Release v0.47.0

Release Image

These images can also be referenced by their digest: sha256:3a46e1ea8b874281698dd27e60d6f9b46738cb10483baa9dc78a0023cc17e29d.

Changes

This release adds support for using Go's native FIPS compatibility, fixes bugs, and upgrades the project's dependencies to the latest versions.

Minor Changes

• Pinniped now supports being optionally compiled using Go's native GOFIPS140 mode for FIPS compatibility. For more information, see https://pinniped.dev/docs/reference/fips and also see the description of the PR which introduced this support. Compiling with boring crypto is still supported, but should be considered deprecated now and will be removed in a future release. (#3167)
• When using the Supervisor's GitHubIdentityProvider, occasionally logins would fail while the Supervisor was calling the GitHub /user endpoint to discover the user's identity details. This was due a problem in the GitHub API where it does not always immediately recognize its own tokens that it just issued moments before, and would intermittently return 401 from the /user endpoint as a result. This GitHub issue is described here. The Pinniped Supervisor will now retry up to two additional /user requests when this happens as a mitigation strategy. (#3152)
• Updates the Kubernetes libraries to v0.36.2, Golang to v1.26.5, and updates all other project dependencies. (#3152, #3169, #3166, #3165, #3163, #3084)

Bug Fixes

• When using the Supervisor's ActiveDirectoryIdentityProvider CR, and when ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty, the Supervisor will default to building group names by appending the group's sAMAccountName with @ followed by the group's domain components (all DCs in the group's DN) joined by .. For example, this would form a group name such as example@company.com for a group whose sAMAccountName is example and whose Distinguished Name (DN) includes DC=company,DC=com. This release fixes a bug in the parsing logic for getting all the domain components from the group's DN. The code was previously not correctly interpreting commas embedded in the values of other fields of the group's DN, such as commas in the group's Common Name (CN). This bug could lead to the Supervisor incorrectly determining that group's name for Kubernetes. Anyone using the Pinniped Supervisor with an ActiveDirectoryIdentityProvider with an empty ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is advised to upgrade the Supervisor to this release. See GHSA-7xq8-m6h6-2xg8 for more details. (#3152)

Diffs

A complete list of changes (31 commits, 134 changed files with 1,160 additions and 483 deletions) can be found here.