username", "USER",
-				"--password", "PASS",
-			},
-			want: authentication.GrantOptionSet{
-				ROPCOption: &ropc.Option{
-					Username: "USER",
-					Password: "PASS",
-				},
-			},
-		},
-	}
-
-	for name, c := range tests {
-		t.Run(name, func(t *testing.T) {
-			var o authenticationOptions
-			f := pflag.NewFlagSet("", pflag.ContinueOnError)
-			o.addFlags(f)
-			if err := f.Parse(c.args); err != nil {
-				t.Fatalf("Parse error: %s", err)
-			}
-			got, err := o.grantOptionSet()
-			if err != nil {
-				t.Fatalf("grantOptionSet error: %s", err)
-			}
-			if diff := cmp.Diff(c.want, got); diff != "" {
-				t.Errorf("mismatch (-want +got):\n%s", diff)
-			}
-		})
-	}
-}
--- a/pkg/cmd/clean.go
+++ b/pkg/cmd/clean.go
@@ -1,56 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/int128/kubelogin/pkg/usecases/clean"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-)
-
-type cleanOptions struct {
-	tokenCacheOptions tokenCacheOptions
-}
-
-func (o *cleanOptions) addFlags(f *pflag.FlagSet) {
-	o.tokenCacheOptions.addFlags(f)
-}
-
-func (o *cleanOptions) expandHomedir() {
-	o.tokenCacheOptions.expandHomedir()
-}
-
-type Clean struct {
-	Clean clean.Interface
-}
-
-func (cmd *Clean) New() *cobra.Command {
-	var o cleanOptions
-	c := &cobra.Command{
-		Use:   "clean [flags]",
-		Short: "Delete the token cache",
-		Long: `Delete the token cache.
-
-This deletes both the OS keyring and the directory by default.
-If you encounter an error of keyring, try --token-cache-storage=disk.
-`,
-		Args: cobra.NoArgs,
-		RunE: func(c *cobra.Command, _ []string) error {
-			o.expandHomedir()
-			tokenCacheConfig, err := o.tokenCacheOptions.tokenCacheConfig()
-			if err != nil {
-				return fmt.Errorf("clean: %w", err)
-			}
-			in := clean.Input{
-				TokenCacheConfig: tokenCacheConfig,
-			}
-			if err := cmd.Clean.Do(c.Context(), in); err != nil {
-				return fmt.Errorf("clean: %w", err)
-			}
-			return nil
-		},
-	}
-	c.Flags().SortFlags = false
-	o.addFlags(c.Flags())
-	return c
-}
--- a/pkg/cmd/cmd.go
+++ b/pkg/cmd/cmd.go
@@ -1,73 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"runtime"
-
-	"github.com/google/wire"
-	"github.com/int128/kubelogin/pkg/infrastructure/logger"
-	"github.com/spf13/cobra"
-)
-
-// Set provides an implementation and interface for Cmd.
-var Set = wire.NewSet(
-	wire.Struct(new(Cmd), "*"),
-	wire.Bind(new(Interface), new(*Cmd)),
-	wire.Struct(new(Root), "*"),
-	wire.Struct(new(GetToken), "*"),
-	wire.Struct(new(Setup), "*"),
-	wire.Struct(new(Clean), "*"),
-)
-
-type Interface interface {
-	Run(ctx context.Context, args []string, version string) int
-}
-
-var defaultListenAddress = []string{"127.0.0.1:8000", "127.0.0.1:18000"}
-
-const defaultAuthenticationTimeoutSec = 180
-
-// Cmd provides interaction with command line interface (CLI).
-type Cmd struct {
-	Root     *Root
-	GetToken *GetToken
-	Setup    *Setup
-	Clean    *Clean
-	Logger   logger.Interface
-}
-
-// Run parses the command line arguments and executes the specified use-case.
-// It returns an exit code, that is 0 on success or 1 on error.
-func (cmd *Cmd) Run(ctx context.Context, args []string, version string) int {
-	rootCmd := cmd.Root.New()
-	rootCmd.Version = version
-	rootCmd.SilenceUsage = true
-	rootCmd.SilenceErrors = true
-
-	getTokenCmd := cmd.GetToken.New()
-	rootCmd.AddCommand(getTokenCmd)
-
-	setupCmd := cmd.Setup.New()
-	rootCmd.AddCommand(setupCmd)
-
-	cleanCmd := cmd.Clean.New()
-	rootCmd.AddCommand(cleanCmd)
-
-	versionCmd := &cobra.Command{
-		Use:   "version",
-		Short: "Print the version information",
-		Args:  cobra.NoArgs,
-		Run: func(*cobra.Command, []string) {
-			cmd.Logger.Printf("kubelogin version %s (%s %s_%s)", version, runtime.Version(), runtime.GOOS, runtime.GOARCH)
-		},
-	}
-	rootCmd.AddCommand(versionCmd)
-
-	rootCmd.SetArgs(args[1:])
-	if err := rootCmd.ExecuteContext(ctx); err != nil {
-		cmd.Logger.Printf("error: %s", err)
-		cmd.Logger.V(1).Infof("stacktrace: %+v", err)
-		return 1
-	}
-	return 0
-}
--- a/pkg/cmd/cmd_test.go
+++ b/pkg/cmd/cmd_test.go
@@ -1,285 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/int128/kubelogin/mocks/github.com/int128/kubelogin/pkg/usecases/credentialplugin_mock"
-	"github.com/int128/kubelogin/mocks/github.com/int128/kubelogin/pkg/usecases/standalone_mock"
-	"github.com/int128/kubelogin/pkg/oidc"
-	"github.com/int128/kubelogin/pkg/testing/logger"
-	"github.com/int128/kubelogin/pkg/tlsclientconfig"
-	"github.com/int128/kubelogin/pkg/tokencache"
-	"github.com/int128/kubelogin/pkg/usecases/authentication"
-	"github.com/int128/kubelogin/pkg/usecases/authentication/authcode"
-	"github.com/int128/kubelogin/pkg/usecases/credentialplugin"
-	"github.com/int128/kubelogin/pkg/usecases/standalone"
-)
-
-func TestCmd_Run(t *testing.T) {
-	const executable = "kubelogin"
-	const version = "HEAD"
-
-	t.Run("root", func(t *testing.T) {
-		tests := map[string]struct {
-			args []string
-			in   standalone.Input
-		}{
-			"Defaults": {
-				args: []string{executable},
-				in: standalone.Input{
-					GrantOptionSet: authentication.GrantOptionSet{
-						AuthCodeBrowserOption: &authcode.BrowserOption{
-							BindAddress:           defaultListenAddress,
-							AuthenticationTimeout: defaultAuthenticationTimeoutSec * time.Second,
-							RedirectURLHostname:   "localhost",
-						},
-					},
-				},
-			},
-			"FullOptions": {
-				args: []string{executable,
-					"--kubeconfig", "/path/to/kubeconfig",
-					"--context", "hello.k8s.local",
-					"--user", "google",
-					"-v1",
-				},
-				in: standalone.Input{
-					KubeconfigFilename: "/path/to/kubeconfig",
-					KubeconfigContext:  "hello.k8s.local",
-					KubeconfigUser:     "google",
-					GrantOptionSet: authentication.GrantOptionSet{
-						AuthCodeBrowserOption: &authcode.BrowserOption{
-							BindAddress:           defaultListenAddress,
-							AuthenticationTimeout: defaultAuthenticationTimeoutSec * time.Second,
-							RedirectURLHostname:   "localhost",
-						},
-					},
-				},
-			},
-		}
-		for name, c := range tests {
-			t.Run(name, func(t *testing.T) {
-				ctx := context.TODO()
-				mockStandalone := standalone_mock.NewMockInterface(t)
-				mockStandalone.EXPECT().
-					Do(ctx, c.in).
-					Return(nil)
-				cmd := Cmd{
-					Root: &Root{
-						Standalone: mockStandalone,
-						Logger:     logger.New(t),
-					},
-					Logger: logger.New(t),
-				}
-				exitCode := cmd.Run(ctx, c.args, version)
-				if exitCode != 0 {
-					t.Errorf("exitCode wants 0 but %d", exitCode)
-				}
-			})
-		}
-
-		t.Run("TooManyArgs", func(t *testing.T) {
-			cmd := Cmd{
-				Root: &Root{
-					Standalone: standalone_mock.NewMockInterface(t),
-					Logger:     logger.New(t),
-				},
-				Logger: logger.New(t),
-			}
-			exitCode := cmd.Run(context.TODO(), []string{executable, "some"}, version)
-			if exitCode != 1 {
-				t.Errorf("exitCode wants 1 but %d", exitCode)
-			}
-		})
-	})
-
-	t.Run("get-token", func(t *testing.T) {
-		userHomeDir, err := os.UserHomeDir()
-		if err != nil {
-			t.Fatalf("os.UserHomeDir error: %s", err)
-		}
-
-		tests := map[string]struct {
-			args []string
-			in   credentialplugin.Input
-		}{
-			"Defaults": {
-				args: []string{executable,
-					"get-token",
-					"--oidc-issuer-url", "https://issuer.example.com",
-					"--oidc-client-id", "YOUR_CLIENT_ID",
-				},
-				in: credentialplugin.Input{
-					Provider: oidc.Provider{
-						IssuerURL: "https://issuer.example.com",
-						ClientID:  "YOUR_CLIENT_ID",
-					},
-					TokenCacheConfig: tokencache.Config{
-						Directory: filepath.Join(userHomeDir, ".kube/cache/oidc-login"),
-						Storage:   tokencache.StorageAuto,
-					},
-					GrantOptionSet: authentication.GrantOptionSet{
-						AuthCodeBrowserOption: &authcode.BrowserOption{
-							BindAddress:           defaultListenAddress,
-							AuthenticationTimeout: defaultAuthenticationTimeoutSec * time.Second,
-							RedirectURLHostname:   "localhost",
-						},
-					},
-				},
-			},
-			"FullOptions": {
-				args: []string{executable,
-					"get-token",
-					"--oidc-issuer-url", "https://issuer.example.com",
-					"--oidc-client-id", "YOUR_CLIENT_ID",
-					"--oidc-client-secret", "YOUR_CLIENT_SECRET",
-					"--oidc-extra-scope", "email",
-					"--oidc-extra-scope", "profile",
-					"--token-cache-storage", "disk",
-					"-v1",
-				},
-				in: credentialplugin.Input{
-					Provider: oidc.Provider{
-						IssuerURL:    "https://issuer.example.com",
-						ClientID:     "YOUR_CLIENT_ID",
-						ClientSecret: "YOUR_CLIENT_SECRET",
-						ExtraScopes:  []string{"email", "profile"},
-					},
-					TokenCacheConfig: tokencache.Config{
-						Directory: filepath.Join(userHomeDir, ".kube/cache/oidc-login"),
-						Storage:   tokencache.StorageDisk,
-					},
-					GrantOptionSet: authentication.GrantOptionSet{
-						AuthCodeBrowserOption: &authcode.BrowserOption{
-							BindAddress:           defaultListenAddress,
-							AuthenticationTimeout: defaultAuthenticationTimeoutSec * time.Second,
-							RedirectURLHostname:   "localhost",
-						},
-					},
-				},
-			},
-			"AccessToken": {
-				args: []string{executable,
-					"get-token",
-					"--oidc-issuer-url", "https://issuer.example.com",
-					"--oidc-client-id", "YOUR_CLIENT_ID",
-					"--oidc-use-access-token=true",
-				},
-				in: credentialplugin.Input{
-					Provider: oidc.Provider{
-						IssuerURL:      "https://issuer.example.com",
-						ClientID:       "YOUR_CLIENT_ID",
-						UseAccessToken: true,
-					},
-					TokenCacheConfig: tokencache.Config{
-						Directory: filepath.Join(userHomeDir, ".kube/cache/oidc-login"),
-						Storage:   tokencache.StorageAuto,
-					},
-					GrantOptionSet: authentication.GrantOptionSet{
-						AuthCodeBrowserOption: &authcode.BrowserOption{
-							BindAddress:           defaultListenAddress,
-							AuthenticationTimeout: defaultAuthenticationTimeoutSec * time.Second,
-							RedirectURLHostname:   "localhost",
-						},
-					},
-				},
-			},
-			"HomedirExpansion": {
-				args: []string{executable,
-					"get-token",
-					"--oidc-issuer-url", "https://issuer.example.com",
-					"--oidc-client-id", "YOUR_CLIENT_ID",
-					"--certificate-authority", "~/.kube/ca.crt",
-					"--local-server-cert", "~/.kube/oidc-server.crt",
-					"--local-server-key", "~/.kube/oidc-server.key",
-					"--token-cache-dir", "~/.kube/oidc-cache",
-				},
-				in: credentialplugin.Input{
-					Provider: oidc.Provider{
-						IssuerURL: "https://issuer.example.com",
-						ClientID:  "YOUR_CLIENT_ID",
-					},
-					TokenCacheConfig: tokencache.Config{
-						Directory: filepath.Join(userHomeDir, ".kube/oidc-cache"),
-						Storage:   tokencache.StorageAuto,
-					},
-					GrantOptionSet: authentication.GrantOptionSet{
-						AuthCodeBrowserOption: &authcode.BrowserOption{
-							BindAddress:           defaultListenAddress,
-							AuthenticationTimeout: defaultAuthenticationTimeoutSec * time.Second,
-							RedirectURLHostname:   "localhost",
-							LocalServerCertFile:   filepath.Join(userHomeDir, ".kube/oidc-server.crt"),
-							LocalServerKeyFile:    filepath.Join(userHomeDir, ".kube/oidc-server.key"),
-						},
-					},
-					TLSClientConfig: tlsclientconfig.Config{
-						CACertFilename: []string{filepath.Join(userHomeDir, ".kube/ca.crt")},
-					},
-				},
-			},
-		}
-		for name, c := range tests {
-			t.Run(name, func(t *testing.T) {
-				ctx := context.TODO()
-				getToken := credentialplugin_mock.NewMockInterface(t)
-				getToken.EXPECT().
-					Do(ctx, c.in).
-					Return(nil)
-				cmd := Cmd{
-					Root: &Root{
-						Logger: logger.New(t),
-					},
-					GetToken: &GetToken{
-						GetToken: getToken,
-						Logger:   logger.New(t),
-					},
-					Logger: logger.New(t),
-				}
-				exitCode := cmd.Run(ctx, c.args, version)
-				if exitCode != 0 {
-					t.Errorf("exitCode wants 0 but %d", exitCode)
-				}
-			})
-		}
-
-		t.Run("MissingMandatoryOptions", func(t *testing.T) {
-			ctx := context.TODO()
-			cmd := Cmd{
-				Root: &Root{
-					Logger: logger.New(t),
-				},
-				GetToken: &GetToken{
-					GetToken: credentialplugin_mock.NewMockInterface(t),
-					Logger:   logger.New(t),
-				},
-				Logger: logger.New(t),
-			}
-			exitCode := cmd.Run(ctx, []string{executable, "get-token"}, version)
-			if exitCode != 1 {
-				t.Errorf("exitCode wants 1 but %d", exitCode)
-			}
-		})
-
-		t.Run("TooManyArgs", func(t *testing.T) {
-			ctx := context.TODO()
-			cmd := Cmd{
-				Root: &Root{
-					Logger: logger.New(t),
-				},
-				GetToken: &GetToken{
-					GetToken: credentialplugin_mock.NewMockInterface(t),
-					Logger:   logger.New(t),
-				},
-				Logger: logger.New(t),
-			}
-			exitCode := cmd.Run(ctx, []string{executable, "get-token", "foo"}, version)
-			if exitCode != 1 {
-				t.Errorf("exitCode wants 1 but %d", exitCode)
-			}
-		})
-	})
-}
--- a/pkg/cmd/get_token.go
+++ b/pkg/cmd/get_token.go
@@ -1,106 +0,0 @@
-package cmd
-
-import (
-	"errors"
-	"fmt"
-
-	"github.com/int128/kubelogin/pkg/infrastructure/logger"
-	"github.com/int128/kubelogin/pkg/oidc"
-	"github.com/int128/kubelogin/pkg/usecases/credentialplugin"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-)
-
-// getTokenOptions represents the options for get-token command.
-type getTokenOptions struct {
-	IssuerURL             string
-	ClientID              string
-	ClientSecret          string
-	ExtraScopes           []string
-	UseAccessToken        bool
-	tokenCacheOptions     tokenCacheOptions
-	tlsOptions            tlsOptions
-	pkceOptions           pkceOptions
-	authenticationOptions authenticationOptions
-	ForceRefresh          bool
-}
-
-func (o *getTokenOptions) addFlags(f *pflag.FlagSet) {
-	f.StringVar(&o.IssuerURL, "oidc-issuer-url", "", "Issuer URL of the provider (mandatory)")
-	f.StringVar(&o.ClientID, "oidc-client-id", "", "Client ID of the provider (mandatory)")
-	f.StringVar(&o.ClientSecret, "oidc-client-secret", "", "Client secret of the provider")
-	f.StringSliceVar(&o.ExtraScopes, "oidc-extra-scope", nil, "Scopes to request to the provider")
-	f.BoolVar(&o.UseAccessToken, "oidc-use-access-token", false, "Instead of using the id_token, use the access_token to authenticate to Kubernetes")
-	f.BoolVar(&o.ForceRefresh, "force-refresh", false, "If set, refresh the ID token regardless of its expiration time")
-	o.tokenCacheOptions.addFlags(f)
-	o.tlsOptions.addFlags(f)
-	o.pkceOptions.addFlags(f)
-	o.authenticationOptions.addFlags(f)
-}
-
-func (o *getTokenOptions) expandHomedir() {
-	o.tokenCacheOptions.expandHomedir()
-	o.authenticationOptions.expandHomedir()
-	o.tlsOptions.expandHomedir()
-}
-
-type GetToken struct {
-	GetToken credentialplugin.Interface
-	Logger   logger.Interface
-}
-
-func (cmd *GetToken) New() *cobra.Command {
-	var o getTokenOptions
-	c := &cobra.Command{
-		Use:   "get-token [flags]",
-		Short: "Run as a kubectl credential plugin",
-		Args: func(c *cobra.Command, args []string) error {
-			if err := cobra.NoArgs(c, args); err != nil {
-				return err
-			}
-			if o.IssuerURL == "" {
-				return errors.New("--oidc-issuer-url is missing")
-			}
-			if o.ClientID == "" {
-				return errors.New("--oidc-client-id is missing")
-			}
-			return nil
-		},
-		RunE: func(c *cobra.Command, _ []string) error {
-			o.expandHomedir()
-			grantOptionSet, err := o.authenticationOptions.grantOptionSet()
-			if err != nil {
-				return fmt.Errorf("get-token: %w", err)
-			}
-			tokenCacheConfig, err := o.tokenCacheOptions.tokenCacheConfig()
-			if err != nil {
-				return fmt.Errorf("get-token: %w", err)
-			}
-			pkceMethod, err := o.pkceOptions.pkceMethod()
-			if err != nil {
-				return fmt.Errorf("get-token: %w", err)
-			}
-			in := credentialplugin.Input{
-				Provider: oidc.Provider{
-					IssuerURL:      o.IssuerURL,
-					ClientID:       o.ClientID,
-					ClientSecret:   o.ClientSecret,
-					PKCEMethod:     pkceMethod,
-					UseAccessToken: o.UseAccessToken,
-					ExtraScopes:    o.ExtraScopes,
-				},
-				ForceRefresh:     o.ForceRefresh,
-				TokenCacheConfig: tokenCacheConfig,
-				GrantOptionSet:   grantOptionSet,
-				TLSClientConfig:  o.tlsOptions.tlsClientConfig(),
-			}
-			if err := cmd.GetToken.Do(c.Context(), in); err != nil {
-				return fmt.Errorf("get-token: %w", err)
-			}
-			return nil
-		},
-	}
-	c.Flags().SortFlags = false
-	o.addFlags(c.Flags())
-	return c
-}
--- a/pkg/cmd/homedir.go
+++ b/pkg/cmd/homedir.go
@@ -1,15 +0,0 @@
-package cmd
-
-import (
-	"path/filepath"
-	"strings"
-
-	"k8s.io/client-go/util/homedir"
-)
-
-func expandHomedir(s string) string {
-	if !strings.HasPrefix(s, "~") {
-		return s
-	}
-	return filepath.Join(homedir.HomeDir(), strings.TrimPrefix(s, "~"))
-}
--- a/pkg/cmd/pkce.go
+++ b/pkg/cmd/pkce.go
@@ -1,40 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/int128/kubelogin/pkg/oidc"
-	"github.com/spf13/pflag"
-)
-
-var allPKCEMethods = strings.Join([]string{"auto", "no", "S256"}, "|")
-
-type pkceOptions struct {
-	UsePKCE    bool
-	PKCEMethod string
-}
-
-func (o *pkceOptions) addFlags(f *pflag.FlagSet) {
-	f.BoolVar(&o.UsePKCE, "oidc-use-pkce", false, "Force PKCE S256 code challenge method")
-	if err := f.MarkDeprecated("oidc-use-pkce", "use --oidc-pkce-method instead. For the most providers, you don't need to set the flag."); err != nil {
-		panic(err)
-	}
-	f.StringVar(&o.PKCEMethod, "oidc-pkce-method", "auto", fmt.Sprintf("PKCE code challenge method. Automatically determined by default. One of (%s)", allPKCEMethods))
-}
-
-func (o *pkceOptions) pkceMethod() (oidc.PKCEMethod, error) {
-	if o.UsePKCE {
-		return oidc.PKCEMethodS256, nil
-	}
-	switch o.PKCEMethod {
-	case "auto":
-		return oidc.PKCEMethodAuto, nil
-	case "no":
-		return oidc.PKCEMethodNo, nil
-	case "S256":
-		return oidc.PKCEMethodS256, nil
-	default:
-		return 0, fmt.Errorf("oidc-pkce-method must be one of (%s)", allPKCEMethods)
-	}
-}
--- a/pkg/cmd/root.go
+++ b/pkg/cmd/root.go
@@ -1,74 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/int128/kubelogin/pkg/infrastructure/logger"
-	"github.com/int128/kubelogin/pkg/kubeconfig"
-	"github.com/int128/kubelogin/pkg/usecases/standalone"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-)
-
-const rootDescription = `Log in to the OpenID Connect provider.
-
-You need to set up the OIDC provider, role binding, Kubernetes API server and kubeconfig.
-To show the setup instruction:
-
-	kubectl oidc-login setup
-
-See https://github.com/int128/kubelogin for more.
-`
-
-// rootOptions represents the options for the root command.
-type rootOptions struct {
-	Kubeconfig            string
-	Context               string
-	User                  string
-	tlsOptions            tlsOptions
-	authenticationOptions authenticationOptions
-}
-
-func (o *rootOptions) addFlags(f *pflag.FlagSet) {
-	f.StringVar(&o.Kubeconfig, "kubeconfig", "", "Path to the kubeconfig file")
-	f.StringVar(&o.Context, "context", "", "Name of the kubeconfig context to use")
-	f.StringVar(&o.User, "user", "", "Name of the kubeconfig user to use. Prior to --context")
-	o.tlsOptions.addFlags(f)
-	o.authenticationOptions.addFlags(f)
-}
-
-type Root struct {
-	Standalone standalone.Interface
-	Logger     logger.Interface
-}
-
-func (cmd *Root) New() *cobra.Command {
-	var o rootOptions
-	c := &cobra.Command{
-		Use:   "kubelogin",
-		Short: "Log in to the OpenID Connect provider",
-		Long:  rootDescription,
-		Args:  cobra.NoArgs,
-		RunE: func(c *cobra.Command, _ []string) error {
-			grantOptionSet, err := o.authenticationOptions.grantOptionSet()
-			if err != nil {
-				return fmt.Errorf("invalid option: %w", err)
-			}
-			in := standalone.Input{
-				KubeconfigFilename: o.Kubeconfig,
-				KubeconfigContext:  kubeconfig.ContextName(o.Context),
-				KubeconfigUser:     kubeconfig.UserName(o.User),
-				GrantOptionSet:     grantOptionSet,
-				TLSClientConfig:    o.tlsOptions.tlsClientConfig(),
-			}
-			if err := cmd.Standalone.Do(c.Context(), in); err != nil {
-				return fmt.Errorf("login: %w", err)
-			}
-			return nil
-		},
-	}
-	c.Flags().SortFlags = false
-	o.addFlags(c.Flags())
-	cmd.Logger.AddFlags(c.PersistentFlags())
-	return c
-}
--- a/pkg/cmd/setup.go
+++ b/pkg/cmd/setup.go
@@ -1,82 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/int128/kubelogin/pkg/usecases/setup"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-)
-
-// setupOptions represents the options for setup command.
-type setupOptions struct {
-	IssuerURL             string
-	ClientID              string
-	ClientSecret          string
-	ExtraScopes           []string
-	UseAccessToken        bool
-	tlsOptions            tlsOptions
-	pkceOptions           pkceOptions
-	authenticationOptions authenticationOptions
-}
-
-func (o *setupOptions) addFlags(f *pflag.FlagSet) {
-	f.StringVar(&o.IssuerURL, "oidc-issuer-url", "", "Issuer URL of the provider")
-	f.StringVar(&o.ClientID, "oidc-client-id", "", "Client ID of the provider")
-	f.StringVar(&o.ClientSecret, "oidc-client-secret", "", "Client secret of the provider")
-	f.StringSliceVar(&o.ExtraScopes, "oidc-extra-scope", nil, "Scopes to request to the provider")
-	f.BoolVar(&o.UseAccessToken, "oidc-use-access-token", false, "Instead of using the id_token, use the access_token to authenticate to Kubernetes")
-	o.tlsOptions.addFlags(f)
-	o.pkceOptions.addFlags(f)
-	o.authenticationOptions.addFlags(f)
-}
-
-type Setup struct {
-	Setup setup.Interface
-}
-
-func (cmd *Setup) New() *cobra.Command {
-	var o setupOptions
-	c := &cobra.Command{
-		Use:   "setup",
-		Short: "Show the setup instruction",
-		Args:  cobra.NoArgs,
-		RunE: func(c *cobra.Command, _ []string) error {
-			grantOptionSet, err := o.authenticationOptions.grantOptionSet()
-			if err != nil {
-				return fmt.Errorf("setup: %w", err)
-			}
-			pkceMethod, err := o.pkceOptions.pkceMethod()
-			if err != nil {
-				return fmt.Errorf("setup: %w", err)
-			}
-			in := setup.Stage2Input{
-				IssuerURL:       o.IssuerURL,
-				ClientID:        o.ClientID,
-				ClientSecret:    o.ClientSecret,
-				ExtraScopes:     o.ExtraScopes,
-				UseAccessToken:  o.UseAccessToken,
-				PKCEMethod:      pkceMethod,
-				GrantOptionSet:  grantOptionSet,
-				TLSClientConfig: o.tlsOptions.tlsClientConfig(),
-			}
-			if c.Flags().Lookup("listen-address").Changed {
-				in.ListenAddressArgs = o.authenticationOptions.ListenAddress
-			}
-			if c.Flags().Lookup("oidc-pkce-method").Changed {
-				in.PKCEMethodArg = o.pkceOptions.PKCEMethod
-			}
-			if in.IssuerURL == "" || in.ClientID == "" {
-				cmd.Setup.DoStage1()
-				return nil
-			}
-			if err := cmd.Setup.DoStage2(c.Context(), in); err != nil {
-				return fmt.Errorf("setup: %w", err)
-			}
-			return nil
-		},
-	}
-	c.Flags().SortFlags = false
-	o.addFlags(c.Flags())
-	return c
-}
--- a/pkg/cmd/tls.go
+++ b/pkg/cmd/tls.go
@@ -1,52 +0,0 @@
-package cmd
-
-import (
-	"crypto/tls"
-
-	"github.com/int128/kubelogin/pkg/tlsclientconfig"
-	"github.com/spf13/pflag"
-)
-
-type tlsOptions struct {
-	CACertFilename            []string
-	CACertData                []string
-	SkipTLSVerify             bool
-	RenegotiateOnceAsClient   bool
-	RenegotiateFreelyAsClient bool
-}
-
-func (o *tlsOptions) addFlags(f *pflag.FlagSet) {
-	f.StringArrayVar(&o.CACertFilename, "certificate-authority", nil, "Path to a cert file for the certificate authority")
-	f.StringArrayVar(&o.CACertData, "certificate-authority-data", nil, "Base64 encoded cert for the certificate authority")
-	f.BoolVar(&o.SkipTLSVerify, "insecure-skip-tls-verify", false, "[SECURITY RISK] If set, the server's certificate will not be checked for validity")
-	f.BoolVar(&o.RenegotiateOnceAsClient, "tls-renegotiation-once", false, "If set, allow a remote server to request renegotiation once per connection")
-	f.BoolVar(&o.RenegotiateFreelyAsClient, "tls-renegotiation-freely", false, "If set, allow a remote server to repeatedly request renegotiation")
-}
-
-func (o *tlsOptions) expandHomedir() {
-	var caCertFilenames []string
-	for _, caCertFilename := range o.CACertFilename {
-		expanded := expandHomedir(caCertFilename)
-		caCertFilenames = append(caCertFilenames, expanded)
-	}
-	o.CACertFilename = caCertFilenames
-}
-
-func (o tlsOptions) tlsClientConfig() tlsclientconfig.Config {
-	return tlsclientconfig.Config{
-		CACertFilename: o.CACertFilename,
-		CACertData:     o.CACertData,
-		SkipTLSVerify:  o.SkipTLSVerify,
-		Renegotiation:  o.renegotiationSupport(),
-	}
-}
-
-func (o tlsOptions) renegotiationSupport() tls.RenegotiationSupport {
-	if o.RenegotiateOnceAsClient {
-		return tls.RenegotiateOnceAsClient
-	}
-	if o.RenegotiateFreelyAsClient {
-		return tls.RenegotiateFreelyAsClient
-	}
-	return tls.RenegotiateNever
-}
--- a/pkg/cmd/tls_test.go
+++ b/pkg/cmd/tls_test.go
@@ -1,92 +0,0 @@
-package cmd
-
-import (
-	"crypto/tls"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/int128/kubelogin/pkg/tlsclientconfig"
-	"github.com/spf13/pflag"
-)
-
-func Test_tlsOptions_tlsClientConfig(t *testing.T) {
-	tests := map[string]struct {
-		args []string
-		want tlsclientconfig.Config
-	}{
-		"NoFlag": {},
-		"SkipTLSVerify": {
-			args: []string{
-				"--insecure-skip-tls-verify",
-			},
-			want: tlsclientconfig.Config{
-				SkipTLSVerify: true,
-			},
-		},
-		"CACertFilename1": {
-			args: []string{
-				"--certificate-authority", "/path/to/cert1",
-			},
-			want: tlsclientconfig.Config{
-				CACertFilename: []string{"/path/to/cert1"},
-			},
-		},
-		"CACertFilename2": {
-			args: []string{
-				"--certificate-authority", "/path/to/cert1",
-				"--certificate-authority", "/path/to/cert2",
-			},
-			want: tlsclientconfig.Config{
-				CACertFilename: []string{"/path/to/cert1", "/path/to/cert2"},
-			},
-		},
-		"CACertData1": {
-			args: []string{
-				"--certificate-authority-data", "base64encoded1",
-			},
-			want: tlsclientconfig.Config{
-				CACertData: []string{"base64encoded1"},
-			},
-		},
-		"CACertData2": {
-			args: []string{
-				"--certificate-authority-data", "base64encoded1",
-				"--certificate-authority-data", "base64encoded2",
-			},
-			want: tlsclientconfig.Config{
-				CACertData: []string{"base64encoded1", "base64encoded2"},
-			},
-		},
-		"RenegotiateOnceAsClient": {
-			args: []string{
-				"--tls-renegotiation-once",
-			},
-			want: tlsclientconfig.Config{
-				Renegotiation: tls.RenegotiateOnceAsClient,
-			},
-		},
-		"RenegotiateFreelyAsClient": {
-			args: []string{
-				"--tls-renegotiation-freely",
-			},
-			want: tlsclientconfig.Config{
-				Renegotiation: tls.RenegotiateFreelyAsClient,
-			},
-		},
-	}
-
-	for name, c := range tests {
-		t.Run(name, func(t *testing.T) {
-			var o tlsOptions
-			f := pflag.NewFlagSet("", pflag.ContinueOnError)
-			o.addFlags(f)
-			if err := f.Parse(c.args); err != nil {
-				t.Fatalf("Parse error: %s", err)
-			}
-			got := o.tlsClientConfig()
-			if diff := cmp.Diff(c.want, got); diff != "" {
-				t.Errorf("mismatch (-want +got):\n%s", diff)
-			}
-		})
-	}
-}
--- a/pkg/cmd/tokencache.go
+++ b/pkg/cmd/tokencache.go
@@ -1,52 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/int128/kubelogin/pkg/tokencache"
-	"github.com/spf13/pflag"
-)
-
-func getDefaultTokenCacheDir() string {
-	// https://github.com/int128/kubelogin/pull/975
-	if kubeCacheDir, ok := os.LookupEnv("KUBECACHEDIR"); ok {
-		return filepath.Join(kubeCacheDir, "oidc-login")
-	}
-	return filepath.Join("~", ".kube", "cache", "oidc-login")
-}
-
-var allTokenCacheStorage = strings.Join([]string{"auto", "keyring", "disk"}, "|")
-
-type tokenCacheOptions struct {
-	TokenCacheDir     string
-	TokenCacheStorage string
-}
-
-func (o *tokenCacheOptions) addFlags(f *pflag.FlagSet) {
-	f.StringVar(&o.TokenCacheDir, "token-cache-dir", getDefaultTokenCacheDir(), "Path to a directory of the token cache")
-	f.StringVar(&o.TokenCacheStorage, "token-cache-storage", "auto", fmt.Sprintf("Storage for the token cache. One of (%s)", allTokenCacheStorage))
-}
-
-func (o *tokenCacheOptions) expandHomedir() {
-	o.TokenCacheDir = expandHomedir(o.TokenCacheDir)
-}
-
-func (o *tokenCacheOptions) tokenCacheConfig() (tokencache.Config, error) {
-	config := tokencache.Config{
-		Directory: o.TokenCacheDir,
-	}
-	switch o.TokenCacheStorage {
-	case "auto":
-		config.Storage = tokencache.StorageAuto
-	case "keyring":
-		config.Storage = tokencache.StorageKeyring
-	case "disk":
-		config.Storage = tokencache.StorageDisk
-	default:
-		return tokencache.Config{}, fmt.Errorf("token-cache-storage must be one of (%s)", allTokenCacheStorage)
-	}
-	return config, nil
-}
--- a/pkg/credentialplugin/reader/reader.go
+++ b/pkg/credentialplugin/reader/reader.go
@@ -1,39 +0,0 @@
-// Package reader provides a loader for the credential plugin.
-package reader
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-
-	"github.com/google/wire"
-	"github.com/int128/kubelogin/pkg/credentialplugin"
-	"k8s.io/client-go/pkg/apis/clientauthentication"
-)
-
-var Set = wire.NewSet(
-	wire.Struct(new(Reader), "*"),
-	wire.Bind(new(Interface), new(*Reader)),
-)
-
-type Interface interface {
-	Read() (credentialplugin.Input, error)
-}
-
-type Reader struct{}
-
-// Read parses the environment variable KUBERNETES_EXEC_INFO.
-// If the environment variable is not given by kubectl, Read returns a zero value.
-func (r Reader) Read() (credentialplugin.Input, error) {
-	execInfo := os.Getenv("KUBERNETES_EXEC_INFO")
-	if execInfo == "" {
-		return credentialplugin.Input{}, nil
-	}
-	var execCredential clientauthentication.ExecCredential
-	if err := json.Unmarshal([]byte(execInfo), &execCredential); err != nil {
-		return credentialplugin.Input{}, fmt.Errorf("invalid KUBERNETES_EXEC_INFO: %w", err)
-	}
-	return credentialplugin.Input{
-		ClientAuthenticationAPIVersion: execCredential.APIVersion,
-	}, nil
-}
--- a/pkg/credentialplugin/reader/reader_test.go
+++ b/pkg/credentialplugin/reader/reader_test.go
@@ -1,44 +0,0 @@
-package reader
-
-import (
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/int128/kubelogin/pkg/credentialplugin"
-)
-
-func TestReader_Read(t *testing.T) {
-	var reader Reader
-
-	t.Run("KUBERNETES_EXEC_INFO is empty", func(t *testing.T) {
-		input, err := reader.Read()
-		if err != nil {
-			t.Errorf("Read returned error: %v", err)
-		}
-		want := credentialplugin.Input{}
-		if diff := cmp.Diff(want, input); diff != "" {
-			t.Errorf("input mismatch (-want +got):\n%s", diff)
-		}
-	})
-	t.Run("KUBERNETES_EXEC_INFO is invalid JSON", func(t *testing.T) {
-		t.Setenv("KUBERNETES_EXEC_INFO", "invalid")
-		_, err := reader.Read()
-		if err == nil {
-			t.Errorf("Read wants error but no error")
-		}
-	})
-	t.Run("KUBERNETES_EXEC_INFO is v1", func(t *testing.T) {
-		t.Setenv(
-			"KUBERNETES_EXEC_INFO",
-			`{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1","spec":{"interactive":true}}`,
-		)
-		input, err := reader.Read()
-		if err != nil {
-			t.Errorf("Read returned error: %v", err)
-		}
-		want := credentialplugin.Input{ClientAuthenticationAPIVersion: "client.authentication.k8s.io/v1"}
-		if diff := cmp.Diff(want, input); diff != "" {
-			t.Errorf("input mismatch (-want +got):\n%s", diff)
-		}
-	})
-}
--- a/pkg/credentialplugin/types.go
+++ b/pkg/credentialplugin/types.go
@@ -1,17 +0,0 @@
-// Package credentialplugin provides the types for client-go credential plugins.
-package credentialplugin
-
-import "time"
-
-// Input represents an input object of the credential plugin.
-// This may be a zero value if the input is not available.
-type Input struct {
-	ClientAuthenticationAPIVersion string
-}
-
-// Output represents an output object of the credential plugin.
-type Output struct {
-	Token                          string
-	Expiry                         time.Time
-	ClientAuthenticationAPIVersion string
-}
--- a/pkg/credentialplugin/writer/credential_plugin.go
+++ b/pkg/credentialplugin/writer/credential_plugin.go
@@ -1,71 +0,0 @@
-// Package writer provides a writer for the credential plugin.
-package writer
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/google/wire"
-	"github.com/int128/kubelogin/pkg/credentialplugin"
-	"github.com/int128/kubelogin/pkg/infrastructure/stdio"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	clientauthenticationv1 "k8s.io/client-go/pkg/apis/clientauthentication/v1"
-	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
-)
-
-var Set = wire.NewSet(
-	wire.Struct(new(Writer), "*"),
-	wire.Bind(new(Interface), new(*Writer)),
-)
-
-type Interface interface {
-	Write(out credentialplugin.Output) error
-}
-
-type Writer struct {
-	Stdout stdio.Stdout
-}
-
-// Write writes the ExecCredential to standard output for kubectl.
-func (w *Writer) Write(out credentialplugin.Output) error {
-	execCredential, err := generateExecCredential(out)
-	if err != nil {
-		return fmt.Errorf("generate ExecCredential: %w", err)
-	}
-	if err := json.NewEncoder(w.Stdout).Encode(execCredential); err != nil {
-		return fmt.Errorf("write ExecCredential: %w", err)
-	}
-	return nil
-}
-
-func generateExecCredential(out credentialplugin.Output) (any, error) {
-	switch out.ClientAuthenticationAPIVersion {
-	// If the API version is not available, fall back to v1beta1.
-	case clientauthenticationv1beta1.SchemeGroupVersion.String(), "":
-		return &clientauthenticationv1beta1.ExecCredential{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: clientauthenticationv1beta1.SchemeGroupVersion.String(),
-				Kind:       "ExecCredential",
-			},
-			Status: &clientauthenticationv1beta1.ExecCredentialStatus{
-				Token:               out.Token,
-				ExpirationTimestamp: &metav1.Time{Time: out.Expiry},
-			},
-		}, nil
-
-	case clientauthenticationv1.SchemeGroupVersion.String():
-		return &clientauthenticationv1.ExecCredential{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: clientauthenticationv1.SchemeGroupVersion.String(),
-				Kind:       "ExecCredential",
-			},
-			Status: &clientauthenticationv1.ExecCredentialStatus{
-				Token:               out.Token,
-				ExpirationTimestamp: &metav1.Time{Time: out.Expiry},
-			},
-		}, nil
-
-	default:
-		return nil, fmt.Errorf("unknown apiVersion: %s", out.ClientAuthenticationAPIVersion)
-	}
-}
--- a/pkg/di/di.go
+++ b/pkg/di/di.go
@@ -1,65 +0,0 @@
-//go:build wireinject
-// +build wireinject
-
-// Package di provides dependency injection.
-package di
-
-import (
-	"github.com/google/wire"
-	"github.com/int128/kubelogin/pkg/cmd"
-	credentialpluginreader "github.com/int128/kubelogin/pkg/credentialplugin/reader"
-	credentialpluginwriter "github.com/int128/kubelogin/pkg/credentialplugin/writer"
-	"github.com/int128/kubelogin/pkg/infrastructure/browser"
-	"github.com/int128/kubelogin/pkg/infrastructure/clock"
-	"github.com/int128/kubelogin/pkg/infrastructure/logger"
-	"github.com/int128/kubelogin/pkg/infrastructure/reader"
-	"github.com/int128/kubelogin/pkg/infrastructure/stdio"
-	kubeconfigLoader "github.com/int128/kubelogin/pkg/kubeconfig/loader"
-	kubeconfigWriter "github.com/int128/kubelogin/pkg/kubeconfig/writer"
-	"github.com/int128/kubelogin/pkg/oidc/client"
-	"github.com/int128/kubelogin/pkg/tlsclientconfig/loader"
-	"github.com/int128/kubelogin/pkg/tokencache/repository"
-	"github.com/int128/kubelogin/pkg/usecases/authentication"
-	"github.com/int128/kubelogin/pkg/usecases/clean"
-	"github.com/int128/kubelogin/pkg/usecases/credentialplugin"
-	"github.com/int128/kubelogin/pkg/usecases/setup"
-	"github.com/int128/kubelogin/pkg/usecases/standalone"
-)
-
-// NewCmd returns an instance of infrastructure.Cmd.
-func NewCmd() cmd.Interface {
-	wire.Build(
-		NewCmdForHeadless,
-
-		// dependencies for production
-		clock.Set,
-		stdio.Set,
-		logger.Set,
-		browser.Set,
-	)
-	return nil
-}
-
-// NewCmdForHeadless returns an instance of infrastructure.Cmd for headless testing.
-func NewCmdForHeadless(clock.Interface, stdio.Stdin, stdio.Stdout, logger.Interface, browser.Interface) cmd.Interface {
-	wire.Build(
-		// use-cases
-		authentication.Set,
-		standalone.Set,
-		credentialplugin.Set,
-		setup.Set,
-		clean.Set,
-
-		// infrastructure
-		cmd.Set,
-		reader.Set,
-		kubeconfigLoader.Set,
-		kubeconfigWriter.Set,
-		repository.Set,
-		client.Set,
-		loader.Set,
-		credentialpluginreader.Set,
-		credentialpluginwriter.Set,
-	)
-	return nil
-}
--- a/Show More
+++ b/Show More