Merge pull request #2936 from vmware/pinny/bump-deps

Bump dependencies

.github/ISSUE_TEMPLATE/release_checklist.md

@@ -11,21 +11,23 @@ assignees: ''
 
 # Release checklist
 
-- [ ] Ensure that Pinniped's dependencies have been upgraded, to the extent desired by the team (refer to the diff output from the latest run of the [all-golang-deps-updated](https://ci.pinniped.dev/teams/main/pipelines/security-scan/jobs/all-golang-deps-updated/) CI job)
+- [ ] Ensure that Pinniped's dependencies have been upgraded, to the extent desired by the team (refer to the diff output from the latest run of the [all-golang-deps-updated](https://ci.pinniped.broadcom.net/teams/main/pipelines/security-scan/jobs/all-golang-deps-updated/) CI job)
   - [ ] If you are updating golang in Pinniped, be sure to update golang in CI as well.  Do a search-and-replace to update the version number everywhere in the pinniped `ci` branch.
   - [ ] If the Fosite library is being updated and the format of the content of the Supervisor's storage Secrets are changed, or if any change to our own code changes the format of the content of the Supervisor's session storage Secrets, then be sure to update the `accessTokenStorageVersion`, `authorizeCodeStorageVersion`, `oidcStorageVersion`, `pkceStorageVersion`, `refreshTokenStorageVersion`, variables in files such as `internal/fositestorage/accesstoken/accesstoken.go`.  Failing tests should signal the need to update these values.
   - [ ] For go.mod direct dependencies that are v2 or above, such as `github.com/google/go-github/vXX`, check to see if there is a new major version available. Try using `hack/update-go-mod/update-majors.sh`.
-  - [ ] Evaluate all `replace` directives in the `go.mod` file. Are they up to date versions? Can any `replace` directives be removed?
-- [ ] Ensure that Pinniped's codegen is up-to-date with the latest Kubernetes releases by making sure this [file](https://github.com/vmware-tanzu/pinniped/blob/main/hack/lib/kube-versions.txt) is updated compared to the latest releases listed [here for active branches](https://kubernetes.io/releases/) and [here for non-active branches](https://kubernetes.io/releases/patch-releases/#non-active-branch-history)
+  - [ ] Evaluate all `replace` directives in the `go.mod` file. Are those versions up-to-date? Can any `replace` directives be removed?
+  - [ ] Evaluate all overrides in the `hack/update-go-mod/overrides.conf` file. Are those versions up-to-date? Can those overrides be removed?
+- [ ] Ensure that Pinniped's codegen is up-to-date with the latest Kubernetes releases by making sure this [file](https://github.com/vmware/pinniped/blob/main/hack/lib/kube-versions.txt) is updated compared to the latest releases listed [here for active branches](https://kubernetes.io/releases/) and [here for non-active branches](https://kubernetes.io/releases/patch-releases/#non-active-branch-history)
 - [ ] Ensure that the `k8s-code-generator` CI job definitions are up-to-date with the latest Go, K8s, and `controller-gen` versions
 - [ ] All relevant feature and docs PRs are merged
-- [ ] The [main pipeline](https://ci.pinniped.dev/teams/main/pipelines/main) is green, up to and including the `ready-to-release` job. Check that the expected git commit has passed the `ready-to-release` job.
+- [ ] The [main pipeline](https://ci.pinniped.broadcom.net/teams/main/pipelines/main) is green, up to and including the `ready-to-release` job. Check that the expected git commit has passed the `ready-to-release` job.
+- [ ] Manually trigger the jobs `run-int-misc`, `run-int-cloud-providers`, and `run-int-k8s-versions` in the main pipeline to run other pre-release tests. Depending on the number of Concourse workers, you may need to run these one at a time.
 - [ ] Optional: a blog post for the release is written and submitted as a PR but not merged yet
 - [ ] All merged user stories are accepted (manually tested)
 - [ ] Only after all stories are accepted, manually trigger the `release` job to create a draft GitHub release
-- [ ] Manually edit the draft release notes on the [GitHub release](https://github.com/vmware-tanzu/pinniped/releases) to describe the contents of the release, using the format which was automatically added to the draft release
+- [ ] Manually edit the draft release notes on the [GitHub release](https://github.com/vmware/pinniped/releases) to describe the contents of the release, using the format which was automatically added to the draft release
 - [ ] Publish (i.e. make public) the draft release
-- [ ] After making the release public, the jobs in the [main pipeline](https://ci.pinniped.dev/teams/main/pipelines/main) beyond the release job should auto-trigger, so check to make sure that they passed
+- [ ] After making the release public, the jobs in the [main pipeline](https://ci.pinniped.broadcom.net/teams/main/pipelines/main) beyond the release job should auto-trigger, so check to make sure that they passed
 - [ ] Edit the blog post's date to make it match the actual release date, and merge the blog post PR to make it live on the website
 - [ ] Publicize the release via tweets, etc.
 - [ ] Close this issue

.golangci.yaml

@@ -90,6 +90,8 @@ linters:
           alias: supervisorclientsetscheme
         - pkg: go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake
           alias: supervisorfake
+        - pkg: k8s.io/client-go/kubernetes/fake
+          alias: kubefake
         - pkg: go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
           alias: idpv1alpha1
         - pkg: go.pinniped.dev/generated/latest/client/concierge/informers/externalversions

ADOPTERS.md

@@ -30,5 +30,5 @@ TMC uses Pinniped to provide a uniform authentication experience across all atta
 ## Adding your organization to the list of adopters
 
 If you are using Pinniped and would like to be included in the list of Pinniped Adopters, add an SVG version of your logo that is less than 150 KB to
-the [img directory](https://github.com/vmware-tanzu/pinniped/tree/main/site/themes/pinniped/static/img) in this repo and submit a pull request with your change including 1-2 sentences describing how your organization is using Pinniped. Name the image file something that
+the [img directory](https://github.com/vmware/pinniped/tree/main/site/themes/pinniped/static/img) in this repo and submit a pull request with your change including 1-2 sentences describing how your organization is using Pinniped. Name the image file something that
 reflects your company (e.g., if your company is called Acme, name the image acme.svg). Please feel free to send us a message in [#pinniped](https://kubernetes.slack.com/archives/C01BW364RJA) with any questions you may have.

CONTRIBUTING.md

@@ -20,26 +20,26 @@ The near-term and mid-term roadmap for the work planned for the project [maintai
 ## Discussion
 
 Got a question, comment, or idea? Please don't hesitate to reach out
-via GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions),
-GitHub [Issues](https://github.com/vmware-tanzu/pinniped/issues),
+via GitHub [Discussions](https://github.com/vmware/pinniped/discussions),
+GitHub [Issues](https://github.com/vmware/pinniped/issues),
 or in the Kubernetes Slack Workspace within the [#pinniped channel](https://go.pinniped.dev/community/slack).
 Join our [Google Group](https://go.pinniped.dev/community/group) to receive updates and meeting invitations.
 
 ## Issues
 
 Need an idea for a project to get started contributing? Take a look at the open
-[issues](https://github.com/vmware-tanzu/pinniped/issues).
+[issues](https://github.com/vmware/pinniped/issues).
 Also check to see if any open issues are labeled with
-["good first issue"](https://github.com/vmware-tanzu/pinniped/labels/good%20first%20issue)
-or ["help wanted"](https://github.com/vmware-tanzu/pinniped/labels/help%20wanted).
+["good first issue"](https://github.com/vmware/pinniped/labels/good%20first%20issue)
+or ["help wanted"](https://github.com/vmware/pinniped/labels/help%20wanted).
 
 ### Bugs
 
 To file a bug report, please first open an
-[issue](https://github.com/vmware-tanzu/pinniped/issues/new?template=bug_report.md). The project team
+[issue](https://github.com/vmware/pinniped/issues/new?template=bug_report.md). The project team
 will work with you on your bug report.
 
-Once the bug has been validated, a [pull request](https://github.com/vmware-tanzu/pinniped/compare)
+Once the bug has been validated, a [pull request](https://github.com/vmware/pinniped/compare)
 can be opened to fix the bug.
 
 For specifics on what to include in your bug report, please follow the
@@ -48,11 +48,11 @@ guidelines in the issue and pull request templates.
 ### Features
 
 To suggest a feature, please first open an
-[issue](https://github.com/vmware-tanzu/pinniped/issues/new?template=feature-proposal.md)
-and tag it with `proposal`, or create a new [Discussion](https://github.com/vmware-tanzu/pinniped/discussions).
+[issue](https://github.com/vmware/pinniped/issues/new?template=feature-proposal.md)
+and tag it with `proposal`, or create a new [Discussion](https://github.com/vmware/pinniped/discussions).
 The project [maintainers](MAINTAINERS.md) will work with you on your feature request.
 
-Once the feature request has been validated, a [pull request](https://github.com/vmware-tanzu/pinniped/compare)
+Once the feature request has been validated, a [pull request](https://github.com/vmware/pinniped/compare)
 can be opened to implement the feature.
 
 For specifics on what to include in your feature request, please follow the
@@ -127,7 +127,7 @@ go build -o pinniped ./cmd/pinniped
    On macOS, these tools can be installed with [Homebrew](https://brew.sh/) (assuming you have Chrome installed already):
 
    ```bash
-   brew install kind vmware-tanzu/carvel/ytt vmware-tanzu/carvel/kapp kubectl nmap && brew cask install docker
+   brew install kind carvel-dev/carvel/ytt carvel-dev/carvel/kapp kubectl nmap && brew cask install docker
    ```
 
 1. Create a kind cluster, compile, create container images, and install Pinniped and supporting test dependencies using:
@@ -144,7 +144,7 @@ go build -o pinniped ./cmd/pinniped
 
    To run specific integration tests, add the `-run` flag to the above command to specify a regexp for the test names.
    Use a leading `/` on the regexp because the Pinniped integration tests are automatically nested under several parent tests
-   (see [integration/main_test.go](https://github.com/vmware-tanzu/pinniped/blob/main/test/integration/main_test.go)).
+   (see [integration/main_test.go](https://github.com/vmware/pinniped/blob/main/test/integration/main_test.go)).
    For example, to run an integration test called `TestE2E`, add `-run /TestE2E` to the command shown above.
 
 1. After making production code changes, recompile, redeploy, and run tests again by repeating the same
@@ -177,17 +177,20 @@ Each run of `hack/prepare-for-integration-tests.sh` can result in different valu
 
 ### Observing Tests on the Continuous Integration Environment
 
-[CI](https://ci.pinniped.dev/teams/main/pipelines/pull-requests)
-will not be triggered on a pull request until the pull request is reviewed and
+CI will not be triggered on a pull request until the pull request is reviewed and
 approved for CI by a project [maintainer](MAINTAINERS.md). Once CI is triggered,
 the progress and results will appear on the Github page for that
-[pull request](https://github.com/vmware-tanzu/pinniped/pulls) as checks. Links
+[pull request](https://github.com/vmware/pinniped/pulls) as checks. Links
 will appear to view the details of each check.
 
+Starting in mid-2025, Pinniped's CI system is no longer externally visible due to corporate policies.
+Please contact the maintainers for help with your PR if you encounter any CI failures.
+They will be happy to share CI logs with you directly for your PR.
+
 ## CI
 
-Pinniped's CI configuration and code is in the [`ci`](https://github.com/vmware-tanzu/pinniped/tree/ci)
-branch of this repo. The CI results are visible to the public at https://ci.pinniped.dev.
+Pinniped's CI configuration and code is in the [`ci`](https://github.com/vmware/pinniped/tree/ci)
+branch of this repo.
 
 ## Documentation
 

Dockerfile

@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1
 
-# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-ARG BUILD_IMAGE=golang:1.24.3@sha256:86b4cff66e04d41821a17cea30c1031ed53e2635e2be99ae0b4a7d69336b5063
-ARG BASE_IMAGE=gcr.io/distroless/static:nonroot@sha256:c0f429e16b13e583da7e5a6ec20dd656d325d88e6819cafe0adb0828976529dc
+ARG BUILD_IMAGE=golang:1.26.0@sha256:c83e68f3ebb6943a2904fa66348867d108119890a2c6a2e6f07b38d0eb6c25c5
+ARG BASE_IMAGE=gcr.io/distroless/static:nonroot@sha256:01e550fdb7ab79ee7be5ff440a563a58f1fd000ad9e0c532e65c3d23f917f1c5
 
 # Prepare to cross-compile by always running the build stage in the build platform, not the target platform.
 FROM --platform=$BUILDPLATFORM $BUILD_IMAGE AS build-env

GOVERNANCE.md

@@ -11,7 +11,7 @@ all members should work together to achieve this goal.
 # Code of Conduct
 
 The Pinniped community abides by this
-[code of conduct](https://github.com/vmware-tanzu/pinniped/blob/main/CODE_OF_CONDUCT.md).
+[code of conduct](https://github.com/vmware/pinniped/blob/main/CODE_OF_CONDUCT.md).
 
 # Community Roles
 
@@ -29,7 +29,7 @@ notifying one of the maintainers.
 
 **Note:** If a maintainer leaves their employer they are still considered a maintainer of Pinniped, unless they
 voluntarily resign. Employment is not taken into consideration when determining maintainer eligibility unless the
-company itself violates our [Code of Conduct](https://github.com/vmware-tanzu/pinniped/blob/main/CODE_OF_CONDUCT.md).
+company itself violates our [Code of Conduct](https://github.com/vmware/pinniped/blob/main/CODE_OF_CONDUCT.md).
 
 # Decision Making
 

README.md

@@ -19,8 +19,8 @@ Care to kick the tires? It's easy to [install and try Pinniped](https://pinniped
 ## Discussion
 
 Got a question, comment, or idea? Please don't hesitate to reach out
-via GitHub [Discussions](https://github.com/vmware-tanzu/pinniped/discussions),
-GitHub [Issues](https://github.com/vmware-tanzu/pinniped/issues),
+via GitHub [Discussions](https://github.com/vmware/pinniped/discussions),
+GitHub [Issues](https://github.com/vmware/pinniped/issues),
 or in the Kubernetes Slack Workspace within the [#pinniped channel](https://go.pinniped.dev/community/slack).
 Join our [Google Group](https://go.pinniped.dev/community/group) to receive updates and meeting invitations.
 
@@ -37,7 +37,7 @@ building and testing the code, submitting PRs, and other contributor topics.
 ## Adopters
 
 Some organizations and products using Pinniped are featured in [ADOPTERS.md](ADOPTERS.md).
-Add your own organization or product [here](https://github.com/vmware-tanzu/pinniped/discussions/152).
+Add your own organization or product [here](https://github.com/vmware/pinniped/discussions/152).
 
 ## Reporting security vulnerabilities
 

ROADMAP.md

@@ -10,17 +10,17 @@ help determine if a contribution could be conflicting with a longer term plan.
 
 Discussion on the roadmap is welcomed. If you want to provide suggestions, use cases, and feedback to an item in the
 roadmap, please reach out to the maintainers using one of the methods described in the project's
-[README.md](https://github.com/vmware-tanzu/pinniped#discussion).
-[Contributions](https://github.com/vmware-tanzu/pinniped/blob/main/CONTRIBUTING.md) to Pinniped are also welcomed.
+[README.md](https://github.com/vmware/pinniped#discussion).
+[Contributions](https://github.com/vmware/pinniped/blob/main/CONTRIBUTING.md) to Pinniped are also welcomed.
 
 ### How to add an item to the roadmap
 
 One of the most important aspects in any open source community is the concept of proposals. Large changes to the
 codebase and / or new features should be preceded by
-a [proposal](https://github.com/vmware-tanzu/pinniped/tree/main/proposals) in our repo.
+a [proposal](https://github.com/vmware/pinniped/tree/main/proposals) in our repo.
 For smaller enhancements, you can open an issue to track that initiative or feature request.
 We work with and rely on community feedback to focus our efforts to improve Pinniped and maintain a healthy roadmap.
 
 Priorities and requirements change based on community feedback, roadblocks encountered, community contributions,
 etc. If you depend on a specific item, we encourage you to reach out for updated status information, or help us deliver
-that feature by [contributing](https://github.com/vmware-tanzu/pinniped/blob/main/CONTRIBUTING.md) to Pinniped.
+that feature by [contributing](https://github.com/vmware/pinniped/blob/main/CONTRIBUTING.md) to Pinniped.

SECURITY.md

@@ -10,11 +10,11 @@ As of right now, only the latest version of Pinniped is supported.
 
 Security is of the highest importance and all security vulnerabilities or suspected security vulnerabilities should be reported to Pinniped privately, to minimize attacks against current users of Pinniped before they are fixed. Vulnerabilities will be investigated and patched on the next patch (or minor) release as soon as possible. This information could be kept entirely internal to the project.
 
-If you know of a publicly disclosed security vulnerability for Pinniped, please **IMMEDIATELY** contact the VMware Security Team (security@vmware.com). The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
+If you know of a publicly disclosed security vulnerability for Pinniped, please **IMMEDIATELY** contact the VMware Security Team (vmware.psirt@broadcom.com). The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
 
 **IMPORTANT: Do not file public issues on GitHub for security vulnerabilities**
 
-To report a vulnerability or a security-related issue, please contact the VMware email address with the details of the vulnerability. The email will be fielded by the VMware Security Team and then shared with the Pinniped maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/vmware-tanzu/pinniped/issues/new/choose) instead.
+To report a vulnerability or a security-related issue, please contact the VMware email address with the details of the vulnerability. The email will be fielded by the VMware Security Team and then shared with the Pinniped maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/vmware/pinniped/issues/new/choose) instead.
 
 ## Proposed Email Content
 
@@ -48,13 +48,13 @@ The VMware Security Team will respond to vulnerability reports as follows:
 
 ## Public Disclosure Process
 
-The Security Team publishes a [public advisory](https://github.com/vmware-tanzu/pinniped/security/advisories) to the Pinniped community via GitHub. In most cases, additional communication via Slack, Twitter, mailing lists, blog and other channels will assist in educating Pinniped users and rolling out the patched release to affected users.
+The Security Team publishes a [public advisory](https://github.com/vmware/pinniped/security/advisories) to the Pinniped community via GitHub. In most cases, additional communication via Slack, Twitter, mailing lists, blog and other channels will assist in educating Pinniped users and rolling out the patched release to affected users.
 
 The Security Team will also publish any mitigating steps users can take until the fix can be applied to their Pinniped instances. Pinniped distributors will handle creating and publishing their own security advisories.
 
 ## Mailing lists
 
-*   Use security@vmware.com to report security concerns to the VMware Security Team, who uses the list to privately discuss security issues and fixes prior to disclosure. The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
+*   Use vmware.psirt@broadcom.com to report security concerns to the VMware Security Team, who uses the list to privately discuss security issues and fixes prior to disclosure. The use of encrypted email is encouraged. The public PGP key can be found at https://kb.vmware.com/kb/1055.
 *   Join the [Pinniped Distributors](https://groups.google.com/g/project-pinniped-distributors) mailing list for early private information and vulnerability disclosure. Early disclosure may include mitigating steps and additional information on security patch releases. See below for information on how Pinniped distributors or vendors can apply to join this list.
 
 ## Early Disclosure to Pinniped Distributors List
@@ -81,7 +81,7 @@ The information that members receive on the Pinniped Distributors mailing list m
 
 Before you share any information from the list with members of your team who are required to fix the issue, these team members must agree to the same terms, and only be provided with information on a need-to-know basis.
 
-In the unfortunate event that you share information beyond what is permitted by this policy, you must urgently inform the VMware Security Team (security@vmware.com) of exactly what information was leaked and to whom. If you continue to leak information and break the policy outlined here, you will be permanently removed from the list.
+In the unfortunate event that you share information beyond what is permitted by this policy, you must urgently inform the VMware Security Team (vmware.psirt@broadcom.com) of exactly what information was leaked and to whom. If you continue to leak information and break the policy outlined here, you will be permanently removed from the list.
 
 ## Requesting to Join
 

apis/concierge/authentication/v1alpha1/types_jwtauthenticator.go.tmpl

@@ -18,7 +18,7 @@ const (
 	JWTAuthenticatorPhaseError JWTAuthenticatorPhase = "Error"
 )
 
-// Status of a JWT authenticator.
+// JWTAuthenticatorStatus is the status of a JWT authenticator.
 type JWTAuthenticatorStatus struct {
 	// Represents the observations of the authenticator's current state.
 	// +patchMergeKey=type
@@ -26,46 +26,255 @@ type JWTAuthenticatorStatus struct {
 	// +listType=map
 	// +listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+
 	// Phase summarizes the overall status of the JWTAuthenticator.
 	// +kubebuilder:default=Pending
 	// +kubebuilder:validation:Enum=Pending;Ready;Error
 	Phase JWTAuthenticatorPhase `json:"phase,omitempty"`
 }
 
-// Spec for configuring a JWT authenticator.
+// JWTAuthenticatorSpec is the spec for configuring a JWT authenticator.
 type JWTAuthenticatorSpec struct {
-	// Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
+	// issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
 	// also used to validate the "iss" JWT claim.
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:Pattern=`^https://`
 	Issuer string `json:"issuer"`
 
-	// Audience is the required value of the "aud" JWT claim.
+	// audience is the required value of the "aud" JWT claim.
 	// +kubebuilder:validation:MinLength=1
 	Audience string `json:"audience"`
 
-	// Claims allows customization of the claims that will be mapped to user identity
+	// claims allows customization of the claims that will be mapped to user identity
 	// for Kubernetes access.
 	// +optional
 	Claims JWTTokenClaims `json:"claims"`
 
-	// TLS configuration for communicating with the OIDC provider.
+	// claimValidationRules are rules that are applied to validate token claims to authenticate users.
+	// This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
+	// https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	// This is an advanced configuration option. During an end-user login flow, mistakes in this
+	// configuration will cause the user's login to fail.
+	// +optional
+	ClaimValidationRules []ClaimValidationRule `json:"claimValidationRules,omitempty"`
+
+	// userValidationRules are rules that are applied to final user before completing authentication.
+	// These allow invariants to be applied to incoming identities such as preventing the
+	// use of the system: prefix that is commonly used by Kubernetes components.
+	// The validation rules are logically ANDed together and must all return true for the validation to pass.
+	// This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
+	// https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	// This is an advanced configuration option. During an end-user login flow, mistakes in this
+	// configuration will cause the user's login to fail.
+	// +optional
+	UserValidationRules []UserValidationRule `json:"userValidationRules,omitempty"`
+
+	// tls is the configuration for communicating with the OIDC provider via TLS.
 	// +optional
 	TLS *TLSSpec `json:"tls,omitempty"`
 }
 
+// ClaimValidationRule provides the configuration for a single claim validation rule.
+type ClaimValidationRule struct {
+	// claim is the name of a required claim.
+	// Only string claim keys are supported.
+	// Mutually exclusive with expression and message.
+	// +optional
+	Claim string `json:"claim,omitempty"`
+
+	// requiredValue is the value of a required claim.
+	// Only string claim values are supported.
+	// If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string.
+	// Mutually exclusive with expression and message.
+	// +optional
+	RequiredValue string `json:"requiredValue,omitempty"`
+
+	// expression represents the expression which will be evaluated by CEL.
+	// Must produce a boolean.
+	//
+	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
+	// - 'claims' is a map of claim names to claim values.
+	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
+	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+	// Must return true for the validation to pass.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// Mutually exclusive with claim and requiredValue.
+	// +optional
+	Expression string `json:"expression,omitempty"`
+
+	// message customizes the returned error message when expression returns false.
+	// message is a literal string.
+	// Mutually exclusive with claim and requiredValue.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
+// UserValidationRule provides the configuration for a single user info validation rule.
+type UserValidationRule struct {
+	// expression represents the expression which will be evaluated by CEL.
+	// Must return true for the validation to pass.
+	//
+	// CEL expressions have access to the contents of UserInfo, organized into CEL variable:
+	// - 'user' - authentication.k8s.io/v1, Kind=UserInfo object
+	//    Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition.
+	//    API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// +required
+	Expression string `json:"expression"`
+
+	// message customizes the returned error message when rule returns false.
+	// message is a literal string.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
 // JWTTokenClaims allows customization of the claims that will be mapped to user identity
 // for Kubernetes access.
 type JWTTokenClaims struct {
-	// Groups is the name of the claim which should be read to extract the user's
-	// group membership from the JWT token. When not specified, it will default to "groups".
+	// username is the name of the claim which should be read to extract the
+	// username from the JWT token. When not specified, it will default to "username",
+	// unless usernameExpression is specified.
+	//
+	// Mutually exclusive with usernameExpression. Use either username or usernameExpression to
+	// determine the user's username from the JWT token.
+	// +optional
+	Username string `json:"username"`
+
+	// usernameExpression represents an expression which will be evaluated by CEL.
+	// The expression's result will become the user's username.
+	//
+	// usernameExpression is similar to claimMappings.username.expression from Kubernetes AuthenticationConfiguration
+	// as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	// This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+	// must evaluate to the expected type without errors, or else the user's login will fail.
+	// Additionally, mistakes in this configuration can cause the users to have unintended usernames.
+	//
+	// The expression must produce a non-empty string value.
+	// If the expression uses 'claims.email', then 'claims.email_verified' must be used in
+	// the expression or extra[*].valueExpression or claimValidationRules[*].expression.
+	// An example claim validation rule expression that matches the validation automatically
+	// applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'.
+	// By explicitly comparing the value to true, we let type-checking see the result will be a boolean,
+	// and to make sure a non-boolean email_verified claim will be caught at runtime.
+	//
+	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
+	// - 'claims' is a map of claim names to claim values.
+	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
+	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// Mutually exclusive with username. Use either username or usernameExpression to
+	// determine the user's username from the JWT token.
+	// +optional
+	UsernameExpression string `json:"usernameExpression,omitempty"`
+
+	// groups is the name of the claim which should be read to extract the user's
+	// group membership from the JWT token. When not specified, it will default to "groups",
+	// unless groupsExpression is specified.
+	//
+	// Mutually exclusive with groupsExpression. Use either groups or groupsExpression to
+	// determine the user's group membership from the JWT token.
 	// +optional
 	Groups string `json:"groups"`
 
-	// Username is the name of the claim which should be read to extract the
-	// username from the JWT token. When not specified, it will default to "username".
+	// groupsExpression represents an expression which will be evaluated by CEL.
+	// The expression's result will become the user's group memberships.
+	//
+	// groupsExpression is similar to claimMappings.groups.expression from Kubernetes AuthenticationConfiguration
+	// as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	// This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+	// must evaluate to one of the expected types without errors, or else the user's login will fail.
+	// Additionally, mistakes in this configuration can cause the users to have unintended group memberships.
+	//
+	// The expression must produce a string or string array value.
+	//  "", [], and null values are treated as the group mapping not being present.
+	//
+	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
+	// - 'claims' is a map of claim names to claim values.
+	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
+	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// Mutually exclusive with groups. Use either groups or groupsExpression to
+	// determine the user's group membership from the JWT token.
 	// +optional
-	Username string `json:"username"`
+	GroupsExpression string `json:"groupsExpression,omitempty"`
+
+	// extra is similar to claimMappings.extra from Kubernetes AuthenticationConfiguration
+	// as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+	//
+	// However, note that the Pinniped Concierge issues client certificates to users for the purpose
+	// of authenticating, and the Kubernetes API server does not have any mechanism for transmitting
+	// auth extras via client certificates. When configured, these extras will appear in client
+	// certificates issued by the Pinniped Supervisor in the x509 Subject field as Organizational
+	// Units (OU). However, when this client certificate is presented to Kubernetes for authentication,
+	// Kubernetes will ignore these extras. This is probably only useful if you are using a custom
+	// authenticating proxy in front of your Kubernetes API server which can translate these OUs into
+	// auth extras, as described by
+	// https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy.
+	// This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+	// must evaluate to either a string or an array of strings, or else the user's login will fail.
+	//
+	// These keys must be a domain-prefixed path (such as "acme.io/foo") and must not contain an equals sign ("=").
+	//
+	// expression must produce a string or string array value.
+	// If the value is empty, the extra mapping will not be present.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// hard-coded extra key/value
+	// - key: "acme.io/foo"
+	//   valueExpression: "'bar'"
+	// This will result in an extra attribute - acme.io/foo: ["bar"]
+	//
+	// hard-coded key, value copying claim value
+	// - key: "acme.io/foo"
+	//   valueExpression: "claims.some_claim"
+	// This will result in an extra attribute - acme.io/foo: [value of some_claim]
+	//
+	// hard-coded key, value derived from claim value
+	// - key: "acme.io/admin"
+	//   valueExpression: '(has(claims.is_admin) && claims.is_admin) ? "true":""'
+	// This will result in:
+	//  - if is_admin claim is present and true, extra attribute - acme.io/admin: ["true"]
+	//  - if is_admin claim is present and false or is_admin claim is not present, no extra attribute will be added
+	//
+	// +optional
+	Extra []ExtraMapping `json:"extra,omitempty"`
+}
+
+// ExtraMapping provides the configuration for a single extra mapping.
+type ExtraMapping struct {
+	// key is a string to use as the extra attribute key.
+	// key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid
+	// subdomain as defined by RFC 1123. All characters trailing the first "/" must
+	// be valid HTTP Path characters as defined by RFC 3986.
+	// key must be lowercase.
+	// Required to be unique.
+	// Additionally, the key must not contain an equals sign ("=").
+	// +required
+	Key string `json:"key"`
+
+	// valueExpression is a CEL expression to extract extra attribute value.
+	// valueExpression must produce a string or string array value.
+	// "", [], and null values are treated as the extra mapping not being present.
+	// Empty string values contained within a string array are filtered out.
+	//
+	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
+	// - 'claims' is a map of claim names to claim values.
+	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
+	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+	//
+	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+	//
+	// +required
+	ValueExpression string `json:"valueExpression"`
 }
 
 // JWTAuthenticator describes the configuration of a JWT authenticator.
@@ -86,14 +295,14 @@ type JWTAuthenticator struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	// Spec for configuring the authenticator.
+	// spec for configuring the authenticator.
 	Spec JWTAuthenticatorSpec `json:"spec"`
 
-	// Status of the authenticator.
+	// status of the authenticator.
 	Status JWTAuthenticatorStatus `json:"status,omitempty"`
 }
 
-// List of JWTAuthenticator objects.
+// JWTAuthenticatorList is a list of JWTAuthenticator objects.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type JWTAuthenticatorList struct {
 	metav1.TypeMeta `json:",inline"`

apis/concierge/identity/v1alpha1/doc.go.tmpl

@@ -5,6 +5,7 @@
 // +k8s:deepcopy-gen=package
 // +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/identity
 // +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=dev.pinniped.apis.concierge.identity.v1alpha1
 // +groupName=identity.concierge.pinniped.dev
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped identity API.

apis/concierge/login/v1alpha1/doc.go.tmpl

@@ -5,6 +5,7 @@
 // +k8s:deepcopy-gen=package
 // +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/concierge/login
 // +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=dev.pinniped.apis.concierge.login.v1alpha1
 // +groupName=login.concierge.pinniped.dev
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped login API.

apis/supervisor/clientsecret/v1alpha1/doc.go.tmpl

@@ -5,6 +5,7 @@
 // +k8s:deepcopy-gen=package
 // +k8s:conversion-gen=go.pinniped.dev/GENERATED_PKG/apis/supervisor/clientsecret
 // +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=dev.pinniped.apis.supervisor.clientsecret.v1alpha1
 // +groupName=clientsecret.supervisor.pinniped.dev
 
 // Package v1alpha1 is the v1alpha1 version of the Pinniped client secret API.

cmd/pinniped/cmd/kubeconfig_test.go

@@ -19,7 +19,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/kubernetes/fake"
+	kubefake "k8s.io/client-go/kubernetes/fake"
 	kubetesting "k8s.io/client-go/testing"
 	"k8s.io/client-go/tools/clientcmd"
 	v1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
@@ -1246,7 +1246,7 @@ func TestGetKubeconfig(t *testing.T) {
 			wantError: true,
 			wantStderr: func(issuerCABundle string, issuerURL string) testutil.RequireErrorStringFunc {
 				return testutil.WantSprintfErrorString(
-					"Error: while fetching OIDC discovery data from issuer: oidc: issuer did not match the issuer returned by provider, expected \"%s\" got \"https://wrong-issuer.com\"\n",
+					"Error: while fetching OIDC discovery data from issuer: oidc: issuer URL provided to client (\"%s\") did not match the issuer URL returned by provider (\"https://wrong-issuer.com\")\n",
 					issuerURL)
 			},
 		},
@@ -1749,7 +1749,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -1819,7 +1818,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -1883,7 +1881,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -1950,7 +1947,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2033,7 +2029,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2116,7 +2111,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2201,7 +2195,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2281,7 +2274,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-sso
 					current-context: kind-context-sso
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-sso
 					  user:
@@ -2400,7 +2392,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2509,7 +2500,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2586,7 +2576,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2665,7 +2654,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2742,7 +2730,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2815,7 +2802,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2895,7 +2881,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -2982,7 +2967,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3070,7 +3054,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3158,7 +3141,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3236,7 +3218,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3319,7 +3300,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3385,7 +3365,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3446,7 +3425,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3507,7 +3485,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3569,7 +3546,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3631,7 +3607,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3692,7 +3667,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3752,7 +3726,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3818,7 +3791,6 @@ func TestGetKubeconfig(t *testing.T) {
 					  name: kind-context-pinniped
 					current-context: kind-context-pinniped
 					kind: Config
-					preferences: {}
 					users:
 					- name: kind-user-pinniped
 					  user:
@@ -3886,14 +3858,17 @@ func TestGetKubeconfig(t *testing.T) {
 				if tt.getClientsetErr != nil {
 					return nil, nil, nil, tt.getClientsetErr
 				}
+				//nolint:staticcheck // as of v0.35.0, this package does not offer a NewClientset() function
 				fakeAggregatorClient := aggregatorfake.NewSimpleClientset(tt.apiServiceObjects...)
-				fakeKubeClient := fake.NewClientset()
+				fakeKubeClient := kubefake.NewClientset()
 				if tt.kubeObjects != nil {
 					kubeObjects := tt.kubeObjects(string(testServerCA))
-					fakeKubeClient = fake.NewClientset(kubeObjects...)
+					fakeKubeClient = kubefake.NewClientset(kubeObjects...)
 				}
+				//nolint:staticcheck // our codegen does not yet generate a NewClientset() function
 				fakeConciergeClient := conciergefake.NewSimpleClientset()
 				if tt.conciergeObjects != nil {
+					//nolint:staticcheck // our codegen does not yet generate a NewClientset() function
 					fakeConciergeClient = conciergefake.NewSimpleClientset(tt.conciergeObjects(string(testServerCA), testServer.URL)...)
 				}
 				if len(tt.conciergeReactions) > 0 {

cmd/pinniped/cmd/whoami_test.go

@@ -130,9 +130,7 @@ func TestWhoami(t *testing.T) {
 				{
 				  "kind": "WhoAmIRequest",
 				  "apiVersion": "identity.concierge.pinniped.dev/v1alpha1",
-				  "metadata": {
-				    "creationTimestamp": null
-				  },
+				  "metadata": {},
 				  "spec": {},
 				  "status": {
 				    "kubernetesUserInfo": {
@@ -154,9 +152,7 @@ func TestWhoami(t *testing.T) {
 				{
 				  "kind": "WhoAmIRequest",
 				  "apiVersion": "identity.concierge.tuna.io/v1alpha1",
-				  "metadata": {
-				    "creationTimestamp": null
-				  },
+				  "metadata": {},
 				  "spec": {},
 				  "status": {
 				    "kubernetesUserInfo": {
@@ -177,8 +173,7 @@ func TestWhoami(t *testing.T) {
 			wantStdout: here.Doc(`
 				apiVersion: identity.concierge.pinniped.dev/v1alpha1
 				kind: WhoAmIRequest
-				metadata:
-				  creationTimestamp: null
+				metadata: {}
 				spec: {}
 				status:
 				  kubernetesUserInfo:
@@ -195,8 +190,7 @@ func TestWhoami(t *testing.T) {
 			wantStdout: here.Doc(`
 				apiVersion: identity.concierge.tuna.io/v1alpha1
 				kind: WhoAmIRequest
-				metadata:
-				  creationTimestamp: null
+				metadata: {}
 				spec: {}
 				status:
 				  kubernetesUserInfo:
@@ -299,6 +293,7 @@ func TestWhoami(t *testing.T) {
 				if test.gettingClientsetErr != nil {
 					return nil, nil, nil, test.gettingClientsetErr
 				}
+				//nolint:staticcheck // our codegen does not yet generate a NewClientset() function
 				conciergeClient := conciergefake.NewSimpleClientset()
 				conciergeClient.PrependReactor("create", "whoamirequests", func(_ kubetesting.Action) (bool, runtime.Object, error) {
 					if test.callingAPIErr != nil {

deploy/concierge/authentication.concierge.pinniped.dev_jwtauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: jwtauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev
@@ -58,37 +58,219 @@ spec:
           metadata:
             type: object
           spec:
-            description: Spec for configuring the authenticator.
+            description: spec for configuring the authenticator.
             properties:
               audience:
-                description: Audience is the required value of the "aud" JWT claim.
+                description: audience is the required value of the "aud" JWT claim.
                 minLength: 1
                 type: string
+              claimValidationRules:
+                description: |-
+                  claimValidationRules are rules that are applied to validate token claims to authenticate users.
+                  This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
+                  https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+                  This is an advanced configuration option. During an end-user login flow, mistakes in this
+                  configuration will cause the user's login to fail.
+                items:
+                  description: ClaimValidationRule provides the configuration for
+                    a single claim validation rule.
+                  properties:
+                    claim:
+                      description: |-
+                        claim is the name of a required claim.
+                        Only string claim keys are supported.
+                        Mutually exclusive with expression and message.
+                      type: string
+                    expression:
+                      description: |-
+                        expression represents the expression which will be evaluated by CEL.
+                        Must produce a boolean.
+
+                        CEL expressions have access to the contents of the token claims, organized into CEL variable:
+                        - 'claims' is a map of claim names to claim values.
+                          For example, a variable named 'sub' can be accessed as 'claims.sub'.
+                          Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+                        Must return true for the validation to pass.
+
+                        Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+
+                        Mutually exclusive with claim and requiredValue.
+                      type: string
+                    message:
+                      description: |-
+                        message customizes the returned error message when expression returns false.
+                        message is a literal string.
+                        Mutually exclusive with claim and requiredValue.
+                      type: string
+                    requiredValue:
+                      description: |-
+                        requiredValue is the value of a required claim.
+                        Only string claim values are supported.
+                        If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string.
+                        Mutually exclusive with expression and message.
+                      type: string
+                  type: object
+                type: array
               claims:
                 description: |-
-                  Claims allows customization of the claims that will be mapped to user identity
+                  claims allows customization of the claims that will be mapped to user identity
                   for Kubernetes access.
                 properties:
+                  extra:
+                    description: |-
+                      extra is similar to claimMappings.extra from Kubernetes AuthenticationConfiguration
+                      as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+
+                      However, note that the Pinniped Concierge issues client certificates to users for the purpose
+                      of authenticating, and the Kubernetes API server does not have any mechanism for transmitting
+                      auth extras via client certificates. When configured, these extras will appear in client
+                      certificates issued by the Pinniped Supervisor in the x509 Subject field as Organizational
+                      Units (OU). However, when this client certificate is presented to Kubernetes for authentication,
+                      Kubernetes will ignore these extras. This is probably only useful if you are using a custom
+                      authenticating proxy in front of your Kubernetes API server which can translate these OUs into
+                      auth extras, as described by
+                      https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy.
+                      This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+                      must evaluate to either a string or an array of strings, or else the user's login will fail.
+
+                      These keys must be a domain-prefixed path (such as "acme.io/foo") and must not contain an equals sign ("=").
+
+                      expression must produce a string or string array value.
+                      If the value is empty, the extra mapping will not be present.
+
+                      Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+
+                      hard-coded extra key/value
+                      - key: "acme.io/foo"
+                        valueExpression: "'bar'"
+                      This will result in an extra attribute - acme.io/foo: ["bar"]
+
+                      hard-coded key, value copying claim value
+                      - key: "acme.io/foo"
+                        valueExpression: "claims.some_claim"
+                      This will result in an extra attribute - acme.io/foo: [value of some_claim]
+
+                      hard-coded key, value derived from claim value
+                      - key: "acme.io/admin"
+                        valueExpression: '(has(claims.is_admin) && claims.is_admin) ? "true":""'
+                      This will result in:
+                       - if is_admin claim is present and true, extra attribute - acme.io/admin: ["true"]
+                       - if is_admin claim is present and false or is_admin claim is not present, no extra attribute will be added
+                    items:
+                      description: ExtraMapping provides the configuration for a single
+                        extra mapping.
+                      properties:
+                        key:
+                          description: |-
+                            key is a string to use as the extra attribute key.
+                            key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid
+                            subdomain as defined by RFC 1123. All characters trailing the first "/" must
+                            be valid HTTP Path characters as defined by RFC 3986.
+                            key must be lowercase.
+                            Required to be unique.
+                            Additionally, the key must not contain an equals sign ("=").
+                          type: string
+                        valueExpression:
+                          description: |-
+                            valueExpression is a CEL expression to extract extra attribute value.
+                            valueExpression must produce a string or string array value.
+                            "", [], and null values are treated as the extra mapping not being present.
+                            Empty string values contained within a string array are filtered out.
+
+                            CEL expressions have access to the contents of the token claims, organized into CEL variable:
+                            - 'claims' is a map of claim names to claim values.
+                              For example, a variable named 'sub' can be accessed as 'claims.sub'.
+                              Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+
+                            Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+                          type: string
+                      required:
+                      - key
+                      - valueExpression
+                      type: object
+                    type: array
                   groups:
                     description: |-
-                      Groups is the name of the claim which should be read to extract the user's
-                      group membership from the JWT token. When not specified, it will default to "groups".
+                      groups is the name of the claim which should be read to extract the user's
+                      group membership from the JWT token. When not specified, it will default to "groups",
+                      unless groupsExpression is specified.
+
+                      Mutually exclusive with groupsExpression. Use either groups or groupsExpression to
+                      determine the user's group membership from the JWT token.
+                    type: string
+                  groupsExpression:
+                    description: |-
+                      groupsExpression represents an expression which will be evaluated by CEL.
+                      The expression's result will become the user's group memberships.
+
+                      groupsExpression is similar to claimMappings.groups.expression from Kubernetes AuthenticationConfiguration
+                      as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+                      This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+                      must evaluate to one of the expected types without errors, or else the user's login will fail.
+                      Additionally, mistakes in this configuration can cause the users to have unintended group memberships.
+
+                      The expression must produce a string or string array value.
+                       "", [], and null values are treated as the group mapping not being present.
+
+                      CEL expressions have access to the contents of the token claims, organized into CEL variable:
+                      - 'claims' is a map of claim names to claim values.
+                        For example, a variable named 'sub' can be accessed as 'claims.sub'.
+                        Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+
+                      Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+
+                      Mutually exclusive with groups. Use either groups or groupsExpression to
+                      determine the user's group membership from the JWT token.
                     type: string
                   username:
                     description: |-
-                      Username is the name of the claim which should be read to extract the
-                      username from the JWT token. When not specified, it will default to "username".
+                      username is the name of the claim which should be read to extract the
+                      username from the JWT token. When not specified, it will default to "username",
+                      unless usernameExpression is specified.
+
+                      Mutually exclusive with usernameExpression. Use either username or usernameExpression to
+                      determine the user's username from the JWT token.
+                    type: string
+                  usernameExpression:
+                    description: |-
+                      usernameExpression represents an expression which will be evaluated by CEL.
+                      The expression's result will become the user's username.
+
+                      usernameExpression is similar to claimMappings.username.expression from Kubernetes AuthenticationConfiguration
+                      as documented in https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+                      This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
+                      must evaluate to the expected type without errors, or else the user's login will fail.
+                      Additionally, mistakes in this configuration can cause the users to have unintended usernames.
+
+                      The expression must produce a non-empty string value.
+                      If the expression uses 'claims.email', then 'claims.email_verified' must be used in
+                      the expression or extra[*].valueExpression or claimValidationRules[*].expression.
+                      An example claim validation rule expression that matches the validation automatically
+                      applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'.
+                      By explicitly comparing the value to true, we let type-checking see the result will be a boolean,
+                      and to make sure a non-boolean email_verified claim will be caught at runtime.
+
+                      CEL expressions have access to the contents of the token claims, organized into CEL variable:
+                      - 'claims' is a map of claim names to claim values.
+                        For example, a variable named 'sub' can be accessed as 'claims.sub'.
+                        Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
+
+                      Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+
+                      Mutually exclusive with username. Use either username or usernameExpression to
+                      determine the user's username from the JWT token.
                     type: string
                 type: object
               issuer:
                 description: |-
-                  Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
+                  issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
                   also used to validate the "iss" JWT claim.
                 minLength: 1
                 pattern: ^https://
                 type: string
               tls:
-                description: TLS configuration for communicating with the OIDC provider.
+                description: tls is the configuration for communicating with the OIDC
+                  provider via TLS.
                 properties:
                   certificateAuthorityData:
                     description: X.509 Certificate Authority (base64-encoded PEM bundle).
@@ -128,12 +310,47 @@ spec:
                     - name
                     type: object
                 type: object
+              userValidationRules:
+                description: |-
+                  userValidationRules are rules that are applied to final user before completing authentication.
+                  These allow invariants to be applied to incoming identities such as preventing the
+                  use of the system: prefix that is commonly used by Kubernetes components.
+                  The validation rules are logically ANDed together and must all return true for the validation to pass.
+                  This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
+                  https://kubernetes.io/docs/reference/access-authn-authz/authentication.
+                  This is an advanced configuration option. During an end-user login flow, mistakes in this
+                  configuration will cause the user's login to fail.
+                items:
+                  description: UserValidationRule provides the configuration for a
+                    single user info validation rule.
+                  properties:
+                    expression:
+                      description: |-
+                        expression represents the expression which will be evaluated by CEL.
+                        Must return true for the validation to pass.
+
+                        CEL expressions have access to the contents of UserInfo, organized into CEL variable:
+                        - 'user' - authentication.k8s.io/v1, Kind=UserInfo object
+                           Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition.
+                           API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io
+
+                        Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
+                      type: string
+                    message:
+                      description: |-
+                        message customizes the returned error message when rule returns false.
+                        message is a literal string.
+                      type: string
+                  required:
+                  - expression
+                  type: object
+                type: array
             required:
             - audience
             - issuer
             type: object
           status:
-            description: Status of the authenticator.
+            description: status of the authenticator.
             properties:
               conditions:
                 description: Represents the observations of the authenticator's current

deploy/concierge/authentication.concierge.pinniped.dev_webhookauthenticators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: webhookauthenticators.authentication.concierge.pinniped.dev
 spec:
   group: authentication.concierge.pinniped.dev

deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: credentialissuers.config.concierge.pinniped.dev
 spec:
   group: config.concierge.pinniped.dev

deploy/concierge/values.yaml

@@ -52,7 +52,7 @@ replicas: 2
 #@schema/title "Image repo"
 #@schema/desc "The repository for the Concierge container image."
 #@schema/validation min_len=1
-image_repo: ghcr.io/vmware-tanzu/pinniped/pinniped-server
+image_repo: ghcr.io/vmware/pinniped/pinniped-server
 
 #@schema/title "Image digest"
 #@schema/desc "The image digest for the Concierge container image. If both image_digest or an image_tag are given, only image_digest will be used."
@@ -72,7 +72,7 @@ image_tag: latest
 #@ on the control plane. This image needs only to include `sleep` and `cat` binaries. \
 #@ By default, the same image specified for image_repo/image_digest/image_tag will be re-used."
 #@schema/desc kube_cert_agent_image_desc
-#@schema/examples ("Image including tag or digest", "ghcr.io/vmware-tanzu/pinniped/pinniped-server:latest")
+#@schema/examples ("Image including tag or digest", "ghcr.io/vmware/pinniped/pinniped-server:latest")
 #@schema/nullable
 #@schema/validation min_len=1
 kube_cert_agent_image: ""

deploy/local-user-authenticator/README.md

@@ -20,7 +20,7 @@ kubectl apply -f https://get.pinniped.dev/latest/install-local-user-authenticato
 
 ## Installing a Specific Version with Default Options
 
-Choose your preferred [release](https://github.com/vmware-tanzu/pinniped/releases) version number
+Choose your preferred [release](https://github.com/vmware/pinniped/releases) version number
 and use it to replace the version number in the URL below.
 
 ```bash

deploy/local-user-authenticator/values.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@data/values-schema
@@ -6,7 +6,7 @@
 #@schema/title "Image repo"
 #@schema/desc "The repository for the local-user-authenticator container image."
 #@schema/validation min_len=1
-image_repo: ghcr.io/vmware-tanzu/pinniped/pinniped-server
+image_repo: ghcr.io/vmware/pinniped/pinniped-server
 
 #@schema/title "Image digest"
 #@schema/desc "The image digest for the local-user-authenticator container image. If both image_digest or an image_tag are given, only image_digest will be used."

deploy/supervisor/config.supervisor.pinniped.dev_federationdomains.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: federationdomains.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev

deploy/supervisor/config.supervisor.pinniped.dev_oidcclients.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: oidcclients.config.supervisor.pinniped.dev
 spec:
   group: config.supervisor.pinniped.dev

deploy/supervisor/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: activedirectoryidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

deploy/supervisor/idp.supervisor.pinniped.dev_githubidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: githubidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

deploy/supervisor/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: ldapidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

deploy/supervisor/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: oidcidentityproviders.idp.supervisor.pinniped.dev
 spec:
   group: idp.supervisor.pinniped.dev

deploy/supervisor/values.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ def validate_strings_map(obj):
@@ -52,7 +52,7 @@ replicas: 2
 #@schema/title "Image repo"
 #@schema/desc "The repository for the Supervisor container image."
 #@schema/validation min_len=1
-image_repo: ghcr.io/vmware-tanzu/pinniped/pinniped-server
+image_repo: ghcr.io/vmware/pinniped/pinniped-server
 
 #@schema/title "Image digest"
 #@schema/desc "The image digest for the Supervisor container image. If both image_digest or an image_tag are given, only image_digest will be used."

generated/1.26/apis/concierge/authentication/v1alpha1/types_jwtauthenticator.go

@@ -1,103 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-type JWTAuthenticatorPhase string
-
-const (
-	// JWTAuthenticatorPhasePending is the default phase for newly-created JWTAuthenticator resources.
-	JWTAuthenticatorPhasePending JWTAuthenticatorPhase = "Pending"
-
-	// JWTAuthenticatorPhaseReady is the phase for an JWTAuthenticator resource in a healthy state.
-	JWTAuthenticatorPhaseReady JWTAuthenticatorPhase = "Ready"
-
-	// JWTAuthenticatorPhaseError is the phase for an JWTAuthenticator in an unhealthy state.
-	JWTAuthenticatorPhaseError JWTAuthenticatorPhase = "Error"
-)
-
-// Status of a JWT authenticator.
-type JWTAuthenticatorStatus struct {
-	// Represents the observations of the authenticator's current state.
-	// +patchMergeKey=type
-	// +patchStrategy=merge
-	// +listType=map
-	// +listMapKey=type
-	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
-	// Phase summarizes the overall status of the JWTAuthenticator.
-	// +kubebuilder:default=Pending
-	// +kubebuilder:validation:Enum=Pending;Ready;Error
-	Phase JWTAuthenticatorPhase `json:"phase,omitempty"`
-}
-
-// Spec for configuring a JWT authenticator.
-type JWTAuthenticatorSpec struct {
-	// Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
-	// also used to validate the "iss" JWT claim.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:Pattern=`^https://`
-	Issuer string `json:"issuer"`
-
-	// Audience is the required value of the "aud" JWT claim.
-	// +kubebuilder:validation:MinLength=1
-	Audience string `json:"audience"`
-
-	// Claims allows customization of the claims that will be mapped to user identity
-	// for Kubernetes access.
-	// +optional
-	Claims JWTTokenClaims `json:"claims"`
-
-	// TLS configuration for communicating with the OIDC provider.
-	// +optional
-	TLS *TLSSpec `json:"tls,omitempty"`
-}
-
-// JWTTokenClaims allows customization of the claims that will be mapped to user identity
-// for Kubernetes access.
-type JWTTokenClaims struct {
-	// Groups is the name of the claim which should be read to extract the user's
-	// group membership from the JWT token. When not specified, it will default to "groups".
-	// +optional
-	Groups string `json:"groups"`
-
-	// Username is the name of the claim which should be read to extract the
-	// username from the JWT token. When not specified, it will default to "username".
-	// +optional
-	Username string `json:"username"`
-}
-
-// JWTAuthenticator describes the configuration of a JWT authenticator.
-//
-// Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
-// signature, existence of claims, etc.) and extract the username and groups from the token.
-//
-// +genclient
-// +genclient:nonNamespaced
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
-// +kubebuilder:printcolumn:name="Issuer",type=string,JSONPath=`.spec.issuer`
-// +kubebuilder:printcolumn:name="Audience",type=string,JSONPath=`.spec.audience`
-// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
-// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
-// +kubebuilder:subresource:status
-type JWTAuthenticator struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	// Spec for configuring the authenticator.
-	Spec JWTAuthenticatorSpec `json:"spec"`
-
-	// Status of the authenticator.
-	Status JWTAuthenticatorStatus `json:"status,omitempty"`
-}
-
-// List of JWTAuthenticator objects.
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type JWTAuthenticatorList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []JWTAuthenticator `json:"items"`
-}

generated/1.26/apis/concierge/authentication/v1alpha1/zz_generated.deepcopy.go

@@ -1,278 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by deepcopy-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertificateAuthorityDataSourceSpec) DeepCopyInto(out *CertificateAuthorityDataSourceSpec) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateAuthorityDataSourceSpec.
-func (in *CertificateAuthorityDataSourceSpec) DeepCopy() *CertificateAuthorityDataSourceSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(CertificateAuthorityDataSourceSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTAuthenticator) DeepCopyInto(out *JWTAuthenticator) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticator.
-func (in *JWTAuthenticator) DeepCopy() *JWTAuthenticator {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTAuthenticator)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *JWTAuthenticator) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTAuthenticatorList) DeepCopyInto(out *JWTAuthenticatorList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]JWTAuthenticator, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorList.
-func (in *JWTAuthenticatorList) DeepCopy() *JWTAuthenticatorList {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTAuthenticatorList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *JWTAuthenticatorList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTAuthenticatorSpec) DeepCopyInto(out *JWTAuthenticatorSpec) {
-	*out = *in
-	out.Claims = in.Claims
-	if in.TLS != nil {
-		in, out := &in.TLS, &out.TLS
-		*out = new(TLSSpec)
-		(*in).DeepCopyInto(*out)
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorSpec.
-func (in *JWTAuthenticatorSpec) DeepCopy() *JWTAuthenticatorSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTAuthenticatorSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTAuthenticatorStatus) DeepCopyInto(out *JWTAuthenticatorStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticatorStatus.
-func (in *JWTAuthenticatorStatus) DeepCopy() *JWTAuthenticatorStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTAuthenticatorStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JWTTokenClaims) DeepCopyInto(out *JWTTokenClaims) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTTokenClaims.
-func (in *JWTTokenClaims) DeepCopy() *JWTTokenClaims {
-	if in == nil {
-		return nil
-	}
-	out := new(JWTTokenClaims)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TLSSpec) DeepCopyInto(out *TLSSpec) {
-	*out = *in
-	if in.CertificateAuthorityDataSource != nil {
-		in, out := &in.CertificateAuthorityDataSource, &out.CertificateAuthorityDataSource
-		*out = new(CertificateAuthorityDataSourceSpec)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSSpec.
-func (in *TLSSpec) DeepCopy() *TLSSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(TLSSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WebhookAuthenticator) DeepCopyInto(out *WebhookAuthenticator) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookAuthenticator.
-func (in *WebhookAuthenticator) DeepCopy() *WebhookAuthenticator {
-	if in == nil {
-		return nil
-	}
-	out := new(WebhookAuthenticator)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *WebhookAuthenticator) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WebhookAuthenticatorList) DeepCopyInto(out *WebhookAuthenticatorList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]WebhookAuthenticator, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookAuthenticatorList.
-func (in *WebhookAuthenticatorList) DeepCopy() *WebhookAuthenticatorList {
-	if in == nil {
-		return nil
-	}
-	out := new(WebhookAuthenticatorList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *WebhookAuthenticatorList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WebhookAuthenticatorSpec) DeepCopyInto(out *WebhookAuthenticatorSpec) {
-	*out = *in
-	if in.TLS != nil {
-		in, out := &in.TLS, &out.TLS
-		*out = new(TLSSpec)
-		(*in).DeepCopyInto(*out)
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookAuthenticatorSpec.
-func (in *WebhookAuthenticatorSpec) DeepCopy() *WebhookAuthenticatorSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(WebhookAuthenticatorSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WebhookAuthenticatorStatus) DeepCopyInto(out *WebhookAuthenticatorStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookAuthenticatorStatus.
-func (in *WebhookAuthenticatorStatus) DeepCopy() *WebhookAuthenticatorStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(WebhookAuthenticatorStatus)
-	in.DeepCopyInto(out)
-	return out
-}

generated/1.26/apis/concierge/identity/v1alpha1/doc.go

@@ -1,11 +0,0 @@
-// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:openapi-gen=true
-// +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/generated/1.26/apis/concierge/identity
-// +k8s:defaulter-gen=TypeMeta
-// +groupName=identity.concierge.pinniped.dev
-
-// Package v1alpha1 is the v1alpha1 version of the Pinniped identity API.
-package v1alpha1

generated/1.26/apis/go.mod

@@ -1,9 +0,0 @@
-// This go.mod file is generated by ./hack/update.sh.
-module go.pinniped.dev/generated/1.26/apis
-
-go 1.13
-
-require (
-	k8s.io/api v0.26.15
-	k8s.io/apimachinery v0.26.15
-)

generated/1.26/apis/go.sum

@@ -1,300 +0,0 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
-github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
-github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
-github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
-github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
-github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
-github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
-github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
-github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8AyFNU9d0=
-github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
-github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
-github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
-github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
-github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
-github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
-github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.26.15 h1:tjMERUjIwkq+2UtPZL5ZbSsLkpxUv4gXWZfV5lQl+Og=
-k8s.io/api v0.26.15/go.mod h1:CtWOrFl8VLCTLolRlhbBxo4fy83tjCLEtYa5pMubIe0=
-k8s.io/apimachinery v0.26.15 h1:GPxeERYBSqSZlj3xIkX4L6mBjzZ9q8JPnJ+Vj15qe+g=
-k8s.io/apimachinery v0.26.15/go.mod h1:O/uIhIOWuy6ndHqQ6qbkjD7OgeMhVtlk8+Z66ZcmJQc=
-k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
-k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
-k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
-k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20221107191617-1a15be271d1d h1:0Smp/HP1OH4Rvhe+4B8nWGERtlqAGSftbSbbmm45oFs=
-k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=

generated/1.26/apis/supervisor/clientsecret/v1alpha1/doc.go

@@ -1,11 +0,0 @@
-// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// +k8s:openapi-gen=true
-// +k8s:deepcopy-gen=package
-// +k8s:conversion-gen=go.pinniped.dev/generated/1.26/apis/supervisor/clientsecret
-// +k8s:defaulter-gen=TypeMeta
-// +groupName=clientsecret.supervisor.pinniped.dev
-
-// Package v1alpha1 is the v1alpha1 version of the Pinniped client secret API.
-package v1alpha1

generated/1.26/apis/supervisor/clientsecret/v1alpha1/zz_generated.conversion.go

@@ -1,165 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by conversion-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	unsafe "unsafe"
-
-	clientsecret "go.pinniped.dev/generated/1.26/apis/supervisor/clientsecret"
-	conversion "k8s.io/apimachinery/pkg/conversion"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	localSchemeBuilder.Register(RegisterConversions)
-}
-
-// RegisterConversions adds conversion functions to the given scheme.
-// Public to allow building arbitrary schemes.
-func RegisterConversions(s *runtime.Scheme) error {
-	if err := s.AddGeneratedConversionFunc((*OIDCClientSecretRequest)(nil), (*clientsecret.OIDCClientSecretRequest)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_OIDCClientSecretRequest_To_clientsecret_OIDCClientSecretRequest(a.(*OIDCClientSecretRequest), b.(*clientsecret.OIDCClientSecretRequest), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*clientsecret.OIDCClientSecretRequest)(nil), (*OIDCClientSecretRequest)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_clientsecret_OIDCClientSecretRequest_To_v1alpha1_OIDCClientSecretRequest(a.(*clientsecret.OIDCClientSecretRequest), b.(*OIDCClientSecretRequest), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*OIDCClientSecretRequestList)(nil), (*clientsecret.OIDCClientSecretRequestList)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_OIDCClientSecretRequestList_To_clientsecret_OIDCClientSecretRequestList(a.(*OIDCClientSecretRequestList), b.(*clientsecret.OIDCClientSecretRequestList), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*clientsecret.OIDCClientSecretRequestList)(nil), (*OIDCClientSecretRequestList)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_clientsecret_OIDCClientSecretRequestList_To_v1alpha1_OIDCClientSecretRequestList(a.(*clientsecret.OIDCClientSecretRequestList), b.(*OIDCClientSecretRequestList), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*OIDCClientSecretRequestSpec)(nil), (*clientsecret.OIDCClientSecretRequestSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_OIDCClientSecretRequestSpec_To_clientsecret_OIDCClientSecretRequestSpec(a.(*OIDCClientSecretRequestSpec), b.(*clientsecret.OIDCClientSecretRequestSpec), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*clientsecret.OIDCClientSecretRequestSpec)(nil), (*OIDCClientSecretRequestSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_clientsecret_OIDCClientSecretRequestSpec_To_v1alpha1_OIDCClientSecretRequestSpec(a.(*clientsecret.OIDCClientSecretRequestSpec), b.(*OIDCClientSecretRequestSpec), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*OIDCClientSecretRequestStatus)(nil), (*clientsecret.OIDCClientSecretRequestStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_OIDCClientSecretRequestStatus_To_clientsecret_OIDCClientSecretRequestStatus(a.(*OIDCClientSecretRequestStatus), b.(*clientsecret.OIDCClientSecretRequestStatus), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*clientsecret.OIDCClientSecretRequestStatus)(nil), (*OIDCClientSecretRequestStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_clientsecret_OIDCClientSecretRequestStatus_To_v1alpha1_OIDCClientSecretRequestStatus(a.(*clientsecret.OIDCClientSecretRequestStatus), b.(*OIDCClientSecretRequestStatus), scope)
-	}); err != nil {
-		return err
-	}
-	return nil
-}
-
-func autoConvert_v1alpha1_OIDCClientSecretRequest_To_clientsecret_OIDCClientSecretRequest(in *OIDCClientSecretRequest, out *clientsecret.OIDCClientSecretRequest, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
-	if err := Convert_v1alpha1_OIDCClientSecretRequestSpec_To_clientsecret_OIDCClientSecretRequestSpec(&in.Spec, &out.Spec, s); err != nil {
-		return err
-	}
-	if err := Convert_v1alpha1_OIDCClientSecretRequestStatus_To_clientsecret_OIDCClientSecretRequestStatus(&in.Status, &out.Status, s); err != nil {
-		return err
-	}
-	return nil
-}
-
-// Convert_v1alpha1_OIDCClientSecretRequest_To_clientsecret_OIDCClientSecretRequest is an autogenerated conversion function.
-func Convert_v1alpha1_OIDCClientSecretRequest_To_clientsecret_OIDCClientSecretRequest(in *OIDCClientSecretRequest, out *clientsecret.OIDCClientSecretRequest, s conversion.Scope) error {
-	return autoConvert_v1alpha1_OIDCClientSecretRequest_To_clientsecret_OIDCClientSecretRequest(in, out, s)
-}
-
-func autoConvert_clientsecret_OIDCClientSecretRequest_To_v1alpha1_OIDCClientSecretRequest(in *clientsecret.OIDCClientSecretRequest, out *OIDCClientSecretRequest, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
-	if err := Convert_clientsecret_OIDCClientSecretRequestSpec_To_v1alpha1_OIDCClientSecretRequestSpec(&in.Spec, &out.Spec, s); err != nil {
-		return err
-	}
-	if err := Convert_clientsecret_OIDCClientSecretRequestStatus_To_v1alpha1_OIDCClientSecretRequestStatus(&in.Status, &out.Status, s); err != nil {
-		return err
-	}
-	return nil
-}
-
-// Convert_clientsecret_OIDCClientSecretRequest_To_v1alpha1_OIDCClientSecretRequest is an autogenerated conversion function.
-func Convert_clientsecret_OIDCClientSecretRequest_To_v1alpha1_OIDCClientSecretRequest(in *clientsecret.OIDCClientSecretRequest, out *OIDCClientSecretRequest, s conversion.Scope) error {
-	return autoConvert_clientsecret_OIDCClientSecretRequest_To_v1alpha1_OIDCClientSecretRequest(in, out, s)
-}
-
-func autoConvert_v1alpha1_OIDCClientSecretRequestList_To_clientsecret_OIDCClientSecretRequestList(in *OIDCClientSecretRequestList, out *clientsecret.OIDCClientSecretRequestList, s conversion.Scope) error {
-	out.ListMeta = in.ListMeta
-	out.Items = *(*[]clientsecret.OIDCClientSecretRequest)(unsafe.Pointer(&in.Items))
-	return nil
-}
-
-// Convert_v1alpha1_OIDCClientSecretRequestList_To_clientsecret_OIDCClientSecretRequestList is an autogenerated conversion function.
-func Convert_v1alpha1_OIDCClientSecretRequestList_To_clientsecret_OIDCClientSecretRequestList(in *OIDCClientSecretRequestList, out *clientsecret.OIDCClientSecretRequestList, s conversion.Scope) error {
-	return autoConvert_v1alpha1_OIDCClientSecretRequestList_To_clientsecret_OIDCClientSecretRequestList(in, out, s)
-}
-
-func autoConvert_clientsecret_OIDCClientSecretRequestList_To_v1alpha1_OIDCClientSecretRequestList(in *clientsecret.OIDCClientSecretRequestList, out *OIDCClientSecretRequestList, s conversion.Scope) error {
-	out.ListMeta = in.ListMeta
-	out.Items = *(*[]OIDCClientSecretRequest)(unsafe.Pointer(&in.Items))
-	return nil
-}
-
-// Convert_clientsecret_OIDCClientSecretRequestList_To_v1alpha1_OIDCClientSecretRequestList is an autogenerated conversion function.
-func Convert_clientsecret_OIDCClientSecretRequestList_To_v1alpha1_OIDCClientSecretRequestList(in *clientsecret.OIDCClientSecretRequestList, out *OIDCClientSecretRequestList, s conversion.Scope) error {
-	return autoConvert_clientsecret_OIDCClientSecretRequestList_To_v1alpha1_OIDCClientSecretRequestList(in, out, s)
-}
-
-func autoConvert_v1alpha1_OIDCClientSecretRequestSpec_To_clientsecret_OIDCClientSecretRequestSpec(in *OIDCClientSecretRequestSpec, out *clientsecret.OIDCClientSecretRequestSpec, s conversion.Scope) error {
-	out.GenerateNewSecret = in.GenerateNewSecret
-	out.RevokeOldSecrets = in.RevokeOldSecrets
-	return nil
-}
-
-// Convert_v1alpha1_OIDCClientSecretRequestSpec_To_clientsecret_OIDCClientSecretRequestSpec is an autogenerated conversion function.
-func Convert_v1alpha1_OIDCClientSecretRequestSpec_To_clientsecret_OIDCClientSecretRequestSpec(in *OIDCClientSecretRequestSpec, out *clientsecret.OIDCClientSecretRequestSpec, s conversion.Scope) error {
-	return autoConvert_v1alpha1_OIDCClientSecretRequestSpec_To_clientsecret_OIDCClientSecretRequestSpec(in, out, s)
-}
-
-func autoConvert_clientsecret_OIDCClientSecretRequestSpec_To_v1alpha1_OIDCClientSecretRequestSpec(in *clientsecret.OIDCClientSecretRequestSpec, out *OIDCClientSecretRequestSpec, s conversion.Scope) error {
-	out.GenerateNewSecret = in.GenerateNewSecret
-	out.RevokeOldSecrets = in.RevokeOldSecrets
-	return nil
-}
-
-// Convert_clientsecret_OIDCClientSecretRequestSpec_To_v1alpha1_OIDCClientSecretRequestSpec is an autogenerated conversion function.
-func Convert_clientsecret_OIDCClientSecretRequestSpec_To_v1alpha1_OIDCClientSecretRequestSpec(in *clientsecret.OIDCClientSecretRequestSpec, out *OIDCClientSecretRequestSpec, s conversion.Scope) error {
-	return autoConvert_clientsecret_OIDCClientSecretRequestSpec_To_v1alpha1_OIDCClientSecretRequestSpec(in, out, s)
-}
-
-func autoConvert_v1alpha1_OIDCClientSecretRequestStatus_To_clientsecret_OIDCClientSecretRequestStatus(in *OIDCClientSecretRequestStatus, out *clientsecret.OIDCClientSecretRequestStatus, s conversion.Scope) error {
-	out.GeneratedSecret = in.GeneratedSecret
-	out.TotalClientSecrets = in.TotalClientSecrets
-	return nil
-}
-
-// Convert_v1alpha1_OIDCClientSecretRequestStatus_To_clientsecret_OIDCClientSecretRequestStatus is an autogenerated conversion function.
-func Convert_v1alpha1_OIDCClientSecretRequestStatus_To_clientsecret_OIDCClientSecretRequestStatus(in *OIDCClientSecretRequestStatus, out *clientsecret.OIDCClientSecretRequestStatus, s conversion.Scope) error {
-	return autoConvert_v1alpha1_OIDCClientSecretRequestStatus_To_clientsecret_OIDCClientSecretRequestStatus(in, out, s)
-}
-
-func autoConvert_clientsecret_OIDCClientSecretRequestStatus_To_v1alpha1_OIDCClientSecretRequestStatus(in *clientsecret.OIDCClientSecretRequestStatus, out *OIDCClientSecretRequestStatus, s conversion.Scope) error {
-	out.GeneratedSecret = in.GeneratedSecret
-	out.TotalClientSecrets = in.TotalClientSecrets
-	return nil
-}
-
-// Convert_clientsecret_OIDCClientSecretRequestStatus_To_v1alpha1_OIDCClientSecretRequestStatus is an autogenerated conversion function.
-func Convert_clientsecret_OIDCClientSecretRequestStatus_To_v1alpha1_OIDCClientSecretRequestStatus(in *clientsecret.OIDCClientSecretRequestStatus, out *OIDCClientSecretRequestStatus, s conversion.Scope) error {
-	return autoConvert_clientsecret_OIDCClientSecretRequestStatus_To_v1alpha1_OIDCClientSecretRequestStatus(in, out, s)
-}

generated/1.26/client/concierge/clientset/versioned/doc.go

@@ -1,7 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-// This package has the automatically generated clientset.
-package versioned

generated/1.26/client/concierge/clientset/versioned/fake/clientset_generated.go

@@ -1,93 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	clientset "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned"
-	authenticationv1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1"
-	fakeauthenticationv1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake"
-	configv1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/config/v1alpha1"
-	fakeconfigv1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/config/v1alpha1/fake"
-	identityv1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/identity/v1alpha1"
-	fakeidentityv1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/identity/v1alpha1/fake"
-	loginv1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/login/v1alpha1"
-	fakeloginv1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/login/v1alpha1/fake"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	"k8s.io/client-go/discovery"
-	fakediscovery "k8s.io/client-go/discovery/fake"
-	"k8s.io/client-go/testing"
-)
-
-// NewSimpleClientset returns a clientset that will respond with the provided objects.
-// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
-// without applying any validations and/or defaults. It shouldn't be considered a replacement
-// for a real clientset and is mostly useful in simple unit tests.
-func NewSimpleClientset(objects ...runtime.Object) *Clientset {
-	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
-	for _, obj := range objects {
-		if err := o.Add(obj); err != nil {
-			panic(err)
-		}
-	}
-
-	cs := &Clientset{tracker: o}
-	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
-	cs.AddReactor("*", "*", testing.ObjectReaction(o))
-	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
-		gvr := action.GetResource()
-		ns := action.GetNamespace()
-		watch, err := o.Watch(gvr, ns)
-		if err != nil {
-			return false, nil, err
-		}
-		return true, watch, nil
-	})
-
-	return cs
-}
-
-// Clientset implements clientset.Interface. Meant to be embedded into a
-// struct to get a default implementation. This makes faking out just the method
-// you want to test easier.
-type Clientset struct {
-	testing.Fake
-	discovery *fakediscovery.FakeDiscovery
-	tracker   testing.ObjectTracker
-}
-
-func (c *Clientset) Discovery() discovery.DiscoveryInterface {
-	return c.discovery
-}
-
-func (c *Clientset) Tracker() testing.ObjectTracker {
-	return c.tracker
-}
-
-var (
-	_ clientset.Interface = &Clientset{}
-	_ testing.FakeClient  = &Clientset{}
-)
-
-// AuthenticationV1alpha1 retrieves the AuthenticationV1alpha1Client
-func (c *Clientset) AuthenticationV1alpha1() authenticationv1alpha1.AuthenticationV1alpha1Interface {
-	return &fakeauthenticationv1alpha1.FakeAuthenticationV1alpha1{Fake: &c.Fake}
-}
-
-// ConfigV1alpha1 retrieves the ConfigV1alpha1Client
-func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface {
-	return &fakeconfigv1alpha1.FakeConfigV1alpha1{Fake: &c.Fake}
-}
-
-// IdentityV1alpha1 retrieves the IdentityV1alpha1Client
-func (c *Clientset) IdentityV1alpha1() identityv1alpha1.IdentityV1alpha1Interface {
-	return &fakeidentityv1alpha1.FakeIdentityV1alpha1{Fake: &c.Fake}
-}
-
-// LoginV1alpha1 retrieves the LoginV1alpha1Client
-func (c *Clientset) LoginV1alpha1() loginv1alpha1.LoginV1alpha1Interface {
-	return &fakeloginv1alpha1.FakeLoginV1alpha1{Fake: &c.Fake}
-}

generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1/authentication_client.go

@@ -1,99 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"net/http"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/authentication/v1alpha1"
-	"go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/scheme"
-	rest "k8s.io/client-go/rest"
-)
-
-type AuthenticationV1alpha1Interface interface {
-	RESTClient() rest.Interface
-	JWTAuthenticatorsGetter
-	WebhookAuthenticatorsGetter
-}
-
-// AuthenticationV1alpha1Client is used to interact with features provided by the authentication.concierge.pinniped.dev group.
-type AuthenticationV1alpha1Client struct {
-	restClient rest.Interface
-}
-
-func (c *AuthenticationV1alpha1Client) JWTAuthenticators() JWTAuthenticatorInterface {
-	return newJWTAuthenticators(c)
-}
-
-func (c *AuthenticationV1alpha1Client) WebhookAuthenticators() WebhookAuthenticatorInterface {
-	return newWebhookAuthenticators(c)
-}
-
-// NewForConfig creates a new AuthenticationV1alpha1Client for the given config.
-// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
-// where httpClient was generated with rest.HTTPClientFor(c).
-func NewForConfig(c *rest.Config) (*AuthenticationV1alpha1Client, error) {
-	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
-	httpClient, err := rest.HTTPClientFor(&config)
-	if err != nil {
-		return nil, err
-	}
-	return NewForConfigAndClient(&config, httpClient)
-}
-
-// NewForConfigAndClient creates a new AuthenticationV1alpha1Client for the given config and http client.
-// Note the http client provided takes precedence over the configured transport values.
-func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AuthenticationV1alpha1Client, error) {
-	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
-	client, err := rest.RESTClientForConfigAndClient(&config, h)
-	if err != nil {
-		return nil, err
-	}
-	return &AuthenticationV1alpha1Client{client}, nil
-}
-
-// NewForConfigOrDie creates a new AuthenticationV1alpha1Client for the given config and
-// panics if there is an error in the config.
-func NewForConfigOrDie(c *rest.Config) *AuthenticationV1alpha1Client {
-	client, err := NewForConfig(c)
-	if err != nil {
-		panic(err)
-	}
-	return client
-}
-
-// New creates a new AuthenticationV1alpha1Client for the given RESTClient.
-func New(c rest.Interface) *AuthenticationV1alpha1Client {
-	return &AuthenticationV1alpha1Client{c}
-}
-
-func setConfigDefaults(config *rest.Config) error {
-	gv := v1alpha1.SchemeGroupVersion
-	config.GroupVersion = &gv
-	config.APIPath = "/apis"
-	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
-
-	if config.UserAgent == "" {
-		config.UserAgent = rest.DefaultKubernetesUserAgent()
-	}
-
-	return nil
-}
-
-// RESTClient returns a RESTClient that is used to communicate
-// with API server by this client implementation.
-func (c *AuthenticationV1alpha1Client) RESTClient() rest.Interface {
-	if c == nil {
-		return nil
-	}
-	return c.restClient
-}

generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_authentication_client.go

@@ -1,31 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1"
-	rest "k8s.io/client-go/rest"
-	testing "k8s.io/client-go/testing"
-)
-
-type FakeAuthenticationV1alpha1 struct {
-	*testing.Fake
-}
-
-func (c *FakeAuthenticationV1alpha1) JWTAuthenticators() v1alpha1.JWTAuthenticatorInterface {
-	return &FakeJWTAuthenticators{c}
-}
-
-func (c *FakeAuthenticationV1alpha1) WebhookAuthenticators() v1alpha1.WebhookAuthenticatorInterface {
-	return &FakeWebhookAuthenticators{c}
-}
-
-// RESTClient returns a RESTClient that is used to communicate
-// with API server by this client implementation.
-func (c *FakeAuthenticationV1alpha1) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}

generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_jwtauthenticator.go

@@ -1,120 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/authentication/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeJWTAuthenticators implements JWTAuthenticatorInterface
-type FakeJWTAuthenticators struct {
-	Fake *FakeAuthenticationV1alpha1
-}
-
-var jwtauthenticatorsResource = schema.GroupVersionResource{Group: "authentication.concierge.pinniped.dev", Version: "v1alpha1", Resource: "jwtauthenticators"}
-
-var jwtauthenticatorsKind = schema.GroupVersionKind{Group: "authentication.concierge.pinniped.dev", Version: "v1alpha1", Kind: "JWTAuthenticator"}
-
-// Get takes name of the jWTAuthenticator, and returns the corresponding jWTAuthenticator object, and an error if there is any.
-func (c *FakeJWTAuthenticators) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.JWTAuthenticator, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootGetAction(jwtauthenticatorsResource, name), &v1alpha1.JWTAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.JWTAuthenticator), err
-}
-
-// List takes label and field selectors, and returns the list of JWTAuthenticators that match those selectors.
-func (c *FakeJWTAuthenticators) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.JWTAuthenticatorList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootListAction(jwtauthenticatorsResource, jwtauthenticatorsKind, opts), &v1alpha1.JWTAuthenticatorList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.JWTAuthenticatorList{ListMeta: obj.(*v1alpha1.JWTAuthenticatorList).ListMeta}
-	for _, item := range obj.(*v1alpha1.JWTAuthenticatorList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested jWTAuthenticators.
-func (c *FakeJWTAuthenticators) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewRootWatchAction(jwtauthenticatorsResource, opts))
-}
-
-// Create takes the representation of a jWTAuthenticator and creates it.  Returns the server's representation of the jWTAuthenticator, and an error, if there is any.
-func (c *FakeJWTAuthenticators) Create(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.CreateOptions) (result *v1alpha1.JWTAuthenticator, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootCreateAction(jwtauthenticatorsResource, jWTAuthenticator), &v1alpha1.JWTAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.JWTAuthenticator), err
-}
-
-// Update takes the representation of a jWTAuthenticator and updates it. Returns the server's representation of the jWTAuthenticator, and an error, if there is any.
-func (c *FakeJWTAuthenticators) Update(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.UpdateOptions) (result *v1alpha1.JWTAuthenticator, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootUpdateAction(jwtauthenticatorsResource, jWTAuthenticator), &v1alpha1.JWTAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.JWTAuthenticator), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeJWTAuthenticators) UpdateStatus(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.UpdateOptions) (*v1alpha1.JWTAuthenticator, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootUpdateSubresourceAction(jwtauthenticatorsResource, "status", jWTAuthenticator), &v1alpha1.JWTAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.JWTAuthenticator), err
-}
-
-// Delete takes name of the jWTAuthenticator and deletes it. Returns an error if one occurs.
-func (c *FakeJWTAuthenticators) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewRootDeleteActionWithOptions(jwtauthenticatorsResource, name, opts), &v1alpha1.JWTAuthenticator{})
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeJWTAuthenticators) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewRootDeleteCollectionAction(jwtauthenticatorsResource, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.JWTAuthenticatorList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched jWTAuthenticator.
-func (c *FakeJWTAuthenticators) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.JWTAuthenticator, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootPatchSubresourceAction(jwtauthenticatorsResource, name, pt, data, subresources...), &v1alpha1.JWTAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.JWTAuthenticator), err
-}

generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1/fake/fake_webhookauthenticator.go

@@ -1,120 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/authentication/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeWebhookAuthenticators implements WebhookAuthenticatorInterface
-type FakeWebhookAuthenticators struct {
-	Fake *FakeAuthenticationV1alpha1
-}
-
-var webhookauthenticatorsResource = schema.GroupVersionResource{Group: "authentication.concierge.pinniped.dev", Version: "v1alpha1", Resource: "webhookauthenticators"}
-
-var webhookauthenticatorsKind = schema.GroupVersionKind{Group: "authentication.concierge.pinniped.dev", Version: "v1alpha1", Kind: "WebhookAuthenticator"}
-
-// Get takes name of the webhookAuthenticator, and returns the corresponding webhookAuthenticator object, and an error if there is any.
-func (c *FakeWebhookAuthenticators) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.WebhookAuthenticator, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootGetAction(webhookauthenticatorsResource, name), &v1alpha1.WebhookAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.WebhookAuthenticator), err
-}
-
-// List takes label and field selectors, and returns the list of WebhookAuthenticators that match those selectors.
-func (c *FakeWebhookAuthenticators) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.WebhookAuthenticatorList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootListAction(webhookauthenticatorsResource, webhookauthenticatorsKind, opts), &v1alpha1.WebhookAuthenticatorList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.WebhookAuthenticatorList{ListMeta: obj.(*v1alpha1.WebhookAuthenticatorList).ListMeta}
-	for _, item := range obj.(*v1alpha1.WebhookAuthenticatorList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested webhookAuthenticators.
-func (c *FakeWebhookAuthenticators) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewRootWatchAction(webhookauthenticatorsResource, opts))
-}
-
-// Create takes the representation of a webhookAuthenticator and creates it.  Returns the server's representation of the webhookAuthenticator, and an error, if there is any.
-func (c *FakeWebhookAuthenticators) Create(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.CreateOptions) (result *v1alpha1.WebhookAuthenticator, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootCreateAction(webhookauthenticatorsResource, webhookAuthenticator), &v1alpha1.WebhookAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.WebhookAuthenticator), err
-}
-
-// Update takes the representation of a webhookAuthenticator and updates it. Returns the server's representation of the webhookAuthenticator, and an error, if there is any.
-func (c *FakeWebhookAuthenticators) Update(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.UpdateOptions) (result *v1alpha1.WebhookAuthenticator, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootUpdateAction(webhookauthenticatorsResource, webhookAuthenticator), &v1alpha1.WebhookAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.WebhookAuthenticator), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeWebhookAuthenticators) UpdateStatus(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.UpdateOptions) (*v1alpha1.WebhookAuthenticator, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootUpdateSubresourceAction(webhookauthenticatorsResource, "status", webhookAuthenticator), &v1alpha1.WebhookAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.WebhookAuthenticator), err
-}
-
-// Delete takes name of the webhookAuthenticator and deletes it. Returns an error if one occurs.
-func (c *FakeWebhookAuthenticators) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewRootDeleteActionWithOptions(webhookauthenticatorsResource, name, opts), &v1alpha1.WebhookAuthenticator{})
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeWebhookAuthenticators) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewRootDeleteCollectionAction(webhookauthenticatorsResource, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.WebhookAuthenticatorList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched webhookAuthenticator.
-func (c *FakeWebhookAuthenticators) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.WebhookAuthenticator, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootPatchSubresourceAction(webhookauthenticatorsResource, name, pt, data, subresources...), &v1alpha1.WebhookAuthenticator{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.WebhookAuthenticator), err
-}

generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1/jwtauthenticator.go

@@ -1,171 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/authentication/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// JWTAuthenticatorsGetter has a method to return a JWTAuthenticatorInterface.
-// A group's client should implement this interface.
-type JWTAuthenticatorsGetter interface {
-	JWTAuthenticators() JWTAuthenticatorInterface
-}
-
-// JWTAuthenticatorInterface has methods to work with JWTAuthenticator resources.
-type JWTAuthenticatorInterface interface {
-	Create(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.CreateOptions) (*v1alpha1.JWTAuthenticator, error)
-	Update(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.UpdateOptions) (*v1alpha1.JWTAuthenticator, error)
-	UpdateStatus(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.UpdateOptions) (*v1alpha1.JWTAuthenticator, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.JWTAuthenticator, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.JWTAuthenticatorList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.JWTAuthenticator, err error)
-	JWTAuthenticatorExpansion
-}
-
-// jWTAuthenticators implements JWTAuthenticatorInterface
-type jWTAuthenticators struct {
-	client rest.Interface
-}
-
-// newJWTAuthenticators returns a JWTAuthenticators
-func newJWTAuthenticators(c *AuthenticationV1alpha1Client) *jWTAuthenticators {
-	return &jWTAuthenticators{
-		client: c.RESTClient(),
-	}
-}
-
-// Get takes name of the jWTAuthenticator, and returns the corresponding jWTAuthenticator object, and an error if there is any.
-func (c *jWTAuthenticators) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.JWTAuthenticator, err error) {
-	result = &v1alpha1.JWTAuthenticator{}
-	err = c.client.Get().
-		Resource("jwtauthenticators").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of JWTAuthenticators that match those selectors.
-func (c *jWTAuthenticators) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.JWTAuthenticatorList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.JWTAuthenticatorList{}
-	err = c.client.Get().
-		Resource("jwtauthenticators").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested jWTAuthenticators.
-func (c *jWTAuthenticators) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Resource("jwtauthenticators").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a jWTAuthenticator and creates it.  Returns the server's representation of the jWTAuthenticator, and an error, if there is any.
-func (c *jWTAuthenticators) Create(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.CreateOptions) (result *v1alpha1.JWTAuthenticator, err error) {
-	result = &v1alpha1.JWTAuthenticator{}
-	err = c.client.Post().
-		Resource("jwtauthenticators").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(jWTAuthenticator).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a jWTAuthenticator and updates it. Returns the server's representation of the jWTAuthenticator, and an error, if there is any.
-func (c *jWTAuthenticators) Update(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.UpdateOptions) (result *v1alpha1.JWTAuthenticator, err error) {
-	result = &v1alpha1.JWTAuthenticator{}
-	err = c.client.Put().
-		Resource("jwtauthenticators").
-		Name(jWTAuthenticator.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(jWTAuthenticator).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *jWTAuthenticators) UpdateStatus(ctx context.Context, jWTAuthenticator *v1alpha1.JWTAuthenticator, opts v1.UpdateOptions) (result *v1alpha1.JWTAuthenticator, err error) {
-	result = &v1alpha1.JWTAuthenticator{}
-	err = c.client.Put().
-		Resource("jwtauthenticators").
-		Name(jWTAuthenticator.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(jWTAuthenticator).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the jWTAuthenticator and deletes it. Returns an error if one occurs.
-func (c *jWTAuthenticators) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Resource("jwtauthenticators").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *jWTAuthenticators) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Resource("jwtauthenticators").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched jWTAuthenticator.
-func (c *jWTAuthenticators) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.JWTAuthenticator, err error) {
-	result = &v1alpha1.JWTAuthenticator{}
-	err = c.client.Patch(pt).
-		Resource("jwtauthenticators").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/concierge/clientset/versioned/typed/authentication/v1alpha1/webhookauthenticator.go

@@ -1,171 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/authentication/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// WebhookAuthenticatorsGetter has a method to return a WebhookAuthenticatorInterface.
-// A group's client should implement this interface.
-type WebhookAuthenticatorsGetter interface {
-	WebhookAuthenticators() WebhookAuthenticatorInterface
-}
-
-// WebhookAuthenticatorInterface has methods to work with WebhookAuthenticator resources.
-type WebhookAuthenticatorInterface interface {
-	Create(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.CreateOptions) (*v1alpha1.WebhookAuthenticator, error)
-	Update(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.UpdateOptions) (*v1alpha1.WebhookAuthenticator, error)
-	UpdateStatus(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.UpdateOptions) (*v1alpha1.WebhookAuthenticator, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.WebhookAuthenticator, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.WebhookAuthenticatorList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.WebhookAuthenticator, err error)
-	WebhookAuthenticatorExpansion
-}
-
-// webhookAuthenticators implements WebhookAuthenticatorInterface
-type webhookAuthenticators struct {
-	client rest.Interface
-}
-
-// newWebhookAuthenticators returns a WebhookAuthenticators
-func newWebhookAuthenticators(c *AuthenticationV1alpha1Client) *webhookAuthenticators {
-	return &webhookAuthenticators{
-		client: c.RESTClient(),
-	}
-}
-
-// Get takes name of the webhookAuthenticator, and returns the corresponding webhookAuthenticator object, and an error if there is any.
-func (c *webhookAuthenticators) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.WebhookAuthenticator, err error) {
-	result = &v1alpha1.WebhookAuthenticator{}
-	err = c.client.Get().
-		Resource("webhookauthenticators").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of WebhookAuthenticators that match those selectors.
-func (c *webhookAuthenticators) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.WebhookAuthenticatorList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.WebhookAuthenticatorList{}
-	err = c.client.Get().
-		Resource("webhookauthenticators").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested webhookAuthenticators.
-func (c *webhookAuthenticators) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Resource("webhookauthenticators").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a webhookAuthenticator and creates it.  Returns the server's representation of the webhookAuthenticator, and an error, if there is any.
-func (c *webhookAuthenticators) Create(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.CreateOptions) (result *v1alpha1.WebhookAuthenticator, err error) {
-	result = &v1alpha1.WebhookAuthenticator{}
-	err = c.client.Post().
-		Resource("webhookauthenticators").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(webhookAuthenticator).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a webhookAuthenticator and updates it. Returns the server's representation of the webhookAuthenticator, and an error, if there is any.
-func (c *webhookAuthenticators) Update(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.UpdateOptions) (result *v1alpha1.WebhookAuthenticator, err error) {
-	result = &v1alpha1.WebhookAuthenticator{}
-	err = c.client.Put().
-		Resource("webhookauthenticators").
-		Name(webhookAuthenticator.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(webhookAuthenticator).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *webhookAuthenticators) UpdateStatus(ctx context.Context, webhookAuthenticator *v1alpha1.WebhookAuthenticator, opts v1.UpdateOptions) (result *v1alpha1.WebhookAuthenticator, err error) {
-	result = &v1alpha1.WebhookAuthenticator{}
-	err = c.client.Put().
-		Resource("webhookauthenticators").
-		Name(webhookAuthenticator.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(webhookAuthenticator).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the webhookAuthenticator and deletes it. Returns an error if one occurs.
-func (c *webhookAuthenticators) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Resource("webhookauthenticators").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *webhookAuthenticators) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Resource("webhookauthenticators").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched webhookAuthenticator.
-func (c *webhookAuthenticators) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.WebhookAuthenticator, err error) {
-	result = &v1alpha1.WebhookAuthenticator{}
-	err = c.client.Patch(pt).
-		Resource("webhookauthenticators").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/concierge/clientset/versioned/typed/config/v1alpha1/credentialissuer.go

@@ -1,171 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/config/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// CredentialIssuersGetter has a method to return a CredentialIssuerInterface.
-// A group's client should implement this interface.
-type CredentialIssuersGetter interface {
-	CredentialIssuers() CredentialIssuerInterface
-}
-
-// CredentialIssuerInterface has methods to work with CredentialIssuer resources.
-type CredentialIssuerInterface interface {
-	Create(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.CreateOptions) (*v1alpha1.CredentialIssuer, error)
-	Update(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.UpdateOptions) (*v1alpha1.CredentialIssuer, error)
-	UpdateStatus(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.UpdateOptions) (*v1alpha1.CredentialIssuer, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.CredentialIssuer, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.CredentialIssuerList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.CredentialIssuer, err error)
-	CredentialIssuerExpansion
-}
-
-// credentialIssuers implements CredentialIssuerInterface
-type credentialIssuers struct {
-	client rest.Interface
-}
-
-// newCredentialIssuers returns a CredentialIssuers
-func newCredentialIssuers(c *ConfigV1alpha1Client) *credentialIssuers {
-	return &credentialIssuers{
-		client: c.RESTClient(),
-	}
-}
-
-// Get takes name of the credentialIssuer, and returns the corresponding credentialIssuer object, and an error if there is any.
-func (c *credentialIssuers) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.CredentialIssuer, err error) {
-	result = &v1alpha1.CredentialIssuer{}
-	err = c.client.Get().
-		Resource("credentialissuers").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of CredentialIssuers that match those selectors.
-func (c *credentialIssuers) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.CredentialIssuerList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.CredentialIssuerList{}
-	err = c.client.Get().
-		Resource("credentialissuers").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested credentialIssuers.
-func (c *credentialIssuers) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Resource("credentialissuers").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a credentialIssuer and creates it.  Returns the server's representation of the credentialIssuer, and an error, if there is any.
-func (c *credentialIssuers) Create(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.CreateOptions) (result *v1alpha1.CredentialIssuer, err error) {
-	result = &v1alpha1.CredentialIssuer{}
-	err = c.client.Post().
-		Resource("credentialissuers").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(credentialIssuer).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a credentialIssuer and updates it. Returns the server's representation of the credentialIssuer, and an error, if there is any.
-func (c *credentialIssuers) Update(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.UpdateOptions) (result *v1alpha1.CredentialIssuer, err error) {
-	result = &v1alpha1.CredentialIssuer{}
-	err = c.client.Put().
-		Resource("credentialissuers").
-		Name(credentialIssuer.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(credentialIssuer).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *credentialIssuers) UpdateStatus(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.UpdateOptions) (result *v1alpha1.CredentialIssuer, err error) {
-	result = &v1alpha1.CredentialIssuer{}
-	err = c.client.Put().
-		Resource("credentialissuers").
-		Name(credentialIssuer.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(credentialIssuer).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the credentialIssuer and deletes it. Returns an error if one occurs.
-func (c *credentialIssuers) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Resource("credentialissuers").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *credentialIssuers) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Resource("credentialissuers").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched credentialIssuer.
-func (c *credentialIssuers) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.CredentialIssuer, err error) {
-	result = &v1alpha1.CredentialIssuer{}
-	err = c.client.Patch(pt).
-		Resource("credentialissuers").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/concierge/clientset/versioned/typed/config/v1alpha1/fake/fake_config_client.go

@@ -1,27 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/typed/config/v1alpha1"
-	rest "k8s.io/client-go/rest"
-	testing "k8s.io/client-go/testing"
-)
-
-type FakeConfigV1alpha1 struct {
-	*testing.Fake
-}
-
-func (c *FakeConfigV1alpha1) CredentialIssuers() v1alpha1.CredentialIssuerInterface {
-	return &FakeCredentialIssuers{c}
-}
-
-// RESTClient returns a RESTClient that is used to communicate
-// with API server by this client implementation.
-func (c *FakeConfigV1alpha1) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}

generated/1.26/client/concierge/clientset/versioned/typed/config/v1alpha1/fake/fake_credentialissuer.go

@@ -1,120 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/config/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeCredentialIssuers implements CredentialIssuerInterface
-type FakeCredentialIssuers struct {
-	Fake *FakeConfigV1alpha1
-}
-
-var credentialissuersResource = schema.GroupVersionResource{Group: "config.concierge.pinniped.dev", Version: "v1alpha1", Resource: "credentialissuers"}
-
-var credentialissuersKind = schema.GroupVersionKind{Group: "config.concierge.pinniped.dev", Version: "v1alpha1", Kind: "CredentialIssuer"}
-
-// Get takes name of the credentialIssuer, and returns the corresponding credentialIssuer object, and an error if there is any.
-func (c *FakeCredentialIssuers) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.CredentialIssuer, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootGetAction(credentialissuersResource, name), &v1alpha1.CredentialIssuer{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.CredentialIssuer), err
-}
-
-// List takes label and field selectors, and returns the list of CredentialIssuers that match those selectors.
-func (c *FakeCredentialIssuers) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.CredentialIssuerList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootListAction(credentialissuersResource, credentialissuersKind, opts), &v1alpha1.CredentialIssuerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.CredentialIssuerList{ListMeta: obj.(*v1alpha1.CredentialIssuerList).ListMeta}
-	for _, item := range obj.(*v1alpha1.CredentialIssuerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested credentialIssuers.
-func (c *FakeCredentialIssuers) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewRootWatchAction(credentialissuersResource, opts))
-}
-
-// Create takes the representation of a credentialIssuer and creates it.  Returns the server's representation of the credentialIssuer, and an error, if there is any.
-func (c *FakeCredentialIssuers) Create(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.CreateOptions) (result *v1alpha1.CredentialIssuer, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootCreateAction(credentialissuersResource, credentialIssuer), &v1alpha1.CredentialIssuer{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.CredentialIssuer), err
-}
-
-// Update takes the representation of a credentialIssuer and updates it. Returns the server's representation of the credentialIssuer, and an error, if there is any.
-func (c *FakeCredentialIssuers) Update(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.UpdateOptions) (result *v1alpha1.CredentialIssuer, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootUpdateAction(credentialissuersResource, credentialIssuer), &v1alpha1.CredentialIssuer{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.CredentialIssuer), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeCredentialIssuers) UpdateStatus(ctx context.Context, credentialIssuer *v1alpha1.CredentialIssuer, opts v1.UpdateOptions) (*v1alpha1.CredentialIssuer, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootUpdateSubresourceAction(credentialissuersResource, "status", credentialIssuer), &v1alpha1.CredentialIssuer{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.CredentialIssuer), err
-}
-
-// Delete takes name of the credentialIssuer and deletes it. Returns an error if one occurs.
-func (c *FakeCredentialIssuers) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewRootDeleteActionWithOptions(credentialissuersResource, name, opts), &v1alpha1.CredentialIssuer{})
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeCredentialIssuers) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewRootDeleteCollectionAction(credentialissuersResource, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.CredentialIssuerList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched credentialIssuer.
-func (c *FakeCredentialIssuers) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.CredentialIssuer, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootPatchSubresourceAction(credentialissuersResource, name, pt, data, subresources...), &v1alpha1.CredentialIssuer{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.CredentialIssuer), err
-}

generated/1.26/client/concierge/clientset/versioned/typed/identity/v1alpha1/fake/fake_whoamirequest.go

@@ -1,34 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/identity/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeWhoAmIRequests implements WhoAmIRequestInterface
-type FakeWhoAmIRequests struct {
-	Fake *FakeIdentityV1alpha1
-}
-
-var whoamirequestsResource = schema.GroupVersionResource{Group: "identity.concierge.pinniped.dev", Version: "v1alpha1", Resource: "whoamirequests"}
-
-var whoamirequestsKind = schema.GroupVersionKind{Group: "identity.concierge.pinniped.dev", Version: "v1alpha1", Kind: "WhoAmIRequest"}
-
-// Create takes the representation of a whoAmIRequest and creates it.  Returns the server's representation of the whoAmIRequest, and an error, if there is any.
-func (c *FakeWhoAmIRequests) Create(ctx context.Context, whoAmIRequest *v1alpha1.WhoAmIRequest, opts v1.CreateOptions) (result *v1alpha1.WhoAmIRequest, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootCreateAction(whoamirequestsResource, whoAmIRequest), &v1alpha1.WhoAmIRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.WhoAmIRequest), err
-}

generated/1.26/client/concierge/clientset/versioned/typed/identity/v1alpha1/identity_client.go

@@ -1,94 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"net/http"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/identity/v1alpha1"
-	"go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/scheme"
-	rest "k8s.io/client-go/rest"
-)
-
-type IdentityV1alpha1Interface interface {
-	RESTClient() rest.Interface
-	WhoAmIRequestsGetter
-}
-
-// IdentityV1alpha1Client is used to interact with features provided by the identity.concierge.pinniped.dev group.
-type IdentityV1alpha1Client struct {
-	restClient rest.Interface
-}
-
-func (c *IdentityV1alpha1Client) WhoAmIRequests() WhoAmIRequestInterface {
-	return newWhoAmIRequests(c)
-}
-
-// NewForConfig creates a new IdentityV1alpha1Client for the given config.
-// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
-// where httpClient was generated with rest.HTTPClientFor(c).
-func NewForConfig(c *rest.Config) (*IdentityV1alpha1Client, error) {
-	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
-	httpClient, err := rest.HTTPClientFor(&config)
-	if err != nil {
-		return nil, err
-	}
-	return NewForConfigAndClient(&config, httpClient)
-}
-
-// NewForConfigAndClient creates a new IdentityV1alpha1Client for the given config and http client.
-// Note the http client provided takes precedence over the configured transport values.
-func NewForConfigAndClient(c *rest.Config, h *http.Client) (*IdentityV1alpha1Client, error) {
-	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
-	client, err := rest.RESTClientForConfigAndClient(&config, h)
-	if err != nil {
-		return nil, err
-	}
-	return &IdentityV1alpha1Client{client}, nil
-}
-
-// NewForConfigOrDie creates a new IdentityV1alpha1Client for the given config and
-// panics if there is an error in the config.
-func NewForConfigOrDie(c *rest.Config) *IdentityV1alpha1Client {
-	client, err := NewForConfig(c)
-	if err != nil {
-		panic(err)
-	}
-	return client
-}
-
-// New creates a new IdentityV1alpha1Client for the given RESTClient.
-func New(c rest.Interface) *IdentityV1alpha1Client {
-	return &IdentityV1alpha1Client{c}
-}
-
-func setConfigDefaults(config *rest.Config) error {
-	gv := v1alpha1.SchemeGroupVersion
-	config.GroupVersion = &gv
-	config.APIPath = "/apis"
-	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
-
-	if config.UserAgent == "" {
-		config.UserAgent = rest.DefaultKubernetesUserAgent()
-	}
-
-	return nil
-}
-
-// RESTClient returns a RESTClient that is used to communicate
-// with API server by this client implementation.
-func (c *IdentityV1alpha1Client) RESTClient() rest.Interface {
-	if c == nil {
-		return nil
-	}
-	return c.restClient
-}

generated/1.26/client/concierge/clientset/versioned/typed/identity/v1alpha1/whoamirequest.go

@@ -1,51 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/identity/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	rest "k8s.io/client-go/rest"
-)
-
-// WhoAmIRequestsGetter has a method to return a WhoAmIRequestInterface.
-// A group's client should implement this interface.
-type WhoAmIRequestsGetter interface {
-	WhoAmIRequests() WhoAmIRequestInterface
-}
-
-// WhoAmIRequestInterface has methods to work with WhoAmIRequest resources.
-type WhoAmIRequestInterface interface {
-	Create(ctx context.Context, whoAmIRequest *v1alpha1.WhoAmIRequest, opts v1.CreateOptions) (*v1alpha1.WhoAmIRequest, error)
-	WhoAmIRequestExpansion
-}
-
-// whoAmIRequests implements WhoAmIRequestInterface
-type whoAmIRequests struct {
-	client rest.Interface
-}
-
-// newWhoAmIRequests returns a WhoAmIRequests
-func newWhoAmIRequests(c *IdentityV1alpha1Client) *whoAmIRequests {
-	return &whoAmIRequests{
-		client: c.RESTClient(),
-	}
-}
-
-// Create takes the representation of a whoAmIRequest and creates it.  Returns the server's representation of the whoAmIRequest, and an error, if there is any.
-func (c *whoAmIRequests) Create(ctx context.Context, whoAmIRequest *v1alpha1.WhoAmIRequest, opts v1.CreateOptions) (result *v1alpha1.WhoAmIRequest, err error) {
-	result = &v1alpha1.WhoAmIRequest{}
-	err = c.client.Post().
-		Resource("whoamirequests").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(whoAmIRequest).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/concierge/clientset/versioned/typed/login/v1alpha1/fake/fake_tokencredentialrequest.go

@@ -1,34 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/login/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeTokenCredentialRequests implements TokenCredentialRequestInterface
-type FakeTokenCredentialRequests struct {
-	Fake *FakeLoginV1alpha1
-}
-
-var tokencredentialrequestsResource = schema.GroupVersionResource{Group: "login.concierge.pinniped.dev", Version: "v1alpha1", Resource: "tokencredentialrequests"}
-
-var tokencredentialrequestsKind = schema.GroupVersionKind{Group: "login.concierge.pinniped.dev", Version: "v1alpha1", Kind: "TokenCredentialRequest"}
-
-// Create takes the representation of a tokenCredentialRequest and creates it.  Returns the server's representation of the tokenCredentialRequest, and an error, if there is any.
-func (c *FakeTokenCredentialRequests) Create(ctx context.Context, tokenCredentialRequest *v1alpha1.TokenCredentialRequest, opts v1.CreateOptions) (result *v1alpha1.TokenCredentialRequest, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewRootCreateAction(tokencredentialrequestsResource, tokenCredentialRequest), &v1alpha1.TokenCredentialRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TokenCredentialRequest), err
-}

generated/1.26/client/concierge/informers/externalversions/authentication/v1alpha1/interface.go

@@ -1,39 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/concierge/informers/externalversions/internalinterfaces"
-)
-
-// Interface provides access to all the informers in this group version.
-type Interface interface {
-	// JWTAuthenticators returns a JWTAuthenticatorInformer.
-	JWTAuthenticators() JWTAuthenticatorInformer
-	// WebhookAuthenticators returns a WebhookAuthenticatorInformer.
-	WebhookAuthenticators() WebhookAuthenticatorInformer
-}
-
-type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	namespace        string
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// New returns a new Interface.
-func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
-	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
-}
-
-// JWTAuthenticators returns a JWTAuthenticatorInformer.
-func (v *version) JWTAuthenticators() JWTAuthenticatorInformer {
-	return &jWTAuthenticatorInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// WebhookAuthenticators returns a WebhookAuthenticatorInformer.
-func (v *version) WebhookAuthenticators() WebhookAuthenticatorInformer {
-	return &webhookAuthenticatorInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}

generated/1.26/client/concierge/informers/externalversions/authentication/v1alpha1/jwtauthenticator.go

@@ -1,76 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	time "time"
-
-	authenticationv1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/authentication/v1alpha1"
-	versioned "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned"
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/concierge/informers/externalversions/internalinterfaces"
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/listers/authentication/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	watch "k8s.io/apimachinery/pkg/watch"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// JWTAuthenticatorInformer provides access to a shared informer and lister for
-// JWTAuthenticators.
-type JWTAuthenticatorInformer interface {
-	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.JWTAuthenticatorLister
-}
-
-type jWTAuthenticatorInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewJWTAuthenticatorInformer constructs a new informer for JWTAuthenticator type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewJWTAuthenticatorInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredJWTAuthenticatorInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredJWTAuthenticatorInformer constructs a new informer for JWTAuthenticator type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredJWTAuthenticatorInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return cache.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.AuthenticationV1alpha1().JWTAuthenticators().List(context.TODO(), options)
-			},
-			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.AuthenticationV1alpha1().JWTAuthenticators().Watch(context.TODO(), options)
-			},
-		},
-		&authenticationv1alpha1.JWTAuthenticator{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *jWTAuthenticatorInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredJWTAuthenticatorInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
-}
-
-func (f *jWTAuthenticatorInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&authenticationv1alpha1.JWTAuthenticator{}, f.defaultInformer)
-}
-
-func (f *jWTAuthenticatorInformer) Lister() v1alpha1.JWTAuthenticatorLister {
-	return v1alpha1.NewJWTAuthenticatorLister(f.Informer().GetIndexer())
-}

generated/1.26/client/concierge/informers/externalversions/config/interface.go

@@ -1,33 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package config
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/concierge/informers/externalversions/config/v1alpha1"
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/concierge/informers/externalversions/internalinterfaces"
-)
-
-// Interface provides access to each of this group's versions.
-type Interface interface {
-	// V1alpha1 provides access to shared informers for resources in V1alpha1.
-	V1alpha1() v1alpha1.Interface
-}
-
-type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	namespace        string
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// New returns a new Interface.
-func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
-	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
-}
-
-// V1alpha1 returns a new v1alpha1.Interface.
-func (g *group) V1alpha1() v1alpha1.Interface {
-	return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions)
-}

generated/1.26/client/concierge/informers/externalversions/config/v1alpha1/interface.go

@@ -1,32 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/concierge/informers/externalversions/internalinterfaces"
-)
-
-// Interface provides access to all the informers in this group version.
-type Interface interface {
-	// CredentialIssuers returns a CredentialIssuerInformer.
-	CredentialIssuers() CredentialIssuerInformer
-}
-
-type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	namespace        string
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// New returns a new Interface.
-func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
-	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
-}
-
-// CredentialIssuers returns a CredentialIssuerInformer.
-func (v *version) CredentialIssuers() CredentialIssuerInformer {
-	return &credentialIssuerInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}

generated/1.26/client/concierge/informers/externalversions/factory.go

@@ -1,244 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package externalversions
-
-import (
-	reflect "reflect"
-	sync "sync"
-	time "time"
-
-	versioned "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned"
-	authentication "go.pinniped.dev/generated/1.26/client/concierge/informers/externalversions/authentication"
-	config "go.pinniped.dev/generated/1.26/client/concierge/informers/externalversions/config"
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/concierge/informers/externalversions/internalinterfaces"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// SharedInformerOption defines the functional option type for SharedInformerFactory.
-type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
-
-type sharedInformerFactory struct {
-	client           versioned.Interface
-	namespace        string
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-	lock             sync.Mutex
-	defaultResync    time.Duration
-	customResync     map[reflect.Type]time.Duration
-
-	informers map[reflect.Type]cache.SharedIndexInformer
-	// startedInformers is used for tracking which informers have been started.
-	// This allows Start() to be called multiple times safely.
-	startedInformers map[reflect.Type]bool
-	// wg tracks how many goroutines were started.
-	wg sync.WaitGroup
-	// shuttingDown is true when Shutdown has been called. It may still be running
-	// because it needs to wait for goroutines.
-	shuttingDown bool
-}
-
-// WithCustomResyncConfig sets a custom resync period for the specified informer types.
-func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
-	return func(factory *sharedInformerFactory) *sharedInformerFactory {
-		for k, v := range resyncConfig {
-			factory.customResync[reflect.TypeOf(k)] = v
-		}
-		return factory
-	}
-}
-
-// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
-func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
-	return func(factory *sharedInformerFactory) *sharedInformerFactory {
-		factory.tweakListOptions = tweakListOptions
-		return factory
-	}
-}
-
-// WithNamespace limits the SharedInformerFactory to the specified namespace.
-func WithNamespace(namespace string) SharedInformerOption {
-	return func(factory *sharedInformerFactory) *sharedInformerFactory {
-		factory.namespace = namespace
-		return factory
-	}
-}
-
-// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
-func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
-	return NewSharedInformerFactoryWithOptions(client, defaultResync)
-}
-
-// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
-// Listers obtained via this SharedInformerFactory will be subject to the same filters
-// as specified here.
-// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
-func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
-	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
-}
-
-// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
-func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
-	factory := &sharedInformerFactory{
-		client:           client,
-		namespace:        v1.NamespaceAll,
-		defaultResync:    defaultResync,
-		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
-		startedInformers: make(map[reflect.Type]bool),
-		customResync:     make(map[reflect.Type]time.Duration),
-	}
-
-	// Apply all options
-	for _, opt := range options {
-		factory = opt(factory)
-	}
-
-	return factory
-}
-
-func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-
-	if f.shuttingDown {
-		return
-	}
-
-	for informerType, informer := range f.informers {
-		if !f.startedInformers[informerType] {
-			f.wg.Add(1)
-			// We need a new variable in each loop iteration,
-			// otherwise the goroutine would use the loop variable
-			// and that keeps changing.
-			informer := informer
-			go func() {
-				defer f.wg.Done()
-				informer.Run(stopCh)
-			}()
-			f.startedInformers[informerType] = true
-		}
-	}
-}
-
-func (f *sharedInformerFactory) Shutdown() {
-	f.lock.Lock()
-	f.shuttingDown = true
-	f.lock.Unlock()
-
-	// Will return immediately if there is nothing to wait for.
-	f.wg.Wait()
-}
-
-func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
-	informers := func() map[reflect.Type]cache.SharedIndexInformer {
-		f.lock.Lock()
-		defer f.lock.Unlock()
-
-		informers := map[reflect.Type]cache.SharedIndexInformer{}
-		for informerType, informer := range f.informers {
-			if f.startedInformers[informerType] {
-				informers[informerType] = informer
-			}
-		}
-		return informers
-	}()
-
-	res := map[reflect.Type]bool{}
-	for informType, informer := range informers {
-		res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced)
-	}
-	return res
-}
-
-// InternalInformerFor returns the SharedIndexInformer for obj using an internal
-// client.
-func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-
-	informerType := reflect.TypeOf(obj)
-	informer, exists := f.informers[informerType]
-	if exists {
-		return informer
-	}
-
-	resyncPeriod, exists := f.customResync[informerType]
-	if !exists {
-		resyncPeriod = f.defaultResync
-	}
-
-	informer = newFunc(f.client, resyncPeriod)
-	f.informers[informerType] = informer
-
-	return informer
-}
-
-// SharedInformerFactory provides shared informers for resources in all known
-// API group versions.
-//
-// It is typically used like this:
-//
-//	ctx, cancel := context.Background()
-//	defer cancel()
-//	factory := NewSharedInformerFactory(client, resyncPeriod)
-//	defer factory.WaitForStop()    // Returns immediately if nothing was started.
-//	genericInformer := factory.ForResource(resource)
-//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
-//	factory.Start(ctx.Done())          // Start processing these informers.
-//	synced := factory.WaitForCacheSync(ctx.Done())
-//	for v, ok := range synced {
-//	    if !ok {
-//	        fmt.Fprintf(os.Stderr, "caches failed to sync: %v", v)
-//	        return
-//	    }
-//	}
-//
-//	// Creating informers can also be created after Start, but then
-//	// Start must be called again:
-//	anotherGenericInformer := factory.ForResource(resource)
-//	factory.Start(ctx.Done())
-type SharedInformerFactory interface {
-	internalinterfaces.SharedInformerFactory
-
-	// Start initializes all requested informers. They are handled in goroutines
-	// which run until the stop channel gets closed.
-	Start(stopCh <-chan struct{})
-
-	// Shutdown marks a factory as shutting down. At that point no new
-	// informers can be started anymore and Start will return without
-	// doing anything.
-	//
-	// In addition, Shutdown blocks until all goroutines have terminated. For that
-	// to happen, the close channel(s) that they were started with must be closed,
-	// either before Shutdown gets called or while it is waiting.
-	//
-	// Shutdown may be called multiple times, even concurrently. All such calls will
-	// block until all goroutines have terminated.
-	Shutdown()
-
-	// WaitForCacheSync blocks until all started informers' caches were synced
-	// or the stop channel gets closed.
-	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
-
-	// ForResource gives generic access to a shared informer of the matching type.
-	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
-
-	// InternalInformerFor returns the SharedIndexInformer for obj using an internal
-	// client.
-	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
-
-	Authentication() authentication.Interface
-	Config() config.Interface
-}
-
-func (f *sharedInformerFactory) Authentication() authentication.Interface {
-	return authentication.New(f, f.namespace, f.tweakListOptions)
-}
-
-func (f *sharedInformerFactory) Config() config.Interface {
-	return config.New(f, f.namespace, f.tweakListOptions)
-}

generated/1.26/client/concierge/informers/externalversions/internalinterfaces/factory_interfaces.go

@@ -1,27 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package internalinterfaces
-
-import (
-	time "time"
-
-	versioned "go.pinniped.dev/generated/1.26/client/concierge/clientset/versioned"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// NewInformerFunc takes versioned.Interface and time.Duration to return a SharedIndexInformer.
-type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
-
-// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
-type SharedInformerFactory interface {
-	Start(stopCh <-chan struct{})
-	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
-}
-
-// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
-type TweakListOptionsFunc func(*v1.ListOptions)

generated/1.26/client/concierge/listers/authentication/v1alpha1/jwtauthenticator.go

@@ -1,55 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by lister-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/authentication/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
-)
-
-// JWTAuthenticatorLister helps list JWTAuthenticators.
-// All objects returned here must be treated as read-only.
-type JWTAuthenticatorLister interface {
-	// List lists all JWTAuthenticators in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.JWTAuthenticator, err error)
-	// Get retrieves the JWTAuthenticator from the index for a given name.
-	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.JWTAuthenticator, error)
-	JWTAuthenticatorListerExpansion
-}
-
-// jWTAuthenticatorLister implements the JWTAuthenticatorLister interface.
-type jWTAuthenticatorLister struct {
-	indexer cache.Indexer
-}
-
-// NewJWTAuthenticatorLister returns a new JWTAuthenticatorLister.
-func NewJWTAuthenticatorLister(indexer cache.Indexer) JWTAuthenticatorLister {
-	return &jWTAuthenticatorLister{indexer: indexer}
-}
-
-// List lists all JWTAuthenticators in the indexer.
-func (s *jWTAuthenticatorLister) List(selector labels.Selector) (ret []*v1alpha1.JWTAuthenticator, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.JWTAuthenticator))
-	})
-	return ret, err
-}
-
-// Get retrieves the JWTAuthenticator from the index for a given name.
-func (s *jWTAuthenticatorLister) Get(name string) (*v1alpha1.JWTAuthenticator, error) {
-	obj, exists, err := s.indexer.GetByKey(name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("jwtauthenticator"), name)
-	}
-	return obj.(*v1alpha1.JWTAuthenticator), nil
-}

generated/1.26/client/concierge/listers/authentication/v1alpha1/webhookauthenticator.go

@@ -1,55 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by lister-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/authentication/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
-)
-
-// WebhookAuthenticatorLister helps list WebhookAuthenticators.
-// All objects returned here must be treated as read-only.
-type WebhookAuthenticatorLister interface {
-	// List lists all WebhookAuthenticators in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.WebhookAuthenticator, err error)
-	// Get retrieves the WebhookAuthenticator from the index for a given name.
-	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.WebhookAuthenticator, error)
-	WebhookAuthenticatorListerExpansion
-}
-
-// webhookAuthenticatorLister implements the WebhookAuthenticatorLister interface.
-type webhookAuthenticatorLister struct {
-	indexer cache.Indexer
-}
-
-// NewWebhookAuthenticatorLister returns a new WebhookAuthenticatorLister.
-func NewWebhookAuthenticatorLister(indexer cache.Indexer) WebhookAuthenticatorLister {
-	return &webhookAuthenticatorLister{indexer: indexer}
-}
-
-// List lists all WebhookAuthenticators in the indexer.
-func (s *webhookAuthenticatorLister) List(selector labels.Selector) (ret []*v1alpha1.WebhookAuthenticator, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.WebhookAuthenticator))
-	})
-	return ret, err
-}
-
-// Get retrieves the WebhookAuthenticator from the index for a given name.
-func (s *webhookAuthenticatorLister) Get(name string) (*v1alpha1.WebhookAuthenticator, error) {
-	obj, exists, err := s.indexer.GetByKey(name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("webhookauthenticator"), name)
-	}
-	return obj.(*v1alpha1.WebhookAuthenticator), nil
-}

generated/1.26/client/concierge/listers/config/v1alpha1/credentialissuer.go

@@ -1,55 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by lister-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/concierge/config/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
-)
-
-// CredentialIssuerLister helps list CredentialIssuers.
-// All objects returned here must be treated as read-only.
-type CredentialIssuerLister interface {
-	// List lists all CredentialIssuers in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.CredentialIssuer, err error)
-	// Get retrieves the CredentialIssuer from the index for a given name.
-	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.CredentialIssuer, error)
-	CredentialIssuerListerExpansion
-}
-
-// credentialIssuerLister implements the CredentialIssuerLister interface.
-type credentialIssuerLister struct {
-	indexer cache.Indexer
-}
-
-// NewCredentialIssuerLister returns a new CredentialIssuerLister.
-func NewCredentialIssuerLister(indexer cache.Indexer) CredentialIssuerLister {
-	return &credentialIssuerLister{indexer: indexer}
-}
-
-// List lists all CredentialIssuers in the indexer.
-func (s *credentialIssuerLister) List(selector labels.Selector) (ret []*v1alpha1.CredentialIssuer, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.CredentialIssuer))
-	})
-	return ret, err
-}
-
-// Get retrieves the CredentialIssuer from the index for a given name.
-func (s *credentialIssuerLister) Get(name string) (*v1alpha1.CredentialIssuer, error) {
-	obj, exists, err := s.indexer.GetByKey(name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("credentialissuer"), name)
-	}
-	return obj.(*v1alpha1.CredentialIssuer), nil
-}

generated/1.26/client/go.mod

@@ -1,13 +0,0 @@
-// This go.mod file is generated by ./hack/update.sh.
-module go.pinniped.dev/generated/1.26/client
-
-go 1.13
-
-replace go.pinniped.dev/generated/1.26/apis => ../apis
-
-require (
-	go.pinniped.dev/generated/1.26/apis v0.0.0
-	k8s.io/apimachinery v0.26.15
-	k8s.io/client-go v0.26.15
-	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280
-)

generated/1.26/client/go.sum

@@ -1,345 +0,0 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
-github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE=
-github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
-github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
-github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
-github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
-github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA=
-github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
-github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng=
-github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
-github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54=
-github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
-github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA=
-github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
-github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
-github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
-github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
-github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
-github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8AyFNU9d0=
-github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs=
-github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
-github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
-github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
-github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
-github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
-github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
-github.com/onsi/gomega v1.23.0 h1:/oxKu9c2HVap+F3PfKort2Hw5DEU+HGlW8n+tguWsys=
-github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
-github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
-golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.26.15 h1:tjMERUjIwkq+2UtPZL5ZbSsLkpxUv4gXWZfV5lQl+Og=
-k8s.io/api v0.26.15/go.mod h1:CtWOrFl8VLCTLolRlhbBxo4fy83tjCLEtYa5pMubIe0=
-k8s.io/apimachinery v0.26.15 h1:GPxeERYBSqSZlj3xIkX4L6mBjzZ9q8JPnJ+Vj15qe+g=
-k8s.io/apimachinery v0.26.15/go.mod h1:O/uIhIOWuy6ndHqQ6qbkjD7OgeMhVtlk8+Z66ZcmJQc=
-k8s.io/client-go v0.26.15 h1:A2Yav2v+VZQfpEsf5ESFp2Lqq5XACKBDrwkG+jEtOg0=
-k8s.io/client-go v0.26.15/go.mod h1:KJs7snLEyKPlypqTQG/ngcaqE6h3/6qTvVHDViRL+iI=
-k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
-k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
-k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E=
-k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
-k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20221107191617-1a15be271d1d h1:0Smp/HP1OH4Rvhe+4B8nWGERtlqAGSftbSbbmm45oFs=
-k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=

generated/1.26/client/supervisor/clientset/versioned/doc.go

@@ -1,7 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-// This package has the automatically generated clientset.
-package versioned

generated/1.26/client/supervisor/clientset/versioned/fake/clientset_generated.go

@@ -1,86 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	clientset "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned"
-	clientsecretv1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1"
-	fakeclientsecretv1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake"
-	configv1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/typed/config/v1alpha1"
-	fakeconfigv1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake"
-	idpv1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1"
-	fakeidpv1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	"k8s.io/client-go/discovery"
-	fakediscovery "k8s.io/client-go/discovery/fake"
-	"k8s.io/client-go/testing"
-)
-
-// NewSimpleClientset returns a clientset that will respond with the provided objects.
-// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
-// without applying any validations and/or defaults. It shouldn't be considered a replacement
-// for a real clientset and is mostly useful in simple unit tests.
-func NewSimpleClientset(objects ...runtime.Object) *Clientset {
-	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
-	for _, obj := range objects {
-		if err := o.Add(obj); err != nil {
-			panic(err)
-		}
-	}
-
-	cs := &Clientset{tracker: o}
-	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
-	cs.AddReactor("*", "*", testing.ObjectReaction(o))
-	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
-		gvr := action.GetResource()
-		ns := action.GetNamespace()
-		watch, err := o.Watch(gvr, ns)
-		if err != nil {
-			return false, nil, err
-		}
-		return true, watch, nil
-	})
-
-	return cs
-}
-
-// Clientset implements clientset.Interface. Meant to be embedded into a
-// struct to get a default implementation. This makes faking out just the method
-// you want to test easier.
-type Clientset struct {
-	testing.Fake
-	discovery *fakediscovery.FakeDiscovery
-	tracker   testing.ObjectTracker
-}
-
-func (c *Clientset) Discovery() discovery.DiscoveryInterface {
-	return c.discovery
-}
-
-func (c *Clientset) Tracker() testing.ObjectTracker {
-	return c.tracker
-}
-
-var (
-	_ clientset.Interface = &Clientset{}
-	_ testing.FakeClient  = &Clientset{}
-)
-
-// ClientsecretV1alpha1 retrieves the ClientsecretV1alpha1Client
-func (c *Clientset) ClientsecretV1alpha1() clientsecretv1alpha1.ClientsecretV1alpha1Interface {
-	return &fakeclientsecretv1alpha1.FakeClientsecretV1alpha1{Fake: &c.Fake}
-}
-
-// ConfigV1alpha1 retrieves the ConfigV1alpha1Client
-func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface {
-	return &fakeconfigv1alpha1.FakeConfigV1alpha1{Fake: &c.Fake}
-}
-
-// IDPV1alpha1 retrieves the IDPV1alpha1Client
-func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface {
-	return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake}
-}

generated/1.26/client/supervisor/clientset/versioned/fake/register.go

@@ -1,47 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	clientsecretv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/clientsecret/v1alpha1"
-	configv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-)
-
-var scheme = runtime.NewScheme()
-var codecs = serializer.NewCodecFactory(scheme)
-
-var localSchemeBuilder = runtime.SchemeBuilder{
-	clientsecretv1alpha1.AddToScheme,
-	configv1alpha1.AddToScheme,
-	idpv1alpha1.AddToScheme,
-}
-
-// AddToScheme adds all types of this clientset into the given scheme. This allows composition
-// of clientsets, like in:
-//
-//	import (
-//	  "k8s.io/client-go/kubernetes"
-//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
-//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
-//	)
-//
-//	kclientset, _ := kubernetes.NewForConfig(c)
-//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
-//
-// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
-// correctly.
-var AddToScheme = localSchemeBuilder.AddToScheme
-
-func init() {
-	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
-	utilruntime.Must(AddToScheme(scheme))
-}

generated/1.26/client/supervisor/clientset/versioned/scheme/register.go

@@ -1,47 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package scheme
-
-import (
-	clientsecretv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/clientsecret/v1alpha1"
-	configv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	idpv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-)
-
-var Scheme = runtime.NewScheme()
-var Codecs = serializer.NewCodecFactory(Scheme)
-var ParameterCodec = runtime.NewParameterCodec(Scheme)
-var localSchemeBuilder = runtime.SchemeBuilder{
-	clientsecretv1alpha1.AddToScheme,
-	configv1alpha1.AddToScheme,
-	idpv1alpha1.AddToScheme,
-}
-
-// AddToScheme adds all types of this clientset into the given scheme. This allows composition
-// of clientsets, like in:
-//
-//	import (
-//	  "k8s.io/client-go/kubernetes"
-//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
-//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
-//	)
-//
-//	kclientset, _ := kubernetes.NewForConfig(c)
-//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
-//
-// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
-// correctly.
-var AddToScheme = localSchemeBuilder.AddToScheme
-
-func init() {
-	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
-	utilruntime.Must(AddToScheme(Scheme))
-}

generated/1.26/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/clientsecret_client.go

@@ -1,94 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"net/http"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/clientsecret/v1alpha1"
-	"go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	rest "k8s.io/client-go/rest"
-)
-
-type ClientsecretV1alpha1Interface interface {
-	RESTClient() rest.Interface
-	OIDCClientSecretRequestsGetter
-}
-
-// ClientsecretV1alpha1Client is used to interact with features provided by the clientsecret.supervisor.pinniped.dev group.
-type ClientsecretV1alpha1Client struct {
-	restClient rest.Interface
-}
-
-func (c *ClientsecretV1alpha1Client) OIDCClientSecretRequests(namespace string) OIDCClientSecretRequestInterface {
-	return newOIDCClientSecretRequests(c, namespace)
-}
-
-// NewForConfig creates a new ClientsecretV1alpha1Client for the given config.
-// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
-// where httpClient was generated with rest.HTTPClientFor(c).
-func NewForConfig(c *rest.Config) (*ClientsecretV1alpha1Client, error) {
-	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
-	httpClient, err := rest.HTTPClientFor(&config)
-	if err != nil {
-		return nil, err
-	}
-	return NewForConfigAndClient(&config, httpClient)
-}
-
-// NewForConfigAndClient creates a new ClientsecretV1alpha1Client for the given config and http client.
-// Note the http client provided takes precedence over the configured transport values.
-func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ClientsecretV1alpha1Client, error) {
-	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
-	client, err := rest.RESTClientForConfigAndClient(&config, h)
-	if err != nil {
-		return nil, err
-	}
-	return &ClientsecretV1alpha1Client{client}, nil
-}
-
-// NewForConfigOrDie creates a new ClientsecretV1alpha1Client for the given config and
-// panics if there is an error in the config.
-func NewForConfigOrDie(c *rest.Config) *ClientsecretV1alpha1Client {
-	client, err := NewForConfig(c)
-	if err != nil {
-		panic(err)
-	}
-	return client
-}
-
-// New creates a new ClientsecretV1alpha1Client for the given RESTClient.
-func New(c rest.Interface) *ClientsecretV1alpha1Client {
-	return &ClientsecretV1alpha1Client{c}
-}
-
-func setConfigDefaults(config *rest.Config) error {
-	gv := v1alpha1.SchemeGroupVersion
-	config.GroupVersion = &gv
-	config.APIPath = "/apis"
-	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
-
-	if config.UserAgent == "" {
-		config.UserAgent = rest.DefaultKubernetesUserAgent()
-	}
-
-	return nil
-}
-
-// RESTClient returns a RESTClient that is used to communicate
-// with API server by this client implementation.
-func (c *ClientsecretV1alpha1Client) RESTClient() rest.Interface {
-	if c == nil {
-		return nil
-	}
-	return c.restClient
-}

generated/1.26/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake/fake_clientsecret_client.go

@@ -1,27 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1"
-	rest "k8s.io/client-go/rest"
-	testing "k8s.io/client-go/testing"
-)
-
-type FakeClientsecretV1alpha1 struct {
-	*testing.Fake
-}
-
-func (c *FakeClientsecretV1alpha1) OIDCClientSecretRequests(namespace string) v1alpha1.OIDCClientSecretRequestInterface {
-	return &FakeOIDCClientSecretRequests{c, namespace}
-}
-
-// RESTClient returns a RESTClient that is used to communicate
-// with API server by this client implementation.
-func (c *FakeClientsecretV1alpha1) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}

generated/1.26/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/fake/fake_oidcclientsecretrequest.go

@@ -1,36 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/clientsecret/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeOIDCClientSecretRequests implements OIDCClientSecretRequestInterface
-type FakeOIDCClientSecretRequests struct {
-	Fake *FakeClientsecretV1alpha1
-	ns   string
-}
-
-var oidcclientsecretrequestsResource = schema.GroupVersionResource{Group: "clientsecret.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclientsecretrequests"}
-
-var oidcclientsecretrequestsKind = schema.GroupVersionKind{Group: "clientsecret.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClientSecretRequest"}
-
-// Create takes the representation of a oIDCClientSecretRequest and creates it.  Returns the server's representation of the oIDCClientSecretRequest, and an error, if there is any.
-func (c *FakeOIDCClientSecretRequests) Create(ctx context.Context, oIDCClientSecretRequest *v1alpha1.OIDCClientSecretRequest, opts v1.CreateOptions) (result *v1alpha1.OIDCClientSecretRequest, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(oidcclientsecretrequestsResource, c.ns, oIDCClientSecretRequest), &v1alpha1.OIDCClientSecretRequest{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCClientSecretRequest), err
-}

generated/1.26/client/supervisor/clientset/versioned/typed/clientsecret/v1alpha1/oidcclientsecretrequest.go

@@ -1,54 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/clientsecret/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	rest "k8s.io/client-go/rest"
-)
-
-// OIDCClientSecretRequestsGetter has a method to return a OIDCClientSecretRequestInterface.
-// A group's client should implement this interface.
-type OIDCClientSecretRequestsGetter interface {
-	OIDCClientSecretRequests(namespace string) OIDCClientSecretRequestInterface
-}
-
-// OIDCClientSecretRequestInterface has methods to work with OIDCClientSecretRequest resources.
-type OIDCClientSecretRequestInterface interface {
-	Create(ctx context.Context, oIDCClientSecretRequest *v1alpha1.OIDCClientSecretRequest, opts v1.CreateOptions) (*v1alpha1.OIDCClientSecretRequest, error)
-	OIDCClientSecretRequestExpansion
-}
-
-// oIDCClientSecretRequests implements OIDCClientSecretRequestInterface
-type oIDCClientSecretRequests struct {
-	client rest.Interface
-	ns     string
-}
-
-// newOIDCClientSecretRequests returns a OIDCClientSecretRequests
-func newOIDCClientSecretRequests(c *ClientsecretV1alpha1Client, namespace string) *oIDCClientSecretRequests {
-	return &oIDCClientSecretRequests{
-		client: c.RESTClient(),
-		ns:     namespace,
-	}
-}
-
-// Create takes the representation of a oIDCClientSecretRequest and creates it.  Returns the server's representation of the oIDCClientSecretRequest, and an error, if there is any.
-func (c *oIDCClientSecretRequests) Create(ctx context.Context, oIDCClientSecretRequest *v1alpha1.OIDCClientSecretRequest, opts v1.CreateOptions) (result *v1alpha1.OIDCClientSecretRequest, err error) {
-	result = &v1alpha1.OIDCClientSecretRequest{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("oidcclientsecretrequests").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(oIDCClientSecretRequest).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/supervisor/clientset/versioned/typed/config/v1alpha1/config_client.go

@@ -1,99 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"net/http"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	"go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	rest "k8s.io/client-go/rest"
-)
-
-type ConfigV1alpha1Interface interface {
-	RESTClient() rest.Interface
-	FederationDomainsGetter
-	OIDCClientsGetter
-}
-
-// ConfigV1alpha1Client is used to interact with features provided by the config.supervisor.pinniped.dev group.
-type ConfigV1alpha1Client struct {
-	restClient rest.Interface
-}
-
-func (c *ConfigV1alpha1Client) FederationDomains(namespace string) FederationDomainInterface {
-	return newFederationDomains(c, namespace)
-}
-
-func (c *ConfigV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface {
-	return newOIDCClients(c, namespace)
-}
-
-// NewForConfig creates a new ConfigV1alpha1Client for the given config.
-// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
-// where httpClient was generated with rest.HTTPClientFor(c).
-func NewForConfig(c *rest.Config) (*ConfigV1alpha1Client, error) {
-	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
-	httpClient, err := rest.HTTPClientFor(&config)
-	if err != nil {
-		return nil, err
-	}
-	return NewForConfigAndClient(&config, httpClient)
-}
-
-// NewForConfigAndClient creates a new ConfigV1alpha1Client for the given config and http client.
-// Note the http client provided takes precedence over the configured transport values.
-func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ConfigV1alpha1Client, error) {
-	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
-	client, err := rest.RESTClientForConfigAndClient(&config, h)
-	if err != nil {
-		return nil, err
-	}
-	return &ConfigV1alpha1Client{client}, nil
-}
-
-// NewForConfigOrDie creates a new ConfigV1alpha1Client for the given config and
-// panics if there is an error in the config.
-func NewForConfigOrDie(c *rest.Config) *ConfigV1alpha1Client {
-	client, err := NewForConfig(c)
-	if err != nil {
-		panic(err)
-	}
-	return client
-}
-
-// New creates a new ConfigV1alpha1Client for the given RESTClient.
-func New(c rest.Interface) *ConfigV1alpha1Client {
-	return &ConfigV1alpha1Client{c}
-}
-
-func setConfigDefaults(config *rest.Config) error {
-	gv := v1alpha1.SchemeGroupVersion
-	config.GroupVersion = &gv
-	config.APIPath = "/apis"
-	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
-
-	if config.UserAgent == "" {
-		config.UserAgent = rest.DefaultKubernetesUserAgent()
-	}
-
-	return nil
-}
-
-// RESTClient returns a RESTClient that is used to communicate
-// with API server by this client implementation.
-func (c *ConfigV1alpha1Client) RESTClient() rest.Interface {
-	if c == nil {
-		return nil
-	}
-	return c.restClient
-}

generated/1.26/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/fake_federationdomain.go

@@ -1,129 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeFederationDomains implements FederationDomainInterface
-type FakeFederationDomains struct {
-	Fake *FakeConfigV1alpha1
-	ns   string
-}
-
-var federationdomainsResource = schema.GroupVersionResource{Group: "config.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "federationdomains"}
-
-var federationdomainsKind = schema.GroupVersionKind{Group: "config.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "FederationDomain"}
-
-// Get takes name of the federationDomain, and returns the corresponding federationDomain object, and an error if there is any.
-func (c *FakeFederationDomains) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.FederationDomain, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(federationdomainsResource, c.ns, name), &v1alpha1.FederationDomain{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.FederationDomain), err
-}
-
-// List takes label and field selectors, and returns the list of FederationDomains that match those selectors.
-func (c *FakeFederationDomains) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.FederationDomainList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(federationdomainsResource, federationdomainsKind, c.ns, opts), &v1alpha1.FederationDomainList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.FederationDomainList{ListMeta: obj.(*v1alpha1.FederationDomainList).ListMeta}
-	for _, item := range obj.(*v1alpha1.FederationDomainList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested federationDomains.
-func (c *FakeFederationDomains) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(federationdomainsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a federationDomain and creates it.  Returns the server's representation of the federationDomain, and an error, if there is any.
-func (c *FakeFederationDomains) Create(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.CreateOptions) (result *v1alpha1.FederationDomain, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(federationdomainsResource, c.ns, federationDomain), &v1alpha1.FederationDomain{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.FederationDomain), err
-}
-
-// Update takes the representation of a federationDomain and updates it. Returns the server's representation of the federationDomain, and an error, if there is any.
-func (c *FakeFederationDomains) Update(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.UpdateOptions) (result *v1alpha1.FederationDomain, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(federationdomainsResource, c.ns, federationDomain), &v1alpha1.FederationDomain{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.FederationDomain), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeFederationDomains) UpdateStatus(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.UpdateOptions) (*v1alpha1.FederationDomain, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(federationdomainsResource, "status", c.ns, federationDomain), &v1alpha1.FederationDomain{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.FederationDomain), err
-}
-
-// Delete takes name of the federationDomain and deletes it. Returns an error if one occurs.
-func (c *FakeFederationDomains) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(federationdomainsResource, c.ns, name, opts), &v1alpha1.FederationDomain{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeFederationDomains) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(federationdomainsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.FederationDomainList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched federationDomain.
-func (c *FakeFederationDomains) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.FederationDomain, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(federationdomainsResource, c.ns, name, pt, data, subresources...), &v1alpha1.FederationDomain{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.FederationDomain), err
-}

generated/1.26/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake/fake_oidcclient.go

@@ -1,129 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeOIDCClients implements OIDCClientInterface
-type FakeOIDCClients struct {
-	Fake *FakeConfigV1alpha1
-	ns   string
-}
-
-var oidcclientsResource = schema.GroupVersionResource{Group: "config.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"}
-
-var oidcclientsKind = schema.GroupVersionKind{Group: "config.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"}
-
-// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any.
-func (c *FakeOIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCClient), err
-}
-
-// List takes label and field selectors, and returns the list of OIDCClients that match those selectors.
-func (c *FakeOIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta}
-	for _, item := range obj.(*v1alpha1.OIDCClientList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested oIDCClients.
-func (c *FakeOIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a oIDCClient and creates it.  Returns the server's representation of the oIDCClient, and an error, if there is any.
-func (c *FakeOIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCClient), err
-}
-
-// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any.
-func (c *FakeOIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCClient), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeOIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCClient), err
-}
-
-// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs.
-func (c *FakeOIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(oidcclientsResource, c.ns, name, opts), &v1alpha1.OIDCClient{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeOIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched oIDCClient.
-func (c *FakeOIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCClient), err
-}

generated/1.26/client/supervisor/clientset/versioned/typed/config/v1alpha1/federationdomain.go

@@ -1,182 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// FederationDomainsGetter has a method to return a FederationDomainInterface.
-// A group's client should implement this interface.
-type FederationDomainsGetter interface {
-	FederationDomains(namespace string) FederationDomainInterface
-}
-
-// FederationDomainInterface has methods to work with FederationDomain resources.
-type FederationDomainInterface interface {
-	Create(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.CreateOptions) (*v1alpha1.FederationDomain, error)
-	Update(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.UpdateOptions) (*v1alpha1.FederationDomain, error)
-	UpdateStatus(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.UpdateOptions) (*v1alpha1.FederationDomain, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.FederationDomain, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.FederationDomainList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.FederationDomain, err error)
-	FederationDomainExpansion
-}
-
-// federationDomains implements FederationDomainInterface
-type federationDomains struct {
-	client rest.Interface
-	ns     string
-}
-
-// newFederationDomains returns a FederationDomains
-func newFederationDomains(c *ConfigV1alpha1Client, namespace string) *federationDomains {
-	return &federationDomains{
-		client: c.RESTClient(),
-		ns:     namespace,
-	}
-}
-
-// Get takes name of the federationDomain, and returns the corresponding federationDomain object, and an error if there is any.
-func (c *federationDomains) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.FederationDomain, err error) {
-	result = &v1alpha1.FederationDomain{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("federationdomains").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of FederationDomains that match those selectors.
-func (c *federationDomains) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.FederationDomainList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.FederationDomainList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("federationdomains").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested federationDomains.
-func (c *federationDomains) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("federationdomains").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a federationDomain and creates it.  Returns the server's representation of the federationDomain, and an error, if there is any.
-func (c *federationDomains) Create(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.CreateOptions) (result *v1alpha1.FederationDomain, err error) {
-	result = &v1alpha1.FederationDomain{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("federationdomains").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(federationDomain).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a federationDomain and updates it. Returns the server's representation of the federationDomain, and an error, if there is any.
-func (c *federationDomains) Update(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.UpdateOptions) (result *v1alpha1.FederationDomain, err error) {
-	result = &v1alpha1.FederationDomain{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("federationdomains").
-		Name(federationDomain.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(federationDomain).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *federationDomains) UpdateStatus(ctx context.Context, federationDomain *v1alpha1.FederationDomain, opts v1.UpdateOptions) (result *v1alpha1.FederationDomain, err error) {
-	result = &v1alpha1.FederationDomain{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("federationdomains").
-		Name(federationDomain.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(federationDomain).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the federationDomain and deletes it. Returns an error if one occurs.
-func (c *federationDomains) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("federationdomains").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *federationDomains) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("federationdomains").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched federationDomain.
-func (c *federationDomains) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.FederationDomain, err error) {
-	result = &v1alpha1.FederationDomain{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("federationdomains").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/supervisor/clientset/versioned/typed/config/v1alpha1/oidcclient.go

@@ -1,182 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// OIDCClientsGetter has a method to return a OIDCClientInterface.
-// A group's client should implement this interface.
-type OIDCClientsGetter interface {
-	OIDCClients(namespace string) OIDCClientInterface
-}
-
-// OIDCClientInterface has methods to work with OIDCClient resources.
-type OIDCClientInterface interface {
-	Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (*v1alpha1.OIDCClient, error)
-	Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error)
-	UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCClient, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCClientList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error)
-	OIDCClientExpansion
-}
-
-// oIDCClients implements OIDCClientInterface
-type oIDCClients struct {
-	client rest.Interface
-	ns     string
-}
-
-// newOIDCClients returns a OIDCClients
-func newOIDCClients(c *ConfigV1alpha1Client, namespace string) *oIDCClients {
-	return &oIDCClients{
-		client: c.RESTClient(),
-		ns:     namespace,
-	}
-}
-
-// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any.
-func (c *oIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) {
-	result = &v1alpha1.OIDCClient{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("oidcclients").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of OIDCClients that match those selectors.
-func (c *oIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.OIDCClientList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("oidcclients").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested oIDCClients.
-func (c *oIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("oidcclients").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a oIDCClient and creates it.  Returns the server's representation of the oIDCClient, and an error, if there is any.
-func (c *oIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) {
-	result = &v1alpha1.OIDCClient{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("oidcclients").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(oIDCClient).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any.
-func (c *oIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) {
-	result = &v1alpha1.OIDCClient{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("oidcclients").
-		Name(oIDCClient.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(oIDCClient).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *oIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) {
-	result = &v1alpha1.OIDCClient{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("oidcclients").
-		Name(oIDCClient.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(oIDCClient).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs.
-func (c *oIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("oidcclients").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *oIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("oidcclients").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched oIDCClient.
-func (c *oIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) {
-	result = &v1alpha1.OIDCClient{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("oidcclients").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/activedirectoryidentityprovider.go

@@ -1,182 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// ActiveDirectoryIdentityProvidersGetter has a method to return a ActiveDirectoryIdentityProviderInterface.
-// A group's client should implement this interface.
-type ActiveDirectoryIdentityProvidersGetter interface {
-	ActiveDirectoryIdentityProviders(namespace string) ActiveDirectoryIdentityProviderInterface
-}
-
-// ActiveDirectoryIdentityProviderInterface has methods to work with ActiveDirectoryIdentityProvider resources.
-type ActiveDirectoryIdentityProviderInterface interface {
-	Create(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.CreateOptions) (*v1alpha1.ActiveDirectoryIdentityProvider, error)
-	Update(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.ActiveDirectoryIdentityProvider, error)
-	UpdateStatus(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.ActiveDirectoryIdentityProvider, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.ActiveDirectoryIdentityProvider, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.ActiveDirectoryIdentityProviderList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error)
-	ActiveDirectoryIdentityProviderExpansion
-}
-
-// activeDirectoryIdentityProviders implements ActiveDirectoryIdentityProviderInterface
-type activeDirectoryIdentityProviders struct {
-	client rest.Interface
-	ns     string
-}
-
-// newActiveDirectoryIdentityProviders returns a ActiveDirectoryIdentityProviders
-func newActiveDirectoryIdentityProviders(c *IDPV1alpha1Client, namespace string) *activeDirectoryIdentityProviders {
-	return &activeDirectoryIdentityProviders{
-		client: c.RESTClient(),
-		ns:     namespace,
-	}
-}
-
-// Get takes name of the activeDirectoryIdentityProvider, and returns the corresponding activeDirectoryIdentityProvider object, and an error if there is any.
-func (c *activeDirectoryIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	result = &v1alpha1.ActiveDirectoryIdentityProvider{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of ActiveDirectoryIdentityProviders that match those selectors.
-func (c *activeDirectoryIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ActiveDirectoryIdentityProviderList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.ActiveDirectoryIdentityProviderList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested activeDirectoryIdentityProviders.
-func (c *activeDirectoryIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a activeDirectoryIdentityProvider and creates it.  Returns the server's representation of the activeDirectoryIdentityProvider, and an error, if there is any.
-func (c *activeDirectoryIdentityProviders) Create(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	result = &v1alpha1.ActiveDirectoryIdentityProvider{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(activeDirectoryIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a activeDirectoryIdentityProvider and updates it. Returns the server's representation of the activeDirectoryIdentityProvider, and an error, if there is any.
-func (c *activeDirectoryIdentityProviders) Update(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	result = &v1alpha1.ActiveDirectoryIdentityProvider{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		Name(activeDirectoryIdentityProvider.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(activeDirectoryIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *activeDirectoryIdentityProviders) UpdateStatus(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	result = &v1alpha1.ActiveDirectoryIdentityProvider{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		Name(activeDirectoryIdentityProvider.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(activeDirectoryIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the activeDirectoryIdentityProvider and deletes it. Returns an error if one occurs.
-func (c *activeDirectoryIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *activeDirectoryIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched activeDirectoryIdentityProvider.
-func (c *activeDirectoryIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	result = &v1alpha1.ActiveDirectoryIdentityProvider{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("activedirectoryidentityproviders").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_activedirectoryidentityprovider.go

@@ -1,129 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeActiveDirectoryIdentityProviders implements ActiveDirectoryIdentityProviderInterface
-type FakeActiveDirectoryIdentityProviders struct {
-	Fake *FakeIDPV1alpha1
-	ns   string
-}
-
-var activedirectoryidentityprovidersResource = schema.GroupVersionResource{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "activedirectoryidentityproviders"}
-
-var activedirectoryidentityprovidersKind = schema.GroupVersionKind{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "ActiveDirectoryIdentityProvider"}
-
-// Get takes name of the activeDirectoryIdentityProvider, and returns the corresponding activeDirectoryIdentityProvider object, and an error if there is any.
-func (c *FakeActiveDirectoryIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(activedirectoryidentityprovidersResource, c.ns, name), &v1alpha1.ActiveDirectoryIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ActiveDirectoryIdentityProvider), err
-}
-
-// List takes label and field selectors, and returns the list of ActiveDirectoryIdentityProviders that match those selectors.
-func (c *FakeActiveDirectoryIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ActiveDirectoryIdentityProviderList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(activedirectoryidentityprovidersResource, activedirectoryidentityprovidersKind, c.ns, opts), &v1alpha1.ActiveDirectoryIdentityProviderList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.ActiveDirectoryIdentityProviderList{ListMeta: obj.(*v1alpha1.ActiveDirectoryIdentityProviderList).ListMeta}
-	for _, item := range obj.(*v1alpha1.ActiveDirectoryIdentityProviderList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested activeDirectoryIdentityProviders.
-func (c *FakeActiveDirectoryIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(activedirectoryidentityprovidersResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a activeDirectoryIdentityProvider and creates it.  Returns the server's representation of the activeDirectoryIdentityProvider, and an error, if there is any.
-func (c *FakeActiveDirectoryIdentityProviders) Create(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(activedirectoryidentityprovidersResource, c.ns, activeDirectoryIdentityProvider), &v1alpha1.ActiveDirectoryIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ActiveDirectoryIdentityProvider), err
-}
-
-// Update takes the representation of a activeDirectoryIdentityProvider and updates it. Returns the server's representation of the activeDirectoryIdentityProvider, and an error, if there is any.
-func (c *FakeActiveDirectoryIdentityProviders) Update(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(activedirectoryidentityprovidersResource, c.ns, activeDirectoryIdentityProvider), &v1alpha1.ActiveDirectoryIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ActiveDirectoryIdentityProvider), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeActiveDirectoryIdentityProviders) UpdateStatus(ctx context.Context, activeDirectoryIdentityProvider *v1alpha1.ActiveDirectoryIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.ActiveDirectoryIdentityProvider, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(activedirectoryidentityprovidersResource, "status", c.ns, activeDirectoryIdentityProvider), &v1alpha1.ActiveDirectoryIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ActiveDirectoryIdentityProvider), err
-}
-
-// Delete takes name of the activeDirectoryIdentityProvider and deletes it. Returns an error if one occurs.
-func (c *FakeActiveDirectoryIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(activedirectoryidentityprovidersResource, c.ns, name, opts), &v1alpha1.ActiveDirectoryIdentityProvider{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeActiveDirectoryIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(activedirectoryidentityprovidersResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.ActiveDirectoryIdentityProviderList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched activeDirectoryIdentityProvider.
-func (c *FakeActiveDirectoryIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ActiveDirectoryIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(activedirectoryidentityprovidersResource, c.ns, name, pt, data, subresources...), &v1alpha1.ActiveDirectoryIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ActiveDirectoryIdentityProvider), err
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_githubidentityprovider.go

@@ -1,129 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeGitHubIdentityProviders implements GitHubIdentityProviderInterface
-type FakeGitHubIdentityProviders struct {
-	Fake *FakeIDPV1alpha1
-	ns   string
-}
-
-var githubidentityprovidersResource = schema.GroupVersionResource{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "githubidentityproviders"}
-
-var githubidentityprovidersKind = schema.GroupVersionKind{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "GitHubIdentityProvider"}
-
-// Get takes name of the gitHubIdentityProvider, and returns the corresponding gitHubIdentityProvider object, and an error if there is any.
-func (c *FakeGitHubIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(githubidentityprovidersResource, c.ns, name), &v1alpha1.GitHubIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.GitHubIdentityProvider), err
-}
-
-// List takes label and field selectors, and returns the list of GitHubIdentityProviders that match those selectors.
-func (c *FakeGitHubIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.GitHubIdentityProviderList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(githubidentityprovidersResource, githubidentityprovidersKind, c.ns, opts), &v1alpha1.GitHubIdentityProviderList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.GitHubIdentityProviderList{ListMeta: obj.(*v1alpha1.GitHubIdentityProviderList).ListMeta}
-	for _, item := range obj.(*v1alpha1.GitHubIdentityProviderList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested gitHubIdentityProviders.
-func (c *FakeGitHubIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(githubidentityprovidersResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a gitHubIdentityProvider and creates it.  Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
-func (c *FakeGitHubIdentityProviders) Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(githubidentityprovidersResource, c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.GitHubIdentityProvider), err
-}
-
-// Update takes the representation of a gitHubIdentityProvider and updates it. Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
-func (c *FakeGitHubIdentityProviders) Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(githubidentityprovidersResource, c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.GitHubIdentityProvider), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeGitHubIdentityProviders) UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(githubidentityprovidersResource, "status", c.ns, gitHubIdentityProvider), &v1alpha1.GitHubIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.GitHubIdentityProvider), err
-}
-
-// Delete takes name of the gitHubIdentityProvider and deletes it. Returns an error if one occurs.
-func (c *FakeGitHubIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(githubidentityprovidersResource, c.ns, name, opts), &v1alpha1.GitHubIdentityProvider{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeGitHubIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(githubidentityprovidersResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.GitHubIdentityProviderList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched gitHubIdentityProvider.
-func (c *FakeGitHubIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(githubidentityprovidersResource, c.ns, name, pt, data, subresources...), &v1alpha1.GitHubIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.GitHubIdentityProvider), err
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_idp_client.go

@@ -1,39 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1"
-	rest "k8s.io/client-go/rest"
-	testing "k8s.io/client-go/testing"
-)
-
-type FakeIDPV1alpha1 struct {
-	*testing.Fake
-}
-
-func (c *FakeIDPV1alpha1) ActiveDirectoryIdentityProviders(namespace string) v1alpha1.ActiveDirectoryIdentityProviderInterface {
-	return &FakeActiveDirectoryIdentityProviders{c, namespace}
-}
-
-func (c *FakeIDPV1alpha1) GitHubIdentityProviders(namespace string) v1alpha1.GitHubIdentityProviderInterface {
-	return &FakeGitHubIdentityProviders{c, namespace}
-}
-
-func (c *FakeIDPV1alpha1) LDAPIdentityProviders(namespace string) v1alpha1.LDAPIdentityProviderInterface {
-	return &FakeLDAPIdentityProviders{c, namespace}
-}
-
-func (c *FakeIDPV1alpha1) OIDCIdentityProviders(namespace string) v1alpha1.OIDCIdentityProviderInterface {
-	return &FakeOIDCIdentityProviders{c, namespace}
-}
-
-// RESTClient returns a RESTClient that is used to communicate
-// with API server by this client implementation.
-func (c *FakeIDPV1alpha1) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_ldapidentityprovider.go

@@ -1,129 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeLDAPIdentityProviders implements LDAPIdentityProviderInterface
-type FakeLDAPIdentityProviders struct {
-	Fake *FakeIDPV1alpha1
-	ns   string
-}
-
-var ldapidentityprovidersResource = schema.GroupVersionResource{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "ldapidentityproviders"}
-
-var ldapidentityprovidersKind = schema.GroupVersionKind{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "LDAPIdentityProvider"}
-
-// Get takes name of the lDAPIdentityProvider, and returns the corresponding lDAPIdentityProvider object, and an error if there is any.
-func (c *FakeLDAPIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(ldapidentityprovidersResource, c.ns, name), &v1alpha1.LDAPIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.LDAPIdentityProvider), err
-}
-
-// List takes label and field selectors, and returns the list of LDAPIdentityProviders that match those selectors.
-func (c *FakeLDAPIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.LDAPIdentityProviderList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(ldapidentityprovidersResource, ldapidentityprovidersKind, c.ns, opts), &v1alpha1.LDAPIdentityProviderList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.LDAPIdentityProviderList{ListMeta: obj.(*v1alpha1.LDAPIdentityProviderList).ListMeta}
-	for _, item := range obj.(*v1alpha1.LDAPIdentityProviderList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested lDAPIdentityProviders.
-func (c *FakeLDAPIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(ldapidentityprovidersResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a lDAPIdentityProvider and creates it.  Returns the server's representation of the lDAPIdentityProvider, and an error, if there is any.
-func (c *FakeLDAPIdentityProviders) Create(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(ldapidentityprovidersResource, c.ns, lDAPIdentityProvider), &v1alpha1.LDAPIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.LDAPIdentityProvider), err
-}
-
-// Update takes the representation of a lDAPIdentityProvider and updates it. Returns the server's representation of the lDAPIdentityProvider, and an error, if there is any.
-func (c *FakeLDAPIdentityProviders) Update(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(ldapidentityprovidersResource, c.ns, lDAPIdentityProvider), &v1alpha1.LDAPIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.LDAPIdentityProvider), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeLDAPIdentityProviders) UpdateStatus(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.LDAPIdentityProvider, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(ldapidentityprovidersResource, "status", c.ns, lDAPIdentityProvider), &v1alpha1.LDAPIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.LDAPIdentityProvider), err
-}
-
-// Delete takes name of the lDAPIdentityProvider and deletes it. Returns an error if one occurs.
-func (c *FakeLDAPIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(ldapidentityprovidersResource, c.ns, name, opts), &v1alpha1.LDAPIdentityProvider{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeLDAPIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(ldapidentityprovidersResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.LDAPIdentityProviderList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched lDAPIdentityProvider.
-func (c *FakeLDAPIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(ldapidentityprovidersResource, c.ns, name, pt, data, subresources...), &v1alpha1.LDAPIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.LDAPIdentityProvider), err
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake/fake_oidcidentityprovider.go

@@ -1,129 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakeOIDCIdentityProviders implements OIDCIdentityProviderInterface
-type FakeOIDCIdentityProviders struct {
-	Fake *FakeIDPV1alpha1
-	ns   string
-}
-
-var oidcidentityprovidersResource = schema.GroupVersionResource{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcidentityproviders"}
-
-var oidcidentityprovidersKind = schema.GroupVersionKind{Group: "idp.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCIdentityProvider"}
-
-// Get takes name of the oIDCIdentityProvider, and returns the corresponding oIDCIdentityProvider object, and an error if there is any.
-func (c *FakeOIDCIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(oidcidentityprovidersResource, c.ns, name), &v1alpha1.OIDCIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCIdentityProvider), err
-}
-
-// List takes label and field selectors, and returns the list of OIDCIdentityProviders that match those selectors.
-func (c *FakeOIDCIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCIdentityProviderList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(oidcidentityprovidersResource, oidcidentityprovidersKind, c.ns, opts), &v1alpha1.OIDCIdentityProviderList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.OIDCIdentityProviderList{ListMeta: obj.(*v1alpha1.OIDCIdentityProviderList).ListMeta}
-	for _, item := range obj.(*v1alpha1.OIDCIdentityProviderList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested oIDCIdentityProviders.
-func (c *FakeOIDCIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(oidcidentityprovidersResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a oIDCIdentityProvider and creates it.  Returns the server's representation of the oIDCIdentityProvider, and an error, if there is any.
-func (c *FakeOIDCIdentityProviders) Create(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(oidcidentityprovidersResource, c.ns, oIDCIdentityProvider), &v1alpha1.OIDCIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCIdentityProvider), err
-}
-
-// Update takes the representation of a oIDCIdentityProvider and updates it. Returns the server's representation of the oIDCIdentityProvider, and an error, if there is any.
-func (c *FakeOIDCIdentityProviders) Update(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(oidcidentityprovidersResource, c.ns, oIDCIdentityProvider), &v1alpha1.OIDCIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCIdentityProvider), err
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeOIDCIdentityProviders) UpdateStatus(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.OIDCIdentityProvider, error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(oidcidentityprovidersResource, "status", c.ns, oIDCIdentityProvider), &v1alpha1.OIDCIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCIdentityProvider), err
-}
-
-// Delete takes name of the oIDCIdentityProvider and deletes it. Returns an error if one occurs.
-func (c *FakeOIDCIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(oidcidentityprovidersResource, c.ns, name, opts), &v1alpha1.OIDCIdentityProvider{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeOIDCIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(oidcidentityprovidersResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.OIDCIdentityProviderList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched oIDCIdentityProvider.
-func (c *FakeOIDCIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(oidcidentityprovidersResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCIdentityProvider{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.OIDCIdentityProvider), err
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/githubidentityprovider.go

@@ -1,182 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// GitHubIdentityProvidersGetter has a method to return a GitHubIdentityProviderInterface.
-// A group's client should implement this interface.
-type GitHubIdentityProvidersGetter interface {
-	GitHubIdentityProviders(namespace string) GitHubIdentityProviderInterface
-}
-
-// GitHubIdentityProviderInterface has methods to work with GitHubIdentityProvider resources.
-type GitHubIdentityProviderInterface interface {
-	Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (*v1alpha1.GitHubIdentityProvider, error)
-	Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error)
-	UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.GitHubIdentityProvider, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.GitHubIdentityProvider, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.GitHubIdentityProviderList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error)
-	GitHubIdentityProviderExpansion
-}
-
-// gitHubIdentityProviders implements GitHubIdentityProviderInterface
-type gitHubIdentityProviders struct {
-	client rest.Interface
-	ns     string
-}
-
-// newGitHubIdentityProviders returns a GitHubIdentityProviders
-func newGitHubIdentityProviders(c *IDPV1alpha1Client, namespace string) *gitHubIdentityProviders {
-	return &gitHubIdentityProviders{
-		client: c.RESTClient(),
-		ns:     namespace,
-	}
-}
-
-// Get takes name of the gitHubIdentityProvider, and returns the corresponding gitHubIdentityProvider object, and an error if there is any.
-func (c *gitHubIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	result = &v1alpha1.GitHubIdentityProvider{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of GitHubIdentityProviders that match those selectors.
-func (c *gitHubIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.GitHubIdentityProviderList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.GitHubIdentityProviderList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested gitHubIdentityProviders.
-func (c *gitHubIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a gitHubIdentityProvider and creates it.  Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
-func (c *gitHubIdentityProviders) Create(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	result = &v1alpha1.GitHubIdentityProvider{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(gitHubIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a gitHubIdentityProvider and updates it. Returns the server's representation of the gitHubIdentityProvider, and an error, if there is any.
-func (c *gitHubIdentityProviders) Update(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	result = &v1alpha1.GitHubIdentityProvider{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		Name(gitHubIdentityProvider.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(gitHubIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *gitHubIdentityProviders) UpdateStatus(ctx context.Context, gitHubIdentityProvider *v1alpha1.GitHubIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	result = &v1alpha1.GitHubIdentityProvider{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		Name(gitHubIdentityProvider.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(gitHubIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the gitHubIdentityProvider and deletes it. Returns an error if one occurs.
-func (c *gitHubIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *gitHubIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched gitHubIdentityProvider.
-func (c *gitHubIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.GitHubIdentityProvider, err error) {
-	result = &v1alpha1.GitHubIdentityProvider{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("githubidentityproviders").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/ldapidentityprovider.go

@@ -1,182 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// LDAPIdentityProvidersGetter has a method to return a LDAPIdentityProviderInterface.
-// A group's client should implement this interface.
-type LDAPIdentityProvidersGetter interface {
-	LDAPIdentityProviders(namespace string) LDAPIdentityProviderInterface
-}
-
-// LDAPIdentityProviderInterface has methods to work with LDAPIdentityProvider resources.
-type LDAPIdentityProviderInterface interface {
-	Create(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.CreateOptions) (*v1alpha1.LDAPIdentityProvider, error)
-	Update(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.LDAPIdentityProvider, error)
-	UpdateStatus(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.LDAPIdentityProvider, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.LDAPIdentityProvider, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.LDAPIdentityProviderList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.LDAPIdentityProvider, err error)
-	LDAPIdentityProviderExpansion
-}
-
-// lDAPIdentityProviders implements LDAPIdentityProviderInterface
-type lDAPIdentityProviders struct {
-	client rest.Interface
-	ns     string
-}
-
-// newLDAPIdentityProviders returns a LDAPIdentityProviders
-func newLDAPIdentityProviders(c *IDPV1alpha1Client, namespace string) *lDAPIdentityProviders {
-	return &lDAPIdentityProviders{
-		client: c.RESTClient(),
-		ns:     namespace,
-	}
-}
-
-// Get takes name of the lDAPIdentityProvider, and returns the corresponding lDAPIdentityProvider object, and an error if there is any.
-func (c *lDAPIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	result = &v1alpha1.LDAPIdentityProvider{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of LDAPIdentityProviders that match those selectors.
-func (c *lDAPIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.LDAPIdentityProviderList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.LDAPIdentityProviderList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested lDAPIdentityProviders.
-func (c *lDAPIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a lDAPIdentityProvider and creates it.  Returns the server's representation of the lDAPIdentityProvider, and an error, if there is any.
-func (c *lDAPIdentityProviders) Create(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	result = &v1alpha1.LDAPIdentityProvider{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(lDAPIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a lDAPIdentityProvider and updates it. Returns the server's representation of the lDAPIdentityProvider, and an error, if there is any.
-func (c *lDAPIdentityProviders) Update(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	result = &v1alpha1.LDAPIdentityProvider{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		Name(lDAPIdentityProvider.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(lDAPIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *lDAPIdentityProviders) UpdateStatus(ctx context.Context, lDAPIdentityProvider *v1alpha1.LDAPIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	result = &v1alpha1.LDAPIdentityProvider{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		Name(lDAPIdentityProvider.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(lDAPIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the lDAPIdentityProvider and deletes it. Returns an error if one occurs.
-func (c *lDAPIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *lDAPIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched lDAPIdentityProvider.
-func (c *lDAPIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.LDAPIdentityProvider, err error) {
-	result = &v1alpha1.LDAPIdentityProvider{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("ldapidentityproviders").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/supervisor/clientset/versioned/typed/idp/v1alpha1/oidcidentityprovider.go

@@ -1,182 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	scheme "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// OIDCIdentityProvidersGetter has a method to return a OIDCIdentityProviderInterface.
-// A group's client should implement this interface.
-type OIDCIdentityProvidersGetter interface {
-	OIDCIdentityProviders(namespace string) OIDCIdentityProviderInterface
-}
-
-// OIDCIdentityProviderInterface has methods to work with OIDCIdentityProvider resources.
-type OIDCIdentityProviderInterface interface {
-	Create(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.CreateOptions) (*v1alpha1.OIDCIdentityProvider, error)
-	Update(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.OIDCIdentityProvider, error)
-	UpdateStatus(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.UpdateOptions) (*v1alpha1.OIDCIdentityProvider, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCIdentityProvider, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCIdentityProviderList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCIdentityProvider, err error)
-	OIDCIdentityProviderExpansion
-}
-
-// oIDCIdentityProviders implements OIDCIdentityProviderInterface
-type oIDCIdentityProviders struct {
-	client rest.Interface
-	ns     string
-}
-
-// newOIDCIdentityProviders returns a OIDCIdentityProviders
-func newOIDCIdentityProviders(c *IDPV1alpha1Client, namespace string) *oIDCIdentityProviders {
-	return &oIDCIdentityProviders{
-		client: c.RESTClient(),
-		ns:     namespace,
-	}
-}
-
-// Get takes name of the oIDCIdentityProvider, and returns the corresponding oIDCIdentityProvider object, and an error if there is any.
-func (c *oIDCIdentityProviders) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	result = &v1alpha1.OIDCIdentityProvider{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of OIDCIdentityProviders that match those selectors.
-func (c *oIDCIdentityProviders) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCIdentityProviderList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.OIDCIdentityProviderList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested oIDCIdentityProviders.
-func (c *oIDCIdentityProviders) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a oIDCIdentityProvider and creates it.  Returns the server's representation of the oIDCIdentityProvider, and an error, if there is any.
-func (c *oIDCIdentityProviders) Create(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.CreateOptions) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	result = &v1alpha1.OIDCIdentityProvider{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(oIDCIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a oIDCIdentityProvider and updates it. Returns the server's representation of the oIDCIdentityProvider, and an error, if there is any.
-func (c *oIDCIdentityProviders) Update(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	result = &v1alpha1.OIDCIdentityProvider{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		Name(oIDCIdentityProvider.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(oIDCIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// UpdateStatus was generated because the type contains a Status member.
-// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *oIDCIdentityProviders) UpdateStatus(ctx context.Context, oIDCIdentityProvider *v1alpha1.OIDCIdentityProvider, opts v1.UpdateOptions) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	result = &v1alpha1.OIDCIdentityProvider{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		Name(oIDCIdentityProvider.Name).
-		SubResource("status").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(oIDCIdentityProvider).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the oIDCIdentityProvider and deletes it. Returns an error if one occurs.
-func (c *oIDCIdentityProviders) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *oIDCIdentityProviders) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched oIDCIdentityProvider.
-func (c *oIDCIdentityProviders) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCIdentityProvider, err error) {
-	result = &v1alpha1.OIDCIdentityProvider{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("oidcidentityproviders").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}

generated/1.26/client/supervisor/informers/externalversions/config/v1alpha1/federationdomain.go

@@ -1,77 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	time "time"
-
-	configv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	versioned "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned"
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/internalinterfaces"
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/listers/config/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	watch "k8s.io/apimachinery/pkg/watch"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// FederationDomainInformer provides access to a shared informer and lister for
-// FederationDomains.
-type FederationDomainInformer interface {
-	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.FederationDomainLister
-}
-
-type federationDomainInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-	namespace        string
-}
-
-// NewFederationDomainInformer constructs a new informer for FederationDomain type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFederationDomainInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredFederationDomainInformer(client, namespace, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredFederationDomainInformer constructs a new informer for FederationDomain type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredFederationDomainInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return cache.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ConfigV1alpha1().FederationDomains(namespace).List(context.TODO(), options)
-			},
-			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ConfigV1alpha1().FederationDomains(namespace).Watch(context.TODO(), options)
-			},
-		},
-		&configv1alpha1.FederationDomain{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *federationDomainInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredFederationDomainInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
-}
-
-func (f *federationDomainInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&configv1alpha1.FederationDomain{}, f.defaultInformer)
-}
-
-func (f *federationDomainInformer) Lister() v1alpha1.FederationDomainLister {
-	return v1alpha1.NewFederationDomainLister(f.Informer().GetIndexer())
-}

generated/1.26/client/supervisor/informers/externalversions/factory.go

@@ -1,244 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package externalversions
-
-import (
-	reflect "reflect"
-	sync "sync"
-	time "time"
-
-	versioned "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned"
-	config "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/config"
-	idp "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/idp"
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/internalinterfaces"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// SharedInformerOption defines the functional option type for SharedInformerFactory.
-type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
-
-type sharedInformerFactory struct {
-	client           versioned.Interface
-	namespace        string
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-	lock             sync.Mutex
-	defaultResync    time.Duration
-	customResync     map[reflect.Type]time.Duration
-
-	informers map[reflect.Type]cache.SharedIndexInformer
-	// startedInformers is used for tracking which informers have been started.
-	// This allows Start() to be called multiple times safely.
-	startedInformers map[reflect.Type]bool
-	// wg tracks how many goroutines were started.
-	wg sync.WaitGroup
-	// shuttingDown is true when Shutdown has been called. It may still be running
-	// because it needs to wait for goroutines.
-	shuttingDown bool
-}
-
-// WithCustomResyncConfig sets a custom resync period for the specified informer types.
-func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
-	return func(factory *sharedInformerFactory) *sharedInformerFactory {
-		for k, v := range resyncConfig {
-			factory.customResync[reflect.TypeOf(k)] = v
-		}
-		return factory
-	}
-}
-
-// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
-func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
-	return func(factory *sharedInformerFactory) *sharedInformerFactory {
-		factory.tweakListOptions = tweakListOptions
-		return factory
-	}
-}
-
-// WithNamespace limits the SharedInformerFactory to the specified namespace.
-func WithNamespace(namespace string) SharedInformerOption {
-	return func(factory *sharedInformerFactory) *sharedInformerFactory {
-		factory.namespace = namespace
-		return factory
-	}
-}
-
-// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
-func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
-	return NewSharedInformerFactoryWithOptions(client, defaultResync)
-}
-
-// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
-// Listers obtained via this SharedInformerFactory will be subject to the same filters
-// as specified here.
-// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
-func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
-	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
-}
-
-// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
-func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
-	factory := &sharedInformerFactory{
-		client:           client,
-		namespace:        v1.NamespaceAll,
-		defaultResync:    defaultResync,
-		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
-		startedInformers: make(map[reflect.Type]bool),
-		customResync:     make(map[reflect.Type]time.Duration),
-	}
-
-	// Apply all options
-	for _, opt := range options {
-		factory = opt(factory)
-	}
-
-	return factory
-}
-
-func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-
-	if f.shuttingDown {
-		return
-	}
-
-	for informerType, informer := range f.informers {
-		if !f.startedInformers[informerType] {
-			f.wg.Add(1)
-			// We need a new variable in each loop iteration,
-			// otherwise the goroutine would use the loop variable
-			// and that keeps changing.
-			informer := informer
-			go func() {
-				defer f.wg.Done()
-				informer.Run(stopCh)
-			}()
-			f.startedInformers[informerType] = true
-		}
-	}
-}
-
-func (f *sharedInformerFactory) Shutdown() {
-	f.lock.Lock()
-	f.shuttingDown = true
-	f.lock.Unlock()
-
-	// Will return immediately if there is nothing to wait for.
-	f.wg.Wait()
-}
-
-func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
-	informers := func() map[reflect.Type]cache.SharedIndexInformer {
-		f.lock.Lock()
-		defer f.lock.Unlock()
-
-		informers := map[reflect.Type]cache.SharedIndexInformer{}
-		for informerType, informer := range f.informers {
-			if f.startedInformers[informerType] {
-				informers[informerType] = informer
-			}
-		}
-		return informers
-	}()
-
-	res := map[reflect.Type]bool{}
-	for informType, informer := range informers {
-		res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced)
-	}
-	return res
-}
-
-// InternalInformerFor returns the SharedIndexInformer for obj using an internal
-// client.
-func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
-	f.lock.Lock()
-	defer f.lock.Unlock()
-
-	informerType := reflect.TypeOf(obj)
-	informer, exists := f.informers[informerType]
-	if exists {
-		return informer
-	}
-
-	resyncPeriod, exists := f.customResync[informerType]
-	if !exists {
-		resyncPeriod = f.defaultResync
-	}
-
-	informer = newFunc(f.client, resyncPeriod)
-	f.informers[informerType] = informer
-
-	return informer
-}
-
-// SharedInformerFactory provides shared informers for resources in all known
-// API group versions.
-//
-// It is typically used like this:
-//
-//	ctx, cancel := context.Background()
-//	defer cancel()
-//	factory := NewSharedInformerFactory(client, resyncPeriod)
-//	defer factory.WaitForStop()    // Returns immediately if nothing was started.
-//	genericInformer := factory.ForResource(resource)
-//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
-//	factory.Start(ctx.Done())          // Start processing these informers.
-//	synced := factory.WaitForCacheSync(ctx.Done())
-//	for v, ok := range synced {
-//	    if !ok {
-//	        fmt.Fprintf(os.Stderr, "caches failed to sync: %v", v)
-//	        return
-//	    }
-//	}
-//
-//	// Creating informers can also be created after Start, but then
-//	// Start must be called again:
-//	anotherGenericInformer := factory.ForResource(resource)
-//	factory.Start(ctx.Done())
-type SharedInformerFactory interface {
-	internalinterfaces.SharedInformerFactory
-
-	// Start initializes all requested informers. They are handled in goroutines
-	// which run until the stop channel gets closed.
-	Start(stopCh <-chan struct{})
-
-	// Shutdown marks a factory as shutting down. At that point no new
-	// informers can be started anymore and Start will return without
-	// doing anything.
-	//
-	// In addition, Shutdown blocks until all goroutines have terminated. For that
-	// to happen, the close channel(s) that they were started with must be closed,
-	// either before Shutdown gets called or while it is waiting.
-	//
-	// Shutdown may be called multiple times, even concurrently. All such calls will
-	// block until all goroutines have terminated.
-	Shutdown()
-
-	// WaitForCacheSync blocks until all started informers' caches were synced
-	// or the stop channel gets closed.
-	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
-
-	// ForResource gives generic access to a shared informer of the matching type.
-	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
-
-	// InternalInformerFor returns the SharedIndexInformer for obj using an internal
-	// client.
-	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
-
-	Config() config.Interface
-	IDP() idp.Interface
-}
-
-func (f *sharedInformerFactory) Config() config.Interface {
-	return config.New(f, f.namespace, f.tweakListOptions)
-}
-
-func (f *sharedInformerFactory) IDP() idp.Interface {
-	return idp.New(f, f.namespace, f.tweakListOptions)
-}

generated/1.26/client/supervisor/informers/externalversions/idp/interface.go

@@ -1,33 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package idp
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/idp/v1alpha1"
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/internalinterfaces"
-)
-
-// Interface provides access to each of this group's versions.
-type Interface interface {
-	// V1alpha1 provides access to shared informers for resources in V1alpha1.
-	V1alpha1() v1alpha1.Interface
-}
-
-type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	namespace        string
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// New returns a new Interface.
-func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
-	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
-}
-
-// V1alpha1 returns a new v1alpha1.Interface.
-func (g *group) V1alpha1() v1alpha1.Interface {
-	return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions)
-}

generated/1.26/client/supervisor/informers/externalversions/idp/v1alpha1/activedirectoryidentityprovider.go

@@ -1,77 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	time "time"
-
-	idpv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	versioned "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned"
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/internalinterfaces"
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/listers/idp/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	watch "k8s.io/apimachinery/pkg/watch"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// ActiveDirectoryIdentityProviderInformer provides access to a shared informer and lister for
-// ActiveDirectoryIdentityProviders.
-type ActiveDirectoryIdentityProviderInformer interface {
-	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.ActiveDirectoryIdentityProviderLister
-}
-
-type activeDirectoryIdentityProviderInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-	namespace        string
-}
-
-// NewActiveDirectoryIdentityProviderInformer constructs a new informer for ActiveDirectoryIdentityProvider type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewActiveDirectoryIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredActiveDirectoryIdentityProviderInformer(client, namespace, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredActiveDirectoryIdentityProviderInformer constructs a new informer for ActiveDirectoryIdentityProvider type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredActiveDirectoryIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return cache.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.IDPV1alpha1().ActiveDirectoryIdentityProviders(namespace).List(context.TODO(), options)
-			},
-			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.IDPV1alpha1().ActiveDirectoryIdentityProviders(namespace).Watch(context.TODO(), options)
-			},
-		},
-		&idpv1alpha1.ActiveDirectoryIdentityProvider{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *activeDirectoryIdentityProviderInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredActiveDirectoryIdentityProviderInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
-}
-
-func (f *activeDirectoryIdentityProviderInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&idpv1alpha1.ActiveDirectoryIdentityProvider{}, f.defaultInformer)
-}
-
-func (f *activeDirectoryIdentityProviderInformer) Lister() v1alpha1.ActiveDirectoryIdentityProviderLister {
-	return v1alpha1.NewActiveDirectoryIdentityProviderLister(f.Informer().GetIndexer())
-}

generated/1.26/client/supervisor/informers/externalversions/idp/v1alpha1/interface.go

@@ -1,53 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/internalinterfaces"
-)
-
-// Interface provides access to all the informers in this group version.
-type Interface interface {
-	// ActiveDirectoryIdentityProviders returns a ActiveDirectoryIdentityProviderInformer.
-	ActiveDirectoryIdentityProviders() ActiveDirectoryIdentityProviderInformer
-	// GitHubIdentityProviders returns a GitHubIdentityProviderInformer.
-	GitHubIdentityProviders() GitHubIdentityProviderInformer
-	// LDAPIdentityProviders returns a LDAPIdentityProviderInformer.
-	LDAPIdentityProviders() LDAPIdentityProviderInformer
-	// OIDCIdentityProviders returns a OIDCIdentityProviderInformer.
-	OIDCIdentityProviders() OIDCIdentityProviderInformer
-}
-
-type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	namespace        string
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// New returns a new Interface.
-func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
-	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
-}
-
-// ActiveDirectoryIdentityProviders returns a ActiveDirectoryIdentityProviderInformer.
-func (v *version) ActiveDirectoryIdentityProviders() ActiveDirectoryIdentityProviderInformer {
-	return &activeDirectoryIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
-}
-
-// GitHubIdentityProviders returns a GitHubIdentityProviderInformer.
-func (v *version) GitHubIdentityProviders() GitHubIdentityProviderInformer {
-	return &gitHubIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
-}
-
-// LDAPIdentityProviders returns a LDAPIdentityProviderInformer.
-func (v *version) LDAPIdentityProviders() LDAPIdentityProviderInformer {
-	return &lDAPIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
-}
-
-// OIDCIdentityProviders returns a OIDCIdentityProviderInformer.
-func (v *version) OIDCIdentityProviders() OIDCIdentityProviderInformer {
-	return &oIDCIdentityProviderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
-}

generated/1.26/client/supervisor/informers/externalversions/idp/v1alpha1/oidcidentityprovider.go

@@ -1,77 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	time "time"
-
-	idpv1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	versioned "go.pinniped.dev/generated/1.26/client/supervisor/clientset/versioned"
-	internalinterfaces "go.pinniped.dev/generated/1.26/client/supervisor/informers/externalversions/internalinterfaces"
-	v1alpha1 "go.pinniped.dev/generated/1.26/client/supervisor/listers/idp/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	watch "k8s.io/apimachinery/pkg/watch"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// OIDCIdentityProviderInformer provides access to a shared informer and lister for
-// OIDCIdentityProviders.
-type OIDCIdentityProviderInformer interface {
-	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.OIDCIdentityProviderLister
-}
-
-type oIDCIdentityProviderInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-	namespace        string
-}
-
-// NewOIDCIdentityProviderInformer constructs a new informer for OIDCIdentityProvider type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewOIDCIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredOIDCIdentityProviderInformer(client, namespace, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredOIDCIdentityProviderInformer constructs a new informer for OIDCIdentityProvider type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredOIDCIdentityProviderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return cache.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.IDPV1alpha1().OIDCIdentityProviders(namespace).List(context.TODO(), options)
-			},
-			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.IDPV1alpha1().OIDCIdentityProviders(namespace).Watch(context.TODO(), options)
-			},
-		},
-		&idpv1alpha1.OIDCIdentityProvider{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *oIDCIdentityProviderInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredOIDCIdentityProviderInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
-}
-
-func (f *oIDCIdentityProviderInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&idpv1alpha1.OIDCIdentityProvider{}, f.defaultInformer)
-}
-
-func (f *oIDCIdentityProviderInformer) Lister() v1alpha1.OIDCIdentityProviderLister {
-	return v1alpha1.NewOIDCIdentityProviderLister(f.Informer().GetIndexer())
-}

generated/1.26/client/supervisor/listers/config/v1alpha1/oidcclient.go

@@ -1,86 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by lister-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/config/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
-)
-
-// OIDCClientLister helps list OIDCClients.
-// All objects returned here must be treated as read-only.
-type OIDCClientLister interface {
-	// List lists all OIDCClients in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error)
-	// OIDCClients returns an object that can list and get OIDCClients.
-	OIDCClients(namespace string) OIDCClientNamespaceLister
-	OIDCClientListerExpansion
-}
-
-// oIDCClientLister implements the OIDCClientLister interface.
-type oIDCClientLister struct {
-	indexer cache.Indexer
-}
-
-// NewOIDCClientLister returns a new OIDCClientLister.
-func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister {
-	return &oIDCClientLister{indexer: indexer}
-}
-
-// List lists all OIDCClients in the indexer.
-func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.OIDCClient))
-	})
-	return ret, err
-}
-
-// OIDCClients returns an object that can list and get OIDCClients.
-func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister {
-	return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace}
-}
-
-// OIDCClientNamespaceLister helps list and get OIDCClients.
-// All objects returned here must be treated as read-only.
-type OIDCClientNamespaceLister interface {
-	// List lists all OIDCClients in the indexer for a given namespace.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error)
-	// Get retrieves the OIDCClient from the indexer for a given namespace and name.
-	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.OIDCClient, error)
-	OIDCClientNamespaceListerExpansion
-}
-
-// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister
-// interface.
-type oIDCClientNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all OIDCClients in the indexer for a given namespace.
-func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.OIDCClient))
-	})
-	return ret, err
-}
-
-// Get retrieves the OIDCClient from the indexer for a given namespace and name.
-func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name)
-	}
-	return obj.(*v1alpha1.OIDCClient), nil
-}

generated/1.26/client/supervisor/listers/idp/v1alpha1/githubidentityprovider.go

@@ -1,86 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by lister-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
-)
-
-// GitHubIdentityProviderLister helps list GitHubIdentityProviders.
-// All objects returned here must be treated as read-only.
-type GitHubIdentityProviderLister interface {
-	// List lists all GitHubIdentityProviders in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error)
-	// GitHubIdentityProviders returns an object that can list and get GitHubIdentityProviders.
-	GitHubIdentityProviders(namespace string) GitHubIdentityProviderNamespaceLister
-	GitHubIdentityProviderListerExpansion
-}
-
-// gitHubIdentityProviderLister implements the GitHubIdentityProviderLister interface.
-type gitHubIdentityProviderLister struct {
-	indexer cache.Indexer
-}
-
-// NewGitHubIdentityProviderLister returns a new GitHubIdentityProviderLister.
-func NewGitHubIdentityProviderLister(indexer cache.Indexer) GitHubIdentityProviderLister {
-	return &gitHubIdentityProviderLister{indexer: indexer}
-}
-
-// List lists all GitHubIdentityProviders in the indexer.
-func (s *gitHubIdentityProviderLister) List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.GitHubIdentityProvider))
-	})
-	return ret, err
-}
-
-// GitHubIdentityProviders returns an object that can list and get GitHubIdentityProviders.
-func (s *gitHubIdentityProviderLister) GitHubIdentityProviders(namespace string) GitHubIdentityProviderNamespaceLister {
-	return gitHubIdentityProviderNamespaceLister{indexer: s.indexer, namespace: namespace}
-}
-
-// GitHubIdentityProviderNamespaceLister helps list and get GitHubIdentityProviders.
-// All objects returned here must be treated as read-only.
-type GitHubIdentityProviderNamespaceLister interface {
-	// List lists all GitHubIdentityProviders in the indexer for a given namespace.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error)
-	// Get retrieves the GitHubIdentityProvider from the indexer for a given namespace and name.
-	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.GitHubIdentityProvider, error)
-	GitHubIdentityProviderNamespaceListerExpansion
-}
-
-// gitHubIdentityProviderNamespaceLister implements the GitHubIdentityProviderNamespaceLister
-// interface.
-type gitHubIdentityProviderNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all GitHubIdentityProviders in the indexer for a given namespace.
-func (s gitHubIdentityProviderNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.GitHubIdentityProvider, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.GitHubIdentityProvider))
-	})
-	return ret, err
-}
-
-// Get retrieves the GitHubIdentityProvider from the indexer for a given namespace and name.
-func (s gitHubIdentityProviderNamespaceLister) Get(name string) (*v1alpha1.GitHubIdentityProvider, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("githubidentityprovider"), name)
-	}
-	return obj.(*v1alpha1.GitHubIdentityProvider), nil
-}

generated/1.26/client/supervisor/listers/idp/v1alpha1/ldapidentityprovider.go

@@ -1,86 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by lister-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
-)
-
-// LDAPIdentityProviderLister helps list LDAPIdentityProviders.
-// All objects returned here must be treated as read-only.
-type LDAPIdentityProviderLister interface {
-	// List lists all LDAPIdentityProviders in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.LDAPIdentityProvider, err error)
-	// LDAPIdentityProviders returns an object that can list and get LDAPIdentityProviders.
-	LDAPIdentityProviders(namespace string) LDAPIdentityProviderNamespaceLister
-	LDAPIdentityProviderListerExpansion
-}
-
-// lDAPIdentityProviderLister implements the LDAPIdentityProviderLister interface.
-type lDAPIdentityProviderLister struct {
-	indexer cache.Indexer
-}
-
-// NewLDAPIdentityProviderLister returns a new LDAPIdentityProviderLister.
-func NewLDAPIdentityProviderLister(indexer cache.Indexer) LDAPIdentityProviderLister {
-	return &lDAPIdentityProviderLister{indexer: indexer}
-}
-
-// List lists all LDAPIdentityProviders in the indexer.
-func (s *lDAPIdentityProviderLister) List(selector labels.Selector) (ret []*v1alpha1.LDAPIdentityProvider, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.LDAPIdentityProvider))
-	})
-	return ret, err
-}
-
-// LDAPIdentityProviders returns an object that can list and get LDAPIdentityProviders.
-func (s *lDAPIdentityProviderLister) LDAPIdentityProviders(namespace string) LDAPIdentityProviderNamespaceLister {
-	return lDAPIdentityProviderNamespaceLister{indexer: s.indexer, namespace: namespace}
-}
-
-// LDAPIdentityProviderNamespaceLister helps list and get LDAPIdentityProviders.
-// All objects returned here must be treated as read-only.
-type LDAPIdentityProviderNamespaceLister interface {
-	// List lists all LDAPIdentityProviders in the indexer for a given namespace.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.LDAPIdentityProvider, err error)
-	// Get retrieves the LDAPIdentityProvider from the indexer for a given namespace and name.
-	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.LDAPIdentityProvider, error)
-	LDAPIdentityProviderNamespaceListerExpansion
-}
-
-// lDAPIdentityProviderNamespaceLister implements the LDAPIdentityProviderNamespaceLister
-// interface.
-type lDAPIdentityProviderNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all LDAPIdentityProviders in the indexer for a given namespace.
-func (s lDAPIdentityProviderNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.LDAPIdentityProvider, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.LDAPIdentityProvider))
-	})
-	return ret, err
-}
-
-// Get retrieves the LDAPIdentityProvider from the indexer for a given namespace and name.
-func (s lDAPIdentityProviderNamespaceLister) Get(name string) (*v1alpha1.LDAPIdentityProvider, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("ldapidentityprovider"), name)
-	}
-	return obj.(*v1alpha1.LDAPIdentityProvider), nil
-}

generated/1.26/client/supervisor/listers/idp/v1alpha1/oidcidentityprovider.go

@@ -1,86 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by lister-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	v1alpha1 "go.pinniped.dev/generated/1.26/apis/supervisor/idp/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
-)
-
-// OIDCIdentityProviderLister helps list OIDCIdentityProviders.
-// All objects returned here must be treated as read-only.
-type OIDCIdentityProviderLister interface {
-	// List lists all OIDCIdentityProviders in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.OIDCIdentityProvider, err error)
-	// OIDCIdentityProviders returns an object that can list and get OIDCIdentityProviders.
-	OIDCIdentityProviders(namespace string) OIDCIdentityProviderNamespaceLister
-	OIDCIdentityProviderListerExpansion
-}
-
-// oIDCIdentityProviderLister implements the OIDCIdentityProviderLister interface.
-type oIDCIdentityProviderLister struct {
-	indexer cache.Indexer
-}
-
-// NewOIDCIdentityProviderLister returns a new OIDCIdentityProviderLister.
-func NewOIDCIdentityProviderLister(indexer cache.Indexer) OIDCIdentityProviderLister {
-	return &oIDCIdentityProviderLister{indexer: indexer}
-}
-
-// List lists all OIDCIdentityProviders in the indexer.
-func (s *oIDCIdentityProviderLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCIdentityProvider, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.OIDCIdentityProvider))
-	})
-	return ret, err
-}
-
-// OIDCIdentityProviders returns an object that can list and get OIDCIdentityProviders.
-func (s *oIDCIdentityProviderLister) OIDCIdentityProviders(namespace string) OIDCIdentityProviderNamespaceLister {
-	return oIDCIdentityProviderNamespaceLister{indexer: s.indexer, namespace: namespace}
-}
-
-// OIDCIdentityProviderNamespaceLister helps list and get OIDCIdentityProviders.
-// All objects returned here must be treated as read-only.
-type OIDCIdentityProviderNamespaceLister interface {
-	// List lists all OIDCIdentityProviders in the indexer for a given namespace.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.OIDCIdentityProvider, err error)
-	// Get retrieves the OIDCIdentityProvider from the indexer for a given namespace and name.
-	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.OIDCIdentityProvider, error)
-	OIDCIdentityProviderNamespaceListerExpansion
-}
-
-// oIDCIdentityProviderNamespaceLister implements the OIDCIdentityProviderNamespaceLister
-// interface.
-type oIDCIdentityProviderNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all OIDCIdentityProviders in the indexer for a given namespace.
-func (s oIDCIdentityProviderNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCIdentityProvider, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.OIDCIdentityProvider))
-	})
-	return ret, err
-}
-
-// Get retrieves the OIDCIdentityProvider from the indexer for a given namespace and name.
-func (s oIDCIdentityProviderNamespaceLister) Get(name string) (*v1alpha1.OIDCIdentityProvider, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("oidcidentityprovider"), name)
-	}
-	return obj.(*v1alpha1.OIDCIdentityProvider), nil
-}

generated/1.26/crds/authentication.concierge.pinniped.dev_jwtauthenticators.yaml

@@ -1,214 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
-  name: jwtauthenticators.authentication.concierge.pinniped.dev
-spec:
-  group: authentication.concierge.pinniped.dev
-  names:
-    categories:
-    - pinniped
-    - pinniped-authenticator
-    - pinniped-authenticators
-    kind: JWTAuthenticator
-    listKind: JWTAuthenticatorList
-    plural: jwtauthenticators
-    singular: jwtauthenticator
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.issuer
-      name: Issuer
-      type: string
-    - jsonPath: .spec.audience
-      name: Audience
-      type: string
-    - jsonPath: .status.phase
-      name: Status
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: |-
-          JWTAuthenticator describes the configuration of a JWT authenticator.
-
-          Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
-          signature, existence of claims, etc.) and extract the username and groups from the token.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Spec for configuring the authenticator.
-            properties:
-              audience:
-                description: Audience is the required value of the "aud" JWT claim.
-                minLength: 1
-                type: string
-              claims:
-                description: |-
-                  Claims allows customization of the claims that will be mapped to user identity
-                  for Kubernetes access.
-                properties:
-                  groups:
-                    description: |-
-                      Groups is the name of the claim which should be read to extract the user's
-                      group membership from the JWT token. When not specified, it will default to "groups".
-                    type: string
-                  username:
-                    description: |-
-                      Username is the name of the claim which should be read to extract the
-                      username from the JWT token. When not specified, it will default to "username".
-                    type: string
-                type: object
-              issuer:
-                description: |-
-                  Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
-                  also used to validate the "iss" JWT claim.
-                minLength: 1
-                pattern: ^https://
-                type: string
-              tls:
-                description: TLS configuration for communicating with the OIDC provider.
-                properties:
-                  certificateAuthorityData:
-                    description: X.509 Certificate Authority (base64-encoded PEM bundle).
-                      If omitted, a default set of system roots will be trusted.
-                    type: string
-                  certificateAuthorityDataSource:
-                    description: |-
-                      Reference to a CA bundle in a secret or a configmap.
-                      Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
-                    properties:
-                      key:
-                        description: |-
-                          Key is the key name within the secret or configmap from which to read the CA bundle.
-                          The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
-                          certificate bundle.
-                        minLength: 1
-                        type: string
-                      kind:
-                        description: |-
-                          Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
-                          Allowed values are "Secret" or "ConfigMap".
-                          "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
-                          "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
-                        enum:
-                        - Secret
-                        - ConfigMap
-                        type: string
-                      name:
-                        description: |-
-                          Name is the resource name of the secret or configmap from which to read the CA bundle.
-                          The referenced secret or configmap must be created in the same namespace where Pinniped Concierge is installed.
-                        minLength: 1
-                        type: string
-                    required:
-                    - key
-                    - kind
-                    - name
-                    type: object
-                type: object
-            required:
-            - audience
-            - issuer
-            type: object
-          status:
-            description: Status of the authenticator.
-            properties:
-              conditions:
-                description: Represents the observations of the authenticator's current
-                  state.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              phase:
-                default: Pending
-                description: Phase summarizes the overall status of the JWTAuthenticator.
-                enum:
-                - Pending
-                - Ready
-                - Error
-                type: string
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}

generated/1.26/crds/config.concierge.pinniped.dev_credentialissuers.yaml

@@ -1,243 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
-  name: credentialissuers.config.concierge.pinniped.dev
-spec:
-  group: config.concierge.pinniped.dev
-  names:
-    categories:
-    - pinniped
-    kind: CredentialIssuer
-    listKind: CredentialIssuerList
-    plural: credentialissuers
-    singular: credentialissuer
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.impersonationProxy.mode
-      name: ProxyMode
-      type: string
-    - jsonPath: .status.strategies[?(@.status == "Success")].type
-      name: DefaultStrategy
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: CredentialIssuer describes the configuration and status of the
-          Pinniped Concierge credential issuer.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Spec describes the intended configuration of the Concierge.
-            properties:
-              impersonationProxy:
-                description: ImpersonationProxy describes the intended configuration
-                  of the Concierge impersonation proxy.
-                properties:
-                  externalEndpoint:
-                    description: |-
-                      ExternalEndpoint describes the HTTPS endpoint where the proxy will be exposed. If not set, the proxy will
-                      be served using the external name of the LoadBalancer service or the cluster service DNS name.
-
-                      This field must be non-empty when spec.impersonationProxy.service.type is "None".
-                    type: string
-                  mode:
-                    description: |-
-                      Mode configures whether the impersonation proxy should be started:
-                      - "disabled" explicitly disables the impersonation proxy. This is the default.
-                      - "enabled" explicitly enables the impersonation proxy.
-                      - "auto" enables or disables the impersonation proxy based upon the cluster in which it is running.
-                    enum:
-                    - auto
-                    - enabled
-                    - disabled
-                    type: string
-                  service:
-                    default:
-                      type: LoadBalancer
-                    description: Service describes the configuration of the Service
-                      provisioned to expose the impersonation proxy to clients.
-                    properties:
-                      annotations:
-                        additionalProperties:
-                          type: string
-                        description: Annotations specifies zero or more key/value
-                          pairs to set as annotations on the provisioned Service.
-                        type: object
-                      loadBalancerIP:
-                        description: |-
-                          LoadBalancerIP specifies the IP address to set in the spec.loadBalancerIP field of the provisioned Service.
-                          This is not supported on all cloud providers.
-                        maxLength: 255
-                        minLength: 1
-                        type: string
-                      type:
-                        default: LoadBalancer
-                        description: |-
-                          Type specifies the type of Service to provision for the impersonation proxy.
-
-                          If the type is "None", then the "spec.impersonationProxy.externalEndpoint" field must be set to a non-empty
-                          value so that the Concierge can properly advertise the endpoint in the CredentialIssuer's status.
-                        enum:
-                        - LoadBalancer
-                        - ClusterIP
-                        - None
-                        type: string
-                    type: object
-                  tls:
-                    description: |-
-                      TLS contains information about how the Concierge impersonation proxy should serve TLS.
-
-                      If this field is empty, the impersonation proxy will generate its own TLS certificate.
-                    properties:
-                      certificateAuthorityData:
-                        description: |-
-                          X.509 Certificate Authority (base64-encoded PEM bundle).
-                          Used to advertise the CA bundle for the impersonation proxy endpoint.
-                        type: string
-                      secretName:
-                        description: |-
-                          SecretName is the name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains
-                          the TLS serving certificate for the Concierge impersonation proxy endpoint.
-                        minLength: 1
-                        type: string
-                    type: object
-                required:
-                - mode
-                - service
-                type: object
-            required:
-            - impersonationProxy
-            type: object
-          status:
-            description: CredentialIssuerStatus describes the status of the Concierge.
-            properties:
-              strategies:
-                description: List of integration strategies that were attempted by
-                  Pinniped.
-                items:
-                  description: CredentialIssuerStrategy describes the status of an
-                    integration strategy that was attempted by Pinniped.
-                  properties:
-                    frontend:
-                      description: Frontend describes how clients can connect using
-                        this strategy.
-                      properties:
-                        impersonationProxyInfo:
-                          description: |-
-                            ImpersonationProxyInfo describes the parameters for the impersonation proxy on this Concierge.
-                            This field is only set when Type is "ImpersonationProxy".
-                          properties:
-                            certificateAuthorityData:
-                              description: CertificateAuthorityData is the base64-encoded
-                                PEM CA bundle of the impersonation proxy.
-                              minLength: 1
-                              type: string
-                            endpoint:
-                              description: Endpoint is the HTTPS endpoint of the impersonation
-                                proxy.
-                              minLength: 1
-                              pattern: ^https://
-                              type: string
-                          required:
-                          - certificateAuthorityData
-                          - endpoint
-                          type: object
-                        tokenCredentialRequestInfo:
-                          description: |-
-                            TokenCredentialRequestAPIInfo describes the parameters for the TokenCredentialRequest API on this Concierge.
-                            This field is only set when Type is "TokenCredentialRequestAPI".
-                          properties:
-                            certificateAuthorityData:
-                              description: CertificateAuthorityData is the base64-encoded
-                                Kubernetes API server CA bundle.
-                              minLength: 1
-                              type: string
-                            server:
-                              description: Server is the Kubernetes API server URL.
-                              minLength: 1
-                              pattern: ^https://|^http://
-                              type: string
-                          required:
-                          - certificateAuthorityData
-                          - server
-                          type: object
-                        type:
-                          description: Type describes which frontend mechanism clients
-                            can use with a strategy.
-                          enum:
-                          - TokenCredentialRequestAPI
-                          - ImpersonationProxy
-                          type: string
-                      required:
-                      - type
-                      type: object
-                    lastUpdateTime:
-                      description: When the status was last checked.
-                      format: date-time
-                      type: string
-                    message:
-                      description: Human-readable description of the current status.
-                      minLength: 1
-                      type: string
-                    reason:
-                      description: Reason for the current status.
-                      enum:
-                      - Listening
-                      - Pending
-                      - Disabled
-                      - ErrorDuringSetup
-                      - CouldNotFetchKey
-                      - CouldNotGetClusterInfo
-                      - FetchedKey
-                      type: string
-                    status:
-                      description: Status of the attempted integration strategy.
-                      enum:
-                      - Success
-                      - Error
-                      type: string
-                    type:
-                      description: Type of integration attempted.
-                      enum:
-                      - KubeClusterSigningCertificate
-                      - ImpersonationProxy
-                      type: string
-                  required:
-                  - lastUpdateTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-            required:
-            - strategies
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}

generated/1.26/crds/config.supervisor.pinniped.dev_federationdomains.yaml

@@ -1,456 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
-  name: federationdomains.config.supervisor.pinniped.dev
-spec:
-  group: config.supervisor.pinniped.dev
-  names:
-    categories:
-    - pinniped
-    kind: FederationDomain
-    listKind: FederationDomainList
-    plural: federationdomains
-    singular: federationdomain
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.issuer
-      name: Issuer
-      type: string
-    - jsonPath: .status.phase
-      name: Status
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: FederationDomain describes the configuration of an OIDC provider.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Spec of the OIDC provider.
-            properties:
-              identityProviders:
-                description: |-
-                  IdentityProviders is the list of identity providers available for use by this FederationDomain.
-
-                  An identity provider CR (e.g. OIDCIdentityProvider or LDAPIdentityProvider) describes how to connect to a server,
-                  how to talk in a specific protocol for authentication, and how to use the schema of that server/protocol to
-                  extract a normalized user identity. Normalized user identities include a username and a list of group names.
-                  In contrast, IdentityProviders describes how to use that normalized identity in those Kubernetes clusters which
-                  belong to this FederationDomain. Each entry in IdentityProviders can be configured with arbitrary transformations
-                  on that normalized identity. For example, a transformation can add a prefix to all usernames to help avoid
-                  accidental conflicts when multiple identity providers have different users with the same username (e.g.
-                  "idp1:ryan" versus "idp2:ryan"). Each entry in IdentityProviders can also implement arbitrary authentication
-                  rejection policies. Even though a user was able to authenticate with the identity provider, a policy can disallow
-                  the authentication to the Kubernetes clusters that belong to this FederationDomain. For example, a policy could
-                  disallow the authentication unless the user belongs to a specific group in the identity provider.
-
-                  For backwards compatibility with versions of Pinniped which predate support for multiple identity providers,
-                  an empty IdentityProviders list will cause the FederationDomain to use all available identity providers which
-                  exist in the same namespace, but also to reject all authentication requests when there is more than one identity
-                  provider currently defined. In this backwards compatibility mode, the name of the identity provider resource
-                  (e.g. the Name of an OIDCIdentityProvider resource) will be used as the name of the identity provider in this
-                  FederationDomain. This mode is provided to make upgrading from older versions easier. However, instead of
-                  relying on this backwards compatibility mode, please consider this mode to be deprecated and please instead
-                  explicitly list the identity provider using this IdentityProviders field.
-                items:
-                  description: FederationDomainIdentityProvider describes how an identity
-                    provider is made available in this FederationDomain.
-                  properties:
-                    displayName:
-                      description: |-
-                        DisplayName is the name of this identity provider as it will appear to clients. This name ends up in the
-                        kubeconfig of end users, so changing the name of an identity provider that is in use by end users will be a
-                        disruptive change for those users.
-                      minLength: 1
-                      type: string
-                    objectRef:
-                      description: |-
-                        ObjectRef is a reference to a Pinniped identity provider resource. A valid reference is required.
-                        If the reference cannot be resolved then the identity provider will not be made available.
-                        Must refer to a resource of one of the Pinniped identity provider types, e.g. OIDCIdentityProvider,
-                        LDAPIdentityProvider, ActiveDirectoryIdentityProvider.
-                      properties:
-                        apiGroup:
-                          description: |-
-                            APIGroup is the group for the resource being referenced.
-                            If APIGroup is not specified, the specified Kind must be in the core API group.
-                            For any other third-party types, APIGroup is required.
-                          type: string
-                        kind:
-                          description: Kind is the type of resource being referenced
-                          type: string
-                        name:
-                          description: Name is the name of resource being referenced
-                          type: string
-                      required:
-                      - kind
-                      - name
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    transforms:
-                      description: |-
-                        Transforms is an optional way to specify transformations to be applied during user authentication and
-                        session refresh.
-                      properties:
-                        constants:
-                          description: Constants defines constant variables and their
-                            values which will be made available to the transform expressions.
-                          items:
-                            description: |-
-                              FederationDomainTransformsConstant defines a constant variable and its value which will be made available to
-                              the transform expressions. This is a union type, and Type is the discriminator field.
-                            properties:
-                              name:
-                                description: Name determines the name of the constant.
-                                  It must be a valid identifier name.
-                                maxLength: 64
-                                minLength: 1
-                                pattern: ^[a-zA-Z][_a-zA-Z0-9]*$
-                                type: string
-                              stringListValue:
-                                description: StringListValue should hold the value
-                                  when Type is "stringList", and is otherwise ignored.
-                                items:
-                                  type: string
-                                type: array
-                              stringValue:
-                                description: StringValue should hold the value when
-                                  Type is "string", and is otherwise ignored.
-                                type: string
-                              type:
-                                description: |-
-                                  Type determines the type of the constant, and indicates which other field should be non-empty.
-                                  Allowed values are "string" or "stringList".
-                                enum:
-                                - string
-                                - stringList
-                                type: string
-                            required:
-                            - name
-                            - type
-                            type: object
-                          type: array
-                          x-kubernetes-list-map-keys:
-                          - name
-                          x-kubernetes-list-type: map
-                        examples:
-                          description: |-
-                            Examples can optionally be used to ensure that the sequence of transformation expressions are working as
-                            expected. Examples define sample input identities which are then run through the expression list, and the
-                            results are compared to the expected results. If any example in this list fails, then this
-                            identity provider will not be available for use within this FederationDomain, and the error(s) will be
-                            added to the FederationDomain status. This can be used to help guard against programming mistakes in the
-                            expressions, and also act as living documentation for other administrators to better understand the expressions.
-                          items:
-                            description: FederationDomainTransformsExample defines
-                              a transform example.
-                            properties:
-                              expects:
-                                description: |-
-                                  Expects is the expected output of the entire sequence of transforms when they are run against the
-                                  input Username and Groups.
-                                properties:
-                                  groups:
-                                    description: Groups is the expected list of group
-                                      names after the transformations have been applied.
-                                    items:
-                                      type: string
-                                    type: array
-                                  message:
-                                    description: |-
-                                      Message is the expected error message of the transforms. When Rejected is true, then Message is the expected
-                                      message for the policy which rejected the authentication attempt. When Rejected is true and Message is blank,
-                                      then Message will be treated as the default error message for authentication attempts which are rejected by a
-                                      policy. When Rejected is false, then Message is the expected error message for some other non-policy
-                                      transformation error, such as a runtime error. When Rejected is false, there is no default expected Message.
-                                    type: string
-                                  rejected:
-                                    description: |-
-                                      Rejected is a boolean that indicates whether authentication is expected to be rejected by a policy expression
-                                      after the transformations have been applied. True means that it is expected that the authentication would be
-                                      rejected. The default value of false means that it is expected that the authentication would not be rejected
-                                      by any policy expression.
-                                    type: boolean
-                                  username:
-                                    description: Username is the expected username
-                                      after the transformations have been applied.
-                                    type: string
-                                type: object
-                              groups:
-                                description: Groups is the input list of group names.
-                                items:
-                                  type: string
-                                type: array
-                              username:
-                                description: Username is the input username.
-                                minLength: 1
-                                type: string
-                            required:
-                            - expects
-                            - username
-                            type: object
-                          type: array
-                        expressions:
-                          description: |-
-                            Expressions are an optional list of transforms and policies to be executed in the order given during every
-                            authentication attempt, including during every session refresh.
-                            Each is a CEL expression. It may use the basic CEL language as defined in
-                            https://github.com/google/cel-spec/blob/master/doc/langdef.md plus the CEL string extensions defined in
-                            https://github.com/google/cel-go/tree/master/ext#strings.
-
-                            The username and groups extracted from the identity provider, and the constants defined in this CR, are
-                            available as variables in all expressions. The username is provided via a variable called `username` and
-                            the list of group names is provided via a variable called `groups` (which may be an empty list).
-                            Each user-provided constants is provided via a variable named `strConst.varName` for string constants
-                            and `strListConst.varName` for string list constants.
-
-                            The only allowed types for expressions are currently policy/v1, username/v1, and groups/v1.
-                            Each policy/v1 must return a boolean, and when it returns false, no more expressions from the list are evaluated
-                            and the authentication attempt is rejected.
-                            Transformations of type policy/v1 do not return usernames or group names, and therefore cannot change the
-                            username or group names.
-                            Each username/v1 transform must return the new username (a string), which can be the same as the old username.
-                            Transformations of type username/v1 do not return group names, and therefore cannot change the group names.
-                            Each groups/v1 transform must return the new groups list (list of strings), which can be the same as the old
-                            groups list.
-                            Transformations of type groups/v1 do not return usernames, and therefore cannot change the usernames.
-                            After each expression, the new (potentially changed) username or groups get passed to the following expression.
-
-                            Any compilation or static type-checking failure of any expression will cause an error status on the FederationDomain.
-                            During an authentication attempt, any unexpected runtime evaluation errors (e.g. division by zero) cause the
-                            authentication attempt to fail. When all expressions evaluate successfully, then the (potentially changed) username
-                            and group names have been decided for that authentication attempt.
-                          items:
-                            description: FederationDomainTransformsExpression defines
-                              a transform expression.
-                            properties:
-                              expression:
-                                description: Expression is a CEL expression that will
-                                  be evaluated based on the Type during an authentication.
-                                minLength: 1
-                                type: string
-                              message:
-                                description: |-
-                                  Message is only used when Type is policy/v1. It defines an error message to be used when the policy rejects
-                                  an authentication attempt. When empty, a default message will be used.
-                                type: string
-                              type:
-                                description: |-
-                                  Type determines the type of the expression. It must be one of the supported types.
-                                  Allowed values are "policy/v1", "username/v1", or "groups/v1".
-                                enum:
-                                - policy/v1
-                                - username/v1
-                                - groups/v1
-                                type: string
-                            required:
-                            - expression
-                            - type
-                            type: object
-                          type: array
-                      type: object
-                  required:
-                  - displayName
-                  - objectRef
-                  type: object
-                type: array
-              issuer:
-                description: |-
-                  Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the
-                  identifier that it will use for the iss claim in issued JWTs. This field will also be used as
-                  the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is
-                  https://example.com/foo, then your authorization endpoint will look like
-                  https://example.com/foo/some/path/to/auth/endpoint).
-
-                  See
-                  https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information.
-                minLength: 1
-                type: string
-                x-kubernetes-validations:
-                - message: issuer must be an HTTPS URL
-                  rule: isURL(self) && url(self).getScheme() == 'https'
-              tls:
-                description: TLS specifies a secret which will contain Transport Layer
-                  Security (TLS) configuration for the FederationDomain.
-                properties:
-                  secretName:
-                    description: |-
-                      SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains
-                      the TLS serving certificate for the HTTPS endpoints served by this FederationDomain. When provided, the TLS Secret
-                      named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use
-                      for TLS.
-
-                      Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) supported by all major browsers.
-
-                      SecretName is required if you would like to use different TLS certificates for issuers of different hostnames.
-                      SNI requests do not include port numbers, so all issuers with the same DNS hostname must use the same
-                      SecretName value even if they have different port numbers.
-
-                      SecretName is not required when you would like to use only the HTTP endpoints (e.g. when the HTTP listener is
-                      configured to listen on loopback interfaces or UNIX domain sockets for traffic from a service mesh sidecar).
-                      It is also not required when you would like all requests to this OIDC Provider's HTTPS endpoints to
-                      use the default TLS certificate, which is configured elsewhere.
-
-                      When your Issuer URL's host is an IP address, then this field is ignored. SNI does not work for IP addresses.
-                    type: string
-                type: object
-            required:
-            - issuer
-            type: object
-          status:
-            description: Status of the OIDC provider.
-            properties:
-              conditions:
-                description: Conditions represent the observations of an FederationDomain's
-                  current state.
-                items:
-                  description: Condition contains details for one aspect of the current
-                    state of this API Resource.
-                  properties:
-                    lastTransitionTime:
-                      description: |-
-                        lastTransitionTime is the last time the condition transitioned from one status to another.
-                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                      format: date-time
-                      type: string
-                    message:
-                      description: |-
-                        message is a human readable message indicating details about the transition.
-                        This may be an empty string.
-                      maxLength: 32768
-                      type: string
-                    observedGeneration:
-                      description: |-
-                        observedGeneration represents the .metadata.generation that the condition was set based upon.
-                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                        with respect to the current state of the instance.
-                      format: int64
-                      minimum: 0
-                      type: integer
-                    reason:
-                      description: |-
-                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                        Producers of specific condition types may define expected values and meanings for this field,
-                        and whether the values are considered a guaranteed API.
-                        The value should be a CamelCase string.
-                        This field may not be empty.
-                      maxLength: 1024
-                      minLength: 1
-                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                      type: string
-                    status:
-                      description: status of the condition, one of True, False, Unknown.
-                      enum:
-                      - "True"
-                      - "False"
-                      - Unknown
-                      type: string
-                    type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                      maxLength: 316
-                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                      type: string
-                  required:
-                  - lastTransitionTime
-                  - message
-                  - reason
-                  - status
-                  - type
-                  type: object
-                type: array
-                x-kubernetes-list-map-keys:
-                - type
-                x-kubernetes-list-type: map
-              phase:
-                default: Pending
-                description: Phase summarizes the overall status of the FederationDomain.
-                enum:
-                - Pending
-                - Ready
-                - Error
-                type: string
-              secrets:
-                description: Secrets contains information about this OIDC Provider's
-                  secrets.
-                properties:
-                  jwks:
-                    description: |-
-                      JWKS holds the name of the corev1.Secret in which this OIDC Provider's signing/verification keys are
-                      stored. If it is empty, then the signing/verification keys are either unknown or they don't
-                      exist.
-                    properties:
-                      name:
-                        description: |-
-                          Name of the referent.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  stateEncryptionKey:
-                    description: |-
-                      StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
-                      encrypting state parameters is stored.
-                    properties:
-                      name:
-                        description: |-
-                          Name of the referent.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  stateSigningKey:
-                    description: |-
-                      StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
-                      signing state parameters is stored.
-                    properties:
-                      name:
-                        description: |-
-                          Name of the referent.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  tokenSigningKey:
-                    description: |-
-                      TokenSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for
-                      signing tokens is stored.
-                    properties:
-                      name:
-                        description: |-
-                          Name of the referent.
-                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                        type: string
-                    type: object
-                    x-kubernetes-map-type: atomic
-                type: object
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}

generated/1.27/apis/concierge/authentication/v1alpha1/types_jwtauthenticator.go

@@ -1,103 +0,0 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-type JWTAuthenticatorPhase string
-
-const (
-	// JWTAuthenticatorPhasePending is the default phase for newly-created JWTAuthenticator resources.
-	JWTAuthenticatorPhasePending JWTAuthenticatorPhase = "Pending"
-
-	// JWTAuthenticatorPhaseReady is the phase for an JWTAuthenticator resource in a healthy state.
-	JWTAuthenticatorPhaseReady JWTAuthenticatorPhase = "Ready"
-
-	// JWTAuthenticatorPhaseError is the phase for an JWTAuthenticator in an unhealthy state.
-	JWTAuthenticatorPhaseError JWTAuthenticatorPhase = "Error"
-)
-
-// Status of a JWT authenticator.
-type JWTAuthenticatorStatus struct {
-	// Represents the observations of the authenticator's current state.
-	// +patchMergeKey=type
-	// +patchStrategy=merge
-	// +listType=map
-	// +listMapKey=type
-	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
-	// Phase summarizes the overall status of the JWTAuthenticator.
-	// +kubebuilder:default=Pending
-	// +kubebuilder:validation:Enum=Pending;Ready;Error
-	Phase JWTAuthenticatorPhase `json:"phase,omitempty"`
-}
-
-// Spec for configuring a JWT authenticator.
-type JWTAuthenticatorSpec struct {
-	// Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
-	// also used to validate the "iss" JWT claim.
-	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:Pattern=`^https://`
-	Issuer string `json:"issuer"`
-
-	// Audience is the required value of the "aud" JWT claim.
-	// +kubebuilder:validation:MinLength=1
-	Audience string `json:"audience"`
-
-	// Claims allows customization of the claims that will be mapped to user identity
-	// for Kubernetes access.
-	// +optional
-	Claims JWTTokenClaims `json:"claims"`
-
-	// TLS configuration for communicating with the OIDC provider.
-	// +optional
-	TLS *TLSSpec `json:"tls,omitempty"`
-}
-
-// JWTTokenClaims allows customization of the claims that will be mapped to user identity
-// for Kubernetes access.
-type JWTTokenClaims struct {
-	// Groups is the name of the claim which should be read to extract the user's
-	// group membership from the JWT token. When not specified, it will default to "groups".
-	// +optional
-	Groups string `json:"groups"`
-
-	// Username is the name of the claim which should be read to extract the
-	// username from the JWT token. When not specified, it will default to "username".
-	// +optional
-	Username string `json:"username"`
-}
-
-// JWTAuthenticator describes the configuration of a JWT authenticator.
-//
-// Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
-// signature, existence of claims, etc.) and extract the username and groups from the token.
-//
-// +genclient
-// +genclient:nonNamespaced
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:resource:categories=pinniped;pinniped-authenticator;pinniped-authenticators,scope=Cluster
-// +kubebuilder:printcolumn:name="Issuer",type=string,JSONPath=`.spec.issuer`
-// +kubebuilder:printcolumn:name="Audience",type=string,JSONPath=`.spec.audience`
-// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.phase`
-// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
-// +kubebuilder:subresource:status
-type JWTAuthenticator struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	// Spec for configuring the authenticator.
-	Spec JWTAuthenticatorSpec `json:"spec"`
-
-	// Status of the authenticator.
-	Status JWTAuthenticatorStatus `json:"status,omitempty"`
-}
-
-// List of JWTAuthenticator objects.
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-type JWTAuthenticatorList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-
-	Items []JWTAuthenticator `json:"items"`
-}

generated/1.27/apis/concierge/identity/v1alpha1/zz_generated.conversion.go

@@ -1,235 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by conversion-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	unsafe "unsafe"
-
-	identity "go.pinniped.dev/generated/1.27/apis/concierge/identity"
-	conversion "k8s.io/apimachinery/pkg/conversion"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	localSchemeBuilder.Register(RegisterConversions)
-}
-
-// RegisterConversions adds conversion functions to the given scheme.
-// Public to allow building arbitrary schemes.
-func RegisterConversions(s *runtime.Scheme) error {
-	if err := s.AddGeneratedConversionFunc((*KubernetesUserInfo)(nil), (*identity.KubernetesUserInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_KubernetesUserInfo_To_identity_KubernetesUserInfo(a.(*KubernetesUserInfo), b.(*identity.KubernetesUserInfo), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*identity.KubernetesUserInfo)(nil), (*KubernetesUserInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_identity_KubernetesUserInfo_To_v1alpha1_KubernetesUserInfo(a.(*identity.KubernetesUserInfo), b.(*KubernetesUserInfo), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*UserInfo)(nil), (*identity.UserInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_UserInfo_To_identity_UserInfo(a.(*UserInfo), b.(*identity.UserInfo), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*identity.UserInfo)(nil), (*UserInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_identity_UserInfo_To_v1alpha1_UserInfo(a.(*identity.UserInfo), b.(*UserInfo), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*WhoAmIRequest)(nil), (*identity.WhoAmIRequest)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_WhoAmIRequest_To_identity_WhoAmIRequest(a.(*WhoAmIRequest), b.(*identity.WhoAmIRequest), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*identity.WhoAmIRequest)(nil), (*WhoAmIRequest)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_identity_WhoAmIRequest_To_v1alpha1_WhoAmIRequest(a.(*identity.WhoAmIRequest), b.(*WhoAmIRequest), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*WhoAmIRequestList)(nil), (*identity.WhoAmIRequestList)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_WhoAmIRequestList_To_identity_WhoAmIRequestList(a.(*WhoAmIRequestList), b.(*identity.WhoAmIRequestList), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*identity.WhoAmIRequestList)(nil), (*WhoAmIRequestList)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_identity_WhoAmIRequestList_To_v1alpha1_WhoAmIRequestList(a.(*identity.WhoAmIRequestList), b.(*WhoAmIRequestList), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*WhoAmIRequestSpec)(nil), (*identity.WhoAmIRequestSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_WhoAmIRequestSpec_To_identity_WhoAmIRequestSpec(a.(*WhoAmIRequestSpec), b.(*identity.WhoAmIRequestSpec), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*identity.WhoAmIRequestSpec)(nil), (*WhoAmIRequestSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_identity_WhoAmIRequestSpec_To_v1alpha1_WhoAmIRequestSpec(a.(*identity.WhoAmIRequestSpec), b.(*WhoAmIRequestSpec), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*WhoAmIRequestStatus)(nil), (*identity.WhoAmIRequestStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1alpha1_WhoAmIRequestStatus_To_identity_WhoAmIRequestStatus(a.(*WhoAmIRequestStatus), b.(*identity.WhoAmIRequestStatus), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*identity.WhoAmIRequestStatus)(nil), (*WhoAmIRequestStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_identity_WhoAmIRequestStatus_To_v1alpha1_WhoAmIRequestStatus(a.(*identity.WhoAmIRequestStatus), b.(*WhoAmIRequestStatus), scope)
-	}); err != nil {
-		return err
-	}
-	return nil
-}
-
-func autoConvert_v1alpha1_KubernetesUserInfo_To_identity_KubernetesUserInfo(in *KubernetesUserInfo, out *identity.KubernetesUserInfo, s conversion.Scope) error {
-	if err := Convert_v1alpha1_UserInfo_To_identity_UserInfo(&in.User, &out.User, s); err != nil {
-		return err
-	}
-	out.Audiences = *(*[]string)(unsafe.Pointer(&in.Audiences))
-	return nil
-}
-
-// Convert_v1alpha1_KubernetesUserInfo_To_identity_KubernetesUserInfo is an autogenerated conversion function.
-func Convert_v1alpha1_KubernetesUserInfo_To_identity_KubernetesUserInfo(in *KubernetesUserInfo, out *identity.KubernetesUserInfo, s conversion.Scope) error {
-	return autoConvert_v1alpha1_KubernetesUserInfo_To_identity_KubernetesUserInfo(in, out, s)
-}
-
-func autoConvert_identity_KubernetesUserInfo_To_v1alpha1_KubernetesUserInfo(in *identity.KubernetesUserInfo, out *KubernetesUserInfo, s conversion.Scope) error {
-	if err := Convert_identity_UserInfo_To_v1alpha1_UserInfo(&in.User, &out.User, s); err != nil {
-		return err
-	}
-	out.Audiences = *(*[]string)(unsafe.Pointer(&in.Audiences))
-	return nil
-}
-
-// Convert_identity_KubernetesUserInfo_To_v1alpha1_KubernetesUserInfo is an autogenerated conversion function.
-func Convert_identity_KubernetesUserInfo_To_v1alpha1_KubernetesUserInfo(in *identity.KubernetesUserInfo, out *KubernetesUserInfo, s conversion.Scope) error {
-	return autoConvert_identity_KubernetesUserInfo_To_v1alpha1_KubernetesUserInfo(in, out, s)
-}
-
-func autoConvert_v1alpha1_UserInfo_To_identity_UserInfo(in *UserInfo, out *identity.UserInfo, s conversion.Scope) error {
-	out.Username = in.Username
-	out.UID = in.UID
-	out.Groups = *(*[]string)(unsafe.Pointer(&in.Groups))
-	out.Extra = *(*map[string]identity.ExtraValue)(unsafe.Pointer(&in.Extra))
-	return nil
-}
-
-// Convert_v1alpha1_UserInfo_To_identity_UserInfo is an autogenerated conversion function.
-func Convert_v1alpha1_UserInfo_To_identity_UserInfo(in *UserInfo, out *identity.UserInfo, s conversion.Scope) error {
-	return autoConvert_v1alpha1_UserInfo_To_identity_UserInfo(in, out, s)
-}
-
-func autoConvert_identity_UserInfo_To_v1alpha1_UserInfo(in *identity.UserInfo, out *UserInfo, s conversion.Scope) error {
-	out.Username = in.Username
-	out.UID = in.UID
-	out.Groups = *(*[]string)(unsafe.Pointer(&in.Groups))
-	out.Extra = *(*map[string]ExtraValue)(unsafe.Pointer(&in.Extra))
-	return nil
-}
-
-// Convert_identity_UserInfo_To_v1alpha1_UserInfo is an autogenerated conversion function.
-func Convert_identity_UserInfo_To_v1alpha1_UserInfo(in *identity.UserInfo, out *UserInfo, s conversion.Scope) error {
-	return autoConvert_identity_UserInfo_To_v1alpha1_UserInfo(in, out, s)
-}
-
-func autoConvert_v1alpha1_WhoAmIRequest_To_identity_WhoAmIRequest(in *WhoAmIRequest, out *identity.WhoAmIRequest, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
-	if err := Convert_v1alpha1_WhoAmIRequestSpec_To_identity_WhoAmIRequestSpec(&in.Spec, &out.Spec, s); err != nil {
-		return err
-	}
-	if err := Convert_v1alpha1_WhoAmIRequestStatus_To_identity_WhoAmIRequestStatus(&in.Status, &out.Status, s); err != nil {
-		return err
-	}
-	return nil
-}
-
-// Convert_v1alpha1_WhoAmIRequest_To_identity_WhoAmIRequest is an autogenerated conversion function.
-func Convert_v1alpha1_WhoAmIRequest_To_identity_WhoAmIRequest(in *WhoAmIRequest, out *identity.WhoAmIRequest, s conversion.Scope) error {
-	return autoConvert_v1alpha1_WhoAmIRequest_To_identity_WhoAmIRequest(in, out, s)
-}
-
-func autoConvert_identity_WhoAmIRequest_To_v1alpha1_WhoAmIRequest(in *identity.WhoAmIRequest, out *WhoAmIRequest, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
-	if err := Convert_identity_WhoAmIRequestSpec_To_v1alpha1_WhoAmIRequestSpec(&in.Spec, &out.Spec, s); err != nil {
-		return err
-	}
-	if err := Convert_identity_WhoAmIRequestStatus_To_v1alpha1_WhoAmIRequestStatus(&in.Status, &out.Status, s); err != nil {
-		return err
-	}
-	return nil
-}
-
-// Convert_identity_WhoAmIRequest_To_v1alpha1_WhoAmIRequest is an autogenerated conversion function.
-func Convert_identity_WhoAmIRequest_To_v1alpha1_WhoAmIRequest(in *identity.WhoAmIRequest, out *WhoAmIRequest, s conversion.Scope) error {
-	return autoConvert_identity_WhoAmIRequest_To_v1alpha1_WhoAmIRequest(in, out, s)
-}
-
-func autoConvert_v1alpha1_WhoAmIRequestList_To_identity_WhoAmIRequestList(in *WhoAmIRequestList, out *identity.WhoAmIRequestList, s conversion.Scope) error {
-	out.ListMeta = in.ListMeta
-	out.Items = *(*[]identity.WhoAmIRequest)(unsafe.Pointer(&in.Items))
-	return nil
-}
-
-// Convert_v1alpha1_WhoAmIRequestList_To_identity_WhoAmIRequestList is an autogenerated conversion function.
-func Convert_v1alpha1_WhoAmIRequestList_To_identity_WhoAmIRequestList(in *WhoAmIRequestList, out *identity.WhoAmIRequestList, s conversion.Scope) error {
-	return autoConvert_v1alpha1_WhoAmIRequestList_To_identity_WhoAmIRequestList(in, out, s)
-}
-
-func autoConvert_identity_WhoAmIRequestList_To_v1alpha1_WhoAmIRequestList(in *identity.WhoAmIRequestList, out *WhoAmIRequestList, s conversion.Scope) error {
-	out.ListMeta = in.ListMeta
-	out.Items = *(*[]WhoAmIRequest)(unsafe.Pointer(&in.Items))
-	return nil
-}
-
-// Convert_identity_WhoAmIRequestList_To_v1alpha1_WhoAmIRequestList is an autogenerated conversion function.
-func Convert_identity_WhoAmIRequestList_To_v1alpha1_WhoAmIRequestList(in *identity.WhoAmIRequestList, out *WhoAmIRequestList, s conversion.Scope) error {
-	return autoConvert_identity_WhoAmIRequestList_To_v1alpha1_WhoAmIRequestList(in, out, s)
-}
-
-func autoConvert_v1alpha1_WhoAmIRequestSpec_To_identity_WhoAmIRequestSpec(in *WhoAmIRequestSpec, out *identity.WhoAmIRequestSpec, s conversion.Scope) error {
-	return nil
-}
-
-// Convert_v1alpha1_WhoAmIRequestSpec_To_identity_WhoAmIRequestSpec is an autogenerated conversion function.
-func Convert_v1alpha1_WhoAmIRequestSpec_To_identity_WhoAmIRequestSpec(in *WhoAmIRequestSpec, out *identity.WhoAmIRequestSpec, s conversion.Scope) error {
-	return autoConvert_v1alpha1_WhoAmIRequestSpec_To_identity_WhoAmIRequestSpec(in, out, s)
-}
-
-func autoConvert_identity_WhoAmIRequestSpec_To_v1alpha1_WhoAmIRequestSpec(in *identity.WhoAmIRequestSpec, out *WhoAmIRequestSpec, s conversion.Scope) error {
-	return nil
-}
-
-// Convert_identity_WhoAmIRequestSpec_To_v1alpha1_WhoAmIRequestSpec is an autogenerated conversion function.
-func Convert_identity_WhoAmIRequestSpec_To_v1alpha1_WhoAmIRequestSpec(in *identity.WhoAmIRequestSpec, out *WhoAmIRequestSpec, s conversion.Scope) error {
-	return autoConvert_identity_WhoAmIRequestSpec_To_v1alpha1_WhoAmIRequestSpec(in, out, s)
-}
-
-func autoConvert_v1alpha1_WhoAmIRequestStatus_To_identity_WhoAmIRequestStatus(in *WhoAmIRequestStatus, out *identity.WhoAmIRequestStatus, s conversion.Scope) error {
-	if err := Convert_v1alpha1_KubernetesUserInfo_To_identity_KubernetesUserInfo(&in.KubernetesUserInfo, &out.KubernetesUserInfo, s); err != nil {
-		return err
-	}
-	return nil
-}
-
-// Convert_v1alpha1_WhoAmIRequestStatus_To_identity_WhoAmIRequestStatus is an autogenerated conversion function.
-func Convert_v1alpha1_WhoAmIRequestStatus_To_identity_WhoAmIRequestStatus(in *WhoAmIRequestStatus, out *identity.WhoAmIRequestStatus, s conversion.Scope) error {
-	return autoConvert_v1alpha1_WhoAmIRequestStatus_To_identity_WhoAmIRequestStatus(in, out, s)
-}
-
-func autoConvert_identity_WhoAmIRequestStatus_To_v1alpha1_WhoAmIRequestStatus(in *identity.WhoAmIRequestStatus, out *WhoAmIRequestStatus, s conversion.Scope) error {
-	if err := Convert_identity_KubernetesUserInfo_To_v1alpha1_KubernetesUserInfo(&in.KubernetesUserInfo, &out.KubernetesUserInfo, s); err != nil {
-		return err
-	}
-	return nil
-}
-
-// Convert_identity_WhoAmIRequestStatus_To_v1alpha1_WhoAmIRequestStatus is an autogenerated conversion function.
-func Convert_identity_WhoAmIRequestStatus_To_v1alpha1_WhoAmIRequestStatus(in *identity.WhoAmIRequestStatus, out *WhoAmIRequestStatus, s conversion.Scope) error {
-	return autoConvert_identity_WhoAmIRequestStatus_To_v1alpha1_WhoAmIRequestStatus(in, out, s)
-}

generated/1.27/apis/concierge/identity/validation/validation.go

@@ -1,14 +0,0 @@
-// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package validation
-
-import (
-	"k8s.io/apimachinery/pkg/util/validation/field"
-
-	identityapi "go.pinniped.dev/generated/1.27/apis/concierge/identity"
-)
-
-func ValidateWhoAmIRequest(whoAmIRequest *identityapi.WhoAmIRequest) field.ErrorList {
-	return nil // add validation for spec here if we expand it
-}