v0.47.0

Release v0.47.0

Release Image

Image	Registry
ghcr.io/vmware/pinniped/pinniped-server:v0.47.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.47.0	DockerHub

These images can also be referenced by their digest: sha256:3a46e1ea8b874281698dd27e60d6f9b46738cb10483baa9dc78a0023cc17e29d.

Changes

This release adds support for using Go's native FIPS compatibility, fixes bugs, and upgrades the project's dependencies to the latest versions.

Minor Changes

• Pinniped now supports being optionally compiled using Go's native GOFIPS140 mode for FIPS compatibility. For more information, see https://pinniped.dev/docs/reference/fips and also see the description of the PR which introduced this support. Compiling with boring crypto is still supported, but should be considered deprecated now and will be removed in a future release. (#3167)
• When using the Supervisor's GitHubIdentityProvider, occasionally logins would fail while the Supervisor was calling the GitHub /user endpoint to discover the user's identity details. This was due a problem in the GitHub API where it does not always immediately recognize its own tokens that it just issued moments before, and would intermittently return 401 from the /user endpoint as a result. This GitHub issue is described here. The Pinniped Supervisor will now retry up to two additional /user requests when this happens as a mitigation strategy. (#3152)
• Updates the Kubernetes libraries to v0.36.2, Golang to v1.26.5, and updates all other project dependencies. (#3152, #3169, #3166, #3165, #3163, #3084)

Bug Fixes

• When using the Supervisor's ActiveDirectoryIdentityProvider CR, and when ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty, the Supervisor will default to building group names by appending the group's sAMAccountName with @ followed by the group's domain components (all DCs in the group's DN) joined by .. For example, this would form a group name such as example@company.com for a group whose sAMAccountName is example and whose Distinguished Name (DN) includes DC=company,DC=com. This release fixes a bug in the parsing logic for getting all the domain components from the group's DN. The code was previously not correctly interpreting commas embedded in the values of other fields of the group's DN, such as commas in the group's Common Name (CN). This bug could lead to the Supervisor incorrectly determining that group's name for Kubernetes. Anyone using the Pinniped Supervisor with an ActiveDirectoryIdentityProvider with an empty ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is advised to upgrade the Supervisor to this release. See GHSA-7xq8-m6h6-2xg8 for more details. (#3152)

Diffs

A complete list of changes (31 commits, 134 changed files with 1,160 additions and 483 deletions) can be found here.

v0.46.0

Release v0.46.0

Release Image

Image	Registry
ghcr.io/vmware/pinniped/pinniped-server:v0.46.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.46.0	DockerHub

These images can also be referenced by their digest: sha256:140294862f6c83f9e242c58bbaf54f15d768666030cc451344897f221a605c9a.

Changes

This release upgrades the project's golang dependencies to the latest versions.

Minor Changes

• Updates the Kubernetes libraries to v0.36.0, Golang to v1.26.3, and updates all other project dependencies. (#3042, #3082, #3083, #3077, #3058, #3038, #3028, #3026, #3017, #3014)

Diffs

A complete list of changes (38 commits, 291 changed files with 10,285 additions and 8,761 deletions) can be found here.

v0.45.0

Release v0.45.0

Release Image

Image	Registry
ghcr.io/vmware/pinniped/pinniped-server:v0.45.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.45.0	DockerHub

These images can also be referenced by their digest: sha256:5aea06db863bc4b3e45f21a611ab1b0893d41bfee032cc58789ad952e30bf924.

Changes

This release fixes a bug related to labels on the impersonation proxy's Service, and updates all project dependencies.

Minor Changes

• Fixed a bug in the Concierge where the controller which creates the Service for the impersonation proxy could compete with 3rd party controllers over the labels on that Service, which could have the unfortunate side effect of Concierge pods other than the auto-elected leader pod being unable to start the impersonator server. See PR for more details. (#3008)
• Updates Kubernetes libraries to v0.35.3, Golang to v1.26.1, and updates all other project dependencies. (#3011, #3007, #2996, #2980, #2973, #2970, #2945, #2912, #2936, #2932, #2903, #2891, #2880, #2883)

Diffs

A complete list of changes (43 commits, 1,047 changed files with 1,651 additions and 1,604 deletions) can be found here.

Acknowledgements

Thanks to @sedflix for reporting the issue #2933 fixed by #3008.

v0.44.0

Release v0.44.0

Release Image

Image	Registry
ghcr.io/vmware/pinniped/pinniped-server:v0.44.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.44.0	DockerHub

These images can also be referenced by their digest: sha256:8fa44154f31a8b756fa17ab1900691124b11c152b05d0ab90c80df3a72417fb2.

Changes

This release updates how anonymous authentication works in the impersonation proxy, and updates all project dependencies.

Minor Changes

• The heuristic used by the Concierge impersonation proxy to decide if the cluster supports anonymous authentication, and therefore decides whether the impersonation proxy should allow anonymous authentication on k8s API requests, was updated to better support recent AKS and GKE clusters which allow anonymous authentication only at the health endpoints. See PR description for more details. (#2869)
• Updates Golang to v1.25.6, and updates all other project dependencies. (#2873, #2872, #2837, #2838, #2831, #2827, #2823)

Diffs

A complete list of changes (21 commits, 36 changed files with 657 additions and 236 deletions) can be found here.

v0.43.0

Release v0.43.0

Release Image

Image	Registry
ghcr.io/vmware/pinniped/pinniped-server:v0.43.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.43.0	DockerHub

These images can also be referenced by their digest: sha256:cd16380e1159fea4c1c6d79386548a000ca214e6a09f881af09e9ac59db962e0.

Changes

This release upgrades the project's golang dependencies to the latest versions.

Minor Changes

• Updates the Kubernetes libraries to v0.35.0, Golang to v1.25.5, and updates all other project dependencies. (#2821, #2812, #2806, #2804, #2785, #2780, #2707, #2696, #2701, #2695)

Diffs

A complete list of changes (32 commits, 992 changed files with 20,044 additions and 67,392 deletions) can be found here.

v0.42.0

Release v0.42.0

Release Image

Image	Registry
ghcr.io/vmware/pinniped/pinniped-server:v0.42.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.42.0	DockerHub

These images can also be referenced by their digest: sha256:7f901305b659e9ed3c5b32ab273141430202f2b5fa697616574753a96c845537.

Changes

This release adds some more advanced configuration options for the Concierge's kube cert agent Deployment.

Minor Changes

• Adds a new configuration option which can be used in the Concierge's ConfigMap to change the kube cert agent Deployment's strategy type. See PR description for details. (#2690)
• Adds a new configuration option which can be used in the Concierge's ConfigMap to change the kube cert agent Deployment's pod template runAsUser and runAsGroup. See PR description for details. (#2683)
• Updates the Kubernetes libraries to v0.33.5, Golang to v1.25.3, and updates all other project dependencies. (#2676, #2590)

Diffs

A complete list of changes (15 commits, 32 changed files with 648 additions and 205 deletions) can be found here.

v0.41.0

Release v0.41.0

Release Image

Image	Registry
ghcr.io/vmware/pinniped/pinniped-server:v0.41.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.41.0	DockerHub

These images can also be referenced by their digest: sha256:7f8f5822e762396fe964ec4737bb02c3370be1eb7edd087079c80f9b3caaa061.

Changes

This release enables the use of ADFS with the Pinniped Supervisor and upgrades dependencies.

Major Changes

• The Pinniped Supervisor supports OIDC-compliant providers, along with several other identity provider types. However, ADFS does not correctly implement the OIDC specification, so it was not previously supported. This release provides a workaround so that the Pinniped Supervisor can be configured to use ADFS as an OIDCIdentityProvider. See PR #2580's description for more documentation.

Minor Changes

• Updates the Kubernetes libraries to v0.33.4, Golang to v1.25.0, and updates all other project dependencies. (#2588, #2577, #2573, #2536, #2531, #2529)

Diffs

A complete list of changes (20 commits, 112 changed files with 679 additions and 256 deletions) can be found here.

v0.40.0

Release v0.40.0

Release Image

Image	Registry
ghcr.io/vmware/pinniped/pinniped-server:v0.40.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.40.0	DockerHub

These images can also be referenced by their digest: sha256:fb3c48175998700ecaaa629e05aacc79c7f1ac47f457655668ca8fb984ae5557.

Changes

This release adds new features to JWTAuthenticator and upgrades dependencies.

Major Changes

• Starting with this release, container images for the release will no longer be pushed to ghcr.io/vmware-tanzu/pinniped/pinniped-server. For this release and for future releases, container images will be pushed to ghcr.io/vmware/pinniped/pinniped-server instead. This is because the Pinniped GitHub repository was recently moved from the vmware-tanzu GitHub organization to the vmware organization. GitHub automatically redirects most things from the old location to the new location, but not the container image repository. (#2526)
• The Pinniped JWTAuthenticator has several new features which are meant to be similar to features found in Kubernetes AuthenticationConfiguration. (#2491) These are all expert user features and should be used with caution. See the Pinniped API docs for full documentation. The new features are:
  • spec.claimValidationRules: works like jwt[].claimValidationRules
  • spec.userValidationRules: works like jwt[].userValidationRules
  • spec.claims.usernameExpression: works like jwt[].claimMappings.username.expression
  • spec.claims.groupsExpression: works like jwt[].claimMappings.groups.expression
  • spec.claims.extra: works like jwt[].claimMappings.extra
    • Note that while these extras will be added to the client certificate issued by the Pinniped Concierge during end user login, Kubernetes will not respect these extras because Kubernetes has no mechanism for userInfo extras from a client cert. This will probably only be useful if you are using a custom auth proxy in front of Kubernetes.
    • Also note that unlike in Kubernetes structured auth, the keys for these extras in Pinniped are not allowed to contain the = character.

Minor Changes

• Updates the Kubernetes libraries to v0.33.3, Golang to v1.24.4, and updates all other project dependencies. (#2482, #2475, #2473, #2471, #2393, #2525, #2528)
• Makes some minor changes to accommodate Pinniped's CI system moving. (#2514, #2506, #2485, #2461)

Diffs

A complete list of changes (45 commits, 199 changed files with 9,549 additions and 1,229 deletions) can be found here.

v0.39.0

Release v0.39.0

Release Image

Image	Registry
ghcr.io/vmware-tanzu/pinniped/pinniped-server:v0.39.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.39.0	DockerHub

These images can also be referenced by their digest: sha256:e05962e09ffcf964184718fb790a6099c2f295897b8e96e95cb8a3f87a9d64c8.

Changes

Add a feature to set spec.priorityClassName for the kube-cert-agent pod created by Concierge.

Major Changes

• Added a feature to set spec.priorityClassName for the kube-cert-agent pod created by Concierge. For more information see the issue #2349 and the PR #2389. It's possible to set the spec.priorityClassName for the Concierge and Supervisor pods by changing the manifest (if using the provided ./deploy directory, use a ytt overlay).

Minor Changes

• Updated many golang dependencies. See the go.mod file for details
• Added Pinniped golang codegen for K8s 1.32 and 1.33. Removed Pinniped codegen for K8s 1.25.

Bug Fixes

• N/A

Diffs

A complete list of changes can be found here.

Acknowledgements

Thanks to @luwangVMW for issue #2349

v0.38.0

Release v0.38.0

Release Image

Image	Registry
ghcr.io/vmware-tanzu/pinniped/pinniped-server:v0.38.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.38.0	DockerHub

These images can also be referenced by their digest: sha256:cc1769112d738ff95a3f8430d254d8546fc254d2cbc065f916b88d83ceb22c65.

Changes

This release includes several new features and upgrades project dependencies.

Minor Changes

• The Pinniped Supervisor now supports using response_mode=form_post with an OIDCIdentityProvider. Some versions of ADFS might require this in order for Pinniped to receive certain claims in the ADFS-issued ID token. (#2254)
• The pinniped get kubeconfig CLI command now auto-discovers the issuer's CA bundle from a JWTAuthenticator's spec.TLS.CertificateAuthorityDataSource, and this CA bundle is written into the resulting kubeconfig. (#2193)
• The FederationDomain.spec.issuer field must start with https://. This was previously validated after the resource was created. Now this validation will cause resource creation to fail. (#2167)
• The long-deprecated CredentialIssuer.status.kubeConfigInfo field has been removed. (#2167)
• Both the Pinniped Supervisor and the Pinniped Concierge have a new configuration option available in their respective ConfigMaps to disable various types of dynamic admission plugins for their aggregated APIs. It is not typically necessary to disable these admission plugins. This feature was added because having lots of ValidatingAdmissionPolicies on your cluster can cause the Pinniped and Kubernetes API server pods to use lots of memory. For more information, see the description of PR #2269. (#2269)
• When compiling for FIPS compatibility, this release is designed to be used with Go 1.24, which included an updated version of boringcrypto. Note that Pinniped is still designed to be used with GOEXPERIMENT=boringcrypto, and has not yet been tested with Go 1.24's new fips140 GODEBUG setting. When compiled using hack/Dockerfile_fips, the Pinniped Concierge and Supervisor servers will allow the use of both TLS 1.2 and TLS 1.3, because Go 1.24 now supports both with its updated version of boringcrypto. As a result, the fips_enable_tls13_max_for_default_profile build tag, which could previously be used to allow the use of TLS 1.3 in FIPS-compatible mode, is no longer needed, as that is now the default behavior. Also drops the use of two insecure ciphers that have been dropped by boringcrypto. (#2203)
• Updates the Kubernetes libraries to v0.31.6, Golang to v1.24.1, and updates all other project dependencies. (#2276, #2268, #2266, #2264, #2249, #2239, #2236, #2233, #2228, #2209, #2205, #2197, #2196, #2195, #2192, #2191, #2190, #2189, #2188, #2187, #2186, #2278)
• Some additional changes were made to improve tests. (#2253, #2250)

Diffs

A complete list of changes (81 commits, 179 changed files with 2,049 additions and 1,535 deletions) can be found here.

Acknowledgements

• Thanks to @devantler for reporting the issue fixed by #2193.
• Thanks to @graindcafe for reporting the issue fixed by #2254.