File pinniped.changes of Package pinniped

Overview Repositories Revisions Requests Users Attributes Meta

File pinniped.changes of Package pinniped

-------------------------------------------------------------------
Fri Jun 07 19:28:42 UTC 2024 - opensuse_buildservice@ojkastl.de

- Update to version 0.31.0:
  CLI-related changes
  * Pinniped CLI and the oidc-client package are now enhanced by
    pinniped_supported_identity_provider_types

-------------------------------------------------------------------
Fri May 10 04:57:05 UTC 2024 - opensuse_buildservice@ojkastl.de

- Update to version 0.30.0:
  * Added new option to OIDCClient resource to allow configuration
    of ID token lifetime for tokens issued by authcode flows and
    refresh flows. See
    OIDCClient.spec.tokenLifetimes.idTokenSeconds in the API docs.
    (#1914)
  * Setting the new env var PINNIPED_SKIP_PRINT_LOGIN_URL=true will
    cause the Pinniped CLI to skip printing the login URL when a
    browser has launched, which can be useful when using console
    UIs like k9s. (#1938, #1897)
  * WebhookAuthenticator resources will have detailed status
    written to them automatically, to aid in debugging. (#1894)
  * WebhookAuthenticators now honor Pinniped's preferred client TLS
    configuration, including its preferred allowed TLS v1.2
    ciphers. This could be a breaking change if your webhook server
    is serving requests using only TLS v1.2 (not allowing TLS v1.3)
    and does not allow any of Pinniped's preferred TLS v1.2
    ciphers. Note that Pinniped's preferred TLS v1.2 cipher list is
    different depending on if it was compiled in FIPS compatibility
    mode or not. (#1917)
  * Removed all deprecated deployment options from ytt templates.
    (#1926)
  * Clarified the text in some error messages. (#1932, #1922)
  * Added documentation to provide some debugging tips. (#1936,
    #1904, #1824)
  * Updates Go to v1.22.3, updates the Kubernetes libraries to
    v0.30.0, and updates all other project dependencies. (#1940,
    #1937, #1935, #1934, #1933, #1931, #1921, #1916, #1913, #1911,
    #1902, #1899)

-------------------------------------------------------------------
Fri Mar 15 21:35:06 UTC 2024 - opensuse_buildservice@ojkastl.de

- Update to version 0.29.0:
  * Use go.uber.org/mock instead of github.com/golang/mock and
    rerun mock generation
  * Bump dependencies
  * Bump golang.org/x/mod from 0.15.0 to 0.16.0 in
    /hack/update-go-mod
  * Use ghcr instead of Harbor as the default for pinniped-server
    images
  * CLI's localhost listener handles CORS preflight requests for
    GETs
  * Integration tests should use a valid value for CredentialIssuer
    spec.impersonationProxy.service.type
  * Bump google.golang.org/protobuf to v1.33.0 for CVE-2024-24786
  * whoami integration test now allows for additional extra fields
    in K8s 1.30+
  * Add some logging and comments making it easier to debug with
    chrome
  * replace verison of otelhttptrace in go.mod
  * Add 1.29 and update patch versions in kube-versions.txt; run
    codegen
  * Change codegen scripts to work with Kube 1.29
  * wait for JWTAuthenticator to be phase=ready in supervisor
    warnings test
  * Update jwtauthenticator unit tests to check actions
  * Update jwk authenticator status integration tests
  * Add Status & tests for jwks key fetching
  * Update copyright year in modified files
  * Add integration tests for JWTAuthenticators
  * add WaitForJWTAuthenticatorStatusPhase() integration helper
  * fix comment in testlib/client.go
  * Improve jwtcachefiller tests
  * extract status comparison test helpers
  * ldap upstream watcher: rename local var for clarity
  * Add .Status to JWTAuthenticator with Conditions,Phase
  * Update some comments in go.mod
  * Fix races in login_test.go units tests
  * Update codeql workflow actions to latest versions and add
    setup-go
  * "login oidc" CLI command sometimes skips printing auth URL for
    non-ttys
  * Update configure-concierge-jwt.md doc with clarifications
  * Add hack/prepare-jwtauthenticator-on-kind.sh
  * CLI deciding if token exchange needed should not look at ID
    token expiry
  * Don't skip upstream group memberships when groups scope is not
    granted
  * Rename a func and collapse applying id transforms into creating
    session
  * Refactor to move invocation of identity transforms out of IDP
    interfaces
  * Refactor token endpoint to add interface for IDP upstream
    refresh
  * Refactor to extract interface for upstream IDP interactions
  * More refactoring of auth handler and related refactor of
    upstreamldap
  * Refactor error handling in authorize endpoint (changes some
    responses)
  * Correct doc which explained bug that has since been fixed.
  * Adjust tests and comments for upgrade to latest version of
    fosite
  * login oidc cmd checks access token expiry before doing token
    exchange
  * Convert double-quoted strings to raw strings in login_test.go
  * Fix ptls_test.go for Go 1.22
  * Rerun codegen after upgrading CI controller-gen from v0.13.0 to
    v0.14.0
  * Fix plog_test.go for Go 1.22
  * Revert support TLS 1.3 in FIPS mode because Go reverted
    goboring upgrade
  * Test util AssertTLS supports both old and new goboring
  * Bump golang.org/x/mod from 0.14.0 to 0.15.0 in
    /hack/update-go-mod
  * disable dependabot for some things in favor of our own tooling
  * Increase the lint timeout in hack/module.sh for when CI workers
    get slow
  * update CI URL in CONTRIBUTING.md
  * Support the new Go FIPS compiler which was upgraded inside Go
    1.21.6
  * Update dependencies, including Kube packages to v0.29.0
  * Updated versions in docs for v0.28.0 release

-------------------------------------------------------------------
Sat Dec 16 19:00:25 UTC 2023 - kastl@b1-systems.de

- Update to version 0.28.0:
  * Minor Changes
    - The Concierge will no longer create a long-lived service
      account token upon installation, which was previously
      contained in a Secret in the Concierge's namespace. Instead,
      it will dynamically fetch short-lived tokens and hold them
      in-memory in the Pods. Upon upgrade, the old Secret will be
      automatically deleted. This improves security posture by
      making it impossible for an RBAC configuration or similar
      mistake to make this token readable to non-admins, and also
      by making the token short-lived. Other Secrets in the
      namespace must still be protected against read by non-admins.
      (#1733)
    - The Supervisor will now show an interstitial web page to
      allow the end-user to choose one of the configured IDPs, when
      multiple IDPs are configured, and when the query parameters
      to the OIDC authorize endpoint do not specify which IDP to
      use. (#1742)
    - A new debugging tool has been added to aid in debugging your
      LDAPIdentityProvider settings. See
      hack/debug-ldapidentityprovider.sh. (#1594)
    - The values.yaml files in the ytt template directories have
      been converted to use ytt's schema feature. This makes it
      easier for users or 3rd parties to create Carvel packages
      using the Dockerfile and ytt templates from the Pinniped
      repo. At this time, the Pinniped releases on GitHub do not
      include Carvel packages. (#1701)
    - The project's Dockerfiles have been updated to add build ARGs
      to choose the BUILD_IMAGE (golang image used to compile) and
      the BASE_IMAGE (base layer of the resulting container image).
      This will make it easier for users and 3rd parties to choose
      alternate images when building the project. The default
      values are the latest golang image and the latest
      gcr.io/distroless/static image. The project maintainers will
      continue to bump the default values when updates of those
      images are available. (#1776)
    - Updates Go to v1.21.5, updates the Kubernetes libraries to
      v0.28.4, and updates all other project dependencies. (#1815,
      #1808, #1807, #1804, #1803, #1801, #1793, #1791, #1788,
      #1779, #1775, #1772, #1771, #1767, #1763, #1755, #1751,
      #1748, #1741, #1738, #1735, #1734, #1732, #1721, #1752)
  * Bug Fixes
    - pinniped whoami has a new --timeout parameter, which defaults
      to no timeout. This replaces a hardcoded timeout which caused
      pinniped whoami to fail when a user took more than 20 seconds
      to complete a fresh interactive login. (#1774)

-------------------------------------------------------------------
Wed Oct 11 04:44:59 UTC 2023 - kastl@b1-systems.de

- Update to version 0.27.0:
  * document usage of --pinniped-cli-path option
  * Bump go.mod direct dependencies
  * add a login banner to CLI-based login prompts which shows the
    IDP name
  * backfill unit tests for expected stderr output in login_test.go
  * Rename username and password prompt variables
  * Shorten kubeconfigCommand func for lint funlen
  * Allow 'pinniped get kubeconfig' to override the client-go
    credential plugin command
  * Update kube versions for codegen
  * tolerate arm64 in tools deployments and jobs
  * Bump dockerfiles to golang:1.21.2
  * Update hack/update-go-mod/go.mod
  * Bump go.mod direct dependencies
  * Update website docs for arm64 support
  * Use bitnami/openldap in integration tests instead of our old
    fork
  * Support building and deploying multi-arch linux amd64 and arm64
    images
  * Show errors from the form_post POST request on the page
  * Bump go.mod direct dependencies
  * Bump go.mod direct dependencies
  * Optionally use Contour in hack/prepare-supervisor-on-kind.sh
  * fix flake seen in pod_shutdown_test.go
  * Stop using deprecated critical-pod annotation
  * Same error messages shown in CLI's callback web page and in
    terminal
  * Use latest controller-gen, which allows CEL validations
  * add integration test for graceful shutdowns which release
    leader leases
  * Fix deadlock during shutdown which prevented leader election
    cleanup
  * Update blog rendering to h1 the title (not h2)
  * Updated versions in docs for v0.26.0 release
  * add blog post for v0.26.0 release
  * Add CI/CD How-To

-------------------------------------------------------------------
Wed Sep 20 05:38:43 UTC 2023 - kastl@b1-systems.de

- Update to version 0.26.0:
  * trying to avoid flake on Okta login page in browser
  * specify the container name when fetching keys from kube cert
    agent pod
  * Update LDAP integration tests for changes in
    github.com/go-ldap/ldap/v3
  * Bump k8s.io/kube-openapi and pin github.com/google/cel-go
  * Bump go.mod direct dependencies
  * Bump go.uber.org/zap from 1.25.0 to 1.26.0
  * Keep the deps updated from previous commit but keep cel-go at
    0.16.x
  * Bump go.mod direct dependencies
  * update kube-versions.txt for codegen
  * multiple IDPs and identity transformations docs
  * remove extra timeoutCtx for exec.CommandContext invocations in
    e2e test
  * add celformer unit test demonstrating string regexp in CEL
    expressions
  * make prepare-supervisor-on-kind.sh work with older versions of
    bash
  * fix imports grouping in manager.go
  * add workaround in update-codegen.sh for problem seen when run
    on linux
  * update FederationDomain.status.conditions to come from metav1
  * Fix conflicts caused from rebasing main into multiple IDPs
    branch
  * add the IDP display name to the downstream ID token's `sub`
    claim
  * add units tests to token_handler_test.go
  * run codegen again after rebasing main branch into feature
    branch
  * started add units tests for identity transforms to
    token_handler_test.go
  * add units tests to post_login_handler_test.go
  * add new unit tests in callback_handler_test.go
  * use slices.Contains() instead of custom func in
    token_handler_test.go
  * add new unit tests in auth_handler_test.go
  * Add more tests with identity transformations in
    supervisor_login_test.go
  * Replace more pointer.String() with the new ptr.To()
  * Start adding identity transformations tests to
    supervisor_login_test.go
  * Fix expectations in FederationDomains status test for old Kube
    versions
  * Add e2e test for rejecting auth using identity transformation
    policy
  * handle old versions of k8s in
    supervisor_federationdomain_status_test.go
  * remove expectation about TransformsConstantsNamesUnique status
    condition
  * rename a local variable in an integration test
  * add an e2e test for a FederationDomain with multiple IDPs and
    transforms
  * CRD already validates that IDP transform constant names are
    unique
  * fix some here.Doc string indents in
    federation_domain_watcher_test.go
  * wordsmith some FederationDomain status messages
  * add integration test for FederationDomain status updates
  * small refactor in supervisor_discovery_test.go
  * add unit test for ApplyIdentityTransformations helper
  * add unit tests for getters in federation_domain_issuer_test.go
  * extract a helper function in federation_domain_watcher.go
  * use multiple IDPs in manager_test.go
  * Status condition messages for IDP transforms show index of
    invalid IDP
  * Make it possible to compare transformation pipelines in unit
    tests
  * Validate transforms examples in federation_domain_watcher.go
  * Validate transforms expressions in federation_domain_watcher.go
  * Add helper for happy/sad conditions to
    federation_domain_watcher_test.go
  * Allow for slower CI workers in celformer_test.go
  * Validate transforms const names in federation_domain_watcher.go
  * Update proposal doc statuses
  * Replace sleep with kubectl wait in
    prepare-supervisor-on-kind.sh
  * Validate IDP objectRef kind names in
    federation_domain_watcher.go
  * Validate apiGroup names are valid in
    federation_domain_watcher.go
  * Validate display names are unique in
    federation_domain_watcher.go
  * Handle some unexpected errors in federation_domain_watcher.go
  * Refactor: extract helper functions in
    federation_domain_watcher.go
  * Load FederationDomain endpoints before updating its status
  * Fix lint errors in federation_domain_watcher.go, and adjust
    unit test
  * Update integration tests for new FederationDomain phase
    behavior
  * Refactor federation_domain_watcher_test.go and add new test to
    its table
  * Expand IdentityProvidersFound condition in
    federation_domain_watcher
  * Update federation_domain_watcher with new IdentityProviderFound
  * Change federation_domain_watcher_test.go to use a test table
    style
  * Update informers unit test for
    FederationDomainWatcherController
  * Change name of FederationDomain printer column back to "Status"
  * Change FederationDomain.Status to use Phase and Conditions
  * Update a test assertion to make failure easier to understand
  * fix more integration tests for multiple IDPs
  * update 1.27 codegen for multiple IDPs
  * update unit test that fails on slow CI workers
  * Fix some tests in supervisor_login_test.go
  * escape semicolons in variable values in
    integration-test-env-goland.sh
  * fix callback_handler_test.go
  * fix token_handler_test.go
  * test FederationDomainIdentityProvidersListerFinder
  * reorganize federation domain packages to be more intuitive
  * Reorganized FederationDomain packages to avoid circular
    dependency
  * Fix auth_handler_test.go
  * Update auth_handler.go to return 422 error when upstream IdP
    not found
  * Fix post_login_handler_test.go
  * add a type assertion
  * fix internal/oidc/provider/manager/manager_test.go
  * refactor: rename "provider" to "federationdomain" when
    appropriate
  * Get tests to compile again and fix lint errors
  * Add tests for identity_transformation.go
  * Fixup unit tests for the previous commit
  * First draft of implementation of multiple IDPs support
  * Allow user-defined string & stringList consts for use in CEL
    expressions
  * Add identity transformation packages idtransform and celformer
  * Add APIs for multiple IDP and id transformations to
    FederationDomain CRD
  * Use Conditions from apimachinery, specifically
    k8s.io/apimachinery/pkg/apis/meta/v1.Conditions
  * Improve pod logs related to Supervisor TLS certificate problems
  * Bump to go1.20.1
  * Bump go.mod direct dependencies
  * site: fix codeblock left padding and spacing tweak
  * Make pre code blocks have more consistent font size and line
    height
  * [LDAP] move attributeUnchangedSinceLogin from upstreamldap to
    activedirectoryupstreamwatcher
  * Adjust test expectations for compilation differences with 1.21
  * Run 'go fix ./...' with go1.21.0
  * Inline and remove testutil.TempDir
  * Simplify build tags associated with unsupported golang versions
  * Bump to golang 1.21.0, and bump all golang deps
  * Add docs for Supervisor with Azure AD
  * Improve hack/prepare-for-integration-tests.sh flexibility
  * Do not fail hack/prepare-for-integration-tests.sh without
    KUBE_GIT_VERSION
  * Do not fail when KUBE_GIT_VERSION is not set
  * Update comments to indicate support for newer versions of
    Kubernetes
  * Remove generated code for K8s 1.17, 1.18, 1.19, and 1.20
  * Split off helper function
  * Use pversion to retrieve buildtime information
  * Integration tests should use 'kubectl explain --output
    plaintext-openapiv2'
  * Expose OpenAPIv3 explanations
  * Ensure that kubegenerator scripts are executable
  * Run K8s codegen, adding 1.28.0
  * K8s API Server audit events are no longer pointers
  * Update all golang dependencies, especially k8s.io (for 1.28)
  * Update docs to clarify which Supervisor port to expose outside
    cluster
  * blog: clean up tags page
  * blog: add multiple author support for posts
  * blog: impersonation-proxy spelling, grammar
  * blog: impersonation-proxy post updates
  * add author to blog list page
  * Add blog post for v0.25.0
  * Updated versions in docs for v0.25.0 release

-------------------------------------------------------------------
Tue Sep 05 15:03:19 UTC 2023 - kastl@b1-systems.de

- Update to version 0.25.0:
  * Address PR feedback
  * Fix #1582 by not double-decoding the ca.crt field in external
    TLS secrets for the impersonation proxy
  * Bump go.mod direct dependencies
  * Address PR feedback, especially to check that the CA bundle is
    some kind of valid cert
  * Add integration test to verify that the impersonation proxy
    will use an external TLS serving cert
  * Test Refactor: use explicit names for mTLS signing cert
  * Impersonation proxy detects when the user has configured an
    externally provided TLS secret to serve TLS
  * Add CredentialIssuer.Spec.ImpersonationProxy.TLS to configure
    an externally provided TLS secret
  * The impersonation controller should sync when any secret of
    type kubernetes.io/tls changes in the namespace
  * Bump golang to 1.20.7
  * Bump go.mod direct dependencies
  * site: autogenerate new sections on main docs listing page
  * site: minor text updates
  * site: reorganize /howto/idp->/howto/supervisor
  * site: add redirects for old doc links
  * site style: code block tweaks and sidebar menu highlight
  * site sidebar: menu renaming & reorganization
  * site sidebar: create new How-to sub-heading for IDP config
  * Replace agouti and chromedriver with chromedp across the whole
    project
  * Bump go.mod direct dependencies
  * Add How To... Integrate with Auth0
  * site css: images on resource page should fit the grid
  * Use k8s.io/utils/ptr instead of k8s.io/utils/pointer, which is
    deprecated
  * Bump go.mod direct dependencies
  * add AWS blog post to resources page of pinniped.dev
  * kube cert agent pod requests 0 cpu to avoid scheduling failures
  * Bump K8s APIs 1.24 through 1.27
  * Bump go.mod direct dependencies
  * Remove untested comments
  * Do not name return variables
  * Fix lint
  * Mark untested code paths
  * Pass caBundle instead of an object
  * Backfill test cases
  * Prefer early return
  * Backfill issuer tests
  * Use go:embed for easier to read tests
  * Fix godoc
  * Bump base images to go1.20.6 in Dockerfiles
  * Bump go.mod direct dependencies
  * Improve performance of supervisor_oidcclientsecret_test.go
  * Add proposal to implement #1547, Concierge Impersonation Proxy
    | External Certificate Management
  * Add proposal for multiple identity providers in the Supervisor
  * Bump to golang:1.20.5
  * Func ldap.Conn.Close() now returns an error
  * Pin to the version of k8s.io/kube-openapi used by
    client-go@v0.27.3
  * Update generated files
  * Bump hack/update-go-mod/go.mod
  * Bump all go.mod dependencies
  * Updated versions in docs for v0.24.0 release
  * Increase a test timeout in supervisor_secrets_test.go
  * Update codeql-analysis.yml according to the latest template

-------------------------------------------------------------------
Fri Jul 14 07:19:32 UTC 2023 - kastl@b1-systems.de

- Update to version 0.24.0:
  * Update codeql-analysis.yml
  * Increase a test timeout for when pulling container image is slow
  * backtick changes
  * Increase some test timeouts
  * increase timeout in a test
  * Add docs for UserAttributeForFilter group search setting
  * Add integration test for AD UserAttributeForFilter group search setting
  * Use groupSearch.userAttributeForFilter during ActiveDirectory group searches
  * Add ActiveDirectoryIdentityProvider.spec.groupSearch.userAttributeForFilter
  * Add integration test for UserAttributeForFilter group search setting
  * Add group search tests for UserAttributeForFilter in ldap_client_test.go
  * command line option.
  * Use groupSearch.userAttributeForFilter during LDAP group searches
  * Add LDAPIdentityProvider.spec.groupSearch.userAttributeForFilter
  * Add some posixGroups to the openldap server for use in integration tests

-------------------------------------------------------------------
Fri Jul 14 07:16:37 UTC 2023 - Johannes Kastl <kastl@b1-systems.de>

- new package pinniped: CLI for the Pinniped identity service
  provider for Kubernetes

Places

File pinniped.changes of Package pinniped

Places