chore(deps): update kubernetes packages to v0.36.0 (#6 )

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [k8s.io/api](https://github.com/kubernetes/api) | `v0.0.0-20260509204538-0dfb117cc6ec` → `v0.36.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/k8s.io%2fapi/v0.36.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/k8s.io%2fapi/v0.0.0-20260509204538-0dfb117cc6ec/v0.36.0?slim=true) | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `v0.0.0-20260513183604-f9371b815e42` → `v0.36.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/k8s.io%2fapimachinery/v0.36.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/k8s.io%2fapimachinery/v0.0.0-20260513183604-f9371b815e42/v0.36.0?slim=true) | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `v0.0.0-20260509205101-ca52b81a2940` → `v0.36.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/k8s.io%2fclient-go/v0.36.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/k8s.io%2fclient-go/v0.0.0-20260509205101-ca52b81a2940/v0.36.0?slim=true) | Co-authored-by: Renovate Bot <renovate@t00n.de> Co-committed-by: Renovate Bot <renovate@t00n.de>
feat: adjust sample to mvp (#1 )
2026-05-19 10:37:38 +02:00 · 2026-05-17 14:39:46 +02:00
47 changed files with 1094 additions and 378 deletions
@@ -0,0 +1,7 @@
+*
+
+!pkg
+!controller.go
+!main.go
+!go.mod
+!go.sum
@@ -0,0 +1,16 @@
+name: Go Cache Key
+description: Create a cache key for Go dependencies
+
+outputs:
+  hash:
+    description: The cache key for Go dependencies
+    value: ${{ steps.hash-go.outputs.hash }}
+
+runs:
+  using: composite
+  steps:
+    - name: Create cache key
+      shell: bash
+      id: hash-go
+      run: |
+        echo "hash=$(sha256sum go.mod go.sum | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
@@ -0,0 +1,104 @@
+name: CD
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "go.mod"
+      - "go.sum"
+      - "**/*.go"
+      - "Dockerfile"
+      - "Makefile"
+  workflow_dispatch:
+
+env:
+  DOCKER_REGISTRY: gitea.t000-n.de
+
+jobs:
+  build_and_push:
+    name: Build and push
+    strategy:
+      matrix:
+        arch: [amd64]
+    runs-on:
+      - ubuntu-latest
+      - linux_${{ matrix.arch }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - name: Login to Registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+      - name: Get Metadata
+        id: meta
+        run: |
+          echo REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F"/" '{print $2}' | tr '[:upper:]' '[:lower:]') >> $GITHUB_OUTPUT
+          echo REPO_VERSION=$(git describe --tags --always | sed 's/^v//') >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/${{ matrix.arch }}
+          push: true
+          provenance: false
+          build-args: GOARCH=${{ matrix.arch }}
+          tags: |
+            ${{ env.DOCKER_REGISTRY }}/t.behrendt/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}-${{ matrix.arch }}
+
+  create_tag:
+    name: Create tag
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag.outputs.new-tag }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@ef0c23189db33220a73022d8c29a27709d0df440 # 0.1.32
+        id: tag
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          prerelease: ${{ github.event_name == 'workflow_dispatch' }}
+      - run: |
+          git tag ${{ steps.tag.outputs.new-tag }}
+          git push origin ${{ steps.tag.outputs.new-tag }}
+      - name: Set output
+        run: |
+          echo "tag=${{ steps.tag.outputs.new-tag }}" >> $GITHUB_OUTPUT
+
+  create_manifest:
+    name: Create manifest
+    needs:
+      - build_and_push
+      - create_tag
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Get Metadata
+        id: meta
+        run: |
+          echo REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F"/" '{print $2}' | tr '[:upper:]' '[:lower:]') >> $GITHUB_OUTPUT
+          echo REPO_VERSION=$(git describe --tags --always | sed 's/^v//') >> $GITHUB_OUTPUT
+
+      - name: Login to Registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Create manifest
+        run: |
+          docker manifest create ${{ env.DOCKER_REGISTRY }}/t.behrendt/${{ steps.meta.outputs.REPO_NAME }}:${{ needs.create_tag.outputs.tag }} \
+            ${{ env.DOCKER_REGISTRY }}/t.behrendt/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}-amd64
+
+          docker manifest push ${{ env.DOCKER_REGISTRY }}/t.behrendt/${{ steps.meta.outputs.REPO_NAME }}:${{ needs.create_tag.outputs.tag }}
@@ -8,30 +8,44 @@ env:
  RUNNER_TOOL_CACHE: /toolcache

 jobs:
+  install-dependencies:
+    uses: ./.gitea/workflows/install-go-dependencies.yaml
+
+  build-check:
+    name: build check
+    needs: install-dependencies
+    uses: ./.gitea/workflows/run-go-script.yaml
+    with:
+      script: build
+
+  check-format:
+    name: check format
+    needs: install-dependencies
+    uses: ./.gitea/workflows/run-go-script.yaml
+    with:
+      script: check-format
+
+  check-lint:
+    name: check lint
+    needs: install-dependencies
+    uses: ./.gitea/workflows/run-go-script.yaml
+    with:
+      script: lint
+
  test:
    name: test
+    needs: install-dependencies
+    uses: ./.gitea/workflows/run-go-script.yaml
+    with:
+      script: test
+
+  image-check:
+    name: image check
    runs-on:
      - ubuntu-latest
+      - linux_amd64
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - name: Create cache key
-        id: hash-go
-        run: echo "hash=$(sha256sum go.mod go.sum | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
-      - name: cache go
-        id: cache-go
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            /go_path
-            /go_cache
-          key: go_path-${{ steps.hash-go.outputs.hash }}
-          restore-keys: |-
-            go_cache-${{ steps.hash-go.outputs.hash }}
-      - name: build
-        run: make build
+      - name: Build image
+        run: make build-image
@@ -0,0 +1,33 @@
+name: Install Go Dependencies
+
+on:
+  workflow_call:
+
+jobs:
+  install-dependencies:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - name: Create cache key
+        id: go-cache-key
+        uses: ./.gitea/actions/go-cache-key
+      - name: cache go
+        id: cache-go
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            /go_path
+            /go_cache
+          key: go_path-${{ steps.go-cache-key.outputs.hash }}
+          restore-keys: |-
+            go_cache-${{ steps.go-cache-key.outputs.hash }}
+      - name: Download dependencies
+        run: go mod download
@@ -0,0 +1,38 @@
+name: Run Go Script
+
+on:
+  workflow_call:
+    inputs:
+      script:
+        description: The script to run
+        required: true
+        type: string
+
+jobs:
+  run-script:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - name: Create cache key
+        id: go-cache-key
+        uses: ./.gitea/actions/go-cache-key
+      - name: Install dependencies from Cache
+        id: cache-go
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            /go_path
+            /go_cache
+          key: go_path-${{ steps.go-cache-key.outputs.hash }}
+          restore-keys: |-
+            go_cache-${{ steps.go-cache-key.outputs.hash }}
+      - name: Run script
+        run: make ${{ inputs.script }}
@@ -14,6 +14,7 @@

 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
+lcov.info

 # Dependency directories (remove the comment below to include it)
 # vendor/
@@ -30,3 +31,4 @@ vendor/

 # build artifacts
 main
+__debug_bin*
@@ -1,7 +1,4 @@
 {
-  // Use IntelliSense to learn about possible attributes.
-  // Hover to view descriptions of existing attributes.
-  // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
  "version": "0.2.0",
  "configurations": [
    {
@@ -1,4 +1,4 @@
-FROM docker.io/library/golang:1.25-alpine@sha256:04d017a27c481185c169884328a5761d052910fdced8c3b8edd686474efdf59b AS build
+FROM docker.io/library/golang:1.26.3@sha256:313faae491b410a35402c05d35e7518ae99103d957308e940e1ae2cfa0aac29b AS build

 ARG GOARCH=amd64

@@ -2,14 +2,39 @@ ifneq (,$(wildcard ./.env))
    include .env
    export
 endif
-.PHONY: build run codegen
+.PHONY: build run codegen build-image test test-unit test-coverage lint format check-format

 build:
 	go build -o main

+build-image:
+	docker build -t authentik-kubernetes-operator:latest .
+
 run:
 	make build
 	./main --kubeconfig=/home/tbehrendt/.kube/config

 codegen:
 	./scripts/codegen.sh
+
+test: test-unit test-coverage
+
+test-unit:
+	go test . -coverprofile=coverage.out
+
+test-coverage:
+	go tool gcov2lcov -infile coverage.out > lcov.info
+
+lint:
+	go vet ./...
+
+format:
+	gofmt -w .
+
+check-format:
+	@OUTPUT=$$(gofmt -l .); \
+	if [ -n "$$OUTPUT" ]; then \
+		echo "Formatter failed for:"; \
+		echo "$$OUTPUT"; \
+		exit 1; \
+	fi
@@ -2,4 +2,56 @@

 Authentik Kubernetes Operator allows to manage Authentik resources directly in Kubernetes using Custom Kubernetes Resources.

-## Features
+The custom resources of this operator ultimately will mirror the Authentik resources. New resources will be added as there is a need for them.
+
+Manual changes to the resources in Authentik will be overwritten by the operator. So always manage the resources in Kubernetes.
+
+## Custom Resources
+
+| Custom Resource | CRD File                                                   | Short Name |
+| --------------- | ---------------------------------------------------------- | ---------- |
+| ProxyProvider   | [`proxyProvider.yaml`](`artifacts/crd/proxyProvider.yaml`) | pp         |
+
+### ProxyProvider
+
+Currently only the "Forward Single" ProxyProvider is supported and only a reduced set of fields are exposed by the custom resources.
+
+Example [`proxyProvider.yaml`](`artifacts/examples/proxyProvider.yaml`):
+
+```yaml
+apiVersion: proxyprovider.t000-n.de/v1alpha1
+kind: ProxyProvider
+metadata:
+  name: proxy-provider-example
+  namespace: kube-system
+spec:
+  name: proxy-provider-example
+  # The ID of the authorization flow. In this example: "default-provider-authorization-implicit-consent (Authorize Application)"
+  authorization_flow: 16896c6d-b326-42d1-8d3f-93f32921962e
+  # The ID of the invalidation flow. In this example: "default-provider-invalidation-flow (Logged out of application)"
+  invalidation_flow: 7acac1ef-19e3-4a6f-8d8d-14ca7031d184
+  # The external host of your application.
+  external_host: https://example.t00n.de
+```
+
+The ProxyProvider will be created in Authentik, but will not be assigned to an outpost or an application (Resources are TBD).
+
+## Versioning
+
+As soon as the operator covers an entire use case, the version will be raised to v1 and follow default versioning rules. Before that, the version will be v1alpha1.
+
+## Development
+
+### Guidelines & Tips
+
+- Only do a single reconciliation at a time and then return.
+  - This is because your references from the k8s API get stale after each update.
+  - Whenever you update a resource, k8s API will send a new event to your controller, which will trigger a new reconciliation.
+- The API will periodically send a resource to the controller for re-syncing, giving the controller a chance to reconcile the state with the outside world.
+- Use finalizers to ensure that the controller gets a chance to reconcile the state with the outside world before the object is deleted. If no finalizer is present, the object is deleted immediately without the controller seeing it.
+- Use the resource's state to keep track of the current state of the outside world, e.g. identifiers of external resources, etc.
+
+### References
+
+- [Extend Kubernetes](https://kubernetes.io/docs/concepts/extend-kubernetes/#api-extensions)
+- [Example Controller Implementation](https://github.com/kubernetes/sample-controller)
@@ -2,10 +2,12 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  name: proxyproviders.proxyprovider.t000-n.de
+  finalizers:
+    - proxyprovider.t000-n.de/delete-authentik-proxyprovider
 spec:
  group: proxyprovider.t000-n.de
  versions:
-    - name: v1
+    - name: v1alpha1
      served: true
      storage: true
      subresources:
@@ -1,5 +1,5 @@
 # Example ProxyProvider CRD
-apiVersion: proxyprovider.t000-n.de/v1
+apiVersion: proxyprovider.t000-n.de/v1alpha1
 kind: ProxyProvider
 metadata:
  name: proxy-provider-example
@@ -19,32 +19,31 @@ package main
 import (
 	"context"
 	"fmt"
+	"net/http"
+	"slices"
 	"strconv"
 	"time"

 	"golang.org/x/time/rate"

-	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/wait"
-	appsinformers "k8s.io/client-go/informers/apps/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/scheme"
 	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
-	appslisters "k8s.io/client-go/listers/apps/v1"
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/client-go/tools/record"
 	"k8s.io/client-go/util/workqueue"
 	"k8s.io/klog/v2"

-	v1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
+	v1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
 	clientset "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned"
 	operatorscheme "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/scheme"
-	informers "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions/proxyprovider/v1"
-	listers "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/listers/proxyprovider/v1"
+	informers "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions/proxyprovider/v1alpha1"
+	listers "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/listers/proxyprovider/v1alpha1"
 	authentikapi "goauthentik.io/api/v3"
 )

@@ -58,15 +57,18 @@ const (
 	FieldManager          = controllerAgentName
 )

+// Finalizers
+const (
+	DeleteAuthentikProxyProviderFinalizer = "proxyprovider.t000-n.de/delete-authentik-proxyprovider"
+)
+
 type Controller struct {
 	kubeclientset          kubernetes.Interface
 	proxyProviderClientset clientset.Interface
 	authentik              *authentikapi.APIClient

-	deploymentsLister appslisters.DeploymentLister
-	deploymentsSynced cache.InformerSynced
-	proxyLister       listers.ProxyProviderLister
-	proxySynced       cache.InformerSynced
+	proxyLister listers.ProxyProviderLister
+	proxySynced cache.InformerSynced

 	workqueue workqueue.TypedRateLimitingInterface[cache.ObjectName]
 	recorder  record.EventRecorder
@@ -77,7 +79,6 @@ func NewController(
 	kubeclientset kubernetes.Interface,
 	proxyProviderClientset clientset.Interface,
 	authentik *authentikapi.APIClient,
-	deploymentInformer appsinformers.DeploymentInformer,
 	proxyInformer informers.ProxyProviderInformer,
 ) *Controller {
 	logger := klog.FromContext(ctx)
@@ -98,8 +99,6 @@ func NewController(
 		kubeclientset:          kubeclientset,
 		proxyProviderClientset: proxyProviderClientset,
 		authentik:              authentik,
-		deploymentsLister:      deploymentInformer.Lister(),
-		deploymentsSynced:      deploymentInformer.Informer().HasSynced,
 		proxyLister:            proxyInformer.Lister(),
 		proxySynced:            proxyInformer.Informer().HasSynced,
 		workqueue:              workqueue.NewTypedRateLimitingQueue(ratelimiter),
@@ -113,18 +112,6 @@ func NewController(
 			c.enqueueProxyProvider(newObj)
 		},
 	})
-	deploymentInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
-		AddFunc: c.handleObject,
-		UpdateFunc: func(old, new interface{}) {
-			newDepl := new.(*appsv1.Deployment)
-			oldDepl := old.(*appsv1.Deployment)
-			if newDepl.ResourceVersion == oldDepl.ResourceVersion {
-				return
-			}
-			c.handleObject(new)
-		},
-		DeleteFunc: c.handleObject,
-	})

 	return c
 }
@@ -137,7 +124,7 @@ func (c *Controller) Run(ctx context.Context, workers int) error {
 	logger.Info("Starting ProxyProvider controller")

 	logger.Info("Waiting for informer caches to sync")
-	if ok := cache.WaitForCacheSync(ctx.Done(), c.deploymentsSynced, c.proxySynced); !ok {
+	if ok := cache.WaitForCacheSync(ctx.Done(), c.proxySynced); !ok {
 		return fmt.Errorf("failed to wait for caches to sync")
 	}

@@ -189,54 +176,98 @@ func (c *Controller) syncHandler(ctx context.Context, objectRef cache.ObjectName
 	}
 	logger.V(4).Info("sync ProxyProvider", "name", pp.Name)

-	if pp.Status.PK != "" {
-		// We retrieve the existing PP from the API by slug.
-		pk, err := strconv.ParseInt(pp.Status.PK, 10, 32)
-		if err != nil {
-			return fmt.Errorf("error parsing PK: %v", err)
-		}
-		_, _, err = c.authentik.ProvidersApi.ProvidersAllRetrieve(ctx, int32(pk)).Execute()
-		if err != nil {
-			return fmt.Errorf("error retrieving existing ProxyProvider: %v", err)
-		}
+	if !pp.ObjectMeta.DeletionTimestamp.IsZero() {
+		logger.Info("Reconciling deletion of ProxyProvider", "name", pp.Name)
+		return c.reconcileDelete(ctx, pp)
+	}

-		// We update the existing PP with the new spec.
-		proxyProviderRequest := &authentikapi.ProxyProviderRequest{
-			Name:              pp.Spec.Name,
-			AuthorizationFlow: pp.Spec.AuthorizationFlow,
-			InvalidationFlow:  pp.Spec.InvalidationFlow,
-			ExternalHost:      pp.Spec.ExternalHost,
-			Mode:              authentikapi.PROXYMODE_FORWARD_SINGLE.Ptr(),
-		}
-		resp, r, err := c.authentik.ProvidersApi.ProvidersProxyUpdate(ctx, int32(pk)).ProxyProviderRequest(*proxyProviderRequest).Execute()
-		if err != nil {
-			return fmt.Errorf("error when calling `ProvidersAPI.ProvidersProxyUpdate`: %w with response %v", err, r)
-		}
-		pp.Status.PK = strconv.Itoa(int(resp.Pk))
-		err = c.updateProxyProviderStatus(ctx, pp)
-		if err != nil {
-			return fmt.Errorf("error updating ProxyProvider status: %v", err)
-		}
-	} else {
-		proxyProviderRequest := &authentikapi.ProxyProviderRequest{
-			Name:              pp.Spec.Name,
-			AuthorizationFlow: pp.Spec.AuthorizationFlow,
-			InvalidationFlow:  pp.Spec.InvalidationFlow,
-			ExternalHost:      pp.Spec.ExternalHost,
-			Mode:              authentikapi.PROXYMODE_FORWARD_SINGLE.Ptr(),
-		}
-		resp, r, err := c.authentik.ProvidersApi.ProvidersProxyCreate(ctx).ProxyProviderRequest(*proxyProviderRequest).Execute()
-		if err != nil {
-			return fmt.Errorf("error when calling `ProvidersAPI.ProvidersProxyCreate`: %w with response %v", err, r)
-		}
-		pp.Status.PK = strconv.Itoa(int(resp.Pk))
-		err = c.updateProxyProviderStatus(ctx, pp)
-		if err != nil {
-			return fmt.Errorf("error updating ProxyProvider status: %v", err)
+	if pp.Status.PK == "" {
+		logger.Info("Reconciling creation of ProxyProvider", "name", pp.Name)
+		return c.reconcileCreate(ctx, pp)
+	}
+
+	// Check if all finalizers are present. If not, we add them. Same pattern as above, just needs a helper function to check for presence of a finalizer.
+	if !slices.Contains(pp.ObjectMeta.Finalizers, DeleteAuthentikProxyProviderFinalizer) {
+		logger.Info("Ensuring finalizers are present", "name", pp.Name)
+		return c.ensureFinalizers(ctx, pp)
+	}
+
+	logger.Info("Reconciling update of ProxyProvider", "name", pp.Name)
+	return c.reconcileUpdate(ctx, pp)
+}
+
+func (c *Controller) ensureFinalizers(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
+	pp.ObjectMeta.Finalizers = append(pp.ObjectMeta.Finalizers, DeleteAuthentikProxyProviderFinalizer)
+	return c.updateProxyProvider(ctx, pp)
+}
+
+func (c *Controller) reconcileDelete(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
+	pk, err := strconv.ParseInt(pp.Status.PK, 10, 32)
+	if err != nil {
+		return fmt.Errorf("error parsing PK: %v", err)
+	}
+
+	r, err := c.authentik.ProvidersApi.ProvidersProxyDestroy(ctx, int32(pk)).Execute()
+	if err != nil {
+		// This handles an edge-case, where when the ProxyProvider on Authentik has already been deleted, but the finalizer is still present. We just remove the finalizer and return.
+		if r != nil && r.StatusCode != http.StatusNotFound {
+			return fmt.Errorf("error when calling `ProvidersAPI.ProvidersProxyDestroy`: %w with response %v", err, r)
 		}
 	}

-	return nil
+	pp.ObjectMeta.Finalizers = slices.Delete(pp.ObjectMeta.Finalizers, slices.Index(pp.ObjectMeta.Finalizers, DeleteAuthentikProxyProviderFinalizer), 1)
+	return c.updateProxyProvider(ctx, pp)
+}
+
+func (c *Controller) reconcileUpdate(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
+	// We retrieve the existing PP from the API by slug.
+	pk, err := strconv.ParseInt(pp.Status.PK, 10, 32)
+	if err != nil {
+		return fmt.Errorf("error parsing PK: %v", err)
+	}
+	_, r, err := c.authentik.ProvidersApi.ProvidersAllRetrieve(ctx, int32(pk)).Execute()
+	if err != nil {
+		if r != nil && r.StatusCode == http.StatusNotFound {
+			// This handles an edge-case, where when the PorxyProvider on Authentik has been deleted, e.g. by mistake. We just remove the PK and return.
+			// During the next reconciliation, the ProxyProvider will be re-created.
+			pp.Status.PK = ""
+			return c.updateProxyProviderStatus(ctx, pp)
+		}
+		return fmt.Errorf("error retrieving existing ProxyProvider: %v with response %v", err, r)
+	}
+
+	proxyProviderRequest := &authentikapi.PatchedProxyProviderRequest{
+		Name:              &pp.Spec.Name,
+		AuthorizationFlow: &pp.Spec.AuthorizationFlow,
+		InvalidationFlow:  &pp.Spec.InvalidationFlow,
+		ExternalHost:      &pp.Spec.ExternalHost,
+		Mode:              authentikapi.PROXYMODE_FORWARD_SINGLE.Ptr(),
+	}
+	resp, r, err := c.authentik.ProvidersApi.ProvidersProxyPartialUpdate(ctx, int32(pk)).PatchedProxyProviderRequest(*proxyProviderRequest).Execute()
+	if err != nil {
+		return fmt.Errorf("error when calling `ProvidersAPI.ProvidersProxyPartialUpdate`: %w with response %v", err, r)
+	}
+
+	pp.Status.PK = strconv.Itoa(int(resp.Pk))
+
+	return c.updateProxyProviderStatus(ctx, pp)
+}
+
+func (c *Controller) reconcileCreate(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
+	proxyProviderRequest := &authentikapi.ProxyProviderRequest{
+		Name:              pp.Spec.Name,
+		AuthorizationFlow: pp.Spec.AuthorizationFlow,
+		InvalidationFlow:  pp.Spec.InvalidationFlow,
+		ExternalHost:      pp.Spec.ExternalHost,
+		Mode:              authentikapi.PROXYMODE_FORWARD_SINGLE.Ptr(),
+	}
+	resp, r, err := c.authentik.ProvidersApi.ProvidersProxyCreate(ctx).ProxyProviderRequest(*proxyProviderRequest).Execute()
+	if err != nil {
+		return fmt.Errorf("error when calling `ProvidersAPI.ProvidersProxyCreate`: %w with response %v", err, r)
+	}
+
+	pp.Status.PK = strconv.Itoa(int(resp.Pk))
+	return c.updateProxyProviderStatus(ctx, pp)
 }

 func (c *Controller) enqueueProxyProvider(obj interface{}) {
@@ -248,26 +279,18 @@ func (c *Controller) enqueueProxyProvider(obj interface{}) {
 	c.workqueue.Add(objectRef)
 }

-func (c *Controller) handleObject(obj interface{}) {
-	// Optional: resolve Deployment owners back to ProxyProvider and enqueue.
-	_, ok := obj.(metav1.Object)
-	if !ok {
-		tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
-		if !ok {
-			utilruntime.HandleError(fmt.Errorf("couldn't get object from tombstone %#v", obj))
-			return
-		}
-		_, ok = tombstone.Obj.(metav1.Object)
-		if !ok {
-			utilruntime.HandleError(fmt.Errorf("tombstone contained object that is not a metav1.Object %#v", obj))
-			return
-		}
-	}
-}
-
-func (c *Controller) updateProxyProviderStatus(ctx context.Context, pp *v1.ProxyProvider) error {
+func (c *Controller) updateProxyProviderStatus(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
 	ppCopy := pp.DeepCopy()
-	ppCopy.Status.PK = pp.Status.PK
-	_, err := c.proxyProviderClientset.ProxyproviderV1().ProxyProviders(pp.Namespace).UpdateStatus(ctx, ppCopy, metav1.UpdateOptions{FieldManager: FieldManager})
+	_, err := c.proxyProviderClientset.ProxyproviderV1alpha1().ProxyProviders(ppCopy.Namespace).UpdateStatus(ctx, ppCopy, metav1.UpdateOptions{FieldManager: FieldManager})
 	return err
 }
+
+// Update metadata, spec, etc. of the ProxyProvider object.
+func (c *Controller) updateProxyProvider(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
+	ppCopy := pp.DeepCopy()
+	_, err := c.proxyProviderClientset.ProxyproviderV1alpha1().ProxyProviders(ppCopy.Namespace).Update(ctx, ppCopy, metav1.UpdateOptions{FieldManager: FieldManager})
+	if err != nil {
+		return fmt.Errorf("error updating ProxyProvider metadata: %v", err)
+	}
+	return nil
+}
@@ -0,0 +1,385 @@
+// AI generated tests and not yet reviewed.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"slices"
+	"strings"
+	"testing"
+
+	v1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
+	operatorfake "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/fake"
+	operatorinformers "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions"
+	authentikapi "goauthentik.io/api/v3"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes/fake"
+	"k8s.io/client-go/tools/cache"
+)
+
+func TestController_syncHandler_create(t *testing.T) {
+	const wantPK = 42
+
+	server := newAuthentikTestServer(t, authentikTestHandlers{
+		proxyCreate: func(w http.ResponseWriter, _ *http.Request) {
+			writeJSON(t, w, http.StatusCreated, map[string]any{"pk": wantPK})
+		},
+	})
+	t.Cleanup(server.Close)
+
+	ctrl, ctx, cancel := newTestController(t, testProxyProvider(), server.URL)
+	t.Cleanup(cancel)
+
+	err := ctrl.syncHandler(ctx, cache.ObjectName{Namespace: "default", Name: "test-pp"})
+	if err != nil {
+		t.Fatalf("syncHandler() error = %v", err)
+	}
+
+	got := getProxyProvider(t, ctrl, "default", "test-pp")
+	if got.Status.PK != "42" {
+		t.Fatalf("status.pk = %q, want 42", got.Status.PK)
+	}
+}
+
+func TestController_syncHandler_ensureFinalizers(t *testing.T) {
+	pp := testProxyProvider()
+	pp.Status.PK = "42"
+
+	server := newAuthentikTestServer(t, authentikTestHandlers{})
+	t.Cleanup(server.Close)
+
+	ctrl, ctx, cancel := newTestController(t, pp, server.URL)
+	t.Cleanup(cancel)
+
+	err := ctrl.syncHandler(ctx, cache.ObjectName{Namespace: pp.Namespace, Name: pp.Name})
+	if err != nil {
+		t.Fatalf("syncHandler() error = %v", err)
+	}
+
+	got := getProxyProvider(t, ctrl, pp.Namespace, pp.Name)
+	if !slices.Contains(got.Finalizers, DeleteAuthentikProxyProviderFinalizer) {
+		t.Fatalf("finalizers = %v, want %q", got.Finalizers, DeleteAuthentikProxyProviderFinalizer)
+	}
+}
+
+func TestController_syncHandler_update(t *testing.T) {
+	pp := testProxyProvider()
+	pp.Status.PK = "42"
+	pp.Finalizers = []string{DeleteAuthentikProxyProviderFinalizer}
+
+	server := newAuthentikTestServer(t, authentikTestHandlers{
+		allRetrieve: func(w http.ResponseWriter, _ *http.Request) {
+			writeJSON(t, w, http.StatusOK, map[string]any{"pk": 42})
+		},
+		proxyPartialUpdate: func(w http.ResponseWriter, _ *http.Request) {
+			writeJSON(t, w, http.StatusOK, map[string]any{"pk": 42})
+		},
+	})
+	t.Cleanup(server.Close)
+
+	ctrl, ctx, cancel := newTestController(t, pp, server.URL)
+	t.Cleanup(cancel)
+
+	err := ctrl.syncHandler(ctx, cache.ObjectName{Namespace: pp.Namespace, Name: pp.Name})
+	if err != nil {
+		t.Fatalf("syncHandler() error = %v", err)
+	}
+
+	got := getProxyProvider(t, ctrl, pp.Namespace, pp.Name)
+	if got.Status.PK != "42" {
+		t.Fatalf("status.pk = %q, want 42", got.Status.PK)
+	}
+}
+
+func TestController_syncHandler_update_providerNotFound(t *testing.T) {
+	pp := testProxyProvider()
+	pp.Status.PK = "42"
+	pp.Finalizers = []string{DeleteAuthentikProxyProviderFinalizer}
+
+	server := newAuthentikTestServer(t, authentikTestHandlers{
+		allRetrieve: func(w http.ResponseWriter, _ *http.Request) {
+			http.NotFound(w, nil)
+		},
+	})
+	t.Cleanup(server.Close)
+
+	ctrl, ctx, cancel := newTestController(t, pp, server.URL)
+	t.Cleanup(cancel)
+
+	err := ctrl.syncHandler(ctx, cache.ObjectName{Namespace: pp.Namespace, Name: pp.Name})
+	if err != nil {
+		t.Fatalf("syncHandler() error = %v", err)
+	}
+
+	got := getProxyProvider(t, ctrl, pp.Namespace, pp.Name)
+	if got.Status.PK != "" {
+		t.Fatalf("status.pk = %q, want empty after provider not found", got.Status.PK)
+	}
+}
+
+func TestController_syncHandler_delete(t *testing.T) {
+	now := metav1.Now()
+	pp := testProxyProvider()
+	pp.Status.PK = "42"
+	pp.DeletionTimestamp = &now
+	pp.Finalizers = []string{DeleteAuthentikProxyProviderFinalizer}
+
+	var destroyCalled bool
+	server := newAuthentikTestServer(t, authentikTestHandlers{
+		proxyDestroy: func(w http.ResponseWriter, r *http.Request) {
+			destroyCalled = true
+			if r.Method != http.MethodDelete {
+				t.Errorf("destroy method = %s, want DELETE", r.Method)
+			}
+			w.WriteHeader(http.StatusNoContent)
+		},
+	})
+	t.Cleanup(server.Close)
+
+	ctrl, ctx, cancel := newTestController(t, pp, server.URL)
+	t.Cleanup(cancel)
+
+	err := ctrl.syncHandler(ctx, cache.ObjectName{Namespace: pp.Namespace, Name: pp.Name})
+	if err != nil {
+		t.Fatalf("syncHandler() error = %v", err)
+	}
+	if !destroyCalled {
+		t.Fatal("expected Authentik destroy call")
+	}
+
+	got := getProxyProvider(t, ctrl, pp.Namespace, pp.Name)
+	if slices.Contains(got.Finalizers, DeleteAuthentikProxyProviderFinalizer) {
+		t.Fatalf("finalizers = %v, want finalizer removed", got.Finalizers)
+	}
+}
+
+func TestController_syncHandler_delete_providerAlreadyGone(t *testing.T) {
+	now := metav1.Now()
+	pp := testProxyProvider()
+	pp.Status.PK = "42"
+	pp.DeletionTimestamp = &now
+	pp.Finalizers = []string{DeleteAuthentikProxyProviderFinalizer}
+
+	server := newAuthentikTestServer(t, authentikTestHandlers{
+		proxyDestroy: func(w http.ResponseWriter, _ *http.Request) {
+			http.NotFound(w, nil)
+		},
+	})
+	t.Cleanup(server.Close)
+
+	ctrl, ctx, cancel := newTestController(t, pp, server.URL)
+	t.Cleanup(cancel)
+
+	err := ctrl.syncHandler(ctx, cache.ObjectName{Namespace: pp.Namespace, Name: pp.Name})
+	if err != nil {
+		t.Fatalf("syncHandler() error = %v", err)
+	}
+
+	got := getProxyProvider(t, ctrl, pp.Namespace, pp.Name)
+	if slices.Contains(got.Finalizers, DeleteAuthentikProxyProviderFinalizer) {
+		t.Fatalf("finalizers = %v, want finalizer removed after 404", got.Finalizers)
+	}
+}
+
+func TestController_syncHandler_notFound(t *testing.T) {
+	server := newAuthentikTestServer(t, authentikTestHandlers{})
+	t.Cleanup(server.Close)
+
+	ctrl, ctx, cancel := newTestController(t, nil, server.URL)
+	t.Cleanup(cancel)
+
+	err := ctrl.syncHandler(ctx, cache.ObjectName{Namespace: "default", Name: "missing"})
+	if err != nil {
+		t.Fatalf("syncHandler() error = %v, want nil for missing object", err)
+	}
+}
+
+func TestController_syncHandler_invalidPK(t *testing.T) {
+	pp := testProxyProvider()
+	pp.Status.PK = "not-a-number"
+	pp.Finalizers = []string{DeleteAuthentikProxyProviderFinalizer}
+
+	server := newAuthentikTestServer(t, authentikTestHandlers{})
+	t.Cleanup(server.Close)
+
+	ctrl, ctx, cancel := newTestController(t, pp, server.URL)
+	t.Cleanup(cancel)
+
+	err := ctrl.syncHandler(ctx, cache.ObjectName{Namespace: pp.Namespace, Name: pp.Name})
+	if err == nil {
+		t.Fatal("syncHandler() error = nil, want parse error")
+	}
+	if !strings.Contains(err.Error(), "error parsing PK") {
+		t.Fatalf("syncHandler() error = %v, want PK parse error", err)
+	}
+}
+
+func TestController_enqueueProxyProvider(t *testing.T) {
+	server := newAuthentikTestServer(t, authentikTestHandlers{})
+	t.Cleanup(server.Close)
+
+	ctrl, _, cancel := newTestController(t, testProxyProvider(), server.URL)
+	t.Cleanup(cancel)
+
+	ctrl.enqueueProxyProvider(testProxyProvider())
+
+	if ctrl.workqueue.Len() != 1 {
+		t.Fatalf("workqueue length = %d, want 1", ctrl.workqueue.Len())
+	}
+}
+
+// --- test helpers ---
+
+func testProxyProvider() *v1alpha1.ProxyProvider {
+	return &v1alpha1.ProxyProvider{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: v1alpha1.SchemeGroupVersion.String(),
+			Kind:       "ProxyProvider",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-pp",
+			Namespace: "default",
+		},
+		Spec: v1alpha1.ProxyProviderSpec{
+			Name:              "my-app",
+			AuthorizationFlow: "flow-auth",
+			InvalidationFlow:  "flow-invalidate",
+			ExternalHost:      "https://app.example.com",
+		},
+	}
+}
+
+func newTestController(t *testing.T, pp *v1alpha1.ProxyProvider, authentikURL string) (*Controller, context.Context, context.CancelFunc) {
+	t.Helper()
+	ctx, cancel := context.WithCancel(context.Background())
+	ctrl, _, stop := newTestControllerWithContext(t, ctx, pp, authentikURL)
+	return ctrl, ctx, func() {
+		cancel()
+		stop()
+	}
+}
+
+func newTestControllerWithContext(t *testing.T, ctx context.Context, pp *v1alpha1.ProxyProvider, authentikURL string) (*Controller, context.Context, func()) {
+	t.Helper()
+
+	authentikClient := newAuthentikAPIClientForTest(t, authentikURL)
+
+	var objects []runtime.Object
+	if pp != nil {
+		objects = append(objects, pp)
+	}
+	proxyClient := operatorfake.NewSimpleClientset(objects...)
+
+	informerFactory := operatorinformers.NewSharedInformerFactory(proxyClient, 0)
+	proxyInformer := informerFactory.Proxyprovider().V1alpha1().ProxyProviders()
+
+	ctrl := NewController(ctx, fake.NewClientset(), proxyClient, authentikClient, proxyInformer)
+
+	informerFactory.Start(ctx.Done())
+	for informerType, synced := range informerFactory.WaitForCacheSync(ctx.Done()) {
+		if !synced {
+			t.Fatalf("informer %v failed to sync", informerType)
+		}
+	}
+
+	return ctrl, ctx, func() {}
+}
+
+func newAuthentikAPIClientForTest(t *testing.T, serverURL string) *authentikapi.APIClient {
+	t.Helper()
+
+	u, err := url.Parse(serverURL)
+	if err != nil {
+		t.Fatalf("parse server URL: %v", err)
+	}
+
+	cfg := authentikapi.NewConfiguration()
+	cfg.Scheme = u.Scheme
+	cfg.Host = u.Host
+
+	return authentikapi.NewAPIClient(cfg)
+}
+
+type authentikTestHandlers struct {
+	proxyCreate        http.HandlerFunc
+	proxyDestroy       http.HandlerFunc
+	proxyPartialUpdate http.HandlerFunc
+	allRetrieve        http.HandlerFunc
+}
+
+func newAuthentikTestServer(t *testing.T, handlers authentikTestHandlers) *httptest.Server {
+	t.Helper()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path := r.URL.Path
+
+		switch {
+		case path == "/api/v3/providers/proxy/" && r.Method == http.MethodPost:
+			if handlers.proxyCreate != nil {
+				handlers.proxyCreate(w, r)
+				return
+			}
+			http.NotFound(w, r)
+
+		case strings.HasPrefix(path, "/api/v3/providers/proxy/") && strings.HasSuffix(path, "/"):
+			idPath := strings.TrimPrefix(path, "/api/v3/providers/proxy/")
+			if idPath == "" {
+				http.NotFound(w, r)
+				return
+			}
+			switch r.Method {
+			case http.MethodDelete:
+				if handlers.proxyDestroy != nil {
+					handlers.proxyDestroy(w, r)
+					return
+				}
+				http.NotFound(w, r)
+			case http.MethodPatch:
+				if handlers.proxyPartialUpdate != nil {
+					handlers.proxyPartialUpdate(w, r)
+					return
+				}
+				http.NotFound(w, r)
+			default:
+				http.Error(w, "unexpected method on proxy instance", http.StatusMethodNotAllowed)
+			}
+
+		case strings.HasPrefix(path, "/api/v3/providers/all/") && strings.HasSuffix(path, "/"):
+			if r.Method == http.MethodGet && handlers.allRetrieve != nil {
+				handlers.allRetrieve(w, r)
+				return
+			}
+			http.NotFound(w, r)
+
+		default:
+			http.NotFound(w, r)
+		}
+	})
+
+	return httptest.NewServer(handler)
+}
+
+func writeJSON(t *testing.T, w http.ResponseWriter, status int, body any) {
+	t.Helper()
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(body); err != nil {
+		t.Fatalf("write JSON response: %v", err)
+	}
+}
+
+func getProxyProvider(t *testing.T, ctrl *Controller, namespace, name string) *v1alpha1.ProxyProvider {
+	t.Helper()
+
+	got, err := ctrl.proxyProviderClientset.ProxyproviderV1alpha1().ProxyProviders(namespace).Get(
+		context.Background(), name, metav1.GetOptions{},
+	)
+	if err != nil {
+		t.Fatalf("get ProxyProvider: %v", err)
+	}
+	return got
+}
@@ -7,9 +7,9 @@ godebug default=go1.26
 require (
 	goauthentik.io/api/v3 v3.2026020.16
 	golang.org/x/time v0.15.0
-	k8s.io/api v0.0.0-20260509204538-0dfb117cc6ec
-	k8s.io/apimachinery v0.0.0-20260513183604-f9371b815e42
-	k8s.io/client-go v0.0.0-20260509205101-ca52b81a2940
+	k8s.io/api v0.36.0
+	k8s.io/apimachinery v0.36.0
+	k8s.io/client-go v0.36.0
 	k8s.io/klog/v2 v2.140.0
 	k8s.io/kube-openapi v0.0.0-20260511211612-da4e56fe5676
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.0
@@ -36,6 +36,7 @@ require (
 	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/jandelgado/gcov2lcov v1.1.1 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
@@ -60,3 +61,5 @@ require (
 )

 replace k8s.io/code-generator => ./code-generator
+
+tool github.com/jandelgado/gcov2lcov
@@ -49,6 +49,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/jandelgado/gcov2lcov v1.1.1 h1:CHUNoAglvb34DqmMoZchnzDbA3yjpzT8EoUvVqcAY+s=
+github.com/jandelgado/gcov2lcov v1.1.1/go.mod h1:tMVUlMVtS1po2SB8UkADWhOT5Y5Q13XOce2AYU69JuI=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -71,9 +73,16 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -107,14 +116,21 @@ gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnf
 gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 k8s.io/api v0.0.0-20260509204538-0dfb117cc6ec h1:xf12Yh3ltN4fnNyP0CyyM0TwNVnZDfLJjV3+bf9fPFY=
 k8s.io/api v0.0.0-20260509204538-0dfb117cc6ec/go.mod h1:C+fcNlNQ9TcKHspN+DD7UybdfnjDAGyBjfCd6W7ogbY=
+k8s.io/api v0.36.0 h1:SgqDhZzHdOtMk40xVSvCXkP9ME0H05hPM3p9AB1kL80=
+k8s.io/api v0.36.0/go.mod h1:m1LVrGPNYax5NBHdO+QuAedXyuzTt4RryI/qnmNvs34=
 k8s.io/apimachinery v0.0.0-20260513183604-f9371b815e42 h1:rWdGOTor3z0WSyZcRl9ms4dn9Cw9CqmNBqXuf2z0k1k=
 k8s.io/apimachinery v0.0.0-20260513183604-f9371b815e42/go.mod h1:hiubQ6UTHIdr0bS8ExXOJEywFVOoudnldm/l/NiNVlA=
+k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
+k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
 k8s.io/client-go v0.0.0-20260509205101-ca52b81a2940 h1:n5t5Jx3VpLdiAGxIvIHsZDmsExtZVwghUPLM3wFi6Go=
 k8s.io/client-go v0.0.0-20260509205101-ca52b81a2940/go.mod h1:0e7OLwg7kdXISVFwn7ishFdvxfVgi7wsqHqsQPHl61w=
+k8s.io/client-go v0.36.0 h1:pOYi7C4RHChYjMiHpZSpSbIM6ZxVbRXBy7CuiIwqA3c=
+k8s.io/client-go v0.36.0/go.mod h1:ZKKcpwF0aLYfkHFCjillCKaTK/yBkEDHTDXCFY6AS9Y=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
 k8s.io/kube-openapi v0.0.0-20260511211612-da4e56fe5676 h1:ahjrVu/DBcaAhw/GcblfaOvvQ2wi8kqXWvn62nud3UU=
@@ -1,6 +1,6 @@
-API rule violation: names_match,gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1,ProxyProviderSpec,AuthorizationFlow
-API rule violation: names_match,gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1,ProxyProviderSpec,ExternalHost
-API rule violation: names_match,gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1,ProxyProviderSpec,InvalidationFlow
+API rule violation: names_match,gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1,ProxyProviderSpec,AuthorizationFlow
+API rule violation: names_match,gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1,ProxyProviderSpec,ExternalHost
+API rule violation: names_match,gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1,ProxyProviderSpec,InvalidationFlow
 API rule violation: names_match,k8s.io/apimachinery/pkg/api/resource,Quantity,Format
 API rule violation: names_match,k8s.io/apimachinery/pkg/api/resource,Quantity,d
 API rule violation: names_match,k8s.io/apimachinery/pkg/api/resource,Quantity,i
@@ -25,7 +25,6 @@ import (

 	"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/signals"
 	authentikapi "goauthentik.io/api/v3"
-	kubeinformers "k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/klog/v2"
@@ -74,16 +73,14 @@ func main() {
 		klog.FlushAndExit(klog.ExitFlushTimeout, 1)
 	}

-	kubeInformerFactory := kubeinformers.NewSharedInformerFactory(kubeClient, time.Second*30)
 	proxyProviderInformerFactory := informers.NewSharedInformerFactory(proxyProviderClient, time.Second*30)

 	controller := NewController(ctx, kubeClient, proxyProviderClient, authentikClient,
-		kubeInformerFactory.Apps().V1().Deployments(),
-		proxyProviderInformerFactory.Proxyprovider().V1().ProxyProviders())
+		proxyProviderInformerFactory.Proxyprovider().V1alpha1().ProxyProviders(),
+	)

 	// notice that there is no need to run Start methods in a separate goroutine. (i.e. go kubeInformerFactory.Start(ctx.done())
 	// Start method is non-blocking and runs all registered informers in a dedicated goroutine.
-	kubeInformerFactory.Start(ctx.Done())
 	proxyProviderInformerFactory.Start(ctx.Done())

 	if err = controller.Run(ctx, 2); err != nil {
@@ -19,4 +19,4 @@ limitations under the License.
 // +groupName=proxyprovider.t000-n.de

 // Package v1 is the v1 version of the API.
-package v1
+package v1alpha1
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-package v1
+package v1alpha1

 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -19,7 +19,7 @@ limitations under the License.

 // Code generated by deepcopy-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
@@ -19,10 +19,10 @@ limitations under the License.

 // Code generated by register-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 )
@@ -31,12 +31,12 @@ import (
 const GroupName = "proxyprovider.t000-n.de"

 // GroupVersion specifies the group and the version used to register the objects.
-var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+var GroupVersion = v1.GroupVersion{Group: GroupName, Version: "v1alpha1"}

 // SchemeGroupVersion is group version used to register these objects
 //
 // Deprecated: use GroupVersion instead.
-var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}

 // Resource takes an unqualified resource and returns a Group qualified GroupResource
 func Resource(resource string) schema.GroupResource {
@@ -66,6 +66,6 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&ProxyProviderList{},
 	)
 	// AddToGroupVersion allows the serialization of client types like ListOptions.
-	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	v1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil
 }
@@ -16,21 +16,21 @@ limitations under the License.

 // Code generated by applyconfiguration-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 import (
-	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
-	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
 )

 // ProxyProviderApplyConfiguration represents a declarative configuration of the ProxyProvider type for use
 // with apply.
 type ProxyProviderApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration    `json:""`
-	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	Spec                                 *ProxyProviderSpecApplyConfiguration   `json:"spec,omitempty"`
-	Status                               *ProxyProviderStatusApplyConfiguration `json:"status,omitempty"`
+	v1.TypeMetaApplyConfiguration    `json:""`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *ProxyProviderSpecApplyConfiguration   `json:"spec,omitempty"`
+	Status                           *ProxyProviderStatusApplyConfiguration `json:"status,omitempty"`
 }

 // ProxyProvider constructs a declarative configuration of the ProxyProvider type for use with
@@ -40,7 +40,7 @@ func ProxyProvider(name, namespace string) *ProxyProviderApplyConfiguration {
 	b.WithName(name)
 	b.WithNamespace(namespace)
 	b.WithKind("ProxyProvider")
-	b.WithAPIVersion("proxyprovider.t000-n.de/v1")
+	b.WithAPIVersion("proxyprovider.t000-n.de/v1alpha1")
 	return b
 }

@@ -119,7 +119,7 @@ func (b *ProxyProviderApplyConfiguration) WithGeneration(value int64) *ProxyProv
 // WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the CreationTimestamp field is set to the value of the last call.
-func (b *ProxyProviderApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ProxyProviderApplyConfiguration {
+func (b *ProxyProviderApplyConfiguration) WithCreationTimestamp(value metav1.Time) *ProxyProviderApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
 	return b
@@ -128,7 +128,7 @@ func (b *ProxyProviderApplyConfiguration) WithCreationTimestamp(value apismetav1
 // WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the DeletionTimestamp field is set to the value of the last call.
-func (b *ProxyProviderApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ProxyProviderApplyConfiguration {
+func (b *ProxyProviderApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *ProxyProviderApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
 	return b
@@ -176,7 +176,7 @@ func (b *ProxyProviderApplyConfiguration) WithAnnotations(entries map[string]str
 // WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the OwnerReferences field.
-func (b *ProxyProviderApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ProxyProviderApplyConfiguration {
+func (b *ProxyProviderApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *ProxyProviderApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	for i := range values {
 		if values[i] == nil {
@@ -200,7 +200,7 @@ func (b *ProxyProviderApplyConfiguration) WithFinalizers(values ...string) *Prox

 func (b *ProxyProviderApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
 	if b.ObjectMetaApplyConfiguration == nil {
-		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
 	}
 }

@@ -16,7 +16,7 @@ limitations under the License.

 // Code generated by applyconfiguration-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 // ProxyProviderSpecApplyConfiguration represents a declarative configuration of the ProxyProviderSpec type for use
 // with apply.
@@ -16,7 +16,7 @@ limitations under the License.

 // Code generated by applyconfiguration-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 // ProxyProviderStatusApplyConfiguration represents a declarative configuration of the ProxyProviderStatus type for use
 // with apply.
@@ -19,9 +19,9 @@ limitations under the License.
 package applyconfiguration

 import (
-	v1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
+	v1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
 	internal "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/applyconfiguration/internal"
-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/applyconfiguration/proxyprovider/v1"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/applyconfiguration/proxyprovider/v1alpha1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
@@ -31,13 +31,13 @@ import (
 // apply configuration type exists for the given GroupVersionKind.
 func ForKind(kind schema.GroupVersionKind) interface{} {
 	switch kind {
-	// Group=proxyprovider.t000-n.de, Version=v1
-	case v1.SchemeGroupVersion.WithKind("ProxyProvider"):
-		return &proxyproviderv1.ProxyProviderApplyConfiguration{}
-	case v1.SchemeGroupVersion.WithKind("ProxyProviderSpec"):
-		return &proxyproviderv1.ProxyProviderSpecApplyConfiguration{}
-	case v1.SchemeGroupVersion.WithKind("ProxyProviderStatus"):
-		return &proxyproviderv1.ProxyProviderStatusApplyConfiguration{}
+	// Group=proxyprovider.t000-n.de, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithKind("ProxyProvider"):
+		return &proxyproviderv1alpha1.ProxyProviderApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ProxyProviderSpec"):
+		return &proxyproviderv1alpha1.ProxyProviderSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ProxyProviderStatus"):
+		return &proxyproviderv1alpha1.ProxyProviderStatusApplyConfiguration{}

 	}
 	return nil
@@ -22,7 +22,7 @@ import (
 	fmt "fmt"
 	http "net/http"

-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1alpha1"
 	discovery "k8s.io/client-go/discovery"
 	rest "k8s.io/client-go/rest"
 	flowcontrol "k8s.io/client-go/util/flowcontrol"
@@ -30,18 +30,18 @@ import (

 type Interface interface {
 	Discovery() discovery.DiscoveryInterface
-	ProxyproviderV1() proxyproviderv1.ProxyproviderV1Interface
+	ProxyproviderV1alpha1() proxyproviderv1alpha1.ProxyproviderV1alpha1Interface
 }

 // Clientset contains the clients for groups.
 type Clientset struct {
 	*discovery.DiscoveryClient
-	proxyproviderV1 *proxyproviderv1.ProxyproviderV1Client
+	proxyproviderV1alpha1 *proxyproviderv1alpha1.ProxyproviderV1alpha1Client
 }

-// ProxyproviderV1 retrieves the ProxyproviderV1Client
-func (c *Clientset) ProxyproviderV1() proxyproviderv1.ProxyproviderV1Interface {
-	return c.proxyproviderV1
+// ProxyproviderV1alpha1 retrieves the ProxyproviderV1alpha1Client
+func (c *Clientset) ProxyproviderV1alpha1() proxyproviderv1alpha1.ProxyproviderV1alpha1Interface {
+	return c.proxyproviderV1alpha1
 }

 // Discovery retrieves the DiscoveryClient
@@ -88,7 +88,7 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset,

 	var cs Clientset
 	var err error
-	cs.proxyproviderV1, err = proxyproviderv1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	cs.proxyproviderV1alpha1, err = proxyproviderv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -113,7 +113,7 @@ func NewForConfigOrDie(c *rest.Config) *Clientset {
 // New creates a new Clientset for the given RESTClient.
 func New(c rest.Interface) *Clientset {
 	var cs Clientset
-	cs.proxyproviderV1 = proxyproviderv1.New(c)
+	cs.proxyproviderV1alpha1 = proxyproviderv1alpha1.New(c)

 	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
 	return &cs
@@ -21,8 +21,8 @@ package fake
 import (
 	applyconfiguration "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/applyconfiguration"
 	clientset "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned"
-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1"
-	fakeproxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1/fake"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1alpha1"
+	fakeproxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1alpha1/fake"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/watch"
@@ -136,7 +136,7 @@ var (
 	_ testing.FakeClient  = &Clientset{}
 )

-// ProxyproviderV1 retrieves the ProxyproviderV1Client
-func (c *Clientset) ProxyproviderV1() proxyproviderv1.ProxyproviderV1Interface {
-	return &fakeproxyproviderv1.FakeProxyproviderV1{Fake: &c.Fake}
+// ProxyproviderV1alpha1 retrieves the ProxyproviderV1alpha1Client
+func (c *Clientset) ProxyproviderV1alpha1() proxyproviderv1alpha1.ProxyproviderV1alpha1Interface {
+	return &fakeproxyproviderv1alpha1.FakeProxyproviderV1alpha1{Fake: &c.Fake}
 }
@@ -19,7 +19,7 @@ limitations under the License.
 package fake

 import (
-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
@@ -31,7 +31,7 @@ var scheme = runtime.NewScheme()
 var codecs = serializer.NewCodecFactory(scheme)

 var localSchemeBuilder = runtime.SchemeBuilder{
-	proxyproviderv1.AddToScheme,
+	proxyproviderv1alpha1.AddToScheme,
 }

 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
@@ -19,7 +19,7 @@ limitations under the License.
 package scheme

 import (
-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
@@ -31,7 +31,7 @@ var Scheme = runtime.NewScheme()
 var Codecs = serializer.NewCodecFactory(Scheme)
 var ParameterCodec = runtime.NewParameterCodec(Scheme)
 var localSchemeBuilder = runtime.SchemeBuilder{
-	proxyproviderv1.AddToScheme,
+	proxyproviderv1alpha1.AddToScheme,
 }

 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
@@ -1,51 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	v1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/applyconfiguration/proxyprovider/v1"
-	typedproxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1"
-	gentype "k8s.io/client-go/gentype"
-)
-
-// fakeProxyProviders implements ProxyProviderInterface
-type fakeProxyProviders struct {
-	*gentype.FakeClientWithListAndApply[*v1.ProxyProvider, *v1.ProxyProviderList, *proxyproviderv1.ProxyProviderApplyConfiguration]
-	Fake *FakeProxyproviderV1
-}
-
-func newFakeProxyProviders(fake *FakeProxyproviderV1, namespace string) typedproxyproviderv1.ProxyProviderInterface {
-	return &fakeProxyProviders{
-		gentype.NewFakeClientWithListAndApply[*v1.ProxyProvider, *v1.ProxyProviderList, *proxyproviderv1.ProxyProviderApplyConfiguration](
-			fake.Fake,
-			namespace,
-			v1.SchemeGroupVersion.WithResource("proxyproviders"),
-			v1.SchemeGroupVersion.WithKind("ProxyProvider"),
-			func() *v1.ProxyProvider { return &v1.ProxyProvider{} },
-			func() *v1.ProxyProviderList { return &v1.ProxyProviderList{} },
-			func(dst, src *v1.ProxyProviderList) { dst.ListMeta = src.ListMeta },
-			func(list *v1.ProxyProviderList) []*v1.ProxyProvider { return gentype.ToPointerSlice(list.Items) },
-			func(list *v1.ProxyProviderList, items []*v1.ProxyProvider) {
-				list.Items = gentype.FromPointerSlice(items)
-			},
-		),
-		fake,
-	}
-}
@@ -1,74 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1
-
-import (
-	context "context"
-
-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
-	applyconfigurationproxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/applyconfiguration/proxyprovider/v1"
-	scheme "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/scheme"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	gentype "k8s.io/client-go/gentype"
-)
-
-// ProxyProvidersGetter has a method to return a ProxyProviderInterface.
-// A group's client should implement this interface.
-type ProxyProvidersGetter interface {
-	ProxyProviders(namespace string) ProxyProviderInterface
-}
-
-// ProxyProviderInterface has methods to work with ProxyProvider resources.
-type ProxyProviderInterface interface {
-	Create(ctx context.Context, proxyProvider *proxyproviderv1.ProxyProvider, opts metav1.CreateOptions) (*proxyproviderv1.ProxyProvider, error)
-	Update(ctx context.Context, proxyProvider *proxyproviderv1.ProxyProvider, opts metav1.UpdateOptions) (*proxyproviderv1.ProxyProvider, error)
-	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-	UpdateStatus(ctx context.Context, proxyProvider *proxyproviderv1.ProxyProvider, opts metav1.UpdateOptions) (*proxyproviderv1.ProxyProvider, error)
-	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
-	Get(ctx context.Context, name string, opts metav1.GetOptions) (*proxyproviderv1.ProxyProvider, error)
-	List(ctx context.Context, opts metav1.ListOptions) (*proxyproviderv1.ProxyProviderList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *proxyproviderv1.ProxyProvider, err error)
-	Apply(ctx context.Context, proxyProvider *applyconfigurationproxyproviderv1.ProxyProviderApplyConfiguration, opts metav1.ApplyOptions) (result *proxyproviderv1.ProxyProvider, err error)
-	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
-	ApplyStatus(ctx context.Context, proxyProvider *applyconfigurationproxyproviderv1.ProxyProviderApplyConfiguration, opts metav1.ApplyOptions) (result *proxyproviderv1.ProxyProvider, err error)
-	ProxyProviderExpansion
-}
-
-// proxyProviders implements ProxyProviderInterface
-type proxyProviders struct {
-	*gentype.ClientWithListAndApply[*proxyproviderv1.ProxyProvider, *proxyproviderv1.ProxyProviderList, *applyconfigurationproxyproviderv1.ProxyProviderApplyConfiguration]
-}
-
-// newProxyProviders returns a ProxyProviders
-func newProxyProviders(c *ProxyproviderV1Client, namespace string) *proxyProviders {
-	return &proxyProviders{
-		gentype.NewClientWithListAndApply[*proxyproviderv1.ProxyProvider, *proxyproviderv1.ProxyProviderList, *applyconfigurationproxyproviderv1.ProxyProviderApplyConfiguration](
-			"proxyproviders",
-			c.RESTClient(),
-			scheme.ParameterCodec,
-			namespace,
-			func() *proxyproviderv1.ProxyProvider { return &proxyproviderv1.ProxyProvider{} },
-			func() *proxyproviderv1.ProxyProviderList { return &proxyproviderv1.ProxyProviderList{} },
-		),
-	}
-}
@@ -17,4 +17,4 @@ limitations under the License.
 // Code generated by client-gen. DO NOT EDIT.

 // This package has the automatically generated typed clients.
-package v1
+package v1alpha1
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/applyconfiguration/proxyprovider/v1alpha1"
+	typedproxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1alpha1"
+	gentype "k8s.io/client-go/gentype"
+)
+
+// fakeProxyProviders implements ProxyProviderInterface
+type fakeProxyProviders struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.ProxyProvider, *v1alpha1.ProxyProviderList, *proxyproviderv1alpha1.ProxyProviderApplyConfiguration]
+	Fake *FakeProxyproviderV1alpha1
+}
+
+func newFakeProxyProviders(fake *FakeProxyproviderV1alpha1, namespace string) typedproxyproviderv1alpha1.ProxyProviderInterface {
+	return &fakeProxyProviders{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.ProxyProvider, *v1alpha1.ProxyProviderList, *proxyproviderv1alpha1.ProxyProviderApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("proxyproviders"),
+			v1alpha1.SchemeGroupVersion.WithKind("ProxyProvider"),
+			func() *v1alpha1.ProxyProvider { return &v1alpha1.ProxyProvider{} },
+			func() *v1alpha1.ProxyProviderList { return &v1alpha1.ProxyProviderList{} },
+			func(dst, src *v1alpha1.ProxyProviderList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.ProxyProviderList) []*v1alpha1.ProxyProvider {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.ProxyProviderList, items []*v1alpha1.ProxyProvider) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
@@ -19,22 +19,22 @@ limitations under the License.
 package fake

 import (
-	v1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1"
+	v1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/typed/proxyprovider/v1alpha1"
 	rest "k8s.io/client-go/rest"
 	testing "k8s.io/client-go/testing"
 )

-type FakeProxyproviderV1 struct {
+type FakeProxyproviderV1alpha1 struct {
 	*testing.Fake
 }

-func (c *FakeProxyproviderV1) ProxyProviders(namespace string) v1.ProxyProviderInterface {
+func (c *FakeProxyproviderV1alpha1) ProxyProviders(namespace string) v1alpha1.ProxyProviderInterface {
 	return newFakeProxyProviders(c, namespace)
 }

 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
-func (c *FakeProxyproviderV1) RESTClient() rest.Interface {
+func (c *FakeProxyproviderV1alpha1) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
@@ -16,6 +16,6 @@ limitations under the License.

 // Code generated by client-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 type ProxyProviderExpansion interface{}
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
+	applyconfigurationproxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/applyconfiguration/proxyprovider/v1alpha1"
+	scheme "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+)
+
+// ProxyProvidersGetter has a method to return a ProxyProviderInterface.
+// A group's client should implement this interface.
+type ProxyProvidersGetter interface {
+	ProxyProviders(namespace string) ProxyProviderInterface
+}
+
+// ProxyProviderInterface has methods to work with ProxyProvider resources.
+type ProxyProviderInterface interface {
+	Create(ctx context.Context, proxyProvider *proxyproviderv1alpha1.ProxyProvider, opts v1.CreateOptions) (*proxyproviderv1alpha1.ProxyProvider, error)
+	Update(ctx context.Context, proxyProvider *proxyproviderv1alpha1.ProxyProvider, opts v1.UpdateOptions) (*proxyproviderv1alpha1.ProxyProvider, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, proxyProvider *proxyproviderv1alpha1.ProxyProvider, opts v1.UpdateOptions) (*proxyproviderv1alpha1.ProxyProvider, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*proxyproviderv1alpha1.ProxyProvider, error)
+	List(ctx context.Context, opts v1.ListOptions) (*proxyproviderv1alpha1.ProxyProviderList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *proxyproviderv1alpha1.ProxyProvider, err error)
+	Apply(ctx context.Context, proxyProvider *applyconfigurationproxyproviderv1alpha1.ProxyProviderApplyConfiguration, opts v1.ApplyOptions) (result *proxyproviderv1alpha1.ProxyProvider, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, proxyProvider *applyconfigurationproxyproviderv1alpha1.ProxyProviderApplyConfiguration, opts v1.ApplyOptions) (result *proxyproviderv1alpha1.ProxyProvider, err error)
+	ProxyProviderExpansion
+}
+
+// proxyProviders implements ProxyProviderInterface
+type proxyProviders struct {
+	*gentype.ClientWithListAndApply[*proxyproviderv1alpha1.ProxyProvider, *proxyproviderv1alpha1.ProxyProviderList, *applyconfigurationproxyproviderv1alpha1.ProxyProviderApplyConfiguration]
+}
+
+// newProxyProviders returns a ProxyProviders
+func newProxyProviders(c *ProxyproviderV1alpha1Client, namespace string) *proxyProviders {
+	return &proxyProviders{
+		gentype.NewClientWithListAndApply[*proxyproviderv1alpha1.ProxyProvider, *proxyproviderv1alpha1.ProxyProviderList, *applyconfigurationproxyproviderv1alpha1.ProxyProviderApplyConfiguration](
+			"proxyproviders",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *proxyproviderv1alpha1.ProxyProvider { return &proxyproviderv1alpha1.ProxyProvider{} },
+			func() *proxyproviderv1alpha1.ProxyProviderList { return &proxyproviderv1alpha1.ProxyProviderList{} },
+		),
+	}
+}
@@ -16,34 +16,34 @@ limitations under the License.

 // Code generated by client-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 import (
 	http "net/http"

-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
 	scheme "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
 )

-type ProxyproviderV1Interface interface {
+type ProxyproviderV1alpha1Interface interface {
 	RESTClient() rest.Interface
 	ProxyProvidersGetter
 }

-// ProxyproviderV1Client is used to interact with features provided by the proxyprovider.t000-n.de group.
-type ProxyproviderV1Client struct {
+// ProxyproviderV1alpha1Client is used to interact with features provided by the proxyprovider.t000-n.de group.
+type ProxyproviderV1alpha1Client struct {
 	restClient rest.Interface
 }

-func (c *ProxyproviderV1Client) ProxyProviders(namespace string) ProxyProviderInterface {
+func (c *ProxyproviderV1alpha1Client) ProxyProviders(namespace string) ProxyProviderInterface {
 	return newProxyProviders(c, namespace)
 }

-// NewForConfig creates a new ProxyproviderV1Client for the given config.
+// NewForConfig creates a new ProxyproviderV1alpha1Client for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
-func NewForConfig(c *rest.Config) (*ProxyproviderV1Client, error) {
+func NewForConfig(c *rest.Config) (*ProxyproviderV1alpha1Client, error) {
 	config := *c
 	setConfigDefaults(&config)
 	httpClient, err := rest.HTTPClientFor(&config)
@@ -53,21 +53,21 @@ func NewForConfig(c *rest.Config) (*ProxyproviderV1Client, error) {
 	return NewForConfigAndClient(&config, httpClient)
 }

-// NewForConfigAndClient creates a new ProxyproviderV1Client for the given config and http client.
+// NewForConfigAndClient creates a new ProxyproviderV1alpha1Client for the given config and http client.
 // Note the http client provided takes precedence over the configured transport values.
-func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ProxyproviderV1Client, error) {
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ProxyproviderV1alpha1Client, error) {
 	config := *c
 	setConfigDefaults(&config)
 	client, err := rest.RESTClientForConfigAndClient(&config, h)
 	if err != nil {
 		return nil, err
 	}
-	return &ProxyproviderV1Client{client}, nil
+	return &ProxyproviderV1alpha1Client{client}, nil
 }

-// NewForConfigOrDie creates a new ProxyproviderV1Client for the given config and
+// NewForConfigOrDie creates a new ProxyproviderV1alpha1Client for the given config and
 // panics if there is an error in the config.
-func NewForConfigOrDie(c *rest.Config) *ProxyproviderV1Client {
+func NewForConfigOrDie(c *rest.Config) *ProxyproviderV1alpha1Client {
 	client, err := NewForConfig(c)
 	if err != nil {
 		panic(err)
@@ -75,13 +75,13 @@ func NewForConfigOrDie(c *rest.Config) *ProxyproviderV1Client {
 	return client
 }

-// New creates a new ProxyproviderV1Client for the given RESTClient.
-func New(c rest.Interface) *ProxyproviderV1Client {
-	return &ProxyproviderV1Client{c}
+// New creates a new ProxyproviderV1alpha1Client for the given RESTClient.
+func New(c rest.Interface) *ProxyproviderV1alpha1Client {
+	return &ProxyproviderV1alpha1Client{c}
 }

 func setConfigDefaults(config *rest.Config) {
-	gv := proxyproviderv1.SchemeGroupVersion
+	gv := proxyproviderv1alpha1.SchemeGroupVersion
 	config.GroupVersion = &gv
 	config.APIPath = "/apis"
 	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
@@ -93,7 +93,7 @@ func setConfigDefaults(config *rest.Config) {

 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
-func (c *ProxyproviderV1Client) RESTClient() rest.Interface {
+func (c *ProxyproviderV1alpha1Client) RESTClient() rest.Interface {
 	if c == nil {
 		return nil
 	}
@@ -21,7 +21,7 @@ package externalversions
 import (
 	fmt "fmt"

-	v1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
+	v1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	cache "k8s.io/client-go/tools/cache"
 )
@@ -52,9 +52,9 @@ func (f *genericInformer) Lister() cache.GenericLister {
 // TODO extend this to unknown resources with a client pool
 func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
 	switch resource {
-	// Group=proxyprovider.t000-n.de, Version=v1
-	case v1.SchemeGroupVersion.WithResource("proxyproviders"):
-		return &genericInformer{resource: resource.GroupResource(), informer: f.Proxyprovider().V1().ProxyProviders().Informer()}, nil
+	// Group=proxyprovider.t000-n.de, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithResource("proxyproviders"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Proxyprovider().V1alpha1().ProxyProviders().Informer()}, nil

 	}

@@ -20,13 +20,13 @@ package proxyprovider

 import (
 	internalinterfaces "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions/internalinterfaces"
-	v1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions/proxyprovider/v1"
+	v1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions/proxyprovider/v1alpha1"
 )

 // Interface provides access to each of this group's versions.
 type Interface interface {
-	// V1 provides access to shared informers for resources in V1.
-	V1() v1.Interface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() v1alpha1.Interface
 }

 type group struct {
@@ -40,7 +40,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }

-// V1 returns a new v1.Interface.
-func (g *group) V1() v1.Interface {
-	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+// V1alpha1 returns a new v1alpha1.Interface.
+func (g *group) V1alpha1() v1alpha1.Interface {
+	return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions)
 }
@@ -16,7 +16,7 @@ limitations under the License.

 // Code generated by informer-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 import (
 	internalinterfaces "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions/internalinterfaces"
@@ -16,17 +16,17 @@ limitations under the License.

 // Code generated by informer-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 import (
 	context "context"
 	time "time"

-	apisproxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
+	apisproxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
 	versioned "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned"
 	internalinterfaces "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions/internalinterfaces"
-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/listers/proxyprovider/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/listers/proxyprovider/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -37,7 +37,7 @@ import (
 // ProxyProviders.
 type ProxyProviderInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() proxyproviderv1.ProxyProviderLister
+	Lister() proxyproviderv1alpha1.ProxyProviderLister
 }

 type proxyProviderInformer struct {
@@ -64,37 +64,37 @@ func NewFilteredProxyProviderInformer(client versioned.Interface, namespace stri
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
 func NewProxyProviderInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
-	gvr := schema.GroupVersionResource{Group: "proxyprovider.t000-n.de", Version: "v1", Resource: "proxyproviders"}
+	gvr := schema.GroupVersionResource{Group: "proxyprovider.t000-n.de", Version: "v1alpha1", Resource: "proxyproviders"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
 	return cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
-			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&opts)
 				}
-				return client.ProxyproviderV1().ProxyProviders(namespace).List(context.Background(), opts)
+				return client.ProxyproviderV1alpha1().ProxyProviders(namespace).List(context.Background(), opts)
 			},
-			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&opts)
 				}
-				return client.ProxyproviderV1().ProxyProviders(namespace).Watch(context.Background(), opts)
+				return client.ProxyproviderV1alpha1().ProxyProviders(namespace).Watch(context.Background(), opts)
 			},
-			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&opts)
 				}
-				return client.ProxyproviderV1().ProxyProviders(namespace).List(ctx, opts)
+				return client.ProxyproviderV1alpha1().ProxyProviders(namespace).List(ctx, opts)
 			},
-			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&opts)
 				}
-				return client.ProxyproviderV1().ProxyProviders(namespace).Watch(ctx, opts)
+				return client.ProxyproviderV1alpha1().ProxyProviders(namespace).Watch(ctx, opts)
 			},
 		}, client),
-		&apisproxyproviderv1.ProxyProvider{},
+		&apisproxyproviderv1alpha1.ProxyProvider{},
 		cache.SharedIndexInformerOptions{
 			ResyncPeriod: options.ResyncPeriod,
 			Indexers:     options.Indexers,
@@ -108,9 +108,9 @@ func (f *proxyProviderInformer) defaultInformer(client versioned.Interface, resy
 }

 func (f *proxyProviderInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apisproxyproviderv1.ProxyProvider{}, f.defaultInformer)
+	return f.factory.InformerFor(&apisproxyproviderv1alpha1.ProxyProvider{}, f.defaultInformer)
 }

-func (f *proxyProviderInformer) Lister() proxyproviderv1.ProxyProviderLister {
-	return proxyproviderv1.NewProxyProviderLister(f.Informer().GetIndexer())
+func (f *proxyProviderInformer) Lister() proxyproviderv1alpha1.ProxyProviderLister {
+	return proxyproviderv1alpha1.NewProxyProviderLister(f.Informer().GetIndexer())
 }
@@ -16,7 +16,7 @@ limitations under the License.

 // Code generated by lister-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 // ProxyProviderListerExpansion allows custom methods to be added to
 // ProxyProviderLister.
@@ -16,10 +16,10 @@ limitations under the License.

 // Code generated by lister-gen. DO NOT EDIT.

-package v1
+package v1alpha1

 import (
-	proxyproviderv1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1"
+	proxyproviderv1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
 	labels "k8s.io/apimachinery/pkg/labels"
 	listers "k8s.io/client-go/listers"
 	cache "k8s.io/client-go/tools/cache"
@@ -30,7 +30,7 @@ import (
 type ProxyProviderLister interface {
 	// List lists all ProxyProviders in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*proxyproviderv1.ProxyProvider, err error)
+	List(selector labels.Selector) (ret []*proxyproviderv1alpha1.ProxyProvider, err error)
 	// ProxyProviders returns an object that can list and get ProxyProviders.
 	ProxyProviders(namespace string) ProxyProviderNamespaceLister
 	ProxyProviderListerExpansion
@@ -38,17 +38,17 @@ type ProxyProviderLister interface {

 // proxyProviderLister implements the ProxyProviderLister interface.
 type proxyProviderLister struct {
-	listers.ResourceIndexer[*proxyproviderv1.ProxyProvider]
+	listers.ResourceIndexer[*proxyproviderv1alpha1.ProxyProvider]
 }

 // NewProxyProviderLister returns a new ProxyProviderLister.
 func NewProxyProviderLister(indexer cache.Indexer) ProxyProviderLister {
-	return &proxyProviderLister{listers.New[*proxyproviderv1.ProxyProvider](indexer, proxyproviderv1.Resource("proxyprovider"))}
+	return &proxyProviderLister{listers.New[*proxyproviderv1alpha1.ProxyProvider](indexer, proxyproviderv1alpha1.Resource("proxyprovider"))}
 }

 // ProxyProviders returns an object that can list and get ProxyProviders.
 func (s *proxyProviderLister) ProxyProviders(namespace string) ProxyProviderNamespaceLister {
-	return proxyProviderNamespaceLister{listers.NewNamespaced[*proxyproviderv1.ProxyProvider](s.ResourceIndexer, namespace)}
+	return proxyProviderNamespaceLister{listers.NewNamespaced[*proxyproviderv1alpha1.ProxyProvider](s.ResourceIndexer, namespace)}
 }

 // ProxyProviderNamespaceLister helps list and get ProxyProviders.
@@ -56,15 +56,15 @@ func (s *proxyProviderLister) ProxyProviders(namespace string) ProxyProviderName
 type ProxyProviderNamespaceLister interface {
 	// List lists all ProxyProviders in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*proxyproviderv1.ProxyProvider, err error)
+	List(selector labels.Selector) (ret []*proxyproviderv1alpha1.ProxyProvider, err error)
 	// Get retrieves the ProxyProvider from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*proxyproviderv1.ProxyProvider, error)
+	Get(name string) (*proxyproviderv1alpha1.ProxyProvider, error)
 	ProxyProviderNamespaceListerExpansion
 }

 // proxyProviderNamespaceLister implements the ProxyProviderNamespaceLister
 // interface.
 type proxyProviderNamespaceLister struct {
-	listers.ResourceIndexer[*proxyproviderv1.ProxyProvider]
+	listers.ResourceIndexer[*proxyproviderv1alpha1.ProxyProvider]
 }
@@ -32,10 +32,10 @@ import (

 func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition {
 	return map[string]common.OpenAPIDefinition{
-		"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProvider":       schema_pkg_apis_proxyprovider_v1_ProxyProvider(ref),
-		"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProviderList":   schema_pkg_apis_proxyprovider_v1_ProxyProviderList(ref),
-		"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProviderSpec":   schema_pkg_apis_proxyprovider_v1_ProxyProviderSpec(ref),
-		"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProviderStatus": schema_pkg_apis_proxyprovider_v1_ProxyProviderStatus(ref),
+		"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProvider":       schema_pkg_apis_proxyprovider_v1alpha1_ProxyProvider(ref),
+		"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProviderList":   schema_pkg_apis_proxyprovider_v1alpha1_ProxyProviderList(ref),
+		"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProviderSpec":   schema_pkg_apis_proxyprovider_v1alpha1_ProxyProviderSpec(ref),
+		"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProviderStatus": schema_pkg_apis_proxyprovider_v1alpha1_ProxyProviderStatus(ref),
 		resource.Quantity{}.OpenAPIModelName():            schema_apimachinery_pkg_api_resource_Quantity(ref),
 		v1.APIGroup{}.OpenAPIModelName():                  schema_pkg_apis_meta_v1_APIGroup(ref),
 		v1.APIGroupList{}.OpenAPIModelName():              schema_pkg_apis_meta_v1_APIGroupList(ref),
@@ -94,7 +94,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 	}
 }

-func schema_pkg_apis_proxyprovider_v1_ProxyProvider(ref common.ReferenceCallback) common.OpenAPIDefinition {
+func schema_pkg_apis_proxyprovider_v1alpha1_ProxyProvider(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
@@ -123,13 +123,13 @@ func schema_pkg_apis_proxyprovider_v1_ProxyProvider(ref common.ReferenceCallback
 					"spec": {
 						SchemaProps: spec.SchemaProps{
 							Default: map[string]interface{}{},
-							Ref:     ref("gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProviderSpec"),
+							Ref:     ref("gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProviderSpec"),
 						},
 					},
 					"status": {
 						SchemaProps: spec.SchemaProps{
 							Default: map[string]interface{}{},
-							Ref:     ref("gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProviderStatus"),
+							Ref:     ref("gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProviderStatus"),
 						},
 					},
 				},
@@ -137,11 +137,11 @@ func schema_pkg_apis_proxyprovider_v1_ProxyProvider(ref common.ReferenceCallback
 			},
 		},
 		Dependencies: []string{
-			"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProviderSpec", "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProviderStatus", v1.ObjectMeta{}.OpenAPIModelName()},
+			"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProviderSpec", "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProviderStatus", v1.ObjectMeta{}.OpenAPIModelName()},
 	}
 }

-func schema_pkg_apis_proxyprovider_v1_ProxyProviderList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+func schema_pkg_apis_proxyprovider_v1alpha1_ProxyProviderList(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
@@ -173,7 +173,7 @@ func schema_pkg_apis_proxyprovider_v1_ProxyProviderList(ref common.ReferenceCall
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
 									SchemaProps: spec.SchemaProps{
-										Ref: ref("gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProvider"),
+										Ref: ref("gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProvider"),
 									},
 								},
 							},
@@ -184,11 +184,11 @@ func schema_pkg_apis_proxyprovider_v1_ProxyProviderList(ref common.ReferenceCall
 			},
 		},
 		Dependencies: []string{
-			"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1.ProxyProvider", v1.ListMeta{}.OpenAPIModelName()},
+			"gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1.ProxyProvider", v1.ListMeta{}.OpenAPIModelName()},
 	}
 }

-func schema_pkg_apis_proxyprovider_v1_ProxyProviderSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+func schema_pkg_apis_proxyprovider_v1alpha1_ProxyProviderSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
@@ -229,7 +229,7 @@ func schema_pkg_apis_proxyprovider_v1_ProxyProviderSpec(ref common.ReferenceCall
 	}
 }

-func schema_pkg_apis_proxyprovider_v1_ProxyProviderStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+func schema_pkg_apis_proxyprovider_v1alpha1_ProxyProviderStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{