diff --git a/apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl b/apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl
index 78ed1384..e38b207b 100644
--- a/apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl
+++ b/apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl
@@ -5,16 +5,16 @@ package v1alpha1
 
 import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-// +kubebuilder:validation:Enum=KubeClusterSigningCertificate
+// +kubebuilder:validation:Enum=KubeClusterSigningCertificate;ImpersonationProxy
 type StrategyType string
 
-// +kubebuilder:validation:Enum=TokenCredentialRequestAPI
+// +kubebuilder:validation:Enum=TokenCredentialRequestAPI;ImpersonationProxy
 type FrontendType string
 
 // +kubebuilder:validation:Enum=Success;Error
 type StrategyStatus string
 
-// +kubebuilder:validation:Enum=FetchedKey;CouldNotFetchKey
+// +kubebuilder:validation:Enum=Listening;Pending;Disabled;ErrorDuringSetup;CouldNotFetchKey;CouldNotGetClusterInfo;FetchedKey
 type StrategyReason string
 
 const (
diff --git a/deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml b/deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml
index 5ae6b3fb..7436f6e2 100644
--- a/deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -111,6 +111,7 @@ spec:
                             can use with a strategy.
                           enum:
                           - TokenCredentialRequestAPI
+                          - ImpersonationProxy
                           type: string
                       required:
                       - type
@@ -126,8 +127,13 @@ spec:
                     reason:
                       description: Reason for the current status.
                       enum:
-                      - FetchedKey
+                      - Listening
+                      - Pending
+                      - Disabled
+                      - ErrorDuringSetup
                       - CouldNotFetchKey
+                      - CouldNotGetClusterInfo
+                      - FetchedKey
                       type: string
                     status:
                       description: Status of the attempted integration strategy.
@@ -139,6 +145,7 @@ spec:
                       description: Type of integration attempted.
                       enum:
                       - KubeClusterSigningCertificate
+                      - ImpersonationProxy
                       type: string
                   required:
                   - lastUpdateTime
diff --git a/generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go
index 78ed1384..e38b207b 100644
--- a/generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -5,16 +5,16 @@ package v1alpha1
 
 import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-// +kubebuilder:validation:Enum=KubeClusterSigningCertificate
+// +kubebuilder:validation:Enum=KubeClusterSigningCertificate;ImpersonationProxy
 type StrategyType string
 
-// +kubebuilder:validation:Enum=TokenCredentialRequestAPI
+// +kubebuilder:validation:Enum=TokenCredentialRequestAPI;ImpersonationProxy
 type FrontendType string
 
 // +kubebuilder:validation:Enum=Success;Error
 type StrategyStatus string
 
-// +kubebuilder:validation:Enum=FetchedKey;CouldNotFetchKey
+// +kubebuilder:validation:Enum=Listening;Pending;Disabled;ErrorDuringSetup;CouldNotFetchKey;CouldNotGetClusterInfo;FetchedKey
 type StrategyReason string
 
 const (
diff --git a/generated/1.17/crds/config.concierge.pinniped.dev_credentialissuers.yaml b/generated/1.17/crds/config.concierge.pinniped.dev_credentialissuers.yaml
index 5ae6b3fb..7436f6e2 100644
--- a/generated/1.17/crds/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/generated/1.17/crds/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -111,6 +111,7 @@ spec:
                             can use with a strategy.
                           enum:
                           - TokenCredentialRequestAPI
+                          - ImpersonationProxy
                           type: string
                       required:
                       - type
@@ -126,8 +127,13 @@ spec:
                     reason:
                       description: Reason for the current status.
                       enum:
-                      - FetchedKey
+                      - Listening
+                      - Pending
+                      - Disabled
+                      - ErrorDuringSetup
                       - CouldNotFetchKey
+                      - CouldNotGetClusterInfo
+                      - FetchedKey
                       type: string
                     status:
                       description: Status of the attempted integration strategy.
@@ -139,6 +145,7 @@ spec:
                       description: Type of integration attempted.
                       enum:
                       - KubeClusterSigningCertificate
+                      - ImpersonationProxy
                       type: string
                   required:
                   - lastUpdateTime
diff --git a/generated/1.18/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/1.18/apis/concierge/config/v1alpha1/types_credentialissuer.go
index 78ed1384..e38b207b 100644
--- a/generated/1.18/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/1.18/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -5,16 +5,16 @@ package v1alpha1
 
 import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-// +kubebuilder:validation:Enum=KubeClusterSigningCertificate
+// +kubebuilder:validation:Enum=KubeClusterSigningCertificate;ImpersonationProxy
 type StrategyType string
 
-// +kubebuilder:validation:Enum=TokenCredentialRequestAPI
+// +kubebuilder:validation:Enum=TokenCredentialRequestAPI;ImpersonationProxy
 type FrontendType string
 
 // +kubebuilder:validation:Enum=Success;Error
 type StrategyStatus string
 
-// +kubebuilder:validation:Enum=FetchedKey;CouldNotFetchKey
+// +kubebuilder:validation:Enum=Listening;Pending;Disabled;ErrorDuringSetup;CouldNotFetchKey;CouldNotGetClusterInfo;FetchedKey
 type StrategyReason string
 
 const (
diff --git a/generated/1.18/crds/config.concierge.pinniped.dev_credentialissuers.yaml b/generated/1.18/crds/config.concierge.pinniped.dev_credentialissuers.yaml
index 5ae6b3fb..7436f6e2 100644
--- a/generated/1.18/crds/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/generated/1.18/crds/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -111,6 +111,7 @@ spec:
                             can use with a strategy.
                           enum:
                           - TokenCredentialRequestAPI
+                          - ImpersonationProxy
                           type: string
                       required:
                       - type
@@ -126,8 +127,13 @@ spec:
                     reason:
                       description: Reason for the current status.
                       enum:
-                      - FetchedKey
+                      - Listening
+                      - Pending
+                      - Disabled
+                      - ErrorDuringSetup
                       - CouldNotFetchKey
+                      - CouldNotGetClusterInfo
+                      - FetchedKey
                       type: string
                     status:
                       description: Status of the attempted integration strategy.
@@ -139,6 +145,7 @@ spec:
                       description: Type of integration attempted.
                       enum:
                       - KubeClusterSigningCertificate
+                      - ImpersonationProxy
                       type: string
                   required:
                   - lastUpdateTime
diff --git a/generated/1.19/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/1.19/apis/concierge/config/v1alpha1/types_credentialissuer.go
index 78ed1384..e38b207b 100644
--- a/generated/1.19/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/1.19/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -5,16 +5,16 @@ package v1alpha1
 
 import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-// +kubebuilder:validation:Enum=KubeClusterSigningCertificate
+// +kubebuilder:validation:Enum=KubeClusterSigningCertificate;ImpersonationProxy
 type StrategyType string
 
-// +kubebuilder:validation:Enum=TokenCredentialRequestAPI
+// +kubebuilder:validation:Enum=TokenCredentialRequestAPI;ImpersonationProxy
 type FrontendType string
 
 // +kubebuilder:validation:Enum=Success;Error
 type StrategyStatus string
 
-// +kubebuilder:validation:Enum=FetchedKey;CouldNotFetchKey
+// +kubebuilder:validation:Enum=Listening;Pending;Disabled;ErrorDuringSetup;CouldNotFetchKey;CouldNotGetClusterInfo;FetchedKey
 type StrategyReason string
 
 const (
diff --git a/generated/1.19/crds/config.concierge.pinniped.dev_credentialissuers.yaml b/generated/1.19/crds/config.concierge.pinniped.dev_credentialissuers.yaml
index 5ae6b3fb..7436f6e2 100644
--- a/generated/1.19/crds/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/generated/1.19/crds/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -111,6 +111,7 @@ spec:
                             can use with a strategy.
                           enum:
                           - TokenCredentialRequestAPI
+                          - ImpersonationProxy
                           type: string
                       required:
                       - type
@@ -126,8 +127,13 @@ spec:
                     reason:
                       description: Reason for the current status.
                       enum:
-                      - FetchedKey
+                      - Listening
+                      - Pending
+                      - Disabled
+                      - ErrorDuringSetup
                       - CouldNotFetchKey
+                      - CouldNotGetClusterInfo
+                      - FetchedKey
                       type: string
                     status:
                       description: Status of the attempted integration strategy.
@@ -139,6 +145,7 @@ spec:
                       description: Type of integration attempted.
                       enum:
                       - KubeClusterSigningCertificate
+                      - ImpersonationProxy
                       type: string
                   required:
                   - lastUpdateTime
diff --git a/generated/1.20/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/1.20/apis/concierge/config/v1alpha1/types_credentialissuer.go
index 78ed1384..e38b207b 100644
--- a/generated/1.20/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/1.20/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -5,16 +5,16 @@ package v1alpha1
 
 import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-// +kubebuilder:validation:Enum=KubeClusterSigningCertificate
+// +kubebuilder:validation:Enum=KubeClusterSigningCertificate;ImpersonationProxy
 type StrategyType string
 
-// +kubebuilder:validation:Enum=TokenCredentialRequestAPI
+// +kubebuilder:validation:Enum=TokenCredentialRequestAPI;ImpersonationProxy
 type FrontendType string
 
 // +kubebuilder:validation:Enum=Success;Error
 type StrategyStatus string
 
-// +kubebuilder:validation:Enum=FetchedKey;CouldNotFetchKey
+// +kubebuilder:validation:Enum=Listening;Pending;Disabled;ErrorDuringSetup;CouldNotFetchKey;CouldNotGetClusterInfo;FetchedKey
 type StrategyReason string
 
 const (
diff --git a/generated/1.20/crds/config.concierge.pinniped.dev_credentialissuers.yaml b/generated/1.20/crds/config.concierge.pinniped.dev_credentialissuers.yaml
index 5ae6b3fb..7436f6e2 100644
--- a/generated/1.20/crds/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/generated/1.20/crds/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -111,6 +111,7 @@ spec:
                             can use with a strategy.
                           enum:
                           - TokenCredentialRequestAPI
+                          - ImpersonationProxy
                           type: string
                       required:
                       - type
@@ -126,8 +127,13 @@ spec:
                     reason:
                       description: Reason for the current status.
                       enum:
-                      - FetchedKey
+                      - Listening
+                      - Pending
+                      - Disabled
+                      - ErrorDuringSetup
                       - CouldNotFetchKey
+                      - CouldNotGetClusterInfo
+                      - FetchedKey
                       type: string
                     status:
                       description: Status of the attempted integration strategy.
@@ -139,6 +145,7 @@ spec:
                       description: Type of integration attempted.
                       enum:
                       - KubeClusterSigningCertificate
+                      - ImpersonationProxy
                       type: string
                   required:
                   - lastUpdateTime
diff --git a/generated/latest/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/latest/apis/concierge/config/v1alpha1/types_credentialissuer.go
index 78ed1384..e38b207b 100644
--- a/generated/latest/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/latest/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -5,16 +5,16 @@ package v1alpha1
 
 import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-// +kubebuilder:validation:Enum=KubeClusterSigningCertificate
+// +kubebuilder:validation:Enum=KubeClusterSigningCertificate;ImpersonationProxy
 type StrategyType string
 
-// +kubebuilder:validation:Enum=TokenCredentialRequestAPI
+// +kubebuilder:validation:Enum=TokenCredentialRequestAPI;ImpersonationProxy
 type FrontendType string
 
 // +kubebuilder:validation:Enum=Success;Error
 type StrategyStatus string
 
-// +kubebuilder:validation:Enum=FetchedKey;CouldNotFetchKey
+// +kubebuilder:validation:Enum=Listening;Pending;Disabled;ErrorDuringSetup;CouldNotFetchKey;CouldNotGetClusterInfo;FetchedKey
 type StrategyReason string
 
 const (