From cd47ba53c2ceebbec183a756b913546f1b308f9a Mon Sep 17 00:00:00 2001 From: Margo Crawford Date: Fri, 3 Jun 2022 16:22:15 -0700 Subject: [PATCH 1/4] Add CRD for OIDCClient Signed-off-by: Margo Crawford --- apis/supervisor/oauth/v1alpha1/doc.go.tmpl | 10 + .../oauth/v1alpha1/register.go.tmpl | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go.tmpl | 84 ++++++++ ...h.supervisor.pinniped.dev_oidcclients.yaml | 121 ++++++++++++ generated/1.17/README.adoc | 54 ++++++ .../apis/supervisor/oauth/v1alpha1/doc.go | 10 + .../supervisor/oauth/v1alpha1/register.go | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go | 84 ++++++++ .../oauth/v1alpha1/zz_generated.deepcopy.go | 121 ++++++++++++ .../clientset/versioned/clientset.go | 14 ++ .../versioned/fake/clientset_generated.go | 7 + .../clientset/versioned/fake/register.go | 2 + .../clientset/versioned/scheme/register.go | 2 + .../versioned/typed/oauth/v1alpha1/doc.go | 7 + .../typed/oauth/v1alpha1/fake/doc.go | 7 + .../oauth/v1alpha1/fake/fake_oauth_client.go | 27 +++ .../oauth/v1alpha1/fake/fake_oidcclient.go | 127 ++++++++++++ .../oauth/v1alpha1/generated_expansion.go | 8 + .../typed/oauth/v1alpha1/oauth_client.go | 76 ++++++++ .../typed/oauth/v1alpha1/oidcclient.go | 178 +++++++++++++++++ .../informers/externalversions/factory.go | 6 + .../informers/externalversions/generic.go | 5 + .../externalversions/oauth/interface.go | 33 ++++ .../oauth/v1alpha1/interface.go | 32 +++ .../oauth/v1alpha1/oidcclient.go | 76 ++++++++ .../oauth/v1alpha1/expansion_generated.go | 14 ++ .../listers/oauth/v1alpha1/oidcclient.go | 81 ++++++++ ...h.supervisor.pinniped.dev_oidcclients.yaml | 121 ++++++++++++ generated/1.18/README.adoc | 54 ++++++ .../apis/supervisor/oauth/v1alpha1/doc.go | 10 + .../supervisor/oauth/v1alpha1/register.go | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go | 84 ++++++++ .../oauth/v1alpha1/zz_generated.deepcopy.go | 121 ++++++++++++ .../clientset/versioned/clientset.go | 14 ++ .../versioned/fake/clientset_generated.go | 7 + .../clientset/versioned/fake/register.go | 2 + .../clientset/versioned/scheme/register.go | 2 + .../versioned/typed/oauth/v1alpha1/doc.go | 7 + .../typed/oauth/v1alpha1/fake/doc.go | 7 + .../oauth/v1alpha1/fake/fake_oauth_client.go | 27 +++ .../oauth/v1alpha1/fake/fake_oidcclient.go | 129 +++++++++++++ .../oauth/v1alpha1/generated_expansion.go | 8 + .../typed/oauth/v1alpha1/oauth_client.go | 76 ++++++++ .../typed/oauth/v1alpha1/oidcclient.go | 182 ++++++++++++++++++ .../informers/externalversions/factory.go | 6 + .../informers/externalversions/generic.go | 5 + .../externalversions/oauth/interface.go | 33 ++++ .../oauth/v1alpha1/interface.go | 32 +++ .../oauth/v1alpha1/oidcclient.go | 77 ++++++++ .../oauth/v1alpha1/expansion_generated.go | 14 ++ .../listers/oauth/v1alpha1/oidcclient.go | 81 ++++++++ ...h.supervisor.pinniped.dev_oidcclients.yaml | 121 ++++++++++++ generated/1.19/README.adoc | 54 ++++++ .../apis/supervisor/oauth/v1alpha1/doc.go | 10 + .../supervisor/oauth/v1alpha1/register.go | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go | 84 ++++++++ .../oauth/v1alpha1/zz_generated.deepcopy.go | 121 ++++++++++++ .../clientset/versioned/clientset.go | 14 ++ .../versioned/fake/clientset_generated.go | 7 + .../clientset/versioned/fake/register.go | 2 + .../clientset/versioned/scheme/register.go | 2 + .../versioned/typed/oauth/v1alpha1/doc.go | 7 + .../typed/oauth/v1alpha1/fake/doc.go | 7 + .../oauth/v1alpha1/fake/fake_oauth_client.go | 27 +++ .../oauth/v1alpha1/fake/fake_oidcclient.go | 129 +++++++++++++ .../oauth/v1alpha1/generated_expansion.go | 8 + .../typed/oauth/v1alpha1/oauth_client.go | 76 ++++++++ .../typed/oauth/v1alpha1/oidcclient.go | 182 ++++++++++++++++++ .../informers/externalversions/factory.go | 6 + .../informers/externalversions/generic.go | 5 + .../externalversions/oauth/interface.go | 33 ++++ .../oauth/v1alpha1/interface.go | 32 +++ .../oauth/v1alpha1/oidcclient.go | 77 ++++++++ .../oauth/v1alpha1/expansion_generated.go | 14 ++ .../listers/oauth/v1alpha1/oidcclient.go | 86 +++++++++ ...h.supervisor.pinniped.dev_oidcclients.yaml | 121 ++++++++++++ generated/1.20/README.adoc | 54 ++++++ .../apis/supervisor/oauth/v1alpha1/doc.go | 10 + .../supervisor/oauth/v1alpha1/register.go | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go | 84 ++++++++ .../oauth/v1alpha1/zz_generated.deepcopy.go | 121 ++++++++++++ .../clientset/versioned/clientset.go | 14 ++ .../versioned/fake/clientset_generated.go | 7 + .../clientset/versioned/fake/register.go | 2 + .../clientset/versioned/scheme/register.go | 2 + .../versioned/typed/oauth/v1alpha1/doc.go | 7 + .../typed/oauth/v1alpha1/fake/doc.go | 7 + .../oauth/v1alpha1/fake/fake_oauth_client.go | 27 +++ .../oauth/v1alpha1/fake/fake_oidcclient.go | 129 +++++++++++++ .../oauth/v1alpha1/generated_expansion.go | 8 + .../typed/oauth/v1alpha1/oauth_client.go | 76 ++++++++ .../typed/oauth/v1alpha1/oidcclient.go | 182 ++++++++++++++++++ .../informers/externalversions/factory.go | 6 + .../informers/externalversions/generic.go | 5 + .../externalversions/oauth/interface.go | 33 ++++ .../oauth/v1alpha1/interface.go | 32 +++ .../oauth/v1alpha1/oidcclient.go | 77 ++++++++ .../oauth/v1alpha1/expansion_generated.go | 14 ++ .../listers/oauth/v1alpha1/oidcclient.go | 86 +++++++++ ...h.supervisor.pinniped.dev_oidcclients.yaml | 121 ++++++++++++ generated/1.21/README.adoc | 54 ++++++ .../apis/supervisor/oauth/v1alpha1/doc.go | 10 + .../supervisor/oauth/v1alpha1/register.go | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go | 84 ++++++++ .../oauth/v1alpha1/zz_generated.deepcopy.go | 121 ++++++++++++ .../clientset/versioned/clientset.go | 14 ++ .../versioned/fake/clientset_generated.go | 7 + .../clientset/versioned/fake/register.go | 2 + .../clientset/versioned/scheme/register.go | 2 + .../versioned/typed/oauth/v1alpha1/doc.go | 7 + .../typed/oauth/v1alpha1/fake/doc.go | 7 + .../oauth/v1alpha1/fake/fake_oauth_client.go | 27 +++ .../oauth/v1alpha1/fake/fake_oidcclient.go | 129 +++++++++++++ .../oauth/v1alpha1/generated_expansion.go | 8 + .../typed/oauth/v1alpha1/oauth_client.go | 76 ++++++++ .../typed/oauth/v1alpha1/oidcclient.go | 182 ++++++++++++++++++ .../informers/externalversions/factory.go | 6 + .../informers/externalversions/generic.go | 5 + .../externalversions/oauth/interface.go | 33 ++++ .../oauth/v1alpha1/interface.go | 32 +++ .../oauth/v1alpha1/oidcclient.go | 77 ++++++++ .../oauth/v1alpha1/expansion_generated.go | 14 ++ .../listers/oauth/v1alpha1/oidcclient.go | 86 +++++++++ ...h.supervisor.pinniped.dev_oidcclients.yaml | 121 ++++++++++++ generated/1.22/README.adoc | 54 ++++++ .../apis/supervisor/oauth/v1alpha1/doc.go | 10 + .../supervisor/oauth/v1alpha1/register.go | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go | 84 ++++++++ .../oauth/v1alpha1/zz_generated.deepcopy.go | 121 ++++++++++++ .../clientset/versioned/clientset.go | 14 ++ .../versioned/fake/clientset_generated.go | 7 + .../clientset/versioned/fake/register.go | 2 + .../clientset/versioned/scheme/register.go | 2 + .../versioned/typed/oauth/v1alpha1/doc.go | 7 + .../typed/oauth/v1alpha1/fake/doc.go | 7 + .../oauth/v1alpha1/fake/fake_oauth_client.go | 27 +++ .../oauth/v1alpha1/fake/fake_oidcclient.go | 129 +++++++++++++ .../oauth/v1alpha1/generated_expansion.go | 8 + .../typed/oauth/v1alpha1/oauth_client.go | 76 ++++++++ .../typed/oauth/v1alpha1/oidcclient.go | 182 ++++++++++++++++++ .../informers/externalversions/factory.go | 6 + .../informers/externalversions/generic.go | 5 + .../externalversions/oauth/interface.go | 33 ++++ .../oauth/v1alpha1/interface.go | 32 +++ .../oauth/v1alpha1/oidcclient.go | 77 ++++++++ .../oauth/v1alpha1/expansion_generated.go | 14 ++ .../listers/oauth/v1alpha1/oidcclient.go | 86 +++++++++ ...h.supervisor.pinniped.dev_oidcclients.yaml | 121 ++++++++++++ generated/1.23/README.adoc | 54 ++++++ .../apis/supervisor/oauth/v1alpha1/doc.go | 10 + .../supervisor/oauth/v1alpha1/register.go | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go | 84 ++++++++ .../oauth/v1alpha1/zz_generated.deepcopy.go | 121 ++++++++++++ .../clientset/versioned/clientset.go | 13 ++ .../versioned/fake/clientset_generated.go | 7 + .../clientset/versioned/fake/register.go | 2 + .../clientset/versioned/scheme/register.go | 2 + .../versioned/typed/oauth/v1alpha1/doc.go | 7 + .../typed/oauth/v1alpha1/fake/doc.go | 7 + .../oauth/v1alpha1/fake/fake_oauth_client.go | 27 +++ .../oauth/v1alpha1/fake/fake_oidcclient.go | 129 +++++++++++++ .../oauth/v1alpha1/generated_expansion.go | 8 + .../typed/oauth/v1alpha1/oauth_client.go | 94 +++++++++ .../typed/oauth/v1alpha1/oidcclient.go | 182 ++++++++++++++++++ .../informers/externalversions/factory.go | 6 + .../informers/externalversions/generic.go | 5 + .../externalversions/oauth/interface.go | 33 ++++ .../oauth/v1alpha1/interface.go | 32 +++ .../oauth/v1alpha1/oidcclient.go | 77 ++++++++ .../oauth/v1alpha1/expansion_generated.go | 14 ++ .../listers/oauth/v1alpha1/oidcclient.go | 86 +++++++++ ...h.supervisor.pinniped.dev_oidcclients.yaml | 121 ++++++++++++ .../apis/supervisor/oauth/v1alpha1/doc.go | 10 + .../supervisor/oauth/v1alpha1/register.go | 43 +++++ .../oauth/v1alpha1/types_oidcclient.go | 84 ++++++++ .../oauth/v1alpha1/zz_generated.deepcopy.go | 121 ++++++++++++ .../clientset/versioned/clientset.go | 13 ++ .../versioned/fake/clientset_generated.go | 7 + .../clientset/versioned/fake/register.go | 2 + .../clientset/versioned/scheme/register.go | 2 + .../versioned/typed/oauth/v1alpha1/doc.go | 7 + .../typed/oauth/v1alpha1/fake/doc.go | 7 + .../oauth/v1alpha1/fake/fake_oauth_client.go | 27 +++ .../oauth/v1alpha1/fake/fake_oidcclient.go | 129 +++++++++++++ .../oauth/v1alpha1/generated_expansion.go | 8 + .../typed/oauth/v1alpha1/oauth_client.go | 94 +++++++++ .../typed/oauth/v1alpha1/oidcclient.go | 182 ++++++++++++++++++ .../informers/externalversions/factory.go | 6 + .../informers/externalversions/generic.go | 5 + .../externalversions/oauth/interface.go | 33 ++++ .../oauth/v1alpha1/interface.go | 32 +++ .../oauth/v1alpha1/oidcclient.go | 77 ++++++++ .../oauth/v1alpha1/expansion_generated.go | 14 ++ .../listers/oauth/v1alpha1/oidcclient.go | 86 +++++++++ hack/lib/update-codegen.sh | 5 +- 195 files changed, 9279 insertions(+), 2 deletions(-) create mode 100644 apis/supervisor/oauth/v1alpha1/doc.go.tmpl create mode 100644 apis/supervisor/oauth/v1alpha1/register.go.tmpl create mode 100644 apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl create mode 100644 deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml create mode 100644 generated/1.17/apis/supervisor/oauth/v1alpha1/doc.go create mode 100644 generated/1.17/apis/supervisor/oauth/v1alpha1/register.go create mode 100644 generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go create mode 100644 generated/1.17/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go create mode 100644 generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go create mode 100644 generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go create mode 100644 generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go create mode 100644 generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go create mode 100644 generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go create mode 100644 generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go create mode 100644 generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.17/client/supervisor/informers/externalversions/oauth/interface.go create mode 100644 generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go create mode 100644 generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.17/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go create mode 100644 generated/1.17/client/supervisor/listers/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml create mode 100644 generated/1.18/apis/supervisor/oauth/v1alpha1/doc.go create mode 100644 generated/1.18/apis/supervisor/oauth/v1alpha1/register.go create mode 100644 generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go create mode 100644 generated/1.18/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go create mode 100644 generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go create mode 100644 generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go create mode 100644 generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go create mode 100644 generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go create mode 100644 generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go create mode 100644 generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go create mode 100644 generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.18/client/supervisor/informers/externalversions/oauth/interface.go create mode 100644 generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go create mode 100644 generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.18/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go create mode 100644 generated/1.18/client/supervisor/listers/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml create mode 100644 generated/1.19/apis/supervisor/oauth/v1alpha1/doc.go create mode 100644 generated/1.19/apis/supervisor/oauth/v1alpha1/register.go create mode 100644 generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go create mode 100644 generated/1.19/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go create mode 100644 generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go create mode 100644 generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go create mode 100644 generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go create mode 100644 generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go create mode 100644 generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go create mode 100644 generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go create mode 100644 generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.19/client/supervisor/informers/externalversions/oauth/interface.go create mode 100644 generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go create mode 100644 generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.19/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go create mode 100644 generated/1.19/client/supervisor/listers/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml create mode 100644 generated/1.20/apis/supervisor/oauth/v1alpha1/doc.go create mode 100644 generated/1.20/apis/supervisor/oauth/v1alpha1/register.go create mode 100644 generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go create mode 100644 generated/1.20/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go create mode 100644 generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go create mode 100644 generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go create mode 100644 generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go create mode 100644 generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go create mode 100644 generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go create mode 100644 generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go create mode 100644 generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.20/client/supervisor/informers/externalversions/oauth/interface.go create mode 100644 generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go create mode 100644 generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.20/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go create mode 100644 generated/1.20/client/supervisor/listers/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml create mode 100644 generated/1.21/apis/supervisor/oauth/v1alpha1/doc.go create mode 100644 generated/1.21/apis/supervisor/oauth/v1alpha1/register.go create mode 100644 generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go create mode 100644 generated/1.21/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go create mode 100644 generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go create mode 100644 generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go create mode 100644 generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go create mode 100644 generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go create mode 100644 generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go create mode 100644 generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go create mode 100644 generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.21/client/supervisor/informers/externalversions/oauth/interface.go create mode 100644 generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go create mode 100644 generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.21/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go create mode 100644 generated/1.21/client/supervisor/listers/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml create mode 100644 generated/1.22/apis/supervisor/oauth/v1alpha1/doc.go create mode 100644 generated/1.22/apis/supervisor/oauth/v1alpha1/register.go create mode 100644 generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go create mode 100644 generated/1.22/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go create mode 100644 generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go create mode 100644 generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go create mode 100644 generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go create mode 100644 generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go create mode 100644 generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go create mode 100644 generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go create mode 100644 generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.22/client/supervisor/informers/externalversions/oauth/interface.go create mode 100644 generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go create mode 100644 generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.22/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go create mode 100644 generated/1.22/client/supervisor/listers/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml create mode 100644 generated/1.23/apis/supervisor/oauth/v1alpha1/doc.go create mode 100644 generated/1.23/apis/supervisor/oauth/v1alpha1/register.go create mode 100644 generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go create mode 100644 generated/1.23/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go create mode 100644 generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go create mode 100644 generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go create mode 100644 generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go create mode 100644 generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go create mode 100644 generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go create mode 100644 generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go create mode 100644 generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.23/client/supervisor/informers/externalversions/oauth/interface.go create mode 100644 generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go create mode 100644 generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.23/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go create mode 100644 generated/1.23/client/supervisor/listers/oauth/v1alpha1/oidcclient.go create mode 100644 generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml create mode 100644 generated/latest/apis/supervisor/oauth/v1alpha1/doc.go create mode 100644 generated/latest/apis/supervisor/oauth/v1alpha1/register.go create mode 100644 generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go create mode 100644 generated/latest/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go create mode 100644 generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go create mode 100644 generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go create mode 100644 generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go create mode 100644 generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go create mode 100644 generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go create mode 100644 generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go create mode 100644 generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go create mode 100644 generated/latest/client/supervisor/informers/externalversions/oauth/interface.go create mode 100644 generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go create mode 100644 generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go create mode 100644 generated/latest/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go create mode 100644 generated/latest/client/supervisor/listers/oauth/v1alpha1/oidcclient.go diff --git a/apis/supervisor/oauth/v1alpha1/doc.go.tmpl b/apis/supervisor/oauth/v1alpha1/doc.go.tmpl new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/apis/supervisor/oauth/v1alpha1/doc.go.tmpl @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/apis/supervisor/oauth/v1alpha1/register.go.tmpl b/apis/supervisor/oauth/v1alpha1/register.go.tmpl new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/apis/supervisor/oauth/v1alpha1/register.go.tmpl @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl b/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml b/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml new file mode 100644 index 00000000..0b4ee157 --- /dev/null +++ b/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: oidcclients.oauth.supervisor.pinniped.dev +spec: + group: oauth.supervisor.pinniped.dev + names: + categories: + - pinniped + kind: OIDCClient + listKind: OIDCClientList + plural: oidcclients + singular: oidcclient + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' + name: Privileged + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: OIDCClient describes the configuration of an OIDC client. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec of the OIDC provider. + properties: + allowedGrantTypes: + description: "allowedGrantTypes is a list of the allowed grant_type + param values that should be accepted during OIDC flows with this + client. \n Must only contain the following values: - authorization_code: + allows the client to perform the authorization code grant flow, + i.e. allows the webapp to authenticate users. This grant must always + be listed. - refresh_token: allows the client to perform refresh + grants for the user to extend the user's session. This grant must + be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: + allows the client to perform RFC8693 token exchange, which is a + step in the process to be able to get a cluster credential for the + user. This grant must be listed if allowedScopes lists pinniped:request-audience." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedRedirectURIs: + description: allowedRedirectURIs is a list of the allowed redirect_uri + param values that should be accepted during OIDC flows with this + client. Any other uris will be rejected. Must be https, unless it + is a loopback. + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedScopes: + description: "allowedScopes is a list of the allowed scopes param + values that should be accepted during OIDC flows with this client. + \n Must only contain the following values: - openid: The client + is allowed to request ID tokens. ID tokens only include the required + claims by default (iss, sub, aud, exp, iat). This scope must always + be listed. - offline_access: The client is allowed to request an + initial refresh token during the authorization code grant flow. + This scope must be listed if allowedGrantTypes lists refresh_token. + - pinniped:request-audience: The client is allowed to request a + new audience value during a RFC8693 token exchange, which is a step + in the process to be able to get a cluster credential for the user. + openid, username and groups scopes must be listed when this scope + is present. This scope must be listed if allowedGrantTypes lists + urn:ietf:params:oauth:grant-type:token-exchange. - username: The + client is allowed to request that ID tokens contain the user's username. + Without the username scope being requested and allowed, the ID token + will not contain the user's username. - groups: The client is allowed + to request that ID tokens contain the user's group membership, if + their group membership is discoverable by the Supervisor. Without + the groups scope being requested and allowed, the ID token will + not contain groups." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + required: + - allowedGrantTypes + - allowedRedirectURIs + - allowedScopes + type: object + status: + description: Status of the OIDC provider. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/generated/1.17/README.adoc b/generated/1.17/README.adoc index 9efe8a67..a7396f25 100644 --- a/generated/1.17/README.adoc +++ b/generated/1.17/README.adoc @@ -12,6 +12,7 @@ - xref:{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1[$$identity.concierge.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$] +- xref:{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1[$$oauth.supervisor.pinniped.dev/v1alpha1$$] [id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"] @@ -1332,3 +1333,56 @@ TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned |=== + +[id="{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1"] +=== oauth.supervisor.pinniped.dev/v1alpha1 + +Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclient"] +==== OIDCClient + +OIDCClient describes the configuration of an OIDC client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclientlist[$$OIDCClientList$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. + +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +|=== + + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclientspec"] +==== OIDCClientSpec + +OIDCClientSpec is a struct that describes an OIDC Client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclient[$$OIDCClient$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. +| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. +| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. +|=== + + + + diff --git a/generated/1.17/apis/supervisor/oauth/v1alpha1/doc.go b/generated/1.17/apis/supervisor/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/generated/1.17/apis/supervisor/oauth/v1alpha1/doc.go @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/generated/1.17/apis/supervisor/oauth/v1alpha1/register.go b/generated/1.17/apis/supervisor/oauth/v1alpha1/register.go new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/generated/1.17/apis/supervisor/oauth/v1alpha1/register.go @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/generated/1.17/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.17/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..cb35cea5 --- /dev/null +++ b/generated/1.17/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,121 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClient) DeepCopyInto(out *OIDCClient) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClient. +func (in *OIDCClient) DeepCopy() *OIDCClient { + if in == nil { + return nil + } + out := new(OIDCClient) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClient) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientList) DeepCopyInto(out *OIDCClientList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OIDCClient, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientList. +func (in *OIDCClientList) DeepCopy() *OIDCClientList { + if in == nil { + return nil + } + out := new(OIDCClientList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClientList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { + *out = *in + if in.AllowedRedirectURIs != nil { + in, out := &in.AllowedRedirectURIs, &out.AllowedRedirectURIs + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedGrantTypes != nil { + in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedScopes != nil { + in, out := &in.AllowedScopes, &out.AllowedScopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientSpec. +func (in *OIDCClientSpec) DeepCopy() *OIDCClientSpec { + if in == nil { + return nil + } + out := new(OIDCClientSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientStatus) DeepCopyInto(out *OIDCClientStatus) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientStatus. +func (in *OIDCClientStatus) DeepCopy() *OIDCClientStatus { + if in == nil { + return nil + } + out := new(OIDCClientStatus) + in.DeepCopyInto(out) + return out +} diff --git a/generated/1.17/client/supervisor/clientset/versioned/clientset.go b/generated/1.17/client/supervisor/clientset/versioned/clientset.go index d1845d53..c51ef35e 100644 --- a/generated/1.17/client/supervisor/clientset/versioned/clientset.go +++ b/generated/1.17/client/supervisor/clientset/versioned/clientset.go @@ -10,6 +10,7 @@ import ( configv1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" discovery "k8s.io/client-go/discovery" rest "k8s.io/client-go/rest" flowcontrol "k8s.io/client-go/util/flowcontrol" @@ -19,6 +20,7 @@ type Interface interface { Discovery() discovery.DiscoveryInterface ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface + OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface } // Clientset contains the clients for groups. Each group has exactly one @@ -27,6 +29,7 @@ type Clientset struct { *discovery.DiscoveryClient configV1alpha1 *configv1alpha1.ConfigV1alpha1Client iDPV1alpha1 *idpv1alpha1.IDPV1alpha1Client + oauthV1alpha1 *oauthv1alpha1.OauthV1alpha1Client } // ConfigV1alpha1 retrieves the ConfigV1alpha1Client @@ -39,6 +42,11 @@ func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return c.iDPV1alpha1 } +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return c.oauthV1alpha1 +} + // Discovery retrieves the DiscoveryClient func (c *Clientset) Discovery() discovery.DiscoveryInterface { if c == nil { @@ -68,6 +76,10 @@ func NewForConfig(c *rest.Config) (*Clientset, error) { if err != nil { return nil, err } + cs.oauthV1alpha1, err = oauthv1alpha1.NewForConfig(&configShallowCopy) + if err != nil { + return nil, err + } cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy) if err != nil { @@ -82,6 +94,7 @@ func NewForConfigOrDie(c *rest.Config) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.NewForConfigOrDie(c) cs.iDPV1alpha1 = idpv1alpha1.NewForConfigOrDie(c) + cs.oauthV1alpha1 = oauthv1alpha1.NewForConfigOrDie(c) cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c) return &cs @@ -92,6 +105,7 @@ func New(c rest.Interface) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.New(c) cs.iDPV1alpha1 = idpv1alpha1.New(c) + cs.oauthV1alpha1 = oauthv1alpha1.New(c) cs.DiscoveryClient = discovery.NewDiscoveryClient(c) return &cs diff --git a/generated/1.17/client/supervisor/clientset/versioned/fake/clientset_generated.go b/generated/1.17/client/supervisor/clientset/versioned/fake/clientset_generated.go index 0bc2edfc..7139764c 100644 --- a/generated/1.17/client/supervisor/clientset/versioned/fake/clientset_generated.go +++ b/generated/1.17/client/supervisor/clientset/versioned/fake/clientset_generated.go @@ -11,6 +11,8 @@ import ( fakeconfigv1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake" idpv1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/idp/v1alpha1" fakeidpv1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake" + oauthv1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + fakeoauthv1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/watch" "k8s.io/client-go/discovery" @@ -74,3 +76,8 @@ func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface { func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake} } + +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return &fakeoauthv1alpha1.FakeOauthV1alpha1{Fake: &c.Fake} +} diff --git a/generated/1.17/client/supervisor/clientset/versioned/fake/register.go b/generated/1.17/client/supervisor/clientset/versioned/fake/register.go index 5717b4eb..980ce98f 100644 --- a/generated/1.17/client/supervisor/clientset/versioned/fake/register.go +++ b/generated/1.17/client/supervisor/clientset/versioned/fake/register.go @@ -8,6 +8,7 @@ package fake import ( configv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var parameterCodec = runtime.NewParameterCodec(scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.17/client/supervisor/clientset/versioned/scheme/register.go b/generated/1.17/client/supervisor/clientset/versioned/scheme/register.go index 3d881a08..676b0aae 100644 --- a/generated/1.17/client/supervisor/clientset/versioned/scheme/register.go +++ b/generated/1.17/client/supervisor/clientset/versioned/scheme/register.go @@ -8,6 +8,7 @@ package scheme import ( configv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var ParameterCodec = runtime.NewParameterCodec(Scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..e7a470b6 --- /dev/null +++ b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// This package has the automatically generated typed clients. +package v1alpha1 diff --git a/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go new file mode 100644 index 00000000..7906901b --- /dev/null +++ b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// Package fake has the automatically generated clients. +package fake diff --git a/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go new file mode 100644 index 00000000..1625045c --- /dev/null +++ b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go @@ -0,0 +1,27 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + rest "k8s.io/client-go/rest" + testing "k8s.io/client-go/testing" +) + +type FakeOauthV1alpha1 struct { + *testing.Fake +} + +func (c *FakeOauthV1alpha1) OIDCClients(namespace string) v1alpha1.OIDCClientInterface { + return &FakeOIDCClients{c, namespace} +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *FakeOauthV1alpha1) RESTClient() rest.Interface { + var ret *rest.RESTClient + return ret +} diff --git a/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go new file mode 100644 index 00000000..69c8555d --- /dev/null +++ b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go @@ -0,0 +1,127 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + labels "k8s.io/apimachinery/pkg/labels" + schema "k8s.io/apimachinery/pkg/runtime/schema" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + testing "k8s.io/client-go/testing" +) + +// FakeOIDCClients implements OIDCClientInterface +type FakeOIDCClients struct { + Fake *FakeOauthV1alpha1 + ns string +} + +var oidcclientsResource = schema.GroupVersionResource{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"} + +var oidcclientsKind = schema.GroupVersionKind{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *FakeOIDCClients) Get(name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *FakeOIDCClients) List(opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + obj, err := c.Fake. + Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{}) + + if obj == nil { + return nil, err + } + + label, _, _ := testing.ExtractFromListOptions(opts) + if label == nil { + label = labels.Everything() + } + list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta} + for _, item := range obj.(*v1alpha1.OIDCClientList).Items { + if label.Matches(labels.Set(item.Labels)) { + list.Items = append(list.Items, item) + } + } + return list, err +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *FakeOIDCClients) Watch(opts v1.ListOptions) (watch.Interface, error) { + return c.Fake. + InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts)) + +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Create(oIDCClient *v1alpha1.OIDCClient) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Update(oIDCClient *v1alpha1.OIDCClient) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *FakeOIDCClients) UpdateStatus(oIDCClient *v1alpha1.OIDCClient) (*v1alpha1.OIDCClient, error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *FakeOIDCClients) Delete(name string, options *v1.DeleteOptions) error { + _, err := c.Fake. + Invokes(testing.NewDeleteAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + return err +} + +// DeleteCollection deletes a collection of objects. +func (c *FakeOIDCClients) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error { + action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOptions) + + _, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{}) + return err +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *FakeOIDCClients) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} diff --git a/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go new file mode 100644 index 00000000..87d22ea9 --- /dev/null +++ b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go @@ -0,0 +1,8 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +type OIDCClientExpansion interface{} diff --git a/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go new file mode 100644 index 00000000..32dae26a --- /dev/null +++ b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go @@ -0,0 +1,76 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/oauth/v1alpha1" + "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/scheme" + rest "k8s.io/client-go/rest" +) + +type OauthV1alpha1Interface interface { + RESTClient() rest.Interface + OIDCClientsGetter +} + +// OauthV1alpha1Client is used to interact with features provided by the oauth.supervisor.pinniped.dev group. +type OauthV1alpha1Client struct { + restClient rest.Interface +} + +func (c *OauthV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface { + return newOIDCClients(c, namespace) +} + +// NewForConfig creates a new OauthV1alpha1Client for the given config. +func NewForConfig(c *rest.Config) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + client, err := rest.RESTClientFor(&config) + if err != nil { + return nil, err + } + return &OauthV1alpha1Client{client}, nil +} + +// NewForConfigOrDie creates a new OauthV1alpha1Client for the given config and +// panics if there is an error in the config. +func NewForConfigOrDie(c *rest.Config) *OauthV1alpha1Client { + client, err := NewForConfig(c) + if err != nil { + panic(err) + } + return client +} + +// New creates a new OauthV1alpha1Client for the given RESTClient. +func New(c rest.Interface) *OauthV1alpha1Client { + return &OauthV1alpha1Client{c} +} + +func setConfigDefaults(config *rest.Config) error { + gv := v1alpha1.SchemeGroupVersion + config.GroupVersion = &gv + config.APIPath = "/apis" + config.NegotiatedSerializer = scheme.Codecs.WithoutConversion() + + if config.UserAgent == "" { + config.UserAgent = rest.DefaultKubernetesUserAgent() + } + + return nil +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *OauthV1alpha1Client) RESTClient() rest.Interface { + if c == nil { + return nil + } + return c.restClient +} diff --git a/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..322bcb9d --- /dev/null +++ b/generated/1.17/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,178 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "time" + + v1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/oauth/v1alpha1" + scheme "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + rest "k8s.io/client-go/rest" +) + +// OIDCClientsGetter has a method to return a OIDCClientInterface. +// A group's client should implement this interface. +type OIDCClientsGetter interface { + OIDCClients(namespace string) OIDCClientInterface +} + +// OIDCClientInterface has methods to work with OIDCClient resources. +type OIDCClientInterface interface { + Create(*v1alpha1.OIDCClient) (*v1alpha1.OIDCClient, error) + Update(*v1alpha1.OIDCClient) (*v1alpha1.OIDCClient, error) + UpdateStatus(*v1alpha1.OIDCClient) (*v1alpha1.OIDCClient, error) + Delete(name string, options *v1.DeleteOptions) error + DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error + Get(name string, options v1.GetOptions) (*v1alpha1.OIDCClient, error) + List(opts v1.ListOptions) (*v1alpha1.OIDCClientList, error) + Watch(opts v1.ListOptions) (watch.Interface, error) + Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.OIDCClient, err error) + OIDCClientExpansion +} + +// oIDCClients implements OIDCClientInterface +type oIDCClients struct { + client rest.Interface + ns string +} + +// newOIDCClients returns a OIDCClients +func newOIDCClients(c *OauthV1alpha1Client, namespace string) *oIDCClients { + return &oIDCClients{ + client: c.RESTClient(), + ns: namespace, + } +} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *oIDCClients) Get(name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + VersionedParams(&options, scheme.ParameterCodec). + Do(). + Into(result) + return +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *oIDCClients) List(opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + result = &v1alpha1.OIDCClientList{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Do(). + Into(result) + return +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *oIDCClients) Watch(opts v1.ListOptions) (watch.Interface, error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + opts.Watch = true + return c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Watch() +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Create(oIDCClient *v1alpha1.OIDCClient) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Post(). + Namespace(c.ns). + Resource("oidcclients"). + Body(oIDCClient). + Do(). + Into(result) + return +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Update(oIDCClient *v1alpha1.OIDCClient) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + Body(oIDCClient). + Do(). + Into(result) + return +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). + +func (c *oIDCClients) UpdateStatus(oIDCClient *v1alpha1.OIDCClient) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + SubResource("status"). + Body(oIDCClient). + Do(). + Into(result) + return +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *oIDCClients) Delete(name string, options *v1.DeleteOptions) error { + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + Body(options). + Do(). + Error() +} + +// DeleteCollection deletes a collection of objects. +func (c *oIDCClients) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error { + var timeout time.Duration + if listOptions.TimeoutSeconds != nil { + timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second + } + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&listOptions, scheme.ParameterCodec). + Timeout(timeout). + Body(options). + Do(). + Error() +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *oIDCClients) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Patch(pt). + Namespace(c.ns). + Resource("oidcclients"). + SubResource(subresources...). + Name(name). + Body(data). + Do(). + Into(result) + return +} diff --git a/generated/1.17/client/supervisor/informers/externalversions/factory.go b/generated/1.17/client/supervisor/informers/externalversions/factory.go index 10a7bf92..ac94e186 100644 --- a/generated/1.17/client/supervisor/informers/externalversions/factory.go +++ b/generated/1.17/client/supervisor/informers/externalversions/factory.go @@ -14,6 +14,7 @@ import ( config "go.pinniped.dev/generated/1.17/client/supervisor/informers/externalversions/config" idp "go.pinniped.dev/generated/1.17/client/supervisor/informers/externalversions/idp" internalinterfaces "go.pinniped.dev/generated/1.17/client/supervisor/informers/externalversions/internalinterfaces" + oauth "go.pinniped.dev/generated/1.17/client/supervisor/informers/externalversions/oauth" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -162,6 +163,7 @@ type SharedInformerFactory interface { Config() config.Interface IDP() idp.Interface + Oauth() oauth.Interface } func (f *sharedInformerFactory) Config() config.Interface { @@ -171,3 +173,7 @@ func (f *sharedInformerFactory) Config() config.Interface { func (f *sharedInformerFactory) IDP() idp.Interface { return idp.New(f, f.namespace, f.tweakListOptions) } + +func (f *sharedInformerFactory) Oauth() oauth.Interface { + return oauth.New(f, f.namespace, f.tweakListOptions) +} diff --git a/generated/1.17/client/supervisor/informers/externalversions/generic.go b/generated/1.17/client/supervisor/informers/externalversions/generic.go index 945a84dd..4f5c74e4 100644 --- a/generated/1.17/client/supervisor/informers/externalversions/generic.go +++ b/generated/1.17/client/supervisor/informers/externalversions/generic.go @@ -10,6 +10,7 @@ import ( v1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/oauth/v1alpha1" schema "k8s.io/apimachinery/pkg/runtime/schema" cache "k8s.io/client-go/tools/cache" ) @@ -52,6 +53,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"): return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().OIDCIdentityProviders().Informer()}, nil + // Group=oauth.supervisor.pinniped.dev, Version=v1alpha1 + case oauthv1alpha1.SchemeGroupVersion.WithResource("oidcclients"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Oauth().V1alpha1().OIDCClients().Informer()}, nil + } return nil, fmt.Errorf("no informer found for %v", resource) diff --git a/generated/1.17/client/supervisor/informers/externalversions/oauth/interface.go b/generated/1.17/client/supervisor/informers/externalversions/oauth/interface.go new file mode 100644 index 00000000..06b9370b --- /dev/null +++ b/generated/1.17/client/supervisor/informers/externalversions/oauth/interface.go @@ -0,0 +1,33 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package oauth + +import ( + internalinterfaces "go.pinniped.dev/generated/1.17/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go b/generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go new file mode 100644 index 00000000..46d19a40 --- /dev/null +++ b/generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go @@ -0,0 +1,32 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "go.pinniped.dev/generated/1.17/client/supervisor/informers/externalversions/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // OIDCClients returns a OIDCClientInformer. + OIDCClients() OIDCClientInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// OIDCClients returns a OIDCClientInformer. +func (v *version) OIDCClients() OIDCClientInformer { + return &oIDCClientInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} +} diff --git a/generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go b/generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..1996f202 --- /dev/null +++ b/generated/1.17/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,76 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + time "time" + + oauthv1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/oauth/v1alpha1" + versioned "go.pinniped.dev/generated/1.17/client/supervisor/clientset/versioned" + internalinterfaces "go.pinniped.dev/generated/1.17/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.17/client/supervisor/listers/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" +) + +// OIDCClientInformer provides access to a shared informer and lister for +// OIDCClients. +type OIDCClientInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.OIDCClientLister +} + +type oIDCClientInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc + namespace string +} + +// NewOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, namespace, resyncPeriod, indexers, nil) +} + +// NewFilteredOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).List(options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).Watch(options) + }, + }, + &oauthv1alpha1.OIDCClient{}, + resyncPeriod, + indexers, + ) +} + +func (f *oIDCClientInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *oIDCClientInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&oauthv1alpha1.OIDCClient{}, f.defaultInformer) +} + +func (f *oIDCClientInformer) Lister() v1alpha1.OIDCClientLister { + return v1alpha1.NewOIDCClientLister(f.Informer().GetIndexer()) +} diff --git a/generated/1.17/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go b/generated/1.17/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go new file mode 100644 index 00000000..c19310da --- /dev/null +++ b/generated/1.17/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go @@ -0,0 +1,14 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// OIDCClientListerExpansion allows custom methods to be added to +// OIDCClientLister. +type OIDCClientListerExpansion interface{} + +// OIDCClientNamespaceListerExpansion allows custom methods to be added to +// OIDCClientNamespaceLister. +type OIDCClientNamespaceListerExpansion interface{} diff --git a/generated/1.17/client/supervisor/listers/oauth/v1alpha1/oidcclient.go b/generated/1.17/client/supervisor/listers/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..8395809f --- /dev/null +++ b/generated/1.17/client/supervisor/listers/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,81 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.17/apis/supervisor/oauth/v1alpha1" + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" +) + +// OIDCClientLister helps list OIDCClients. +type OIDCClientLister interface { + // List lists all OIDCClients in the indexer. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // OIDCClients returns an object that can list and get OIDCClients. + OIDCClients(namespace string) OIDCClientNamespaceLister + OIDCClientListerExpansion +} + +// oIDCClientLister implements the OIDCClientLister interface. +type oIDCClientLister struct { + indexer cache.Indexer +} + +// NewOIDCClientLister returns a new OIDCClientLister. +func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister { + return &oIDCClientLister{indexer: indexer} +} + +// List lists all OIDCClients in the indexer. +func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// OIDCClients returns an object that can list and get OIDCClients. +func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister { + return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace} +} + +// OIDCClientNamespaceLister helps list and get OIDCClients. +type OIDCClientNamespaceLister interface { + // List lists all OIDCClients in the indexer for a given namespace. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // Get retrieves the OIDCClient from the indexer for a given namespace and name. + Get(name string) (*v1alpha1.OIDCClient, error) + OIDCClientNamespaceListerExpansion +} + +// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister +// interface. +type oIDCClientNamespaceLister struct { + indexer cache.Indexer + namespace string +} + +// List lists all OIDCClients in the indexer for a given namespace. +func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// Get retrieves the OIDCClient from the indexer for a given namespace and name. +func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) { + obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name) + } + return obj.(*v1alpha1.OIDCClient), nil +} diff --git a/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml new file mode 100644 index 00000000..0b4ee157 --- /dev/null +++ b/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: oidcclients.oauth.supervisor.pinniped.dev +spec: + group: oauth.supervisor.pinniped.dev + names: + categories: + - pinniped + kind: OIDCClient + listKind: OIDCClientList + plural: oidcclients + singular: oidcclient + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' + name: Privileged + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: OIDCClient describes the configuration of an OIDC client. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec of the OIDC provider. + properties: + allowedGrantTypes: + description: "allowedGrantTypes is a list of the allowed grant_type + param values that should be accepted during OIDC flows with this + client. \n Must only contain the following values: - authorization_code: + allows the client to perform the authorization code grant flow, + i.e. allows the webapp to authenticate users. This grant must always + be listed. - refresh_token: allows the client to perform refresh + grants for the user to extend the user's session. This grant must + be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: + allows the client to perform RFC8693 token exchange, which is a + step in the process to be able to get a cluster credential for the + user. This grant must be listed if allowedScopes lists pinniped:request-audience." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedRedirectURIs: + description: allowedRedirectURIs is a list of the allowed redirect_uri + param values that should be accepted during OIDC flows with this + client. Any other uris will be rejected. Must be https, unless it + is a loopback. + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedScopes: + description: "allowedScopes is a list of the allowed scopes param + values that should be accepted during OIDC flows with this client. + \n Must only contain the following values: - openid: The client + is allowed to request ID tokens. ID tokens only include the required + claims by default (iss, sub, aud, exp, iat). This scope must always + be listed. - offline_access: The client is allowed to request an + initial refresh token during the authorization code grant flow. + This scope must be listed if allowedGrantTypes lists refresh_token. + - pinniped:request-audience: The client is allowed to request a + new audience value during a RFC8693 token exchange, which is a step + in the process to be able to get a cluster credential for the user. + openid, username and groups scopes must be listed when this scope + is present. This scope must be listed if allowedGrantTypes lists + urn:ietf:params:oauth:grant-type:token-exchange. - username: The + client is allowed to request that ID tokens contain the user's username. + Without the username scope being requested and allowed, the ID token + will not contain the user's username. - groups: The client is allowed + to request that ID tokens contain the user's group membership, if + their group membership is discoverable by the Supervisor. Without + the groups scope being requested and allowed, the ID token will + not contain groups." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + required: + - allowedGrantTypes + - allowedRedirectURIs + - allowedScopes + type: object + status: + description: Status of the OIDC provider. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/generated/1.18/README.adoc b/generated/1.18/README.adoc index f6ecc0f5..53a3a986 100644 --- a/generated/1.18/README.adoc +++ b/generated/1.18/README.adoc @@ -12,6 +12,7 @@ - xref:{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1[$$identity.concierge.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$] +- xref:{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1[$$oauth.supervisor.pinniped.dev/v1alpha1$$] [id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"] @@ -1332,3 +1333,56 @@ TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned |=== + +[id="{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1"] +=== oauth.supervisor.pinniped.dev/v1alpha1 + +Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclient"] +==== OIDCClient + +OIDCClient describes the configuration of an OIDC client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclientlist[$$OIDCClientList$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. + +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +|=== + + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclientspec"] +==== OIDCClientSpec + +OIDCClientSpec is a struct that describes an OIDC Client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclient[$$OIDCClient$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. +| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. +| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. +|=== + + + + diff --git a/generated/1.18/apis/supervisor/oauth/v1alpha1/doc.go b/generated/1.18/apis/supervisor/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/generated/1.18/apis/supervisor/oauth/v1alpha1/doc.go @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/generated/1.18/apis/supervisor/oauth/v1alpha1/register.go b/generated/1.18/apis/supervisor/oauth/v1alpha1/register.go new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/generated/1.18/apis/supervisor/oauth/v1alpha1/register.go @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/generated/1.18/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.18/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..cb35cea5 --- /dev/null +++ b/generated/1.18/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,121 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClient) DeepCopyInto(out *OIDCClient) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClient. +func (in *OIDCClient) DeepCopy() *OIDCClient { + if in == nil { + return nil + } + out := new(OIDCClient) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClient) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientList) DeepCopyInto(out *OIDCClientList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OIDCClient, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientList. +func (in *OIDCClientList) DeepCopy() *OIDCClientList { + if in == nil { + return nil + } + out := new(OIDCClientList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClientList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { + *out = *in + if in.AllowedRedirectURIs != nil { + in, out := &in.AllowedRedirectURIs, &out.AllowedRedirectURIs + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedGrantTypes != nil { + in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedScopes != nil { + in, out := &in.AllowedScopes, &out.AllowedScopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientSpec. +func (in *OIDCClientSpec) DeepCopy() *OIDCClientSpec { + if in == nil { + return nil + } + out := new(OIDCClientSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientStatus) DeepCopyInto(out *OIDCClientStatus) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientStatus. +func (in *OIDCClientStatus) DeepCopy() *OIDCClientStatus { + if in == nil { + return nil + } + out := new(OIDCClientStatus) + in.DeepCopyInto(out) + return out +} diff --git a/generated/1.18/client/supervisor/clientset/versioned/clientset.go b/generated/1.18/client/supervisor/clientset/versioned/clientset.go index 1427efc1..d9bb8ce9 100644 --- a/generated/1.18/client/supervisor/clientset/versioned/clientset.go +++ b/generated/1.18/client/supervisor/clientset/versioned/clientset.go @@ -10,6 +10,7 @@ import ( configv1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" discovery "k8s.io/client-go/discovery" rest "k8s.io/client-go/rest" flowcontrol "k8s.io/client-go/util/flowcontrol" @@ -19,6 +20,7 @@ type Interface interface { Discovery() discovery.DiscoveryInterface ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface + OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface } // Clientset contains the clients for groups. Each group has exactly one @@ -27,6 +29,7 @@ type Clientset struct { *discovery.DiscoveryClient configV1alpha1 *configv1alpha1.ConfigV1alpha1Client iDPV1alpha1 *idpv1alpha1.IDPV1alpha1Client + oauthV1alpha1 *oauthv1alpha1.OauthV1alpha1Client } // ConfigV1alpha1 retrieves the ConfigV1alpha1Client @@ -39,6 +42,11 @@ func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return c.iDPV1alpha1 } +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return c.oauthV1alpha1 +} + // Discovery retrieves the DiscoveryClient func (c *Clientset) Discovery() discovery.DiscoveryInterface { if c == nil { @@ -68,6 +76,10 @@ func NewForConfig(c *rest.Config) (*Clientset, error) { if err != nil { return nil, err } + cs.oauthV1alpha1, err = oauthv1alpha1.NewForConfig(&configShallowCopy) + if err != nil { + return nil, err + } cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy) if err != nil { @@ -82,6 +94,7 @@ func NewForConfigOrDie(c *rest.Config) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.NewForConfigOrDie(c) cs.iDPV1alpha1 = idpv1alpha1.NewForConfigOrDie(c) + cs.oauthV1alpha1 = oauthv1alpha1.NewForConfigOrDie(c) cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c) return &cs @@ -92,6 +105,7 @@ func New(c rest.Interface) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.New(c) cs.iDPV1alpha1 = idpv1alpha1.New(c) + cs.oauthV1alpha1 = oauthv1alpha1.New(c) cs.DiscoveryClient = discovery.NewDiscoveryClient(c) return &cs diff --git a/generated/1.18/client/supervisor/clientset/versioned/fake/clientset_generated.go b/generated/1.18/client/supervisor/clientset/versioned/fake/clientset_generated.go index 4a5361d2..be0ba580 100644 --- a/generated/1.18/client/supervisor/clientset/versioned/fake/clientset_generated.go +++ b/generated/1.18/client/supervisor/clientset/versioned/fake/clientset_generated.go @@ -11,6 +11,8 @@ import ( fakeconfigv1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake" idpv1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/idp/v1alpha1" fakeidpv1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake" + oauthv1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + fakeoauthv1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/watch" "k8s.io/client-go/discovery" @@ -74,3 +76,8 @@ func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface { func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake} } + +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return &fakeoauthv1alpha1.FakeOauthV1alpha1{Fake: &c.Fake} +} diff --git a/generated/1.18/client/supervisor/clientset/versioned/fake/register.go b/generated/1.18/client/supervisor/clientset/versioned/fake/register.go index 20b81309..9a64a8a9 100644 --- a/generated/1.18/client/supervisor/clientset/versioned/fake/register.go +++ b/generated/1.18/client/supervisor/clientset/versioned/fake/register.go @@ -8,6 +8,7 @@ package fake import ( configv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var parameterCodec = runtime.NewParameterCodec(scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.18/client/supervisor/clientset/versioned/scheme/register.go b/generated/1.18/client/supervisor/clientset/versioned/scheme/register.go index 23788bd1..1de4c05d 100644 --- a/generated/1.18/client/supervisor/clientset/versioned/scheme/register.go +++ b/generated/1.18/client/supervisor/clientset/versioned/scheme/register.go @@ -8,6 +8,7 @@ package scheme import ( configv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var ParameterCodec = runtime.NewParameterCodec(Scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..e7a470b6 --- /dev/null +++ b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// This package has the automatically generated typed clients. +package v1alpha1 diff --git a/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go new file mode 100644 index 00000000..7906901b --- /dev/null +++ b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// Package fake has the automatically generated clients. +package fake diff --git a/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go new file mode 100644 index 00000000..0483f163 --- /dev/null +++ b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go @@ -0,0 +1,27 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + rest "k8s.io/client-go/rest" + testing "k8s.io/client-go/testing" +) + +type FakeOauthV1alpha1 struct { + *testing.Fake +} + +func (c *FakeOauthV1alpha1) OIDCClients(namespace string) v1alpha1.OIDCClientInterface { + return &FakeOIDCClients{c, namespace} +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *FakeOauthV1alpha1) RESTClient() rest.Interface { + var ret *rest.RESTClient + return ret +} diff --git a/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go new file mode 100644 index 00000000..a177ce4a --- /dev/null +++ b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go @@ -0,0 +1,129 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + "context" + + v1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + labels "k8s.io/apimachinery/pkg/labels" + schema "k8s.io/apimachinery/pkg/runtime/schema" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + testing "k8s.io/client-go/testing" +) + +// FakeOIDCClients implements OIDCClientInterface +type FakeOIDCClients struct { + Fake *FakeOauthV1alpha1 + ns string +} + +var oidcclientsResource = schema.GroupVersionResource{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"} + +var oidcclientsKind = schema.GroupVersionKind{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *FakeOIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *FakeOIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + obj, err := c.Fake. + Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{}) + + if obj == nil { + return nil, err + } + + label, _, _ := testing.ExtractFromListOptions(opts) + if label == nil { + label = labels.Everything() + } + list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta} + for _, item := range obj.(*v1alpha1.OIDCClientList).Items { + if label.Matches(labels.Set(item.Labels)) { + list.Items = append(list.Items, item) + } + } + return list, err +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *FakeOIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + return c.Fake. + InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts)) + +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *FakeOIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *FakeOIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + _, err := c.Fake. + Invokes(testing.NewDeleteAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + return err +} + +// DeleteCollection deletes a collection of objects. +func (c *FakeOIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOpts) + + _, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{}) + return err +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *FakeOIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} diff --git a/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go new file mode 100644 index 00000000..87d22ea9 --- /dev/null +++ b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go @@ -0,0 +1,8 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +type OIDCClientExpansion interface{} diff --git a/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go new file mode 100644 index 00000000..17d59cf4 --- /dev/null +++ b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go @@ -0,0 +1,76 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/oauth/v1alpha1" + "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/scheme" + rest "k8s.io/client-go/rest" +) + +type OauthV1alpha1Interface interface { + RESTClient() rest.Interface + OIDCClientsGetter +} + +// OauthV1alpha1Client is used to interact with features provided by the oauth.supervisor.pinniped.dev group. +type OauthV1alpha1Client struct { + restClient rest.Interface +} + +func (c *OauthV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface { + return newOIDCClients(c, namespace) +} + +// NewForConfig creates a new OauthV1alpha1Client for the given config. +func NewForConfig(c *rest.Config) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + client, err := rest.RESTClientFor(&config) + if err != nil { + return nil, err + } + return &OauthV1alpha1Client{client}, nil +} + +// NewForConfigOrDie creates a new OauthV1alpha1Client for the given config and +// panics if there is an error in the config. +func NewForConfigOrDie(c *rest.Config) *OauthV1alpha1Client { + client, err := NewForConfig(c) + if err != nil { + panic(err) + } + return client +} + +// New creates a new OauthV1alpha1Client for the given RESTClient. +func New(c rest.Interface) *OauthV1alpha1Client { + return &OauthV1alpha1Client{c} +} + +func setConfigDefaults(config *rest.Config) error { + gv := v1alpha1.SchemeGroupVersion + config.GroupVersion = &gv + config.APIPath = "/apis" + config.NegotiatedSerializer = scheme.Codecs.WithoutConversion() + + if config.UserAgent == "" { + config.UserAgent = rest.DefaultKubernetesUserAgent() + } + + return nil +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *OauthV1alpha1Client) RESTClient() rest.Interface { + if c == nil { + return nil + } + return c.restClient +} diff --git a/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..26026924 --- /dev/null +++ b/generated/1.18/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,182 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + "time" + + v1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/oauth/v1alpha1" + scheme "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + rest "k8s.io/client-go/rest" +) + +// OIDCClientsGetter has a method to return a OIDCClientInterface. +// A group's client should implement this interface. +type OIDCClientsGetter interface { + OIDCClients(namespace string) OIDCClientInterface +} + +// OIDCClientInterface has methods to work with OIDCClient resources. +type OIDCClientInterface interface { + Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (*v1alpha1.OIDCClient, error) + Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + Delete(ctx context.Context, name string, opts v1.DeleteOptions) error + DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error + Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCClient, error) + List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCClientList, error) + Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) + Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) + OIDCClientExpansion +} + +// oIDCClients implements OIDCClientInterface +type oIDCClients struct { + client rest.Interface + ns string +} + +// newOIDCClients returns a OIDCClients +func newOIDCClients(c *OauthV1alpha1Client, namespace string) *oIDCClients { + return &oIDCClients{ + client: c.RESTClient(), + ns: namespace, + } +} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *oIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + VersionedParams(&options, scheme.ParameterCodec). + Do(ctx). + Into(result) + return +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *oIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + result = &v1alpha1.OIDCClientList{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Do(ctx). + Into(result) + return +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *oIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + opts.Watch = true + return c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Watch(ctx) +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Post(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *oIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + SubResource("status"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *oIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + Body(&opts). + Do(ctx). + Error() +} + +// DeleteCollection deletes a collection of objects. +func (c *oIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + var timeout time.Duration + if listOpts.TimeoutSeconds != nil { + timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second + } + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&listOpts, scheme.ParameterCodec). + Timeout(timeout). + Body(&opts). + Do(ctx). + Error() +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *oIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Patch(pt). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + SubResource(subresources...). + VersionedParams(&opts, scheme.ParameterCodec). + Body(data). + Do(ctx). + Into(result) + return +} diff --git a/generated/1.18/client/supervisor/informers/externalversions/factory.go b/generated/1.18/client/supervisor/informers/externalversions/factory.go index 997de893..158fded5 100644 --- a/generated/1.18/client/supervisor/informers/externalversions/factory.go +++ b/generated/1.18/client/supervisor/informers/externalversions/factory.go @@ -14,6 +14,7 @@ import ( config "go.pinniped.dev/generated/1.18/client/supervisor/informers/externalversions/config" idp "go.pinniped.dev/generated/1.18/client/supervisor/informers/externalversions/idp" internalinterfaces "go.pinniped.dev/generated/1.18/client/supervisor/informers/externalversions/internalinterfaces" + oauth "go.pinniped.dev/generated/1.18/client/supervisor/informers/externalversions/oauth" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -162,6 +163,7 @@ type SharedInformerFactory interface { Config() config.Interface IDP() idp.Interface + Oauth() oauth.Interface } func (f *sharedInformerFactory) Config() config.Interface { @@ -171,3 +173,7 @@ func (f *sharedInformerFactory) Config() config.Interface { func (f *sharedInformerFactory) IDP() idp.Interface { return idp.New(f, f.namespace, f.tweakListOptions) } + +func (f *sharedInformerFactory) Oauth() oauth.Interface { + return oauth.New(f, f.namespace, f.tweakListOptions) +} diff --git a/generated/1.18/client/supervisor/informers/externalversions/generic.go b/generated/1.18/client/supervisor/informers/externalversions/generic.go index 665f95b9..43579b43 100644 --- a/generated/1.18/client/supervisor/informers/externalversions/generic.go +++ b/generated/1.18/client/supervisor/informers/externalversions/generic.go @@ -10,6 +10,7 @@ import ( v1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/oauth/v1alpha1" schema "k8s.io/apimachinery/pkg/runtime/schema" cache "k8s.io/client-go/tools/cache" ) @@ -52,6 +53,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"): return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().OIDCIdentityProviders().Informer()}, nil + // Group=oauth.supervisor.pinniped.dev, Version=v1alpha1 + case oauthv1alpha1.SchemeGroupVersion.WithResource("oidcclients"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Oauth().V1alpha1().OIDCClients().Informer()}, nil + } return nil, fmt.Errorf("no informer found for %v", resource) diff --git a/generated/1.18/client/supervisor/informers/externalversions/oauth/interface.go b/generated/1.18/client/supervisor/informers/externalversions/oauth/interface.go new file mode 100644 index 00000000..7a2b6531 --- /dev/null +++ b/generated/1.18/client/supervisor/informers/externalversions/oauth/interface.go @@ -0,0 +1,33 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package oauth + +import ( + internalinterfaces "go.pinniped.dev/generated/1.18/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go b/generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go new file mode 100644 index 00000000..86b4efd0 --- /dev/null +++ b/generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go @@ -0,0 +1,32 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "go.pinniped.dev/generated/1.18/client/supervisor/informers/externalversions/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // OIDCClients returns a OIDCClientInformer. + OIDCClients() OIDCClientInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// OIDCClients returns a OIDCClientInformer. +func (v *version) OIDCClients() OIDCClientInformer { + return &oIDCClientInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} +} diff --git a/generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go b/generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..c5869b86 --- /dev/null +++ b/generated/1.18/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,77 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + oauthv1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/oauth/v1alpha1" + versioned "go.pinniped.dev/generated/1.18/client/supervisor/clientset/versioned" + internalinterfaces "go.pinniped.dev/generated/1.18/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.18/client/supervisor/listers/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" +) + +// OIDCClientInformer provides access to a shared informer and lister for +// OIDCClients. +type OIDCClientInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.OIDCClientLister +} + +type oIDCClientInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc + namespace string +} + +// NewOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, namespace, resyncPeriod, indexers, nil) +} + +// NewFilteredOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).Watch(context.TODO(), options) + }, + }, + &oauthv1alpha1.OIDCClient{}, + resyncPeriod, + indexers, + ) +} + +func (f *oIDCClientInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *oIDCClientInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&oauthv1alpha1.OIDCClient{}, f.defaultInformer) +} + +func (f *oIDCClientInformer) Lister() v1alpha1.OIDCClientLister { + return v1alpha1.NewOIDCClientLister(f.Informer().GetIndexer()) +} diff --git a/generated/1.18/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go b/generated/1.18/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go new file mode 100644 index 00000000..c19310da --- /dev/null +++ b/generated/1.18/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go @@ -0,0 +1,14 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// OIDCClientListerExpansion allows custom methods to be added to +// OIDCClientLister. +type OIDCClientListerExpansion interface{} + +// OIDCClientNamespaceListerExpansion allows custom methods to be added to +// OIDCClientNamespaceLister. +type OIDCClientNamespaceListerExpansion interface{} diff --git a/generated/1.18/client/supervisor/listers/oauth/v1alpha1/oidcclient.go b/generated/1.18/client/supervisor/listers/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..77d38f1e --- /dev/null +++ b/generated/1.18/client/supervisor/listers/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,81 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.18/apis/supervisor/oauth/v1alpha1" + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" +) + +// OIDCClientLister helps list OIDCClients. +type OIDCClientLister interface { + // List lists all OIDCClients in the indexer. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // OIDCClients returns an object that can list and get OIDCClients. + OIDCClients(namespace string) OIDCClientNamespaceLister + OIDCClientListerExpansion +} + +// oIDCClientLister implements the OIDCClientLister interface. +type oIDCClientLister struct { + indexer cache.Indexer +} + +// NewOIDCClientLister returns a new OIDCClientLister. +func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister { + return &oIDCClientLister{indexer: indexer} +} + +// List lists all OIDCClients in the indexer. +func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// OIDCClients returns an object that can list and get OIDCClients. +func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister { + return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace} +} + +// OIDCClientNamespaceLister helps list and get OIDCClients. +type OIDCClientNamespaceLister interface { + // List lists all OIDCClients in the indexer for a given namespace. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // Get retrieves the OIDCClient from the indexer for a given namespace and name. + Get(name string) (*v1alpha1.OIDCClient, error) + OIDCClientNamespaceListerExpansion +} + +// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister +// interface. +type oIDCClientNamespaceLister struct { + indexer cache.Indexer + namespace string +} + +// List lists all OIDCClients in the indexer for a given namespace. +func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// Get retrieves the OIDCClient from the indexer for a given namespace and name. +func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) { + obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name) + } + return obj.(*v1alpha1.OIDCClient), nil +} diff --git a/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml new file mode 100644 index 00000000..0b4ee157 --- /dev/null +++ b/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: oidcclients.oauth.supervisor.pinniped.dev +spec: + group: oauth.supervisor.pinniped.dev + names: + categories: + - pinniped + kind: OIDCClient + listKind: OIDCClientList + plural: oidcclients + singular: oidcclient + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' + name: Privileged + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: OIDCClient describes the configuration of an OIDC client. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec of the OIDC provider. + properties: + allowedGrantTypes: + description: "allowedGrantTypes is a list of the allowed grant_type + param values that should be accepted during OIDC flows with this + client. \n Must only contain the following values: - authorization_code: + allows the client to perform the authorization code grant flow, + i.e. allows the webapp to authenticate users. This grant must always + be listed. - refresh_token: allows the client to perform refresh + grants for the user to extend the user's session. This grant must + be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: + allows the client to perform RFC8693 token exchange, which is a + step in the process to be able to get a cluster credential for the + user. This grant must be listed if allowedScopes lists pinniped:request-audience." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedRedirectURIs: + description: allowedRedirectURIs is a list of the allowed redirect_uri + param values that should be accepted during OIDC flows with this + client. Any other uris will be rejected. Must be https, unless it + is a loopback. + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedScopes: + description: "allowedScopes is a list of the allowed scopes param + values that should be accepted during OIDC flows with this client. + \n Must only contain the following values: - openid: The client + is allowed to request ID tokens. ID tokens only include the required + claims by default (iss, sub, aud, exp, iat). This scope must always + be listed. - offline_access: The client is allowed to request an + initial refresh token during the authorization code grant flow. + This scope must be listed if allowedGrantTypes lists refresh_token. + - pinniped:request-audience: The client is allowed to request a + new audience value during a RFC8693 token exchange, which is a step + in the process to be able to get a cluster credential for the user. + openid, username and groups scopes must be listed when this scope + is present. This scope must be listed if allowedGrantTypes lists + urn:ietf:params:oauth:grant-type:token-exchange. - username: The + client is allowed to request that ID tokens contain the user's username. + Without the username scope being requested and allowed, the ID token + will not contain the user's username. - groups: The client is allowed + to request that ID tokens contain the user's group membership, if + their group membership is discoverable by the Supervisor. Without + the groups scope being requested and allowed, the ID token will + not contain groups." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + required: + - allowedGrantTypes + - allowedRedirectURIs + - allowedScopes + type: object + status: + description: Status of the OIDC provider. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/generated/1.19/README.adoc b/generated/1.19/README.adoc index 197ed326..a8dd26ee 100644 --- a/generated/1.19/README.adoc +++ b/generated/1.19/README.adoc @@ -12,6 +12,7 @@ - xref:{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1[$$identity.concierge.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$] +- xref:{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1[$$oauth.supervisor.pinniped.dev/v1alpha1$$] [id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"] @@ -1332,3 +1333,56 @@ TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned |=== + +[id="{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1"] +=== oauth.supervisor.pinniped.dev/v1alpha1 + +Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclient"] +==== OIDCClient + +OIDCClient describes the configuration of an OIDC client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclientlist[$$OIDCClientList$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. + +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +|=== + + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclientspec"] +==== OIDCClientSpec + +OIDCClientSpec is a struct that describes an OIDC Client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclient[$$OIDCClient$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. +| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. +| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. +|=== + + + + diff --git a/generated/1.19/apis/supervisor/oauth/v1alpha1/doc.go b/generated/1.19/apis/supervisor/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/generated/1.19/apis/supervisor/oauth/v1alpha1/doc.go @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/generated/1.19/apis/supervisor/oauth/v1alpha1/register.go b/generated/1.19/apis/supervisor/oauth/v1alpha1/register.go new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/generated/1.19/apis/supervisor/oauth/v1alpha1/register.go @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/generated/1.19/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.19/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..cb35cea5 --- /dev/null +++ b/generated/1.19/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,121 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClient) DeepCopyInto(out *OIDCClient) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClient. +func (in *OIDCClient) DeepCopy() *OIDCClient { + if in == nil { + return nil + } + out := new(OIDCClient) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClient) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientList) DeepCopyInto(out *OIDCClientList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OIDCClient, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientList. +func (in *OIDCClientList) DeepCopy() *OIDCClientList { + if in == nil { + return nil + } + out := new(OIDCClientList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClientList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { + *out = *in + if in.AllowedRedirectURIs != nil { + in, out := &in.AllowedRedirectURIs, &out.AllowedRedirectURIs + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedGrantTypes != nil { + in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedScopes != nil { + in, out := &in.AllowedScopes, &out.AllowedScopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientSpec. +func (in *OIDCClientSpec) DeepCopy() *OIDCClientSpec { + if in == nil { + return nil + } + out := new(OIDCClientSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientStatus) DeepCopyInto(out *OIDCClientStatus) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientStatus. +func (in *OIDCClientStatus) DeepCopy() *OIDCClientStatus { + if in == nil { + return nil + } + out := new(OIDCClientStatus) + in.DeepCopyInto(out) + return out +} diff --git a/generated/1.19/client/supervisor/clientset/versioned/clientset.go b/generated/1.19/client/supervisor/clientset/versioned/clientset.go index a5d5b43c..09f209c0 100644 --- a/generated/1.19/client/supervisor/clientset/versioned/clientset.go +++ b/generated/1.19/client/supervisor/clientset/versioned/clientset.go @@ -10,6 +10,7 @@ import ( configv1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" discovery "k8s.io/client-go/discovery" rest "k8s.io/client-go/rest" flowcontrol "k8s.io/client-go/util/flowcontrol" @@ -19,6 +20,7 @@ type Interface interface { Discovery() discovery.DiscoveryInterface ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface + OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface } // Clientset contains the clients for groups. Each group has exactly one @@ -27,6 +29,7 @@ type Clientset struct { *discovery.DiscoveryClient configV1alpha1 *configv1alpha1.ConfigV1alpha1Client iDPV1alpha1 *idpv1alpha1.IDPV1alpha1Client + oauthV1alpha1 *oauthv1alpha1.OauthV1alpha1Client } // ConfigV1alpha1 retrieves the ConfigV1alpha1Client @@ -39,6 +42,11 @@ func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return c.iDPV1alpha1 } +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return c.oauthV1alpha1 +} + // Discovery retrieves the DiscoveryClient func (c *Clientset) Discovery() discovery.DiscoveryInterface { if c == nil { @@ -68,6 +76,10 @@ func NewForConfig(c *rest.Config) (*Clientset, error) { if err != nil { return nil, err } + cs.oauthV1alpha1, err = oauthv1alpha1.NewForConfig(&configShallowCopy) + if err != nil { + return nil, err + } cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy) if err != nil { @@ -82,6 +94,7 @@ func NewForConfigOrDie(c *rest.Config) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.NewForConfigOrDie(c) cs.iDPV1alpha1 = idpv1alpha1.NewForConfigOrDie(c) + cs.oauthV1alpha1 = oauthv1alpha1.NewForConfigOrDie(c) cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c) return &cs @@ -92,6 +105,7 @@ func New(c rest.Interface) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.New(c) cs.iDPV1alpha1 = idpv1alpha1.New(c) + cs.oauthV1alpha1 = oauthv1alpha1.New(c) cs.DiscoveryClient = discovery.NewDiscoveryClient(c) return &cs diff --git a/generated/1.19/client/supervisor/clientset/versioned/fake/clientset_generated.go b/generated/1.19/client/supervisor/clientset/versioned/fake/clientset_generated.go index 6fbd1410..cc7334de 100644 --- a/generated/1.19/client/supervisor/clientset/versioned/fake/clientset_generated.go +++ b/generated/1.19/client/supervisor/clientset/versioned/fake/clientset_generated.go @@ -11,6 +11,8 @@ import ( fakeconfigv1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake" idpv1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/idp/v1alpha1" fakeidpv1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake" + oauthv1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + fakeoauthv1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/watch" "k8s.io/client-go/discovery" @@ -74,3 +76,8 @@ func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface { func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake} } + +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return &fakeoauthv1alpha1.FakeOauthV1alpha1{Fake: &c.Fake} +} diff --git a/generated/1.19/client/supervisor/clientset/versioned/fake/register.go b/generated/1.19/client/supervisor/clientset/versioned/fake/register.go index 93a34271..31bd0f0b 100644 --- a/generated/1.19/client/supervisor/clientset/versioned/fake/register.go +++ b/generated/1.19/client/supervisor/clientset/versioned/fake/register.go @@ -8,6 +8,7 @@ package fake import ( configv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var codecs = serializer.NewCodecFactory(scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.19/client/supervisor/clientset/versioned/scheme/register.go b/generated/1.19/client/supervisor/clientset/versioned/scheme/register.go index 0f2ac77b..bd2ef62e 100644 --- a/generated/1.19/client/supervisor/clientset/versioned/scheme/register.go +++ b/generated/1.19/client/supervisor/clientset/versioned/scheme/register.go @@ -8,6 +8,7 @@ package scheme import ( configv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var ParameterCodec = runtime.NewParameterCodec(Scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..e7a470b6 --- /dev/null +++ b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// This package has the automatically generated typed clients. +package v1alpha1 diff --git a/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go new file mode 100644 index 00000000..7906901b --- /dev/null +++ b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// Package fake has the automatically generated clients. +package fake diff --git a/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go new file mode 100644 index 00000000..9430b71b --- /dev/null +++ b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go @@ -0,0 +1,27 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + rest "k8s.io/client-go/rest" + testing "k8s.io/client-go/testing" +) + +type FakeOauthV1alpha1 struct { + *testing.Fake +} + +func (c *FakeOauthV1alpha1) OIDCClients(namespace string) v1alpha1.OIDCClientInterface { + return &FakeOIDCClients{c, namespace} +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *FakeOauthV1alpha1) RESTClient() rest.Interface { + var ret *rest.RESTClient + return ret +} diff --git a/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go new file mode 100644 index 00000000..078ab176 --- /dev/null +++ b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go @@ -0,0 +1,129 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + "context" + + v1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + labels "k8s.io/apimachinery/pkg/labels" + schema "k8s.io/apimachinery/pkg/runtime/schema" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + testing "k8s.io/client-go/testing" +) + +// FakeOIDCClients implements OIDCClientInterface +type FakeOIDCClients struct { + Fake *FakeOauthV1alpha1 + ns string +} + +var oidcclientsResource = schema.GroupVersionResource{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"} + +var oidcclientsKind = schema.GroupVersionKind{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *FakeOIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *FakeOIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + obj, err := c.Fake. + Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{}) + + if obj == nil { + return nil, err + } + + label, _, _ := testing.ExtractFromListOptions(opts) + if label == nil { + label = labels.Everything() + } + list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta} + for _, item := range obj.(*v1alpha1.OIDCClientList).Items { + if label.Matches(labels.Set(item.Labels)) { + list.Items = append(list.Items, item) + } + } + return list, err +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *FakeOIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + return c.Fake. + InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts)) + +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *FakeOIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *FakeOIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + _, err := c.Fake. + Invokes(testing.NewDeleteAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + return err +} + +// DeleteCollection deletes a collection of objects. +func (c *FakeOIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOpts) + + _, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{}) + return err +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *FakeOIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} diff --git a/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go new file mode 100644 index 00000000..87d22ea9 --- /dev/null +++ b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go @@ -0,0 +1,8 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +type OIDCClientExpansion interface{} diff --git a/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go new file mode 100644 index 00000000..0e347f19 --- /dev/null +++ b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go @@ -0,0 +1,76 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/oauth/v1alpha1" + "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/scheme" + rest "k8s.io/client-go/rest" +) + +type OauthV1alpha1Interface interface { + RESTClient() rest.Interface + OIDCClientsGetter +} + +// OauthV1alpha1Client is used to interact with features provided by the oauth.supervisor.pinniped.dev group. +type OauthV1alpha1Client struct { + restClient rest.Interface +} + +func (c *OauthV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface { + return newOIDCClients(c, namespace) +} + +// NewForConfig creates a new OauthV1alpha1Client for the given config. +func NewForConfig(c *rest.Config) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + client, err := rest.RESTClientFor(&config) + if err != nil { + return nil, err + } + return &OauthV1alpha1Client{client}, nil +} + +// NewForConfigOrDie creates a new OauthV1alpha1Client for the given config and +// panics if there is an error in the config. +func NewForConfigOrDie(c *rest.Config) *OauthV1alpha1Client { + client, err := NewForConfig(c) + if err != nil { + panic(err) + } + return client +} + +// New creates a new OauthV1alpha1Client for the given RESTClient. +func New(c rest.Interface) *OauthV1alpha1Client { + return &OauthV1alpha1Client{c} +} + +func setConfigDefaults(config *rest.Config) error { + gv := v1alpha1.SchemeGroupVersion + config.GroupVersion = &gv + config.APIPath = "/apis" + config.NegotiatedSerializer = scheme.Codecs.WithoutConversion() + + if config.UserAgent == "" { + config.UserAgent = rest.DefaultKubernetesUserAgent() + } + + return nil +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *OauthV1alpha1Client) RESTClient() rest.Interface { + if c == nil { + return nil + } + return c.restClient +} diff --git a/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..93cd5805 --- /dev/null +++ b/generated/1.19/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,182 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + "time" + + v1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/oauth/v1alpha1" + scheme "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + rest "k8s.io/client-go/rest" +) + +// OIDCClientsGetter has a method to return a OIDCClientInterface. +// A group's client should implement this interface. +type OIDCClientsGetter interface { + OIDCClients(namespace string) OIDCClientInterface +} + +// OIDCClientInterface has methods to work with OIDCClient resources. +type OIDCClientInterface interface { + Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (*v1alpha1.OIDCClient, error) + Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + Delete(ctx context.Context, name string, opts v1.DeleteOptions) error + DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error + Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCClient, error) + List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCClientList, error) + Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) + Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) + OIDCClientExpansion +} + +// oIDCClients implements OIDCClientInterface +type oIDCClients struct { + client rest.Interface + ns string +} + +// newOIDCClients returns a OIDCClients +func newOIDCClients(c *OauthV1alpha1Client, namespace string) *oIDCClients { + return &oIDCClients{ + client: c.RESTClient(), + ns: namespace, + } +} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *oIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + VersionedParams(&options, scheme.ParameterCodec). + Do(ctx). + Into(result) + return +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *oIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + result = &v1alpha1.OIDCClientList{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Do(ctx). + Into(result) + return +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *oIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + opts.Watch = true + return c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Watch(ctx) +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Post(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *oIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + SubResource("status"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *oIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + Body(&opts). + Do(ctx). + Error() +} + +// DeleteCollection deletes a collection of objects. +func (c *oIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + var timeout time.Duration + if listOpts.TimeoutSeconds != nil { + timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second + } + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&listOpts, scheme.ParameterCodec). + Timeout(timeout). + Body(&opts). + Do(ctx). + Error() +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *oIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Patch(pt). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + SubResource(subresources...). + VersionedParams(&opts, scheme.ParameterCodec). + Body(data). + Do(ctx). + Into(result) + return +} diff --git a/generated/1.19/client/supervisor/informers/externalversions/factory.go b/generated/1.19/client/supervisor/informers/externalversions/factory.go index 0ad18aae..90fff5ef 100644 --- a/generated/1.19/client/supervisor/informers/externalversions/factory.go +++ b/generated/1.19/client/supervisor/informers/externalversions/factory.go @@ -14,6 +14,7 @@ import ( config "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions/config" idp "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions/idp" internalinterfaces "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions/internalinterfaces" + oauth "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions/oauth" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -162,6 +163,7 @@ type SharedInformerFactory interface { Config() config.Interface IDP() idp.Interface + Oauth() oauth.Interface } func (f *sharedInformerFactory) Config() config.Interface { @@ -171,3 +173,7 @@ func (f *sharedInformerFactory) Config() config.Interface { func (f *sharedInformerFactory) IDP() idp.Interface { return idp.New(f, f.namespace, f.tweakListOptions) } + +func (f *sharedInformerFactory) Oauth() oauth.Interface { + return oauth.New(f, f.namespace, f.tweakListOptions) +} diff --git a/generated/1.19/client/supervisor/informers/externalversions/generic.go b/generated/1.19/client/supervisor/informers/externalversions/generic.go index 644f1b12..ffc852ca 100644 --- a/generated/1.19/client/supervisor/informers/externalversions/generic.go +++ b/generated/1.19/client/supervisor/informers/externalversions/generic.go @@ -10,6 +10,7 @@ import ( v1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/oauth/v1alpha1" schema "k8s.io/apimachinery/pkg/runtime/schema" cache "k8s.io/client-go/tools/cache" ) @@ -52,6 +53,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"): return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().OIDCIdentityProviders().Informer()}, nil + // Group=oauth.supervisor.pinniped.dev, Version=v1alpha1 + case oauthv1alpha1.SchemeGroupVersion.WithResource("oidcclients"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Oauth().V1alpha1().OIDCClients().Informer()}, nil + } return nil, fmt.Errorf("no informer found for %v", resource) diff --git a/generated/1.19/client/supervisor/informers/externalversions/oauth/interface.go b/generated/1.19/client/supervisor/informers/externalversions/oauth/interface.go new file mode 100644 index 00000000..2b6d2943 --- /dev/null +++ b/generated/1.19/client/supervisor/informers/externalversions/oauth/interface.go @@ -0,0 +1,33 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package oauth + +import ( + internalinterfaces "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go b/generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go new file mode 100644 index 00000000..3db762a4 --- /dev/null +++ b/generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go @@ -0,0 +1,32 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // OIDCClients returns a OIDCClientInformer. + OIDCClients() OIDCClientInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// OIDCClients returns a OIDCClientInformer. +func (v *version) OIDCClients() OIDCClientInformer { + return &oIDCClientInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} +} diff --git a/generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go b/generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..749b0977 --- /dev/null +++ b/generated/1.19/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,77 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + oauthv1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/oauth/v1alpha1" + versioned "go.pinniped.dev/generated/1.19/client/supervisor/clientset/versioned" + internalinterfaces "go.pinniped.dev/generated/1.19/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.19/client/supervisor/listers/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" +) + +// OIDCClientInformer provides access to a shared informer and lister for +// OIDCClients. +type OIDCClientInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.OIDCClientLister +} + +type oIDCClientInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc + namespace string +} + +// NewOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, namespace, resyncPeriod, indexers, nil) +} + +// NewFilteredOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).Watch(context.TODO(), options) + }, + }, + &oauthv1alpha1.OIDCClient{}, + resyncPeriod, + indexers, + ) +} + +func (f *oIDCClientInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *oIDCClientInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&oauthv1alpha1.OIDCClient{}, f.defaultInformer) +} + +func (f *oIDCClientInformer) Lister() v1alpha1.OIDCClientLister { + return v1alpha1.NewOIDCClientLister(f.Informer().GetIndexer()) +} diff --git a/generated/1.19/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go b/generated/1.19/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go new file mode 100644 index 00000000..c19310da --- /dev/null +++ b/generated/1.19/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go @@ -0,0 +1,14 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// OIDCClientListerExpansion allows custom methods to be added to +// OIDCClientLister. +type OIDCClientListerExpansion interface{} + +// OIDCClientNamespaceListerExpansion allows custom methods to be added to +// OIDCClientNamespaceLister. +type OIDCClientNamespaceListerExpansion interface{} diff --git a/generated/1.19/client/supervisor/listers/oauth/v1alpha1/oidcclient.go b/generated/1.19/client/supervisor/listers/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..7040f4c9 --- /dev/null +++ b/generated/1.19/client/supervisor/listers/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,86 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.19/apis/supervisor/oauth/v1alpha1" + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" +) + +// OIDCClientLister helps list OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientLister interface { + // List lists all OIDCClients in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // OIDCClients returns an object that can list and get OIDCClients. + OIDCClients(namespace string) OIDCClientNamespaceLister + OIDCClientListerExpansion +} + +// oIDCClientLister implements the OIDCClientLister interface. +type oIDCClientLister struct { + indexer cache.Indexer +} + +// NewOIDCClientLister returns a new OIDCClientLister. +func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister { + return &oIDCClientLister{indexer: indexer} +} + +// List lists all OIDCClients in the indexer. +func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// OIDCClients returns an object that can list and get OIDCClients. +func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister { + return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace} +} + +// OIDCClientNamespaceLister helps list and get OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientNamespaceLister interface { + // List lists all OIDCClients in the indexer for a given namespace. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // Get retrieves the OIDCClient from the indexer for a given namespace and name. + // Objects returned here must be treated as read-only. + Get(name string) (*v1alpha1.OIDCClient, error) + OIDCClientNamespaceListerExpansion +} + +// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister +// interface. +type oIDCClientNamespaceLister struct { + indexer cache.Indexer + namespace string +} + +// List lists all OIDCClients in the indexer for a given namespace. +func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// Get retrieves the OIDCClient from the indexer for a given namespace and name. +func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) { + obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name) + } + return obj.(*v1alpha1.OIDCClient), nil +} diff --git a/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml new file mode 100644 index 00000000..0b4ee157 --- /dev/null +++ b/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: oidcclients.oauth.supervisor.pinniped.dev +spec: + group: oauth.supervisor.pinniped.dev + names: + categories: + - pinniped + kind: OIDCClient + listKind: OIDCClientList + plural: oidcclients + singular: oidcclient + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' + name: Privileged + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: OIDCClient describes the configuration of an OIDC client. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec of the OIDC provider. + properties: + allowedGrantTypes: + description: "allowedGrantTypes is a list of the allowed grant_type + param values that should be accepted during OIDC flows with this + client. \n Must only contain the following values: - authorization_code: + allows the client to perform the authorization code grant flow, + i.e. allows the webapp to authenticate users. This grant must always + be listed. - refresh_token: allows the client to perform refresh + grants for the user to extend the user's session. This grant must + be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: + allows the client to perform RFC8693 token exchange, which is a + step in the process to be able to get a cluster credential for the + user. This grant must be listed if allowedScopes lists pinniped:request-audience." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedRedirectURIs: + description: allowedRedirectURIs is a list of the allowed redirect_uri + param values that should be accepted during OIDC flows with this + client. Any other uris will be rejected. Must be https, unless it + is a loopback. + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedScopes: + description: "allowedScopes is a list of the allowed scopes param + values that should be accepted during OIDC flows with this client. + \n Must only contain the following values: - openid: The client + is allowed to request ID tokens. ID tokens only include the required + claims by default (iss, sub, aud, exp, iat). This scope must always + be listed. - offline_access: The client is allowed to request an + initial refresh token during the authorization code grant flow. + This scope must be listed if allowedGrantTypes lists refresh_token. + - pinniped:request-audience: The client is allowed to request a + new audience value during a RFC8693 token exchange, which is a step + in the process to be able to get a cluster credential for the user. + openid, username and groups scopes must be listed when this scope + is present. This scope must be listed if allowedGrantTypes lists + urn:ietf:params:oauth:grant-type:token-exchange. - username: The + client is allowed to request that ID tokens contain the user's username. + Without the username scope being requested and allowed, the ID token + will not contain the user's username. - groups: The client is allowed + to request that ID tokens contain the user's group membership, if + their group membership is discoverable by the Supervisor. Without + the groups scope being requested and allowed, the ID token will + not contain groups." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + required: + - allowedGrantTypes + - allowedRedirectURIs + - allowedScopes + type: object + status: + description: Status of the OIDC provider. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/generated/1.20/README.adoc b/generated/1.20/README.adoc index 8ad43876..5d419a80 100644 --- a/generated/1.20/README.adoc +++ b/generated/1.20/README.adoc @@ -12,6 +12,7 @@ - xref:{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1[$$identity.concierge.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$] +- xref:{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1[$$oauth.supervisor.pinniped.dev/v1alpha1$$] [id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"] @@ -1332,3 +1333,56 @@ TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned |=== + +[id="{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1"] +=== oauth.supervisor.pinniped.dev/v1alpha1 + +Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclient"] +==== OIDCClient + +OIDCClient describes the configuration of an OIDC client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclientlist[$$OIDCClientList$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.2/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. + +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +|=== + + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclientspec"] +==== OIDCClientSpec + +OIDCClientSpec is a struct that describes an OIDC Client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclient[$$OIDCClient$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. +| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. +| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. +|=== + + + + diff --git a/generated/1.20/apis/supervisor/oauth/v1alpha1/doc.go b/generated/1.20/apis/supervisor/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/generated/1.20/apis/supervisor/oauth/v1alpha1/doc.go @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/generated/1.20/apis/supervisor/oauth/v1alpha1/register.go b/generated/1.20/apis/supervisor/oauth/v1alpha1/register.go new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/generated/1.20/apis/supervisor/oauth/v1alpha1/register.go @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/generated/1.20/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.20/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..cb35cea5 --- /dev/null +++ b/generated/1.20/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,121 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClient) DeepCopyInto(out *OIDCClient) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClient. +func (in *OIDCClient) DeepCopy() *OIDCClient { + if in == nil { + return nil + } + out := new(OIDCClient) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClient) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientList) DeepCopyInto(out *OIDCClientList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OIDCClient, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientList. +func (in *OIDCClientList) DeepCopy() *OIDCClientList { + if in == nil { + return nil + } + out := new(OIDCClientList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClientList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { + *out = *in + if in.AllowedRedirectURIs != nil { + in, out := &in.AllowedRedirectURIs, &out.AllowedRedirectURIs + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedGrantTypes != nil { + in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedScopes != nil { + in, out := &in.AllowedScopes, &out.AllowedScopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientSpec. +func (in *OIDCClientSpec) DeepCopy() *OIDCClientSpec { + if in == nil { + return nil + } + out := new(OIDCClientSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientStatus) DeepCopyInto(out *OIDCClientStatus) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientStatus. +func (in *OIDCClientStatus) DeepCopy() *OIDCClientStatus { + if in == nil { + return nil + } + out := new(OIDCClientStatus) + in.DeepCopyInto(out) + return out +} diff --git a/generated/1.20/client/supervisor/clientset/versioned/clientset.go b/generated/1.20/client/supervisor/clientset/versioned/clientset.go index 47592892..ec78cd88 100644 --- a/generated/1.20/client/supervisor/clientset/versioned/clientset.go +++ b/generated/1.20/client/supervisor/clientset/versioned/clientset.go @@ -10,6 +10,7 @@ import ( configv1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" discovery "k8s.io/client-go/discovery" rest "k8s.io/client-go/rest" flowcontrol "k8s.io/client-go/util/flowcontrol" @@ -19,6 +20,7 @@ type Interface interface { Discovery() discovery.DiscoveryInterface ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface + OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface } // Clientset contains the clients for groups. Each group has exactly one @@ -27,6 +29,7 @@ type Clientset struct { *discovery.DiscoveryClient configV1alpha1 *configv1alpha1.ConfigV1alpha1Client iDPV1alpha1 *idpv1alpha1.IDPV1alpha1Client + oauthV1alpha1 *oauthv1alpha1.OauthV1alpha1Client } // ConfigV1alpha1 retrieves the ConfigV1alpha1Client @@ -39,6 +42,11 @@ func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return c.iDPV1alpha1 } +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return c.oauthV1alpha1 +} + // Discovery retrieves the DiscoveryClient func (c *Clientset) Discovery() discovery.DiscoveryInterface { if c == nil { @@ -68,6 +76,10 @@ func NewForConfig(c *rest.Config) (*Clientset, error) { if err != nil { return nil, err } + cs.oauthV1alpha1, err = oauthv1alpha1.NewForConfig(&configShallowCopy) + if err != nil { + return nil, err + } cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy) if err != nil { @@ -82,6 +94,7 @@ func NewForConfigOrDie(c *rest.Config) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.NewForConfigOrDie(c) cs.iDPV1alpha1 = idpv1alpha1.NewForConfigOrDie(c) + cs.oauthV1alpha1 = oauthv1alpha1.NewForConfigOrDie(c) cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c) return &cs @@ -92,6 +105,7 @@ func New(c rest.Interface) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.New(c) cs.iDPV1alpha1 = idpv1alpha1.New(c) + cs.oauthV1alpha1 = oauthv1alpha1.New(c) cs.DiscoveryClient = discovery.NewDiscoveryClient(c) return &cs diff --git a/generated/1.20/client/supervisor/clientset/versioned/fake/clientset_generated.go b/generated/1.20/client/supervisor/clientset/versioned/fake/clientset_generated.go index 4f710f0b..cee1ca0d 100644 --- a/generated/1.20/client/supervisor/clientset/versioned/fake/clientset_generated.go +++ b/generated/1.20/client/supervisor/clientset/versioned/fake/clientset_generated.go @@ -11,6 +11,8 @@ import ( fakeconfigv1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake" idpv1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/idp/v1alpha1" fakeidpv1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake" + oauthv1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + fakeoauthv1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/watch" "k8s.io/client-go/discovery" @@ -74,3 +76,8 @@ func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface { func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake} } + +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return &fakeoauthv1alpha1.FakeOauthV1alpha1{Fake: &c.Fake} +} diff --git a/generated/1.20/client/supervisor/clientset/versioned/fake/register.go b/generated/1.20/client/supervisor/clientset/versioned/fake/register.go index 7587d602..b9ea3ea8 100644 --- a/generated/1.20/client/supervisor/clientset/versioned/fake/register.go +++ b/generated/1.20/client/supervisor/clientset/versioned/fake/register.go @@ -8,6 +8,7 @@ package fake import ( configv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var codecs = serializer.NewCodecFactory(scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.20/client/supervisor/clientset/versioned/scheme/register.go b/generated/1.20/client/supervisor/clientset/versioned/scheme/register.go index af0ed68f..cd769223 100644 --- a/generated/1.20/client/supervisor/clientset/versioned/scheme/register.go +++ b/generated/1.20/client/supervisor/clientset/versioned/scheme/register.go @@ -8,6 +8,7 @@ package scheme import ( configv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var ParameterCodec = runtime.NewParameterCodec(Scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..e7a470b6 --- /dev/null +++ b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// This package has the automatically generated typed clients. +package v1alpha1 diff --git a/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go new file mode 100644 index 00000000..7906901b --- /dev/null +++ b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// Package fake has the automatically generated clients. +package fake diff --git a/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go new file mode 100644 index 00000000..3bc1da70 --- /dev/null +++ b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go @@ -0,0 +1,27 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + rest "k8s.io/client-go/rest" + testing "k8s.io/client-go/testing" +) + +type FakeOauthV1alpha1 struct { + *testing.Fake +} + +func (c *FakeOauthV1alpha1) OIDCClients(namespace string) v1alpha1.OIDCClientInterface { + return &FakeOIDCClients{c, namespace} +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *FakeOauthV1alpha1) RESTClient() rest.Interface { + var ret *rest.RESTClient + return ret +} diff --git a/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go new file mode 100644 index 00000000..38aac300 --- /dev/null +++ b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go @@ -0,0 +1,129 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + "context" + + v1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + labels "k8s.io/apimachinery/pkg/labels" + schema "k8s.io/apimachinery/pkg/runtime/schema" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + testing "k8s.io/client-go/testing" +) + +// FakeOIDCClients implements OIDCClientInterface +type FakeOIDCClients struct { + Fake *FakeOauthV1alpha1 + ns string +} + +var oidcclientsResource = schema.GroupVersionResource{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"} + +var oidcclientsKind = schema.GroupVersionKind{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *FakeOIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *FakeOIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + obj, err := c.Fake. + Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{}) + + if obj == nil { + return nil, err + } + + label, _, _ := testing.ExtractFromListOptions(opts) + if label == nil { + label = labels.Everything() + } + list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta} + for _, item := range obj.(*v1alpha1.OIDCClientList).Items { + if label.Matches(labels.Set(item.Labels)) { + list.Items = append(list.Items, item) + } + } + return list, err +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *FakeOIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + return c.Fake. + InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts)) + +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *FakeOIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *FakeOIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + _, err := c.Fake. + Invokes(testing.NewDeleteAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + return err +} + +// DeleteCollection deletes a collection of objects. +func (c *FakeOIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOpts) + + _, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{}) + return err +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *FakeOIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} diff --git a/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go new file mode 100644 index 00000000..87d22ea9 --- /dev/null +++ b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go @@ -0,0 +1,8 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +type OIDCClientExpansion interface{} diff --git a/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go new file mode 100644 index 00000000..ca9d2cf5 --- /dev/null +++ b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go @@ -0,0 +1,76 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/oauth/v1alpha1" + "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/scheme" + rest "k8s.io/client-go/rest" +) + +type OauthV1alpha1Interface interface { + RESTClient() rest.Interface + OIDCClientsGetter +} + +// OauthV1alpha1Client is used to interact with features provided by the oauth.supervisor.pinniped.dev group. +type OauthV1alpha1Client struct { + restClient rest.Interface +} + +func (c *OauthV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface { + return newOIDCClients(c, namespace) +} + +// NewForConfig creates a new OauthV1alpha1Client for the given config. +func NewForConfig(c *rest.Config) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + client, err := rest.RESTClientFor(&config) + if err != nil { + return nil, err + } + return &OauthV1alpha1Client{client}, nil +} + +// NewForConfigOrDie creates a new OauthV1alpha1Client for the given config and +// panics if there is an error in the config. +func NewForConfigOrDie(c *rest.Config) *OauthV1alpha1Client { + client, err := NewForConfig(c) + if err != nil { + panic(err) + } + return client +} + +// New creates a new OauthV1alpha1Client for the given RESTClient. +func New(c rest.Interface) *OauthV1alpha1Client { + return &OauthV1alpha1Client{c} +} + +func setConfigDefaults(config *rest.Config) error { + gv := v1alpha1.SchemeGroupVersion + config.GroupVersion = &gv + config.APIPath = "/apis" + config.NegotiatedSerializer = scheme.Codecs.WithoutConversion() + + if config.UserAgent == "" { + config.UserAgent = rest.DefaultKubernetesUserAgent() + } + + return nil +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *OauthV1alpha1Client) RESTClient() rest.Interface { + if c == nil { + return nil + } + return c.restClient +} diff --git a/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..32503911 --- /dev/null +++ b/generated/1.20/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,182 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + "time" + + v1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/oauth/v1alpha1" + scheme "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + rest "k8s.io/client-go/rest" +) + +// OIDCClientsGetter has a method to return a OIDCClientInterface. +// A group's client should implement this interface. +type OIDCClientsGetter interface { + OIDCClients(namespace string) OIDCClientInterface +} + +// OIDCClientInterface has methods to work with OIDCClient resources. +type OIDCClientInterface interface { + Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (*v1alpha1.OIDCClient, error) + Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + Delete(ctx context.Context, name string, opts v1.DeleteOptions) error + DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error + Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCClient, error) + List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCClientList, error) + Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) + Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) + OIDCClientExpansion +} + +// oIDCClients implements OIDCClientInterface +type oIDCClients struct { + client rest.Interface + ns string +} + +// newOIDCClients returns a OIDCClients +func newOIDCClients(c *OauthV1alpha1Client, namespace string) *oIDCClients { + return &oIDCClients{ + client: c.RESTClient(), + ns: namespace, + } +} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *oIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + VersionedParams(&options, scheme.ParameterCodec). + Do(ctx). + Into(result) + return +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *oIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + result = &v1alpha1.OIDCClientList{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Do(ctx). + Into(result) + return +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *oIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + opts.Watch = true + return c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Watch(ctx) +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Post(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *oIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + SubResource("status"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *oIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + Body(&opts). + Do(ctx). + Error() +} + +// DeleteCollection deletes a collection of objects. +func (c *oIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + var timeout time.Duration + if listOpts.TimeoutSeconds != nil { + timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second + } + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&listOpts, scheme.ParameterCodec). + Timeout(timeout). + Body(&opts). + Do(ctx). + Error() +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *oIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Patch(pt). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + SubResource(subresources...). + VersionedParams(&opts, scheme.ParameterCodec). + Body(data). + Do(ctx). + Into(result) + return +} diff --git a/generated/1.20/client/supervisor/informers/externalversions/factory.go b/generated/1.20/client/supervisor/informers/externalversions/factory.go index 60395f1f..6e6fffaa 100644 --- a/generated/1.20/client/supervisor/informers/externalversions/factory.go +++ b/generated/1.20/client/supervisor/informers/externalversions/factory.go @@ -14,6 +14,7 @@ import ( config "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions/config" idp "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions/idp" internalinterfaces "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions/internalinterfaces" + oauth "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions/oauth" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -162,6 +163,7 @@ type SharedInformerFactory interface { Config() config.Interface IDP() idp.Interface + Oauth() oauth.Interface } func (f *sharedInformerFactory) Config() config.Interface { @@ -171,3 +173,7 @@ func (f *sharedInformerFactory) Config() config.Interface { func (f *sharedInformerFactory) IDP() idp.Interface { return idp.New(f, f.namespace, f.tweakListOptions) } + +func (f *sharedInformerFactory) Oauth() oauth.Interface { + return oauth.New(f, f.namespace, f.tweakListOptions) +} diff --git a/generated/1.20/client/supervisor/informers/externalversions/generic.go b/generated/1.20/client/supervisor/informers/externalversions/generic.go index 0b11db8b..d541574e 100644 --- a/generated/1.20/client/supervisor/informers/externalversions/generic.go +++ b/generated/1.20/client/supervisor/informers/externalversions/generic.go @@ -10,6 +10,7 @@ import ( v1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/oauth/v1alpha1" schema "k8s.io/apimachinery/pkg/runtime/schema" cache "k8s.io/client-go/tools/cache" ) @@ -52,6 +53,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"): return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().OIDCIdentityProviders().Informer()}, nil + // Group=oauth.supervisor.pinniped.dev, Version=v1alpha1 + case oauthv1alpha1.SchemeGroupVersion.WithResource("oidcclients"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Oauth().V1alpha1().OIDCClients().Informer()}, nil + } return nil, fmt.Errorf("no informer found for %v", resource) diff --git a/generated/1.20/client/supervisor/informers/externalversions/oauth/interface.go b/generated/1.20/client/supervisor/informers/externalversions/oauth/interface.go new file mode 100644 index 00000000..b4cc533e --- /dev/null +++ b/generated/1.20/client/supervisor/informers/externalversions/oauth/interface.go @@ -0,0 +1,33 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package oauth + +import ( + internalinterfaces "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go b/generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go new file mode 100644 index 00000000..ed7eacf5 --- /dev/null +++ b/generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go @@ -0,0 +1,32 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // OIDCClients returns a OIDCClientInformer. + OIDCClients() OIDCClientInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// OIDCClients returns a OIDCClientInformer. +func (v *version) OIDCClients() OIDCClientInformer { + return &oIDCClientInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} +} diff --git a/generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go b/generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..37efa298 --- /dev/null +++ b/generated/1.20/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,77 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + oauthv1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/oauth/v1alpha1" + versioned "go.pinniped.dev/generated/1.20/client/supervisor/clientset/versioned" + internalinterfaces "go.pinniped.dev/generated/1.20/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.20/client/supervisor/listers/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" +) + +// OIDCClientInformer provides access to a shared informer and lister for +// OIDCClients. +type OIDCClientInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.OIDCClientLister +} + +type oIDCClientInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc + namespace string +} + +// NewOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, namespace, resyncPeriod, indexers, nil) +} + +// NewFilteredOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).Watch(context.TODO(), options) + }, + }, + &oauthv1alpha1.OIDCClient{}, + resyncPeriod, + indexers, + ) +} + +func (f *oIDCClientInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *oIDCClientInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&oauthv1alpha1.OIDCClient{}, f.defaultInformer) +} + +func (f *oIDCClientInformer) Lister() v1alpha1.OIDCClientLister { + return v1alpha1.NewOIDCClientLister(f.Informer().GetIndexer()) +} diff --git a/generated/1.20/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go b/generated/1.20/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go new file mode 100644 index 00000000..c19310da --- /dev/null +++ b/generated/1.20/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go @@ -0,0 +1,14 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// OIDCClientListerExpansion allows custom methods to be added to +// OIDCClientLister. +type OIDCClientListerExpansion interface{} + +// OIDCClientNamespaceListerExpansion allows custom methods to be added to +// OIDCClientNamespaceLister. +type OIDCClientNamespaceListerExpansion interface{} diff --git a/generated/1.20/client/supervisor/listers/oauth/v1alpha1/oidcclient.go b/generated/1.20/client/supervisor/listers/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..9cb0fe48 --- /dev/null +++ b/generated/1.20/client/supervisor/listers/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,86 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.20/apis/supervisor/oauth/v1alpha1" + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" +) + +// OIDCClientLister helps list OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientLister interface { + // List lists all OIDCClients in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // OIDCClients returns an object that can list and get OIDCClients. + OIDCClients(namespace string) OIDCClientNamespaceLister + OIDCClientListerExpansion +} + +// oIDCClientLister implements the OIDCClientLister interface. +type oIDCClientLister struct { + indexer cache.Indexer +} + +// NewOIDCClientLister returns a new OIDCClientLister. +func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister { + return &oIDCClientLister{indexer: indexer} +} + +// List lists all OIDCClients in the indexer. +func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// OIDCClients returns an object that can list and get OIDCClients. +func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister { + return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace} +} + +// OIDCClientNamespaceLister helps list and get OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientNamespaceLister interface { + // List lists all OIDCClients in the indexer for a given namespace. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // Get retrieves the OIDCClient from the indexer for a given namespace and name. + // Objects returned here must be treated as read-only. + Get(name string) (*v1alpha1.OIDCClient, error) + OIDCClientNamespaceListerExpansion +} + +// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister +// interface. +type oIDCClientNamespaceLister struct { + indexer cache.Indexer + namespace string +} + +// List lists all OIDCClients in the indexer for a given namespace. +func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// Get retrieves the OIDCClient from the indexer for a given namespace and name. +func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) { + obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name) + } + return obj.(*v1alpha1.OIDCClient), nil +} diff --git a/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml new file mode 100644 index 00000000..0b4ee157 --- /dev/null +++ b/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: oidcclients.oauth.supervisor.pinniped.dev +spec: + group: oauth.supervisor.pinniped.dev + names: + categories: + - pinniped + kind: OIDCClient + listKind: OIDCClientList + plural: oidcclients + singular: oidcclient + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' + name: Privileged + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: OIDCClient describes the configuration of an OIDC client. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec of the OIDC provider. + properties: + allowedGrantTypes: + description: "allowedGrantTypes is a list of the allowed grant_type + param values that should be accepted during OIDC flows with this + client. \n Must only contain the following values: - authorization_code: + allows the client to perform the authorization code grant flow, + i.e. allows the webapp to authenticate users. This grant must always + be listed. - refresh_token: allows the client to perform refresh + grants for the user to extend the user's session. This grant must + be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: + allows the client to perform RFC8693 token exchange, which is a + step in the process to be able to get a cluster credential for the + user. This grant must be listed if allowedScopes lists pinniped:request-audience." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedRedirectURIs: + description: allowedRedirectURIs is a list of the allowed redirect_uri + param values that should be accepted during OIDC flows with this + client. Any other uris will be rejected. Must be https, unless it + is a loopback. + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedScopes: + description: "allowedScopes is a list of the allowed scopes param + values that should be accepted during OIDC flows with this client. + \n Must only contain the following values: - openid: The client + is allowed to request ID tokens. ID tokens only include the required + claims by default (iss, sub, aud, exp, iat). This scope must always + be listed. - offline_access: The client is allowed to request an + initial refresh token during the authorization code grant flow. + This scope must be listed if allowedGrantTypes lists refresh_token. + - pinniped:request-audience: The client is allowed to request a + new audience value during a RFC8693 token exchange, which is a step + in the process to be able to get a cluster credential for the user. + openid, username and groups scopes must be listed when this scope + is present. This scope must be listed if allowedGrantTypes lists + urn:ietf:params:oauth:grant-type:token-exchange. - username: The + client is allowed to request that ID tokens contain the user's username. + Without the username scope being requested and allowed, the ID token + will not contain the user's username. - groups: The client is allowed + to request that ID tokens contain the user's group membership, if + their group membership is discoverable by the Supervisor. Without + the groups scope being requested and allowed, the ID token will + not contain groups." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + required: + - allowedGrantTypes + - allowedRedirectURIs + - allowedScopes + type: object + status: + description: Status of the OIDC provider. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/generated/1.21/README.adoc b/generated/1.21/README.adoc index 6abd6c4b..925391c3 100644 --- a/generated/1.21/README.adoc +++ b/generated/1.21/README.adoc @@ -12,6 +12,7 @@ - xref:{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1[$$identity.concierge.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$] +- xref:{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1[$$oauth.supervisor.pinniped.dev/v1alpha1$$] [id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"] @@ -1332,3 +1333,56 @@ TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned |=== + +[id="{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1"] +=== oauth.supervisor.pinniped.dev/v1alpha1 + +Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclient"] +==== OIDCClient + +OIDCClient describes the configuration of an OIDC client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclientlist[$$OIDCClientList$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. + +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +|=== + + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclientspec"] +==== OIDCClientSpec + +OIDCClientSpec is a struct that describes an OIDC Client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclient[$$OIDCClient$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. +| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. +| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. +|=== + + + + diff --git a/generated/1.21/apis/supervisor/oauth/v1alpha1/doc.go b/generated/1.21/apis/supervisor/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/generated/1.21/apis/supervisor/oauth/v1alpha1/doc.go @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/generated/1.21/apis/supervisor/oauth/v1alpha1/register.go b/generated/1.21/apis/supervisor/oauth/v1alpha1/register.go new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/generated/1.21/apis/supervisor/oauth/v1alpha1/register.go @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/generated/1.21/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.21/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..cb35cea5 --- /dev/null +++ b/generated/1.21/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,121 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClient) DeepCopyInto(out *OIDCClient) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClient. +func (in *OIDCClient) DeepCopy() *OIDCClient { + if in == nil { + return nil + } + out := new(OIDCClient) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClient) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientList) DeepCopyInto(out *OIDCClientList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OIDCClient, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientList. +func (in *OIDCClientList) DeepCopy() *OIDCClientList { + if in == nil { + return nil + } + out := new(OIDCClientList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClientList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { + *out = *in + if in.AllowedRedirectURIs != nil { + in, out := &in.AllowedRedirectURIs, &out.AllowedRedirectURIs + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedGrantTypes != nil { + in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedScopes != nil { + in, out := &in.AllowedScopes, &out.AllowedScopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientSpec. +func (in *OIDCClientSpec) DeepCopy() *OIDCClientSpec { + if in == nil { + return nil + } + out := new(OIDCClientSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientStatus) DeepCopyInto(out *OIDCClientStatus) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientStatus. +func (in *OIDCClientStatus) DeepCopy() *OIDCClientStatus { + if in == nil { + return nil + } + out := new(OIDCClientStatus) + in.DeepCopyInto(out) + return out +} diff --git a/generated/1.21/client/supervisor/clientset/versioned/clientset.go b/generated/1.21/client/supervisor/clientset/versioned/clientset.go index aa52f6ae..23d76422 100644 --- a/generated/1.21/client/supervisor/clientset/versioned/clientset.go +++ b/generated/1.21/client/supervisor/clientset/versioned/clientset.go @@ -10,6 +10,7 @@ import ( configv1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" discovery "k8s.io/client-go/discovery" rest "k8s.io/client-go/rest" flowcontrol "k8s.io/client-go/util/flowcontrol" @@ -19,6 +20,7 @@ type Interface interface { Discovery() discovery.DiscoveryInterface ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface + OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface } // Clientset contains the clients for groups. Each group has exactly one @@ -27,6 +29,7 @@ type Clientset struct { *discovery.DiscoveryClient configV1alpha1 *configv1alpha1.ConfigV1alpha1Client iDPV1alpha1 *idpv1alpha1.IDPV1alpha1Client + oauthV1alpha1 *oauthv1alpha1.OauthV1alpha1Client } // ConfigV1alpha1 retrieves the ConfigV1alpha1Client @@ -39,6 +42,11 @@ func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return c.iDPV1alpha1 } +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return c.oauthV1alpha1 +} + // Discovery retrieves the DiscoveryClient func (c *Clientset) Discovery() discovery.DiscoveryInterface { if c == nil { @@ -68,6 +76,10 @@ func NewForConfig(c *rest.Config) (*Clientset, error) { if err != nil { return nil, err } + cs.oauthV1alpha1, err = oauthv1alpha1.NewForConfig(&configShallowCopy) + if err != nil { + return nil, err + } cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy) if err != nil { @@ -82,6 +94,7 @@ func NewForConfigOrDie(c *rest.Config) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.NewForConfigOrDie(c) cs.iDPV1alpha1 = idpv1alpha1.NewForConfigOrDie(c) + cs.oauthV1alpha1 = oauthv1alpha1.NewForConfigOrDie(c) cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c) return &cs @@ -92,6 +105,7 @@ func New(c rest.Interface) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.New(c) cs.iDPV1alpha1 = idpv1alpha1.New(c) + cs.oauthV1alpha1 = oauthv1alpha1.New(c) cs.DiscoveryClient = discovery.NewDiscoveryClient(c) return &cs diff --git a/generated/1.21/client/supervisor/clientset/versioned/fake/clientset_generated.go b/generated/1.21/client/supervisor/clientset/versioned/fake/clientset_generated.go index 31bf30c1..6a40aa3e 100644 --- a/generated/1.21/client/supervisor/clientset/versioned/fake/clientset_generated.go +++ b/generated/1.21/client/supervisor/clientset/versioned/fake/clientset_generated.go @@ -11,6 +11,8 @@ import ( fakeconfigv1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake" idpv1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/idp/v1alpha1" fakeidpv1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake" + oauthv1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + fakeoauthv1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/watch" "k8s.io/client-go/discovery" @@ -74,3 +76,8 @@ func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface { func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake} } + +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return &fakeoauthv1alpha1.FakeOauthV1alpha1{Fake: &c.Fake} +} diff --git a/generated/1.21/client/supervisor/clientset/versioned/fake/register.go b/generated/1.21/client/supervisor/clientset/versioned/fake/register.go index 3a9d6a18..8fb2f241 100644 --- a/generated/1.21/client/supervisor/clientset/versioned/fake/register.go +++ b/generated/1.21/client/supervisor/clientset/versioned/fake/register.go @@ -8,6 +8,7 @@ package fake import ( configv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var codecs = serializer.NewCodecFactory(scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.21/client/supervisor/clientset/versioned/scheme/register.go b/generated/1.21/client/supervisor/clientset/versioned/scheme/register.go index 0629cdd4..ca3c854a 100644 --- a/generated/1.21/client/supervisor/clientset/versioned/scheme/register.go +++ b/generated/1.21/client/supervisor/clientset/versioned/scheme/register.go @@ -8,6 +8,7 @@ package scheme import ( configv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var ParameterCodec = runtime.NewParameterCodec(Scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..e7a470b6 --- /dev/null +++ b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// This package has the automatically generated typed clients. +package v1alpha1 diff --git a/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go new file mode 100644 index 00000000..7906901b --- /dev/null +++ b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// Package fake has the automatically generated clients. +package fake diff --git a/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go new file mode 100644 index 00000000..8e56072b --- /dev/null +++ b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go @@ -0,0 +1,27 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + rest "k8s.io/client-go/rest" + testing "k8s.io/client-go/testing" +) + +type FakeOauthV1alpha1 struct { + *testing.Fake +} + +func (c *FakeOauthV1alpha1) OIDCClients(namespace string) v1alpha1.OIDCClientInterface { + return &FakeOIDCClients{c, namespace} +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *FakeOauthV1alpha1) RESTClient() rest.Interface { + var ret *rest.RESTClient + return ret +} diff --git a/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go new file mode 100644 index 00000000..cdd06d71 --- /dev/null +++ b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go @@ -0,0 +1,129 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + "context" + + v1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + labels "k8s.io/apimachinery/pkg/labels" + schema "k8s.io/apimachinery/pkg/runtime/schema" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + testing "k8s.io/client-go/testing" +) + +// FakeOIDCClients implements OIDCClientInterface +type FakeOIDCClients struct { + Fake *FakeOauthV1alpha1 + ns string +} + +var oidcclientsResource = schema.GroupVersionResource{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"} + +var oidcclientsKind = schema.GroupVersionKind{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *FakeOIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *FakeOIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + obj, err := c.Fake. + Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{}) + + if obj == nil { + return nil, err + } + + label, _, _ := testing.ExtractFromListOptions(opts) + if label == nil { + label = labels.Everything() + } + list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta} + for _, item := range obj.(*v1alpha1.OIDCClientList).Items { + if label.Matches(labels.Set(item.Labels)) { + list.Items = append(list.Items, item) + } + } + return list, err +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *FakeOIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + return c.Fake. + InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts)) + +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *FakeOIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *FakeOIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + _, err := c.Fake. + Invokes(testing.NewDeleteAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + return err +} + +// DeleteCollection deletes a collection of objects. +func (c *FakeOIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOpts) + + _, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{}) + return err +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *FakeOIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} diff --git a/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go new file mode 100644 index 00000000..87d22ea9 --- /dev/null +++ b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go @@ -0,0 +1,8 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +type OIDCClientExpansion interface{} diff --git a/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go new file mode 100644 index 00000000..259f1b10 --- /dev/null +++ b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go @@ -0,0 +1,76 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/oauth/v1alpha1" + "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/scheme" + rest "k8s.io/client-go/rest" +) + +type OauthV1alpha1Interface interface { + RESTClient() rest.Interface + OIDCClientsGetter +} + +// OauthV1alpha1Client is used to interact with features provided by the oauth.supervisor.pinniped.dev group. +type OauthV1alpha1Client struct { + restClient rest.Interface +} + +func (c *OauthV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface { + return newOIDCClients(c, namespace) +} + +// NewForConfig creates a new OauthV1alpha1Client for the given config. +func NewForConfig(c *rest.Config) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + client, err := rest.RESTClientFor(&config) + if err != nil { + return nil, err + } + return &OauthV1alpha1Client{client}, nil +} + +// NewForConfigOrDie creates a new OauthV1alpha1Client for the given config and +// panics if there is an error in the config. +func NewForConfigOrDie(c *rest.Config) *OauthV1alpha1Client { + client, err := NewForConfig(c) + if err != nil { + panic(err) + } + return client +} + +// New creates a new OauthV1alpha1Client for the given RESTClient. +func New(c rest.Interface) *OauthV1alpha1Client { + return &OauthV1alpha1Client{c} +} + +func setConfigDefaults(config *rest.Config) error { + gv := v1alpha1.SchemeGroupVersion + config.GroupVersion = &gv + config.APIPath = "/apis" + config.NegotiatedSerializer = scheme.Codecs.WithoutConversion() + + if config.UserAgent == "" { + config.UserAgent = rest.DefaultKubernetesUserAgent() + } + + return nil +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *OauthV1alpha1Client) RESTClient() rest.Interface { + if c == nil { + return nil + } + return c.restClient +} diff --git a/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..c7e2f82b --- /dev/null +++ b/generated/1.21/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,182 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + "time" + + v1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/oauth/v1alpha1" + scheme "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + rest "k8s.io/client-go/rest" +) + +// OIDCClientsGetter has a method to return a OIDCClientInterface. +// A group's client should implement this interface. +type OIDCClientsGetter interface { + OIDCClients(namespace string) OIDCClientInterface +} + +// OIDCClientInterface has methods to work with OIDCClient resources. +type OIDCClientInterface interface { + Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (*v1alpha1.OIDCClient, error) + Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + Delete(ctx context.Context, name string, opts v1.DeleteOptions) error + DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error + Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCClient, error) + List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCClientList, error) + Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) + Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) + OIDCClientExpansion +} + +// oIDCClients implements OIDCClientInterface +type oIDCClients struct { + client rest.Interface + ns string +} + +// newOIDCClients returns a OIDCClients +func newOIDCClients(c *OauthV1alpha1Client, namespace string) *oIDCClients { + return &oIDCClients{ + client: c.RESTClient(), + ns: namespace, + } +} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *oIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + VersionedParams(&options, scheme.ParameterCodec). + Do(ctx). + Into(result) + return +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *oIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + result = &v1alpha1.OIDCClientList{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Do(ctx). + Into(result) + return +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *oIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + opts.Watch = true + return c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Watch(ctx) +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Post(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *oIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + SubResource("status"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *oIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + Body(&opts). + Do(ctx). + Error() +} + +// DeleteCollection deletes a collection of objects. +func (c *oIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + var timeout time.Duration + if listOpts.TimeoutSeconds != nil { + timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second + } + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&listOpts, scheme.ParameterCodec). + Timeout(timeout). + Body(&opts). + Do(ctx). + Error() +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *oIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Patch(pt). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + SubResource(subresources...). + VersionedParams(&opts, scheme.ParameterCodec). + Body(data). + Do(ctx). + Into(result) + return +} diff --git a/generated/1.21/client/supervisor/informers/externalversions/factory.go b/generated/1.21/client/supervisor/informers/externalversions/factory.go index 09200fa1..5f2301a2 100644 --- a/generated/1.21/client/supervisor/informers/externalversions/factory.go +++ b/generated/1.21/client/supervisor/informers/externalversions/factory.go @@ -14,6 +14,7 @@ import ( config "go.pinniped.dev/generated/1.21/client/supervisor/informers/externalversions/config" idp "go.pinniped.dev/generated/1.21/client/supervisor/informers/externalversions/idp" internalinterfaces "go.pinniped.dev/generated/1.21/client/supervisor/informers/externalversions/internalinterfaces" + oauth "go.pinniped.dev/generated/1.21/client/supervisor/informers/externalversions/oauth" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -162,6 +163,7 @@ type SharedInformerFactory interface { Config() config.Interface IDP() idp.Interface + Oauth() oauth.Interface } func (f *sharedInformerFactory) Config() config.Interface { @@ -171,3 +173,7 @@ func (f *sharedInformerFactory) Config() config.Interface { func (f *sharedInformerFactory) IDP() idp.Interface { return idp.New(f, f.namespace, f.tweakListOptions) } + +func (f *sharedInformerFactory) Oauth() oauth.Interface { + return oauth.New(f, f.namespace, f.tweakListOptions) +} diff --git a/generated/1.21/client/supervisor/informers/externalversions/generic.go b/generated/1.21/client/supervisor/informers/externalversions/generic.go index 1ccbd3e6..d08e96cf 100644 --- a/generated/1.21/client/supervisor/informers/externalversions/generic.go +++ b/generated/1.21/client/supervisor/informers/externalversions/generic.go @@ -10,6 +10,7 @@ import ( v1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/oauth/v1alpha1" schema "k8s.io/apimachinery/pkg/runtime/schema" cache "k8s.io/client-go/tools/cache" ) @@ -52,6 +53,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"): return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().OIDCIdentityProviders().Informer()}, nil + // Group=oauth.supervisor.pinniped.dev, Version=v1alpha1 + case oauthv1alpha1.SchemeGroupVersion.WithResource("oidcclients"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Oauth().V1alpha1().OIDCClients().Informer()}, nil + } return nil, fmt.Errorf("no informer found for %v", resource) diff --git a/generated/1.21/client/supervisor/informers/externalversions/oauth/interface.go b/generated/1.21/client/supervisor/informers/externalversions/oauth/interface.go new file mode 100644 index 00000000..d734d0d3 --- /dev/null +++ b/generated/1.21/client/supervisor/informers/externalversions/oauth/interface.go @@ -0,0 +1,33 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package oauth + +import ( + internalinterfaces "go.pinniped.dev/generated/1.21/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go b/generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go new file mode 100644 index 00000000..05ad0a58 --- /dev/null +++ b/generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go @@ -0,0 +1,32 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "go.pinniped.dev/generated/1.21/client/supervisor/informers/externalversions/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // OIDCClients returns a OIDCClientInformer. + OIDCClients() OIDCClientInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// OIDCClients returns a OIDCClientInformer. +func (v *version) OIDCClients() OIDCClientInformer { + return &oIDCClientInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} +} diff --git a/generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go b/generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..f56b83db --- /dev/null +++ b/generated/1.21/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,77 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + oauthv1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/oauth/v1alpha1" + versioned "go.pinniped.dev/generated/1.21/client/supervisor/clientset/versioned" + internalinterfaces "go.pinniped.dev/generated/1.21/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.21/client/supervisor/listers/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" +) + +// OIDCClientInformer provides access to a shared informer and lister for +// OIDCClients. +type OIDCClientInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.OIDCClientLister +} + +type oIDCClientInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc + namespace string +} + +// NewOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, namespace, resyncPeriod, indexers, nil) +} + +// NewFilteredOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).Watch(context.TODO(), options) + }, + }, + &oauthv1alpha1.OIDCClient{}, + resyncPeriod, + indexers, + ) +} + +func (f *oIDCClientInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *oIDCClientInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&oauthv1alpha1.OIDCClient{}, f.defaultInformer) +} + +func (f *oIDCClientInformer) Lister() v1alpha1.OIDCClientLister { + return v1alpha1.NewOIDCClientLister(f.Informer().GetIndexer()) +} diff --git a/generated/1.21/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go b/generated/1.21/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go new file mode 100644 index 00000000..c19310da --- /dev/null +++ b/generated/1.21/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go @@ -0,0 +1,14 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// OIDCClientListerExpansion allows custom methods to be added to +// OIDCClientLister. +type OIDCClientListerExpansion interface{} + +// OIDCClientNamespaceListerExpansion allows custom methods to be added to +// OIDCClientNamespaceLister. +type OIDCClientNamespaceListerExpansion interface{} diff --git a/generated/1.21/client/supervisor/listers/oauth/v1alpha1/oidcclient.go b/generated/1.21/client/supervisor/listers/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..ac6047cd --- /dev/null +++ b/generated/1.21/client/supervisor/listers/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,86 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.21/apis/supervisor/oauth/v1alpha1" + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" +) + +// OIDCClientLister helps list OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientLister interface { + // List lists all OIDCClients in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // OIDCClients returns an object that can list and get OIDCClients. + OIDCClients(namespace string) OIDCClientNamespaceLister + OIDCClientListerExpansion +} + +// oIDCClientLister implements the OIDCClientLister interface. +type oIDCClientLister struct { + indexer cache.Indexer +} + +// NewOIDCClientLister returns a new OIDCClientLister. +func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister { + return &oIDCClientLister{indexer: indexer} +} + +// List lists all OIDCClients in the indexer. +func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// OIDCClients returns an object that can list and get OIDCClients. +func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister { + return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace} +} + +// OIDCClientNamespaceLister helps list and get OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientNamespaceLister interface { + // List lists all OIDCClients in the indexer for a given namespace. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // Get retrieves the OIDCClient from the indexer for a given namespace and name. + // Objects returned here must be treated as read-only. + Get(name string) (*v1alpha1.OIDCClient, error) + OIDCClientNamespaceListerExpansion +} + +// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister +// interface. +type oIDCClientNamespaceLister struct { + indexer cache.Indexer + namespace string +} + +// List lists all OIDCClients in the indexer for a given namespace. +func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// Get retrieves the OIDCClient from the indexer for a given namespace and name. +func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) { + obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name) + } + return obj.(*v1alpha1.OIDCClient), nil +} diff --git a/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml new file mode 100644 index 00000000..0b4ee157 --- /dev/null +++ b/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: oidcclients.oauth.supervisor.pinniped.dev +spec: + group: oauth.supervisor.pinniped.dev + names: + categories: + - pinniped + kind: OIDCClient + listKind: OIDCClientList + plural: oidcclients + singular: oidcclient + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' + name: Privileged + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: OIDCClient describes the configuration of an OIDC client. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec of the OIDC provider. + properties: + allowedGrantTypes: + description: "allowedGrantTypes is a list of the allowed grant_type + param values that should be accepted during OIDC flows with this + client. \n Must only contain the following values: - authorization_code: + allows the client to perform the authorization code grant flow, + i.e. allows the webapp to authenticate users. This grant must always + be listed. - refresh_token: allows the client to perform refresh + grants for the user to extend the user's session. This grant must + be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: + allows the client to perform RFC8693 token exchange, which is a + step in the process to be able to get a cluster credential for the + user. This grant must be listed if allowedScopes lists pinniped:request-audience." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedRedirectURIs: + description: allowedRedirectURIs is a list of the allowed redirect_uri + param values that should be accepted during OIDC flows with this + client. Any other uris will be rejected. Must be https, unless it + is a loopback. + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedScopes: + description: "allowedScopes is a list of the allowed scopes param + values that should be accepted during OIDC flows with this client. + \n Must only contain the following values: - openid: The client + is allowed to request ID tokens. ID tokens only include the required + claims by default (iss, sub, aud, exp, iat). This scope must always + be listed. - offline_access: The client is allowed to request an + initial refresh token during the authorization code grant flow. + This scope must be listed if allowedGrantTypes lists refresh_token. + - pinniped:request-audience: The client is allowed to request a + new audience value during a RFC8693 token exchange, which is a step + in the process to be able to get a cluster credential for the user. + openid, username and groups scopes must be listed when this scope + is present. This scope must be listed if allowedGrantTypes lists + urn:ietf:params:oauth:grant-type:token-exchange. - username: The + client is allowed to request that ID tokens contain the user's username. + Without the username scope being requested and allowed, the ID token + will not contain the user's username. - groups: The client is allowed + to request that ID tokens contain the user's group membership, if + their group membership is discoverable by the Supervisor. Without + the groups scope being requested and allowed, the ID token will + not contain groups." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + required: + - allowedGrantTypes + - allowedRedirectURIs + - allowedScopes + type: object + status: + description: Status of the OIDC provider. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/generated/1.22/README.adoc b/generated/1.22/README.adoc index 46e9a2e5..51cf7c07 100644 --- a/generated/1.22/README.adoc +++ b/generated/1.22/README.adoc @@ -12,6 +12,7 @@ - xref:{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1[$$identity.concierge.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$] +- xref:{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1[$$oauth.supervisor.pinniped.dev/v1alpha1$$] [id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"] @@ -1332,3 +1333,56 @@ TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned |=== + +[id="{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1"] +=== oauth.supervisor.pinniped.dev/v1alpha1 + +Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclient"] +==== OIDCClient + +OIDCClient describes the configuration of an OIDC client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclientlist[$$OIDCClientList$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. + +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +|=== + + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclientspec"] +==== OIDCClientSpec + +OIDCClientSpec is a struct that describes an OIDC Client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclient[$$OIDCClient$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. +| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. +| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. +|=== + + + + diff --git a/generated/1.22/apis/supervisor/oauth/v1alpha1/doc.go b/generated/1.22/apis/supervisor/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/generated/1.22/apis/supervisor/oauth/v1alpha1/doc.go @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/generated/1.22/apis/supervisor/oauth/v1alpha1/register.go b/generated/1.22/apis/supervisor/oauth/v1alpha1/register.go new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/generated/1.22/apis/supervisor/oauth/v1alpha1/register.go @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/generated/1.22/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.22/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..cb35cea5 --- /dev/null +++ b/generated/1.22/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,121 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClient) DeepCopyInto(out *OIDCClient) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClient. +func (in *OIDCClient) DeepCopy() *OIDCClient { + if in == nil { + return nil + } + out := new(OIDCClient) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClient) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientList) DeepCopyInto(out *OIDCClientList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OIDCClient, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientList. +func (in *OIDCClientList) DeepCopy() *OIDCClientList { + if in == nil { + return nil + } + out := new(OIDCClientList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClientList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { + *out = *in + if in.AllowedRedirectURIs != nil { + in, out := &in.AllowedRedirectURIs, &out.AllowedRedirectURIs + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedGrantTypes != nil { + in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedScopes != nil { + in, out := &in.AllowedScopes, &out.AllowedScopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientSpec. +func (in *OIDCClientSpec) DeepCopy() *OIDCClientSpec { + if in == nil { + return nil + } + out := new(OIDCClientSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientStatus) DeepCopyInto(out *OIDCClientStatus) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientStatus. +func (in *OIDCClientStatus) DeepCopy() *OIDCClientStatus { + if in == nil { + return nil + } + out := new(OIDCClientStatus) + in.DeepCopyInto(out) + return out +} diff --git a/generated/1.22/client/supervisor/clientset/versioned/clientset.go b/generated/1.22/client/supervisor/clientset/versioned/clientset.go index b110aa5d..dcdcab22 100644 --- a/generated/1.22/client/supervisor/clientset/versioned/clientset.go +++ b/generated/1.22/client/supervisor/clientset/versioned/clientset.go @@ -10,6 +10,7 @@ import ( configv1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" discovery "k8s.io/client-go/discovery" rest "k8s.io/client-go/rest" flowcontrol "k8s.io/client-go/util/flowcontrol" @@ -19,6 +20,7 @@ type Interface interface { Discovery() discovery.DiscoveryInterface ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface + OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface } // Clientset contains the clients for groups. Each group has exactly one @@ -27,6 +29,7 @@ type Clientset struct { *discovery.DiscoveryClient configV1alpha1 *configv1alpha1.ConfigV1alpha1Client iDPV1alpha1 *idpv1alpha1.IDPV1alpha1Client + oauthV1alpha1 *oauthv1alpha1.OauthV1alpha1Client } // ConfigV1alpha1 retrieves the ConfigV1alpha1Client @@ -39,6 +42,11 @@ func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return c.iDPV1alpha1 } +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return c.oauthV1alpha1 +} + // Discovery retrieves the DiscoveryClient func (c *Clientset) Discovery() discovery.DiscoveryInterface { if c == nil { @@ -68,6 +76,10 @@ func NewForConfig(c *rest.Config) (*Clientset, error) { if err != nil { return nil, err } + cs.oauthV1alpha1, err = oauthv1alpha1.NewForConfig(&configShallowCopy) + if err != nil { + return nil, err + } cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy) if err != nil { @@ -82,6 +94,7 @@ func NewForConfigOrDie(c *rest.Config) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.NewForConfigOrDie(c) cs.iDPV1alpha1 = idpv1alpha1.NewForConfigOrDie(c) + cs.oauthV1alpha1 = oauthv1alpha1.NewForConfigOrDie(c) cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c) return &cs @@ -92,6 +105,7 @@ func New(c rest.Interface) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.New(c) cs.iDPV1alpha1 = idpv1alpha1.New(c) + cs.oauthV1alpha1 = oauthv1alpha1.New(c) cs.DiscoveryClient = discovery.NewDiscoveryClient(c) return &cs diff --git a/generated/1.22/client/supervisor/clientset/versioned/fake/clientset_generated.go b/generated/1.22/client/supervisor/clientset/versioned/fake/clientset_generated.go index 919b66cf..492217cf 100644 --- a/generated/1.22/client/supervisor/clientset/versioned/fake/clientset_generated.go +++ b/generated/1.22/client/supervisor/clientset/versioned/fake/clientset_generated.go @@ -11,6 +11,8 @@ import ( fakeconfigv1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake" idpv1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/idp/v1alpha1" fakeidpv1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake" + oauthv1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + fakeoauthv1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/watch" "k8s.io/client-go/discovery" @@ -77,3 +79,8 @@ func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface { func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake} } + +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return &fakeoauthv1alpha1.FakeOauthV1alpha1{Fake: &c.Fake} +} diff --git a/generated/1.22/client/supervisor/clientset/versioned/fake/register.go b/generated/1.22/client/supervisor/clientset/versioned/fake/register.go index 38fb0501..690d6ee3 100644 --- a/generated/1.22/client/supervisor/clientset/versioned/fake/register.go +++ b/generated/1.22/client/supervisor/clientset/versioned/fake/register.go @@ -8,6 +8,7 @@ package fake import ( configv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var codecs = serializer.NewCodecFactory(scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.22/client/supervisor/clientset/versioned/scheme/register.go b/generated/1.22/client/supervisor/clientset/versioned/scheme/register.go index 1fdb17cd..99bafb85 100644 --- a/generated/1.22/client/supervisor/clientset/versioned/scheme/register.go +++ b/generated/1.22/client/supervisor/clientset/versioned/scheme/register.go @@ -8,6 +8,7 @@ package scheme import ( configv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var ParameterCodec = runtime.NewParameterCodec(Scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..e7a470b6 --- /dev/null +++ b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// This package has the automatically generated typed clients. +package v1alpha1 diff --git a/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go new file mode 100644 index 00000000..7906901b --- /dev/null +++ b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// Package fake has the automatically generated clients. +package fake diff --git a/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go new file mode 100644 index 00000000..7f7620ad --- /dev/null +++ b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go @@ -0,0 +1,27 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + rest "k8s.io/client-go/rest" + testing "k8s.io/client-go/testing" +) + +type FakeOauthV1alpha1 struct { + *testing.Fake +} + +func (c *FakeOauthV1alpha1) OIDCClients(namespace string) v1alpha1.OIDCClientInterface { + return &FakeOIDCClients{c, namespace} +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *FakeOauthV1alpha1) RESTClient() rest.Interface { + var ret *rest.RESTClient + return ret +} diff --git a/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go new file mode 100644 index 00000000..afddba32 --- /dev/null +++ b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go @@ -0,0 +1,129 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + "context" + + v1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + labels "k8s.io/apimachinery/pkg/labels" + schema "k8s.io/apimachinery/pkg/runtime/schema" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + testing "k8s.io/client-go/testing" +) + +// FakeOIDCClients implements OIDCClientInterface +type FakeOIDCClients struct { + Fake *FakeOauthV1alpha1 + ns string +} + +var oidcclientsResource = schema.GroupVersionResource{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"} + +var oidcclientsKind = schema.GroupVersionKind{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *FakeOIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *FakeOIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + obj, err := c.Fake. + Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{}) + + if obj == nil { + return nil, err + } + + label, _, _ := testing.ExtractFromListOptions(opts) + if label == nil { + label = labels.Everything() + } + list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta} + for _, item := range obj.(*v1alpha1.OIDCClientList).Items { + if label.Matches(labels.Set(item.Labels)) { + list.Items = append(list.Items, item) + } + } + return list, err +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *FakeOIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + return c.Fake. + InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts)) + +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *FakeOIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *FakeOIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + _, err := c.Fake. + Invokes(testing.NewDeleteAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + return err +} + +// DeleteCollection deletes a collection of objects. +func (c *FakeOIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOpts) + + _, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{}) + return err +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *FakeOIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} diff --git a/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go new file mode 100644 index 00000000..87d22ea9 --- /dev/null +++ b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go @@ -0,0 +1,8 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +type OIDCClientExpansion interface{} diff --git a/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go new file mode 100644 index 00000000..1bf4eb28 --- /dev/null +++ b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go @@ -0,0 +1,76 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/oauth/v1alpha1" + "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/scheme" + rest "k8s.io/client-go/rest" +) + +type OauthV1alpha1Interface interface { + RESTClient() rest.Interface + OIDCClientsGetter +} + +// OauthV1alpha1Client is used to interact with features provided by the oauth.supervisor.pinniped.dev group. +type OauthV1alpha1Client struct { + restClient rest.Interface +} + +func (c *OauthV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface { + return newOIDCClients(c, namespace) +} + +// NewForConfig creates a new OauthV1alpha1Client for the given config. +func NewForConfig(c *rest.Config) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + client, err := rest.RESTClientFor(&config) + if err != nil { + return nil, err + } + return &OauthV1alpha1Client{client}, nil +} + +// NewForConfigOrDie creates a new OauthV1alpha1Client for the given config and +// panics if there is an error in the config. +func NewForConfigOrDie(c *rest.Config) *OauthV1alpha1Client { + client, err := NewForConfig(c) + if err != nil { + panic(err) + } + return client +} + +// New creates a new OauthV1alpha1Client for the given RESTClient. +func New(c rest.Interface) *OauthV1alpha1Client { + return &OauthV1alpha1Client{c} +} + +func setConfigDefaults(config *rest.Config) error { + gv := v1alpha1.SchemeGroupVersion + config.GroupVersion = &gv + config.APIPath = "/apis" + config.NegotiatedSerializer = scheme.Codecs.WithoutConversion() + + if config.UserAgent == "" { + config.UserAgent = rest.DefaultKubernetesUserAgent() + } + + return nil +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *OauthV1alpha1Client) RESTClient() rest.Interface { + if c == nil { + return nil + } + return c.restClient +} diff --git a/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..be9f6246 --- /dev/null +++ b/generated/1.22/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,182 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + "time" + + v1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/oauth/v1alpha1" + scheme "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + rest "k8s.io/client-go/rest" +) + +// OIDCClientsGetter has a method to return a OIDCClientInterface. +// A group's client should implement this interface. +type OIDCClientsGetter interface { + OIDCClients(namespace string) OIDCClientInterface +} + +// OIDCClientInterface has methods to work with OIDCClient resources. +type OIDCClientInterface interface { + Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (*v1alpha1.OIDCClient, error) + Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + Delete(ctx context.Context, name string, opts v1.DeleteOptions) error + DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error + Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCClient, error) + List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCClientList, error) + Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) + Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) + OIDCClientExpansion +} + +// oIDCClients implements OIDCClientInterface +type oIDCClients struct { + client rest.Interface + ns string +} + +// newOIDCClients returns a OIDCClients +func newOIDCClients(c *OauthV1alpha1Client, namespace string) *oIDCClients { + return &oIDCClients{ + client: c.RESTClient(), + ns: namespace, + } +} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *oIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + VersionedParams(&options, scheme.ParameterCodec). + Do(ctx). + Into(result) + return +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *oIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + result = &v1alpha1.OIDCClientList{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Do(ctx). + Into(result) + return +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *oIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + opts.Watch = true + return c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Watch(ctx) +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Post(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *oIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + SubResource("status"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *oIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + Body(&opts). + Do(ctx). + Error() +} + +// DeleteCollection deletes a collection of objects. +func (c *oIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + var timeout time.Duration + if listOpts.TimeoutSeconds != nil { + timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second + } + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&listOpts, scheme.ParameterCodec). + Timeout(timeout). + Body(&opts). + Do(ctx). + Error() +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *oIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Patch(pt). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + SubResource(subresources...). + VersionedParams(&opts, scheme.ParameterCodec). + Body(data). + Do(ctx). + Into(result) + return +} diff --git a/generated/1.22/client/supervisor/informers/externalversions/factory.go b/generated/1.22/client/supervisor/informers/externalversions/factory.go index 1686a18c..b1a59943 100644 --- a/generated/1.22/client/supervisor/informers/externalversions/factory.go +++ b/generated/1.22/client/supervisor/informers/externalversions/factory.go @@ -14,6 +14,7 @@ import ( config "go.pinniped.dev/generated/1.22/client/supervisor/informers/externalversions/config" idp "go.pinniped.dev/generated/1.22/client/supervisor/informers/externalversions/idp" internalinterfaces "go.pinniped.dev/generated/1.22/client/supervisor/informers/externalversions/internalinterfaces" + oauth "go.pinniped.dev/generated/1.22/client/supervisor/informers/externalversions/oauth" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -162,6 +163,7 @@ type SharedInformerFactory interface { Config() config.Interface IDP() idp.Interface + Oauth() oauth.Interface } func (f *sharedInformerFactory) Config() config.Interface { @@ -171,3 +173,7 @@ func (f *sharedInformerFactory) Config() config.Interface { func (f *sharedInformerFactory) IDP() idp.Interface { return idp.New(f, f.namespace, f.tweakListOptions) } + +func (f *sharedInformerFactory) Oauth() oauth.Interface { + return oauth.New(f, f.namespace, f.tweakListOptions) +} diff --git a/generated/1.22/client/supervisor/informers/externalversions/generic.go b/generated/1.22/client/supervisor/informers/externalversions/generic.go index 9d595d85..0380a5b8 100644 --- a/generated/1.22/client/supervisor/informers/externalversions/generic.go +++ b/generated/1.22/client/supervisor/informers/externalversions/generic.go @@ -10,6 +10,7 @@ import ( v1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/oauth/v1alpha1" schema "k8s.io/apimachinery/pkg/runtime/schema" cache "k8s.io/client-go/tools/cache" ) @@ -52,6 +53,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"): return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().OIDCIdentityProviders().Informer()}, nil + // Group=oauth.supervisor.pinniped.dev, Version=v1alpha1 + case oauthv1alpha1.SchemeGroupVersion.WithResource("oidcclients"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Oauth().V1alpha1().OIDCClients().Informer()}, nil + } return nil, fmt.Errorf("no informer found for %v", resource) diff --git a/generated/1.22/client/supervisor/informers/externalversions/oauth/interface.go b/generated/1.22/client/supervisor/informers/externalversions/oauth/interface.go new file mode 100644 index 00000000..97090c7c --- /dev/null +++ b/generated/1.22/client/supervisor/informers/externalversions/oauth/interface.go @@ -0,0 +1,33 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package oauth + +import ( + internalinterfaces "go.pinniped.dev/generated/1.22/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go b/generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go new file mode 100644 index 00000000..19d5ccb1 --- /dev/null +++ b/generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go @@ -0,0 +1,32 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "go.pinniped.dev/generated/1.22/client/supervisor/informers/externalversions/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // OIDCClients returns a OIDCClientInformer. + OIDCClients() OIDCClientInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// OIDCClients returns a OIDCClientInformer. +func (v *version) OIDCClients() OIDCClientInformer { + return &oIDCClientInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} +} diff --git a/generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go b/generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..73fd8a10 --- /dev/null +++ b/generated/1.22/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,77 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + oauthv1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/oauth/v1alpha1" + versioned "go.pinniped.dev/generated/1.22/client/supervisor/clientset/versioned" + internalinterfaces "go.pinniped.dev/generated/1.22/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.22/client/supervisor/listers/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" +) + +// OIDCClientInformer provides access to a shared informer and lister for +// OIDCClients. +type OIDCClientInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.OIDCClientLister +} + +type oIDCClientInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc + namespace string +} + +// NewOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, namespace, resyncPeriod, indexers, nil) +} + +// NewFilteredOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).Watch(context.TODO(), options) + }, + }, + &oauthv1alpha1.OIDCClient{}, + resyncPeriod, + indexers, + ) +} + +func (f *oIDCClientInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *oIDCClientInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&oauthv1alpha1.OIDCClient{}, f.defaultInformer) +} + +func (f *oIDCClientInformer) Lister() v1alpha1.OIDCClientLister { + return v1alpha1.NewOIDCClientLister(f.Informer().GetIndexer()) +} diff --git a/generated/1.22/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go b/generated/1.22/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go new file mode 100644 index 00000000..c19310da --- /dev/null +++ b/generated/1.22/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go @@ -0,0 +1,14 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// OIDCClientListerExpansion allows custom methods to be added to +// OIDCClientLister. +type OIDCClientListerExpansion interface{} + +// OIDCClientNamespaceListerExpansion allows custom methods to be added to +// OIDCClientNamespaceLister. +type OIDCClientNamespaceListerExpansion interface{} diff --git a/generated/1.22/client/supervisor/listers/oauth/v1alpha1/oidcclient.go b/generated/1.22/client/supervisor/listers/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..e73a2114 --- /dev/null +++ b/generated/1.22/client/supervisor/listers/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,86 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.22/apis/supervisor/oauth/v1alpha1" + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" +) + +// OIDCClientLister helps list OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientLister interface { + // List lists all OIDCClients in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // OIDCClients returns an object that can list and get OIDCClients. + OIDCClients(namespace string) OIDCClientNamespaceLister + OIDCClientListerExpansion +} + +// oIDCClientLister implements the OIDCClientLister interface. +type oIDCClientLister struct { + indexer cache.Indexer +} + +// NewOIDCClientLister returns a new OIDCClientLister. +func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister { + return &oIDCClientLister{indexer: indexer} +} + +// List lists all OIDCClients in the indexer. +func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// OIDCClients returns an object that can list and get OIDCClients. +func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister { + return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace} +} + +// OIDCClientNamespaceLister helps list and get OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientNamespaceLister interface { + // List lists all OIDCClients in the indexer for a given namespace. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // Get retrieves the OIDCClient from the indexer for a given namespace and name. + // Objects returned here must be treated as read-only. + Get(name string) (*v1alpha1.OIDCClient, error) + OIDCClientNamespaceListerExpansion +} + +// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister +// interface. +type oIDCClientNamespaceLister struct { + indexer cache.Indexer + namespace string +} + +// List lists all OIDCClients in the indexer for a given namespace. +func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// Get retrieves the OIDCClient from the indexer for a given namespace and name. +func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) { + obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name) + } + return obj.(*v1alpha1.OIDCClient), nil +} diff --git a/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml new file mode 100644 index 00000000..0b4ee157 --- /dev/null +++ b/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: oidcclients.oauth.supervisor.pinniped.dev +spec: + group: oauth.supervisor.pinniped.dev + names: + categories: + - pinniped + kind: OIDCClient + listKind: OIDCClientList + plural: oidcclients + singular: oidcclient + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' + name: Privileged + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: OIDCClient describes the configuration of an OIDC client. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec of the OIDC provider. + properties: + allowedGrantTypes: + description: "allowedGrantTypes is a list of the allowed grant_type + param values that should be accepted during OIDC flows with this + client. \n Must only contain the following values: - authorization_code: + allows the client to perform the authorization code grant flow, + i.e. allows the webapp to authenticate users. This grant must always + be listed. - refresh_token: allows the client to perform refresh + grants for the user to extend the user's session. This grant must + be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: + allows the client to perform RFC8693 token exchange, which is a + step in the process to be able to get a cluster credential for the + user. This grant must be listed if allowedScopes lists pinniped:request-audience." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedRedirectURIs: + description: allowedRedirectURIs is a list of the allowed redirect_uri + param values that should be accepted during OIDC flows with this + client. Any other uris will be rejected. Must be https, unless it + is a loopback. + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedScopes: + description: "allowedScopes is a list of the allowed scopes param + values that should be accepted during OIDC flows with this client. + \n Must only contain the following values: - openid: The client + is allowed to request ID tokens. ID tokens only include the required + claims by default (iss, sub, aud, exp, iat). This scope must always + be listed. - offline_access: The client is allowed to request an + initial refresh token during the authorization code grant flow. + This scope must be listed if allowedGrantTypes lists refresh_token. + - pinniped:request-audience: The client is allowed to request a + new audience value during a RFC8693 token exchange, which is a step + in the process to be able to get a cluster credential for the user. + openid, username and groups scopes must be listed when this scope + is present. This scope must be listed if allowedGrantTypes lists + urn:ietf:params:oauth:grant-type:token-exchange. - username: The + client is allowed to request that ID tokens contain the user's username. + Without the username scope being requested and allowed, the ID token + will not contain the user's username. - groups: The client is allowed + to request that ID tokens contain the user's group membership, if + their group membership is discoverable by the Supervisor. Without + the groups scope being requested and allowed, the ID token will + not contain groups." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + required: + - allowedGrantTypes + - allowedRedirectURIs + - allowedScopes + type: object + status: + description: Status of the OIDC provider. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/generated/1.23/README.adoc b/generated/1.23/README.adoc index 9d67cb25..b7eddf16 100644 --- a/generated/1.23/README.adoc +++ b/generated/1.23/README.adoc @@ -12,6 +12,7 @@ - xref:{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1[$$identity.concierge.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$] - xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$] +- xref:{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1[$$oauth.supervisor.pinniped.dev/v1alpha1$$] [id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"] @@ -1332,3 +1333,56 @@ TokenCredentialRequestStatus is the status of a TokenCredentialRequest, returned |=== + +[id="{anchor_prefix}-oauth-supervisor-pinniped-dev-v1alpha1"] +=== oauth.supervisor.pinniped.dev/v1alpha1 + +Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclient"] +==== OIDCClient + +OIDCClient describes the configuration of an OIDC client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclientlist[$$OIDCClientList$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. + +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +|=== + + + + +[id="{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclientspec"] +==== OIDCClientSpec + +OIDCClientSpec is a struct that describes an OIDC Client. + +.Appears In: +**** +- xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclient[$$OIDCClient$$] +**** + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. +| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. +| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. +|=== + + + + diff --git a/generated/1.23/apis/supervisor/oauth/v1alpha1/doc.go b/generated/1.23/apis/supervisor/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/generated/1.23/apis/supervisor/oauth/v1alpha1/doc.go @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/generated/1.23/apis/supervisor/oauth/v1alpha1/register.go b/generated/1.23/apis/supervisor/oauth/v1alpha1/register.go new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/generated/1.23/apis/supervisor/oauth/v1alpha1/register.go @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/generated/1.23/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.23/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..cb35cea5 --- /dev/null +++ b/generated/1.23/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,121 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClient) DeepCopyInto(out *OIDCClient) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClient. +func (in *OIDCClient) DeepCopy() *OIDCClient { + if in == nil { + return nil + } + out := new(OIDCClient) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClient) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientList) DeepCopyInto(out *OIDCClientList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OIDCClient, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientList. +func (in *OIDCClientList) DeepCopy() *OIDCClientList { + if in == nil { + return nil + } + out := new(OIDCClientList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClientList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { + *out = *in + if in.AllowedRedirectURIs != nil { + in, out := &in.AllowedRedirectURIs, &out.AllowedRedirectURIs + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedGrantTypes != nil { + in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedScopes != nil { + in, out := &in.AllowedScopes, &out.AllowedScopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientSpec. +func (in *OIDCClientSpec) DeepCopy() *OIDCClientSpec { + if in == nil { + return nil + } + out := new(OIDCClientSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientStatus) DeepCopyInto(out *OIDCClientStatus) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientStatus. +func (in *OIDCClientStatus) DeepCopy() *OIDCClientStatus { + if in == nil { + return nil + } + out := new(OIDCClientStatus) + in.DeepCopyInto(out) + return out +} diff --git a/generated/1.23/client/supervisor/clientset/versioned/clientset.go b/generated/1.23/client/supervisor/clientset/versioned/clientset.go index b36adb5b..b0f81c08 100644 --- a/generated/1.23/client/supervisor/clientset/versioned/clientset.go +++ b/generated/1.23/client/supervisor/clientset/versioned/clientset.go @@ -11,6 +11,7 @@ import ( configv1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" discovery "k8s.io/client-go/discovery" rest "k8s.io/client-go/rest" flowcontrol "k8s.io/client-go/util/flowcontrol" @@ -20,6 +21,7 @@ type Interface interface { Discovery() discovery.DiscoveryInterface ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface + OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface } // Clientset contains the clients for groups. Each group has exactly one @@ -28,6 +30,7 @@ type Clientset struct { *discovery.DiscoveryClient configV1alpha1 *configv1alpha1.ConfigV1alpha1Client iDPV1alpha1 *idpv1alpha1.IDPV1alpha1Client + oauthV1alpha1 *oauthv1alpha1.OauthV1alpha1Client } // ConfigV1alpha1 retrieves the ConfigV1alpha1Client @@ -40,6 +43,11 @@ func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return c.iDPV1alpha1 } +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return c.oauthV1alpha1 +} + // Discovery retrieves the DiscoveryClient func (c *Clientset) Discovery() discovery.DiscoveryInterface { if c == nil { @@ -88,6 +96,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, if err != nil { return nil, err } + cs.oauthV1alpha1, err = oauthv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient) + if err != nil { + return nil, err + } cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient) if err != nil { @@ -111,6 +123,7 @@ func New(c rest.Interface) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.New(c) cs.iDPV1alpha1 = idpv1alpha1.New(c) + cs.oauthV1alpha1 = oauthv1alpha1.New(c) cs.DiscoveryClient = discovery.NewDiscoveryClient(c) return &cs diff --git a/generated/1.23/client/supervisor/clientset/versioned/fake/clientset_generated.go b/generated/1.23/client/supervisor/clientset/versioned/fake/clientset_generated.go index 0c53ef8d..26e5ff04 100644 --- a/generated/1.23/client/supervisor/clientset/versioned/fake/clientset_generated.go +++ b/generated/1.23/client/supervisor/clientset/versioned/fake/clientset_generated.go @@ -11,6 +11,8 @@ import ( fakeconfigv1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake" idpv1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/idp/v1alpha1" fakeidpv1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake" + oauthv1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + fakeoauthv1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/watch" "k8s.io/client-go/discovery" @@ -77,3 +79,8 @@ func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface { func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake} } + +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return &fakeoauthv1alpha1.FakeOauthV1alpha1{Fake: &c.Fake} +} diff --git a/generated/1.23/client/supervisor/clientset/versioned/fake/register.go b/generated/1.23/client/supervisor/clientset/versioned/fake/register.go index f46c7432..328aca4e 100644 --- a/generated/1.23/client/supervisor/clientset/versioned/fake/register.go +++ b/generated/1.23/client/supervisor/clientset/versioned/fake/register.go @@ -8,6 +8,7 @@ package fake import ( configv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var codecs = serializer.NewCodecFactory(scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.23/client/supervisor/clientset/versioned/scheme/register.go b/generated/1.23/client/supervisor/clientset/versioned/scheme/register.go index b251a20d..5d908f2e 100644 --- a/generated/1.23/client/supervisor/clientset/versioned/scheme/register.go +++ b/generated/1.23/client/supervisor/clientset/versioned/scheme/register.go @@ -8,6 +8,7 @@ package scheme import ( configv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var ParameterCodec = runtime.NewParameterCodec(Scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..e7a470b6 --- /dev/null +++ b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// This package has the automatically generated typed clients. +package v1alpha1 diff --git a/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go new file mode 100644 index 00000000..7906901b --- /dev/null +++ b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// Package fake has the automatically generated clients. +package fake diff --git a/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go new file mode 100644 index 00000000..c5ce6f9b --- /dev/null +++ b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go @@ -0,0 +1,27 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + rest "k8s.io/client-go/rest" + testing "k8s.io/client-go/testing" +) + +type FakeOauthV1alpha1 struct { + *testing.Fake +} + +func (c *FakeOauthV1alpha1) OIDCClients(namespace string) v1alpha1.OIDCClientInterface { + return &FakeOIDCClients{c, namespace} +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *FakeOauthV1alpha1) RESTClient() rest.Interface { + var ret *rest.RESTClient + return ret +} diff --git a/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go new file mode 100644 index 00000000..34cf2735 --- /dev/null +++ b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go @@ -0,0 +1,129 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + "context" + + v1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + labels "k8s.io/apimachinery/pkg/labels" + schema "k8s.io/apimachinery/pkg/runtime/schema" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + testing "k8s.io/client-go/testing" +) + +// FakeOIDCClients implements OIDCClientInterface +type FakeOIDCClients struct { + Fake *FakeOauthV1alpha1 + ns string +} + +var oidcclientsResource = schema.GroupVersionResource{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"} + +var oidcclientsKind = schema.GroupVersionKind{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *FakeOIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *FakeOIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + obj, err := c.Fake. + Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{}) + + if obj == nil { + return nil, err + } + + label, _, _ := testing.ExtractFromListOptions(opts) + if label == nil { + label = labels.Everything() + } + list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta} + for _, item := range obj.(*v1alpha1.OIDCClientList).Items { + if label.Matches(labels.Set(item.Labels)) { + list.Items = append(list.Items, item) + } + } + return list, err +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *FakeOIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + return c.Fake. + InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts)) + +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *FakeOIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *FakeOIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + _, err := c.Fake. + Invokes(testing.NewDeleteActionWithOptions(oidcclientsResource, c.ns, name, opts), &v1alpha1.OIDCClient{}) + + return err +} + +// DeleteCollection deletes a collection of objects. +func (c *FakeOIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOpts) + + _, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{}) + return err +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *FakeOIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} diff --git a/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go new file mode 100644 index 00000000..87d22ea9 --- /dev/null +++ b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go @@ -0,0 +1,8 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +type OIDCClientExpansion interface{} diff --git a/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go new file mode 100644 index 00000000..7891e154 --- /dev/null +++ b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go @@ -0,0 +1,94 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "net/http" + + v1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/oauth/v1alpha1" + "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/scheme" + rest "k8s.io/client-go/rest" +) + +type OauthV1alpha1Interface interface { + RESTClient() rest.Interface + OIDCClientsGetter +} + +// OauthV1alpha1Client is used to interact with features provided by the oauth.supervisor.pinniped.dev group. +type OauthV1alpha1Client struct { + restClient rest.Interface +} + +func (c *OauthV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface { + return newOIDCClients(c, namespace) +} + +// NewForConfig creates a new OauthV1alpha1Client for the given config. +// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient), +// where httpClient was generated with rest.HTTPClientFor(c). +func NewForConfig(c *rest.Config) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + httpClient, err := rest.HTTPClientFor(&config) + if err != nil { + return nil, err + } + return NewForConfigAndClient(&config, httpClient) +} + +// NewForConfigAndClient creates a new OauthV1alpha1Client for the given config and http client. +// Note the http client provided takes precedence over the configured transport values. +func NewForConfigAndClient(c *rest.Config, h *http.Client) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + client, err := rest.RESTClientForConfigAndClient(&config, h) + if err != nil { + return nil, err + } + return &OauthV1alpha1Client{client}, nil +} + +// NewForConfigOrDie creates a new OauthV1alpha1Client for the given config and +// panics if there is an error in the config. +func NewForConfigOrDie(c *rest.Config) *OauthV1alpha1Client { + client, err := NewForConfig(c) + if err != nil { + panic(err) + } + return client +} + +// New creates a new OauthV1alpha1Client for the given RESTClient. +func New(c rest.Interface) *OauthV1alpha1Client { + return &OauthV1alpha1Client{c} +} + +func setConfigDefaults(config *rest.Config) error { + gv := v1alpha1.SchemeGroupVersion + config.GroupVersion = &gv + config.APIPath = "/apis" + config.NegotiatedSerializer = scheme.Codecs.WithoutConversion() + + if config.UserAgent == "" { + config.UserAgent = rest.DefaultKubernetesUserAgent() + } + + return nil +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *OauthV1alpha1Client) RESTClient() rest.Interface { + if c == nil { + return nil + } + return c.restClient +} diff --git a/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..18287fd4 --- /dev/null +++ b/generated/1.23/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,182 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + "time" + + v1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/oauth/v1alpha1" + scheme "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + rest "k8s.io/client-go/rest" +) + +// OIDCClientsGetter has a method to return a OIDCClientInterface. +// A group's client should implement this interface. +type OIDCClientsGetter interface { + OIDCClients(namespace string) OIDCClientInterface +} + +// OIDCClientInterface has methods to work with OIDCClient resources. +type OIDCClientInterface interface { + Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (*v1alpha1.OIDCClient, error) + Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + Delete(ctx context.Context, name string, opts v1.DeleteOptions) error + DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error + Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCClient, error) + List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCClientList, error) + Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) + Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) + OIDCClientExpansion +} + +// oIDCClients implements OIDCClientInterface +type oIDCClients struct { + client rest.Interface + ns string +} + +// newOIDCClients returns a OIDCClients +func newOIDCClients(c *OauthV1alpha1Client, namespace string) *oIDCClients { + return &oIDCClients{ + client: c.RESTClient(), + ns: namespace, + } +} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *oIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + VersionedParams(&options, scheme.ParameterCodec). + Do(ctx). + Into(result) + return +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *oIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + result = &v1alpha1.OIDCClientList{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Do(ctx). + Into(result) + return +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *oIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + opts.Watch = true + return c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Watch(ctx) +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Post(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *oIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + SubResource("status"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *oIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + Body(&opts). + Do(ctx). + Error() +} + +// DeleteCollection deletes a collection of objects. +func (c *oIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + var timeout time.Duration + if listOpts.TimeoutSeconds != nil { + timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second + } + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&listOpts, scheme.ParameterCodec). + Timeout(timeout). + Body(&opts). + Do(ctx). + Error() +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *oIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Patch(pt). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + SubResource(subresources...). + VersionedParams(&opts, scheme.ParameterCodec). + Body(data). + Do(ctx). + Into(result) + return +} diff --git a/generated/1.23/client/supervisor/informers/externalversions/factory.go b/generated/1.23/client/supervisor/informers/externalversions/factory.go index 25a2ea38..690cfe62 100644 --- a/generated/1.23/client/supervisor/informers/externalversions/factory.go +++ b/generated/1.23/client/supervisor/informers/externalversions/factory.go @@ -14,6 +14,7 @@ import ( config "go.pinniped.dev/generated/1.23/client/supervisor/informers/externalversions/config" idp "go.pinniped.dev/generated/1.23/client/supervisor/informers/externalversions/idp" internalinterfaces "go.pinniped.dev/generated/1.23/client/supervisor/informers/externalversions/internalinterfaces" + oauth "go.pinniped.dev/generated/1.23/client/supervisor/informers/externalversions/oauth" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -162,6 +163,7 @@ type SharedInformerFactory interface { Config() config.Interface IDP() idp.Interface + Oauth() oauth.Interface } func (f *sharedInformerFactory) Config() config.Interface { @@ -171,3 +173,7 @@ func (f *sharedInformerFactory) Config() config.Interface { func (f *sharedInformerFactory) IDP() idp.Interface { return idp.New(f, f.namespace, f.tweakListOptions) } + +func (f *sharedInformerFactory) Oauth() oauth.Interface { + return oauth.New(f, f.namespace, f.tweakListOptions) +} diff --git a/generated/1.23/client/supervisor/informers/externalversions/generic.go b/generated/1.23/client/supervisor/informers/externalversions/generic.go index efeda809..da434169 100644 --- a/generated/1.23/client/supervisor/informers/externalversions/generic.go +++ b/generated/1.23/client/supervisor/informers/externalversions/generic.go @@ -10,6 +10,7 @@ import ( v1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/oauth/v1alpha1" schema "k8s.io/apimachinery/pkg/runtime/schema" cache "k8s.io/client-go/tools/cache" ) @@ -52,6 +53,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"): return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().OIDCIdentityProviders().Informer()}, nil + // Group=oauth.supervisor.pinniped.dev, Version=v1alpha1 + case oauthv1alpha1.SchemeGroupVersion.WithResource("oidcclients"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Oauth().V1alpha1().OIDCClients().Informer()}, nil + } return nil, fmt.Errorf("no informer found for %v", resource) diff --git a/generated/1.23/client/supervisor/informers/externalversions/oauth/interface.go b/generated/1.23/client/supervisor/informers/externalversions/oauth/interface.go new file mode 100644 index 00000000..f5bbdc54 --- /dev/null +++ b/generated/1.23/client/supervisor/informers/externalversions/oauth/interface.go @@ -0,0 +1,33 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package oauth + +import ( + internalinterfaces "go.pinniped.dev/generated/1.23/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go b/generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go new file mode 100644 index 00000000..6d128bf0 --- /dev/null +++ b/generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go @@ -0,0 +1,32 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "go.pinniped.dev/generated/1.23/client/supervisor/informers/externalversions/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // OIDCClients returns a OIDCClientInformer. + OIDCClients() OIDCClientInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// OIDCClients returns a OIDCClientInformer. +func (v *version) OIDCClients() OIDCClientInformer { + return &oIDCClientInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} +} diff --git a/generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go b/generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..a7fdc001 --- /dev/null +++ b/generated/1.23/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,77 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + oauthv1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/oauth/v1alpha1" + versioned "go.pinniped.dev/generated/1.23/client/supervisor/clientset/versioned" + internalinterfaces "go.pinniped.dev/generated/1.23/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/1.23/client/supervisor/listers/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" +) + +// OIDCClientInformer provides access to a shared informer and lister for +// OIDCClients. +type OIDCClientInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.OIDCClientLister +} + +type oIDCClientInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc + namespace string +} + +// NewOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, namespace, resyncPeriod, indexers, nil) +} + +// NewFilteredOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).Watch(context.TODO(), options) + }, + }, + &oauthv1alpha1.OIDCClient{}, + resyncPeriod, + indexers, + ) +} + +func (f *oIDCClientInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *oIDCClientInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&oauthv1alpha1.OIDCClient{}, f.defaultInformer) +} + +func (f *oIDCClientInformer) Lister() v1alpha1.OIDCClientLister { + return v1alpha1.NewOIDCClientLister(f.Informer().GetIndexer()) +} diff --git a/generated/1.23/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go b/generated/1.23/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go new file mode 100644 index 00000000..c19310da --- /dev/null +++ b/generated/1.23/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go @@ -0,0 +1,14 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// OIDCClientListerExpansion allows custom methods to be added to +// OIDCClientLister. +type OIDCClientListerExpansion interface{} + +// OIDCClientNamespaceListerExpansion allows custom methods to be added to +// OIDCClientNamespaceLister. +type OIDCClientNamespaceListerExpansion interface{} diff --git a/generated/1.23/client/supervisor/listers/oauth/v1alpha1/oidcclient.go b/generated/1.23/client/supervisor/listers/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..28d81d93 --- /dev/null +++ b/generated/1.23/client/supervisor/listers/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,86 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/1.23/apis/supervisor/oauth/v1alpha1" + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" +) + +// OIDCClientLister helps list OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientLister interface { + // List lists all OIDCClients in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // OIDCClients returns an object that can list and get OIDCClients. + OIDCClients(namespace string) OIDCClientNamespaceLister + OIDCClientListerExpansion +} + +// oIDCClientLister implements the OIDCClientLister interface. +type oIDCClientLister struct { + indexer cache.Indexer +} + +// NewOIDCClientLister returns a new OIDCClientLister. +func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister { + return &oIDCClientLister{indexer: indexer} +} + +// List lists all OIDCClients in the indexer. +func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// OIDCClients returns an object that can list and get OIDCClients. +func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister { + return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace} +} + +// OIDCClientNamespaceLister helps list and get OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientNamespaceLister interface { + // List lists all OIDCClients in the indexer for a given namespace. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // Get retrieves the OIDCClient from the indexer for a given namespace and name. + // Objects returned here must be treated as read-only. + Get(name string) (*v1alpha1.OIDCClient, error) + OIDCClientNamespaceListerExpansion +} + +// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister +// interface. +type oIDCClientNamespaceLister struct { + indexer cache.Indexer + namespace string +} + +// List lists all OIDCClients in the indexer for a given namespace. +func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// Get retrieves the OIDCClient from the indexer for a given namespace and name. +func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) { + obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name) + } + return obj.(*v1alpha1.OIDCClient), nil +} diff --git a/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml new file mode 100644 index 00000000..0b4ee157 --- /dev/null +++ b/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: oidcclients.oauth.supervisor.pinniped.dev +spec: + group: oauth.supervisor.pinniped.dev + names: + categories: + - pinniped + kind: OIDCClient + listKind: OIDCClientList + plural: oidcclients + singular: oidcclient + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' + name: Privileged + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: OIDCClient describes the configuration of an OIDC client. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec of the OIDC provider. + properties: + allowedGrantTypes: + description: "allowedGrantTypes is a list of the allowed grant_type + param values that should be accepted during OIDC flows with this + client. \n Must only contain the following values: - authorization_code: + allows the client to perform the authorization code grant flow, + i.e. allows the webapp to authenticate users. This grant must always + be listed. - refresh_token: allows the client to perform refresh + grants for the user to extend the user's session. This grant must + be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: + allows the client to perform RFC8693 token exchange, which is a + step in the process to be able to get a cluster credential for the + user. This grant must be listed if allowedScopes lists pinniped:request-audience." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedRedirectURIs: + description: allowedRedirectURIs is a list of the allowed redirect_uri + param values that should be accepted during OIDC flows with this + client. Any other uris will be rejected. Must be https, unless it + is a loopback. + items: + type: string + minItems: 1 + type: array + uniqueItems: true + allowedScopes: + description: "allowedScopes is a list of the allowed scopes param + values that should be accepted during OIDC flows with this client. + \n Must only contain the following values: - openid: The client + is allowed to request ID tokens. ID tokens only include the required + claims by default (iss, sub, aud, exp, iat). This scope must always + be listed. - offline_access: The client is allowed to request an + initial refresh token during the authorization code grant flow. + This scope must be listed if allowedGrantTypes lists refresh_token. + - pinniped:request-audience: The client is allowed to request a + new audience value during a RFC8693 token exchange, which is a step + in the process to be able to get a cluster credential for the user. + openid, username and groups scopes must be listed when this scope + is present. This scope must be listed if allowedGrantTypes lists + urn:ietf:params:oauth:grant-type:token-exchange. - username: The + client is allowed to request that ID tokens contain the user's username. + Without the username scope being requested and allowed, the ID token + will not contain the user's username. - groups: The client is allowed + to request that ID tokens contain the user's group membership, if + their group membership is discoverable by the Supervisor. Without + the groups scope being requested and allowed, the ID token will + not contain groups." + items: + type: string + minItems: 1 + type: array + uniqueItems: true + required: + - allowedGrantTypes + - allowedRedirectURIs + - allowedScopes + type: object + status: + description: Status of the OIDC provider. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/generated/latest/apis/supervisor/oauth/v1alpha1/doc.go b/generated/latest/apis/supervisor/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..75580481 --- /dev/null +++ b/generated/latest/apis/supervisor/oauth/v1alpha1/doc.go @@ -0,0 +1,10 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// +k8s:openapi-gen=true +// +k8s:deepcopy-gen=package +// +k8s:defaulter-gen=TypeMeta +// +groupName=oauth.supervisor.pinniped.dev + +// Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor oauth API. +package v1alpha1 diff --git a/generated/latest/apis/supervisor/oauth/v1alpha1/register.go b/generated/latest/apis/supervisor/oauth/v1alpha1/register.go new file mode 100644 index 00000000..37ae1fbf --- /dev/null +++ b/generated/latest/apis/supervisor/oauth/v1alpha1/register.go @@ -0,0 +1,43 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "oauth.supervisor.pinniped.dev" + +// SchemeGroupVersion is group version used to register these objects. +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to the given scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &OIDCClient{}, + &OIDCClientList{}, + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource. +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go new file mode 100644 index 00000000..ee125443 --- /dev/null +++ b/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -0,0 +1,84 @@ +// Copyright 2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// OIDCClientSpec is a struct that describes an OIDC Client. +type OIDCClientSpec struct { + // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this + // client. Any other uris will be rejected. + // Must be https, unless it is a loopback. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedRedirectURIs []string `json:"allowedRedirectURIs"` + + // allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this + // client. + // + // Must only contain the following values: + // - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to + // authenticate users. This grant must always be listed. + // - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. + // This grant must be listed if allowedScopes lists offline_access. + // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // This grant must be listed if allowedScopes lists pinniped:request-audience. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedGrantTypes []string `json:"allowedGrantTypes"` + + // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. + // + // Must only contain the following values: + // - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). + // This scope must always be listed. + // - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. + // This scope must be listed if allowedGrantTypes lists refresh_token. + // - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, + // which is a step in the process to be able to get a cluster credential for the user. + // openid, username and groups scopes must be listed when this scope is present. + // This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. + // - username: The client is allowed to request that ID tokens contain the user's username. + // Without the username scope being requested and allowed, the ID token will not contain the user's username. + // - groups: The client is allowed to request that ID tokens contain the user's group membership, + // if their group membership is discoverable by the Supervisor. + // Without the groups scope being requested and allowed, the ID token will not contain groups. + // +kubebuilder:validation:UniqueItems=true + // +kubebuilder:validation:MinItems=1 + AllowedScopes []string `json:"allowedScopes"` +} + +// OIDCClientStatus is a struct that describes the actual state of an OIDC Client. +type OIDCClientStatus struct { +} + +// OIDCClient describes the configuration of an OIDC client. +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=pinniped +// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` +// +kubebuilder:subresource:status +type OIDCClient struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + // Spec of the OIDC provider. + Spec OIDCClientSpec `json:"spec"` + + // Status of the OIDC provider. + Status OIDCClientStatus `json:"status,omitempty"` +} + +// List of OIDCClient objects. +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +type OIDCClientList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + + Items []OIDCClient `json:"items"` +} diff --git a/generated/latest/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/latest/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..cb35cea5 --- /dev/null +++ b/generated/latest/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,121 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClient) DeepCopyInto(out *OIDCClient) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClient. +func (in *OIDCClient) DeepCopy() *OIDCClient { + if in == nil { + return nil + } + out := new(OIDCClient) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClient) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientList) DeepCopyInto(out *OIDCClientList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OIDCClient, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientList. +func (in *OIDCClientList) DeepCopy() *OIDCClientList { + if in == nil { + return nil + } + out := new(OIDCClientList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OIDCClientList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { + *out = *in + if in.AllowedRedirectURIs != nil { + in, out := &in.AllowedRedirectURIs, &out.AllowedRedirectURIs + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedGrantTypes != nil { + in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.AllowedScopes != nil { + in, out := &in.AllowedScopes, &out.AllowedScopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientSpec. +func (in *OIDCClientSpec) DeepCopy() *OIDCClientSpec { + if in == nil { + return nil + } + out := new(OIDCClientSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCClientStatus) DeepCopyInto(out *OIDCClientStatus) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCClientStatus. +func (in *OIDCClientStatus) DeepCopy() *OIDCClientStatus { + if in == nil { + return nil + } + out := new(OIDCClientStatus) + in.DeepCopyInto(out) + return out +} diff --git a/generated/latest/client/supervisor/clientset/versioned/clientset.go b/generated/latest/client/supervisor/clientset/versioned/clientset.go index 7e617419..04429897 100644 --- a/generated/latest/client/supervisor/clientset/versioned/clientset.go +++ b/generated/latest/client/supervisor/clientset/versioned/clientset.go @@ -11,6 +11,7 @@ import ( configv1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" discovery "k8s.io/client-go/discovery" rest "k8s.io/client-go/rest" flowcontrol "k8s.io/client-go/util/flowcontrol" @@ -20,6 +21,7 @@ type Interface interface { Discovery() discovery.DiscoveryInterface ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface + OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface } // Clientset contains the clients for groups. Each group has exactly one @@ -28,6 +30,7 @@ type Clientset struct { *discovery.DiscoveryClient configV1alpha1 *configv1alpha1.ConfigV1alpha1Client iDPV1alpha1 *idpv1alpha1.IDPV1alpha1Client + oauthV1alpha1 *oauthv1alpha1.OauthV1alpha1Client } // ConfigV1alpha1 retrieves the ConfigV1alpha1Client @@ -40,6 +43,11 @@ func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return c.iDPV1alpha1 } +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return c.oauthV1alpha1 +} + // Discovery retrieves the DiscoveryClient func (c *Clientset) Discovery() discovery.DiscoveryInterface { if c == nil { @@ -88,6 +96,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, if err != nil { return nil, err } + cs.oauthV1alpha1, err = oauthv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient) + if err != nil { + return nil, err + } cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient) if err != nil { @@ -111,6 +123,7 @@ func New(c rest.Interface) *Clientset { var cs Clientset cs.configV1alpha1 = configv1alpha1.New(c) cs.iDPV1alpha1 = idpv1alpha1.New(c) + cs.oauthV1alpha1 = oauthv1alpha1.New(c) cs.DiscoveryClient = discovery.NewDiscoveryClient(c) return &cs diff --git a/generated/latest/client/supervisor/clientset/versioned/fake/clientset_generated.go b/generated/latest/client/supervisor/clientset/versioned/fake/clientset_generated.go index 783ec35f..6b73fc47 100644 --- a/generated/latest/client/supervisor/clientset/versioned/fake/clientset_generated.go +++ b/generated/latest/client/supervisor/clientset/versioned/fake/clientset_generated.go @@ -11,6 +11,8 @@ import ( fakeconfigv1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/config/v1alpha1/fake" idpv1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/idp/v1alpha1" fakeidpv1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/idp/v1alpha1/fake" + oauthv1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + fakeoauthv1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/watch" "k8s.io/client-go/discovery" @@ -77,3 +79,8 @@ func (c *Clientset) ConfigV1alpha1() configv1alpha1.ConfigV1alpha1Interface { func (c *Clientset) IDPV1alpha1() idpv1alpha1.IDPV1alpha1Interface { return &fakeidpv1alpha1.FakeIDPV1alpha1{Fake: &c.Fake} } + +// OauthV1alpha1 retrieves the OauthV1alpha1Client +func (c *Clientset) OauthV1alpha1() oauthv1alpha1.OauthV1alpha1Interface { + return &fakeoauthv1alpha1.FakeOauthV1alpha1{Fake: &c.Fake} +} diff --git a/generated/latest/client/supervisor/clientset/versioned/fake/register.go b/generated/latest/client/supervisor/clientset/versioned/fake/register.go index 4d84f079..db9bb1a4 100644 --- a/generated/latest/client/supervisor/clientset/versioned/fake/register.go +++ b/generated/latest/client/supervisor/clientset/versioned/fake/register.go @@ -8,6 +8,7 @@ package fake import ( configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var codecs = serializer.NewCodecFactory(scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/latest/client/supervisor/clientset/versioned/scheme/register.go b/generated/latest/client/supervisor/clientset/versioned/scheme/register.go index 7b874df0..9456d619 100644 --- a/generated/latest/client/supervisor/clientset/versioned/scheme/register.go +++ b/generated/latest/client/supervisor/clientset/versioned/scheme/register.go @@ -8,6 +8,7 @@ package scheme import ( configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/oauth/v1alpha1" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -21,6 +22,7 @@ var ParameterCodec = runtime.NewParameterCodec(Scheme) var localSchemeBuilder = runtime.SchemeBuilder{ configv1alpha1.AddToScheme, idpv1alpha1.AddToScheme, + oauthv1alpha1.AddToScheme, } // AddToScheme adds all types of this clientset into the given scheme. This allows composition diff --git a/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go new file mode 100644 index 00000000..e7a470b6 --- /dev/null +++ b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// This package has the automatically generated typed clients. +package v1alpha1 diff --git a/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go new file mode 100644 index 00000000..7906901b --- /dev/null +++ b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/doc.go @@ -0,0 +1,7 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +// Package fake has the automatically generated clients. +package fake diff --git a/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go new file mode 100644 index 00000000..abcc6a0c --- /dev/null +++ b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oauth_client.go @@ -0,0 +1,27 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + v1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1" + rest "k8s.io/client-go/rest" + testing "k8s.io/client-go/testing" +) + +type FakeOauthV1alpha1 struct { + *testing.Fake +} + +func (c *FakeOauthV1alpha1) OIDCClients(namespace string) v1alpha1.OIDCClientInterface { + return &FakeOIDCClients{c, namespace} +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *FakeOauthV1alpha1) RESTClient() rest.Interface { + var ret *rest.RESTClient + return ret +} diff --git a/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go new file mode 100644 index 00000000..89568d1a --- /dev/null +++ b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/fake/fake_oidcclient.go @@ -0,0 +1,129 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package fake + +import ( + "context" + + v1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + labels "k8s.io/apimachinery/pkg/labels" + schema "k8s.io/apimachinery/pkg/runtime/schema" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + testing "k8s.io/client-go/testing" +) + +// FakeOIDCClients implements OIDCClientInterface +type FakeOIDCClients struct { + Fake *FakeOauthV1alpha1 + ns string +} + +var oidcclientsResource = schema.GroupVersionResource{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Resource: "oidcclients"} + +var oidcclientsKind = schema.GroupVersionKind{Group: "oauth.supervisor.pinniped.dev", Version: "v1alpha1", Kind: "OIDCClient"} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *FakeOIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewGetAction(oidcclientsResource, c.ns, name), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *FakeOIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + obj, err := c.Fake. + Invokes(testing.NewListAction(oidcclientsResource, oidcclientsKind, c.ns, opts), &v1alpha1.OIDCClientList{}) + + if obj == nil { + return nil, err + } + + label, _, _ := testing.ExtractFromListOptions(opts) + if label == nil { + label = labels.Everything() + } + list := &v1alpha1.OIDCClientList{ListMeta: obj.(*v1alpha1.OIDCClientList).ListMeta} + for _, item := range obj.(*v1alpha1.OIDCClientList).Items { + if label.Matches(labels.Set(item.Labels)) { + list.Items = append(list.Items, item) + } + } + return list, err +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *FakeOIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + return c.Fake. + InvokesWatch(testing.NewWatchAction(oidcclientsResource, c.ns, opts)) + +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewCreateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *FakeOIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateAction(oidcclientsResource, c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *FakeOIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) { + obj, err := c.Fake. + Invokes(testing.NewUpdateSubresourceAction(oidcclientsResource, "status", c.ns, oIDCClient), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *FakeOIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + _, err := c.Fake. + Invokes(testing.NewDeleteActionWithOptions(oidcclientsResource, c.ns, name, opts), &v1alpha1.OIDCClient{}) + + return err +} + +// DeleteCollection deletes a collection of objects. +func (c *FakeOIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + action := testing.NewDeleteCollectionAction(oidcclientsResource, c.ns, listOpts) + + _, err := c.Fake.Invokes(action, &v1alpha1.OIDCClientList{}) + return err +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *FakeOIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + obj, err := c.Fake. + Invokes(testing.NewPatchSubresourceAction(oidcclientsResource, c.ns, name, pt, data, subresources...), &v1alpha1.OIDCClient{}) + + if obj == nil { + return nil, err + } + return obj.(*v1alpha1.OIDCClient), err +} diff --git a/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go new file mode 100644 index 00000000..87d22ea9 --- /dev/null +++ b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/generated_expansion.go @@ -0,0 +1,8 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +type OIDCClientExpansion interface{} diff --git a/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go new file mode 100644 index 00000000..80077607 --- /dev/null +++ b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oauth_client.go @@ -0,0 +1,94 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "net/http" + + v1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/oauth/v1alpha1" + "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/scheme" + rest "k8s.io/client-go/rest" +) + +type OauthV1alpha1Interface interface { + RESTClient() rest.Interface + OIDCClientsGetter +} + +// OauthV1alpha1Client is used to interact with features provided by the oauth.supervisor.pinniped.dev group. +type OauthV1alpha1Client struct { + restClient rest.Interface +} + +func (c *OauthV1alpha1Client) OIDCClients(namespace string) OIDCClientInterface { + return newOIDCClients(c, namespace) +} + +// NewForConfig creates a new OauthV1alpha1Client for the given config. +// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient), +// where httpClient was generated with rest.HTTPClientFor(c). +func NewForConfig(c *rest.Config) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + httpClient, err := rest.HTTPClientFor(&config) + if err != nil { + return nil, err + } + return NewForConfigAndClient(&config, httpClient) +} + +// NewForConfigAndClient creates a new OauthV1alpha1Client for the given config and http client. +// Note the http client provided takes precedence over the configured transport values. +func NewForConfigAndClient(c *rest.Config, h *http.Client) (*OauthV1alpha1Client, error) { + config := *c + if err := setConfigDefaults(&config); err != nil { + return nil, err + } + client, err := rest.RESTClientForConfigAndClient(&config, h) + if err != nil { + return nil, err + } + return &OauthV1alpha1Client{client}, nil +} + +// NewForConfigOrDie creates a new OauthV1alpha1Client for the given config and +// panics if there is an error in the config. +func NewForConfigOrDie(c *rest.Config) *OauthV1alpha1Client { + client, err := NewForConfig(c) + if err != nil { + panic(err) + } + return client +} + +// New creates a new OauthV1alpha1Client for the given RESTClient. +func New(c rest.Interface) *OauthV1alpha1Client { + return &OauthV1alpha1Client{c} +} + +func setConfigDefaults(config *rest.Config) error { + gv := v1alpha1.SchemeGroupVersion + config.GroupVersion = &gv + config.APIPath = "/apis" + config.NegotiatedSerializer = scheme.Codecs.WithoutConversion() + + if config.UserAgent == "" { + config.UserAgent = rest.DefaultKubernetesUserAgent() + } + + return nil +} + +// RESTClient returns a RESTClient that is used to communicate +// with API server by this client implementation. +func (c *OauthV1alpha1Client) RESTClient() rest.Interface { + if c == nil { + return nil + } + return c.restClient +} diff --git a/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..888c2a7e --- /dev/null +++ b/generated/latest/client/supervisor/clientset/versioned/typed/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,182 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + "time" + + v1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/oauth/v1alpha1" + scheme "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + rest "k8s.io/client-go/rest" +) + +// OIDCClientsGetter has a method to return a OIDCClientInterface. +// A group's client should implement this interface. +type OIDCClientsGetter interface { + OIDCClients(namespace string) OIDCClientInterface +} + +// OIDCClientInterface has methods to work with OIDCClient resources. +type OIDCClientInterface interface { + Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (*v1alpha1.OIDCClient, error) + Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (*v1alpha1.OIDCClient, error) + Delete(ctx context.Context, name string, opts v1.DeleteOptions) error + DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error + Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.OIDCClient, error) + List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.OIDCClientList, error) + Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) + Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) + OIDCClientExpansion +} + +// oIDCClients implements OIDCClientInterface +type oIDCClients struct { + client rest.Interface + ns string +} + +// newOIDCClients returns a OIDCClients +func newOIDCClients(c *OauthV1alpha1Client, namespace string) *oIDCClients { + return &oIDCClients{ + client: c.RESTClient(), + ns: namespace, + } +} + +// Get takes name of the oIDCClient, and returns the corresponding oIDCClient object, and an error if there is any. +func (c *oIDCClients) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + VersionedParams(&options, scheme.ParameterCodec). + Do(ctx). + Into(result) + return +} + +// List takes label and field selectors, and returns the list of OIDCClients that match those selectors. +func (c *oIDCClients) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.OIDCClientList, err error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + result = &v1alpha1.OIDCClientList{} + err = c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Do(ctx). + Into(result) + return +} + +// Watch returns a watch.Interface that watches the requested oIDCClients. +func (c *oIDCClients) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) { + var timeout time.Duration + if opts.TimeoutSeconds != nil { + timeout = time.Duration(*opts.TimeoutSeconds) * time.Second + } + opts.Watch = true + return c.client.Get(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Timeout(timeout). + Watch(ctx) +} + +// Create takes the representation of a oIDCClient and creates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Create(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.CreateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Post(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Update takes the representation of a oIDCClient and updates it. Returns the server's representation of the oIDCClient, and an error, if there is any. +func (c *oIDCClients) Update(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// UpdateStatus was generated because the type contains a Status member. +// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). +func (c *oIDCClients) UpdateStatus(ctx context.Context, oIDCClient *v1alpha1.OIDCClient, opts v1.UpdateOptions) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Put(). + Namespace(c.ns). + Resource("oidcclients"). + Name(oIDCClient.Name). + SubResource("status"). + VersionedParams(&opts, scheme.ParameterCodec). + Body(oIDCClient). + Do(ctx). + Into(result) + return +} + +// Delete takes name of the oIDCClient and deletes it. Returns an error if one occurs. +func (c *oIDCClients) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error { + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + Body(&opts). + Do(ctx). + Error() +} + +// DeleteCollection deletes a collection of objects. +func (c *oIDCClients) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error { + var timeout time.Duration + if listOpts.TimeoutSeconds != nil { + timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second + } + return c.client.Delete(). + Namespace(c.ns). + Resource("oidcclients"). + VersionedParams(&listOpts, scheme.ParameterCodec). + Timeout(timeout). + Body(&opts). + Do(ctx). + Error() +} + +// Patch applies the patch and returns the patched oIDCClient. +func (c *oIDCClients) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.OIDCClient, err error) { + result = &v1alpha1.OIDCClient{} + err = c.client.Patch(pt). + Namespace(c.ns). + Resource("oidcclients"). + Name(name). + SubResource(subresources...). + VersionedParams(&opts, scheme.ParameterCodec). + Body(data). + Do(ctx). + Into(result) + return +} diff --git a/generated/latest/client/supervisor/informers/externalversions/factory.go b/generated/latest/client/supervisor/informers/externalversions/factory.go index 252195d3..d3c714e7 100644 --- a/generated/latest/client/supervisor/informers/externalversions/factory.go +++ b/generated/latest/client/supervisor/informers/externalversions/factory.go @@ -14,6 +14,7 @@ import ( config "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/config" idp "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/idp" internalinterfaces "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/internalinterfaces" + oauth "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/oauth" v1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" schema "k8s.io/apimachinery/pkg/runtime/schema" @@ -162,6 +163,7 @@ type SharedInformerFactory interface { Config() config.Interface IDP() idp.Interface + Oauth() oauth.Interface } func (f *sharedInformerFactory) Config() config.Interface { @@ -171,3 +173,7 @@ func (f *sharedInformerFactory) Config() config.Interface { func (f *sharedInformerFactory) IDP() idp.Interface { return idp.New(f, f.namespace, f.tweakListOptions) } + +func (f *sharedInformerFactory) Oauth() oauth.Interface { + return oauth.New(f, f.namespace, f.tweakListOptions) +} diff --git a/generated/latest/client/supervisor/informers/externalversions/generic.go b/generated/latest/client/supervisor/informers/externalversions/generic.go index f36794e6..ba708933 100644 --- a/generated/latest/client/supervisor/informers/externalversions/generic.go +++ b/generated/latest/client/supervisor/informers/externalversions/generic.go @@ -10,6 +10,7 @@ import ( v1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1" idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1" + oauthv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/oauth/v1alpha1" schema "k8s.io/apimachinery/pkg/runtime/schema" cache "k8s.io/client-go/tools/cache" ) @@ -52,6 +53,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource case idpv1alpha1.SchemeGroupVersion.WithResource("oidcidentityproviders"): return &genericInformer{resource: resource.GroupResource(), informer: f.IDP().V1alpha1().OIDCIdentityProviders().Informer()}, nil + // Group=oauth.supervisor.pinniped.dev, Version=v1alpha1 + case oauthv1alpha1.SchemeGroupVersion.WithResource("oidcclients"): + return &genericInformer{resource: resource.GroupResource(), informer: f.Oauth().V1alpha1().OIDCClients().Informer()}, nil + } return nil, fmt.Errorf("no informer found for %v", resource) diff --git a/generated/latest/client/supervisor/informers/externalversions/oauth/interface.go b/generated/latest/client/supervisor/informers/externalversions/oauth/interface.go new file mode 100644 index 00000000..b0c7105b --- /dev/null +++ b/generated/latest/client/supervisor/informers/externalversions/oauth/interface.go @@ -0,0 +1,33 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package oauth + +import ( + internalinterfaces "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1" +) + +// Interface provides access to each of this group's versions. +type Interface interface { + // V1alpha1 provides access to shared informers for resources in V1alpha1. + V1alpha1() v1alpha1.Interface +} + +type group struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// V1alpha1 returns a new v1alpha1.Interface. +func (g *group) V1alpha1() v1alpha1.Interface { + return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions) +} diff --git a/generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go b/generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go new file mode 100644 index 00000000..48e12497 --- /dev/null +++ b/generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1/interface.go @@ -0,0 +1,32 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + internalinterfaces "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/internalinterfaces" +) + +// Interface provides access to all the informers in this group version. +type Interface interface { + // OIDCClients returns a OIDCClientInformer. + OIDCClients() OIDCClientInformer +} + +type version struct { + factory internalinterfaces.SharedInformerFactory + namespace string + tweakListOptions internalinterfaces.TweakListOptionsFunc +} + +// New returns a new Interface. +func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface { + return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions} +} + +// OIDCClients returns a OIDCClientInformer. +func (v *version) OIDCClients() OIDCClientInformer { + return &oIDCClientInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} +} diff --git a/generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go b/generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..d3eec3d2 --- /dev/null +++ b/generated/latest/client/supervisor/informers/externalversions/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,77 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by informer-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "context" + time "time" + + oauthv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/oauth/v1alpha1" + versioned "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned" + internalinterfaces "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/internalinterfaces" + v1alpha1 "go.pinniped.dev/generated/latest/client/supervisor/listers/oauth/v1alpha1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" + watch "k8s.io/apimachinery/pkg/watch" + cache "k8s.io/client-go/tools/cache" +) + +// OIDCClientInformer provides access to a shared informer and lister for +// OIDCClients. +type OIDCClientInformer interface { + Informer() cache.SharedIndexInformer + Lister() v1alpha1.OIDCClientLister +} + +type oIDCClientInformer struct { + factory internalinterfaces.SharedInformerFactory + tweakListOptions internalinterfaces.TweakListOptionsFunc + namespace string +} + +// NewOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, namespace, resyncPeriod, indexers, nil) +} + +// NewFilteredOIDCClientInformer constructs a new informer for OIDCClient type. +// Always prefer using an informer factory to get a shared informer instead of getting an independent +// one. This reduces memory footprint and number of connections to the server. +func NewFilteredOIDCClientInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { + return cache.NewSharedIndexInformer( + &cache.ListWatch{ + ListFunc: func(options v1.ListOptions) (runtime.Object, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).List(context.TODO(), options) + }, + WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { + if tweakListOptions != nil { + tweakListOptions(&options) + } + return client.OauthV1alpha1().OIDCClients(namespace).Watch(context.TODO(), options) + }, + }, + &oauthv1alpha1.OIDCClient{}, + resyncPeriod, + indexers, + ) +} + +func (f *oIDCClientInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { + return NewFilteredOIDCClientInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) +} + +func (f *oIDCClientInformer) Informer() cache.SharedIndexInformer { + return f.factory.InformerFor(&oauthv1alpha1.OIDCClient{}, f.defaultInformer) +} + +func (f *oIDCClientInformer) Lister() v1alpha1.OIDCClientLister { + return v1alpha1.NewOIDCClientLister(f.Informer().GetIndexer()) +} diff --git a/generated/latest/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go b/generated/latest/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go new file mode 100644 index 00000000..c19310da --- /dev/null +++ b/generated/latest/client/supervisor/listers/oauth/v1alpha1/expansion_generated.go @@ -0,0 +1,14 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +// OIDCClientListerExpansion allows custom methods to be added to +// OIDCClientLister. +type OIDCClientListerExpansion interface{} + +// OIDCClientNamespaceListerExpansion allows custom methods to be added to +// OIDCClientNamespaceLister. +type OIDCClientNamespaceListerExpansion interface{} diff --git a/generated/latest/client/supervisor/listers/oauth/v1alpha1/oidcclient.go b/generated/latest/client/supervisor/listers/oauth/v1alpha1/oidcclient.go new file mode 100644 index 00000000..189936b6 --- /dev/null +++ b/generated/latest/client/supervisor/listers/oauth/v1alpha1/oidcclient.go @@ -0,0 +1,86 @@ +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 + +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/oauth/v1alpha1" + "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/client-go/tools/cache" +) + +// OIDCClientLister helps list OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientLister interface { + // List lists all OIDCClients in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // OIDCClients returns an object that can list and get OIDCClients. + OIDCClients(namespace string) OIDCClientNamespaceLister + OIDCClientListerExpansion +} + +// oIDCClientLister implements the OIDCClientLister interface. +type oIDCClientLister struct { + indexer cache.Indexer +} + +// NewOIDCClientLister returns a new OIDCClientLister. +func NewOIDCClientLister(indexer cache.Indexer) OIDCClientLister { + return &oIDCClientLister{indexer: indexer} +} + +// List lists all OIDCClients in the indexer. +func (s *oIDCClientLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAll(s.indexer, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// OIDCClients returns an object that can list and get OIDCClients. +func (s *oIDCClientLister) OIDCClients(namespace string) OIDCClientNamespaceLister { + return oIDCClientNamespaceLister{indexer: s.indexer, namespace: namespace} +} + +// OIDCClientNamespaceLister helps list and get OIDCClients. +// All objects returned here must be treated as read-only. +type OIDCClientNamespaceLister interface { + // List lists all OIDCClients in the indexer for a given namespace. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) + // Get retrieves the OIDCClient from the indexer for a given namespace and name. + // Objects returned here must be treated as read-only. + Get(name string) (*v1alpha1.OIDCClient, error) + OIDCClientNamespaceListerExpansion +} + +// oIDCClientNamespaceLister implements the OIDCClientNamespaceLister +// interface. +type oIDCClientNamespaceLister struct { + indexer cache.Indexer + namespace string +} + +// List lists all OIDCClients in the indexer for a given namespace. +func (s oIDCClientNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.OIDCClient, err error) { + err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) { + ret = append(ret, m.(*v1alpha1.OIDCClient)) + }) + return ret, err +} + +// Get retrieves the OIDCClient from the indexer for a given namespace and name. +func (s oIDCClientNamespaceLister) Get(name string) (*v1alpha1.OIDCClient, error) { + obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name) + if err != nil { + return nil, err + } + if !exists { + return nil, errors.NewNotFound(v1alpha1.Resource("oidcclient"), name) + } + return obj.(*v1alpha1.OIDCClient), nil +} diff --git a/hack/lib/update-codegen.sh b/hack/lib/update-codegen.sh index c1480011..a31a38d7 100755 --- a/hack/lib/update-codegen.sh +++ b/hack/lib/update-codegen.sh @@ -123,7 +123,7 @@ echo "generating API-related code for our public API groups..." "deepcopy" \ "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/apis" \ "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/apis" \ - "supervisor/config:v1alpha1 supervisor/idp:v1alpha1 concierge/config:v1alpha1 concierge/authentication:v1alpha1 concierge/login:v1alpha1 concierge/identity:v1alpha1" \ + "supervisor/config:v1alpha1 supervisor/idp:v1alpha1 supervisor/oauth:v1alpha1 concierge/config:v1alpha1 concierge/authentication:v1alpha1 concierge/login:v1alpha1 concierge/identity:v1alpha1" \ --go-header-file "${ROOT}/hack/boilerplate.go.txt" -v "$debug_level" 2>&1 | sed "s|^|gen-api > |" ) @@ -159,7 +159,7 @@ echo "generating client code for our public API groups..." "client,lister,informer" \ "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/client/supervisor" \ "${BASE_PKG}/generated/${KUBE_MINOR_VERSION}/apis" \ - "supervisor/config:v1alpha1 supervisor/idp:v1alpha1" \ + "supervisor/config:v1alpha1 supervisor/idp:v1alpha1 supervisor/oauth:v1alpha1" \ --go-header-file "${ROOT}/hack/boilerplate.go.txt" -v "$debug_level" 2>&1 | sed "s|^|gen-client > |" ) @@ -180,6 +180,7 @@ crd-ref-docs \ (cd apis && controller-gen paths=./supervisor/config/v1alpha1 crd output:crd:artifacts:config=../crds && controller-gen paths=./supervisor/idp/v1alpha1 crd output:crd:artifacts:config=../crds && + controller-gen paths=./supervisor/oauth/v1alpha1 crd output:crd:artifacts:config=../crds && controller-gen paths=./concierge/config/v1alpha1 crd output:crd:artifacts:config=../crds && controller-gen paths=./concierge/authentication/v1alpha1 crd output:crd:artifacts:config=../crds ) From ca3da0bc90e073693c999e7a5c10f2d7ad00a3eb Mon Sep 17 00:00:00 2001 From: Margo Crawford Date: Sat, 4 Jun 2022 21:04:40 -0700 Subject: [PATCH 2/4] Fix some disallowed kubebuilder annotations, fix kube api discovery test Signed-off-by: Margo Crawford --- .../oauth/v1alpha1/types_oidcclient.go.tmpl | 4 -- ...h.supervisor.pinniped.dev_oidcclients.yaml | 6 --- .../oauth/v1alpha1/types_oidcclient.go | 4 -- ...h.supervisor.pinniped.dev_oidcclients.yaml | 6 --- .../oauth/v1alpha1/types_oidcclient.go | 4 -- ...h.supervisor.pinniped.dev_oidcclients.yaml | 6 --- .../oauth/v1alpha1/types_oidcclient.go | 4 -- ...h.supervisor.pinniped.dev_oidcclients.yaml | 6 --- .../oauth/v1alpha1/types_oidcclient.go | 4 -- ...h.supervisor.pinniped.dev_oidcclients.yaml | 6 --- .../oauth/v1alpha1/types_oidcclient.go | 4 -- ...h.supervisor.pinniped.dev_oidcclients.yaml | 6 --- .../oauth/v1alpha1/types_oidcclient.go | 4 -- ...h.supervisor.pinniped.dev_oidcclients.yaml | 6 --- .../oauth/v1alpha1/types_oidcclient.go | 4 -- ...h.supervisor.pinniped.dev_oidcclients.yaml | 6 --- .../oauth/v1alpha1/types_oidcclient.go | 4 -- test/integration/kube_api_discovery_test.go | 43 ++++++++++++++++++- 18 files changed, 41 insertions(+), 86 deletions(-) diff --git a/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl b/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl index ee125443..abae5f2c 100644 --- a/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl +++ b/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml b/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml index 0b4ee157..e5b2d932 100644 --- a/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -18,9 +18,6 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' - name: Privileged - type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date @@ -60,7 +57,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedRedirectURIs: description: allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -70,7 +66,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedScopes: description: "allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. @@ -97,7 +92,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true required: - allowedGrantTypes - allowedRedirectURIs diff --git a/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index ee125443..abae5f2c 100644 --- a/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 0b4ee157..e5b2d932 100644 --- a/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -18,9 +18,6 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' - name: Privileged - type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date @@ -60,7 +57,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedRedirectURIs: description: allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -70,7 +66,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedScopes: description: "allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. @@ -97,7 +92,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true required: - allowedGrantTypes - allowedRedirectURIs diff --git a/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index ee125443..abae5f2c 100644 --- a/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 0b4ee157..e5b2d932 100644 --- a/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -18,9 +18,6 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' - name: Privileged - type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date @@ -60,7 +57,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedRedirectURIs: description: allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -70,7 +66,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedScopes: description: "allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. @@ -97,7 +92,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true required: - allowedGrantTypes - allowedRedirectURIs diff --git a/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index ee125443..abae5f2c 100644 --- a/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 0b4ee157..e5b2d932 100644 --- a/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -18,9 +18,6 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' - name: Privileged - type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date @@ -60,7 +57,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedRedirectURIs: description: allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -70,7 +66,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedScopes: description: "allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. @@ -97,7 +92,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true required: - allowedGrantTypes - allowedRedirectURIs diff --git a/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index ee125443..abae5f2c 100644 --- a/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 0b4ee157..e5b2d932 100644 --- a/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -18,9 +18,6 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' - name: Privileged - type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date @@ -60,7 +57,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedRedirectURIs: description: allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -70,7 +66,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedScopes: description: "allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. @@ -97,7 +92,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true required: - allowedGrantTypes - allowedRedirectURIs diff --git a/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index ee125443..abae5f2c 100644 --- a/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 0b4ee157..e5b2d932 100644 --- a/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -18,9 +18,6 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' - name: Privileged - type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date @@ -60,7 +57,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedRedirectURIs: description: allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -70,7 +66,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedScopes: description: "allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. @@ -97,7 +92,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true required: - allowedGrantTypes - allowedRedirectURIs diff --git a/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index ee125443..abae5f2c 100644 --- a/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 0b4ee157..e5b2d932 100644 --- a/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -18,9 +18,6 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' - name: Privileged - type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date @@ -60,7 +57,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedRedirectURIs: description: allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -70,7 +66,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedScopes: description: "allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. @@ -97,7 +92,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true required: - allowedGrantTypes - allowedRedirectURIs diff --git a/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index ee125443..abae5f2c 100644 --- a/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 0b4ee157..e5b2d932 100644 --- a/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -18,9 +18,6 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: '{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}' - name: Privileged - type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date @@ -60,7 +57,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedRedirectURIs: description: allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -70,7 +66,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true allowedScopes: description: "allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. @@ -97,7 +92,6 @@ spec: type: string minItems: 1 type: array - uniqueItems: true required: - allowedGrantTypes - allowedRedirectURIs diff --git a/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index ee125443..abae5f2c 100644 --- a/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -12,7 +12,6 @@ type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this // client. Any other uris will be rejected. // Must be https, unless it is a loopback. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedRedirectURIs []string `json:"allowedRedirectURIs"` @@ -27,7 +26,6 @@ type OIDCClientSpec struct { // - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedGrantTypes []string `json:"allowedGrantTypes"` @@ -47,7 +45,6 @@ type OIDCClientSpec struct { // - groups: The client is allowed to request that ID tokens contain the user's group membership, // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. - // +kubebuilder:validation:UniqueItems=true // +kubebuilder:validation:MinItems=1 AllowedScopes []string `json:"allowedScopes"` } @@ -60,7 +57,6 @@ type OIDCClientStatus struct { // +genclient // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +kubebuilder:resource:categories=pinniped -// +kubebuilder:printcolumn:name="Privileged",type=boolean,JSONPath=`{range .spec.allowedScopes[?(@ == "pinniped:request-audience")]}{true}{end}{false}` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` // +kubebuilder:subresource:status type OIDCClient struct { diff --git a/test/integration/kube_api_discovery_test.go b/test/integration/kube_api_discovery_test.go index eec88808..c0d243cf 100644 --- a/test/integration/kube_api_discovery_test.go +++ b/test/integration/kube_api_discovery_test.go @@ -1,4 +1,4 @@ -// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved. +// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. // SPDX-License-Identifier: Apache-2.0 package integration @@ -53,6 +53,7 @@ func TestGetAPIResourceList(t *testing.T) { configConciergeGV := makeGV("config", "concierge") idpSupervisorGV := makeGV("idp", "supervisor") configSupervisorGV := makeGV("config", "supervisor") + oauthSupervisorGV := makeGV("oauth", "supervisor") tests := []struct { group metav1.APIGroup @@ -143,6 +144,39 @@ func TestGetAPIResourceList(t *testing.T) { }, }, }, + { + group: metav1.APIGroup{ + Name: oauthSupervisorGV.Group, + Versions: []metav1.GroupVersionForDiscovery{ + { + GroupVersion: oauthSupervisorGV.String(), + Version: oauthSupervisorGV.Version, + }, + }, + PreferredVersion: metav1.GroupVersionForDiscovery{ + GroupVersion: oauthSupervisorGV.String(), + Version: oauthSupervisorGV.Version, + }, + }, + resourceByVersion: map[string][]metav1.APIResource{ + oauthSupervisorGV.String(): { + { + Name: "oidcclients", + SingularName: "oidcclient", + Namespaced: true, + Kind: "OIDCClient", + Verbs: []string{"delete", "deletecollection", "get", "list", "patch", "create", "update", "watch"}, + Categories: []string{"pinniped"}, + }, + { + Name: "oidcclients/status", + Namespaced: true, + Kind: "OIDCClient", + Verbs: []string{"get", "patch", "update"}, + }, + }, + }, + }, { group: metav1.APIGroup{ Name: idpSupervisorGV.Group, @@ -484,10 +518,15 @@ func TestCRDAdditionalPrinterColumns_Parallel(t *testing.T) { {Name: "Age", Type: "date", JSONPath: ".metadata.creationTimestamp"}, }, }, + addSuffix("oidcclients.oauth.supervisor"): { + "v1alpha1": []apiextensionsv1.CustomResourceColumnDefinition{ + {Name: "Age", Type: "date", JSONPath: ".metadata.creationTimestamp"}, + }, + }, } actualPinnipedCRDCount := 0 - expectedPinnipedCRDCount := 7 // the current number of CRDs that we ship as part of Pinniped + expectedPinnipedCRDCount := 8 // the current number of CRDs that we ship as part of Pinniped for _, crd := range crdList.Items { if !strings.Contains(crd.Spec.Group, env.APIGroupSuffix) { From 3cacb5b022bc69a88af34094f37eb4c9849771dd Mon Sep 17 00:00:00 2001 From: Margo Crawford Date: Mon, 6 Jun 2022 07:38:57 -0700 Subject: [PATCH 3/4] Fix typo in oidcclient spec and status descriptions Signed-off-by: Margo Crawford --- apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl | 4 ++-- .../supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml | 4 ++-- generated/1.17/README.adoc | 4 ++-- .../1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go | 4 ++-- .../1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml | 4 ++-- generated/1.18/README.adoc | 4 ++-- .../1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go | 4 ++-- .../1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml | 4 ++-- generated/1.19/README.adoc | 4 ++-- .../1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go | 4 ++-- .../1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml | 4 ++-- generated/1.20/README.adoc | 4 ++-- .../1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go | 4 ++-- .../1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml | 4 ++-- generated/1.21/README.adoc | 4 ++-- .../1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go | 4 ++-- .../1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml | 4 ++-- generated/1.22/README.adoc | 4 ++-- .../1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go | 4 ++-- .../1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml | 4 ++-- generated/1.23/README.adoc | 4 ++-- .../1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go | 4 ++-- .../1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml | 4 ++-- .../latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go | 4 ++-- 24 files changed, 48 insertions(+), 48 deletions(-) diff --git a/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl b/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl index abae5f2c..b4aaf275 100644 --- a/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl +++ b/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } diff --git a/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml b/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml index e5b2d932..802234ed 100644 --- a/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -39,7 +39,7 @@ spec: metadata: type: object spec: - description: Spec of the OIDC provider. + description: Spec of the OIDC client. properties: allowedGrantTypes: description: "allowedGrantTypes is a list of the allowed grant_type @@ -98,7 +98,7 @@ spec: - allowedScopes type: object status: - description: Status of the OIDC provider. + description: Status of the OIDC client. type: object required: - spec diff --git a/generated/1.17/README.adoc b/generated/1.17/README.adoc index a7396f25..994dc3e8 100644 --- a/generated/1.17/README.adoc +++ b/generated/1.17/README.adoc @@ -1356,8 +1356,8 @@ OIDCClient describes the configuration of an OIDC client. | Field | Description | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. -| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. -| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC client. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC client. |=== diff --git a/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index abae5f2c..b4aaf275 100644 --- a/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } diff --git a/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index e5b2d932..802234ed 100644 --- a/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -39,7 +39,7 @@ spec: metadata: type: object spec: - description: Spec of the OIDC provider. + description: Spec of the OIDC client. properties: allowedGrantTypes: description: "allowedGrantTypes is a list of the allowed grant_type @@ -98,7 +98,7 @@ spec: - allowedScopes type: object status: - description: Status of the OIDC provider. + description: Status of the OIDC client. type: object required: - spec diff --git a/generated/1.18/README.adoc b/generated/1.18/README.adoc index 53a3a986..fc6c1311 100644 --- a/generated/1.18/README.adoc +++ b/generated/1.18/README.adoc @@ -1356,8 +1356,8 @@ OIDCClient describes the configuration of an OIDC client. | Field | Description | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. -| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. -| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC client. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC client. |=== diff --git a/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index abae5f2c..b4aaf275 100644 --- a/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } diff --git a/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index e5b2d932..802234ed 100644 --- a/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -39,7 +39,7 @@ spec: metadata: type: object spec: - description: Spec of the OIDC provider. + description: Spec of the OIDC client. properties: allowedGrantTypes: description: "allowedGrantTypes is a list of the allowed grant_type @@ -98,7 +98,7 @@ spec: - allowedScopes type: object status: - description: Status of the OIDC provider. + description: Status of the OIDC client. type: object required: - spec diff --git a/generated/1.19/README.adoc b/generated/1.19/README.adoc index a8dd26ee..bbfcf79c 100644 --- a/generated/1.19/README.adoc +++ b/generated/1.19/README.adoc @@ -1356,8 +1356,8 @@ OIDCClient describes the configuration of an OIDC client. | Field | Description | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. -| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. -| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC client. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC client. |=== diff --git a/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index abae5f2c..b4aaf275 100644 --- a/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } diff --git a/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index e5b2d932..802234ed 100644 --- a/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -39,7 +39,7 @@ spec: metadata: type: object spec: - description: Spec of the OIDC provider. + description: Spec of the OIDC client. properties: allowedGrantTypes: description: "allowedGrantTypes is a list of the allowed grant_type @@ -98,7 +98,7 @@ spec: - allowedScopes type: object status: - description: Status of the OIDC provider. + description: Status of the OIDC client. type: object required: - spec diff --git a/generated/1.20/README.adoc b/generated/1.20/README.adoc index 5d419a80..eb390ef4 100644 --- a/generated/1.20/README.adoc +++ b/generated/1.20/README.adoc @@ -1356,8 +1356,8 @@ OIDCClient describes the configuration of an OIDC client. | Field | Description | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.2/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. -| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. -| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC client. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC client. |=== diff --git a/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index abae5f2c..b4aaf275 100644 --- a/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } diff --git a/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index e5b2d932..802234ed 100644 --- a/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -39,7 +39,7 @@ spec: metadata: type: object spec: - description: Spec of the OIDC provider. + description: Spec of the OIDC client. properties: allowedGrantTypes: description: "allowedGrantTypes is a list of the allowed grant_type @@ -98,7 +98,7 @@ spec: - allowedScopes type: object status: - description: Status of the OIDC provider. + description: Status of the OIDC client. type: object required: - spec diff --git a/generated/1.21/README.adoc b/generated/1.21/README.adoc index 925391c3..92407eff 100644 --- a/generated/1.21/README.adoc +++ b/generated/1.21/README.adoc @@ -1356,8 +1356,8 @@ OIDCClient describes the configuration of an OIDC client. | Field | Description | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. -| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. -| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC client. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC client. |=== diff --git a/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index abae5f2c..b4aaf275 100644 --- a/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } diff --git a/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index e5b2d932..802234ed 100644 --- a/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -39,7 +39,7 @@ spec: metadata: type: object spec: - description: Spec of the OIDC provider. + description: Spec of the OIDC client. properties: allowedGrantTypes: description: "allowedGrantTypes is a list of the allowed grant_type @@ -98,7 +98,7 @@ spec: - allowedScopes type: object status: - description: Status of the OIDC provider. + description: Status of the OIDC client. type: object required: - spec diff --git a/generated/1.22/README.adoc b/generated/1.22/README.adoc index 51cf7c07..6a1281fb 100644 --- a/generated/1.22/README.adoc +++ b/generated/1.22/README.adoc @@ -1356,8 +1356,8 @@ OIDCClient describes the configuration of an OIDC client. | Field | Description | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. -| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. -| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC client. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC client. |=== diff --git a/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index abae5f2c..b4aaf275 100644 --- a/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } diff --git a/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index e5b2d932..802234ed 100644 --- a/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -39,7 +39,7 @@ spec: metadata: type: object spec: - description: Spec of the OIDC provider. + description: Spec of the OIDC client. properties: allowedGrantTypes: description: "allowedGrantTypes is a list of the allowed grant_type @@ -98,7 +98,7 @@ spec: - allowedScopes type: object status: - description: Status of the OIDC provider. + description: Status of the OIDC client. type: object required: - spec diff --git a/generated/1.23/README.adoc b/generated/1.23/README.adoc index b7eddf16..80a89a56 100644 --- a/generated/1.23/README.adoc +++ b/generated/1.23/README.adoc @@ -1356,8 +1356,8 @@ OIDCClient describes the configuration of an OIDC client. | Field | Description | *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`. -| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC provider. -| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC provider. +| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC client. +| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-supervisor-oauth-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC client. |=== diff --git a/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index abae5f2c..b4aaf275 100644 --- a/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } diff --git a/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index e5b2d932..802234ed 100644 --- a/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -39,7 +39,7 @@ spec: metadata: type: object spec: - description: Spec of the OIDC provider. + description: Spec of the OIDC client. properties: allowedGrantTypes: description: "allowedGrantTypes is a list of the allowed grant_type @@ -98,7 +98,7 @@ spec: - allowedScopes type: object status: - description: Status of the OIDC provider. + description: Status of the OIDC client. type: object required: - spec diff --git a/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index abae5f2c..b4aaf275 100644 --- a/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -63,10 +63,10 @@ type OIDCClient struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // Spec of the OIDC provider. + // Spec of the OIDC client. Spec OIDCClientSpec `json:"spec"` - // Status of the OIDC provider. + // Status of the OIDC client. Status OIDCClientStatus `json:"status,omitempty"` } From 0dec2eee32e8ec951e6688d60647ac80a8b09a6c Mon Sep 17 00:00:00 2001 From: Margo Crawford Date: Mon, 6 Jun 2022 10:15:25 -0700 Subject: [PATCH 4/4] Add enum validation for scopes and grant types Signed-off-by: Margo Crawford --- .../oauth/v1alpha1/types_oidcclient.go.tmpl | 10 ++++++++-- .../oauth.supervisor.pinniped.dev_oidcclients.yaml | 10 ++++++++++ deploy/supervisor/z0_crd_overlay.yaml | 11 ++++++++++- generated/1.17/README.adoc | 4 ++-- .../supervisor/oauth/v1alpha1/types_oidcclient.go | 10 ++++++++-- .../oauth/v1alpha1/zz_generated.deepcopy.go | 4 ++-- .../oauth.supervisor.pinniped.dev_oidcclients.yaml | 10 ++++++++++ generated/1.18/README.adoc | 4 ++-- .../supervisor/oauth/v1alpha1/types_oidcclient.go | 10 ++++++++-- .../oauth/v1alpha1/zz_generated.deepcopy.go | 4 ++-- .../oauth.supervisor.pinniped.dev_oidcclients.yaml | 10 ++++++++++ generated/1.19/README.adoc | 4 ++-- .../supervisor/oauth/v1alpha1/types_oidcclient.go | 10 ++++++++-- .../oauth/v1alpha1/zz_generated.deepcopy.go | 4 ++-- .../oauth.supervisor.pinniped.dev_oidcclients.yaml | 10 ++++++++++ generated/1.20/README.adoc | 4 ++-- .../supervisor/oauth/v1alpha1/types_oidcclient.go | 10 ++++++++-- .../oauth/v1alpha1/zz_generated.deepcopy.go | 4 ++-- .../oauth.supervisor.pinniped.dev_oidcclients.yaml | 10 ++++++++++ generated/1.21/README.adoc | 4 ++-- .../supervisor/oauth/v1alpha1/types_oidcclient.go | 10 ++++++++-- .../oauth/v1alpha1/zz_generated.deepcopy.go | 4 ++-- .../oauth.supervisor.pinniped.dev_oidcclients.yaml | 10 ++++++++++ generated/1.22/README.adoc | 4 ++-- .../supervisor/oauth/v1alpha1/types_oidcclient.go | 10 ++++++++-- .../oauth/v1alpha1/zz_generated.deepcopy.go | 4 ++-- .../oauth.supervisor.pinniped.dev_oidcclients.yaml | 10 ++++++++++ generated/1.23/README.adoc | 4 ++-- .../supervisor/oauth/v1alpha1/types_oidcclient.go | 10 ++++++++-- .../oauth/v1alpha1/zz_generated.deepcopy.go | 4 ++-- .../oauth.supervisor.pinniped.dev_oidcclients.yaml | 10 ++++++++++ .../supervisor/oauth/v1alpha1/types_oidcclient.go | 10 ++++++++-- .../oauth/v1alpha1/zz_generated.deepcopy.go | 4 ++-- 33 files changed, 192 insertions(+), 49 deletions(-) diff --git a/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl b/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl index b4aaf275..e905c61a 100644 --- a/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl +++ b/apis/supervisor/oauth/v1alpha1/types_oidcclient.go.tmpl @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml b/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml index 802234ed..589a9154 100644 --- a/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/deploy/supervisor/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -54,6 +54,10 @@ spec: step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience." items: + enum: + - authorization_code + - refresh_token + - urn:ietf:params:oauth:grant-type:token-exchange type: string minItems: 1 type: array @@ -89,6 +93,12 @@ spec: the groups scope being requested and allowed, the ID token will not contain groups." items: + enum: + - openid + - offline_access + - username + - groups + - pinniped:request-audience type: string minItems: 1 type: array diff --git a/deploy/supervisor/z0_crd_overlay.yaml b/deploy/supervisor/z0_crd_overlay.yaml index 7596975d..130f780d 100644 --- a/deploy/supervisor/z0_crd_overlay.yaml +++ b/deploy/supervisor/z0_crd_overlay.yaml @@ -1,4 +1,4 @@ -#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved. +#! Copyright 2020-2022 the Pinniped contributors. All Rights Reserved. #! SPDX-License-Identifier: Apache-2.0 #@ load("@ytt:overlay", "overlay") @@ -40,3 +40,12 @@ metadata: name: #@ pinnipedDevAPIGroupWithPrefix("activedirectoryidentityproviders.idp.supervisor") spec: group: #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor") + +#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"oidcclients.oauth.supervisor.pinniped.dev"}}), expects=1 +--- +metadata: + #@overlay/match missing_ok=True + labels: #@ labels() + name: #@ pinnipedDevAPIGroupWithPrefix("oidcclients.oauth.supervisor") +spec: + group: #@ pinnipedDevAPIGroupWithPrefix("oauth.supervisor") diff --git a/generated/1.17/README.adoc b/generated/1.17/README.adoc index 994dc3e8..06dd963e 100644 --- a/generated/1.17/README.adoc +++ b/generated/1.17/README.adoc @@ -1377,9 +1377,9 @@ OIDCClientSpec is a struct that describes an OIDC Client. |=== | Field | Description | *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. -| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. +| *`allowedGrantTypes`* __GrantType array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. -| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. +| *`allowedScopes`* __Scope array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. |=== diff --git a/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index b4aaf275..e905c61a 100644 --- a/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.17/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/generated/1.17/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.17/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go index cb35cea5..1aba8aea 100644 --- a/generated/1.17/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go +++ b/generated/1.17/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -83,12 +83,12 @@ func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { } if in.AllowedGrantTypes != nil { in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes - *out = make([]string, len(*in)) + *out = make([]GrantType, len(*in)) copy(*out, *in) } if in.AllowedScopes != nil { in, out := &in.AllowedScopes, &out.AllowedScopes - *out = make([]string, len(*in)) + *out = make([]Scope, len(*in)) copy(*out, *in) } return diff --git a/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 802234ed..589a9154 100644 --- a/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.17/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -54,6 +54,10 @@ spec: step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience." items: + enum: + - authorization_code + - refresh_token + - urn:ietf:params:oauth:grant-type:token-exchange type: string minItems: 1 type: array @@ -89,6 +93,12 @@ spec: the groups scope being requested and allowed, the ID token will not contain groups." items: + enum: + - openid + - offline_access + - username + - groups + - pinniped:request-audience type: string minItems: 1 type: array diff --git a/generated/1.18/README.adoc b/generated/1.18/README.adoc index fc6c1311..3cdade3a 100644 --- a/generated/1.18/README.adoc +++ b/generated/1.18/README.adoc @@ -1377,9 +1377,9 @@ OIDCClientSpec is a struct that describes an OIDC Client. |=== | Field | Description | *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. -| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. +| *`allowedGrantTypes`* __GrantType array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. -| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. +| *`allowedScopes`* __Scope array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. |=== diff --git a/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index b4aaf275..e905c61a 100644 --- a/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.18/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/generated/1.18/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.18/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go index cb35cea5..1aba8aea 100644 --- a/generated/1.18/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go +++ b/generated/1.18/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -83,12 +83,12 @@ func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { } if in.AllowedGrantTypes != nil { in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes - *out = make([]string, len(*in)) + *out = make([]GrantType, len(*in)) copy(*out, *in) } if in.AllowedScopes != nil { in, out := &in.AllowedScopes, &out.AllowedScopes - *out = make([]string, len(*in)) + *out = make([]Scope, len(*in)) copy(*out, *in) } return diff --git a/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 802234ed..589a9154 100644 --- a/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.18/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -54,6 +54,10 @@ spec: step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience." items: + enum: + - authorization_code + - refresh_token + - urn:ietf:params:oauth:grant-type:token-exchange type: string minItems: 1 type: array @@ -89,6 +93,12 @@ spec: the groups scope being requested and allowed, the ID token will not contain groups." items: + enum: + - openid + - offline_access + - username + - groups + - pinniped:request-audience type: string minItems: 1 type: array diff --git a/generated/1.19/README.adoc b/generated/1.19/README.adoc index bbfcf79c..41377c38 100644 --- a/generated/1.19/README.adoc +++ b/generated/1.19/README.adoc @@ -1377,9 +1377,9 @@ OIDCClientSpec is a struct that describes an OIDC Client. |=== | Field | Description | *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. -| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. +| *`allowedGrantTypes`* __GrantType array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. -| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. +| *`allowedScopes`* __Scope array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. |=== diff --git a/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index b4aaf275..e905c61a 100644 --- a/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.19/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/generated/1.19/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.19/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go index cb35cea5..1aba8aea 100644 --- a/generated/1.19/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go +++ b/generated/1.19/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -83,12 +83,12 @@ func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { } if in.AllowedGrantTypes != nil { in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes - *out = make([]string, len(*in)) + *out = make([]GrantType, len(*in)) copy(*out, *in) } if in.AllowedScopes != nil { in, out := &in.AllowedScopes, &out.AllowedScopes - *out = make([]string, len(*in)) + *out = make([]Scope, len(*in)) copy(*out, *in) } return diff --git a/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 802234ed..589a9154 100644 --- a/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.19/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -54,6 +54,10 @@ spec: step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience." items: + enum: + - authorization_code + - refresh_token + - urn:ietf:params:oauth:grant-type:token-exchange type: string minItems: 1 type: array @@ -89,6 +93,12 @@ spec: the groups scope being requested and allowed, the ID token will not contain groups." items: + enum: + - openid + - offline_access + - username + - groups + - pinniped:request-audience type: string minItems: 1 type: array diff --git a/generated/1.20/README.adoc b/generated/1.20/README.adoc index eb390ef4..26266ced 100644 --- a/generated/1.20/README.adoc +++ b/generated/1.20/README.adoc @@ -1377,9 +1377,9 @@ OIDCClientSpec is a struct that describes an OIDC Client. |=== | Field | Description | *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. -| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. +| *`allowedGrantTypes`* __GrantType array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. -| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. +| *`allowedScopes`* __Scope array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. |=== diff --git a/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index b4aaf275..e905c61a 100644 --- a/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.20/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/generated/1.20/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.20/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go index cb35cea5..1aba8aea 100644 --- a/generated/1.20/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go +++ b/generated/1.20/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -83,12 +83,12 @@ func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { } if in.AllowedGrantTypes != nil { in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes - *out = make([]string, len(*in)) + *out = make([]GrantType, len(*in)) copy(*out, *in) } if in.AllowedScopes != nil { in, out := &in.AllowedScopes, &out.AllowedScopes - *out = make([]string, len(*in)) + *out = make([]Scope, len(*in)) copy(*out, *in) } return diff --git a/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 802234ed..589a9154 100644 --- a/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.20/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -54,6 +54,10 @@ spec: step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience." items: + enum: + - authorization_code + - refresh_token + - urn:ietf:params:oauth:grant-type:token-exchange type: string minItems: 1 type: array @@ -89,6 +93,12 @@ spec: the groups scope being requested and allowed, the ID token will not contain groups." items: + enum: + - openid + - offline_access + - username + - groups + - pinniped:request-audience type: string minItems: 1 type: array diff --git a/generated/1.21/README.adoc b/generated/1.21/README.adoc index 92407eff..d6feec77 100644 --- a/generated/1.21/README.adoc +++ b/generated/1.21/README.adoc @@ -1377,9 +1377,9 @@ OIDCClientSpec is a struct that describes an OIDC Client. |=== | Field | Description | *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. -| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. +| *`allowedGrantTypes`* __GrantType array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. -| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. +| *`allowedScopes`* __Scope array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. |=== diff --git a/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index b4aaf275..e905c61a 100644 --- a/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.21/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/generated/1.21/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.21/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go index cb35cea5..1aba8aea 100644 --- a/generated/1.21/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go +++ b/generated/1.21/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -83,12 +83,12 @@ func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { } if in.AllowedGrantTypes != nil { in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes - *out = make([]string, len(*in)) + *out = make([]GrantType, len(*in)) copy(*out, *in) } if in.AllowedScopes != nil { in, out := &in.AllowedScopes, &out.AllowedScopes - *out = make([]string, len(*in)) + *out = make([]Scope, len(*in)) copy(*out, *in) } return diff --git a/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 802234ed..589a9154 100644 --- a/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.21/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -54,6 +54,10 @@ spec: step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience." items: + enum: + - authorization_code + - refresh_token + - urn:ietf:params:oauth:grant-type:token-exchange type: string minItems: 1 type: array @@ -89,6 +93,12 @@ spec: the groups scope being requested and allowed, the ID token will not contain groups." items: + enum: + - openid + - offline_access + - username + - groups + - pinniped:request-audience type: string minItems: 1 type: array diff --git a/generated/1.22/README.adoc b/generated/1.22/README.adoc index 6a1281fb..5d37f884 100644 --- a/generated/1.22/README.adoc +++ b/generated/1.22/README.adoc @@ -1377,9 +1377,9 @@ OIDCClientSpec is a struct that describes an OIDC Client. |=== | Field | Description | *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. -| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. +| *`allowedGrantTypes`* __GrantType array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. -| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. +| *`allowedScopes`* __Scope array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. |=== diff --git a/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index b4aaf275..e905c61a 100644 --- a/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.22/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/generated/1.22/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.22/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go index cb35cea5..1aba8aea 100644 --- a/generated/1.22/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go +++ b/generated/1.22/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -83,12 +83,12 @@ func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { } if in.AllowedGrantTypes != nil { in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes - *out = make([]string, len(*in)) + *out = make([]GrantType, len(*in)) copy(*out, *in) } if in.AllowedScopes != nil { in, out := &in.AllowedScopes, &out.AllowedScopes - *out = make([]string, len(*in)) + *out = make([]Scope, len(*in)) copy(*out, *in) } return diff --git a/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 802234ed..589a9154 100644 --- a/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.22/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -54,6 +54,10 @@ spec: step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience." items: + enum: + - authorization_code + - refresh_token + - urn:ietf:params:oauth:grant-type:token-exchange type: string minItems: 1 type: array @@ -89,6 +93,12 @@ spec: the groups scope being requested and allowed, the ID token will not contain groups." items: + enum: + - openid + - offline_access + - username + - groups + - pinniped:request-audience type: string minItems: 1 type: array diff --git a/generated/1.23/README.adoc b/generated/1.23/README.adoc index 80a89a56..9f71c489 100644 --- a/generated/1.23/README.adoc +++ b/generated/1.23/README.adoc @@ -1377,9 +1377,9 @@ OIDCClientSpec is a struct that describes an OIDC Client. |=== | Field | Description | *`allowedRedirectURIs`* __string array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this client. Any other uris will be rejected. Must be https, unless it is a loopback. -| *`allowedGrantTypes`* __string array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. +| *`allowedGrantTypes`* __GrantType array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this client. Must only contain the following values: - authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to authenticate users. This grant must always be listed. - refresh_token: allows the client to perform refresh grants for the user to extend the user's session. This grant must be listed if allowedScopes lists offline_access. - urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience. -| *`allowedScopes`* __string array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. +| *`allowedScopes`* __Scope array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. Must only contain the following values: - openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). This scope must always be listed. - offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. This scope must be listed if allowedGrantTypes lists refresh_token. - pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, which is a step in the process to be able to get a cluster credential for the user. openid, username and groups scopes must be listed when this scope is present. This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. - username: The client is allowed to request that ID tokens contain the user's username. Without the username scope being requested and allowed, the ID token will not contain the user's username. - groups: The client is allowed to request that ID tokens contain the user's group membership, if their group membership is discoverable by the Supervisor. Without the groups scope being requested and allowed, the ID token will not contain groups. |=== diff --git a/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index b4aaf275..e905c61a 100644 --- a/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/1.23/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/generated/1.23/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/1.23/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go index cb35cea5..1aba8aea 100644 --- a/generated/1.23/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go +++ b/generated/1.23/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -83,12 +83,12 @@ func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { } if in.AllowedGrantTypes != nil { in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes - *out = make([]string, len(*in)) + *out = make([]GrantType, len(*in)) copy(*out, *in) } if in.AllowedScopes != nil { in, out := &in.AllowedScopes, &out.AllowedScopes - *out = make([]string, len(*in)) + *out = make([]Scope, len(*in)) copy(*out, *in) } return diff --git a/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml b/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml index 802234ed..589a9154 100644 --- a/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml +++ b/generated/1.23/crds/oauth.supervisor.pinniped.dev_oidcclients.yaml @@ -54,6 +54,10 @@ spec: step in the process to be able to get a cluster credential for the user. This grant must be listed if allowedScopes lists pinniped:request-audience." items: + enum: + - authorization_code + - refresh_token + - urn:ietf:params:oauth:grant-type:token-exchange type: string minItems: 1 type: array @@ -89,6 +93,12 @@ spec: the groups scope being requested and allowed, the ID token will not contain groups." items: + enum: + - openid + - offline_access + - username + - groups + - pinniped:request-audience type: string minItems: 1 type: array diff --git a/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go b/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go index b4aaf275..e905c61a 100644 --- a/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go +++ b/generated/latest/apis/supervisor/oauth/v1alpha1/types_oidcclient.go @@ -7,6 +7,12 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) +// +kubebuilder:validation:Enum="authorization_code";"refresh_token";"urn:ietf:params:oauth:grant-type:token-exchange" +type GrantType string + +// +kubebuilder:validation:Enum="openid";"offline_access";"username";"groups";"pinniped:request-audience" +type Scope string + // OIDCClientSpec is a struct that describes an OIDC Client. type OIDCClientSpec struct { // allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this @@ -27,7 +33,7 @@ type OIDCClientSpec struct { // which is a step in the process to be able to get a cluster credential for the user. // This grant must be listed if allowedScopes lists pinniped:request-audience. // +kubebuilder:validation:MinItems=1 - AllowedGrantTypes []string `json:"allowedGrantTypes"` + AllowedGrantTypes []GrantType `json:"allowedGrantTypes"` // allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. // @@ -46,7 +52,7 @@ type OIDCClientSpec struct { // if their group membership is discoverable by the Supervisor. // Without the groups scope being requested and allowed, the ID token will not contain groups. // +kubebuilder:validation:MinItems=1 - AllowedScopes []string `json:"allowedScopes"` + AllowedScopes []Scope `json:"allowedScopes"` } // OIDCClientStatus is a struct that describes the actual state of an OIDC Client. diff --git a/generated/latest/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go b/generated/latest/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go index cb35cea5..1aba8aea 100644 --- a/generated/latest/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go +++ b/generated/latest/apis/supervisor/oauth/v1alpha1/zz_generated.deepcopy.go @@ -83,12 +83,12 @@ func (in *OIDCClientSpec) DeepCopyInto(out *OIDCClientSpec) { } if in.AllowedGrantTypes != nil { in, out := &in.AllowedGrantTypes, &out.AllowedGrantTypes - *out = make([]string, len(*in)) + *out = make([]GrantType, len(*in)) copy(*out, *in) } if in.AllowedScopes != nil { in, out := &in.AllowedScopes, &out.AllowedScopes - *out = make([]string, len(*in)) + *out = make([]Scope, len(*in)) copy(*out, *in) } return