Merge pull request #405 from enj/enj/i/cluster_scope_concierge

Cluster scope all concierge APIs

.dockerignore

@@ -0,0 +1,13 @@
+./.*
+./*.md
+./*.yaml
+./apis
+./deploy
+./Dockerfile
+./generated/1.1*
+./hack/lib/tilt/
+./internal/mocks
+./LICENSE
+./site/
+./test
+**/*_test.go

.github/codecov.yml

@@ -0,0 +1,13 @@
+codecov:
+  strict_yaml_branch: main
+  require_ci_to_pass: no
+  notify:
+    wait_for_ci: no  
+coverage:
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true

.golangci.yaml

@@ -30,7 +30,6 @@ linters:
   - gocritic
   - gocyclo
   - godot
-  - goerr113
   - goheader
   - goimports
   - golint
@@ -56,15 +55,18 @@ issues:
     linters:
     - funlen
     - gochecknoglobals
-    - goerr113
 
 linters-settings:
   funlen:
-    lines: 125
+    lines: 150
     statements: 50
   goheader:
+    values:
+      regexp:
+        # YYYY or YYYY-YYYY
+        YEARS: \d\d\d\d(-\d\d\d\d)?
     template: |-
-        Copyright 2020 the Pinniped contributors. All Rights Reserved.
+        Copyright {{YEARS}} the Pinniped contributors. All Rights Reserved.
         SPDX-License-Identifier: Apache-2.0
   goimports:
     local-prefixes: go.pinniped.dev

.pre-commit-config.yaml

@@ -15,3 +15,9 @@ repos:
   - id: detect-private-key
     exclude: testdata
   - id: mixed-line-ending
+- repo: local
+  hooks:
+  - id: validate-copyright-year
+    name: Validate copyright year
+    entry: hack/check-copyright-year.sh
+    language: script

CONTRIBUTING.md

@@ -8,24 +8,17 @@ Please see the [Code of Conduct](./CODE_OF_CONDUCT.md).
 
 ## Project Scope
 
-Learn about the [scope](doc/scope.md) of the project.
+Learn about the [scope](https://pinniped.dev/docs/scope/) of the project.
 
-## Meeting with the Maintainers
+## Community Meetings
 
-The maintainers aspire to hold a video conference every other week with the Pinniped community.
-Any community member may request to add topics to the agenda by contacting a [maintainer](MAINTAINERS.md)
-in advance, or by attending and raising the topic during time remaining after the agenda is covered.
-Typical agenda items include topics regarding the roadmap, feature requests, bug reports, pull requests, etc.
-A [public document](https://docs.google.com/document/d/1qYA35wZV-6bxcH5375vOnIGkNBo7e4OROgsV4Sj8WjQ)
-tracks the agendas and notes for these meetings.
+Pinniped is better because of our contributors and maintainers. It is because of you that we can bring great software to the community. Please join us during our online community meetings, occuring every first and third Thursday of the month at 9AM PT / 12PM PT. Use [this Zoom Link](https://vmware.zoom.us/j/93798188973?pwd=T3pIMWxReEQvcWljNm1admRoZTFSZz09) to attend and add any agenda items you wish to discuss to [the notes document](https://hackmd.io/rd_kVJhjQfOvfAWzK8A3tQ?view). Join our [Google Group](https://groups.google.com/u/1/g/project-pinniped) to receive invites to this meeting.
 
-These meetings are currently scheduled for the first and third Thursday mornings of each month
-at 9 AM Pacific Time, using this [Zoom meeting](https://VMware.zoom.us/j/94638309756?pwd=V3NvRXJIdDg5QVc0TUdFM2dYRzgrUT09).
 If the meeting day falls on a US holiday, please consider that occurrence of the meeting to be canceled.
 
 ## Discussion
 
-Got a question, comment, or idea? Please don't hesitate to reach out via the GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions) tab at the top of this page.
+Got a question, comment, or idea? Please don't hesitate to reach out via the GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions) tab at the top of this page or reach out in Kubernetes Slack Workspace within the [#pinniped channel](https://kubernetes.slack.com/archives/C01BW364RJA).
 
 ## Issues
 
@@ -97,16 +90,19 @@ docker build .
 
 1. Install dependencies:
 
+   - [`chromedriver`](https://chromedriver.chromium.org/) (and [Chrome](https://www.google.com/chrome/))
+   - [`docker`](https://www.docker.com/)
+   - `htpasswd` (installed by default on MacOS, usually found in `apache2-utils` package for linux)
+   - [`kapp`](https://carvel.dev/#getting-started)
    - [`kind`](https://kind.sigs.k8s.io/docs/user/quick-start)
+   - [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
    - [`tilt`](https://docs.tilt.dev/install.html)
    - [`ytt`](https://carvel.dev/#getting-started)
-   - [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
-   - [`chromedriver`](https://chromedriver.chromium.org/) (and [Chrome](https://www.google.com/chrome/))
 
    On macOS, these tools can be installed with [Homebrew](https://brew.sh/) (assuming you have Chrome installed already):
 
    ```bash
-   brew install kind tilt-dev/tap/tilt k14s/tap/ytt kubectl chromedriver
+   brew install kind tilt-dev/tap/tilt k14s/tap/ytt k14s/tap/kapp kubectl chromedriver && brew cask install docker
    ```
 
 1. Create a local Kubernetes cluster using `kind`:

Dockerfile

@@ -1,35 +1,41 @@
-# Copyright 2020 the Pinniped contributors. All Rights Reserved.
+# syntax = docker/dockerfile:1.0-experimental
+
+# Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.15.3 as build-env
+FROM golang:1.15.8 as build-env
 
 WORKDIR /work
-# Get dependencies first so they can be cached as a layer
-COPY go.* ./
-COPY generated/1.19/apis/go.* ./generated/1.19/apis/
-COPY generated/1.19/client/go.* ./generated/1.19/client/
-RUN go mod download
-
-# Copy only the production source code to avoid cache misses when editing other files
-COPY generated ./generated
-COPY cmd ./cmd
-COPY internal ./internal
-COPY tools ./tools
-COPY hack ./hack
+COPY . .
+ARG GOPROXY
 
 # Build the executable binary (CGO_ENABLED=0 means static linking)
-RUN mkdir out \
-  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$(hack/get-ldflags.sh)" -o out ./cmd/pinniped-concierge/... \
-  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$(hack/get-ldflags.sh)" -o out ./cmd/pinniped-supervisor/... \
-  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out ./cmd/local-user-authenticator/...
+# Pass in GOCACHE (build cache) and GOMODCACHE (module cache) so they
+# can be re-used between image builds.
+RUN \
+  --mount=type=cache,target=/cache/gocache \
+  --mount=type=cache,target=/cache/gomodcache \
+  mkdir out && \
+  GOCACHE=/cache/gocache \
+  GOMODCACHE=/cache/gomodcache \
+  CGO_ENABLED=0 \
+  GOOS=linux \
+  GOARCH=amd64 \
+  go build -v -ldflags "$(hack/get-ldflags.sh)" -o out \
+    ./cmd/pinniped-concierge/... \
+    ./cmd/pinniped-supervisor/... \
+    ./cmd/local-user-authenticator/...
 
-# Use a runtime image based on Debian slim
-FROM debian:10.6-slim
+# Use a Debian slim image to grab a reasonable default CA bundle.
+FROM debian:10.8-slim AS get-ca-bundle-env
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/* /var/cache/debconf/*
 
-# Copy the binaries from the build-env stage
-COPY --from=build-env /work/out/pinniped-concierge /usr/local/bin/pinniped-concierge
-COPY --from=build-env /work/out/pinniped-supervisor /usr/local/bin/pinniped-supervisor
-COPY --from=build-env /work/out/local-user-authenticator /usr/local/bin/local-user-authenticator
+# Use a runtime image based on Debian slim.
+FROM debian:10.8-slim
+COPY --from=get-ca-bundle-env /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
+# Copy the binaries from the build-env stage.
+COPY --from=build-env /work/out/ /usr/local/bin/
 
 # Document the ports
 EXPOSE 8080 8443

MAINTAINERS.md

@@ -5,7 +5,9 @@ This is the current list of maintainers for the Pinniped project.
 | Maintainer | GitHub ID | Affiliation |
 | --------------- | --------- | ----------- |
 | Andrew Keesler | [ankeesler](https://github.com/ankeesler) | [VMware](https://www.github.com/vmware/) |
+| Margo Crawford | [margocrawf](https://github.com/margocrawf) | [VMware](https://www.github.com/vmware/) |
 | Matt Moyer | [mattmoyer](https://github.com/mattmoyer) | [VMware](https://www.github.com/vmware/) |
+| Mo Khan | [enj](https://github.com/enj) | [VMware](https://www.github.com/vmware/) |
 | Pablo Schuhmacher | [pabloschuhmacher](https://github.com/pabloschuhmacher) | [VMware](https://www.github.com/vmware/) |
 | Ryan Richard | [cfryanr](https://github.com/cfryanr) | [VMware](https://www.github.com/vmware/) |
 

README.md

@@ -1,4 +1,4 @@
-<img src="doc/img/pinniped_logo.svg" alt="Pinniped Logo" width="100%"/>
+<img src="site/content/docs/img/pinniped_logo.svg" alt="Pinniped Logo" width="100%"/>
 
 ## Overview
 
@@ -23,22 +23,39 @@ with IDPs, and distribution-specific integration strategies.
 
 ### Architecture
 
-Pinniped offers credential exchange to enable a user to exchange an external IDP
-credential for a short-lived, cluster-specific credential. Pinniped supports various
-IDP types and implements different integration strategies for various Kubernetes
+The Pinniped Supervisor component offers identity federation to enable a user to
+access multiple clusters with a single daily login to their external IDP. The
+Pinniped Supervisor supports various external [IDP
+types](https://github.com/vmware-tanzu/pinniped/tree/main/generated/1.20#k8s-api-idp-supervisor-pinniped-dev-v1alpha1).
+
+The Pinniped Concierge component offers credential exchange to enable a user to
+exchange an external credential for a short-lived, cluster-specific
+credential. Pinniped supports various [authentication
+methods](https://github.com/vmware-tanzu/pinniped/tree/main/generated/1.20#authenticationconciergepinnipeddevv1alpha1)
+and implements different integration strategies for various Kubernetes
 distributions to make authentication possible.
 
-To learn more, see [doc/architecture.md](doc/architecture.md).
+The Pinniped Concierge can be configured to hook into the Pinniped Supervisor's
+federated credentials, or it can authenticate users directly via external IDP
+credentials.
 
-<img src="doc/img/pinniped_architecture.svg" alt="Pinniped Architecture Sketch" width="300px"/>
+To learn more, see [architecture](https://pinniped.dev/docs/architecture/).
+
+<img src="site/content/docs/img/pinniped_architecture_concierge_supervisor.svg" alt="Pinniped Architecture Sketch"/>
 
 ## Trying Pinniped
 
-Care to kick the tires? It's easy to [install and try Pinniped](doc/demo.md).
+Care to kick the tires? It's easy to [install and try Pinniped](https://pinniped.dev/docs/demo/).
+
+## Community Meetings
+
+Pinniped is better because of our contributors and maintainers. It is because of you that we can bring great software to the community. Please join us during our online community meetings, occuring every first and third Thursday of the month at 9AM PT / 12PM PT. Use [this Zoom Link](https://vmware.zoom.us/j/93798188973?pwd=T3pIMWxReEQvcWljNm1admRoZTFSZz09) to attend and add any agenda items you wish to discuss to [the notes document](https://hackmd.io/rd_kVJhjQfOvfAWzK8A3tQ?view). Join our [Google Group](https://groups.google.com/u/1/g/project-pinniped) to receive invites to this meeting.
+
+If the meeting day falls on a US holiday, please consider that occurrence of the meeting to be canceled.
 
 ## Discussion
 
-Got a question, comment, or idea? Please don't hesitate to reach out via the GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions) tab at the top of this page.
+Got a question, comment, or idea? Please don't hesitate to reach out via the GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions) tab at the top of this page or reach out in Kubernetes Slack Workspace within the [#pinniped channel](https://kubernetes.slack.com/archives/C01BW364RJA).
 
 ## Contributions
 

SECURITY.md

@@ -1,12 +1,92 @@
-# Reporting a Vulnerability
+# Security Release Process
 
-Pinniped development is sponsored by VMware, and the Pinniped team encourages users
-who become aware of a security vulnerability in Pinniped to report any potential
-vulnerabilities found to security@vmware.com. If possible, please include a description
-of the effects of the vulnerability, reproduction steps, and a description of in which
-version of Pinniped or its dependencies the vulnerability was discovered.
-The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
+Pinniped provides identity services for Kubernetes clusters. The community has adopted this security disclosure and response policy to ensure we responsibly handle critical issues.
 
-The Pinniped team hopes that users encountering a new vulnerability will contact
-us privately as it is in the best interests of our users that the Pinniped team has
-an opportunity to investigate and confirm a suspected vulnerability before it becomes public knowledge.
+## Supported Versions
+
+As of right now, only the latest version of Pinniped is supported.
+
+## Reporting a Vulnerability - Private Disclosure Process
+
+Security is of the highest importance and all security vulnerabilities or suspected security vulnerabilities should be reported to Pinniped privately, to minimize attacks against current users of Pinniped before they are fixed. Vulnerabilities will be investigated and patched on the next patch (or minor) release as soon as possible. This information could be kept entirely internal to the project.
+
+If you know of a publicly disclosed security vulnerability for Pinniped, please **IMMEDIATELY** contact the VMware Security Team (security@vmware.com). The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
+
+**IMPORTANT: Do not file public issues on GitHub for security vulnerabilities**
+
+To report a vulnerability or a security-related issue, please contact the VMware email address with the details of the vulnerability. The email will be fielded by the VMware Security Team and then shared with the Pinniped maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/vmware-tanzu/pinniped/issues/new/choose) instead.
+
+## Proposed Email Content
+
+Provide a descriptive subject line and in the body of the email include the following information:
+
+*   Basic identity information, such as your name and your affiliation or company.
+*   Detailed steps to reproduce the vulnerability  (POC scripts, screenshots, and logs are all helpful to us).
+*   Description of the effects of the vulnerability on Pinniped and the related hardware and software configurations, so that the VMware Security Team can reproduce it.
+*   How the vulnerability affects Pinniped usage and an estimation of the attack surface, if there is one.
+*   List other projects or dependencies that were used in conjunction with Pinniped to produce the vulnerability.
+
+## When to report a vulnerability
+
+*   When you think Pinniped has a potential security vulnerability.
+*   When you suspect a potential vulnerability but you are unsure that it impacts Pinniped.
+*   When you know of or suspect a potential vulnerability on another project that is used by Pinniped.
+
+## Patch, Release, and Disclosure
+
+The VMware Security Team will respond to vulnerability reports as follows:
+
+1. The Security Team will investigate the vulnerability and determine its effects and criticality.
+2. If the issue is not deemed to be a vulnerability, the Security Team will follow up with a detailed reason for rejection.
+3. The Security Team will initiate a conversation with the reporter within 3 business days.
+4. If a vulnerability is acknowledged and the timeline for a fix is determined, the Security Team will work on a plan to communicate with the appropriate community, including identifying mitigating steps that affected users can take to protect themselves until the fix is rolled out.
+5. The Security Team will also create a [CVSS](https://www.first.org/cvss/specification-document) using the [CVSS Calculator](https://www.first.org/cvss/calculator/3.0). The Security Team makes the final call on the calculated CVSS; it is better to move quickly than making the CVSS perfect. Issues may also be reported to [Mitre](https://cve.mitre.org/) using this [scoring calculator](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator). The CVE will initially be set to private.
+6. The Security Team will work on fixing the vulnerability and perform internal testing before preparing to roll out the fix.
+7. The Security Team will provide early disclosure of the vulnerability by emailing the [Pinniped Distributors](https://groups.google.com/g/project-pinniped-distributors) mailing list. Distributors can initially plan for the vulnerability patch ahead of the fix, and later can test the fix and provide feedback to the Pinniped team. See the section **Early Disclosure to Pinniped Distributors List** for details about how to join this mailing list.
+8. A public disclosure date is negotiated by the VMware SecurityTeam, the bug submitter, and the distributors list. We prefer to fully disclose the bug as soon as possible once a user mitigation or patch is available. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for distributor coordination. The timeframe for disclosure is from immediate (especially if it’s already publicly known) to a few weeks. For a critical vulnerability with a straightforward mitigation, we expect the report date for the public disclosure date to be on the order of 14 business days. The VMware Security Team holds the final say when setting a public disclosure date.
+9. Once the fix is confirmed, the Security Team will patch the vulnerability in the next patch or minor release, and backport a patch release into all earlier supported releases. Upon release of the patched version of Pinniped, we will follow the **Public Disclosure Process**.
+
+## Public Disclosure Process
+
+The Security Team publishes a [public advisory](https://github.com/vmware-tanzu/pinniped/security/advisories) to the Pinniped community via GitHub. In most cases, additional communication via Slack, Twitter, mailing lists, blog and other channels will assist in educating Pinniped users and rolling out the patched release to affected users.
+
+The Security Team will also publish any mitigating steps users can take until the fix can be applied to their Pinniped instances. Pinniped distributors will handle creating and publishing their own security advisories.
+
+## Mailing lists
+
+*   Use security@vmware.com to report security concerns to the VMware Security Team, who uses the list to privately discuss security issues and fixes prior to disclosure. The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
+*   Join the [Pinniped Distributors](https://groups.google.com/g/project-pinniped-distributors) mailing list for early private information and vulnerability disclosure. Early disclosure may include mitigating steps and additional information on security patch releases. See below for information on how Pinniped distributors or vendors can apply to join this list.
+
+## Early Disclosure to Pinniped Distributors List
+
+The private list is intended to be used primarily to provide actionable information to multiple distributor projects at once. This list is not intended to inform individuals about security issues.
+
+## Membership Criteria
+
+To be eligible to join the [Pinniped Distributors](https://groups.google.com/g/project-pinniped-distributors) mailing list, you should:
+
+1. Be an active distributor of Pinniped.
+2. Have a user base that is not limited to your own organization.
+3. Have a publicly verifiable track record up to the present day of fixing security issues.
+4. Not be a downstream or rebuild of another distributor.
+5. Be a participant and active contributor in the Pinniped community.
+6. Accept the Embargo Policy that is outlined below.
+7. Have someone who is already on the list vouch for the person requesting membership on behalf of your distribution.
+
+**The terms and conditions of the Embargo Policy apply to all members of this mailing list. A request for membership represents your acceptance to the terms and conditions of the Embargo Policy.**
+
+## Embargo Policy
+
+The information that members receive on the Pinniped Distributors mailing list must not be made public, shared, or even hinted at anywhere beyond those who need to know within your specific team, unless you receive explicit approval to do so from the VMware Security Team. This remains true until the public disclosure date/time agreed upon by the list. Members of the list and others cannot use the information for any reason other than to get the issue fixed for your respective distribution's users.
+
+Before you share any information from the list with members of your team who are required to fix the issue, these team members must agree to the same terms, and only be provided with information on a need-to-know basis.
+
+In the unfortunate event that you share information beyond what is permitted by this policy, you must urgently inform the VMware Security Team (security@vmware.com) of exactly what information was leaked and to whom. If you continue to leak information and break the policy outlined here, you will be permanently removed from the list.
+
+## Requesting to Join
+
+Send new membership requests to https://groups.google.com/g/project-pinniped-distributors. In the body of your request please specify how you qualify for membership and fulfill each criterion listed in the Membership Criteria section above.
+
+## Confidentiality, integrity and availability
+
+We consider vulnerabilities leading to the compromise of data confidentiality, elevation of privilege, or integrity to be our highest priority concerns. Availability, in particular in areas relating to DoS and resource exhaustion, is also a serious security concern. The VMware Security Team takes all vulnerabilities, potential vulnerabilities, and suspected vulnerabilities seriously and will investigate them in an urgent and expeditious manner.

apis/concierge/authentication/doc.go.tmpl

@@ -1,8 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:deepcopy-gen=package
-// +groupName=authentication.concierge.pinniped.dev
-
-// Package authentication is the internal version of the Pinniped concierge authentication API.
-package authentication

apis/concierge/authentication/v1alpha1/defaults.go.tmpl

@@ -1,12 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func addDefaultingFuncs(scheme *runtime.Scheme) error {
-	return RegisterDefaults(scheme)
-}

apis/concierge/authentication/v1alpha1/doc.go.tmpl

@@ -3,7 +3,6 @@
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/authentication
 // +k8s:defaulter-gen=TypeMeta
 // +groupName=authentication.concierge.pinniped.dev
 

apis/concierge/authentication/v1alpha1/register.go.tmpl

@@ -24,7 +24,7 @@ func init() {
 	// We only register manually written functions here. The registration of the
 	// generated functions takes place in the generated files. The separation
 	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+	localSchemeBuilder.Register(addKnownTypes)
 }
 
 // Adds the list of known types to the given scheme.
@@ -32,6 +32,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&WebhookAuthenticator{},
 		&WebhookAuthenticatorList{},
+		&JWTAuthenticator{},
+		&JWTAuthenticatorList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

apis/concierge/authentication/v1alpha1/types_jwt.go.tmpl

@@ -0,0 +1,83 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// Status of a JWT authenticator.
+type JWTAuthenticatorStatus struct {
+	// Represents the observations of the authenticator's current state.
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	Conditions []Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+}
+
+// Spec for configuring a JWT authenticator.
+type JWTAuthenticatorSpec struct {
+	// Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
+	// also used to validate the "iss" JWT claim.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^https://`
+	Issuer string `json:"issuer"`
+
+	// Audience is the required value of the "aud" JWT claim.
+	// +kubebuilder:validation:MinLength=1
+	Audience string `json:"audience"`
+
+	// Claims allows customization of the claims that will be mapped to user identity
+	// for Kubernetes access.
+	// +optional
+	Claims JWTTokenClaims `json:"claims"`
+
+	// TLS configuration for communicating with the OIDC provider.
+	// +optional
+	TLS *TLSSpec `json:"tls,omitempty"`
+}
+
+// JWTTokenClaims allows customization of the claims that will be mapped to user identity
+// for Kubernetes access.
+type JWTTokenClaims struct {
+	// Groups is the name of the claim which should be read to extract the user's
+	// group membership from the JWT token. When not specified, it will default to "groups".
+	// +optional
+	Groups string `json:"groups"`
+
+	// Username is the name of the claim which should be read to extract the
+	// username from the JWT token. When not specified, it will default to "username".
+	// +optional
+	Username string `json:"username"`
+}
+
+// JWTAuthenticator describes the configuration of a JWT authenticator.
+//
+// Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
+// signature, existence of claims, etc.) and extract the username and groups from the token.
+//
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
+// +kubebuilder:printcolumn:name="Issuer",type=string,JSONPath=`.spec.issuer`
+// +kubebuilder:subresource:status
+type JWTAuthenticator struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec for configuring the authenticator.
+	Spec JWTAuthenticatorSpec `json:"spec"`
+
+	// Status of the authenticator.
+	Status JWTAuthenticatorStatus `json:"status,omitempty"`
+}
+
+// List of JWTAuthenticator objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type JWTAuthenticatorList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []JWTAuthenticator `json:"items"`
+}

apis/concierge/authentication/v1alpha1/types_webhook.go.tmpl

@@ -29,9 +29,11 @@ type WebhookAuthenticatorSpec struct {
 
 // WebhookAuthenticator describes the configuration of a webhook authenticator.
 // +genclient
+// +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:resource:categories=all;authenticator;authenticators
+// +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
 // +kubebuilder:printcolumn:name="Endpoint",type=string,JSONPath=`.spec.endpoint`
+// +kubebuilder:subresource:status
 type WebhookAuthenticator struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`

apis/concierge/config/doc.go.tmpl

@@ -1,8 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:deepcopy-gen=package
-// +groupName=config.concierge.pinniped.dev
-
-// Package config is the internal version of the Pinniped concierge configuration API.
-package config

apis/concierge/config/types.go.tmpl

@@ -1,4 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package config

apis/concierge/config/v1alpha1/defaults.go.tmpl

@@ -1,12 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func addDefaultingFuncs(scheme *runtime.Scheme) error {
-	return RegisterDefaults(scheme)
-}

apis/concierge/config/v1alpha1/doc.go.tmpl

@@ -3,7 +3,6 @@
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/config
 // +k8s:defaulter-gen=TypeMeta
 // +groupName=config.concierge.pinniped.dev
 

apis/concierge/config/v1alpha1/register.go.tmpl

@@ -24,7 +24,7 @@ func init() {
 	// We only register manually written functions here. The registration of the
 	// generated functions takes place in the generated files. The separation
 	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+	localSchemeBuilder.Register(addKnownTypes)
 }
 
 // Adds the list of known types to the given scheme.

apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl

@@ -67,19 +67,21 @@ type CredentialIssuerStrategy struct {
 
 // Describes the configuration status of a Pinniped credential issuer.
 // +genclient
+// +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
+// +kubebuilder:resource:categories=pinniped,scope=Cluster
+// +kubebuilder:subresource:status
 type CredentialIssuer struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
 	// Status of the credential issuer.
+	// +optional
 	Status CredentialIssuerStatus `json:"status"`
 }
 
 // List of CredentialIssuer objects.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
 type CredentialIssuerList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`

apis/concierge/login/types_token.go.tmpl

@@ -27,7 +27,6 @@ type TokenCredentialRequestStatus struct {
 }
 
 // TokenCredentialRequest submits an IDP-specific credential to Pinniped in exchange for a cluster-specific credential.
-// +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type TokenCredentialRequest struct {
 	metav1.TypeMeta

apis/concierge/login/v1alpha1/types_token.go.tmpl

@@ -30,6 +30,7 @@ type TokenCredentialRequestStatus struct {
 
 // TokenCredentialRequest submits an IDP-specific credential to Pinniped in exchange for a cluster-specific credential.
 // +genclient
+// +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type TokenCredentialRequest struct {
 	metav1.TypeMeta   `json:",inline"`

apis/supervisor/config/doc.go.tmpl

@@ -1,8 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:deepcopy-gen=package
-// +groupName=config.supervisor.pinniped.dev
-
-// Package config is the internal version of the Pinniped configuration API.
-package config

apis/supervisor/config/types.go.tmpl

@@ -1,4 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package config

apis/supervisor/config/v1alpha1/defaults.go.tmpl

@@ -1,12 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func addDefaultingFuncs(scheme *runtime.Scheme) error {
-	return RegisterDefaults(scheme)
-}

apis/supervisor/config/v1alpha1/register.go.tmpl

@@ -24,14 +24,14 @@ func init() {
 	// We only register manually written functions here. The registration of the
 	// generated functions takes place in the generated files. The separation
 	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+	localSchemeBuilder.Register(addKnownTypes)
 }
 
 // Adds the list of known types to the given scheme.
 func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
-		&OIDCProvider{},
-		&OIDCProviderList{},
+		&FederationDomain{},
+		&FederationDomainList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

apis/supervisor/config/v1alpha1/types_federationdomain.go.tmpl

@@ -8,20 +8,20 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// +kubebuilder:validation:Enum=Success;Duplicate;Invalid
-type OIDCProviderStatusCondition string
+// +kubebuilder:validation:Enum=Success;Duplicate;Invalid;SameIssuerHostMustUseSameSecret
+type FederationDomainStatusCondition string
 
 const (
-	SuccessOIDCProviderStatusCondition                         = OIDCProviderStatusCondition("Success")
-	DuplicateOIDCProviderStatusCondition                       = OIDCProviderStatusCondition("Duplicate")
-	SameIssuerHostMustUseSameSecretOIDCProviderStatusCondition = OIDCProviderStatusCondition("SameIssuerHostMustUseSameSecret")
-	InvalidOIDCProviderStatusCondition                         = OIDCProviderStatusCondition("Invalid")
+	SuccessFederationDomainStatusCondition                         = FederationDomainStatusCondition("Success")
+	DuplicateFederationDomainStatusCondition                       = FederationDomainStatusCondition("Duplicate")
+	SameIssuerHostMustUseSameSecretFederationDomainStatusCondition = FederationDomainStatusCondition("SameIssuerHostMustUseSameSecret")
+	InvalidFederationDomainStatusCondition                         = FederationDomainStatusCondition("Invalid")
 )
 
-// OIDCProviderTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
-type OIDCProviderTLSSpec struct {
+// FederationDomainTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
+type FederationDomainTLSSpec struct {
 	// SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains
-	// the TLS serving certificate for the HTTPS endpoints served by this OIDCProvider. When provided, the TLS Secret
+	// the TLS serving certificate for the HTTPS endpoints served by this FederationDomain. When provided, the TLS Secret
 	// named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use
 	// for TLS.
 	//
@@ -41,8 +41,8 @@ type OIDCProviderTLSSpec struct {
 	SecretName string `json:"secretName,omitempty"`
 }
 
-// OIDCProviderSpec is a struct that describes an OIDC Provider.
-type OIDCProviderSpec struct {
+// FederationDomainSpec is a struct that describes an OIDC Provider.
+type FederationDomainSpec struct {
 	// Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the
 	// identifier that it will use for the iss claim in issued JWTs. This field will also be used as
 	// the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is
@@ -54,17 +54,41 @@ type OIDCProviderSpec struct {
 	// +kubebuilder:validation:MinLength=1
 	Issuer string `json:"issuer"`
 
-	// TLS configures how this OIDCProvider is served over Transport Layer Security (TLS).
+	// TLS configures how this FederationDomain is served over Transport Layer Security (TLS).
 	// +optional
-	TLS *OIDCProviderTLSSpec `json:"tls,omitempty"`
+	TLS *FederationDomainTLSSpec `json:"tls,omitempty"`
 }
 
-// OIDCProviderStatus is a struct that describes the actual state of an OIDC Provider.
-type OIDCProviderStatus struct {
+// FederationDomainSecrets holds information about this OIDC Provider's secrets.
+type FederationDomainSecrets struct {
+	// JWKS holds the name of the corev1.Secret in which this OIDC Provider's signing/verification keys are
+	// stored. If it is empty, then the signing/verification keys are either unknown or they don't
+	// exist.
+	// +optional
+	JWKS corev1.LocalObjectReference `json:"jwks,omitempty"`
+
+	// TokenSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
+	// signing tokens is stored.
+	// +optional
+	TokenSigningKey corev1.LocalObjectReference `json:"tokenSigningKey,omitempty"`
+
+	// StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
+	// signing state parameters is stored.
+	// +optional
+	StateSigningKey corev1.LocalObjectReference `json:"stateSigningKey,omitempty"`
+
+	// StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
+	// encrypting state parameters is stored.
+	// +optional
+	StateEncryptionKey corev1.LocalObjectReference `json:"stateEncryptionKey,omitempty"`
+}
+
+// FederationDomainStatus is a struct that describes the actual state of an OIDC Provider.
+type FederationDomainStatus struct {
 	// Status holds an enum that describes the state of this OIDC Provider. Note that this Status can
 	// represent success or failure.
 	// +optional
-	Status OIDCProviderStatusCondition `json:"status,omitempty"`
+	Status FederationDomainStatusCondition `json:"status,omitempty"`
 
 	// Message provides human-readable details about the Status.
 	// +optional
@@ -76,32 +100,32 @@ type OIDCProviderStatus struct {
 	// +optional
 	LastUpdateTime *metav1.Time `json:"lastUpdateTime,omitempty"`
 
-	// JWKSSecret holds the name of the secret in which this OIDC Provider's signing/verification keys
-	// are stored. If it is empty, then the signing/verification keys are either unknown or they don't
-	// exist.
+	// Secrets contains information about this OIDC Provider's secrets.
 	// +optional
-	JWKSSecret corev1.LocalObjectReference `json:"jwksSecret,omitempty"`
+	Secrets FederationDomainSecrets `json:"secrets,omitempty"`
 }
 
-// OIDCProvider describes the configuration of an OIDC provider.
+// FederationDomain describes the configuration of an OIDC provider.
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type OIDCProvider struct {
+// +kubebuilder:resource:categories=pinniped
+// +kubebuilder:subresource:status
+type FederationDomain struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
 	// Spec of the OIDC provider.
-	Spec OIDCProviderSpec `json:"spec"`
+	Spec FederationDomainSpec `json:"spec"`
 
 	// Status of the OIDC provider.
-	Status OIDCProviderStatus `json:"status,omitempty"`
+	Status FederationDomainStatus `json:"status,omitempty"`
 }
 
-// List of OIDCProvider objects.
+// List of FederationDomain objects.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type OIDCProviderList struct {
+type FederationDomainList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`
 
-	Items []OIDCProvider `json:"items"`
+	Items []FederationDomain `json:"items"`
 }

apis/supervisor/idp/v1alpha1/doc.go.tmpl

@@ -0,0 +1,11 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=idp.supervisor.pinniped.dev
+// +groupGoName=IDP
+
+// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor identity provider (IDP) API.
+package v1alpha1

apis/supervisor/idp/v1alpha1/register.go.tmpl

@@ -0,0 +1,43 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const GroupName = "idp.supervisor.pinniped.dev"
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+var (
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&OIDCIdentityProvider{},
+		&OIDCIdentityProviderList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource.
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}

apis/supervisor/idp/v1alpha1/types_meta.go.tmpl

@@ -0,0 +1,75 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// ConditionStatus is effectively an enum type for Condition.Status.
+type ConditionStatus string
+
+// These are valid condition statuses. "ConditionTrue" means a resource is in the condition.
+// "ConditionFalse" means a resource is not in the condition. "ConditionUnknown" means kubernetes
+// can't decide if a resource is in the condition or not. In the future, we could add other
+// intermediate conditions, e.g. ConditionDegraded.
+const (
+	ConditionTrue    ConditionStatus = "True"
+	ConditionFalse   ConditionStatus = "False"
+	ConditionUnknown ConditionStatus = "Unknown"
+)
+
+// Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API
+// version we can switch to using the upstream type.
+// See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
+type Condition struct {
+	// type of condition in CamelCase or in foo.example.com/CamelCase.
+	// ---
+	// Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+	// useful (see .node.status.conditions), the ability to deconflict is important.
+	// The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
+	// +kubebuilder:validation:MaxLength=316
+	Type string `json:"type"`
+
+	// status of the condition, one of True, False, Unknown.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=True;False;Unknown
+	Status ConditionStatus `json:"status"`
+
+	// observedGeneration represents the .metadata.generation that the condition was set based upon.
+	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+	// with respect to the current state of the instance.
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// lastTransitionTime is the last time the condition transitioned from one status to another.
+	// This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Type=string
+	// +kubebuilder:validation:Format=date-time
+	LastTransitionTime metav1.Time `json:"lastTransitionTime"`
+
+	// reason contains a programmatic identifier indicating the reason for the condition's last transition.
+	// Producers of specific condition types may define expected values and meanings for this field,
+	// and whether the values are considered a guaranteed API.
+	// The value should be a CamelCase string.
+	// This field may not be empty.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=1024
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+	Reason string `json:"reason"`
+
+	// message is a human readable message indicating details about the transition.
+	// This may be an empty string.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=32768
+	Message string `json:"message"`
+}

apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go.tmpl

@@ -0,0 +1,123 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type OIDCIdentityProviderPhase string
+
+const (
+	// PhasePending is the default phase for newly-created OIDCIdentityProvider resources.
+	PhasePending OIDCIdentityProviderPhase = "Pending"
+
+	// PhaseReady is the phase for an OIDCIdentityProvider resource in a healthy state.
+	PhaseReady OIDCIdentityProviderPhase = "Ready"
+
+	// PhaseError is the phase for an OIDCIdentityProvider in an unhealthy state.
+	PhaseError OIDCIdentityProviderPhase = "Error"
+)
+
+// Status of an OIDC identity provider.
+type OIDCIdentityProviderStatus struct {
+	// Phase summarizes the overall status of the OIDCIdentityProvider.
+	// +kubebuilder:default=Pending
+	// +kubebuilder:validation:Enum=Pending;Ready;Error
+	Phase OIDCIdentityProviderPhase `json:"phase,omitempty"`
+
+	// Represents the observations of an identity provider's current state.
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	Conditions []Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+}
+
+// OIDCAuthorizationConfig provides information about how to form the OAuth2 authorization
+// request parameters.
+type OIDCAuthorizationConfig struct {
+	// AdditionalScopes are the scopes in addition to "openid" that will be requested as part of the authorization
+	// request flow with an OIDC identity provider. By default only the "openid" scope will be requested.
+	// +optional
+	AdditionalScopes []string `json:"additionalScopes,omitempty"`
+}
+
+// OIDCClaims provides a mapping from upstream claims into identities.
+type OIDCClaims struct {
+	// Groups provides the name of the token claim that will be used to ascertain the groups to which
+	// an identity belongs.
+	// +optional
+	Groups string `json:"groups"`
+
+	// Username provides the name of the token claim that will be used to ascertain an identity's
+	// username.
+	// +optional
+	Username string `json:"username"`
+}
+
+// OIDCClient contains information about an OIDC client (e.g., client ID and client
+// secret).
+type OIDCClient struct {
+	// SecretName contains the name of a namespace-local Secret object that provides the clientID and
+	// clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient
+	// struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys
+	// "clientID" and "clientSecret".
+	SecretName string `json:"secretName"`
+}
+
+// Spec for configuring an OIDC identity provider.
+type OIDCIdentityProviderSpec struct {
+	// Issuer is the issuer URL of this OIDC identity provider, i.e., where to fetch
+	// /.well-known/openid-configuration.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^https://`
+	Issuer string `json:"issuer"`
+
+	// TLS configuration for discovery/JWKS requests to the issuer.
+	// +optional
+	TLS *TLSSpec `json:"tls,omitempty"`
+
+	// AuthorizationConfig holds information about how to form the OAuth2 authorization request
+	// parameters to be used with this OIDC identity provider.
+	// +optional
+	AuthorizationConfig OIDCAuthorizationConfig `json:"authorizationConfig,omitempty"`
+
+	// Claims provides the names of token claims that will be used when inspecting an identity from
+	// this OIDC identity provider.
+	// +optional
+	Claims OIDCClaims `json:"claims"`
+
+	// OIDCClient contains OIDC client information to be used used with this OIDC identity
+	// provider.
+	Client OIDCClient `json:"client"`
+}
+
+// OIDCIdentityProvider describes the configuration of an upstream OpenID Connect identity provider.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=pinniped;pinniped-idp;pinniped-idps
+// +kubebuilder:printcolumn:name="Issuer",type=string,JSONPath=`.spec.issuer`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+// +kubebuilder:subresource:status
+type OIDCIdentityProvider struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec for configuring the identity provider.
+	Spec OIDCIdentityProviderSpec `json:"spec"`
+
+	// Status of the identity provider.
+	Status OIDCIdentityProviderStatus `json:"status,omitempty"`
+}
+
+// List of OIDCIdentityProvider objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type OIDCIdentityProviderList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []OIDCIdentityProvider `json:"items"`
+}

apis/supervisor/idp/v1alpha1/types_tls.go.tmpl

@@ -0,0 +1,11 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+// Configuration for TLS parameters related to identity provider integration.
+type TLSSpec struct {
+	// X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
+	// +optional
+	CertificateAuthorityData string `json:"certificateAuthorityData,omitempty"`
+}

cmd/local-user-authenticator/main.go

@@ -1,4 +1,4 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // Package main provides a authentication webhook program.
@@ -31,13 +31,14 @@ import (
 	kubeinformers "k8s.io/client-go/informers"
 	corev1informers "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/kubernetes"
-	restclient "k8s.io/client-go/rest"
 	"k8s.io/klog/v2"
 
 	"go.pinniped.dev/internal/constable"
 	"go.pinniped.dev/internal/controller/apicerts"
 	"go.pinniped.dev/internal/controllerlib"
 	"go.pinniped.dev/internal/dynamiccert"
+	"go.pinniped.dev/internal/kubeclient"
+	"go.pinniped.dev/internal/plog"
 )
 
 const (
@@ -92,11 +93,11 @@ func (w *webhook) start(ctx context.Context, l net.Listener) error {
 	go func() {
 		select {
 		case err := <-errCh:
-			klog.InfoS("server exited", "err", err)
+			plog.Debug("server exited", "err", err)
 		case <-ctx.Done():
-			klog.InfoS("server context cancelled", "err", ctx.Err())
+			plog.Debug("server context cancelled", "err", ctx.Err())
 			if err := server.Shutdown(context.Background()); err != nil {
-				klog.InfoS("server shutdown failed", "err", err)
+				plog.Debug("server shutdown failed", "err", err)
 			}
 		}
 	}()
@@ -114,13 +115,13 @@ func (w *webhook) ServeHTTP(rsp http.ResponseWriter, req *http.Request) {
 	secret, err := w.secretInformer.Lister().Secrets(namespace).Get(username)
 	notFound := k8serrors.IsNotFound(err)
 	if err != nil && !notFound {
-		klog.InfoS("could not get secret", "err", err)
+		plog.Debug("could not get secret", "err", err)
 		rsp.WriteHeader(http.StatusInternalServerError)
 		return
 	}
 
 	if notFound {
-		klog.InfoS("user not found")
+		plog.Debug("user not found")
 		respondWithUnauthenticated(rsp)
 		return
 	}
@@ -130,7 +131,7 @@ func (w *webhook) ServeHTTP(rsp http.ResponseWriter, req *http.Request) {
 		[]byte(password),
 	) == nil
 	if !passwordMatches {
-		klog.InfoS("authentication failed: wrong password")
+		plog.Debug("authentication failed: wrong password")
 		respondWithUnauthenticated(rsp)
 		return
 	}
@@ -141,32 +142,32 @@ func (w *webhook) ServeHTTP(rsp http.ResponseWriter, req *http.Request) {
 		groupsCSVReader := csv.NewReader(groupsBuf)
 		groups, err = groupsCSVReader.Read()
 		if err != nil {
-			klog.InfoS("could not read groups", "err", err)
+			plog.Debug("could not read groups", "err", err)
 			rsp.WriteHeader(http.StatusInternalServerError)
 			return
 		}
 		trimLeadingAndTrailingWhitespace(groups)
 	}
 
-	klog.InfoS("successful authentication")
+	plog.Debug("successful authentication")
 	respondWithAuthenticated(rsp, secret.ObjectMeta.Name, string(secret.UID), groups)
 }
 
 func getUsernameAndPasswordFromRequest(rsp http.ResponseWriter, req *http.Request) (string, string, error) {
 	if req.URL.Path != "/authenticate" {
-		klog.InfoS("received request path other than /authenticate", "path", req.URL.Path)
+		plog.Debug("received request path other than /authenticate", "path", req.URL.Path)
 		rsp.WriteHeader(http.StatusNotFound)
 		return "", "", invalidRequest
 	}
 
 	if req.Method != http.MethodPost {
-		klog.InfoS("received request method other than post", "method", req.Method)
+		plog.Debug("received request method other than post", "method", req.Method)
 		rsp.WriteHeader(http.StatusMethodNotAllowed)
 		return "", "", invalidRequest
 	}
 
 	if !headerContains(req, "Content-Type", "application/json") {
-		klog.InfoS("content type is not application/json", "Content-Type", req.Header.Values("Content-Type"))
+		plog.Debug("content type is not application/json", "Content-Type", req.Header.Values("Content-Type"))
 		rsp.WriteHeader(http.StatusUnsupportedMediaType)
 		return "", "", invalidRequest
 	}
@@ -174,39 +175,39 @@ func getUsernameAndPasswordFromRequest(rsp http.ResponseWriter, req *http.Reques
 	if !headerContains(req, "Accept", "application/json") &&
 		!headerContains(req, "Accept", "application/*") &&
 		!headerContains(req, "Accept", "*/*") {
-		klog.InfoS("client does not accept application/json", "Accept", req.Header.Values("Accept"))
+		plog.Debug("client does not accept application/json", "Accept", req.Header.Values("Accept"))
 		rsp.WriteHeader(http.StatusUnsupportedMediaType)
 		return "", "", invalidRequest
 	}
 
 	if req.Body == nil {
-		klog.InfoS("invalid nil body")
+		plog.Debug("invalid nil body")
 		rsp.WriteHeader(http.StatusBadRequest)
 		return "", "", invalidRequest
 	}
 
 	var body authenticationv1beta1.TokenReview
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		klog.InfoS("failed to decode body", "err", err)
+		plog.Debug("failed to decode body", "err", err)
 		rsp.WriteHeader(http.StatusBadRequest)
 		return "", "", invalidRequest
 	}
 
 	if body.APIVersion != authenticationv1beta1.SchemeGroupVersion.String() {
-		klog.InfoS("invalid TokenReview apiVersion", "apiVersion", body.APIVersion)
+		plog.Debug("invalid TokenReview apiVersion", "apiVersion", body.APIVersion)
 		rsp.WriteHeader(http.StatusBadRequest)
 		return "", "", invalidRequest
 	}
 
 	if body.Kind != "TokenReview" {
-		klog.InfoS("invalid TokenReview kind", "kind", body.Kind)
+		plog.Debug("invalid TokenReview kind", "kind", body.Kind)
 		rsp.WriteHeader(http.StatusBadRequest)
 		return "", "", invalidRequest
 	}
 
 	tokenSegments := strings.SplitN(body.Spec.Token, ":", 2)
 	if len(tokenSegments) != 2 {
-		klog.InfoS("bad token format in request")
+		plog.Debug("bad token format in request")
 		rsp.WriteHeader(http.StatusBadRequest)
 		return "", "", invalidRequest
 	}
@@ -247,7 +248,7 @@ func respondWithUnauthenticated(rsp http.ResponseWriter) {
 		},
 	}
 	if err := json.NewEncoder(rsp).Encode(body); err != nil {
-		klog.InfoS("could not encode response", "err", err)
+		plog.Debug("could not encode response", "err", err)
 		rsp.WriteHeader(http.StatusInternalServerError)
 	}
 }
@@ -273,26 +274,11 @@ func respondWithAuthenticated(
 		},
 	}
 	if err := json.NewEncoder(rsp).Encode(body); err != nil {
-		klog.InfoS("could not encode response", "err", err)
+		plog.Debug("could not encode response", "err", err)
 		rsp.WriteHeader(http.StatusInternalServerError)
 	}
 }
 
-func newK8sClient() (kubernetes.Interface, error) {
-	kubeConfig, err := restclient.InClusterConfig()
-	if err != nil {
-		return nil, fmt.Errorf("could not load in-cluster configuration: %w", err)
-	}
-
-	// Connect to the core Kubernetes API.
-	kubeClient, err := kubernetes.NewForConfig(kubeConfig)
-	if err != nil {
-		return nil, fmt.Errorf("could not load in-cluster configuration: %w", err)
-	}
-
-	return kubeClient, nil
-}
-
 func startControllers(
 	ctx context.Context,
 	dynamicCertProvider dynamiccert.Provider,
@@ -358,21 +344,21 @@ func run() error {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kubeClient, err := newK8sClient()
+	client, err := kubeclient.New()
 	if err != nil {
 		return fmt.Errorf("cannot create k8s client: %w", err)
 	}
 
 	kubeInformers := kubeinformers.NewSharedInformerFactoryWithOptions(
-		kubeClient,
+		client.Kubernetes,
 		defaultResyncInterval,
 		kubeinformers.WithNamespace(namespace),
 	)
 
 	dynamicCertProvider := dynamiccert.New()
 
-	startControllers(ctx, dynamicCertProvider, kubeClient, kubeInformers)
-	klog.InfoS("controllers are ready")
+	startControllers(ctx, dynamicCertProvider, client.Kubernetes, kubeInformers)
+	plog.Debug("controllers are ready")
 
 	//nolint: gosec // Intentionally binding to all network interfaces.
 	l, err := net.Listen("tcp", ":8443")
@@ -385,15 +371,20 @@ func run() error {
 	if err != nil {
 		return fmt.Errorf("cannot start webhook: %w", err)
 	}
-	klog.InfoS("webhook is ready", "address", l.Addr().String())
+	plog.Debug("webhook is ready", "address", l.Addr().String())
 
 	gotSignal := waitForSignal()
-	klog.InfoS("webhook exiting", "signal", gotSignal)
+	plog.Debug("webhook exiting", "signal", gotSignal)
 
 	return nil
 }
 
 func main() {
+	// Hardcode the logging level to debug, since this is a test app and it is very helpful to have
+	// verbose logs to debug test failures.
+	if err := plog.ValidateAndSetLogLevelGlobally(plog.LevelDebug); err != nil {
+		klog.Fatal(err)
+	}
 	if err := run(); err != nil {
 		klog.Fatal(err)
 	}

cmd/pinniped-supervisor/main.go

@@ -1,10 +1,11 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package main
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/tls"
 	"fmt"
 	"net"
@@ -14,24 +15,35 @@ import (
 	"strings"
 	"time"
 
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/util/clock"
 	kubeinformers "k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/pkg/version"
 	"k8s.io/client-go/rest"
-	restclient "k8s.io/client-go/rest"
 	"k8s.io/component-base/logs"
 	"k8s.io/klog/v2"
+	"k8s.io/klog/v2/klogr"
 
-	pinnipedclientset "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned"
-	pinnipedinformers "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions"
+	configv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/config/v1alpha1"
+	pinnipedclientset "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned"
+	pinnipedinformers "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions"
 	"go.pinniped.dev/internal/config/supervisor"
 	"go.pinniped.dev/internal/controller/supervisorconfig"
+	"go.pinniped.dev/internal/controller/supervisorconfig/generator"
+	"go.pinniped.dev/internal/controller/supervisorconfig/upstreamwatcher"
+	"go.pinniped.dev/internal/controller/supervisorstorage"
 	"go.pinniped.dev/internal/controllerlib"
+	"go.pinniped.dev/internal/deploymentref"
 	"go.pinniped.dev/internal/downward"
+	"go.pinniped.dev/internal/groupsuffix"
+	"go.pinniped.dev/internal/kubeclient"
 	"go.pinniped.dev/internal/oidc/jwks"
 	"go.pinniped.dev/internal/oidc/provider"
 	"go.pinniped.dev/internal/oidc/provider/manager"
+	"go.pinniped.dev/internal/plog"
+	"go.pinniped.dev/internal/secret"
 )
 
 const (
@@ -50,11 +62,11 @@ func start(ctx context.Context, l net.Listener, handler http.Handler) {
 	go func() {
 		select {
 		case err := <-errCh:
-			klog.InfoS("server exited", "err", err)
+			plog.Debug("server exited", "err", err)
 		case <-ctx.Done():
-			klog.InfoS("server context cancelled", "err", ctx.Err())
+			plog.Debug("server context cancelled", "err", ctx.Err())
 			if err := server.Shutdown(context.Background()); err != nil {
-				klog.InfoS("server shutdown failed", "err", err)
+				plog.Debug("server shutdown failed", "err", err)
 			}
 		}
 	}()
@@ -66,26 +78,42 @@ func waitForSignal() os.Signal {
 	return <-signalCh
 }
 
+//nolint:funlen
 func startControllers(
 	ctx context.Context,
 	cfg *supervisor.Config,
 	issuerManager *manager.Manager,
 	dynamicJWKSProvider jwks.DynamicJWKSProvider,
 	dynamicTLSCertProvider provider.DynamicTLSCertProvider,
+	dynamicUpstreamIDPProvider provider.DynamicUpstreamIDPProvider,
+	secretCache *secret.Cache,
+	supervisorDeployment *appsv1.Deployment,
 	kubeClient kubernetes.Interface,
 	pinnipedClient pinnipedclientset.Interface,
 	kubeInformers kubeinformers.SharedInformerFactory,
 	pinnipedInformers pinnipedinformers.SharedInformerFactory,
 ) {
+	federationDomainInformer := pinnipedInformers.Config().V1alpha1().FederationDomains()
+	secretInformer := kubeInformers.Core().V1().Secrets()
+
 	// Create controller manager.
 	controllerManager := controllerlib.
 		NewManager().
 		WithController(
-			supervisorconfig.NewOIDCProviderWatcherController(
+			supervisorstorage.GarbageCollectorController(
+				clock.RealClock{},
+				kubeClient,
+				secretInformer,
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		).
+		WithController(
+			supervisorconfig.NewFederationDomainWatcherController(
 				issuerManager,
 				clock.RealClock{},
 				pinnipedClient,
-				pinnipedInformers.Config().V1alpha1().OIDCProviders(),
+				federationDomainInformer,
 				controllerlib.WithInformer,
 			),
 			singletonWorker,
@@ -95,8 +123,8 @@ func startControllers(
 				cfg.Labels,
 				kubeClient,
 				pinnipedClient,
-				kubeInformers.Core().V1().Secrets(),
-				pinnipedInformers.Config().V1alpha1().OIDCProviders(),
+				secretInformer,
+				federationDomainInformer,
 				controllerlib.WithInformer,
 			),
 			singletonWorker,
@@ -104,8 +132,8 @@ func startControllers(
 		WithController(
 			supervisorconfig.NewJWKSObserverController(
 				dynamicJWKSProvider,
-				kubeInformers.Core().V1().Secrets(),
-				pinnipedInformers.Config().V1alpha1().OIDCProviders(),
+				secretInformer,
+				federationDomainInformer,
 				controllerlib.WithInformer,
 			),
 			singletonWorker,
@@ -114,12 +142,106 @@ func startControllers(
 			supervisorconfig.NewTLSCertObserverController(
 				dynamicTLSCertProvider,
 				cfg.NamesConfig.DefaultTLSCertificateSecret,
-				kubeInformers.Core().V1().Secrets(),
-				pinnipedInformers.Config().V1alpha1().OIDCProviders(),
+				secretInformer,
+				federationDomainInformer,
 				controllerlib.WithInformer,
 			),
 			singletonWorker,
-		)
+		).
+		WithController(
+			generator.NewSupervisorSecretsController(
+				supervisorDeployment,
+				cfg.Labels,
+				kubeClient,
+				secretInformer,
+				func(secret []byte) {
+					plog.Debug("setting csrf cookie secret")
+					secretCache.SetCSRFCookieEncoderHashKey(secret)
+				},
+				controllerlib.WithInformer,
+				controllerlib.WithInitialEvent,
+			),
+			singletonWorker,
+		).
+		WithController(
+			generator.NewFederationDomainSecretsController(
+				generator.NewSymmetricSecretHelper(
+					"pinniped-oidc-provider-hmac-key-",
+					cfg.Labels,
+					rand.Reader,
+					generator.SecretUsageTokenSigningKey,
+					func(federationDomainIssuer string, symmetricKey []byte) {
+						plog.Debug("setting hmac secret", "issuer", federationDomainIssuer)
+						secretCache.SetTokenHMACKey(federationDomainIssuer, symmetricKey)
+					},
+				),
+				func(fd *configv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference {
+					return &fd.Secrets.TokenSigningKey
+				},
+				kubeClient,
+				pinnipedClient,
+				secretInformer,
+				federationDomainInformer,
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		).
+		WithController(
+			generator.NewFederationDomainSecretsController(
+				generator.NewSymmetricSecretHelper(
+					"pinniped-oidc-provider-upstream-state-signature-key-",
+					cfg.Labels,
+					rand.Reader,
+					generator.SecretUsageStateSigningKey,
+					func(federationDomainIssuer string, symmetricKey []byte) {
+						plog.Debug("setting state signature key", "issuer", federationDomainIssuer)
+						secretCache.SetStateEncoderHashKey(federationDomainIssuer, symmetricKey)
+					},
+				),
+				func(fd *configv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference {
+					return &fd.Secrets.StateSigningKey
+				},
+				kubeClient,
+				pinnipedClient,
+				secretInformer,
+				federationDomainInformer,
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		).
+		WithController(
+			generator.NewFederationDomainSecretsController(
+				generator.NewSymmetricSecretHelper(
+					"pinniped-oidc-provider-upstream-state-encryption-key-",
+					cfg.Labels,
+					rand.Reader,
+					generator.SecretUsageStateEncryptionKey,
+					func(federationDomainIssuer string, symmetricKey []byte) {
+						plog.Debug("setting state encryption key", "issuer", federationDomainIssuer)
+						secretCache.SetStateEncoderBlockKey(federationDomainIssuer, symmetricKey)
+					},
+				),
+				func(fd *configv1alpha1.FederationDomainStatus) *corev1.LocalObjectReference {
+					return &fd.Secrets.StateEncryptionKey
+				},
+				kubeClient,
+				pinnipedClient,
+				secretInformer,
+				federationDomainInformer,
+				controllerlib.WithInformer,
+			),
+			singletonWorker,
+		).
+		WithController(
+			upstreamwatcher.New(
+				dynamicUpstreamIDPProvider,
+				pinnipedClient,
+				pinnipedInformers.IDP().V1alpha1().OIDCIdentityProviders(),
+				secretInformer,
+				klogr.New(),
+				controllerlib.WithInformer,
+			),
+			singletonWorker)
 
 	kubeInformers.Start(ctx.Done())
 	pinnipedInformers.Start(ctx.Done())
@@ -131,44 +253,33 @@ func startControllers(
 	go controllerManager.Start(ctx)
 }
 
-func newClients() (kubernetes.Interface, pinnipedclientset.Interface, error) {
-	kubeConfig, err := restclient.InClusterConfig()
-	if err != nil {
-		return nil, nil, fmt.Errorf("could not load in-cluster configuration: %w", err)
-	}
+func run(podInfo *downward.PodInfo, cfg *supervisor.Config) error {
+	serverInstallationNamespace := podInfo.Namespace
 
-	// Connect to the core Kubernetes API.
-	kubeClient, err := kubernetes.NewForConfig(kubeConfig)
-	if err != nil {
-		return nil, nil, fmt.Errorf("could not create kube client: %w", err)
-	}
-
-	// Connect to the Pinniped API.
-	pinnipedClient, err := pinnipedclientset.NewForConfig(kubeConfig)
-	if err != nil {
-		return nil, nil, fmt.Errorf("could not create pinniped client: %w", err)
-	}
-
-	return kubeClient, pinnipedClient, nil
-}
-
-func run(serverInstallationNamespace string, cfg *supervisor.Config) error {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kubeClient, pinnipedClient, err := newClients()
+	dref, supervisorDeployment, err := deploymentref.New(podInfo)
+	if err != nil {
+		return fmt.Errorf("cannot create deployment ref: %w", err)
+	}
+
+	client, err := kubeclient.New(
+		dref,
+		kubeclient.WithMiddleware(groupsuffix.New(*cfg.APIGroupSuffix)),
+	)
 	if err != nil {
 		return fmt.Errorf("cannot create k8s client: %w", err)
 	}
 
 	kubeInformers := kubeinformers.NewSharedInformerFactoryWithOptions(
-		kubeClient,
+		client.Kubernetes,
 		defaultResyncInterval,
 		kubeinformers.WithNamespace(serverInstallationNamespace),
 	)
 
 	pinnipedInformers := pinnipedinformers.NewSharedInformerFactoryWithOptions(
-		pinnipedClient,
+		client.PinnipedSupervisor,
 		defaultResyncInterval,
 		pinnipedinformers.WithNamespace(serverInstallationNamespace),
 	)
@@ -181,9 +292,17 @@ func run(serverInstallationNamespace string, cfg *supervisor.Config) error {
 
 	dynamicJWKSProvider := jwks.NewDynamicJWKSProvider()
 	dynamicTLSCertProvider := provider.NewDynamicTLSCertProvider()
+	dynamicUpstreamIDPProvider := provider.NewDynamicUpstreamIDPProvider()
+	secretCache := secret.Cache{}
 
 	// OIDC endpoints will be served by the oidProvidersManager, and any non-OIDC paths will fallback to the healthMux.
-	oidProvidersManager := manager.NewManager(healthMux, dynamicJWKSProvider)
+	oidProvidersManager := manager.NewManager(
+		healthMux,
+		dynamicJWKSProvider,
+		dynamicUpstreamIDPProvider,
+		&secretCache,
+		client.Kubernetes.CoreV1().Secrets(serverInstallationNamespace),
+	)
 
 	startControllers(
 		ctx,
@@ -191,8 +310,11 @@ func run(serverInstallationNamespace string, cfg *supervisor.Config) error {
 		oidProvidersManager,
 		dynamicJWKSProvider,
 		dynamicTLSCertProvider,
-		kubeClient,
-		pinnipedClient,
+		dynamicUpstreamIDPProvider,
+		&secretCache,
+		supervisorDeployment,
+		client.Kubernetes,
+		client.PinnipedSupervisor,
 		kubeInformers,
 		pinnipedInformers,
 	)
@@ -211,7 +333,7 @@ func run(serverInstallationNamespace string, cfg *supervisor.Config) error {
 		GetCertificate: func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
 			cert := dynamicTLSCertProvider.GetTLSCert(strings.ToLower(info.ServerName))
 			defaultCert := dynamicTLSCertProvider.GetDefaultTLSCert()
-			klog.InfoS("GetCertificate called for port 8443",
+			plog.Debug("GetCertificate called for port 8443",
 				"info.ServerName", info.ServerName,
 				"foundSNICert", cert != nil,
 				"foundDefaultCert", defaultCert != nil,
@@ -228,13 +350,13 @@ func run(serverInstallationNamespace string, cfg *supervisor.Config) error {
 	defer func() { _ = httpsListener.Close() }()
 	start(ctx, httpsListener, oidProvidersManager)
 
-	klog.InfoS("supervisor is ready",
+	plog.Debug("supervisor is ready",
 		"httpAddress", httpListener.Addr().String(),
 		"httpsAddress", httpsListener.Addr().String(),
 	)
 
 	gotSignal := waitForSignal()
-	klog.InfoS("supervisor exiting", "signal", gotSignal)
+	plog.Debug("supervisor exiting", "signal", gotSignal)
 
 	return nil
 }
@@ -242,6 +364,7 @@ func run(serverInstallationNamespace string, cfg *supervisor.Config) error {
 func main() {
 	logs.InitLogs()
 	defer logs.FlushLogs()
+	plog.RemoveKlogGlobalFlags() // move this whenever the below code gets refactored to use cobra
 
 	klog.Infof("Running %s at %#v", rest.DefaultKubernetesUserAgent(), version.Get())
 	klog.Infof("Command-line arguments were: %s %s %s", os.Args[0], os.Args[1], os.Args[2])
@@ -258,7 +381,7 @@ func main() {
 		klog.Fatal(fmt.Errorf("could not load config: %w", err))
 	}
 
-	if err := run(podInfo.Namespace, cfg); err != nil {
+	if err := run(podInfo, cfg); err != nil {
 		klog.Fatal(err)
 	}
 }

cmd/pinniped/cmd/cobra_util.go

@@ -22,3 +22,9 @@ func mustMarkHidden(cmd *cobra.Command, flags ...string) {
 		}
 	}
 }
+
+func mustMarkDeprecated(cmd *cobra.Command, flag, usageMessage string) {
+	if err := cmd.Flags().MarkDeprecated(flag, usageMessage); err != nil {
+		panic(err)
+	}
+}

cmd/pinniped/cmd/exchange_credential.go

@@ -1,167 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/spf13/cobra"
-	corev1 "k8s.io/api/core/v1"
-	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
-
-	auth1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/authentication/v1alpha1"
-	"go.pinniped.dev/internal/client"
-	"go.pinniped.dev/internal/constable"
-	"go.pinniped.dev/internal/here"
-)
-
-//nolint: gochecknoinits
-func init() {
-	rootCmd.AddCommand(newExchangeCredentialCmd(os.Args, os.Stdout, os.Stderr).cmd)
-}
-
-type exchangeCredentialCommand struct {
-	// runFunc is called by the cobra.Command.Run hook. It is included here for
-	// testability.
-	runFunc func(stdout, stderr io.Writer)
-
-	// cmd is the cobra.Command for this CLI command. It is included here for
-	// testability.
-	cmd *cobra.Command
-}
-
-func newExchangeCredentialCmd(args []string, stdout, stderr io.Writer) *exchangeCredentialCommand {
-	c := &exchangeCredentialCommand{
-		runFunc: runExchangeCredential,
-	}
-
-	c.cmd = &cobra.Command{
-		Run: func(cmd *cobra.Command, _ []string) {
-			c.runFunc(stdout, stderr)
-		},
-		Args:  cobra.NoArgs, // do not accept positional arguments for this command
-		Use:   "exchange-credential",
-		Short: "Exchange a credential for a cluster-specific access credential",
-		Long: here.Doc(`
-			Exchange a credential which proves your identity for a time-limited,
-			cluster-specific access credential.
-
-			Designed to be conveniently used as an credential plugin for kubectl.
-			See the help message for 'pinniped get-kubeconfig' for more
-			information about setting up a kubeconfig file using Pinniped.
-
-			Requires all of the following environment variables, which are
-			typically set in the kubeconfig:
-			  - PINNIPED_TOKEN: the token to send to Pinniped for exchange
-			  - PINNIPED_NAMESPACE: the namespace of the authenticator to authenticate
-			    against
-			  - PINNIPED_AUTHENTICATOR_TYPE: the type of authenticator to authenticate
-			    against (e.g., "webhook")
-			  - PINNIPED_AUTHENTICATOR_NAME: the name of the authenticator to authenticate
-			    against
-			  - PINNIPED_CA_BUNDLE: the CA bundle to trust when calling
-				Pinniped's HTTPS endpoint
-			  - PINNIPED_K8S_API_ENDPOINT: the URL for the Pinniped credential
-				exchange API
-
-			For more information about credential plugins in general, see
-			https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
-		`),
-	}
-
-	c.cmd.SetArgs(args)
-	c.cmd.SetOut(stdout)
-	c.cmd.SetErr(stderr)
-
-	return c
-}
-
-type envGetter func(string) (string, bool)
-type tokenExchanger func(
-	ctx context.Context,
-	namespace string,
-	authenticator corev1.TypedLocalObjectReference,
-	token string,
-	caBundle string,
-	apiEndpoint string,
-) (*clientauthenticationv1beta1.ExecCredential, error)
-
-const (
-	ErrMissingEnvVar            = constable.Error("failed to get credential: environment variable not set")
-	ErrInvalidAuthenticatorType = constable.Error("invalid authenticator type")
-)
-
-func runExchangeCredential(stdout, _ io.Writer) {
-	err := exchangeCredential(os.LookupEnv, client.ExchangeToken, stdout, 30*time.Second)
-	if err != nil {
-		_, _ = fmt.Fprintf(os.Stderr, "%s\n", err.Error())
-		os.Exit(1)
-	}
-}
-
-func exchangeCredential(envGetter envGetter, tokenExchanger tokenExchanger, outputWriter io.Writer, timeout time.Duration) error {
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-
-	namespace, varExists := envGetter("PINNIPED_NAMESPACE")
-	if !varExists {
-		return envVarNotSetError("PINNIPED_NAMESPACE")
-	}
-
-	authenticatorType, varExists := envGetter("PINNIPED_AUTHENTICATOR_TYPE")
-	if !varExists {
-		return envVarNotSetError("PINNIPED_AUTHENTICATOR_TYPE")
-	}
-
-	authenticatorName, varExists := envGetter("PINNIPED_AUTHENTICATOR_NAME")
-	if !varExists {
-		return envVarNotSetError("PINNIPED_AUTHENTICATOR_NAME")
-	}
-
-	token, varExists := envGetter("PINNIPED_TOKEN")
-	if !varExists {
-		return envVarNotSetError("PINNIPED_TOKEN")
-	}
-
-	caBundle, varExists := envGetter("PINNIPED_CA_BUNDLE")
-	if !varExists {
-		return envVarNotSetError("PINNIPED_CA_BUNDLE")
-	}
-
-	apiEndpoint, varExists := envGetter("PINNIPED_K8S_API_ENDPOINT")
-	if !varExists {
-		return envVarNotSetError("PINNIPED_K8S_API_ENDPOINT")
-	}
-
-	authenticator := corev1.TypedLocalObjectReference{Name: authenticatorName}
-	switch strings.ToLower(authenticatorType) {
-	case "webhook":
-		authenticator.APIGroup = &auth1alpha1.SchemeGroupVersion.Group
-		authenticator.Kind = "WebhookAuthenticator"
-	default:
-		return fmt.Errorf(`%w: %q, supported values are "webhook"`, ErrInvalidAuthenticatorType, authenticatorType)
-	}
-
-	cred, err := tokenExchanger(ctx, namespace, authenticator, token, caBundle, apiEndpoint)
-	if err != nil {
-		return fmt.Errorf("failed to get credential: %w", err)
-	}
-
-	err = json.NewEncoder(outputWriter).Encode(cred)
-	if err != nil {
-		return fmt.Errorf("failed to marshal response to stdout: %w", err)
-	}
-
-	return nil
-}
-
-func envVarNotSetError(varName string) error {
-	return fmt.Errorf("%w: %s", ErrMissingEnvVar, varName)
-}

cmd/pinniped/cmd/exchange_credential_test.go

@@ -1,296 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package cmd
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"testing"
-	"time"
-
-	"github.com/sclevine/spec"
-	"github.com/sclevine/spec/report"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
-
-	"go.pinniped.dev/internal/here"
-	"go.pinniped.dev/internal/testutil"
-)
-
-var (
-	knownGoodUsageForExchangeCredential = here.Doc(`
-		Usage:
-		  exchange-credential [flags]
-
-		Flags:
-		  -h, --help   help for exchange-credential
-
-		`)
-
-	knownGoodHelpForExchangeCredential = here.Doc(`
-		Exchange a credential which proves your identity for a time-limited,
-		cluster-specific access credential.
-
-		Designed to be conveniently used as an credential plugin for kubectl.
-		See the help message for 'pinniped get-kubeconfig' for more
-		information about setting up a kubeconfig file using Pinniped.
-
-		Requires all of the following environment variables, which are
-		typically set in the kubeconfig:
-		  - PINNIPED_TOKEN: the token to send to Pinniped for exchange
-		  - PINNIPED_NAMESPACE: the namespace of the authenticator to authenticate
-		    against
-		  - PINNIPED_AUTHENTICATOR_TYPE: the type of authenticator to authenticate
-		    against (e.g., "webhook")
-		  - PINNIPED_AUTHENTICATOR_NAME: the name of the authenticator to authenticate
-		    against
-		  - PINNIPED_CA_BUNDLE: the CA bundle to trust when calling
-			Pinniped's HTTPS endpoint
-		  - PINNIPED_K8S_API_ENDPOINT: the URL for the Pinniped credential
-			exchange API
-
-		For more information about credential plugins in general, see
-		https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
-
-		Usage:
-		  exchange-credential [flags]
-
-		Flags:
-		  -h, --help   help for exchange-credential
-	`)
-)
-
-func TestNewCredentialExchangeCmd(t *testing.T) {
-	spec.Run(t, "newCredentialExchangeCmd", func(t *testing.T, when spec.G, it spec.S) {
-		var r *require.Assertions
-		var stdout, stderr *bytes.Buffer
-
-		it.Before(func() {
-			r = require.New(t)
-
-			stdout, stderr = bytes.NewBuffer([]byte{}), bytes.NewBuffer([]byte{})
-		})
-
-		it("calls runFunc and does not print usage or help when correct arguments and flags are used", func() {
-			c := newExchangeCredentialCmd([]string{}, stdout, stderr)
-
-			runFuncCalled := false
-			c.runFunc = func(out, err io.Writer) {
-				runFuncCalled = true
-			}
-
-			r.NoError(c.cmd.Execute())
-			r.True(runFuncCalled)
-			r.Empty(stdout.String())
-			r.Empty(stderr.String())
-		})
-
-		it("fails when args are passed", func() {
-			c := newExchangeCredentialCmd([]string{"some-arg"}, stdout, stderr)
-
-			runFuncCalled := false
-			c.runFunc = func(out, err io.Writer) {
-				runFuncCalled = true
-			}
-
-			errorMessage := `unknown command "some-arg" for "exchange-credential"`
-			r.EqualError(c.cmd.Execute(), errorMessage)
-			r.False(runFuncCalled)
-
-			output := "Error: " + errorMessage + "\n" + knownGoodUsageForExchangeCredential
-			r.Equal(output, stdout.String())
-			r.Empty(stderr.String())
-		})
-
-		it("prints a nice help message", func() {
-			c := newExchangeCredentialCmd([]string{"--help"}, stdout, stderr)
-
-			runFuncCalled := false
-			c.runFunc = func(out, err io.Writer) {
-				runFuncCalled = true
-			}
-
-			r.NoError(c.cmd.Execute())
-			r.False(runFuncCalled)
-			r.Equal(knownGoodHelpForExchangeCredential, stdout.String())
-			r.Empty(stderr.String())
-		})
-	}, spec.Parallel(), spec.Report(report.Terminal{}))
-}
-
-func TestExchangeCredential(t *testing.T) {
-	spec.Run(t, "cmd.exchangeCredential", func(t *testing.T, when spec.G, it spec.S) {
-		var r *require.Assertions
-		var buffer *bytes.Buffer
-		var tokenExchanger tokenExchanger
-		var fakeEnv map[string]string
-
-		var envGetter envGetter = func(envVarName string) (string, bool) {
-			value, present := fakeEnv[envVarName]
-			if !present {
-				return "", false
-			}
-			return value, true
-		}
-
-		it.Before(func() {
-			r = require.New(t)
-			buffer = new(bytes.Buffer)
-			fakeEnv = map[string]string{
-				"PINNIPED_NAMESPACE":          "namespace from env",
-				"PINNIPED_AUTHENTICATOR_TYPE": "Webhook",
-				"PINNIPED_AUTHENTICATOR_NAME": "webhook name from env",
-				"PINNIPED_TOKEN":              "token from env",
-				"PINNIPED_CA_BUNDLE":          "ca bundle from env",
-				"PINNIPED_K8S_API_ENDPOINT":   "k8s api from env",
-			}
-		})
-
-		when("env vars are missing", func() {
-			it("returns an error when PINNIPED_NAMESPACE is missing", func() {
-				delete(fakeEnv, "PINNIPED_NAMESPACE")
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_NAMESPACE")
-			})
-
-			it("returns an error when PINNIPED_AUTHENTICATOR_TYPE is missing", func() {
-				delete(fakeEnv, "PINNIPED_AUTHENTICATOR_TYPE")
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_AUTHENTICATOR_TYPE")
-			})
-
-			it("returns an error when PINNIPED_AUTHENTICATOR_NAME is missing", func() {
-				delete(fakeEnv, "PINNIPED_AUTHENTICATOR_NAME")
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_AUTHENTICATOR_NAME")
-			})
-
-			it("returns an error when PINNIPED_TOKEN is missing", func() {
-				delete(fakeEnv, "PINNIPED_TOKEN")
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_TOKEN")
-			})
-
-			it("returns an error when PINNIPED_CA_BUNDLE is missing", func() {
-				delete(fakeEnv, "PINNIPED_CA_BUNDLE")
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_CA_BUNDLE")
-			})
-
-			it("returns an error when PINNIPED_K8S_API_ENDPOINT is missing", func() {
-				delete(fakeEnv, "PINNIPED_K8S_API_ENDPOINT")
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.EqualError(err, "failed to get credential: environment variable not set: PINNIPED_K8S_API_ENDPOINT")
-			})
-		})
-
-		when("env vars are invalid", func() {
-			it("returns an error when PINNIPED_AUTHENTICATOR_TYPE is missing", func() {
-				fakeEnv["PINNIPED_AUTHENTICATOR_TYPE"] = "invalid"
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.EqualError(err, `invalid authenticator type: "invalid", supported values are "webhook"`)
-			})
-		})
-
-		when("the token exchange fails", func() {
-			it.Before(func() {
-				tokenExchanger = func(ctx context.Context, namespace string, authenticator corev1.TypedLocalObjectReference, token, caBundle, apiEndpoint string) (*clientauthenticationv1beta1.ExecCredential, error) {
-					return nil, fmt.Errorf("some error")
-				}
-			})
-
-			it("returns an error", func() {
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.EqualError(err, "failed to get credential: some error")
-			})
-		})
-
-		when("the JSON encoder fails", func() {
-			it.Before(func() {
-				tokenExchanger = func(ctx context.Context, namespace string, authenticator corev1.TypedLocalObjectReference, token, caBundle, apiEndpoint string) (*clientauthenticationv1beta1.ExecCredential, error) {
-					return &clientauthenticationv1beta1.ExecCredential{
-						Status: &clientauthenticationv1beta1.ExecCredentialStatus{
-							Token: "some token",
-						},
-					}, nil
-				}
-			})
-
-			it("returns an error", func() {
-				err := exchangeCredential(envGetter, tokenExchanger, &testutil.ErrorWriter{ReturnError: fmt.Errorf("some IO error")}, 30*time.Second)
-				r.EqualError(err, "failed to marshal response to stdout: some IO error")
-			})
-		})
-
-		when("the token exchange times out", func() {
-			it.Before(func() {
-				tokenExchanger = func(ctx context.Context, namespace string, authenticator corev1.TypedLocalObjectReference, token, caBundle, apiEndpoint string) (*clientauthenticationv1beta1.ExecCredential, error) {
-					select {
-					case <-time.After(100 * time.Millisecond):
-						return &clientauthenticationv1beta1.ExecCredential{
-							Status: &clientauthenticationv1beta1.ExecCredentialStatus{
-								Token: "some token",
-							},
-						}, nil
-					case <-ctx.Done():
-						return nil, ctx.Err()
-					}
-				}
-			})
-
-			it("returns an error", func() {
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 1*time.Millisecond)
-				r.EqualError(err, "failed to get credential: context deadline exceeded")
-			})
-		})
-
-		when("the token exchange succeeds", func() {
-			var actualNamespace, actualToken, actualCaBundle, actualAPIEndpoint string
-
-			it.Before(func() {
-				tokenExchanger = func(ctx context.Context, namespace string, authenticator corev1.TypedLocalObjectReference, token, caBundle, apiEndpoint string) (*clientauthenticationv1beta1.ExecCredential, error) {
-					actualNamespace, actualToken, actualCaBundle, actualAPIEndpoint = namespace, token, caBundle, apiEndpoint
-					now := metav1.NewTime(time.Date(2020, 7, 29, 1, 2, 3, 0, time.UTC))
-					return &clientauthenticationv1beta1.ExecCredential{
-						TypeMeta: metav1.TypeMeta{
-							Kind:       "ExecCredential",
-							APIVersion: "client.authentication.k8s.io/v1beta1",
-						},
-						Status: &clientauthenticationv1beta1.ExecCredentialStatus{
-							ExpirationTimestamp:   &now,
-							ClientCertificateData: "some certificate",
-							ClientKeyData:         "some key",
-							Token:                 "some token",
-						},
-					}, nil
-				}
-			})
-
-			it("writes the execCredential to the given writer", func() {
-				err := exchangeCredential(envGetter, tokenExchanger, buffer, 30*time.Second)
-				r.NoError(err)
-				r.Equal(fakeEnv["PINNIPED_NAMESPACE"], actualNamespace)
-				r.Equal(fakeEnv["PINNIPED_TOKEN"], actualToken)
-				r.Equal(fakeEnv["PINNIPED_CA_BUNDLE"], actualCaBundle)
-				r.Equal(fakeEnv["PINNIPED_K8S_API_ENDPOINT"], actualAPIEndpoint)
-				expected := `{
-				  "kind": "ExecCredential",
-				  "apiVersion": "client.authentication.k8s.io/v1beta1",
-				  "spec": {},
-				  "status": {
-					"expirationTimestamp":"2020-07-29T01:02:03Z",
-					"clientCertificateData": "some certificate",
-					"clientKeyData":"some key",
-					"token": "some token"
-				  }
-				}`
-				r.JSONEq(expected, buffer.String())
-			})
-		})
-	}, spec.Parallel(), spec.Report(report.Terminal{}))
-}

cmd/pinniped/cmd/get.go

@@ -0,0 +1,16 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+//nolint: gochecknoglobals
+var getCmd = &cobra.Command{Use: "get", Short: "get"}
+
+//nolint: gochecknoinits
+func init() {
+	rootCmd.AddCommand(getCmd)
+}

cmd/pinniped/cmd/get_kubeconfig.go

@@ -1,344 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package cmd
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"fmt"
-	"io"
-	"os"
-	"time"
-
-	"github.com/ghodss/yaml"
-	"github.com/spf13/cobra"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
-	v1 "k8s.io/client-go/tools/clientcmd/api/v1"
-
-	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/config/v1alpha1"
-	pinnipedclientset "go.pinniped.dev/generated/1.19/client/concierge/clientset/versioned"
-	"go.pinniped.dev/internal/constable"
-	"go.pinniped.dev/internal/here"
-)
-
-//nolint: gochecknoinits
-func init() {
-	rootCmd.AddCommand(newGetKubeConfigCommand().Command())
-}
-
-type getKubeConfigFlags struct {
-	token             string
-	kubeconfig        string
-	contextOverride   string
-	namespace         string
-	authenticatorName string
-	authenticatorType string
-}
-
-type getKubeConfigCommand struct {
-	flags getKubeConfigFlags
-	// 	Test mocking points
-	getPathToSelf     func() (string, error)
-	kubeClientCreator func(restConfig *rest.Config) (pinnipedclientset.Interface, error)
-}
-
-func newGetKubeConfigCommand() *getKubeConfigCommand {
-	return &getKubeConfigCommand{
-		flags: getKubeConfigFlags{
-			namespace: "pinniped",
-		},
-		getPathToSelf: os.Executable,
-		kubeClientCreator: func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
-			return pinnipedclientset.NewForConfig(restConfig)
-		},
-	}
-}
-
-func (c *getKubeConfigCommand) Command() *cobra.Command {
-	cmd := &cobra.Command{
-		RunE:  c.run,
-		Args:  cobra.NoArgs, // do not accept positional arguments for this command
-		Use:   "get-kubeconfig",
-		Short: "Print a kubeconfig for authenticating into a cluster via Pinniped",
-		Long: here.Doc(`
-			Print a kubeconfig for authenticating into a cluster via Pinniped.
-
-			Requires admin-like access to the cluster using the current
-			kubeconfig context in order to access Pinniped's metadata.
-			The current kubeconfig is found similar to how kubectl finds it:
-			using the value of the --kubeconfig option, or if that is not
-			specified then from the value of the KUBECONFIG environment
-			variable, or if that is not specified then it defaults to
-			.kube/config in your home directory.
-
-			Prints a kubeconfig which is suitable to access the cluster using
-			Pinniped as the authentication mechanism. This kubeconfig output
-			can be saved to a file and used with future kubectl commands, e.g.:
-				pinniped get-kubeconfig --token $MY_TOKEN > $HOME/mycluster-kubeconfig
-				kubectl --kubeconfig $HOME/mycluster-kubeconfig get pods
-		`),
-	}
-	cmd.Flags().StringVar(&c.flags.token, "token", "", "Credential to include in the resulting kubeconfig output (Required)")
-	cmd.Flags().StringVar(&c.flags.kubeconfig, "kubeconfig", c.flags.kubeconfig, "Path to the kubeconfig file")
-	cmd.Flags().StringVar(&c.flags.contextOverride, "kubeconfig-context", c.flags.contextOverride, "Kubeconfig context override")
-	cmd.Flags().StringVar(&c.flags.namespace, "pinniped-namespace", c.flags.namespace, "Namespace in which Pinniped was installed")
-	cmd.Flags().StringVar(&c.flags.authenticatorType, "authenticator-type", c.flags.authenticatorType, "Authenticator type (e.g., 'webhook')")
-	cmd.Flags().StringVar(&c.flags.authenticatorName, "authenticator-name", c.flags.authenticatorType, "Authenticator name")
-	mustMarkRequired(cmd, "token")
-	return cmd
-}
-
-func (c *getKubeConfigCommand) run(cmd *cobra.Command, args []string) error {
-	fullPathToSelf, err := c.getPathToSelf()
-	if err != nil {
-		return fmt.Errorf("could not find path to self: %w", err)
-	}
-
-	clientConfig := newClientConfig(c.flags.kubeconfig, c.flags.contextOverride)
-
-	currentKubeConfig, err := clientConfig.RawConfig()
-	if err != nil {
-		return err
-	}
-
-	restConfig, err := clientConfig.ClientConfig()
-	if err != nil {
-		return err
-	}
-	clientset, err := c.kubeClientCreator(restConfig)
-	if err != nil {
-		return err
-	}
-
-	authenticatorType, authenticatorName := c.flags.authenticatorType, c.flags.authenticatorName
-	if authenticatorType == "" || authenticatorName == "" {
-		authenticatorType, authenticatorName, err = getDefaultAuthenticator(clientset, c.flags.namespace)
-		if err != nil {
-			return err
-		}
-	}
-
-	credentialIssuer, err := fetchPinnipedCredentialIssuer(clientset, c.flags.namespace)
-	if err != nil {
-		return err
-	}
-
-	if credentialIssuer.Status.KubeConfigInfo == nil {
-		return constable.Error(`CredentialIssuer "pinniped-config" was missing KubeConfigInfo`)
-	}
-
-	v1Cluster, err := copyCurrentClusterFromExistingKubeConfig(currentKubeConfig, c.flags.contextOverride)
-	if err != nil {
-		return err
-	}
-
-	err = issueWarningForNonMatchingServerOrCA(v1Cluster, credentialIssuer, cmd.ErrOrStderr())
-	if err != nil {
-		return err
-	}
-
-	config := newPinnipedKubeconfig(v1Cluster, fullPathToSelf, c.flags.token, c.flags.namespace, authenticatorType, authenticatorName)
-
-	err = writeConfigAsYAML(cmd.OutOrStdout(), config)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func issueWarningForNonMatchingServerOrCA(v1Cluster v1.Cluster, credentialIssuer *configv1alpha1.CredentialIssuer, warningsWriter io.Writer) error {
-	credentialIssuerCA, err := base64.StdEncoding.DecodeString(credentialIssuer.Status.KubeConfigInfo.CertificateAuthorityData)
-	if err != nil {
-		return err
-	}
-	if v1Cluster.Server != credentialIssuer.Status.KubeConfigInfo.Server ||
-		!bytes.Equal(v1Cluster.CertificateAuthorityData, credentialIssuerCA) {
-		_, err := warningsWriter.Write([]byte("WARNING: Server and certificate authority did not match between local kubeconfig and Pinniped's CredentialIssuer on the cluster. Using local kubeconfig values.\n"))
-		if err != nil {
-			return fmt.Errorf("output write error: %w", err)
-		}
-	}
-	return nil
-}
-
-type noAuthenticatorError struct{ Namespace string }
-
-func (e noAuthenticatorError) Error() string {
-	return fmt.Sprintf(`no authenticators were found in namespace %q`, e.Namespace)
-}
-
-type indeterminateAuthenticatorError struct{ Namespace string }
-
-func (e indeterminateAuthenticatorError) Error() string {
-	return fmt.Sprintf(
-		`multiple authenticators were found in namespace %q, so --authenticator-name/--authenticator-type must be specified`,
-		e.Namespace,
-	)
-}
-
-func getDefaultAuthenticator(clientset pinnipedclientset.Interface, namespace string) (string, string, error) {
-	ctx, cancelFunc := context.WithTimeout(context.Background(), time.Second*20)
-	defer cancelFunc()
-
-	webhooks, err := clientset.AuthenticationV1alpha1().WebhookAuthenticators(namespace).List(ctx, metav1.ListOptions{})
-	if err != nil {
-		return "", "", err
-	}
-
-	type ref struct{ authenticatorType, authenticatorName string }
-	authenticators := make([]ref, 0, len(webhooks.Items))
-	for _, webhook := range webhooks.Items {
-		authenticators = append(authenticators, ref{authenticatorType: "webhook", authenticatorName: webhook.Name})
-	}
-
-	if len(authenticators) == 0 {
-		return "", "", noAuthenticatorError{namespace}
-	}
-	if len(authenticators) > 1 {
-		return "", "", indeterminateAuthenticatorError{namespace}
-	}
-	return authenticators[0].authenticatorType, authenticators[0].authenticatorName, nil
-}
-
-func fetchPinnipedCredentialIssuer(clientset pinnipedclientset.Interface, pinnipedInstallationNamespace string) (*configv1alpha1.CredentialIssuer, error) {
-	ctx, cancelFunc := context.WithTimeout(context.Background(), time.Second*20)
-	defer cancelFunc()
-
-	credentialIssuers, err := clientset.ConfigV1alpha1().CredentialIssuers(pinnipedInstallationNamespace).List(ctx, metav1.ListOptions{})
-	if err != nil {
-		return nil, err
-	}
-
-	if len(credentialIssuers.Items) == 0 {
-		return nil, constable.Error(fmt.Sprintf(
-			`No CredentialIssuer was found in namespace "%s". Is Pinniped installed on this cluster in namespace "%s"?`,
-			pinnipedInstallationNamespace,
-			pinnipedInstallationNamespace,
-		))
-	}
-
-	if len(credentialIssuers.Items) > 1 {
-		return nil, constable.Error(fmt.Sprintf(
-			`More than one CredentialIssuer was found in namespace "%s"`,
-			pinnipedInstallationNamespace,
-		))
-	}
-
-	return &credentialIssuers.Items[0], nil
-}
-
-func newClientConfig(kubeconfigPathOverride string, currentContextName string) clientcmd.ClientConfig {
-	loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()
-	loadingRules.ExplicitPath = kubeconfigPathOverride
-	clientConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, &clientcmd.ConfigOverrides{
-		CurrentContext: currentContextName,
-	})
-	return clientConfig
-}
-
-func writeConfigAsYAML(outputWriter io.Writer, config v1.Config) error {
-	output, err := yaml.Marshal(&config)
-	if err != nil {
-		return fmt.Errorf("YAML serialization error: %w", err)
-	}
-
-	_, err = outputWriter.Write(output)
-	if err != nil {
-		return fmt.Errorf("output write error: %w", err)
-	}
-
-	return nil
-}
-
-func copyCurrentClusterFromExistingKubeConfig(currentKubeConfig clientcmdapi.Config, currentContextNameOverride string) (v1.Cluster, error) {
-	v1Cluster := v1.Cluster{}
-
-	contextName := currentKubeConfig.CurrentContext
-	if currentContextNameOverride != "" {
-		contextName = currentContextNameOverride
-	}
-
-	err := v1.Convert_api_Cluster_To_v1_Cluster(
-		currentKubeConfig.Clusters[currentKubeConfig.Contexts[contextName].Cluster],
-		&v1Cluster,
-		nil,
-	)
-	if err != nil {
-		return v1.Cluster{}, err
-	}
-
-	return v1Cluster, nil
-}
-
-func newPinnipedKubeconfig(v1Cluster v1.Cluster, fullPathToSelf string, token string, namespace string, authenticatorType string, authenticatorName string) v1.Config {
-	clusterName := "pinniped-cluster"
-	userName := "pinniped-user"
-
-	return v1.Config{
-		Kind:        "Config",
-		APIVersion:  v1.SchemeGroupVersion.Version,
-		Preferences: v1.Preferences{},
-		Clusters: []v1.NamedCluster{
-			{
-				Name:    clusterName,
-				Cluster: v1Cluster,
-			},
-		},
-		Contexts: []v1.NamedContext{
-			{
-				Name: clusterName,
-				Context: v1.Context{
-					Cluster:  clusterName,
-					AuthInfo: userName,
-				},
-			},
-		},
-		AuthInfos: []v1.NamedAuthInfo{
-			{
-				Name: userName,
-				AuthInfo: v1.AuthInfo{
-					Exec: &v1.ExecConfig{
-						Command: fullPathToSelf,
-						Args:    []string{"exchange-credential"},
-						Env: []v1.ExecEnvVar{
-							{
-								Name:  "PINNIPED_K8S_API_ENDPOINT",
-								Value: v1Cluster.Server,
-							},
-							{
-								Name:  "PINNIPED_CA_BUNDLE",
-								Value: string(v1Cluster.CertificateAuthorityData)},
-							{
-								Name:  "PINNIPED_NAMESPACE",
-								Value: namespace,
-							},
-							{
-								Name:  "PINNIPED_TOKEN",
-								Value: token,
-							},
-							{
-								Name:  "PINNIPED_AUTHENTICATOR_TYPE",
-								Value: authenticatorType,
-							},
-							{
-								Name:  "PINNIPED_AUTHENTICATOR_NAME",
-								Value: authenticatorName,
-							},
-						},
-						APIVersion: clientauthenticationv1beta1.SchemeGroupVersion.String(),
-						InstallHint: "The Pinniped CLI is required to authenticate to the current cluster.\n" +
-							"For more information, please visit https://pinniped.dev",
-					},
-				},
-			},
-		},
-		CurrentContext: clusterName,
-	}
-}

cmd/pinniped/cmd/get_kubeconfig_test.go

@@ -1,401 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package cmd
-
-import (
-	"bytes"
-	"encoding/base64"
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/spf13/cobra"
-	"github.com/stretchr/testify/require"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/rest"
-	coretesting "k8s.io/client-go/testing"
-
-	authv1alpha "go.pinniped.dev/generated/1.19/apis/concierge/authentication/v1alpha1"
-	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/concierge/config/v1alpha1"
-	pinnipedclientset "go.pinniped.dev/generated/1.19/client/concierge/clientset/versioned"
-	pinnipedfake "go.pinniped.dev/generated/1.19/client/concierge/clientset/versioned/fake"
-	"go.pinniped.dev/internal/here"
-)
-
-var (
-	knownGoodUsageForGetKubeConfig = here.Doc(`
-		Usage:
-		  get-kubeconfig [flags]
-
-		Flags:
-			  --authenticator-name string   Authenticator name
-			  --authenticator-type string   Authenticator type (e.g., 'webhook')
-		  -h, --help                        help for get-kubeconfig
-			  --kubeconfig string           Path to the kubeconfig file
-			  --kubeconfig-context string   Kubeconfig context override
-			  --pinniped-namespace string   Namespace in which Pinniped was installed (default "pinniped")
-			  --token string                Credential to include in the resulting kubeconfig output (Required)
-
-		`)
-
-	knownGoodHelpForGetKubeConfig = here.Doc(`
-		Print a kubeconfig for authenticating into a cluster via Pinniped.
-
-		Requires admin-like access to the cluster using the current
-		kubeconfig context in order to access Pinniped's metadata.
-		The current kubeconfig is found similar to how kubectl finds it:
-		using the value of the --kubeconfig option, or if that is not
-		specified then from the value of the KUBECONFIG environment
-		variable, or if that is not specified then it defaults to
-		.kube/config in your home directory.
-
-		Prints a kubeconfig which is suitable to access the cluster using
-		Pinniped as the authentication mechanism. This kubeconfig output
-		can be saved to a file and used with future kubectl commands, e.g.:
-			pinniped get-kubeconfig --token $MY_TOKEN > $HOME/mycluster-kubeconfig
-			kubectl --kubeconfig $HOME/mycluster-kubeconfig get pods
-
-		Usage:
-		  get-kubeconfig [flags]
-
-		Flags:
-			  --authenticator-name string   Authenticator name
-			  --authenticator-type string   Authenticator type (e.g., 'webhook')
-		  -h, --help                        help for get-kubeconfig
-			  --kubeconfig string           Path to the kubeconfig file
-			  --kubeconfig-context string   Kubeconfig context override
-			  --pinniped-namespace string   Namespace in which Pinniped was installed (default "pinniped")
-			  --token string                Credential to include in the resulting kubeconfig output (Required)
-		`)
-)
-
-func TestNewGetKubeConfigCmd(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		name       string
-		args       []string
-		wantError  bool
-		wantStdout string
-		wantStderr string
-	}{
-		{
-			name:       "help flag passed",
-			args:       []string{"--help"},
-			wantStdout: knownGoodHelpForGetKubeConfig,
-		},
-		{
-			name:       "missing required flag",
-			args:       []string{},
-			wantError:  true,
-			wantStdout: `Error: required flag(s) "token" not set` + "\n" + knownGoodUsageForGetKubeConfig,
-		},
-	}
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			cmd := newGetKubeConfigCommand().Command()
-			require.NotNil(t, cmd)
-
-			var stdout, stderr bytes.Buffer
-			cmd.SetOut(&stdout)
-			cmd.SetErr(&stderr)
-			cmd.SetArgs(tt.args)
-			err := cmd.Execute()
-			if tt.wantError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-			}
-			require.Equal(t, tt.wantStdout, stdout.String(), "unexpected stdout")
-			require.Equal(t, tt.wantStderr, stderr.String(), "unexpected stderr")
-		})
-	}
-}
-
-type expectedKubeconfigYAML struct {
-	clusterCAData     string
-	clusterServer     string
-	command           string
-	token             string
-	pinnipedEndpoint  string
-	pinnipedCABundle  string
-	namespace         string
-	authenticatorType string
-	authenticatorName string
-}
-
-func (e expectedKubeconfigYAML) String() string {
-	return here.Docf(`
-		apiVersion: v1
-		clusters:
-		- cluster:
-			certificate-authority-data: %s
-			server: %s
-		  name: pinniped-cluster
-		contexts:
-		- context:
-			cluster: pinniped-cluster
-			user: pinniped-user
-		  name: pinniped-cluster
-		current-context: pinniped-cluster
-		kind: Config
-		preferences: {}
-		users:
-		- name: pinniped-user
-		  user:
-			exec:
-			  apiVersion: client.authentication.k8s.io/v1beta1
-			  args:
-			  - exchange-credential
-			  command: %s
-			  env:
-			  - name: PINNIPED_K8S_API_ENDPOINT
-				value: %s
-			  - name: PINNIPED_CA_BUNDLE
-				value: %s
-			  - name: PINNIPED_NAMESPACE
-			    value: %s
-			  - name: PINNIPED_TOKEN
-				value: %s
-			  - name: PINNIPED_AUTHENTICATOR_TYPE
-				value: %s
-			  - name: PINNIPED_AUTHENTICATOR_NAME
-				value: %s
-			  installHint: |-
-				The Pinniped CLI is required to authenticate to the current cluster.
-				For more information, please visit https://pinniped.dev
-		`, e.clusterCAData, e.clusterServer, e.command, e.pinnipedEndpoint, e.pinnipedCABundle, e.namespace, e.token, e.authenticatorType, e.authenticatorName)
-}
-
-func newCredentialIssuer(name, namespace, server, certificateAuthorityData string) *configv1alpha1.CredentialIssuer {
-	return &configv1alpha1.CredentialIssuer{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       "CredentialIssuer",
-			APIVersion: configv1alpha1.SchemeGroupVersion.String(),
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: namespace,
-		},
-		Status: configv1alpha1.CredentialIssuerStatus{
-			KubeConfigInfo: &configv1alpha1.CredentialIssuerKubeConfigInfo{
-				Server:                   server,
-				CertificateAuthorityData: base64.StdEncoding.EncodeToString([]byte(certificateAuthorityData)),
-			},
-		},
-	}
-}
-
-func TestRun(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		name       string
-		mocks      func(*getKubeConfigCommand)
-		wantError  string
-		wantStdout string
-		wantStderr string
-	}{
-		{
-			name: "failure to get path to self",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.getPathToSelf = func() (string, error) {
-					return "", fmt.Errorf("some error getting path to self")
-				}
-			},
-			wantError: "could not find path to self: some error getting path to self",
-		},
-		{
-			name: "kubeconfig does not exist",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.flags.kubeconfig = "./testdata/does-not-exist.yaml"
-			},
-			wantError: "stat ./testdata/does-not-exist.yaml: no such file or directory",
-		},
-		{
-			name: "fail to get client",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return nil, fmt.Errorf("some error configuring clientset")
-				}
-			},
-			wantError: "some error configuring clientset",
-		},
-		{
-			name: "fail to get authenticators",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.flags.authenticatorName = ""
-				cmd.flags.authenticatorType = ""
-				clientset := pinnipedfake.NewSimpleClientset()
-				clientset.PrependReactor("*", "*", func(_ coretesting.Action) (bool, runtime.Object, error) {
-					return true, nil, fmt.Errorf("some error getting authenticators")
-				})
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return clientset, nil
-				}
-			},
-			wantError: "some error getting authenticators",
-		},
-		{
-			name: "zero authenticators",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.flags.authenticatorName = ""
-				cmd.flags.authenticatorType = ""
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return pinnipedfake.NewSimpleClientset(), nil
-				}
-			},
-			wantError: `no authenticators were found in namespace "test-namespace"`,
-		},
-		{
-			name: "multiple authenticators",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.flags.authenticatorName = ""
-				cmd.flags.authenticatorType = ""
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return pinnipedfake.NewSimpleClientset(
-						&authv1alpha.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Namespace: "test-namespace", Name: "webhook-one"}},
-						&authv1alpha.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Namespace: "test-namespace", Name: "webhook-two"}},
-					), nil
-				}
-			},
-			wantError: `multiple authenticators were found in namespace "test-namespace", so --authenticator-name/--authenticator-type must be specified`,
-		},
-		{
-			name: "fail to get CredentialIssuers",
-			mocks: func(cmd *getKubeConfigCommand) {
-				clientset := pinnipedfake.NewSimpleClientset()
-				clientset.PrependReactor("*", "*", func(_ coretesting.Action) (bool, runtime.Object, error) {
-					return true, nil, fmt.Errorf("some error getting CredentialIssuers")
-				})
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return clientset, nil
-				}
-			},
-			wantError: "some error getting CredentialIssuers",
-		},
-		{
-			name: "zero CredentialIssuers found",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return pinnipedfake.NewSimpleClientset(
-						newCredentialIssuer("pinniped-config-1", "not-the-test-namespace", "", ""),
-					), nil
-				}
-			},
-			wantError: `No CredentialIssuer was found in namespace "test-namespace". Is Pinniped installed on this cluster in namespace "test-namespace"?`,
-		},
-		{
-			name: "multiple CredentialIssuers found",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return pinnipedfake.NewSimpleClientset(
-						newCredentialIssuer("pinniped-config-1", "test-namespace", "", ""),
-						newCredentialIssuer("pinniped-config-2", "test-namespace", "", ""),
-					), nil
-				}
-			},
-			wantError: `More than one CredentialIssuer was found in namespace "test-namespace"`,
-		},
-		{
-			name: "CredentialIssuer missing KubeConfigInfo",
-			mocks: func(cmd *getKubeConfigCommand) {
-				ci := newCredentialIssuer("pinniped-config", "test-namespace", "", "")
-				ci.Status.KubeConfigInfo = nil
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return pinnipedfake.NewSimpleClientset(ci), nil
-				}
-			},
-			wantError: `CredentialIssuer "pinniped-config" was missing KubeConfigInfo`,
-		},
-		{
-			name: "KubeConfigInfo has invalid base64",
-			mocks: func(cmd *getKubeConfigCommand) {
-				ci := newCredentialIssuer("pinniped-config", "test-namespace", "https://example.com", "")
-				ci.Status.KubeConfigInfo.CertificateAuthorityData = "invalid-base64-test-ca"
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return pinnipedfake.NewSimpleClientset(ci), nil
-				}
-			},
-			wantError: `illegal base64 data at input byte 7`,
-		},
-		{
-			name: "success using remote CA data",
-			mocks: func(cmd *getKubeConfigCommand) {
-				ci := newCredentialIssuer("pinniped-config", "test-namespace", "https://fake-server-url-value", "fake-certificate-authority-data-value")
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return pinnipedfake.NewSimpleClientset(ci), nil
-				}
-			},
-			wantStdout: expectedKubeconfigYAML{
-				clusterCAData:     "ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==",
-				clusterServer:     "https://fake-server-url-value",
-				command:           "/path/to/pinniped",
-				token:             "test-token",
-				pinnipedEndpoint:  "https://fake-server-url-value",
-				pinnipedCABundle:  "fake-certificate-authority-data-value",
-				namespace:         "test-namespace",
-				authenticatorType: "test-authenticator-type",
-				authenticatorName: "test-authenticator-name",
-			}.String(),
-		},
-		{
-			name: "success using local CA data and discovered authenticator",
-			mocks: func(cmd *getKubeConfigCommand) {
-				cmd.flags.authenticatorName = ""
-				cmd.flags.authenticatorType = ""
-
-				cmd.kubeClientCreator = func(_ *rest.Config) (pinnipedclientset.Interface, error) {
-					return pinnipedfake.NewSimpleClientset(
-						&authv1alpha.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Namespace: "test-namespace", Name: "discovered-authenticator"}},
-						newCredentialIssuer("pinniped-config", "test-namespace", "https://example.com", "test-ca"),
-					), nil
-				}
-			},
-			wantStderr: `WARNING: Server and certificate authority did not match between local kubeconfig and Pinniped's CredentialIssuer on the cluster. Using local kubeconfig values.`,
-			wantStdout: expectedKubeconfigYAML{
-				clusterCAData:     "ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==",
-				clusterServer:     "https://fake-server-url-value",
-				command:           "/path/to/pinniped",
-				token:             "test-token",
-				pinnipedEndpoint:  "https://fake-server-url-value",
-				pinnipedCABundle:  "fake-certificate-authority-data-value",
-				namespace:         "test-namespace",
-				authenticatorType: "webhook",
-				authenticatorName: "discovered-authenticator",
-			}.String(),
-		},
-	}
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			// Start with a default getKubeConfigCommand, set some defaults, then apply any mocks.
-			c := newGetKubeConfigCommand()
-			c.flags.token = "test-token"
-			c.flags.namespace = "test-namespace"
-			c.flags.authenticatorName = "test-authenticator-name"
-			c.flags.authenticatorType = "test-authenticator-type"
-			c.getPathToSelf = func() (string, error) { return "/path/to/pinniped", nil }
-			c.flags.kubeconfig = "./testdata/kubeconfig.yaml"
-			tt.mocks(c)
-
-			cmd := &cobra.Command{}
-			var stdout, stderr bytes.Buffer
-			cmd.SetOut(&stdout)
-			cmd.SetErr(&stderr)
-			cmd.SetArgs([]string{})
-			err := c.run(cmd, []string{})
-			if tt.wantError != "" {
-				require.EqualError(t, err, tt.wantError)
-			} else {
-				require.NoError(t, err)
-			}
-			require.Equal(t, strings.TrimSpace(tt.wantStdout), strings.TrimSpace(stdout.String()), "unexpected stdout")
-			require.Equal(t, strings.TrimSpace(tt.wantStderr), strings.TrimSpace(stderr.String()), "unexpected stderr")
-		})
-	}
-}

cmd/pinniped/cmd/kubeconfig.go

@@ -0,0 +1,384 @@
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/spf13/cobra"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+
+	_ "k8s.io/client-go/plugin/pkg/client/auth" // Adds handlers for various dynamic auth plugins in client-go
+
+	conciergev1alpha1 "go.pinniped.dev/generated/1.20/apis/concierge/authentication/v1alpha1"
+	conciergeclientset "go.pinniped.dev/generated/1.20/client/concierge/clientset/versioned"
+	"go.pinniped.dev/internal/groupsuffix"
+	"go.pinniped.dev/internal/kubeclient"
+)
+
+type kubeconfigDeps struct {
+	getPathToSelf func() (string, error)
+	getClientset  func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, error)
+}
+
+func kubeconfigRealDeps() kubeconfigDeps {
+	return kubeconfigDeps{
+		getPathToSelf: os.Executable,
+		getClientset: func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, error) {
+			restConfig, err := clientConfig.ClientConfig()
+			if err != nil {
+				return nil, err
+			}
+			client, err := kubeclient.New(
+				kubeclient.WithConfig(restConfig),
+				kubeclient.WithMiddleware(groupsuffix.New(apiGroupSuffix)),
+			)
+			if err != nil {
+				return nil, err
+			}
+			return client.PinnipedConcierge, nil
+		},
+	}
+}
+
+//nolint: gochecknoinits
+func init() {
+	getCmd.AddCommand(kubeconfigCommand(kubeconfigRealDeps()))
+}
+
+type getKubeconfigOIDCParams struct {
+	issuer            string
+	clientID          string
+	listenPort        uint16
+	scopes            []string
+	skipBrowser       bool
+	sessionCachePath  string
+	debugSessionCache bool
+	caBundlePaths     []string
+	requestAudience   string
+}
+
+type getKubeconfigConciergeParams struct {
+	disabled          bool
+	authenticatorName string
+	authenticatorType string
+	apiGroupSuffix    string
+}
+
+type getKubeconfigParams struct {
+	kubeconfigPath            string
+	kubeconfigContextOverride string
+	staticToken               string
+	staticTokenEnvName        string
+	oidc                      getKubeconfigOIDCParams
+	concierge                 getKubeconfigConciergeParams
+}
+
+func kubeconfigCommand(deps kubeconfigDeps) *cobra.Command {
+	var (
+		cmd = &cobra.Command{
+			Args:         cobra.NoArgs,
+			Use:          "kubeconfig",
+			Short:        "Generate a Pinniped-based kubeconfig for a cluster",
+			SilenceUsage: true,
+		}
+		flags     getKubeconfigParams
+		namespace string // unused now
+	)
+
+	f := cmd.Flags()
+	f.StringVar(&flags.staticToken, "static-token", "", "Instead of doing an OIDC-based login, specify a static token")
+	f.StringVar(&flags.staticTokenEnvName, "static-token-env", "", "Instead of doing an OIDC-based login, read a static token from the environment")
+
+	f.BoolVar(&flags.concierge.disabled, "no-concierge", false, "Generate a configuration which does not use the concierge, but sends the credential to the cluster directly")
+	f.StringVar(&namespace, "concierge-namespace", "pinniped-concierge", "Namespace in which the concierge was installed")
+	f.StringVar(&flags.concierge.authenticatorType, "concierge-authenticator-type", "", "Concierge authenticator type (e.g., 'webhook', 'jwt') (default: autodiscover)")
+	f.StringVar(&flags.concierge.authenticatorName, "concierge-authenticator-name", "", "Concierge authenticator name (default: autodiscover)")
+	f.StringVar(&flags.concierge.apiGroupSuffix, "concierge-api-group-suffix", "pinniped.dev", "Concierge API group suffix")
+
+	f.StringVar(&flags.oidc.issuer, "oidc-issuer", "", "OpenID Connect issuer URL (default: autodiscover)")
+	f.StringVar(&flags.oidc.clientID, "oidc-client-id", "pinniped-cli", "OpenID Connect client ID (default: autodiscover)")
+	f.Uint16Var(&flags.oidc.listenPort, "oidc-listen-port", 0, "TCP port for localhost listener (authorization code flow only)")
+	f.StringSliceVar(&flags.oidc.scopes, "oidc-scopes", []string{oidc.ScopeOfflineAccess, oidc.ScopeOpenID, "pinniped:request-audience"}, "OpenID Connect scopes to request during login")
+	f.BoolVar(&flags.oidc.skipBrowser, "oidc-skip-browser", false, "During OpenID Connect login, skip opening the browser (just print the URL)")
+	f.StringVar(&flags.oidc.sessionCachePath, "oidc-session-cache", "", "Path to OpenID Connect session cache file")
+	f.StringSliceVar(&flags.oidc.caBundlePaths, "oidc-ca-bundle", nil, "Path to TLS certificate authority bundle (PEM format, optional, can be repeated)")
+	f.BoolVar(&flags.oidc.debugSessionCache, "oidc-debug-session-cache", false, "Print debug logs related to the OpenID Connect session cache")
+	f.StringVar(&flags.oidc.requestAudience, "oidc-request-audience", "", "Request a token with an alternate audience using RFC8693 token exchange")
+	f.StringVar(&flags.kubeconfigPath, "kubeconfig", os.Getenv("KUBECONFIG"), "Path to kubeconfig file")
+	f.StringVar(&flags.kubeconfigContextOverride, "kubeconfig-context", "", "Kubeconfig context name (default: current active context)")
+
+	mustMarkHidden(cmd, "oidc-debug-session-cache")
+
+	mustMarkDeprecated(cmd, "concierge-namespace", "not needed anymore")
+	mustMarkHidden(cmd, "concierge-namespace")
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error { return runGetKubeconfig(cmd.OutOrStdout(), deps, flags) }
+	return cmd
+}
+
+//nolint:funlen
+func runGetKubeconfig(out io.Writer, deps kubeconfigDeps, flags getKubeconfigParams) error {
+	// Validate api group suffix and immediately return an error if it is invalid.
+	if err := groupsuffix.Validate(flags.concierge.apiGroupSuffix); err != nil {
+		return fmt.Errorf("invalid api group suffix: %w", err)
+	}
+
+	execConfig := clientcmdapi.ExecConfig{
+		APIVersion: clientauthenticationv1beta1.SchemeGroupVersion.String(),
+		Args:       []string{},
+		Env:        []clientcmdapi.ExecEnvVar{},
+	}
+
+	var err error
+	execConfig.Command, err = deps.getPathToSelf()
+	if err != nil {
+		return fmt.Errorf("could not determine the Pinniped executable path: %w", err)
+	}
+	execConfig.ProvideClusterInfo = true
+
+	oidcCABundle, err := loadCABundlePaths(flags.oidc.caBundlePaths)
+	if err != nil {
+		return fmt.Errorf("could not read --oidc-ca-bundle: %w", err)
+	}
+
+	clientConfig := newClientConfig(flags.kubeconfigPath, flags.kubeconfigContextOverride)
+	currentKubeConfig, err := clientConfig.RawConfig()
+	if err != nil {
+		return fmt.Errorf("could not load --kubeconfig: %w", err)
+	}
+	cluster, err := copyCurrentClusterFromExistingKubeConfig(currentKubeConfig, flags.kubeconfigContextOverride)
+	if err != nil {
+		return fmt.Errorf("could not load --kubeconfig/--kubeconfig-context: %w", err)
+	}
+	clientset, err := deps.getClientset(clientConfig, flags.concierge.apiGroupSuffix)
+	if err != nil {
+		return fmt.Errorf("could not configure Kubernetes client: %w", err)
+	}
+
+	if !flags.concierge.disabled {
+		authenticator, err := lookupAuthenticator(
+			clientset,
+			flags.concierge.authenticatorType,
+			flags.concierge.authenticatorName,
+		)
+		if err != nil {
+			return err
+		}
+		if err := configureConcierge(authenticator, &flags, cluster, &oidcCABundle, &execConfig); err != nil {
+			return err
+		}
+	}
+
+	// If one of the --static-* flags was passed, output a config that runs `pinniped login static`.
+	if flags.staticToken != "" || flags.staticTokenEnvName != "" {
+		if flags.staticToken != "" && flags.staticTokenEnvName != "" {
+			return fmt.Errorf("only one of --static-token and --static-token-env can be specified")
+		}
+		execConfig.Args = append([]string{"login", "static"}, execConfig.Args...)
+		if flags.staticToken != "" {
+			execConfig.Args = append(execConfig.Args, "--token="+flags.staticToken)
+		}
+		if flags.staticTokenEnvName != "" {
+			execConfig.Args = append(execConfig.Args, "--token-env="+flags.staticTokenEnvName)
+		}
+		return writeConfigAsYAML(out, newExecKubeconfig(cluster, &execConfig))
+	}
+
+	// Otherwise continue to parse the OIDC-related flags and output a config that runs `pinniped login oidc`.
+	execConfig.Args = append([]string{"login", "oidc"}, execConfig.Args...)
+	if flags.oidc.issuer == "" {
+		return fmt.Errorf("could not autodiscover --oidc-issuer, and none was provided")
+	}
+	execConfig.Args = append(execConfig.Args,
+		"--issuer="+flags.oidc.issuer,
+		"--client-id="+flags.oidc.clientID,
+		"--scopes="+strings.Join(flags.oidc.scopes, ","),
+	)
+	if flags.oidc.skipBrowser {
+		execConfig.Args = append(execConfig.Args, "--skip-browser")
+	}
+	if flags.oidc.listenPort != 0 {
+		execConfig.Args = append(execConfig.Args, "--listen-port="+strconv.Itoa(int(flags.oidc.listenPort)))
+	}
+	if oidcCABundle != "" {
+		execConfig.Args = append(execConfig.Args, "--ca-bundle-data="+base64.StdEncoding.EncodeToString([]byte(oidcCABundle)))
+	}
+	if flags.oidc.sessionCachePath != "" {
+		execConfig.Args = append(execConfig.Args, "--session-cache="+flags.oidc.sessionCachePath)
+	}
+	if flags.oidc.debugSessionCache {
+		execConfig.Args = append(execConfig.Args, "--debug-session-cache")
+	}
+	if flags.oidc.requestAudience != "" {
+		execConfig.Args = append(execConfig.Args, "--request-audience="+flags.oidc.requestAudience)
+	}
+	return writeConfigAsYAML(out, newExecKubeconfig(cluster, &execConfig))
+}
+
+func configureConcierge(authenticator metav1.Object, flags *getKubeconfigParams, v1Cluster *clientcmdapi.Cluster, oidcCABundle *string, execConfig *clientcmdapi.ExecConfig) error {
+	switch auth := authenticator.(type) {
+	case *conciergev1alpha1.WebhookAuthenticator:
+		// If the --concierge-authenticator-type/--concierge-authenticator-name flags were not set explicitly, set
+		// them to point at the discovered WebhookAuthenticator.
+		if flags.concierge.authenticatorType == "" && flags.concierge.authenticatorName == "" {
+			flags.concierge.authenticatorType = "webhook"
+			flags.concierge.authenticatorName = auth.Name
+		}
+	case *conciergev1alpha1.JWTAuthenticator:
+		// If the --concierge-authenticator-type/--concierge-authenticator-name flags were not set explicitly, set
+		// them to point at the discovered JWTAuthenticator.
+		if flags.concierge.authenticatorType == "" && flags.concierge.authenticatorName == "" {
+			flags.concierge.authenticatorType = "jwt"
+			flags.concierge.authenticatorName = auth.Name
+		}
+
+		// If the --oidc-issuer flag was not set explicitly, default it to the spec.issuer field of the JWTAuthenticator.
+		if flags.oidc.issuer == "" {
+			flags.oidc.issuer = auth.Spec.Issuer
+		}
+
+		// If the --oidc-request-audience flag was not set explicitly, default it to the spec.audience field of the JWTAuthenticator.
+		if flags.oidc.requestAudience == "" {
+			flags.oidc.requestAudience = auth.Spec.Audience
+		}
+
+		// If the --oidc-ca-bundle flags was not set explicitly, default it to the
+		// spec.tls.certificateAuthorityData field of the JWTAuthenticator.
+		if *oidcCABundle == "" && auth.Spec.TLS != nil && auth.Spec.TLS.CertificateAuthorityData != "" {
+			decoded, err := base64.StdEncoding.DecodeString(auth.Spec.TLS.CertificateAuthorityData)
+			if err != nil {
+				return fmt.Errorf("tried to autodiscover --oidc-ca-bundle, but JWTAuthenticator %s has invalid spec.tls.certificateAuthorityData: %w", auth.Name, err)
+			}
+			*oidcCABundle = string(decoded)
+		}
+	}
+
+	// Append the flags to configure the Concierge credential exchange at runtime.
+	execConfig.Args = append(execConfig.Args,
+		"--enable-concierge",
+		"--concierge-api-group-suffix="+flags.concierge.apiGroupSuffix,
+		"--concierge-authenticator-name="+flags.concierge.authenticatorName,
+		"--concierge-authenticator-type="+flags.concierge.authenticatorType,
+		"--concierge-endpoint="+v1Cluster.Server,
+		"--concierge-ca-bundle-data="+base64.StdEncoding.EncodeToString(v1Cluster.CertificateAuthorityData),
+	)
+	return nil
+}
+
+func loadCABundlePaths(paths []string) (string, error) {
+	if len(paths) == 0 {
+		return "", nil
+	}
+	blobs := make([][]byte, 0, len(paths))
+	for _, p := range paths {
+		pem, err := ioutil.ReadFile(p)
+		if err != nil {
+			return "", err
+		}
+		blobs = append(blobs, pem)
+	}
+	return string(bytes.Join(blobs, []byte("\n"))), nil
+}
+
+func newExecKubeconfig(cluster *clientcmdapi.Cluster, execConfig *clientcmdapi.ExecConfig) clientcmdapi.Config {
+	const name = "pinniped"
+	return clientcmdapi.Config{
+		Kind:           "Config",
+		APIVersion:     clientcmdapi.SchemeGroupVersion.Version,
+		Clusters:       map[string]*clientcmdapi.Cluster{name: cluster},
+		AuthInfos:      map[string]*clientcmdapi.AuthInfo{name: {Exec: execConfig}},
+		Contexts:       map[string]*clientcmdapi.Context{name: {Cluster: name, AuthInfo: name}},
+		CurrentContext: name,
+	}
+}
+
+func lookupAuthenticator(clientset conciergeclientset.Interface, authType, authName string) (metav1.Object, error) {
+	ctx, cancelFunc := context.WithTimeout(context.Background(), time.Second*20)
+	defer cancelFunc()
+
+	// If one was specified, look it up or error.
+	if authName != "" && authType != "" {
+		switch strings.ToLower(authType) {
+		case "webhook":
+			return clientset.AuthenticationV1alpha1().WebhookAuthenticators().Get(ctx, authName, metav1.GetOptions{})
+		case "jwt":
+			return clientset.AuthenticationV1alpha1().JWTAuthenticators().Get(ctx, authName, metav1.GetOptions{})
+		default:
+			return nil, fmt.Errorf(`invalid authenticator type %q, supported values are "webhook" and "jwt"`, authType)
+		}
+	}
+
+	// Otherwise list all the available authenticators and hope there's just a single one.
+
+	jwtAuths, err := clientset.AuthenticationV1alpha1().JWTAuthenticators().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("failed to list JWTAuthenticator objects for autodiscovery: %w", err)
+	}
+	webhooks, err := clientset.AuthenticationV1alpha1().WebhookAuthenticators().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("failed to list WebhookAuthenticator objects for autodiscovery: %w", err)
+	}
+
+	results := make([]metav1.Object, 0, len(jwtAuths.Items)+len(webhooks.Items))
+	for i := range jwtAuths.Items {
+		results = append(results, &jwtAuths.Items[i])
+	}
+	for i := range webhooks.Items {
+		results = append(results, &webhooks.Items[i])
+	}
+	if len(results) == 0 {
+		return nil, fmt.Errorf("no authenticators were found")
+	}
+	if len(results) > 1 {
+		return nil, fmt.Errorf("multiple authenticators were found, so the --concierge-authenticator-type/--concierge-authenticator-name flags must be specified")
+	}
+	return results[0], nil
+}
+
+func newClientConfig(kubeconfigPathOverride string, currentContextName string) clientcmd.ClientConfig {
+	loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()
+	loadingRules.ExplicitPath = kubeconfigPathOverride
+	clientConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, &clientcmd.ConfigOverrides{
+		CurrentContext: currentContextName,
+	})
+	return clientConfig
+}
+
+func writeConfigAsYAML(out io.Writer, config clientcmdapi.Config) error {
+	output, err := clientcmd.Write(config)
+	if err != nil {
+		return err
+	}
+	_, err = out.Write(output)
+	if err != nil {
+		return fmt.Errorf("could not write output: %w", err)
+	}
+	return nil
+}
+
+func copyCurrentClusterFromExistingKubeConfig(currentKubeConfig clientcmdapi.Config, currentContextNameOverride string) (*clientcmdapi.Cluster, error) {
+	contextName := currentKubeConfig.CurrentContext
+	if currentContextNameOverride != "" {
+		contextName = currentContextNameOverride
+	}
+	context := currentKubeConfig.Contexts[contextName]
+	if context == nil {
+		return nil, fmt.Errorf("no such context %q", contextName)
+	}
+	return currentKubeConfig.Clusters[context.Cluster], nil
+}

cmd/pinniped/cmd/kubeconfig_test.go

@@ -0,0 +1,540 @@
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"bytes"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	kubetesting "k8s.io/client-go/testing"
+	"k8s.io/client-go/tools/clientcmd"
+
+	conciergev1alpha1 "go.pinniped.dev/generated/1.20/apis/concierge/authentication/v1alpha1"
+	conciergeclientset "go.pinniped.dev/generated/1.20/client/concierge/clientset/versioned"
+	fakeconciergeclientset "go.pinniped.dev/generated/1.20/client/concierge/clientset/versioned/fake"
+	"go.pinniped.dev/internal/certauthority"
+	"go.pinniped.dev/internal/here"
+	"go.pinniped.dev/internal/testutil"
+)
+
+func TestGetKubeconfig(t *testing.T) {
+	testCA, err := certauthority.New(pkix.Name{CommonName: "Test CA"}, 1*time.Hour)
+	require.NoError(t, err)
+	tmpdir := testutil.TempDir(t)
+	testCABundlePath := filepath.Join(tmpdir, "testca.pem")
+	require.NoError(t, ioutil.WriteFile(testCABundlePath, testCA.Bundle(), 0600))
+
+	tests := []struct {
+		name               string
+		args               []string
+		env                map[string]string
+		getPathToSelfErr   error
+		getClientsetErr    error
+		conciergeObjects   []runtime.Object
+		conciergeReactions []kubetesting.Reactor
+		wantError          bool
+		wantStdout         string
+		wantStderr         string
+		wantOptionsCount   int
+		wantAPIGroupSuffix string
+	}{
+		{
+			name: "help flag passed",
+			args: []string{"--help"},
+			wantStdout: here.Doc(`
+				Generate a Pinniped-based kubeconfig for a cluster
+
+				Usage:
+				  kubeconfig [flags]
+
+				Flags:
+				      --concierge-api-group-suffix string     Concierge API group suffix (default "pinniped.dev")
+				      --concierge-authenticator-name string   Concierge authenticator name (default: autodiscover)
+				      --concierge-authenticator-type string   Concierge authenticator type (e.g., 'webhook', 'jwt') (default: autodiscover)
+				  -h, --help                                  help for kubeconfig
+				      --kubeconfig string                     Path to kubeconfig file
+				      --kubeconfig-context string             Kubeconfig context name (default: current active context)
+				      --no-concierge                          Generate a configuration which does not use the concierge, but sends the credential to the cluster directly
+				      --oidc-ca-bundle strings                Path to TLS certificate authority bundle (PEM format, optional, can be repeated)
+				      --oidc-client-id string                 OpenID Connect client ID (default: autodiscover) (default "pinniped-cli")
+				      --oidc-issuer string                    OpenID Connect issuer URL (default: autodiscover)
+				      --oidc-listen-port uint16               TCP port for localhost listener (authorization code flow only)
+				      --oidc-request-audience string          Request a token with an alternate audience using RFC8693 token exchange
+				      --oidc-scopes strings                   OpenID Connect scopes to request during login (default [offline_access,openid,pinniped:request-audience])
+				      --oidc-session-cache string             Path to OpenID Connect session cache file
+				      --oidc-skip-browser                     During OpenID Connect login, skip opening the browser (just print the URL)
+				      --static-token string                   Instead of doing an OIDC-based login, specify a static token
+				      --static-token-env string               Instead of doing an OIDC-based login, read a static token from the environment
+			`),
+		},
+		{
+			name:             "fail to get self-path",
+			args:             []string{},
+			getPathToSelfErr: fmt.Errorf("some OS error"),
+			wantError:        true,
+			wantStderr: here.Doc(`
+				Error: could not determine the Pinniped executable path: some OS error
+			`),
+		},
+		{
+			name: "invalid CA bundle paths",
+			args: []string{
+				"--oidc-ca-bundle", "./does/not/exist",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: could not read --oidc-ca-bundle: open ./does/not/exist: no such file or directory
+			`),
+		},
+		{
+			name: "invalid kubeconfig path",
+			args: []string{
+				"--kubeconfig", "./does/not/exist",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: could not load --kubeconfig: stat ./does/not/exist: no such file or directory
+			`),
+		},
+		{
+			name: "invalid kubeconfig context",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+				"--kubeconfig-context", "invalid",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: could not load --kubeconfig/--kubeconfig-context: no such context "invalid"
+			`),
+		},
+		{
+			name: "clientset creation failure",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+			},
+			getClientsetErr: fmt.Errorf("some kube error"),
+			wantError:       true,
+			wantStderr: here.Doc(`
+				Error: could not configure Kubernetes client: some kube error
+			`),
+		},
+		{
+			name: "webhook authenticator not found",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+				"--concierge-authenticator-type", "webhook",
+				"--concierge-authenticator-name", "test-authenticator",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: webhookauthenticators.authentication.concierge.pinniped.dev "test-authenticator" not found
+			`),
+		},
+		{
+			name: "JWT authenticator not found",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+				"--concierge-authenticator-type", "jwt",
+				"--concierge-authenticator-name", "test-authenticator",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: jwtauthenticators.authentication.concierge.pinniped.dev "test-authenticator" not found
+			`),
+		},
+		{
+			name: "invalid authenticator type",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+				"--concierge-authenticator-type", "invalid",
+				"--concierge-authenticator-name", "test-authenticator",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: invalid authenticator type "invalid", supported values are "webhook" and "jwt"
+			`),
+		},
+		{
+			name: "fail to autodetect authenticator, listing jwtauthenticators fails",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+			},
+			conciergeReactions: []kubetesting.Reactor{
+				&kubetesting.SimpleReactor{
+					Verb:     "*",
+					Resource: "jwtauthenticators",
+					Reaction: func(kubetesting.Action) (bool, runtime.Object, error) {
+						return true, nil, fmt.Errorf("some list error")
+					},
+				},
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: failed to list JWTAuthenticator objects for autodiscovery: some list error
+			`),
+		},
+		{
+			name: "fail to autodetect authenticator, listing webhookauthenticators fails",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+			},
+			conciergeReactions: []kubetesting.Reactor{
+				&kubetesting.SimpleReactor{
+					Verb:     "*",
+					Resource: "webhookauthenticators",
+					Reaction: func(kubetesting.Action) (bool, runtime.Object, error) {
+						return true, nil, fmt.Errorf("some list error")
+					},
+				},
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: failed to list WebhookAuthenticator objects for autodiscovery: some list error
+			`),
+		},
+		{
+			name: "fail to autodetect authenticator, none found",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: no authenticators were found
+			`),
+		},
+		{
+			name: "fail to autodetect authenticator, multiple found",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+			},
+			conciergeObjects: []runtime.Object{
+				&conciergev1alpha1.JWTAuthenticator{ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator-1"}},
+				&conciergev1alpha1.JWTAuthenticator{ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator-2"}},
+				&conciergev1alpha1.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator-3"}},
+				&conciergev1alpha1.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator-4"}},
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: multiple authenticators were found, so the --concierge-authenticator-type/--concierge-authenticator-name flags must be specified
+			`),
+		},
+		{
+			name: "autodetect webhook authenticator, missing --oidc-issuer",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+			},
+			conciergeObjects: []runtime.Object{
+				&conciergev1alpha1.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator"}},
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: could not autodiscover --oidc-issuer, and none was provided
+			`),
+		},
+		{
+			name: "autodetect JWT authenticator, invalid TLS bundle",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+			},
+			conciergeObjects: []runtime.Object{
+				&conciergev1alpha1.JWTAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator"},
+					Spec: conciergev1alpha1.JWTAuthenticatorSpec{
+						TLS: &conciergev1alpha1.TLSSpec{
+							CertificateAuthorityData: "invalid-base64",
+						},
+					},
+				},
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: tried to autodiscover --oidc-ca-bundle, but JWTAuthenticator test-authenticator has invalid spec.tls.certificateAuthorityData: illegal base64 data at input byte 7
+			`),
+		},
+		{
+			name: "invalid static token flags",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+				"--static-token", "test-token",
+				"--static-token-env", "TEST_TOKEN",
+			},
+			conciergeObjects: []runtime.Object{
+				&conciergev1alpha1.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator"}},
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: only one of --static-token and --static-token-env can be specified
+			`),
+		},
+		{
+			name: "invalid api group suffix",
+			args: []string{
+				"--concierge-api-group-suffix", ".starts.with.dot",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: invalid api group suffix: a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')
+			`),
+		},
+		{
+			name: "valid static token",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+				"--static-token", "test-token",
+			},
+			conciergeObjects: []runtime.Object{
+				&conciergev1alpha1.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator"}},
+			},
+			wantStdout: here.Doc(`
+        		apiVersion: v1
+        		clusters:
+        		- cluster:
+        		    certificate-authority-data: ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==
+        		    server: https://fake-server-url-value
+        		  name: pinniped
+        		contexts:
+        		- context:
+        		    cluster: pinniped
+        		    user: pinniped
+        		  name: pinniped
+        		current-context: pinniped
+        		kind: Config
+        		preferences: {}
+        		users:
+        		- name: pinniped
+        		  user:
+        		    exec:
+        		      apiVersion: client.authentication.k8s.io/v1beta1
+        		      args:
+        		      - login
+        		      - static
+        		      - --enable-concierge
+        		      - --concierge-api-group-suffix=pinniped.dev
+        		      - --concierge-authenticator-name=test-authenticator
+        		      - --concierge-authenticator-type=webhook
+        		      - --concierge-endpoint=https://fake-server-url-value
+        		      - --concierge-ca-bundle-data=ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==
+        		      - --token=test-token
+        		      command: '.../path/to/pinniped'
+        		      env: []
+        		      provideClusterInfo: true
+			`),
+		},
+		{
+			name: "valid static token from env var",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+				"--static-token-env", "TEST_TOKEN",
+			},
+			conciergeObjects: []runtime.Object{
+				&conciergev1alpha1.WebhookAuthenticator{ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator"}},
+			},
+			wantStdout: here.Doc(`
+        		apiVersion: v1
+        		clusters:
+        		- cluster:
+        		    certificate-authority-data: ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==
+        		    server: https://fake-server-url-value
+        		  name: pinniped
+        		contexts:
+        		- context:
+        		    cluster: pinniped
+        		    user: pinniped
+        		  name: pinniped
+        		current-context: pinniped
+        		kind: Config
+        		preferences: {}
+        		users:
+        		- name: pinniped
+        		  user:
+        		    exec:
+        		      apiVersion: client.authentication.k8s.io/v1beta1
+        		      args:
+        		      - login
+        		      - static
+        		      - --enable-concierge
+        		      - --concierge-api-group-suffix=pinniped.dev
+        		      - --concierge-authenticator-name=test-authenticator
+        		      - --concierge-authenticator-type=webhook
+        		      - --concierge-endpoint=https://fake-server-url-value
+        		      - --concierge-ca-bundle-data=ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==
+        		      - --token-env=TEST_TOKEN
+        		      command: '.../path/to/pinniped'
+        		      env: []
+        		      provideClusterInfo: true
+			`),
+		},
+		{
+			name: "autodetect JWT authenticator",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+			},
+			conciergeObjects: []runtime.Object{
+				&conciergev1alpha1.JWTAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator"},
+					Spec: conciergev1alpha1.JWTAuthenticatorSpec{
+						Issuer:   "https://example.com/issuer",
+						Audience: "test-audience",
+						TLS: &conciergev1alpha1.TLSSpec{
+							CertificateAuthorityData: base64.StdEncoding.EncodeToString(testCA.Bundle()),
+						},
+					},
+				},
+			},
+			wantStdout: here.Docf(`
+        		apiVersion: v1
+        		clusters:
+        		- cluster:
+        		    certificate-authority-data: ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==
+        		    server: https://fake-server-url-value
+        		  name: pinniped
+        		contexts:
+        		- context:
+        		    cluster: pinniped
+        		    user: pinniped
+        		  name: pinniped
+        		current-context: pinniped
+        		kind: Config
+        		preferences: {}
+        		users:
+        		- name: pinniped
+        		  user:
+        		    exec:
+        		      apiVersion: client.authentication.k8s.io/v1beta1
+        		      args:
+        		      - login
+        		      - oidc
+        		      - --enable-concierge
+        		      - --concierge-api-group-suffix=pinniped.dev
+        		      - --concierge-authenticator-name=test-authenticator
+        		      - --concierge-authenticator-type=jwt
+        		      - --concierge-endpoint=https://fake-server-url-value
+        		      - --concierge-ca-bundle-data=ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==
+        		      - --issuer=https://example.com/issuer
+        		      - --client-id=pinniped-cli
+        		      - --scopes=offline_access,openid,pinniped:request-audience
+        		      - --ca-bundle-data=%s
+        		      - --request-audience=test-audience
+        		      command: '.../path/to/pinniped'
+        		      env: []
+        		      provideClusterInfo: true
+			`, base64.StdEncoding.EncodeToString(testCA.Bundle())),
+		},
+		{
+			name: "autodetect nothing, set a bunch of options",
+			args: []string{
+				"--kubeconfig", "./testdata/kubeconfig.yaml",
+				"--concierge-api-group-suffix", "tuna.io",
+				"--concierge-authenticator-type", "webhook",
+				"--concierge-authenticator-name", "test-authenticator",
+				"--oidc-issuer", "https://example.com/issuer",
+				"--oidc-skip-browser",
+				"--oidc-listen-port", "1234",
+				"--oidc-ca-bundle", testCABundlePath,
+				"--oidc-session-cache", "/path/to/cache/dir/sessions.yaml",
+				"--oidc-debug-session-cache",
+				"--oidc-request-audience", "test-audience",
+			},
+			conciergeObjects: []runtime.Object{
+				&conciergev1alpha1.WebhookAuthenticator{
+					ObjectMeta: metav1.ObjectMeta{Name: "test-authenticator"},
+				},
+			},
+			wantStdout: here.Docf(`
+        		apiVersion: v1
+        		clusters:
+        		- cluster:
+        		    certificate-authority-data: ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==
+        		    server: https://fake-server-url-value
+        		  name: pinniped
+        		contexts:
+        		- context:
+        		    cluster: pinniped
+        		    user: pinniped
+        		  name: pinniped
+        		current-context: pinniped
+        		kind: Config
+        		preferences: {}
+        		users:
+        		- name: pinniped
+        		  user:
+        		    exec:
+        		      apiVersion: client.authentication.k8s.io/v1beta1
+        		      args:
+        		      - login
+        		      - oidc
+        		      - --enable-concierge
+        		      - --concierge-api-group-suffix=tuna.io
+        		      - --concierge-authenticator-name=test-authenticator
+        		      - --concierge-authenticator-type=webhook
+        		      - --concierge-endpoint=https://fake-server-url-value
+        		      - --concierge-ca-bundle-data=ZmFrZS1jZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YS12YWx1ZQ==
+        		      - --issuer=https://example.com/issuer
+        		      - --client-id=pinniped-cli
+        		      - --scopes=offline_access,openid,pinniped:request-audience
+        		      - --skip-browser
+        		      - --listen-port=1234
+        		      - --ca-bundle-data=%s
+        		      - --session-cache=/path/to/cache/dir/sessions.yaml
+        		      - --debug-session-cache
+        		      - --request-audience=test-audience
+        		      command: '.../path/to/pinniped'
+        		      env: []
+        		      provideClusterInfo: true
+			`, base64.StdEncoding.EncodeToString(testCA.Bundle())),
+			wantAPIGroupSuffix: "tuna.io",
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := kubeconfigCommand(kubeconfigDeps{
+				getPathToSelf: func() (string, error) {
+					if tt.getPathToSelfErr != nil {
+						return "", tt.getPathToSelfErr
+					}
+					return ".../path/to/pinniped", nil
+				},
+				getClientset: func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, error) {
+					if tt.wantAPIGroupSuffix == "" {
+						require.Equal(t, "pinniped.dev", apiGroupSuffix) // "pinniped.dev" = api group suffix default
+					} else {
+						require.Equal(t, tt.wantAPIGroupSuffix, apiGroupSuffix)
+					}
+					if tt.getClientsetErr != nil {
+						return nil, tt.getClientsetErr
+					}
+					fake := fakeconciergeclientset.NewSimpleClientset(tt.conciergeObjects...)
+					if len(tt.conciergeReactions) > 0 {
+						fake.ReactionChain = tt.conciergeReactions
+					}
+					return fake, nil
+				},
+			})
+			require.NotNil(t, cmd)
+
+			var stdout, stderr bytes.Buffer
+			cmd.SetOut(&stdout)
+			cmd.SetErr(&stderr)
+			cmd.SetArgs(tt.args)
+			err := cmd.Execute()
+			if tt.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tt.wantStdout, stdout.String(), "unexpected stdout")
+			require.Equal(t, tt.wantStderr, stderr.String(), "unexpected stderr")
+		})
+	}
+}

cmd/pinniped/cmd/login.go

@@ -12,7 +12,8 @@ var loginCmd = &cobra.Command{
 	Use:          "login",
 	Short:        "login",
 	Long:         "Login to a Pinniped server",
-	SilenceUsage: true, // do not print usage message when commands fail
+	SilenceUsage: true, // Do not print usage message when commands fail.
+	Hidden:       true, // These commands are not really meant to be used directly by users, so it's confusing to have them discoverable.
 }
 
 //nolint: gochecknoinits

cmd/pinniped/cmd/login_oidc.go

@@ -1,103 +1,228 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
 
 import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
 	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
 	"os"
 	"path/filepath"
+	"time"
 
+	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
+	clientauthv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
 	"k8s.io/klog/v2/klogr"
 
-	"go.pinniped.dev/internal/oidcclient"
-	"go.pinniped.dev/internal/oidcclient/filesession"
+	"go.pinniped.dev/pkg/conciergeclient"
+	"go.pinniped.dev/pkg/oidcclient"
+	"go.pinniped.dev/pkg/oidcclient/filesession"
+	"go.pinniped.dev/pkg/oidcclient/oidctypes"
 )
 
 //nolint: gochecknoinits
 func init() {
-	loginCmd.AddCommand(oidcLoginCommand(oidcclient.Login))
+	loginCmd.AddCommand(oidcLoginCommand(oidcLoginCommandRealDeps()))
 }
 
-func oidcLoginCommand(loginFunc func(issuer string, clientID string, opts ...oidcclient.Option) (*oidcclient.Token, error)) *cobra.Command {
+type oidcLoginCommandDeps struct {
+	login         func(string, string, ...oidcclient.Option) (*oidctypes.Token, error)
+	exchangeToken func(context.Context, *conciergeclient.Client, string) (*clientauthv1beta1.ExecCredential, error)
+}
+
+func oidcLoginCommandRealDeps() oidcLoginCommandDeps {
+	return oidcLoginCommandDeps{
+		login: oidcclient.Login,
+		exchangeToken: func(ctx context.Context, client *conciergeclient.Client, token string) (*clientauthv1beta1.ExecCredential, error) {
+			return client.ExchangeToken(ctx, token)
+		},
+	}
+}
+
+type oidcLoginFlags struct {
+	issuer                     string
+	clientID                   string
+	listenPort                 uint16
+	scopes                     []string
+	skipBrowser                bool
+	sessionCachePath           string
+	caBundlePaths              []string
+	caBundleData               []string
+	debugSessionCache          bool
+	requestAudience            string
+	conciergeEnabled           bool
+	conciergeAuthenticatorType string
+	conciergeAuthenticatorName string
+	conciergeEndpoint          string
+	conciergeCABundle          string
+	conciergeAPIGroupSuffix    string
+}
+
+func oidcLoginCommand(deps oidcLoginCommandDeps) *cobra.Command {
 	var (
-		cmd = cobra.Command{
+		cmd = &cobra.Command{
 			Args:         cobra.NoArgs,
-			Use:          "oidc --issuer ISSUER --client-id CLIENT_ID",
+			Use:          "oidc --issuer ISSUER",
 			Short:        "Login using an OpenID Connect provider",
 			SilenceUsage: true,
 		}
-		issuer            string
-		clientID          string
-		listenPort        uint16
-		scopes            []string
-		skipBrowser       bool
-		sessionCachePath  string
-		debugSessionCache bool
+		flags              oidcLoginFlags
+		conciergeNamespace string // unused now
 	)
-	cmd.Flags().StringVar(&issuer, "issuer", "", "OpenID Connect issuer URL.")
-	cmd.Flags().StringVar(&clientID, "client-id", "", "OpenID Connect client ID.")
-	cmd.Flags().Uint16Var(&listenPort, "listen-port", 0, "TCP port for localhost listener (authorization code flow only).")
-	cmd.Flags().StringSliceVar(&scopes, "scopes", []string{"offline_access", "openid", "email", "profile"}, "OIDC scopes to request during login.")
-	cmd.Flags().BoolVar(&skipBrowser, "skip-browser", false, "Skip opening the browser (just print the URL).")
-	cmd.Flags().StringVar(&sessionCachePath, "session-cache", filepath.Join(mustGetConfigDir(), "sessions.yaml"), "Path to session cache file.")
-	cmd.Flags().BoolVar(&debugSessionCache, "debug-session-cache", false, "Print debug logs related to the session cache.")
-	mustMarkHidden(&cmd, "debug-session-cache")
-	mustMarkRequired(&cmd, "issuer", "client-id")
+	cmd.Flags().StringVar(&flags.issuer, "issuer", "", "OpenID Connect issuer URL")
+	cmd.Flags().StringVar(&flags.clientID, "client-id", "pinniped-cli", "OpenID Connect client ID")
+	cmd.Flags().Uint16Var(&flags.listenPort, "listen-port", 0, "TCP port for localhost listener (authorization code flow only)")
+	cmd.Flags().StringSliceVar(&flags.scopes, "scopes", []string{oidc.ScopeOfflineAccess, oidc.ScopeOpenID, "pinniped:request-audience"}, "OIDC scopes to request during login")
+	cmd.Flags().BoolVar(&flags.skipBrowser, "skip-browser", false, "Skip opening the browser (just print the URL)")
+	cmd.Flags().StringVar(&flags.sessionCachePath, "session-cache", filepath.Join(mustGetConfigDir(), "sessions.yaml"), "Path to session cache file")
+	cmd.Flags().StringSliceVar(&flags.caBundlePaths, "ca-bundle", nil, "Path to TLS certificate authority bundle (PEM format, optional, can be repeated)")
+	cmd.Flags().StringSliceVar(&flags.caBundleData, "ca-bundle-data", nil, "Base64 endcoded TLS certificate authority bundle (base64 encoded PEM format, optional, can be repeated)")
+	cmd.Flags().BoolVar(&flags.debugSessionCache, "debug-session-cache", false, "Print debug logs related to the session cache")
+	cmd.Flags().StringVar(&flags.requestAudience, "request-audience", "", "Request a token with an alternate audience using RFC8693 token exchange")
+	cmd.Flags().BoolVar(&flags.conciergeEnabled, "enable-concierge", false, "Exchange the OIDC ID token with the Pinniped concierge during login")
+	cmd.Flags().StringVar(&conciergeNamespace, "concierge-namespace", "pinniped-concierge", "Namespace in which the concierge was installed")
+	cmd.Flags().StringVar(&flags.conciergeAuthenticatorType, "concierge-authenticator-type", "", "Concierge authenticator type (e.g., 'webhook', 'jwt')")
+	cmd.Flags().StringVar(&flags.conciergeAuthenticatorName, "concierge-authenticator-name", "", "Concierge authenticator name")
+	cmd.Flags().StringVar(&flags.conciergeEndpoint, "concierge-endpoint", "", "API base for the Pinniped concierge endpoint")
+	cmd.Flags().StringVar(&flags.conciergeCABundle, "concierge-ca-bundle-data", "", "CA bundle to use when connecting to the concierge")
+	cmd.Flags().StringVar(&flags.conciergeAPIGroupSuffix, "concierge-api-group-suffix", "pinniped.dev", "Concierge API group suffix")
 
-	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		// Initialize the session cache.
-		var sessionOptions []filesession.Option
+	mustMarkHidden(cmd, "debug-session-cache")
+	mustMarkRequired(cmd, "issuer")
+	cmd.RunE = func(cmd *cobra.Command, args []string) error { return runOIDCLogin(cmd, deps, flags) }
 
-		// If the hidden --debug-session-cache option is passed, log all the errors from the session cache with klog.
-		if debugSessionCache {
-			logger := klogr.New().WithName("session")
-			sessionOptions = append(sessionOptions, filesession.WithErrorReporter(func(err error) {
-				logger.Error(err, "error during session cache operation")
-			}))
+	mustMarkDeprecated(cmd, "concierge-namespace", "not needed anymore")
+	mustMarkHidden(cmd, "concierge-namespace")
+
+	return cmd
+}
+
+func runOIDCLogin(cmd *cobra.Command, deps oidcLoginCommandDeps, flags oidcLoginFlags) error {
+	// Initialize the session cache.
+	var sessionOptions []filesession.Option
+
+	// If the hidden --debug-session-cache option is passed, log all the errors from the session cache with klog.
+	if flags.debugSessionCache {
+		logger := klogr.New().WithName("session")
+		sessionOptions = append(sessionOptions, filesession.WithErrorReporter(func(err error) {
+			logger.Error(err, "error during session cache operation")
+		}))
+	}
+	sessionCache := filesession.New(flags.sessionCachePath, sessionOptions...)
+
+	// Initialize the login handler.
+	opts := []oidcclient.Option{
+		oidcclient.WithContext(cmd.Context()),
+		oidcclient.WithScopes(flags.scopes),
+		oidcclient.WithSessionCache(sessionCache),
+	}
+
+	if flags.listenPort != 0 {
+		opts = append(opts, oidcclient.WithListenPort(flags.listenPort))
+	}
+
+	if flags.requestAudience != "" {
+		opts = append(opts, oidcclient.WithRequestAudience(flags.requestAudience))
+	}
+
+	var concierge *conciergeclient.Client
+	if flags.conciergeEnabled {
+		var err error
+		concierge, err = conciergeclient.New(
+			conciergeclient.WithEndpoint(flags.conciergeEndpoint),
+			conciergeclient.WithBase64CABundle(flags.conciergeCABundle),
+			conciergeclient.WithAuthenticator(flags.conciergeAuthenticatorType, flags.conciergeAuthenticatorName),
+			conciergeclient.WithAPIGroupSuffix(flags.conciergeAPIGroupSuffix),
+		)
+		if err != nil {
+			return fmt.Errorf("invalid concierge parameters: %w", err)
 		}
-		sessionCache := filesession.New(sessionCachePath, sessionOptions...)
+	}
 
-		// Initialize the login handler.
-		opts := []oidcclient.Option{
-			oidcclient.WithContext(cmd.Context()),
-			oidcclient.WithScopes(scopes),
-			oidcclient.WithSessionCache(sessionCache),
-		}
+	// --skip-browser replaces the default "browser open" function with one that prints to stderr.
+	if flags.skipBrowser {
+		opts = append(opts, oidcclient.WithBrowserOpen(func(url string) error {
+			cmd.PrintErr("Please log in: ", url, "\n")
+			return nil
+		}))
+	}
 
-		if listenPort != 0 {
-			opts = append(opts, oidcclient.WithListenPort(listenPort))
-		}
-
-		// --skip-browser replaces the default "browser open" function with one that prints to stderr.
-		if skipBrowser {
-			opts = append(opts, oidcclient.WithBrowserOpen(func(url string) error {
-				cmd.PrintErr("Please log in: ", url, "\n")
-				return nil
-			}))
-		}
-
-		tok, err := loginFunc(issuer, clientID, opts...)
+	if len(flags.caBundlePaths) > 0 || len(flags.caBundleData) > 0 {
+		client, err := makeClient(flags.caBundlePaths, flags.caBundleData)
 		if err != nil {
 			return err
 		}
-
-		// Convert the token out to Kubernetes ExecCredential JSON format for output.
-		return json.NewEncoder(cmd.OutOrStdout()).Encode(&clientauthenticationv1beta1.ExecCredential{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       "ExecCredential",
-				APIVersion: "client.authentication.k8s.io/v1beta1",
-			},
-			Status: &clientauthenticationv1beta1.ExecCredentialStatus{
-				ExpirationTimestamp: &tok.IDToken.Expiry,
-				Token:               tok.IDToken.Token,
-			},
-		})
+		opts = append(opts, oidcclient.WithClient(client))
 	}
-	return &cmd
+
+	// Do the basic login to get an OIDC token.
+	token, err := deps.login(flags.issuer, flags.clientID, opts...)
+	if err != nil {
+		return fmt.Errorf("could not complete Pinniped login: %w", err)
+	}
+	cred := tokenCredential(token)
+
+	// If the concierge was configured, exchange the credential for a separate short-lived, cluster-specific credential.
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	if concierge != nil {
+		cred, err = deps.exchangeToken(ctx, concierge, token.IDToken.Token)
+		if err != nil {
+			return fmt.Errorf("could not complete concierge credential exchange: %w", err)
+		}
+	}
+	return json.NewEncoder(cmd.OutOrStdout()).Encode(cred)
+}
+func makeClient(caBundlePaths []string, caBundleData []string) (*http.Client, error) {
+	pool := x509.NewCertPool()
+	for _, p := range caBundlePaths {
+		pem, err := ioutil.ReadFile(p)
+		if err != nil {
+			return nil, fmt.Errorf("could not read --ca-bundle: %w", err)
+		}
+		pool.AppendCertsFromPEM(pem)
+	}
+	for _, d := range caBundleData {
+		pem, err := base64.StdEncoding.DecodeString(d)
+		if err != nil {
+			return nil, fmt.Errorf("could not read --ca-bundle-data: %w", err)
+		}
+		pool.AppendCertsFromPEM(pem)
+	}
+	return &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			TLSClientConfig: &tls.Config{
+				RootCAs:    pool,
+				MinVersion: tls.VersionTLS12,
+			},
+		},
+	}, nil
+}
+
+func tokenCredential(token *oidctypes.Token) *clientauthv1beta1.ExecCredential {
+	cred := clientauthv1beta1.ExecCredential{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ExecCredential",
+			APIVersion: "client.authentication.k8s.io/v1beta1",
+		},
+		Status: &clientauthv1beta1.ExecCredentialStatus{
+			Token: token.IDToken.Token,
+		},
+	}
+	if !token.IDToken.Expiry.IsZero() {
+		cred.Status.ExpirationTimestamp = &token.IDToken.Expiry
+	}
+	return &cred
 }
 
 // mustGetConfigDir returns a directory that follows the XDG base directory convention:

cmd/pinniped/cmd/login_oidc_test.go

@@ -1,35 +1,50 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
 
 import (
 	"bytes"
+	"context"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientauthv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
 
+	"go.pinniped.dev/internal/certauthority"
 	"go.pinniped.dev/internal/here"
-	"go.pinniped.dev/internal/oidcclient"
+	"go.pinniped.dev/internal/testutil"
+	"go.pinniped.dev/pkg/conciergeclient"
+	"go.pinniped.dev/pkg/oidcclient"
+	"go.pinniped.dev/pkg/oidcclient/oidctypes"
 )
 
 func TestLoginOIDCCommand(t *testing.T) {
-	t.Parallel()
-
 	cfgDir := mustGetConfigDir()
 
+	testCA, err := certauthority.New(pkix.Name{CommonName: "Test CA"}, 1*time.Hour)
+	require.NoError(t, err)
+	tmpdir := testutil.TempDir(t)
+	testCABundlePath := filepath.Join(tmpdir, "testca.pem")
+	require.NoError(t, ioutil.WriteFile(testCABundlePath, testCA.Bundle(), 0600))
+
 	time1 := time.Date(3020, 10, 12, 13, 14, 15, 16, time.UTC)
 
 	tests := []struct {
 		name             string
 		args             []string
+		loginErr         error
+		conciergeErr     error
 		wantError        bool
 		wantStdout       string
 		wantStderr       string
-		wantIssuer       string
-		wantClientID     string
 		wantOptionsCount int
 	}{
 		{
@@ -39,24 +54,114 @@ func TestLoginOIDCCommand(t *testing.T) {
 				Login using an OpenID Connect provider
 
 				Usage:
-				  oidc --issuer ISSUER --client-id CLIENT_ID [flags]
+				  oidc --issuer ISSUER [flags]
 
 				Flags:
-					  --client-id string       OpenID Connect client ID.
-				  -h, --help                   help for oidc
-					  --issuer string          OpenID Connect issuer URL.
-					  --listen-port uint16     TCP port for localhost listener (authorization code flow only).
-					  --scopes strings         OIDC scopes to request during login. (default [offline_access,openid,email,profile])
-					  --session-cache string   Path to session cache file. (default "` + cfgDir + `/sessions.yaml")
-					  --skip-browser           Skip opening the browser (just print the URL).
+				      --ca-bundle strings                     Path to TLS certificate authority bundle (PEM format, optional, can be repeated)
+				      --ca-bundle-data strings                Base64 endcoded TLS certificate authority bundle (base64 encoded PEM format, optional, can be repeated)
+				      --client-id string                      OpenID Connect client ID (default "pinniped-cli")
+				      --concierge-api-group-suffix string     Concierge API group suffix (default "pinniped.dev")
+				      --concierge-authenticator-name string   Concierge authenticator name
+				      --concierge-authenticator-type string   Concierge authenticator type (e.g., 'webhook', 'jwt')
+				      --concierge-ca-bundle-data string       CA bundle to use when connecting to the concierge
+				      --concierge-endpoint string             API base for the Pinniped concierge endpoint
+				      --enable-concierge                      Exchange the OIDC ID token with the Pinniped concierge during login
+				  -h, --help                                  help for oidc
+				      --issuer string                         OpenID Connect issuer URL
+				      --listen-port uint16                    TCP port for localhost listener (authorization code flow only)
+				      --request-audience string               Request a token with an alternate audience using RFC8693 token exchange
+				      --scopes strings                        OIDC scopes to request during login (default [offline_access,openid,pinniped:request-audience])
+				      --session-cache string                  Path to session cache file (default "` + cfgDir + `/sessions.yaml")
+				      --skip-browser                          Skip opening the browser (just print the URL)
 			`),
 		},
 		{
 			name:      "missing required flags",
 			args:      []string{},
 			wantError: true,
-			wantStdout: here.Doc(`
-				Error: required flag(s) "client-id", "issuer" not set
+			wantStderr: here.Doc(`
+				Error: required flag(s) "issuer" not set
+			`),
+		},
+		{
+			name: "missing concierge flags",
+			args: []string{
+				"--client-id", "test-client-id",
+				"--issuer", "test-issuer",
+				"--enable-concierge",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: invalid concierge parameters: endpoint must not be empty
+			`),
+		},
+		{
+			name: "invalid CA bundle path",
+			args: []string{
+				"--client-id", "test-client-id",
+				"--issuer", "test-issuer",
+				"--ca-bundle", "./does/not/exist",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: could not read --ca-bundle: open ./does/not/exist: no such file or directory
+			`),
+		},
+		{
+			name: "invalid CA bundle data",
+			args: []string{
+				"--client-id", "test-client-id",
+				"--issuer", "test-issuer",
+				"--ca-bundle-data", "invalid-base64",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: could not read --ca-bundle-data: illegal base64 data at input byte 7
+			`),
+		},
+		{
+			name: "invalid api group suffix",
+			args: []string{
+				"--issuer", "test-issuer",
+				"--enable-concierge",
+				"--concierge-api-group-suffix", ".starts.with.dot",
+				"--concierge-authenticator-type", "jwt",
+				"--concierge-authenticator-name", "test-authenticator",
+				"--concierge-endpoint", "https://127.0.0.1:1234/",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: invalid concierge parameters: invalid api group suffix: a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')
+			`),
+		},
+		{
+			name: "login error",
+			args: []string{
+				"--client-id", "test-client-id",
+				"--issuer", "test-issuer",
+			},
+			loginErr:         fmt.Errorf("some login error"),
+			wantOptionsCount: 3,
+			wantError:        true,
+			wantStderr: here.Doc(`
+				Error: could not complete Pinniped login: some login error
+			`),
+		},
+		{
+			name: "concierge token exchange error",
+			args: []string{
+				"--client-id", "test-client-id",
+				"--issuer", "test-issuer",
+				"--enable-concierge",
+				"--concierge-authenticator-type", "jwt",
+				"--concierge-authenticator-name", "test-authenticator",
+				"--concierge-endpoint", "https://127.0.0.1:1234/",
+			},
+			conciergeErr:     fmt.Errorf("some concierge error"),
+			wantOptionsCount: 3,
+			wantError:        true,
+			wantStderr: here.Doc(`
+				Error: could not complete concierge credential exchange: some concierge error
 			`),
 		},
 		{
@@ -65,8 +170,6 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--client-id", "test-client-id",
 				"--issuer", "test-issuer",
 			},
-			wantIssuer:       "test-issuer",
-			wantClientID:     "test-client-id",
 			wantOptionsCount: 3,
 			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
 		},
@@ -78,32 +181,56 @@ func TestLoginOIDCCommand(t *testing.T) {
 				"--skip-browser",
 				"--listen-port", "1234",
 				"--debug-session-cache",
+				"--request-audience", "cluster-1234",
+				"--ca-bundle-data", base64.StdEncoding.EncodeToString(testCA.Bundle()),
+				"--ca-bundle", testCABundlePath,
+				"--enable-concierge",
+				"--concierge-authenticator-type", "webhook",
+				"--concierge-authenticator-name", "test-authenticator",
+				"--concierge-endpoint", "https://127.0.0.1:1234/",
+				"--concierge-ca-bundle-data", base64.StdEncoding.EncodeToString(testCA.Bundle()),
+				"--concierge-api-group-suffix", "some.suffix.com",
 			},
-			wantIssuer:       "test-issuer",
-			wantClientID:     "test-client-id",
-			wantOptionsCount: 5,
-			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{},"status":{"expirationTimestamp":"3020-10-12T13:14:15Z","token":"test-id-token"}}` + "\n",
+			wantOptionsCount: 7,
+			wantStdout:       `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{},"status":{"token":"exchanged-token"}}` + "\n",
 		},
 	}
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
 			var (
-				gotIssuer   string
-				gotClientID string
-				gotOptions  []oidcclient.Option
+				gotOptions []oidcclient.Option
 			)
-			cmd := oidcLoginCommand(func(issuer string, clientID string, opts ...oidcclient.Option) (*oidcclient.Token, error) {
-				gotIssuer = issuer
-				gotClientID = clientID
-				gotOptions = opts
-				return &oidcclient.Token{
-					IDToken: &oidcclient.IDToken{
-						Token:  "test-id-token",
-						Expiry: metav1.NewTime(time1),
-					},
-				}, nil
+			cmd := oidcLoginCommand(oidcLoginCommandDeps{
+				login: func(issuer string, clientID string, opts ...oidcclient.Option) (*oidctypes.Token, error) {
+					require.Equal(t, "test-issuer", issuer)
+					require.Equal(t, "test-client-id", clientID)
+					gotOptions = opts
+					if tt.loginErr != nil {
+						return nil, tt.loginErr
+					}
+					return &oidctypes.Token{
+						IDToken: &oidctypes.IDToken{
+							Token:  "test-id-token",
+							Expiry: metav1.NewTime(time1),
+						},
+					}, nil
+				},
+				exchangeToken: func(ctx context.Context, client *conciergeclient.Client, token string) (*clientauthv1beta1.ExecCredential, error) {
+					require.Equal(t, token, "test-id-token")
+					if tt.conciergeErr != nil {
+						return nil, tt.conciergeErr
+					}
+					return &clientauthv1beta1.ExecCredential{
+						TypeMeta: metav1.TypeMeta{
+							Kind:       "ExecCredential",
+							APIVersion: "client.authentication.k8s.io/v1beta1",
+						},
+						Status: &clientauthv1beta1.ExecCredentialStatus{
+							Token: "exchanged-token",
+						},
+					}, nil
+				},
 			})
 			require.NotNil(t, cmd)
 
@@ -119,8 +246,6 @@ func TestLoginOIDCCommand(t *testing.T) {
 			}
 			require.Equal(t, tt.wantStdout, stdout.String(), "unexpected stdout")
 			require.Equal(t, tt.wantStderr, stderr.String(), "unexpected stderr")
-			require.Equal(t, tt.wantIssuer, gotIssuer, "unexpected issuer")
-			require.Equal(t, tt.wantClientID, gotClientID, "unexpected client ID")
 			require.Len(t, gotOptions, tt.wantOptionsCount)
 		})
 	}

cmd/pinniped/cmd/login_static.go

@@ -0,0 +1,126 @@
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"time"
+
+	"github.com/spf13/cobra"
+	clientauthv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
+
+	"go.pinniped.dev/pkg/conciergeclient"
+	"go.pinniped.dev/pkg/oidcclient/oidctypes"
+)
+
+//nolint: gochecknoinits
+func init() {
+	loginCmd.AddCommand(staticLoginCommand(staticLoginRealDeps()))
+}
+
+type staticLoginDeps struct {
+	lookupEnv     func(string) (string, bool)
+	exchangeToken func(context.Context, *conciergeclient.Client, string) (*clientauthv1beta1.ExecCredential, error)
+}
+
+func staticLoginRealDeps() staticLoginDeps {
+	return staticLoginDeps{
+		lookupEnv: os.LookupEnv,
+		exchangeToken: func(ctx context.Context, client *conciergeclient.Client, token string) (*clientauthv1beta1.ExecCredential, error) {
+			return client.ExchangeToken(ctx, token)
+		},
+	}
+}
+
+type staticLoginParams struct {
+	staticToken                string
+	staticTokenEnvName         string
+	conciergeEnabled           bool
+	conciergeAuthenticatorType string
+	conciergeAuthenticatorName string
+	conciergeEndpoint          string
+	conciergeCABundle          string
+	conciergeAPIGroupSuffix    string
+}
+
+func staticLoginCommand(deps staticLoginDeps) *cobra.Command {
+	var (
+		cmd = &cobra.Command{
+			Args:         cobra.NoArgs,
+			Use:          "static [--token TOKEN] [--token-env TOKEN_NAME]",
+			Short:        "Login using a static token",
+			SilenceUsage: true,
+		}
+		flags              staticLoginParams
+		conciergeNamespace string // unused now
+	)
+	cmd.Flags().StringVar(&flags.staticToken, "token", "", "Static token to present during login")
+	cmd.Flags().StringVar(&flags.staticTokenEnvName, "token-env", "", "Environment variable containing a static token")
+	cmd.Flags().BoolVar(&flags.conciergeEnabled, "enable-concierge", false, "Exchange the token with the Pinniped concierge during login")
+	cmd.Flags().StringVar(&conciergeNamespace, "concierge-namespace", "pinniped-concierge", "Namespace in which the concierge was installed")
+	cmd.Flags().StringVar(&flags.conciergeAuthenticatorType, "concierge-authenticator-type", "", "Concierge authenticator type (e.g., 'webhook', 'jwt')")
+	cmd.Flags().StringVar(&flags.conciergeAuthenticatorName, "concierge-authenticator-name", "", "Concierge authenticator name")
+	cmd.Flags().StringVar(&flags.conciergeEndpoint, "concierge-endpoint", "", "API base for the Pinniped concierge endpoint")
+	cmd.Flags().StringVar(&flags.conciergeCABundle, "concierge-ca-bundle-data", "", "CA bundle to use when connecting to the concierge")
+	cmd.Flags().StringVar(&flags.conciergeAPIGroupSuffix, "concierge-api-group-suffix", "pinniped.dev", "Concierge API group suffix")
+	cmd.RunE = func(cmd *cobra.Command, args []string) error { return runStaticLogin(cmd.OutOrStdout(), deps, flags) }
+
+	mustMarkDeprecated(cmd, "concierge-namespace", "not needed anymore")
+	mustMarkHidden(cmd, "concierge-namespace")
+
+	return cmd
+}
+
+func runStaticLogin(out io.Writer, deps staticLoginDeps, flags staticLoginParams) error {
+	if flags.staticToken == "" && flags.staticTokenEnvName == "" {
+		return fmt.Errorf("one of --token or --token-env must be set")
+	}
+
+	var concierge *conciergeclient.Client
+	if flags.conciergeEnabled {
+		var err error
+		concierge, err = conciergeclient.New(
+			conciergeclient.WithEndpoint(flags.conciergeEndpoint),
+			conciergeclient.WithBase64CABundle(flags.conciergeCABundle),
+			conciergeclient.WithAuthenticator(flags.conciergeAuthenticatorType, flags.conciergeAuthenticatorName),
+			conciergeclient.WithAPIGroupSuffix(flags.conciergeAPIGroupSuffix),
+		)
+		if err != nil {
+			return fmt.Errorf("invalid concierge parameters: %w", err)
+		}
+	}
+
+	var token string
+	if flags.staticToken != "" {
+		token = flags.staticToken
+	}
+	if flags.staticTokenEnvName != "" {
+		var ok bool
+		token, ok = deps.lookupEnv(flags.staticTokenEnvName)
+		if !ok {
+			return fmt.Errorf("--token-env variable %q is not set", flags.staticTokenEnvName)
+		}
+		if token == "" {
+			return fmt.Errorf("--token-env variable %q is empty", flags.staticTokenEnvName)
+		}
+	}
+	cred := tokenCredential(&oidctypes.Token{IDToken: &oidctypes.IDToken{Token: token}})
+
+	// Exchange that token with the concierge, if configured.
+	if concierge != nil {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+
+		var err error
+		cred, err = deps.exchangeToken(ctx, concierge, token)
+		if err != nil {
+			return fmt.Errorf("could not complete concierge credential exchange: %w", err)
+		}
+	}
+	return json.NewEncoder(out).Encode(cred)
+}

cmd/pinniped/cmd/login_static_test.go

@@ -0,0 +1,195 @@
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"crypto/x509/pkix"
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientauthv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
+
+	"go.pinniped.dev/internal/certauthority"
+	"go.pinniped.dev/internal/here"
+	"go.pinniped.dev/internal/testutil"
+	"go.pinniped.dev/pkg/conciergeclient"
+)
+
+func TestLoginStaticCommand(t *testing.T) {
+	testCA, err := certauthority.New(pkix.Name{CommonName: "Test CA"}, 1*time.Hour)
+	require.NoError(t, err)
+	tmpdir := testutil.TempDir(t)
+	testCABundlePath := filepath.Join(tmpdir, "testca.pem")
+	require.NoError(t, ioutil.WriteFile(testCABundlePath, testCA.Bundle(), 0600))
+
+	tests := []struct {
+		name             string
+		args             []string
+		env              map[string]string
+		loginErr         error
+		conciergeErr     error
+		wantError        bool
+		wantStdout       string
+		wantStderr       string
+		wantOptionsCount int
+	}{
+		{
+			name: "help flag passed",
+			args: []string{"--help"},
+			wantStdout: here.Doc(`
+				Login using a static token
+
+				Usage:
+				  static [--token TOKEN] [--token-env TOKEN_NAME] [flags]
+
+				Flags:
+				      --concierge-api-group-suffix string     Concierge API group suffix (default "pinniped.dev")
+				      --concierge-authenticator-name string   Concierge authenticator name
+				      --concierge-authenticator-type string   Concierge authenticator type (e.g., 'webhook', 'jwt')
+				      --concierge-ca-bundle-data string       CA bundle to use when connecting to the concierge
+				      --concierge-endpoint string             API base for the Pinniped concierge endpoint
+				      --enable-concierge                      Exchange the token with the Pinniped concierge during login
+				  -h, --help                                  help for static
+				      --token string                          Static token to present during login
+				      --token-env string                      Environment variable containing a static token
+			`),
+		},
+		{
+			name:      "missing required flags",
+			args:      []string{},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: one of --token or --token-env must be set
+			`),
+		},
+		{
+			name: "missing concierge flags",
+			args: []string{
+				"--token", "test-token",
+				"--enable-concierge",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: invalid concierge parameters: endpoint must not be empty
+			`),
+		},
+		{
+			name: "missing env var",
+			args: []string{
+				"--token-env", "TEST_TOKEN_ENV",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: --token-env variable "TEST_TOKEN_ENV" is not set
+			`),
+		},
+		{
+			name: "empty env var",
+			args: []string{
+				"--token-env", "TEST_TOKEN_ENV",
+			},
+			env: map[string]string{
+				"TEST_TOKEN_ENV": "",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: --token-env variable "TEST_TOKEN_ENV" is empty
+			`),
+		},
+		{
+			name: "env var token success",
+			args: []string{
+				"--token-env", "TEST_TOKEN_ENV",
+			},
+			env: map[string]string{
+				"TEST_TOKEN_ENV": "test-token",
+			},
+			wantStdout: `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{},"status":{"token":"test-token"}}` + "\n",
+		},
+		{
+			name: "concierge failure",
+			args: []string{
+				"--token", "test-token",
+				"--enable-concierge",
+				"--concierge-endpoint", "https://127.0.0.1/",
+				"--concierge-authenticator-type", "webhook",
+				"--concierge-authenticator-name", "test-authenticator",
+			},
+			conciergeErr: fmt.Errorf("some concierge error"),
+			wantError:    true,
+			wantStderr: here.Doc(`
+				Error: could not complete concierge credential exchange: some concierge error
+			`),
+		},
+		{
+			name: "invalid api group suffix",
+			args: []string{
+				"--token", "test-token",
+				"--enable-concierge",
+				"--concierge-api-group-suffix", ".starts.with.dot",
+				"--concierge-authenticator-type", "jwt",
+				"--concierge-authenticator-name", "test-authenticator",
+				"--concierge-endpoint", "https://127.0.0.1:1234/",
+			},
+			wantError: true,
+			wantStderr: here.Doc(`
+				Error: invalid concierge parameters: invalid api group suffix: a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')
+			`),
+		},
+		{
+			name: "static token success",
+			args: []string{
+				"--token", "test-token",
+			},
+			wantStdout: `{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{},"status":{"token":"test-token"}}` + "\n",
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := staticLoginCommand(staticLoginDeps{
+				lookupEnv: func(s string) (string, bool) {
+					v, ok := tt.env[s]
+					return v, ok
+				},
+				exchangeToken: func(ctx context.Context, client *conciergeclient.Client, token string) (*clientauthv1beta1.ExecCredential, error) {
+					require.Equal(t, token, "test-token")
+					if tt.conciergeErr != nil {
+						return nil, tt.conciergeErr
+					}
+					return &clientauthv1beta1.ExecCredential{
+						TypeMeta: metav1.TypeMeta{
+							Kind:       "ExecCredential",
+							APIVersion: "client.authentication.k8s.io/v1beta1",
+						},
+						Status: &clientauthv1beta1.ExecCredentialStatus{
+							Token: "exchanged-token",
+						},
+					}, nil
+				},
+			})
+			require.NotNil(t, cmd)
+
+			var stdout, stderr bytes.Buffer
+			cmd.SetOut(&stdout)
+			cmd.SetErr(&stderr)
+			cmd.SetArgs(tt.args)
+			err := cmd.Execute()
+			if tt.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tt.wantStdout, stdout.String(), "unexpected stdout")
+			require.Equal(t, tt.wantStderr, stderr.String(), "unexpected stderr")
+		})
+	}
+}

cmd/pinniped/cmd/root.go

@@ -1,13 +1,14 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
 
 import (
-	"fmt"
 	"os"
 
 	"github.com/spf13/cobra"
+
+	"go.pinniped.dev/internal/plog"
 )
 
 //nolint: gochecknoglobals
@@ -18,11 +19,16 @@ var rootCmd = &cobra.Command{
 	SilenceUsage: true, // do not print usage message when commands fail
 }
 
+//nolint: gochecknoinits
+func init() {
+	// We don't want klog flags showing up in our CLI.
+	plog.RemoveKlogGlobalFlags()
+}
+
 // Execute adds all child commands to the root command and sets flags appropriately.
 // This is called by main.main(). It only needs to happen once to the rootCmd.
 func Execute() {
 	if err := rootCmd.Execute(); err != nil {
-		fmt.Println(err)
 		os.Exit(1)
 	}
 }

cmd/pinniped/cmd/version_test.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"go.pinniped.dev/internal/here"
@@ -36,13 +37,12 @@ var (
 )
 
 func TestNewVersionCmd(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name             string
 		args             []string
 		wantError        bool
 		wantStdoutRegexp string
-		wantStderr       string
+		wantStderrRegexp string
 	}{
 		{
 			name:             "no flags",
@@ -58,13 +58,13 @@ func TestNewVersionCmd(t *testing.T) {
 			name:             "arg passed",
 			args:             []string{"tuna"},
 			wantError:        true,
-			wantStdoutRegexp: `Error: unknown command "tuna" for "version"` + "\n" + knownGoodUsageRegexpForVersion,
+			wantStderrRegexp: `Error: unknown command "tuna" for "version"`,
+			wantStdoutRegexp: knownGoodUsageRegexpForVersion,
 		},
 	}
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
 			cmd := newVersionCommand()
 			require.NotNil(t, cmd)
 
@@ -78,8 +78,8 @@ func TestNewVersionCmd(t *testing.T) {
 			} else {
 				require.NoError(t, err)
 			}
-			require.Regexp(t, tt.wantStdoutRegexp, stdout.String(), "unexpected stdout")
-			require.Equal(t, tt.wantStderr, stderr.String(), "unexpected stderr")
+			assert.Regexp(t, tt.wantStdoutRegexp, stdout.String(), "unexpected stdout")
+			assert.Regexp(t, tt.wantStderrRegexp, stderr.String(), "unexpected stderr")
 		})
 	}
 }

deploy/concierge/README.md

@@ -10,17 +10,17 @@ for details.
 ## Installing the Latest Version with Default Options
 
 ```bash
-kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/$(curl https://api.github.com/repos/vmware-tanzu/pinniped/releases/latest -s | jq .name -r)/install-pinniped-concierge.yaml
+kubectl apply -f https://get.pinniped.dev/latest/install-pinniped-concierge.yaml
 ```
 
-## Installing an Older Version with Default Options
+## Installing a Specific Version with Default Options
 
 Choose your preferred [release](https://github.com/vmware-tanzu/pinniped/releases) version number
 and use it to replace the version number in the URL below.
 
 ```bash
-# Replace v0.2.0 with your preferred version in the URL below
-kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/v0.2.0/install-pinniped-concierge.yaml
+# Replace v0.4.1 with your preferred version in the URL below
+kubectl apply -f https://get.pinniped.dev/v0.4.1/install-pinniped-concierge.yaml
 ```
 
 ## Installing with Custom Options

deploy/concierge/authentication.concierge.pinniped.dev_jwtauthenticators.yaml

@@ -0,0 +1,171 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.0
+  creationTimestamp: null
+  name: jwtauthenticators.authentication.concierge.pinniped.dev
+spec:
+  group: authentication.concierge.pinniped.dev
+  names:
+    categories:
+    - pinniped
+    - pinniped-authenticator
+    - pinniped-authenticators
+    kind: JWTAuthenticator
+    listKind: JWTAuthenticatorList
+    plural: jwtauthenticators
+    singular: jwtauthenticator
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.issuer
+      name: Issuer
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: "JWTAuthenticator describes the configuration of a JWT authenticator.
+          \n Upon receiving a signed JWT, a JWTAuthenticator will performs some validation
+          on it (e.g., valid signature, existence of claims, etc.) and extract the
+          username and groups from the token."
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec for configuring the authenticator.
+            properties:
+              audience:
+                description: Audience is the required value of the "aud" JWT claim.
+                minLength: 1
+                type: string
+              claims:
+                description: Claims allows customization of the claims that will be
+                  mapped to user identity for Kubernetes access.
+                properties:
+                  groups:
+                    description: Groups is the name of the claim which should be read
+                      to extract the user's group membership from the JWT token. When
+                      not specified, it will default to "groups".
+                    type: string
+                  username:
+                    description: Username is the name of the claim which should be
+                      read to extract the username from the JWT token. When not specified,
+                      it will default to "username".
+                    type: string
+                type: object
+              issuer:
+                description: Issuer is the OIDC issuer URL that will be used to discover
+                  public signing keys. Issuer is also used to validate the "iss" JWT
+                  claim.
+                minLength: 1
+                pattern: ^https://
+                type: string
+              tls:
+                description: TLS configuration for communicating with the OIDC provider.
+                properties:
+                  certificateAuthorityData:
+                    description: X.509 Certificate Authority (base64-encoded PEM bundle).
+                      If omitted, a default set of system roots will be trusted.
+                    type: string
+                type: object
+            required:
+            - audience
+            - issuer
+            type: object
+          status:
+            description: Status of the authenticator.
+            properties:
+              conditions:
+                description: Represents the observations of the authenticator's current
+                  state.
+                items:
+                  description: Condition status of a resource (mirrored from the metav1.Condition
+                    type added in Kubernetes 1.19). In a future API version we can
+                    switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

deploy/concierge/authentication.concierge.pinniped.dev_webhookauthenticators.yaml

@@ -11,14 +11,14 @@ spec:
   group: authentication.concierge.pinniped.dev
   names:
     categories:
-    - all
-    - authenticator
-    - authenticators
+    - pinniped
+    - pinniped-authenticator
+    - pinniped-authenticators
     kind: WebhookAuthenticator
     listKind: WebhookAuthenticatorList
     plural: webhookauthenticators
     singular: webhookauthenticator
-  scope: Namespaced
+  scope: Cluster
   versions:
   - additionalPrinterColumns:
     - jsonPath: .spec.endpoint
@@ -137,7 +137,8 @@ spec:
         type: object
     served: true
     storage: true
-    subresources: {}
+    subresources:
+      status: {}
 status:
   acceptedNames:
     kind: ""

deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml

@@ -10,15 +10,18 @@ metadata:
 spec:
   group: config.concierge.pinniped.dev
   names:
+    categories:
+    - pinniped
     kind: CredentialIssuer
     listKind: CredentialIssuerList
     plural: credentialissuers
     singular: credentialissuer
-  scope: Namespaced
+  scope: Cluster
   versions:
   - name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: Describes the configuration status of a Pinniped credential issuer.
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation
@@ -95,11 +98,11 @@ spec:
             required:
             - strategies
             type: object
-        required:
-        - status
         type: object
     served: true
     storage: true
+    subresources:
+      status: {}
 status:
   acceptedNames:
     kind: ""

deploy/concierge/deployment.yaml

@@ -1,9 +1,9 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
 #@ load("@ytt:json", "json")
-#@ load("helpers.lib.yaml", "defaultLabel", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+#@ load("helpers.lib.yaml", "defaultLabel", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix", "getAndValidateLogLevel", "pinnipedDevAPIGroupWithPrefix")
 
 #@ if not data.values.into_namespace:
 ---
@@ -37,6 +37,7 @@ data:
       servingCertificate:
         durationSeconds: (@= str(data.values.api_serving_certificate_duration_seconds) @)
         renewBeforeSeconds: (@= str(data.values.api_serving_certificate_renew_before_seconds) @)
+    apiGroupSuffix: (@= data.values.api_group_suffix @)
     names:
       servingCertificateSecret: (@= defaultResourceNameWithSuffix("api-tls-serving-certificate") @)
       credentialIssuer: (@= defaultResourceNameWithSuffix("config") @)
@@ -57,6 +58,9 @@ data:
       imagePullSecrets:
         - image-pull-secret
       (@ end @)
+    (@ if data.values.log_level: @)
+    logLevel: (@= getAndValidateLogLevel() @)
+    (@ end @)
 ---
 #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
 apiVersion: v1
@@ -87,8 +91,8 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ""
     spec:
       securityContext:
-        runAsUser: 1001
-        runAsGroup: 1001
+        runAsUser: #@ data.values.run_as_user
+        runAsGroup: #@ data.values.run_as_group
       serviceAccountName: #@ defaultResourceName()
       #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
       imagePullSecrets:
@@ -145,6 +149,9 @@ spec:
               - path: "labels"
                 fieldRef:
                   fieldPath: metadata.labels
+              - path: "name"
+                fieldRef:
+                  fieldPath: metadata.name
               - path: "namespace"
                 fieldRef:
                   fieldPath: metadata.namespace
@@ -185,11 +192,11 @@ spec:
 apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:
-  name: v1alpha1.login.concierge.pinniped.dev
+  name: #@ pinnipedDevAPIGroupWithPrefix("v1alpha1.login.concierge")
   labels: #@ labels()
 spec:
   version: v1alpha1
-  group: login.concierge.pinniped.dev
+  group: #@ pinnipedDevAPIGroupWithPrefix("login.concierge")
   groupPriorityMinimum: 2500
   versionPriority: 10
   #! caBundle: Do not include this key here. Starts out null, will be updated/owned by the golang code.

deploy/concierge/helpers.lib.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
@@ -12,6 +12,10 @@
 #@   return data.values.app_name + "-" + suffix
 #@ end
 
+#@ def pinnipedDevAPIGroupWithPrefix(prefix):
+#@   return prefix + "." + data.values.api_group_suffix
+#@ end
+
 #@ def namespace():
 #@   if data.values.into_namespace:
 #@     return data.values.into_namespace
@@ -28,3 +32,11 @@ app: #@ data.values.app_name
 _: #@ template.replace(defaultLabel())
 _: #@ template.replace(data.values.custom_labels)
 #@ end
+
+#@ def getAndValidateLogLevel():
+#@   log_level = data.values.log_level
+#@   if log_level != "info" and log_level != "debug" and log_level != "trace" and log_level != "all":
+#@     fail("log_level '" + log_level + "' is invalid")
+#@   end
+#@   return log_level
+#@ end

deploy/concierge/rbac.yaml

@@ -1,8 +1,8 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
-#@ load("helpers.lib.yaml", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+#@ load("helpers.lib.yaml", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix", "pinnipedDevAPIGroupWithPrefix")
 
 #! Give permission to various cluster-scoped objects
 ---
@@ -17,13 +17,32 @@ rules:
     verbs: [ get, list, watch ]
   - apiGroups: [ apiregistration.k8s.io ]
     resources: [ apiservices ]
-    verbs: [ create, get, list, patch, update, watch ]
+    verbs: [ get, list, patch, update, watch ]
   - apiGroups: [ admissionregistration.k8s.io ]
     resources: [ validatingwebhookconfigurations, mutatingwebhookconfigurations ]
     verbs: [ get, list, watch ]
+  - apiGroups: [ flowcontrol.apiserver.k8s.io ]
+    resources: [ flowschemas, prioritylevelconfigurations ]
+    verbs: [ get, list, watch ]
   - apiGroups: [ policy ]
     resources: [ podsecuritypolicies ]
     verbs: [ use ]
+  - apiGroups: [ security.openshift.io ]
+    resources: [ securitycontextconstraints ]
+    verbs: [ use ]
+    resourceNames: [ nonroot ]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("config.concierge")
+    resources: [ credentialissuers ]
+    verbs: [ get, list, watch, create ]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("config.concierge")
+    resources: [ credentialissuers/status ]
+    verbs: [get, patch, update]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("authentication.concierge")
+    resources: [ jwtauthenticators, webhookauthenticators ]
+    verbs: [ get, list, watch ]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -62,9 +81,9 @@ rules:
   - apiGroups: [ "" ]
     resources: [ pods/exec ]
     verbs: [ create ]
-  - apiGroups: [ config.concierge.pinniped.dev, authentication.concierge.pinniped.dev ]
-    resources: [ "*" ]
-    verbs: [ create, get, list, update, watch ]
+  - apiGroups: [apps]
+    resources: [replicasets,deployments]
+    verbs: [get]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -117,7 +136,8 @@ metadata:
   name: #@ defaultResourceNameWithSuffix("create-token-credential-requests")
   labels: #@ labels()
 rules:
-  - apiGroups: [ login.concierge.pinniped.dev ]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("login.concierge")
     resources: [ tokencredentialrequests ]
     verbs: [ create ]
 ---

deploy/concierge/values.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@data/values
@@ -25,7 +25,7 @@ custom_labels: {} #! e.g. {myCustomLabelName: myCustomLabelValue, otherCustomLab
 replicas: 2
 
 #! Specify either an image_digest or an image_tag. If both are given, only image_digest will be used.
-image_repo: docker.io/getpinniped/pinniped-server
+image_repo: projects.registry.vmware.com/pinniped/pinniped-server
 image_digest: #! e.g. sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8
 image_tag: latest
 
@@ -50,3 +50,16 @@ discovery_url: #! e.g., https://example.com
 #! about every 25 days.
 api_serving_certificate_duration_seconds: 2592000
 api_serving_certificate_renew_before_seconds: 2160000
+
+#! Specify the verbosity of logging: info ("nice to know" information), debug (developer
+#! information), trace (timing information), all (kitchen sink).
+log_level: #! By default, when this value is left unset, only warnings and errors are printed. There is no way to suppress warning and error logs.
+
+run_as_user: 1001 #! run_as_user specifies the user ID that will own the local-user-authenticator process
+run_as_group: 1001 #! run_as_group specifies the group ID that will own the local-user-authenticator process
+
+#! Specify the API group suffix for all Pinniped API groups. By default, this is set to
+#! pinniped.dev, so Pinniped API groups will look like foo.pinniped.dev,
+#! authentication.concierge.pinniped.dev, etc. As an example, if this is set to tuna.io, then
+#! Pinniped API groups will look like foo.tuna.io. authentication.concierge.tuna.io, etc.
+api_group_suffix: pinniped.dev

deploy/concierge/z0_crd_overlay.yaml

@@ -1,17 +1,33 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:overlay", "overlay")
-#@ load("helpers.lib.yaml", "labels")
+#@ load("helpers.lib.yaml", "labels", "pinnipedDevAPIGroupWithPrefix")
+#@ load("@ytt:data", "data")
 
 #@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"credentialissuers.config.concierge.pinniped.dev"}}), expects=1
 ---
 metadata:
   #@overlay/match missing_ok=True
   labels: #@ labels()
+  name: #@ pinnipedDevAPIGroupWithPrefix("credentialissuers.config.concierge")
+spec:
+  group: #@ pinnipedDevAPIGroupWithPrefix("config.concierge")
 
 #@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"webhookauthenticators.authentication.concierge.pinniped.dev"}}), expects=1
 ---
 metadata:
   #@overlay/match missing_ok=True
   labels: #@ labels()
+  name: #@ pinnipedDevAPIGroupWithPrefix("webhookauthenticators.authentication.concierge")
+spec:
+  group: #@ pinnipedDevAPIGroupWithPrefix("authentication.concierge")
+
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"jwtauthenticators.authentication.concierge.pinniped.dev"}}), expects=1
+---
+metadata:
+  #@overlay/match missing_ok=True
+  labels: #@ labels()
+  name: #@ pinnipedDevAPIGroupWithPrefix("jwtauthenticators.authentication.concierge")
+spec:
+  group: #@ pinnipedDevAPIGroupWithPrefix("authentication.concierge")

deploy/local-user-authenticator/README.md

@@ -15,17 +15,17 @@ User accounts can be created and edited dynamically using `kubectl` commands (se
 ## Installing the Latest Version with Default Options
 
 ```bash
-kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/latest/download/install-local-user-authenticator.yaml
+kubectl apply -f https://get.pinniped.dev/latest/install-local-user-authenticator.yaml
 ```
 
-## Installing an Older Version with Default Options
+## Installing a Specific Version with Default Options
 
 Choose your preferred [release](https://github.com/vmware-tanzu/pinniped/releases) version number
 and use it to replace the version number in the URL below.
 
 ```bash
-# Replace v0.2.0 with your preferred version in the URL below
-kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/v0.2.0/install-local-user-authenticator.yaml
+# Replace v0.4.1 with your preferred version in the URL below
+kubectl apply -f https://get.pinniped.dev/v0.4.1/install-local-user-authenticator.yaml
 ```
 
 ## Installing with Custom Options
@@ -79,7 +79,7 @@ kubectl get secret local-user-authenticator-tls-serving-certificate --namespace
 
 When installing Pinniped on the same cluster, configure local-user-authenticator as an Identity Provider for Pinniped
 using the webhook URL `https://local-user-authenticator.local-user-authenticator.svc/authenticate`
-along with the CA bundle fetched by the above command. See [doc/demo.md](../../doc/demo.md) for an example.
+along with the CA bundle fetched by the above command. See [demo](https://pinniped.dev/docs/demo/) for an example.
 
 ## Optional: Manually Testing the Webhook Endpoint After Installing
 

deploy/local-user-authenticator/deployment.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
@@ -48,8 +48,8 @@ spec:
         app: local-user-authenticator
     spec:
       securityContext:
-        runAsUser: 1001
-        runAsGroup: 1001
+        runAsUser: #@ data.values.run_as_user
+        runAsGroup: #@ data.values.run_as_group
       serviceAccountName: local-user-authenticator
       #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
       imagePullSecrets:

deploy/local-user-authenticator/values.yaml

@@ -1,11 +1,11 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@data/values
 ---
 
 #! Specify either an image_digest or an image_tag. If both are given, only image_digest will be used.
-image_repo: docker.io/getpinniped/pinniped-server
+image_repo: projects.registry.vmware.com/pinniped/pinniped-server
 image_digest: #! e.g. sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8
 image_tag: latest
 
@@ -14,3 +14,6 @@ image_tag: latest
 #! Typically the value would be the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username="USERNAME" --docker-password="PASSWORD" --dry-run=client -o json | jq -r '.data[".dockerconfigjson"]'
 #! Optional.
 image_pull_dockerconfigjson: #! e.g. {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}
+
+run_as_user: 1001 #! run_as_user specifies the user ID that will own the local-user-authenticator process
+run_as_group: 1001 #! run_as_group specifies the group ID that will own the local-user-authenticator process

deploy/supervisor/README.md

@@ -8,17 +8,17 @@ It can be deployed when those features are needed.
 ## Installing the Latest Version with Default Options
 
 ```bash
-kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/latest/download/install-pinniped-supervisor.yaml
+kubectl apply -f https://get.pinniped.dev/latest/install-pinniped-supervisor.yaml
 ```
 
-## Installing an Older Version with Default Options
+## Installing a Specific Version with Default Options
 
 Choose your preferred [release](https://github.com/vmware-tanzu/pinniped/releases) version number
 and use it to replace the version number in the URL below.
 
 ```bash
-# Replace v0.3.0 with your preferred version in the URL below
-kubectl apply -f https://github.com/vmware-tanzu/pinniped/releases/download/v0.3.0/install-pinniped-supervisor.yaml
+# Replace v0.4.1 with your preferred version in the URL below
+kubectl apply -f https://get.pinniped.dev/v0.4.1/install-pinniped-supervisor.yaml
 ```
 
 ## Installing with Custom Options
@@ -59,7 +59,7 @@ The most common ways are:
 
 1. Or, define a [TCP LoadBalancer Service](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer)
    which is a layer 4 load balancer and does not terminate TLS. In this case, the Supervisor app will need to be
-   configured with TLS certificates and will terminate the TLS connection itself (see the section about OIDCProvider
+   configured with TLS certificates and will terminate the TLS connection itself (see the section about FederationDomain
    below). The LoadBalancer Service should be configured to use the HTTPS port 443 of the Supervisor pods as its `targetPort`.
 
    *Warning:* Do not expose the Supervisor's port 8080 to the public. It would not be secure for the OIDC protocol
@@ -132,12 +132,12 @@ spec:
 
 ### Configuring the Supervisor to Act as an OIDC Provider
 
-The Supervisor can be configured as an OIDC provider by creating `OIDCProvider` resources
+The Supervisor can be configured as an OIDC provider by creating `FederationDomain` resources
 in the same namespace where the Supervisor app was installed. For example:
 
 ```yaml
 apiVersion: config.supervisor.pinniped.dev/v1alpha1
-kind: OIDCProvider
+kind: FederationDomain
 metadata:
   name: my-provider
   # Assuming that this is the namespace where the supervisor was installed. This is the default in install-supervisor.yaml.
@@ -156,12 +156,12 @@ spec:
 #### Configuring TLS for the Supervisor OIDC Endpoints
 
 If you have terminated TLS outside the app, for example using an Ingress with TLS certificates, then you do not need to
-configure TLS certificates on the OIDCProvider.
+configure TLS certificates on the FederationDomain.
 
 If you are using a LoadBalancer Service to expose the Supervisor app outside your cluster, then you will
 also need to configure the Supervisor app to terminate TLS. There are two places to configure TLS certificates:
 
-1. Each `OIDCProvider` can be configured with TLS certificates, using the `spec.tls.secretName` field.
+1. Each `FederationDomain` can be configured with TLS certificates, using the `spec.tls.secretName` field.
 
 1. The default TLS certificate for all OIDC providers can be configured by creating a Secret called
 `pinniped-supervisor-default-tls-certificate` in the same namespace in which the Supervisor was installed.

deploy/supervisor/config.supervisor.pinniped.dev_federationdomains.yaml

@@ -6,20 +6,22 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.4.0
   creationTimestamp: null
-  name: oidcproviders.config.supervisor.pinniped.dev
+  name: federationdomains.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev
   names:
-    kind: OIDCProvider
-    listKind: OIDCProviderList
-    plural: oidcproviders
-    singular: oidcprovider
+    categories:
+    - pinniped
+    kind: FederationDomain
+    listKind: FederationDomainList
+    plural: federationdomains
+    singular: federationdomain
   scope: Namespaced
   versions:
   - name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: OIDCProvider describes the configuration of an OIDC provider.
+        description: FederationDomain describes the configuration of an OIDC provider.
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation
@@ -48,14 +50,14 @@ spec:
                 minLength: 1
                 type: string
               tls:
-                description: TLS configures how this OIDCProvider is served over Transport
-                  Layer Security (TLS).
+                description: TLS configures how this FederationDomain is served over
+                  Transport Layer Security (TLS).
                 properties:
                   secretName:
                     description: "SecretName is an optional name of a Secret in the
                       same namespace, of type `kubernetes.io/tls`, which contains
                       the TLS serving certificate for the HTTPS endpoints served by
-                      this OIDCProvider. When provided, the TLS Secret named here
+                      this FederationDomain. When provided, the TLS Secret named here
                       must contain keys named `tls.crt` and `tls.key` that contain
                       the certificate and private key to use for TLS. \n Server Name
                       Indication (SNI) is an extension to the Transport Layer Security
@@ -79,17 +81,6 @@ spec:
           status:
             description: Status of the OIDC provider.
             properties:
-              jwksSecret:
-                description: JWKSSecret holds the name of the secret in which this
-                  OIDC Provider's signing/verification keys are stored. If it is empty,
-                  then the signing/verification keys are either unknown or they don't
-                  exist.
-                properties:
-                  name:
-                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      TODO: Add other useful fields. apiVersion, kind, uid?'
-                    type: string
-                type: object
               lastUpdateTime:
                 description: LastUpdateTime holds the time at which the Status was
                   last updated. It is a pointer to get around some undesirable behavior
@@ -99,6 +90,51 @@ spec:
               message:
                 description: Message provides human-readable details about the Status.
                 type: string
+              secrets:
+                description: Secrets contains information about this OIDC Provider's
+                  secrets.
+                properties:
+                  jwks:
+                    description: JWKS holds the name of the corev1.Secret in which
+                      this OIDC Provider's signing/verification keys are stored. If
+                      it is empty, then the signing/verification keys are either unknown
+                      or they don't exist.
+                    properties:
+                      name:
+                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Add other useful fields. apiVersion, kind, uid?'
+                        type: string
+                    type: object
+                  stateEncryptionKey:
+                    description: StateSigningKey holds the name of the corev1.Secret
+                      in which this OIDC Provider's key for encrypting state parameters
+                      is stored.
+                    properties:
+                      name:
+                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Add other useful fields. apiVersion, kind, uid?'
+                        type: string
+                    type: object
+                  stateSigningKey:
+                    description: StateSigningKey holds the name of the corev1.Secret
+                      in which this OIDC Provider's key for signing state parameters
+                      is stored.
+                    properties:
+                      name:
+                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Add other useful fields. apiVersion, kind, uid?'
+                        type: string
+                    type: object
+                  tokenSigningKey:
+                    description: TokenSigningKey holds the name of the corev1.Secret
+                      in which this OIDC Provider's key for signing tokens is stored.
+                    properties:
+                      name:
+                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Add other useful fields. apiVersion, kind, uid?'
+                        type: string
+                    type: object
+                type: object
               status:
                 description: Status holds an enum that describes the state of this
                   OIDC Provider. Note that this Status can represent success or failure.
@@ -106,6 +142,7 @@ spec:
                 - Success
                 - Duplicate
                 - Invalid
+                - SameIssuerHostMustUseSameSecret
                 type: string
             type: object
         required:
@@ -113,6 +150,8 @@ spec:
         type: object
     served: true
     storage: true
+    subresources:
+      status: {}
 status:
   acceptedNames:
     kind: ""

deploy/supervisor/deployment.yaml

@@ -1,9 +1,9 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
 #@ load("@ytt:json", "json")
-#@ load("helpers.lib.yaml", "defaultLabel", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+#@ load("helpers.lib.yaml", "defaultLabel", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix", "getAndValidateLogLevel")
 
 #@ if not data.values.into_namespace:
 ---
@@ -30,9 +30,13 @@ metadata:
 data:
   #@yaml/text-templated-strings
   pinniped.yaml: |
+    apiGroupSuffix: (@= data.values.api_group_suffix @)
     names:
       defaultTLSCertificateSecret: (@= defaultResourceNameWithSuffix("default-tls-certificate") @)
     labels: (@= json.encode(labels()).rstrip() @)
+    (@ if data.values.log_level: @)
+    logLevel: (@= getAndValidateLogLevel() @)
+    (@ end @)
 ---
 #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
 apiVersion: v1
@@ -61,8 +65,8 @@ spec:
       labels: #@ defaultLabel()
     spec:
       securityContext:
-        runAsUser: 1001
-        runAsGroup: 1001
+        runAsUser: #@ data.values.run_as_user
+        runAsGroup: #@ data.values.run_as_group
       serviceAccountName: #@ defaultResourceName()
       #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
       imagePullSecrets:
@@ -129,6 +133,9 @@ spec:
               - path: "namespace"
                 fieldRef:
                   fieldPath: metadata.namespace
+              - path: "name"
+                fieldRef:
+                  fieldPath: metadata.name
       #! This will help make sure our multiple pods run on different nodes, making
       #! our deployment "more" "HA".
       affinity:

deploy/supervisor/helpers.lib.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
@@ -12,6 +12,10 @@
 #@   return data.values.app_name + "-" + suffix
 #@ end
 
+#@ def pinnipedDevAPIGroupWithPrefix(prefix):
+#@   return prefix + "." + data.values.api_group_suffix
+#@ end
+
 #@ def namespace():
 #@   if data.values.into_namespace:
 #@     return data.values.into_namespace
@@ -28,3 +32,11 @@ app: #@ data.values.app_name
 _: #@ template.replace(defaultLabel())
 _: #@ template.replace(data.values.custom_labels)
 #@ end
+
+#@ def getAndValidateLogLevel():
+#@   log_level = data.values.log_level
+#@   if log_level != "info" and log_level != "debug" and log_level != "trace" and log_level != "all":
+#@     fail("log_level '" + log_level + "' is invalid")
+#@   end
+#@   return log_level
+#@ end

deploy/supervisor/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -0,0 +1,205 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.0
+  creationTimestamp: null
+  name: oidcidentityproviders.idp.supervisor.pinniped.dev
+spec:
+  group: idp.supervisor.pinniped.dev
+  names:
+    categories:
+    - pinniped
+    - pinniped-idp
+    - pinniped-idps
+    kind: OIDCIdentityProvider
+    listKind: OIDCIdentityProviderList
+    plural: oidcidentityproviders
+    singular: oidcidentityprovider
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.issuer
+      name: Issuer
+      type: string
+    - jsonPath: .status.phase
+      name: Status
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: OIDCIdentityProvider describes the configuration of an upstream
+          OpenID Connect identity provider.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec for configuring the identity provider.
+            properties:
+              authorizationConfig:
+                description: AuthorizationConfig holds information about how to form
+                  the OAuth2 authorization request parameters to be used with this
+                  OIDC identity provider.
+                properties:
+                  additionalScopes:
+                    description: AdditionalScopes are the scopes in addition to "openid"
+                      that will be requested as part of the authorization request
+                      flow with an OIDC identity provider. By default only the "openid"
+                      scope will be requested.
+                    items:
+                      type: string
+                    type: array
+                type: object
+              claims:
+                description: Claims provides the names of token claims that will be
+                  used when inspecting an identity from this OIDC identity provider.
+                properties:
+                  groups:
+                    description: Groups provides the name of the token claim that
+                      will be used to ascertain the groups to which an identity belongs.
+                    type: string
+                  username:
+                    description: Username provides the name of the token claim that
+                      will be used to ascertain an identity's username.
+                    type: string
+                type: object
+              client:
+                description: OIDCClient contains OIDC client information to be used
+                  used with this OIDC identity provider.
+                properties:
+                  secretName:
+                    description: SecretName contains the name of a namespace-local
+                      Secret object that provides the clientID and clientSecret for
+                      an OIDC client. If only the SecretName is specified in an OIDCClient
+                      struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client"
+                      with keys "clientID" and "clientSecret".
+                    type: string
+                required:
+                - secretName
+                type: object
+              issuer:
+                description: Issuer is the issuer URL of this OIDC identity provider,
+                  i.e., where to fetch /.well-known/openid-configuration.
+                minLength: 1
+                pattern: ^https://
+                type: string
+              tls:
+                description: TLS configuration for discovery/JWKS requests to the
+                  issuer.
+                properties:
+                  certificateAuthorityData:
+                    description: X.509 Certificate Authority (base64-encoded PEM bundle).
+                      If omitted, a default set of system roots will be trusted.
+                    type: string
+                type: object
+            required:
+            - client
+            - issuer
+            type: object
+          status:
+            description: Status of the identity provider.
+            properties:
+              conditions:
+                description: Represents the observations of an identity provider's
+                  current state.
+                items:
+                  description: Condition status of a resource (mirrored from the metav1.Condition
+                    type added in Kubernetes 1.19). In a future API version we can
+                    switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              phase:
+                default: Pending
+                description: Phase summarizes the overall status of the OIDCIdentityProvider.
+                enum:
+                - Pending
+                - Ready
+                - Error
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

deploy/supervisor/rbac.yaml

@@ -1,8 +1,8 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
-#@ load("helpers.lib.yaml", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
+#@ load("helpers.lib.yaml", "labels", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix", "pinnipedDevAPIGroupWithPrefix")
 
 #! Give permission to various objects within the app's own namespace
 ---
@@ -16,9 +16,30 @@ rules:
   - apiGroups: [""]
     resources: [secrets]
     verbs: [create, get, list, patch, update, watch, delete]
-  - apiGroups: [config.supervisor.pinniped.dev]
-    resources: [oidcproviders]
-    verbs: [update, get, list, watch]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("config.supervisor")
+    resources: [federationdomains]
+    verbs: [get, list, watch]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("config.supervisor")
+    resources: [federationdomains/status]
+    verbs: [get, patch, update]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
+    resources: [oidcidentityproviders]
+    verbs: [get, list, watch]
+  - apiGroups:
+      - #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
+    resources: [oidcidentityproviders/status]
+    verbs: [get, patch, update]
+    #! We want to be able to read pods/replicasets/deployment so we can learn who our deployment is to set
+    #! as an owner reference.
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get]
+  - apiGroups: [apps]
+    resources: [replicasets,deployments]
+    verbs: [get]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

deploy/supervisor/values.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@data/values
@@ -25,7 +25,7 @@ custom_labels: {} #! e.g. {myCustomLabelName: myCustomLabelValue, otherCustomLab
 replicas: 2
 
 #! Specify either an image_digest or an image_tag. If both are given, only image_digest will be used.
-image_repo: docker.io/getpinniped/pinniped-server
+image_repo: projects.registry.vmware.com/pinniped/pinniped-server
 image_digest: #! e.g. sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8
 image_tag: latest
 
@@ -52,3 +52,16 @@ service_https_clusterip_port: #! when specified, creates a ClusterIP Service wit
 #! Ignored unless service_http_loadbalancer_port and/or service_https_loadbalancer_port are provided.
 #! Optional.
 service_loadbalancer_ip: #! e.g. 1.2.3.4
+
+#! Specify the verbosity of logging: info ("nice to know" information), debug (developer
+#! information), trace (timing information), all (kitchen sink).
+log_level: #! By default, when this value is left unset, only warnings and errors are printed. There is no way to suppress warning and error logs.
+
+run_as_user: 1001 #! run_as_user specifies the user ID that will own the local-user-authenticator process
+run_as_group: 1001 #! run_as_group specifies the group ID that will own the local-user-authenticator process
+
+#! Specify the API group suffix for all Pinniped API groups. By default, this is set to
+#! pinniped.dev, so Pinniped API groups will look like foo.pinniped.dev,
+#! authentication.concierge.pinniped.dev, etc. As an example, if this is set to tuna.io, then
+#! Pinniped API groups will look like foo.tuna.io. authentication.concierge.tuna.io, etc.
+api_group_suffix: pinniped.dev

deploy/supervisor/z0_crd_overlay.yaml

@@ -1,11 +1,24 @@
-#! Copyright 2020 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:overlay", "overlay")
-#@ load("helpers.lib.yaml", "labels")
+#@ load("helpers.lib.yaml", "labels", "pinnipedDevAPIGroupWithPrefix")
+#@ load("@ytt:data", "data")
 
-#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"oidcproviders.config.supervisor.pinniped.dev"}}), expects=1
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"federationdomains.config.supervisor.pinniped.dev"}}), expects=1
 ---
 metadata:
   #@overlay/match missing_ok=True
   labels: #@ labels()
+  name: #@ pinnipedDevAPIGroupWithPrefix("federationdomains.config.supervisor")
+spec:
+  group: #@ pinnipedDevAPIGroupWithPrefix("config.supervisor")
+
+#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"oidcidentityproviders.idp.supervisor.pinniped.dev"}}), expects=1
+---
+metadata:
+  #@overlay/match missing_ok=True
+  labels: #@ labels()
+  name: #@ pinnipedDevAPIGroupWithPrefix("oidcidentityproviders.idp.supervisor")
+spec:
+  group: #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")

doc/architecture.md

@@ -1,75 +0,0 @@
-# Architecture
-
-The principal purpose of Pinniped is to allow users to access Kubernetes
-clusters. Pinniped hopes to enable this access across a wide range of Kubernetes
-environments with zero configuration.
-
-This integration is implemented using a credential exchange API which takes as
-input a credential from the external IDP and returns a credential which is understood by the host
-Kubernetes cluster.
-
-<img src="img/pinniped_architecture.svg" alt="Pinniped Architecture Sketch" width="300px"/>
-
-Pinniped supports various IDP types and implements different integration strategies
-for various Kubernetes distributions to make authentication possible.
-
-## Supported Kubernetes Cluster Types
-
-Pinniped supports the following types of Kubernetes clusters:
-
-- Clusters where the Kube Controller Manager pod is accessible from Pinniped's pods.
-
-Support for other types of Kubernetes distributions is coming soon.
-
-## External Identity Provider Integrations
-
-Pinniped will consume identity from one or more external identity providers
-(IDPs). Administrators will configure external IDPs via Kubernetes custom
-resources allowing Pinniped to be managed using GitOps and standard Kubernetes tools.
-
-Pinniped supports the following external IDP types.
-
-1. Any webhook which implements the
-   [Kubernetes TokenReview API](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication).
-
-   In addition to allowing the integration of any existing IDP which implements this API, webhooks also
-   serve as an extension point for Pinniped by allowing for integration of arbitrary custom authenticators.
-   While a custom implementation may be in any language or framework, this project provides a
-   sample implementation in Golang. See the `ServeHTTP` method of
-   [cmd/local-user-authenticator/main.go](../cmd/local-user-authenticator/main.go).
-
-More IDP types are coming soon.
-
-## Cluster Integration Strategies
-
-Pinniped will issue a cluster credential by leveraging cluster-specific
-functionality.  In the near term, cluster integrations will happen via different
-cluster-specific flows depending on the type of cluster. In the longer term,
-Pinniped hopes to contribute and leverage upstream Kubernetes extension points that
-cleanly enable this integration.
-
-Pinniped supports the following cluster integration strategies.
-
-1. Pinniped hosts a credential exchange API endpoint via a Kubernetes aggregated API server.
-This API returns a new cluster-specific credential using the cluster's signing keypair to
-issue short-lived cluster certificates. (In the future, when the Kubernetes CSR API
-provides a way to issue short-lived certificates, then the Pinniped credential exchange API
-will use that instead of using the cluster's signing keypair.)
-
-More cluster integration strategies are coming soon, which will allow Pinniped to
-support more Kubernetes cluster types.
-
-## `kubectl` Integration
-
-With any of the above IDPs and integration strategies, `kubectl` commands receive the
-cluster-specific credential via a
-[Kubernetes client-go credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins).
-Users may use the Pinniped CLI as the credential plugin, or they may use any proprietary CLI
-built with the [Pinniped Go client library](../generated).
-
-## Example Cluster Authentication Sequence Diagram
-
-This diagram demonstrates using `kubectl get pods` with the Pinniped CLI configured as the credential plugin,
-and with a webhook IDP configured as the identity provider for the Pinniped server.
-
-![example-cluster-authentication-sequence-diagram](img/pinniped.svg)

doc/img/README.md

@@ -1,12 +0,0 @@
-# `doc/img` README
-
-## How to Update these Images
-
-- [pinniped.svg](pinniped.svg) was generated using [`plantuml`](https://plantuml.com/).
-  To regenerate the image, run `plantuml -tsvg pinniped.txt` from this directory.
-
-- [pinniped_architecture.svg](pinniped_architecture.svg) was created on [draw.io](https://draw.io).
-  It can be opened again for editing on that site by choosing "File" -> "Open from" -> "Device".
-  Because it includes embedded icons it should be exported using "File" -> "Export as" -> "SVG",
-  with the "Transparent Background", "Embed Images", and "Include a copy of my diagram" options
-  checked. The icons in this diagram are from their "CAE" shapes set.

generated/1.17/README.adoc

@@ -6,9 +6,9 @@
 
 .Packages
 - xref:{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1[$$authentication.concierge.pinniped.dev/v1alpha1$$]
-- xref:{anchor_prefix}-config-concierge-pinniped-dev-config[$$config.concierge.pinniped.dev/config$$]
 - xref:{anchor_prefix}-config-concierge-pinniped-dev-v1alpha1[$$config.concierge.pinniped.dev/v1alpha1$$]
 - xref:{anchor_prefix}-config-supervisor-pinniped-dev-v1alpha1[$$config.supervisor.pinniped.dev/v1alpha1$$]
+- xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$]
 - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$]
 
 
@@ -22,10 +22,11 @@ Package v1alpha1 is the v1alpha1 version of the Pinniped concierge authenticatio
 [id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-condition"]
 ==== Condition 
 
-Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
+
 
 .Appears In:
 ****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticatorstatus[$$JWTAuthenticatorStatus$$]
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorstatus[$$WebhookAuthenticatorStatus$$]
 ****
 
@@ -41,13 +42,104 @@ Condition status of a resource (mirrored from the metav1.Condition type added in
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-tlsspec"]
-==== TLSSpec 
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-conditionstatus"]
+==== ConditionStatus (string) 
+
 
-Configuration for configuring TLS on various authenticators.
 
 .Appears In:
 ****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-condition[$$Condition$$]
+****
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticator"]
+==== JWTAuthenticator 
+
+JWTAuthenticator describes the configuration of a JWT authenticator. 
+ Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid signature, existence of claims, etc.) and extract the username and groups from the token.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticatorlist[$$JWTAuthenticatorList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticatorspec[$$JWTAuthenticatorSpec$$]__ | Spec for configuring the authenticator.
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticatorstatus[$$JWTAuthenticatorStatus$$]__ | Status of the authenticator.
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticatorspec"]
+==== JWTAuthenticatorSpec 
+
+Spec for configuring a JWT authenticator.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticator[$$JWTAuthenticator$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`issuer`* __string__ | Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is also used to validate the "iss" JWT claim.
+| *`audience`* __string__ | Audience is the required value of the "aud" JWT claim.
+| *`claims`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwttokenclaims[$$JWTTokenClaims$$]__ | Claims allows customization of the claims that will be mapped to user identity for Kubernetes access.
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration for communicating with the OIDC provider.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticatorstatus"]
+==== JWTAuthenticatorStatus 
+
+Status of a JWT authenticator.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticator[$$JWTAuthenticator$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-condition[$$Condition$$] array__ | Represents the observations of the authenticator's current state.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwttokenclaims"]
+==== JWTTokenClaims 
+
+JWTTokenClaims allows customization of the claims that will be mapped to user identity for Kubernetes access.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticatorspec[$$JWTAuthenticatorSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`groups`* __string__ | Groups is the name of the claim which should be read to extract the user's group membership from the JWT token. When not specified, it will default to "groups".
+| *`username`* __string__ | Username is the name of the claim which should be read to extract the username from the JWT token. When not specified, it will default to "username".
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-tlsspec"]
+==== TLSSpec 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-jwtauthenticatorspec[$$JWTAuthenticatorSpec$$]
 - xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-webhookauthenticatorspec[$$WebhookAuthenticatorSpec$$]
 ****
 
@@ -111,19 +203,11 @@ Status of a webhook authenticator.
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-condition[$$Condition$$]__ | Represents the observations of the authenticator's current state.
+| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-authentication-v1alpha1-condition[$$Condition$$] array__ | Represents the observations of the authenticator's current state.
 |===
 
 
 
-[id="{anchor_prefix}-config-concierge-pinniped-dev-config"]
-=== config.concierge.pinniped.dev/config
-
-Package config is the internal version of the Pinniped concierge configuration API.
-
-
-
-
 [id="{anchor_prefix}-config-concierge-pinniped-dev-v1alpha1"]
 === config.concierge.pinniped.dev/v1alpha1
 
@@ -134,7 +218,7 @@ Package v1alpha1 is the v1alpha1 version of the Pinniped concierge configuration
 [id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-config-v1alpha1-credentialissuer"]
 ==== CredentialIssuer 
 
-
+Describes the configuration status of a Pinniped credential issuer.
 
 .Appears In:
 ****
@@ -217,14 +301,14 @@ Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor configuratio
 
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovider"]
-==== OIDCProvider 
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomain"]
+==== FederationDomain 
 
-OIDCProvider describes the configuration of an OIDC provider.
+FederationDomain describes the configuration of an OIDC provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderlist[$$OIDCProviderList$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainlist[$$FederationDomainList$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -232,21 +316,41 @@ OIDCProvider describes the configuration of an OIDC provider.
 | Field | Description
 | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
 
-| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderspec[$$OIDCProviderSpec$$]__ | Spec of the OIDC provider.
-| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderstatus[$$OIDCProviderStatus$$]__ | Status of the OIDC provider.
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainspec[$$FederationDomainSpec$$]__ | Spec of the OIDC provider.
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainstatus[$$FederationDomainStatus$$]__ | Status of the OIDC provider.
 |===
 
 
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderspec"]
-==== OIDCProviderSpec 
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainsecrets"]
+==== FederationDomainSecrets 
 
-OIDCProviderSpec is a struct that describes an OIDC Provider.
+FederationDomainSecrets holds information about this OIDC Provider's secrets.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovider[$$OIDCProvider$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainstatus[$$FederationDomainStatus$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`jwks`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | JWKS holds the name of the corev1.Secret in which this OIDC Provider's signing/verification keys are stored. If it is empty, then the signing/verification keys are either unknown or they don't exist.
+| *`tokenSigningKey`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | TokenSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for signing tokens is stored.
+| *`stateSigningKey`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for signing state parameters is stored.
+| *`stateEncryptionKey`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for encrypting state parameters is stored.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainspec"]
+==== FederationDomainSpec 
+
+FederationDomainSpec is a struct that describes an OIDC Provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomain[$$FederationDomain$$]
 ****
 
 [cols="25a,75a", options="header"]
@@ -254,44 +358,44 @@ OIDCProviderSpec is a struct that describes an OIDC Provider.
 | Field | Description
 | *`issuer`* __string__ | Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the identifier that it will use for the iss claim in issued JWTs. This field will also be used as the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is https://example.com/foo, then your authorization endpoint will look like https://example.com/foo/some/path/to/auth/endpoint). 
  See https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
-| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovidertlsspec[$$OIDCProviderTLSSpec$$]__ | TLS configures how this OIDCProvider is served over Transport Layer Security (TLS).
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomaintlsspec[$$FederationDomainTLSSpec$$]__ | TLS configures how this FederationDomain is served over Transport Layer Security (TLS).
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderstatus"]
-==== OIDCProviderStatus 
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainstatus"]
+==== FederationDomainStatus 
 
-OIDCProviderStatus is a struct that describes the actual state of an OIDC Provider.
+FederationDomainStatus is a struct that describes the actual state of an OIDC Provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovider[$$OIDCProvider$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomain[$$FederationDomain$$]
 ****
 
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`status`* __OIDCProviderStatusCondition__ | Status holds an enum that describes the state of this OIDC Provider. Note that this Status can represent success or failure.
+| *`status`* __FederationDomainStatusCondition__ | Status holds an enum that describes the state of this OIDC Provider. Note that this Status can represent success or failure.
 | *`message`* __string__ | Message provides human-readable details about the Status.
 | *`lastUpdateTime`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#time-v1-meta[$$Time$$]__ | LastUpdateTime holds the time at which the Status was last updated. It is a pointer to get around some undesirable behavior with respect to the empty metav1.Time value (see https://github.com/kubernetes/kubernetes/issues/86811).
-| *`jwksSecret`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | JWKSSecret holds the name of the secret in which this OIDC Provider's signing/verification keys are stored. If it is empty, then the signing/verification keys are either unknown or they don't exist.
+| *`secrets`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainsecrets[$$FederationDomainSecrets$$]__ | Secrets contains information about this OIDC Provider's secrets.
 |===
 
 
-[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcprovidertlsspec"]
-==== OIDCProviderTLSSpec 
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomaintlsspec"]
+==== FederationDomainTLSSpec 
 
-OIDCProviderTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
+FederationDomainTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
 
 .Appears In:
 ****
-- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-oidcproviderspec[$$OIDCProviderSpec$$]
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-config-v1alpha1-federationdomainspec[$$FederationDomainSpec$$]
 ****
 
 [cols="25a,75a", options="header"]
 |===
 | Field | Description
-| *`secretName`* __string__ | SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this OIDCProvider. When provided, the TLS Secret named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS. 
+| *`secretName`* __string__ | SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains the TLS serving certificate for the HTTPS endpoints served by this FederationDomain. When provided, the TLS Secret named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS. 
  Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) supported by all major browsers. 
  SecretName is required if you would like to use different TLS certificates for issuers of different hostnames. SNI requests do not include port numbers, so all issuers with the same DNS hostname must use the same SecretName value even if they have different port numbers. 
  SecretName is not required when you would like to use only the HTTP endpoints (e.g. when terminating TLS at an Ingress). It is also not required when you would like all requests to this OIDC Provider's HTTPS endpoints to use the default TLS certificate, which is configured elsewhere. 
@@ -300,6 +404,166 @@ OIDCProviderTLSSpec is a struct that describes the TLS configuration for an OIDC
 
 
 
+[id="{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1"]
+=== idp.supervisor.pinniped.dev/v1alpha1
+
+Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor identity provider (IDP) API.
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-condition"]
+==== Condition 
+
+Condition status of a resource (mirrored from the metav1.Condition type added in Kubernetes 1.19). In a future API version we can switch to using the upstream type. See https://github.com/kubernetes/apimachinery/blob/v0.19.0/pkg/apis/meta/v1/types.go#L1353-L1413.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderstatus[$$OIDCIdentityProviderStatus$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`type`* __string__ | type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+| *`status`* __ConditionStatus__ | status of the condition, one of True, False, Unknown.
+| *`observedGeneration`* __integer__ | observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
+| *`lastTransitionTime`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#time-v1-meta[$$Time$$]__ | lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+| *`reason`* __string__ | reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
+| *`message`* __string__ | message is a human readable message indicating details about the transition. This may be an empty string.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcauthorizationconfig"]
+==== OIDCAuthorizationConfig 
+
+OIDCAuthorizationConfig provides information about how to form the OAuth2 authorization request parameters.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`additionalScopes`* __string array__ | AdditionalScopes are the scopes in addition to "openid" that will be requested as part of the authorization request flow with an OIDC identity provider. By default only the "openid" scope will be requested.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcclaims"]
+==== OIDCClaims 
+
+OIDCClaims provides a mapping from upstream claims into identities.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`groups`* __string__ | Groups provides the name of the token claim that will be used to ascertain the groups to which an identity belongs.
+| *`username`* __string__ | Username provides the name of the token claim that will be used to ascertain an identity's username.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcclient"]
+==== OIDCClient 
+
+OIDCClient contains information about an OIDC client (e.g., client ID and client secret).
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys "clientID" and "clientSecret".
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityprovider"]
+==== OIDCIdentityProvider 
+
+OIDCIdentityProvider describes the configuration of an upstream OpenID Connect identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderlist[$$OIDCIdentityProviderList$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
+
+| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]__ | Spec for configuring the identity provider.
+| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderstatus[$$OIDCIdentityProviderStatus$$]__ | Status of the identity provider.
+|===
+
+
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec"]
+==== OIDCIdentityProviderSpec 
+
+Spec for configuring an OIDC identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityprovider[$$OIDCIdentityProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`issuer`* __string__ | Issuer is the issuer URL of this OIDC identity provider, i.e., where to fetch /.well-known/openid-configuration.
+| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration for discovery/JWKS requests to the issuer.
+| *`authorizationConfig`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcauthorizationconfig[$$OIDCAuthorizationConfig$$]__ | AuthorizationConfig holds information about how to form the OAuth2 authorization request parameters to be used with this OIDC identity provider.
+| *`claims`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcclaims[$$OIDCClaims$$]__ | Claims provides the names of token claims that will be used when inspecting an identity from this OIDC identity provider.
+| *`client`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcclient[$$OIDCClient$$]__ | OIDCClient contains OIDC client information to be used used with this OIDC identity provider.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderstatus"]
+==== OIDCIdentityProviderStatus 
+
+Status of an OIDC identity provider.
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityprovider[$$OIDCIdentityProvider$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`phase`* __OIDCIdentityProviderPhase__ | Phase summarizes the overall status of the OIDCIdentityProvider.
+| *`conditions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-condition[$$Condition$$]__ | Represents the observations of an identity provider's current state.
+|===
+
+
+[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-tlsspec"]
+==== TLSSpec 
+
+
+
+.Appears In:
+****
+- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
+****
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`certificateAuthorityData`* __string__ | X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted.
+|===
+
+
+
 [id="{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1"]
 === login.concierge.pinniped.dev/v1alpha1
 

generated/1.17/apis/concierge/authentication/doc.go

@@ -1,8 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:deepcopy-gen=package
-// +groupName=authentication.concierge.pinniped.dev
-
-// Package authentication is the internal version of the Pinniped concierge authentication API.
-package authentication

generated/1.17/apis/concierge/authentication/v1alpha1/doc.go

@@ -3,7 +3,6 @@
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/generated/1.17/apis/concierge/authentication
 // +k8s:defaulter-gen=TypeMeta
 // +groupName=authentication.concierge.pinniped.dev
 

generated/1.17/apis/concierge/authentication/v1alpha1/register.go

@@ -24,7 +24,7 @@ func init() {
 	// We only register manually written functions here. The registration of the
 	// generated functions takes place in the generated files. The separation
 	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+	localSchemeBuilder.Register(addKnownTypes)
 }
 
 // Adds the list of known types to the given scheme.
@@ -32,6 +32,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&WebhookAuthenticator{},
 		&WebhookAuthenticatorList{},
+		&JWTAuthenticator{},
+		&JWTAuthenticatorList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

generated/1.17/apis/concierge/authentication/v1alpha1/types_jwt.go

@@ -0,0 +1,83 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// Status of a JWT authenticator.
+type JWTAuthenticatorStatus struct {
+	// Represents the observations of the authenticator's current state.
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	Conditions []Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+}
+
+// Spec for configuring a JWT authenticator.
+type JWTAuthenticatorSpec struct {
+	// Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
+	// also used to validate the "iss" JWT claim.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^https://`
+	Issuer string `json:"issuer"`
+
+	// Audience is the required value of the "aud" JWT claim.
+	// +kubebuilder:validation:MinLength=1
+	Audience string `json:"audience"`
+
+	// Claims allows customization of the claims that will be mapped to user identity
+	// for Kubernetes access.
+	// +optional
+	Claims JWTTokenClaims `json:"claims"`
+
+	// TLS configuration for communicating with the OIDC provider.
+	// +optional
+	TLS *TLSSpec `json:"tls,omitempty"`
+}
+
+// JWTTokenClaims allows customization of the claims that will be mapped to user identity
+// for Kubernetes access.
+type JWTTokenClaims struct {
+	// Groups is the name of the claim which should be read to extract the user's
+	// group membership from the JWT token. When not specified, it will default to "groups".
+	// +optional
+	Groups string `json:"groups"`
+
+	// Username is the name of the claim which should be read to extract the
+	// username from the JWT token. When not specified, it will default to "username".
+	// +optional
+	Username string `json:"username"`
+}
+
+// JWTAuthenticator describes the configuration of a JWT authenticator.
+//
+// Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
+// signature, existence of claims, etc.) and extract the username and groups from the token.
+//
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
+// +kubebuilder:printcolumn:name="Issuer",type=string,JSONPath=`.spec.issuer`
+// +kubebuilder:subresource:status
+type JWTAuthenticator struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec for configuring the authenticator.
+	Spec JWTAuthenticatorSpec `json:"spec"`
+
+	// Status of the authenticator.
+	Status JWTAuthenticatorStatus `json:"status,omitempty"`
+}
+
+// List of JWTAuthenticator objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type JWTAuthenticatorList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []JWTAuthenticator `json:"items"`
+}

generated/1.17/apis/concierge/authentication/v1alpha1/types_webhook.go

@@ -29,9 +29,11 @@ type WebhookAuthenticatorSpec struct {
 
 // WebhookAuthenticator describes the configuration of a webhook authenticator.
 // +genclient
+// +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:resource:categories=all;authenticator;authenticators
+// +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
 // +kubebuilder:printcolumn:name="Endpoint",type=string,JSONPath=`.spec.endpoint`
+// +kubebuilder:subresource:status
 type WebhookAuthenticator struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`

generated/1.17/apis/concierge/authentication/v1alpha1/zz_generated.conversion.go

@@ -1,22 +0,0 @@
-// +build !ignore_autogenerated
-
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by conversion-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	localSchemeBuilder.Register(RegisterConversions)
-}
-
-// RegisterConversions adds conversion functions to the given scheme.
-// Public to allow building arbitrary schemes.
-func RegisterConversions(s *runtime.Scheme) error {
-	return nil
-}

generated/1.17/apis/concierge/authentication/v1alpha1/zz_generated.deepcopy.go

@@ -28,6 +28,128 @@ func (in *Condition) DeepCopy() *Condition {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JWTAuthenticator) DeepCopyInto(out *JWTAuthenticator) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticator.
+func (in *JWTAuthenticator) DeepCopy() *JWTAuthenticator {
+	if in == nil {
+		return nil
+	}
+	out := new(JWTAuthenticator)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *JWTAuthenticator) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JWTAuthenticatorList) DeepCopyInto(out *JWTAuthenticatorList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]JWTAuthenticator, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorList.
+func (in *JWTAuthenticatorList) DeepCopy() *JWTAuthenticatorList {
+	if in == nil {
+		return nil
+	}
+	out := new(JWTAuthenticatorList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *JWTAuthenticatorList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JWTAuthenticatorSpec) DeepCopyInto(out *JWTAuthenticatorSpec) {
+	*out = *in
+	out.Claims = in.Claims
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSSpec)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorSpec.
+func (in *JWTAuthenticatorSpec) DeepCopy() *JWTAuthenticatorSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(JWTAuthenticatorSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JWTAuthenticatorStatus) DeepCopyInto(out *JWTAuthenticatorStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorStatus.
+func (in *JWTAuthenticatorStatus) DeepCopy() *JWTAuthenticatorStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(JWTAuthenticatorStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JWTTokenClaims) DeepCopyInto(out *JWTTokenClaims) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTTokenClaims.
+func (in *JWTTokenClaims) DeepCopy() *JWTTokenClaims {
+	if in == nil {
+		return nil
+	}
+	out := new(JWTTokenClaims)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TLSSpec) DeepCopyInto(out *TLSSpec) {
 	*out = *in

generated/1.17/apis/concierge/authentication/zz_generated.deepcopy.go

@@ -1,8 +0,0 @@
-// +build !ignore_autogenerated
-
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by deepcopy-gen. DO NOT EDIT.
-
-package authentication

generated/1.17/apis/concierge/config/types.go

@@ -1,4 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package config

generated/1.17/apis/concierge/config/v1alpha1/defaults.go

@@ -1,12 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func addDefaultingFuncs(scheme *runtime.Scheme) error {
-	return RegisterDefaults(scheme)
-}

generated/1.17/apis/concierge/config/v1alpha1/doc.go

@@ -3,7 +3,6 @@
 
 // +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/generated/1.17/apis/concierge/config
 // +k8s:defaulter-gen=TypeMeta
 // +groupName=config.concierge.pinniped.dev
 

generated/1.17/apis/concierge/config/v1alpha1/register.go

@@ -24,7 +24,7 @@ func init() {
 	// We only register manually written functions here. The registration of the
 	// generated functions takes place in the generated files. The separation
 	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+	localSchemeBuilder.Register(addKnownTypes)
 }
 
 // Adds the list of known types to the given scheme.

generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go

@@ -67,19 +67,21 @@ type CredentialIssuerStrategy struct {
 
 // Describes the configuration status of a Pinniped credential issuer.
 // +genclient
+// +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
+// +kubebuilder:resource:categories=pinniped,scope=Cluster
+// +kubebuilder:subresource:status
 type CredentialIssuer struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
 	// Status of the credential issuer.
+	// +optional
 	Status CredentialIssuerStatus `json:"status"`
 }
 
 // List of CredentialIssuer objects.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
 type CredentialIssuerList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`

generated/1.17/apis/concierge/config/v1alpha1/zz_generated.conversion.go

@@ -1,22 +0,0 @@
-// +build !ignore_autogenerated
-
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by conversion-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	localSchemeBuilder.Register(RegisterConversions)
-}
-
-// RegisterConversions adds conversion functions to the given scheme.
-// Public to allow building arbitrary schemes.
-func RegisterConversions(s *runtime.Scheme) error {
-	return nil
-}

generated/1.17/apis/concierge/config/v1alpha1/zz_generated.defaults.go

@@ -1,19 +0,0 @@
-// +build !ignore_autogenerated
-
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by defaulter-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// RegisterDefaults adds defaulters functions to the given scheme.
-// Public to allow building arbitrary schemes.
-// All generated defaulters are covering - they call all nested defaulters.
-func RegisterDefaults(scheme *runtime.Scheme) error {
-	return nil
-}

generated/1.17/apis/concierge/config/zz_generated.deepcopy.go

@@ -1,8 +0,0 @@
-// +build !ignore_autogenerated
-
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by deepcopy-gen. DO NOT EDIT.
-
-package config

generated/1.17/apis/concierge/login/types_token.go

@@ -27,7 +27,6 @@ type TokenCredentialRequestStatus struct {
 }
 
 // TokenCredentialRequest submits an IDP-specific credential to Pinniped in exchange for a cluster-specific credential.
-// +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type TokenCredentialRequest struct {
 	metav1.TypeMeta

generated/1.17/apis/concierge/login/v1alpha1/types_token.go

@@ -30,6 +30,7 @@ type TokenCredentialRequestStatus struct {
 
 // TokenCredentialRequest submits an IDP-specific credential to Pinniped in exchange for a cluster-specific credential.
 // +genclient
+// +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type TokenCredentialRequest struct {
 	metav1.TypeMeta   `json:",inline"`

generated/1.17/apis/supervisor/config/doc.go

@@ -1,8 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:deepcopy-gen=package
-// +groupName=config.supervisor.pinniped.dev
-
-// Package config is the internal version of the Pinniped configuration API.
-package config

generated/1.17/apis/supervisor/config/types.go

@@ -1,4 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package config

generated/1.17/apis/supervisor/config/v1alpha1/conversion.go

@@ -1,4 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1

generated/1.17/apis/supervisor/config/v1alpha1/defaults.go

@@ -1,12 +0,0 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func addDefaultingFuncs(scheme *runtime.Scheme) error {
-	return RegisterDefaults(scheme)
-}

generated/1.17/apis/supervisor/config/v1alpha1/register.go

@@ -24,14 +24,14 @@ func init() {
 	// We only register manually written functions here. The registration of the
 	// generated functions takes place in the generated files. The separation
 	// makes the code compile even when the generated files are missing.
-	localSchemeBuilder.Register(addKnownTypes, addDefaultingFuncs)
+	localSchemeBuilder.Register(addKnownTypes)
 }
 
 // Adds the list of known types to the given scheme.
 func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
-		&OIDCProvider{},
-		&OIDCProviderList{},
+		&FederationDomain{},
+		&FederationDomainList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

generated/1.17/apis/supervisor/config/v1alpha1/types_federationdomain.go

@@ -8,20 +8,20 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// +kubebuilder:validation:Enum=Success;Duplicate;Invalid
-type OIDCProviderStatusCondition string
+// +kubebuilder:validation:Enum=Success;Duplicate;Invalid;SameIssuerHostMustUseSameSecret
+type FederationDomainStatusCondition string
 
 const (
-	SuccessOIDCProviderStatusCondition                         = OIDCProviderStatusCondition("Success")
-	DuplicateOIDCProviderStatusCondition                       = OIDCProviderStatusCondition("Duplicate")
-	SameIssuerHostMustUseSameSecretOIDCProviderStatusCondition = OIDCProviderStatusCondition("SameIssuerHostMustUseSameSecret")
-	InvalidOIDCProviderStatusCondition                         = OIDCProviderStatusCondition("Invalid")
+	SuccessFederationDomainStatusCondition                         = FederationDomainStatusCondition("Success")
+	DuplicateFederationDomainStatusCondition                       = FederationDomainStatusCondition("Duplicate")
+	SameIssuerHostMustUseSameSecretFederationDomainStatusCondition = FederationDomainStatusCondition("SameIssuerHostMustUseSameSecret")
+	InvalidFederationDomainStatusCondition                         = FederationDomainStatusCondition("Invalid")
 )
 
-// OIDCProviderTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
-type OIDCProviderTLSSpec struct {
+// FederationDomainTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
+type FederationDomainTLSSpec struct {
 	// SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains
-	// the TLS serving certificate for the HTTPS endpoints served by this OIDCProvider. When provided, the TLS Secret
+	// the TLS serving certificate for the HTTPS endpoints served by this FederationDomain. When provided, the TLS Secret
 	// named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use
 	// for TLS.
 	//
@@ -41,8 +41,8 @@ type OIDCProviderTLSSpec struct {
 	SecretName string `json:"secretName,omitempty"`
 }
 
-// OIDCProviderSpec is a struct that describes an OIDC Provider.
-type OIDCProviderSpec struct {
+// FederationDomainSpec is a struct that describes an OIDC Provider.
+type FederationDomainSpec struct {
 	// Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the
 	// identifier that it will use for the iss claim in issued JWTs. This field will also be used as
 	// the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is
@@ -54,17 +54,41 @@ type OIDCProviderSpec struct {
 	// +kubebuilder:validation:MinLength=1
 	Issuer string `json:"issuer"`
 
-	// TLS configures how this OIDCProvider is served over Transport Layer Security (TLS).
+	// TLS configures how this FederationDomain is served over Transport Layer Security (TLS).
 	// +optional
-	TLS *OIDCProviderTLSSpec `json:"tls,omitempty"`
+	TLS *FederationDomainTLSSpec `json:"tls,omitempty"`
 }
 
-// OIDCProviderStatus is a struct that describes the actual state of an OIDC Provider.
-type OIDCProviderStatus struct {
+// FederationDomainSecrets holds information about this OIDC Provider's secrets.
+type FederationDomainSecrets struct {
+	// JWKS holds the name of the corev1.Secret in which this OIDC Provider's signing/verification keys are
+	// stored. If it is empty, then the signing/verification keys are either unknown or they don't
+	// exist.
+	// +optional
+	JWKS corev1.LocalObjectReference `json:"jwks,omitempty"`
+
+	// TokenSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
+	// signing tokens is stored.
+	// +optional
+	TokenSigningKey corev1.LocalObjectReference `json:"tokenSigningKey,omitempty"`
+
+	// StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
+	// signing state parameters is stored.
+	// +optional
+	StateSigningKey corev1.LocalObjectReference `json:"stateSigningKey,omitempty"`
+
+	// StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
+	// encrypting state parameters is stored.
+	// +optional
+	StateEncryptionKey corev1.LocalObjectReference `json:"stateEncryptionKey,omitempty"`
+}
+
+// FederationDomainStatus is a struct that describes the actual state of an OIDC Provider.
+type FederationDomainStatus struct {
 	// Status holds an enum that describes the state of this OIDC Provider. Note that this Status can
 	// represent success or failure.
 	// +optional
-	Status OIDCProviderStatusCondition `json:"status,omitempty"`
+	Status FederationDomainStatusCondition `json:"status,omitempty"`
 
 	// Message provides human-readable details about the Status.
 	// +optional
@@ -76,32 +100,32 @@ type OIDCProviderStatus struct {
 	// +optional
 	LastUpdateTime *metav1.Time `json:"lastUpdateTime,omitempty"`
 
-	// JWKSSecret holds the name of the secret in which this OIDC Provider's signing/verification keys
-	// are stored. If it is empty, then the signing/verification keys are either unknown or they don't
-	// exist.
+	// Secrets contains information about this OIDC Provider's secrets.
 	// +optional
-	JWKSSecret corev1.LocalObjectReference `json:"jwksSecret,omitempty"`
+	Secrets FederationDomainSecrets `json:"secrets,omitempty"`
 }
 
-// OIDCProvider describes the configuration of an OIDC provider.
+// FederationDomain describes the configuration of an OIDC provider.
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type OIDCProvider struct {
+// +kubebuilder:resource:categories=pinniped
+// +kubebuilder:subresource:status
+type FederationDomain struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
 	// Spec of the OIDC provider.
-	Spec OIDCProviderSpec `json:"spec"`
+	Spec FederationDomainSpec `json:"spec"`
 
 	// Status of the OIDC provider.
-	Status OIDCProviderStatus `json:"status,omitempty"`
+	Status FederationDomainStatus `json:"status,omitempty"`
 }
 
-// List of OIDCProvider objects.
+// List of FederationDomain objects.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type OIDCProviderList struct {
+type FederationDomainList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`
 
-	Items []OIDCProvider `json:"items"`
+	Items []FederationDomain `json:"items"`
 }

generated/1.17/apis/supervisor/config/v1alpha1/zz_generated.conversion.go

@@ -1,22 +0,0 @@
-// +build !ignore_autogenerated
-
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by conversion-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	localSchemeBuilder.Register(RegisterConversions)
-}
-
-// RegisterConversions adds conversion functions to the given scheme.
-// Public to allow building arbitrary schemes.
-func RegisterConversions(s *runtime.Scheme) error {
-	return nil
-}

generated/1.17/apis/supervisor/config/v1alpha1/zz_generated.deepcopy.go

@@ -12,7 +12,7 @@ import (
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *OIDCProvider) DeepCopyInto(out *OIDCProvider) {
+func (in *FederationDomain) DeepCopyInto(out *FederationDomain) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
@@ -21,18 +21,18 @@ func (in *OIDCProvider) DeepCopyInto(out *OIDCProvider) {
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCProvider.
-func (in *OIDCProvider) DeepCopy() *OIDCProvider {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FederationDomain.
+func (in *FederationDomain) DeepCopy() *FederationDomain {
 	if in == nil {
 		return nil
 	}
-	out := new(OIDCProvider)
+	out := new(FederationDomain)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *OIDCProvider) DeepCopyObject() runtime.Object {
+func (in *FederationDomain) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -40,13 +40,13 @@ func (in *OIDCProvider) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *OIDCProviderList) DeepCopyInto(out *OIDCProviderList) {
+func (in *FederationDomainList) DeepCopyInto(out *FederationDomainList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]OIDCProvider, len(*in))
+		*out = make([]FederationDomain, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -54,18 +54,18 @@ func (in *OIDCProviderList) DeepCopyInto(out *OIDCProviderList) {
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCProviderList.
-func (in *OIDCProviderList) DeepCopy() *OIDCProviderList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FederationDomainList.
+func (in *FederationDomainList) DeepCopy() *FederationDomainList {
 	if in == nil {
 		return nil
 	}
-	out := new(OIDCProviderList)
+	out := new(FederationDomainList)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *OIDCProviderList) DeepCopyObject() runtime.Object {
+func (in *FederationDomainList) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -73,59 +73,79 @@ func (in *OIDCProviderList) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *OIDCProviderSpec) DeepCopyInto(out *OIDCProviderSpec) {
+func (in *FederationDomainSecrets) DeepCopyInto(out *FederationDomainSecrets) {
+	*out = *in
+	out.JWKS = in.JWKS
+	out.TokenSigningKey = in.TokenSigningKey
+	out.StateSigningKey = in.StateSigningKey
+	out.StateEncryptionKey = in.StateEncryptionKey
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FederationDomainSecrets.
+func (in *FederationDomainSecrets) DeepCopy() *FederationDomainSecrets {
+	if in == nil {
+		return nil
+	}
+	out := new(FederationDomainSecrets)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FederationDomainSpec) DeepCopyInto(out *FederationDomainSpec) {
 	*out = *in
 	if in.TLS != nil {
 		in, out := &in.TLS, &out.TLS
-		*out = new(OIDCProviderTLSSpec)
+		*out = new(FederationDomainTLSSpec)
 		**out = **in
 	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCProviderSpec.
-func (in *OIDCProviderSpec) DeepCopy() *OIDCProviderSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FederationDomainSpec.
+func (in *FederationDomainSpec) DeepCopy() *FederationDomainSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(OIDCProviderSpec)
+	out := new(FederationDomainSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *OIDCProviderStatus) DeepCopyInto(out *OIDCProviderStatus) {
+func (in *FederationDomainStatus) DeepCopyInto(out *FederationDomainStatus) {
 	*out = *in
 	if in.LastUpdateTime != nil {
 		in, out := &in.LastUpdateTime, &out.LastUpdateTime
 		*out = (*in).DeepCopy()
 	}
-	out.JWKSSecret = in.JWKSSecret
+	out.Secrets = in.Secrets
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCProviderStatus.
-func (in *OIDCProviderStatus) DeepCopy() *OIDCProviderStatus {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FederationDomainStatus.
+func (in *FederationDomainStatus) DeepCopy() *FederationDomainStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(OIDCProviderStatus)
+	out := new(FederationDomainStatus)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *OIDCProviderTLSSpec) DeepCopyInto(out *OIDCProviderTLSSpec) {
+func (in *FederationDomainTLSSpec) DeepCopyInto(out *FederationDomainTLSSpec) {
 	*out = *in
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCProviderTLSSpec.
-func (in *OIDCProviderTLSSpec) DeepCopy() *OIDCProviderTLSSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FederationDomainTLSSpec.
+func (in *FederationDomainTLSSpec) DeepCopy() *FederationDomainTLSSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(OIDCProviderTLSSpec)
+	out := new(FederationDomainTLSSpec)
 	in.DeepCopyInto(out)
 	return out
 }