@@ -25842,6 +25842,14 @@

      "userUID": {

       "type": "string",

       "description": "UserUID is the unique UID associated with this token. UserUID and UserName must both match for this token to be valid."

+     },

+     "codeChallenge": {

+      "type": "string",

+      "description": "CodeChallenge is the optional code_challenge associated with this authorization code, as described in rfc7636"

+     },

+     "codeChallengeMethod": {

+      "type": "string",

+      "description": "CodeChallengeMethod is the optional code_challenge_method associated with this authorization code, as described in rfc7636"

      }

     }

    },

@@ -418,6 +418,12 @@ func fuzzInternalObject(t *testing.T, forVersion unversioned.GroupVersion, item

 			j.Spec.Template.Spec.InitContainers = nil

 			j.Status.Template.Spec.InitContainers = nil

 		},

+		func(j *oauthapi.OAuthAuthorizeToken, c fuzz.Continue) {

+			c.FuzzNoCustom(j)

+			if len(j.CodeChallenge) > 0 && len(j.CodeChallengeMethod) == 0 {

+				j.CodeChallengeMethod = "plain"

+			}

+		},

 		func(j *oauthapi.OAuthClientAuthorization, c fuzz.Continue) {

 			c.FuzzNoCustom(j)

 			if len(j.Scopes) == 0 {

@@ -59,6 +59,12 @@ type OAuthAuthorizeToken struct {

 	// UserUID is the unique UID associated with this token. UserUID and UserName must both match

 	// for this token to be valid.

 	UserUID string

+

+	// CodeChallenge is the optional code_challenge associated with this authorization code, as described in rfc7636

+	CodeChallenge string

+

+	// CodeChallengeMethod is the optional code_challenge_method associated with this authorization code, as described in rfc7636

+	CodeChallengeMethod string

 }

 // +genclient=true

new file mode 100644

@@ -0,0 +1,15 @@

+package v1

+

+import "k8s.io/kubernetes/pkg/runtime"

+

+func SetDefaults_OAuthAuthorizeToken(obj *OAuthAuthorizeToken) {

+	if len(obj.CodeChallenge) > 0 && len(obj.CodeChallengeMethod) == 0 {

+		obj.CodeChallengeMethod = "plain"

+	}

+}

+

+func addDefaultingFuncs(scheme *runtime.Scheme) error {

+	return scheme.AddDefaultingFuncs(

+		SetDefaults_OAuthAuthorizeToken,

+	)

+}

@@ -321,6 +321,14 @@ func (m *OAuthAuthorizeToken) MarshalTo(data []byte) (int, error) {

 	i++

 	i = encodeVarintGenerated(data, i, uint64(len(m.UserUID)))

 	i += copy(data[i:], m.UserUID)

+	data[i] = 0x4a

+	i++

+	i = encodeVarintGenerated(data, i, uint64(len(m.CodeChallenge)))

+	i += copy(data[i:], m.CodeChallenge)

+	data[i] = 0x52

+	i++

+	i = encodeVarintGenerated(data, i, uint64(len(m.CodeChallengeMethod)))

+	i += copy(data[i:], m.CodeChallengeMethod)

 	return i, nil

 }

@@ -727,6 +735,10 @@ func (m *OAuthAuthorizeToken) Size() (n int) {

 	n += 1 + l + sovGenerated(uint64(l))

 	l = len(m.UserUID)

 	n += 1 + l + sovGenerated(uint64(l))

+	l = len(m.CodeChallenge)

+	n += 1 + l + sovGenerated(uint64(l))

+	l = len(m.CodeChallengeMethod)

+	n += 1 + l + sovGenerated(uint64(l))

 	return n

 }

@@ -906,6 +918,8 @@ func (this *OAuthAuthorizeToken) String() string {

 		`State:` + fmt.Sprintf("%v", this.State) + `,`,

 		`UserName:` + fmt.Sprintf("%v", this.UserName) + `,`,

 		`UserUID:` + fmt.Sprintf("%v", this.UserUID) + `,`,

+		`CodeChallenge:` + fmt.Sprintf("%v", this.CodeChallenge) + `,`,

+		`CodeChallengeMethod:` + fmt.Sprintf("%v", this.CodeChallengeMethod) + `,`,

 		`}`,

 	}, "")

 	return s

@@ -1785,6 +1799,64 @@ func (m *OAuthAuthorizeToken) Unmarshal(data []byte) error {

 			}

 			m.UserUID = string(data[iNdEx:postIndex])

 			iNdEx = postIndex

+		case 9:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field CodeChallenge", wireType)

+			}

+			var stringLen uint64

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowGenerated

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				stringLen |= (uint64(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			intStringLen := int(stringLen)

+			if intStringLen < 0 {

+				return ErrInvalidLengthGenerated

+			}

+			postIndex := iNdEx + intStringLen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			m.CodeChallenge = string(data[iNdEx:postIndex])

+			iNdEx = postIndex

+		case 10:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field CodeChallengeMethod", wireType)

+			}

+			var stringLen uint64

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowGenerated

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				stringLen |= (uint64(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			intStringLen := int(stringLen)

+			if intStringLen < 0 {

+				return ErrInvalidLengthGenerated

+			}

+			postIndex := iNdEx + intStringLen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			m.CodeChallengeMethod = string(data[iNdEx:postIndex])

+			iNdEx = postIndex

 		default:

 			iNdEx = preIndex

 			skippy, err := skipGenerated(data[iNdEx:])

@@ -2800,69 +2872,72 @@ var (

 )

 var fileDescriptorGenerated = []byte{

-	// 1024 bytes of a gzipped FileDescriptorProto

-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xec, 0x56, 0xcf, 0x6f, 0x1b, 0x45,

-	0x14, 0xee, 0xc6, 0x71, 0x62, 0x3f, 0xb7, 0xb1, 0x3d, 0x6d, 0xa8, 0x09, 0x90, 0x54, 0x06, 0x41,

-	0x10, 0xe9, 0xae, 0x12, 0x51, 0xa9, 0x48, 0xa8, 0x92, 0x1d, 0x02, 0x58, 0x82, 0x56, 0x9a, 0x34,

-	0x80, 0x90, 0x40, 0x9a, 0xec, 0x4e, 0xec, 0xc5, 0xeb, 0x5d, 0x6b, 0x67, 0x36, 0x14, 0xc4, 0x81,

-	0x1b, 0x57, 0xfe, 0x09, 0x8e, 0xdc, 0xb8, 0x72, 0xcf, 0x31, 0x47, 0xc4, 0x21, 0x2a, 0xe5, 0xc6,

-	0x9f, 0xc0, 0x05, 0xde, 0xce, 0xae, 0xf7, 0x97, 0xed, 0xa0, 0x44, 0x22, 0xe2, 0xc0, 0x61, 0xa4,

-	0xdd, 0xf7, 0xbe, 0x6f, 0xe6, 0xbd, 0x37, 0xdf, 0xbc, 0x19, 0x78, 0xbb, 0x6f, 0xcb, 0x41, 0x70,

-	0xa8, 0x9b, 0xde, 0xc8, 0xf0, 0xc6, 0xdc, 0x15, 0x03, 0xfb, 0x48, 0x1a, 0x9e, 0x6f, 0xf7, 0x6d,

-	0xd7, 0x18, 0x0f, 0xfb, 0x86, 0xc7, 0x02, 0x39, 0x30, 0xd8, 0xd8, 0x36, 0x8e, 0xb7, 0x8d, 0x3e,

-	0x77, 0xb9, 0xcf, 0x24, 0xb7, 0xf4, 0xb1, 0xef, 0x49, 0x8f, 0x6c, 0xa5, 0x6c, 0x3d, 0x61, 0xeb,

-	0x11, 0x5b, 0x47, 0xb6, 0xae, 0xd8, 0x3a, 0xb2, 0xf5, 0xe3, 0xed, 0xb5, 0xbb, 0x99, 0xb5, 0xfa,

-	0x5e, 0xdf, 0x33, 0xd4, 0x24, 0x87, 0xc1, 0x91, 0xfa, 0x53, 0x3f, 0xea, 0x2b, 0x9a, 0x7c, 0xed,

-	0xde, 0xf0, 0xbe, 0xd0, 0x6d, 0xcf, 0x18, 0x06, 0x87, 0xdc, 0x77, 0xb9, 0xe4, 0x42, 0x05, 0x14,

-	0x86, 0x12, 0xb8, 0xc7, 0xdc, 0x17, 0xb6, 0xe7, 0x72, 0xab, 0x18, 0xd3, 0xda, 0xd6, 0x7c, 0xda,

-	0x74, 0x06, 0x6b, 0x77, 0x67, 0xa3, 0xfd, 0xc0, 0x95, 0xf6, 0x88, 0x4f, 0xc1, 0xb7, 0x67, 0xc3,

-	0x03, 0x69, 0x3b, 0x86, 0xed, 0x4a, 0x21, 0xfd, 0x22, 0xa5, 0xfd, 0xb3, 0x06, 0x2f, 0xec, 0x3a,

-	0x81, 0x90, 0xdc, 0xa7, 0x9e, 0xc3, 0xf7, 0x4d, 0x2c, 0x14, 0xe5, 0x88, 0xb4, 0x4d, 0x89, 0x19,

-	0x90, 0x37, 0xa0, 0xea, 0xa3, 0xfd, 0x21, 0x1b, 0x71, 0xd1, 0xd2, 0xee, 0x94, 0x36, 0xab, 0xdd,

-	0x1b, 0xcf, 0xce, 0x36, 0xaa, 0x74, 0x62, 0xa4, 0xa9, 0x9f, 0xe8, 0x00, 0x6e, 0xf8, 0x31, 0x66,

-	0x26, 0xa2, 0x17, 0x14, 0x7a, 0x05, 0xd1, 0xf0, 0x30, 0xb1, 0xd2, 0x0c, 0x82, 0x74, 0xa0, 0xce,

-	0x1c, 0xc7, 0xfb, 0x72, 0x4f, 0x98, 0xcc, 0x61, 0xe1, 0x7a, 0xad, 0xd2, 0x1d, 0x6d, 0xb3, 0xd2,

-	0xbd, 0x7d, 0x72, 0xb6, 0x71, 0x0d, 0x89, 0xf5, 0x4e, 0xde, 0x4d, 0x8b, 0xf8, 0xf6, 0x5f, 0x25,

-	0x68, 0x3c, 0xea, 0xe0, 0x36, 0x76, 0x4c, 0x9c, 0x51, 0x3c, 0xf6, 0x86, 0xdc, 0x25, 0x9f, 0x40,

-	0x65, 0xc4, 0x25, 0xb3, 0x98, 0x64, 0x18, 0xb3, 0xb6, 0x59, 0xdb, 0xd9, 0xd4, 0xa3, 0xd2, 0xe8,

-	0x69, 0x69, 0x94, 0x02, 0xa2, 0xbd, 0xd7, 0x1f, 0x1d, 0x7e, 0xc1, 0x4d, 0xf9, 0x21, 0x72, 0xba,

-	0x24, 0x5e, 0x1a, 0x52, 0x1b, 0x4d, 0x66, 0x23, 0x3b, 0x00, 0xa6, 0x63, 0x73, 0x57, 0x86, 0x19,

-	0x61, 0x86, 0x1a, 0x66, 0x98, 0x30, 0x76, 0x13, 0x0f, 0xcd, 0xa0, 0x88, 0x01, 0x55, 0xfe, 0x64,

-	0x6c, 0xfb, 0x5c, 0xf4, 0xa2, 0xfc, 0x4a, 0xdd, 0x66, 0x4c, 0xa9, 0xee, 0x4d, 0x1c, 0x34, 0xc5,

-	0x90, 0x36, 0x2c, 0x89, 0x70, 0x1f, 0x44, 0x6b, 0x51, 0x95, 0x10, 0x10, 0xb9, 0xa4, 0x76, 0x46,

-	0xd0, 0xd8, 0x43, 0xee, 0x41, 0xcd, 0xe7, 0x16, 0x12, 0x4c, 0x79, 0x40, 0x7b, 0xad, 0xb2, 0x8a,

-	0xe4, 0x66, 0x3c, 0x6d, 0x8d, 0xa6, 0x2e, 0x9a, 0xc5, 0x91, 0x2d, 0xa8, 0x04, 0x82, 0xfb, 0x2a,

-	0xfa, 0x25, 0xc5, 0x69, 0xc4, 0x9c, 0xca, 0x41, 0x6c, 0xa7, 0x09, 0x82, 0xbc, 0x0e, 0xcb, 0xe1,

-	0xf7, 0x41, 0xef, 0x9d, 0xd6, 0xb2, 0x02, 0xd7, 0x63, 0xf0, 0xf2, 0x41, 0x64, 0xa6, 0x13, 0x3f,

-	0x79, 0x00, 0x2b, 0xe1, 0x61, 0xc2, 0xc3, 0xf5, 0x35, 0x57, 0x9b, 0xd0, 0xaa, 0x28, 0xc6, 0x73,

-	0x31, 0x63, 0xa5, 0x93, 0xf3, 0xd2, 0x02, 0x9a, 0xdc, 0x87, 0xeb, 0x3e, 0x3f, 0xc2, 0xfc, 0x07,

-	0x11, 0xbb, 0xaa, 0xd8, 0xb7, 0x62, 0xf6, 0x75, 0x9a, 0xf1, 0xd1, 0x1c, 0xb2, 0xfd, 0xab, 0x06,

-	0xb7, 0x8a, 0x0a, 0xf8, 0xc0, 0x16, 0x92, 0x7c, 0x36, 0xa5, 0x02, 0xe3, 0x1c, 0x15, 0x64, 0x0e,

-	0xad, 0x1e, 0xd2, 0x95, 0x18, 0x92, 0xe2, 0x4c, 0x2c, 0x19, 0x29, 0x98, 0x50, 0xb6, 0x25, 0x1f,

-	0x45, 0x3a, 0xaf, 0xed, 0x3c, 0xd0, 0x2f, 0xd2, 0x6d, 0xf4, 0x62, 0xc4, 0xdd, 0x1b, 0xf1, 0x52,

-	0xe5, 0x5e, 0x38, 0x29, 0x8d, 0xe6, 0x6e, 0xff, 0x58, 0x82, 0x9b, 0x11, 0x34, 0x5f, 0xae, 0xff,

-	0x15, 0x3e, 0x4f, 0xe1, 0x2f, 0x43, 0x59, 0x48, 0x6c, 0x70, 0xb1, 0xbc, 0x93, 0xb2, 0xee, 0x87,

-	0x46, 0x1a, 0xf9, 0x72, 0xc7, 0x60, 0xf9, 0x22, 0xc7, 0xa0, 0x72, 0xfe, 0x31, 0x68, 0x3f, 0xd5,

-	0xe0, 0xf6, 0x8c, 0xfd, 0xba, 0x0a, 0x3d, 0x1e, 0xe5, 0xf5, 0xd8, 0xb9, 0x8c, 0x1e, 0x73, 0x41,

-	0xcf, 0x91, 0xe4, 0x4f, 0x8b, 0x50, 0x53, 0xe8, 0x48, 0x0c, 0xff, 0xa2, 0x14, 0x5f, 0x45, 0x95,

-	0x70, 0xd3, 0xe7, 0x32, 0x96, 0xe1, 0x4a, 0x8c, 0x5e, 0xda, 0x57, 0x56, 0x1a, 0x7b, 0xc9, 0x2e,

-	0x34, 0x99, 0x65, 0xd9, 0xe1, 0x7d, 0xc0, 0x9c, 0xc8, 0x27, 0x50, 0x86, 0xa1, 0xb0, 0x56, 0x11,

-	0xde, 0xec, 0x14, 0x9d, 0x74, 0x1a, 0x4f, 0xf6, 0x61, 0x15, 0xb5, 0x39, 0xf6, 0x5c, 0xeb, 0x63,

-	0xac, 0xdb, 0xee, 0x00, 0x2f, 0x1a, 0xee, 0xf6, 0x95, 0x42, 0xc3, 0x1b, 0xe9, 0xa5, 0x78, 0xed,

-	0x55, 0x3a, 0x0b, 0x44, 0x67, 0x73, 0xc9, 0x9b, 0x61, 0x57, 0x4b, 0xb4, 0x29, 0x50, 0xc4, 0x61,

-	0x50, 0x8d, 0xa8, 0xa3, 0xa5, 0x76, 0x9a, 0x43, 0x91, 0x1e, 0xd4, 0xfa, 0x3e, 0x73, 0xc3, 0x72,

-	0x0c, 0x3c, 0x2b, 0x16, 0xf2, 0x6b, 0x13, 0xe5, 0xbf, 0x97, 0xba, 0xfe, 0x3c, 0xdb, 0x68, 0xa8,

-	0xdf, 0xf7, 0x99, 0x6b, 0x39, 0xdc, 0x7f, 0xfc, 0x15, 0x5e, 0xde, 0x59, 0x2e, 0xf9, 0x4e, 0x83,

-	0xa6, 0x28, 0xdc, 0xe9, 0x02, 0x25, 0x7f, 0x89, 0x8e, 0x55, 0x7c, 0x1a, 0x74, 0x9f, 0x8f, 0x23,

-	0x6a, 0x16, 0x3d, 0x58, 0xdf, 0xa9, 0x35, 0xdb, 0x3f, 0x2c, 0x40, 0x2b, 0x23, 0x9b, 0x89, 0xd4,

-	0xd4, 0x2d, 0xfe, 0x1f, 0x6b, 0x67, 0xd9, 0xee, 0x50, 0xba, 0x48, 0x77, 0x58, 0xfc, 0x87, 0x4b,

-	0x32, 0x6d, 0x7b, 0xe5, 0x79, 0x6d, 0xaf, 0xfd, 0x87, 0x06, 0x2f, 0xce, 0xab, 0xd3, 0x55, 0xb4,

-	0x91, 0x61, 0xbe, 0x8d, 0xbc, 0x7b, 0x89, 0x36, 0x32, 0x23, 0xf2, 0x39, 0xbd, 0xe4, 0x54, 0x83,

-	0x7a, 0x86, 0x72, 0x15, 0xf9, 0x7d, 0x9e, 0xcf, 0xef, 0xad, 0x4b, 0xe7, 0x37, 0x27, 0x25, 0x7c,

-	0x50, 0x37, 0x66, 0xbc, 0xa2, 0x2b, 0x0e, 0xba, 0x7d, 0xe6, 0x4c, 0x1e, 0xd1, 0xf5, 0xf0, 0x28,

-	0xef, 0x3d, 0x61, 0xa6, 0xfc, 0x88, 0x39, 0x01, 0xee, 0x7f, 0x02, 0x20, 0xdf, 0x40, 0xcd, 0x4c,

-	0x5f, 0xe4, 0x4a, 0xb3, 0xb5, 0x9d, 0xde, 0xc5, 0xe2, 0x3c, 0xe7, 0x49, 0x1f, 0x2d, 0x9d, 0x01,

-	0xd0, 0xec, 0x72, 0xdd, 0x57, 0x4e, 0x7e, 0x5b, 0xbf, 0x76, 0x8a, 0xe3, 0x17, 0x1c, 0xdf, 0x3e,

-	0x5b, 0xd7, 0x4e, 0x70, 0x9c, 0xe2, 0x78, 0x8a, 0xe3, 0xfb, 0xdf, 0xd7, 0xaf, 0x7d, 0xba, 0x70,

-	0xbc, 0xfd, 0x77, 0x00, 0x00, 0x00, 0xff, 0xff, 0x64, 0xe6, 0x4d, 0xde, 0x99, 0x0d, 0x00, 0x00,

+	// 1067 bytes of a gzipped FileDescriptorProto

+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xec, 0x57, 0x4f, 0x6f, 0x1b, 0x45,

+	0x14, 0xcf, 0xe6, 0xaf, 0xfd, 0xdc, 0x24, 0xf6, 0xa4, 0xa1, 0x26, 0x85, 0xa4, 0x32, 0x08, 0x82,

+	0x48, 0x77, 0x95, 0x88, 0x4a, 0x45, 0xa0, 0x4a, 0xb6, 0x09, 0x60, 0x89, 0xb6, 0xd2, 0xa4, 0x01,

+	0x84, 0x04, 0xd2, 0x66, 0x77, 0x62, 0x2f, 0x5e, 0xef, 0x5a, 0x3b, 0xb3, 0xa1, 0x20, 0x0e, 0xdc,

+	0xb8, 0xf2, 0x25, 0xf8, 0x06, 0x5c, 0x38, 0x70, 0xcf, 0x31, 0x47, 0xc4, 0x21, 0x2a, 0xe5, 0xc6,

+	0x47, 0xe0, 0x02, 0x6f, 0x67, 0xc7, 0xfb, 0xcf, 0x76, 0xab, 0x44, 0x22, 0xe2, 0xc0, 0x61, 0xa5,

+	0xdd, 0xf7, 0x7e, 0xbf, 0x99, 0xf7, 0xde, 0xbc, 0xdf, 0xf3, 0x18, 0xde, 0xed, 0x3a, 0xa2, 0x17,

+	0x1e, 0xe9, 0x96, 0x3f, 0x30, 0xfc, 0x21, 0xf3, 0x78, 0xcf, 0x39, 0x16, 0x86, 0x1f, 0x38, 0x5d,

+	0xc7, 0x33, 0x86, 0xfd, 0xae, 0xe1, 0x9b, 0xa1, 0xe8, 0x19, 0xe6, 0xd0, 0x31, 0x4e, 0x76, 0x8d,

+	0x2e, 0xf3, 0x58, 0x60, 0x0a, 0x66, 0xeb, 0xc3, 0xc0, 0x17, 0x3e, 0xd9, 0x49, 0xd9, 0x7a, 0xc2,

+	0xd6, 0x63, 0xb6, 0x8e, 0x6c, 0x5d, 0xb2, 0x75, 0x64, 0xeb, 0x27, 0xbb, 0x1b, 0xb7, 0x33, 0x7b,

+	0x75, 0xfd, 0xae, 0x6f, 0xc8, 0x45, 0x8e, 0xc2, 0x63, 0xf9, 0x25, 0x3f, 0xe4, 0x5b, 0xbc, 0xf8,

+	0xc6, 0x9d, 0xfe, 0x5d, 0xae, 0x3b, 0xbe, 0xd1, 0x0f, 0x8f, 0x58, 0xe0, 0x31, 0xc1, 0xb8, 0x0c,

+	0x28, 0x0a, 0x25, 0xf4, 0x4e, 0x58, 0xc0, 0x1d, 0xdf, 0x63, 0x76, 0x31, 0xa6, 0x8d, 0x9d, 0xe9,

+	0xb4, 0xf1, 0x0c, 0x36, 0x6e, 0x4f, 0x46, 0x07, 0xa1, 0x27, 0x9c, 0x01, 0x1b, 0x83, 0xef, 0x4e,

+	0x86, 0x87, 0xc2, 0x71, 0x0d, 0xc7, 0x13, 0x5c, 0x04, 0x45, 0x4a, 0xe3, 0x17, 0x0d, 0x6e, 0xb6,

+	0xdd, 0x90, 0x0b, 0x16, 0x50, 0xdf, 0x65, 0x07, 0x16, 0x16, 0x8a, 0x32, 0x44, 0x3a, 0x96, 0xc0,

+	0x0c, 0xc8, 0x9b, 0x50, 0x0e, 0xd0, 0xfe, 0xc0, 0x1c, 0x30, 0x5e, 0xd7, 0x6e, 0xcd, 0x6d, 0x97,

+	0x5b, 0xcb, 0x4f, 0xcf, 0xb7, 0xca, 0x74, 0x64, 0xa4, 0xa9, 0x9f, 0xe8, 0x00, 0x5e, 0xf4, 0x32,

+	0x34, 0x2d, 0x44, 0xcf, 0x4a, 0xf4, 0x0a, 0xa2, 0xe1, 0x41, 0x62, 0xa5, 0x19, 0x04, 0x69, 0xc2,

+	0xaa, 0xe9, 0xba, 0xfe, 0x57, 0xfb, 0xdc, 0x32, 0x5d, 0x33, 0xda, 0xaf, 0x3e, 0x77, 0x4b, 0xdb,

+	0x2e, 0xb5, 0x6e, 0x9c, 0x9e, 0x6f, 0xcd, 0x20, 0x71, 0xb5, 0x99, 0x77, 0xd3, 0x22, 0xbe, 0xf1,

+	0xf7, 0x1c, 0x54, 0x1f, 0x36, 0xf1, 0x18, 0x9b, 0x16, 0xae, 0xc8, 0x1f, 0xf9, 0x7d, 0xe6, 0x91,

+	0x4f, 0xa1, 0x34, 0x60, 0xc2, 0xb4, 0x4d, 0x61, 0x62, 0xcc, 0xda, 0x76, 0x65, 0x6f, 0x5b, 0x8f,

+	0x4b, 0xa3, 0xa7, 0xa5, 0x91, 0x1d, 0x10, 0x9f, 0xbd, 0xfe, 0xf0, 0xe8, 0x4b, 0x66, 0x89, 0xfb,

+	0xc8, 0x69, 0x11, 0xb5, 0x35, 0xa4, 0x36, 0x9a, 0xac, 0x46, 0xf6, 0x00, 0x2c, 0xd7, 0x61, 0x9e,

+	0x88, 0x32, 0xc2, 0x0c, 0x35, 0xcc, 0x30, 0x61, 0xb4, 0x13, 0x0f, 0xcd, 0xa0, 0x88, 0x01, 0x65,

+	0xf6, 0x78, 0xe8, 0x04, 0x8c, 0x77, 0xe2, 0xfc, 0xe6, 0x5a, 0x35, 0x45, 0x29, 0xef, 0x8f, 0x1c,

+	0x34, 0xc5, 0x90, 0x06, 0x2c, 0xf2, 0xe8, 0x1c, 0x78, 0x7d, 0x5e, 0x96, 0x10, 0x10, 0xb9, 0x28,

+	0x4f, 0x86, 0x53, 0xe5, 0x21, 0x77, 0xa0, 0x12, 0x30, 0x1b, 0x09, 0x96, 0x38, 0xa4, 0x9d, 0xfa,

+	0x82, 0x8c, 0x64, 0x4d, 0x2d, 0x5b, 0xa1, 0xa9, 0x8b, 0x66, 0x71, 0x64, 0x07, 0x4a, 0x21, 0x67,

+	0x81, 0x8c, 0x7e, 0x51, 0x72, 0xaa, 0x8a, 0x53, 0x3a, 0x54, 0x76, 0x9a, 0x20, 0xc8, 0x1b, 0xb0,

+	0x14, 0xbd, 0x1f, 0x76, 0xde, 0xab, 0x2f, 0x49, 0xf0, 0xaa, 0x02, 0x2f, 0x1d, 0xc6, 0x66, 0x3a,

+	0xf2, 0x93, 0x7b, 0xb0, 0x12, 0x89, 0x09, 0xc5, 0xf5, 0x0d, 0x93, 0x87, 0x50, 0x2f, 0x49, 0xc6,

+	0x0b, 0x8a, 0xb1, 0xd2, 0xcc, 0x79, 0x69, 0x01, 0x4d, 0xee, 0xc2, 0xb5, 0x80, 0x1d, 0x63, 0xfe,

+	0xbd, 0x98, 0x5d, 0x96, 0xec, 0xeb, 0x8a, 0x7d, 0x8d, 0x66, 0x7c, 0x34, 0x87, 0x6c, 0xfc, 0xa6,

+	0xc1, 0xf5, 0x62, 0x07, 0x7c, 0xe4, 0x70, 0x41, 0x3e, 0x1f, 0xeb, 0x02, 0xe3, 0x19, 0x5d, 0x90,

+	0x11, 0xad, 0x1e, 0xd1, 0x65, 0x33, 0x24, 0xc5, 0x19, 0x59, 0x32, 0xad, 0x60, 0xc1, 0x82, 0x23,

+	0xd8, 0x20, 0xee, 0xf3, 0xca, 0xde, 0x3d, 0xfd, 0x22, 0xd3, 0x46, 0x2f, 0x46, 0xdc, 0x5a, 0x56,

+	0x5b, 0x2d, 0x74, 0xa2, 0x45, 0x69, 0xbc, 0x76, 0xe3, 0xe7, 0x79, 0x58, 0x8b, 0xa1, 0xf9, 0x72,

+	0xfd, 0xdf, 0xe1, 0xd3, 0x3a, 0xfc, 0x15, 0x58, 0xe0, 0x02, 0x07, 0x9c, 0x6a, 0xef, 0xa4, 0xac,

+	0x07, 0x91, 0x91, 0xc6, 0xbe, 0x9c, 0x0c, 0x96, 0x2e, 0x22, 0x83, 0xd2, 0x73, 0x64, 0xf0, 0x0e,

+	0x2c, 0x5b, 0xbe, 0xcd, 0xda, 0x3d, 0x9c, 0x53, 0xcc, 0xeb, 0x32, 0xd5, 0xc7, 0xeb, 0x8a, 0xb0,

+	0xdc, 0xce, 0x3a, 0x69, 0x1e, 0x4b, 0xee, 0xc3, 0x5a, 0xce, 0x80, 0x27, 0xd3, 0xf3, 0xed, 0x3a,

+	0xc8, 0x25, 0x6e, 0xaa, 0x25, 0xd6, 0xda, 0xe3, 0x10, 0x3a, 0x89, 0xd7, 0x78, 0xa2, 0xc1, 0x8d,

+	0x09, 0xbd, 0x73, 0x15, 0xda, 0x38, 0xce, 0x6b, 0xa3, 0x79, 0x19, 0x6d, 0xe4, 0x82, 0x9e, 0x22,

+	0x8f, 0x9f, 0xe6, 0xa1, 0x22, 0xd1, 0x71, 0x63, 0xfe, 0x8b, 0xb2, 0x78, 0x0d, 0x3b, 0x96, 0x59,

+	0x01, 0x13, 0x4a, 0x12, 0x2b, 0x0a, 0xbd, 0x78, 0x20, 0xad, 0x54, 0x79, 0x49, 0x1b, 0x6a, 0xa6,

+	0x6d, 0x3b, 0xd1, 0x6f, 0x93, 0xe9, 0xc6, 0x3e, 0x8e, 0x92, 0x88, 0x9a, 0x7c, 0x1d, 0xe1, 0xb5,

+	0x66, 0xd1, 0x49, 0xc7, 0xf1, 0xe4, 0x00, 0xd6, 0x51, 0x27, 0x43, 0xdf, 0xb3, 0x3f, 0xc1, 0xba,

+	0x25, 0xe7, 0x1a, 0xa9, 0x25, 0xfa, 0x75, 0x7c, 0x59, 0xed, 0xbd, 0x4e, 0x27, 0x81, 0xe8, 0x64,

+	0x2e, 0x79, 0x2b, 0x9a, 0xb0, 0x89, 0x4e, 0x38, 0x0a, 0x2a, 0x0a, 0xaa, 0x1a, 0x4f, 0xd7, 0xd4,

+	0x4e, 0x73, 0x28, 0xd2, 0x81, 0x4a, 0x37, 0x30, 0x3d, 0xa1, 0x7a, 0x31, 0x16, 0xd5, 0xeb, 0x23,

+	0x15, 0x7e, 0x90, 0xba, 0xfe, 0x3a, 0xdf, 0xaa, 0xca, 0xcf, 0x0f, 0x4d, 0xcf, 0x76, 0x59, 0xf0,

+	0xe8, 0x6b, 0xbc, 0x48, 0x64, 0xb9, 0xe4, 0x7b, 0x0d, 0x6a, 0xbc, 0x70, 0xbf, 0xe0, 0x28, 0xbf,

+	0x4b, 0x4c, 0xcf, 0xe2, 0x35, 0xa5, 0xf5, 0xa2, 0x8a, 0xa8, 0x56, 0xf4, 0x60, 0x7d, 0xc7, 0xf6,

+	0x6c, 0xfc, 0x38, 0x0b, 0xf5, 0x4c, 0xdb, 0x8c, 0x5a, 0x4d, 0xde, 0x28, 0xfe, 0x63, 0xa3, 0x35,

+	0x3b, 0xa9, 0xe6, 0x2e, 0x32, 0xa9, 0xe6, 0x9f, 0x33, 0xa9, 0xd2, 0x11, 0xbc, 0x30, 0x6d, 0x04,

+	0x37, 0xfe, 0xd4, 0xe0, 0xa5, 0x69, 0x75, 0xba, 0x8a, 0x31, 0xd2, 0xcf, 0x8f, 0x91, 0xf7, 0x2f,

+	0x31, 0x46, 0x26, 0x44, 0x3e, 0x65, 0x96, 0x9c, 0x69, 0xb0, 0x9a, 0xa1, 0x5c, 0x45, 0x7e, 0x5f,

+	0xe4, 0xf3, 0x7b, 0xfb, 0xd2, 0xf9, 0x4d, 0x49, 0x09, 0x2f, 0xf7, 0xd5, 0x09, 0x37, 0xfa, 0x92,

+	0x8b, 0xee, 0xc0, 0x74, 0x47, 0x17, 0xfa, 0xd5, 0x48, 0xca, 0xfb, 0x8f, 0x4d, 0x4b, 0x7c, 0x6c,

+	0xba, 0x21, 0x9e, 0x7f, 0x02, 0x20, 0xdf, 0x42, 0xc5, 0x4a, 0xff, 0x1d, 0xc8, 0x9e, 0xad, 0xec,

+	0x75, 0x2e, 0x16, 0xe7, 0x33, 0xfe, 0x5e, 0xc4, 0x5b, 0x67, 0x00, 0x34, 0xbb, 0x5d, 0xeb, 0xd5,

+	0xd3, 0xdf, 0x37, 0x67, 0xce, 0xf0, 0xf9, 0x15, 0x9f, 0xef, 0x9e, 0x6e, 0x6a, 0xa7, 0xf8, 0x9c,

+	0xe1, 0xf3, 0x04, 0x9f, 0x1f, 0xfe, 0xd8, 0x9c, 0xf9, 0x6c, 0xf6, 0x64, 0xf7, 0x9f, 0x00, 0x00,

+	0x00, 0xff, 0xff, 0xf7, 0xe5, 0x0b, 0x39, 0x25, 0x0e, 0x00, 0x00,

 }

@@ -90,6 +90,12 @@ message OAuthAuthorizeToken {

   // UserUID is the unique UID associated with this token. UserUID and UserName must both match

   // for this token to be valid.

   optional string userUID = 8;

+

+  // CodeChallenge is the optional code_challenge associated with this authorization code, as described in rfc7636

+  optional string codeChallenge = 9;

+

+  // CodeChallengeMethod is the optional code_challenge_method associated with this authorization code, as described in rfc7636

+  optional string codeChallengeMethod = 10;

 }

 // OAuthAuthorizeTokenList is a collection of OAuth authorization tokens

@@ -11,7 +11,7 @@ const GroupName = ""

 var SchemeGroupVersion = unversioned.GroupVersion{Group: GroupName, Version: "v1"}

 var (

-	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes, addConversionFuncs)

+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes, addConversionFuncs, addDefaultingFuncs)

 	AddToScheme   = SchemeBuilder.AddToScheme

 )

@@ -44,15 +44,17 @@ func (OAuthAccessTokenList) SwaggerDoc() map[string]string {

 }

 var map_OAuthAuthorizeToken = map[string]string{

-	"":            "OAuthAuthorizeToken describes an OAuth authorization token",

-	"metadata":    "Standard object's metadata.",

-	"clientName":  "ClientName references the client that created this token.",

-	"expiresIn":   "ExpiresIn is the seconds from CreationTime before this token expires.",

-	"scopes":      "Scopes is an array of the requested scopes.",

-	"redirectURI": "RedirectURI is the redirection associated with the token.",

-	"state":       "State data from request",

-	"userName":    "UserName is the user name associated with this token",

-	"userUID":     "UserUID is the unique UID associated with this token. UserUID and UserName must both match for this token to be valid.",

+	"":                    "OAuthAuthorizeToken describes an OAuth authorization token",

+	"metadata":            "Standard object's metadata.",

+	"clientName":          "ClientName references the client that created this token.",

+	"expiresIn":           "ExpiresIn is the seconds from CreationTime before this token expires.",

+	"scopes":              "Scopes is an array of the requested scopes.",

+	"redirectURI":         "RedirectURI is the redirection associated with the token.",

+	"state":               "State data from request",

+	"userName":            "UserName is the user name associated with this token",

+	"userUID":             "UserUID is the unique UID associated with this token. UserUID and UserName must both match for this token to be valid.",

+	"codeChallenge":       "CodeChallenge is the optional code_challenge associated with this authorization code, as described in rfc7636",

+	"codeChallengeMethod": "CodeChallengeMethod is the optional code_challenge_method associated with this authorization code, as described in rfc7636",

 }

 func (OAuthAuthorizeToken) SwaggerDoc() map[string]string {

@@ -63,6 +63,12 @@ type OAuthAuthorizeToken struct {

 	// UserUID is the unique UID associated with this token. UserUID and UserName must both match

 	// for this token to be valid.

 	UserUID string `json:"userUID,omitempty" protobuf:"bytes,8,opt,name=userUID"`

+

+	// CodeChallenge is the optional code_challenge associated with this authorization code, as described in rfc7636

+	CodeChallenge string `json:"codeChallenge,omitempty" protobuf:"bytes,9,opt,name=codeChallenge"`

+

+	// CodeChallengeMethod is the optional code_challenge_method associated with this authorization code, as described in rfc7636

+	CodeChallengeMethod string `json:"codeChallengeMethod,omitempty" protobuf:"bytes,10,opt,name=codeChallengeMethod"`

 }

 // +genclient=true

@@ -160,6 +160,7 @@ func Convert_api_OAuthAccessTokenList_To_v1_OAuthAccessTokenList(in *api.OAuthAc

 }

 func autoConvert_v1_OAuthAuthorizeToken_To_api_OAuthAuthorizeToken(in *OAuthAuthorizeToken, out *api.OAuthAuthorizeToken, s conversion.Scope) error {

+	SetDefaults_OAuthAuthorizeToken(in)

 	if err := pkg_api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {

 		return err

 	}

@@ -173,6 +174,8 @@ func autoConvert_v1_OAuthAuthorizeToken_To_api_OAuthAuthorizeToken(in *OAuthAuth

 	out.State = in.State

 	out.UserName = in.UserName

 	out.UserUID = in.UserUID

+	out.CodeChallenge = in.CodeChallenge

+	out.CodeChallengeMethod = in.CodeChallengeMethod

 	return nil

 }

@@ -194,6 +197,8 @@ func autoConvert_api_OAuthAuthorizeToken_To_v1_OAuthAuthorizeToken(in *api.OAuth

 	out.State = in.State

 	out.UserName = in.UserName

 	out.UserUID = in.UserUID

+	out.CodeChallenge = in.CodeChallenge

+	out.CodeChallengeMethod = in.CodeChallengeMethod

 	return nil

 }

@@ -123,6 +123,8 @@ func DeepCopy_v1_OAuthAuthorizeToken(in interface{}, out interface{}, c *convers

 		out.State = in.State

 		out.UserName = in.UserName

 		out.UserUID = in.UserUID

+		out.CodeChallenge = in.CodeChallenge

+		out.CodeChallengeMethod = in.CodeChallengeMethod

 		return nil

 	}

 }

@@ -3,6 +3,7 @@ package validation

 import (

 	"fmt"

 	"net/url"

+	"regexp"

 	"strings"

 	"k8s.io/kubernetes/pkg/api/validation"

@@ -74,6 +75,8 @@ func ValidateAccessTokenUpdate(newToken, oldToken *api.OAuthAccessToken) field.E

 	return append(allErrs, validation.ValidateImmutableField(newToken, &copied, field.NewPath(""))...)

 }

+var codeChallengeRegex = regexp.MustCompile("^[a-zA-Z0-9._~-]{43,128}$")

+

 func ValidateAuthorizeToken(authorizeToken *api.OAuthAuthorizeToken) field.ErrorList {

 	allErrs := validation.ValidateObjectMeta(&authorizeToken.ObjectMeta, false, ValidateTokenName, field.NewPath("metadata"))

 	allErrs = append(allErrs, ValidateClientNameField(authorizeToken.ClientName, field.NewPath("clientName"))...)

@@ -87,6 +90,24 @@ func ValidateAuthorizeToken(authorizeToken *api.OAuthAuthorizeToken) field.Error

 		allErrs = append(allErrs, field.Invalid(field.NewPath("redirectURI"), authorizeToken.RedirectURI, msg))

 	}

+	if len(authorizeToken.CodeChallenge) > 0 || len(authorizeToken.CodeChallengeMethod) > 0 {

+		switch {

+		case len(authorizeToken.CodeChallenge) == 0:

+			allErrs = append(allErrs, field.Required(field.NewPath("codeChallenge"), "required if codeChallengeMethod is specified"))

+		case !codeChallengeRegex.MatchString(authorizeToken.CodeChallenge):

+			allErrs = append(allErrs, field.Invalid(field.NewPath("codeChallenge"), authorizeToken.CodeChallenge, "must be 43-128 characters [a-zA-Z0-9.~_-]"))

+		}

+

+		switch authorizeToken.CodeChallengeMethod {

+		case "":

+			allErrs = append(allErrs, field.Required(field.NewPath("codeChallengeMethod"), "required if codeChallenge is specified"))

+		case "plain", "S256":

+			// no-op, good

+		default:

+			allErrs = append(allErrs, field.NotSupported(field.NewPath("codeChallengeMethod"), authorizeToken.CodeChallengeMethod, []string{"plain", "S256"}))

+		}

+	}

+

 	return allErrs

 }

@@ -123,6 +123,8 @@ func DeepCopy_api_OAuthAuthorizeToken(in interface{}, out interface{}, c *conver

 		out.State = in.State

 		out.UserName = in.UserName

 		out.UserUID = in.UserUID

+		out.CodeChallenge = in.CodeChallenge

+		out.CodeChallengeMethod = in.CodeChallengeMethod

 		return nil

 	}

 }

@@ -185,11 +185,13 @@ func (s *storage) convertToAuthorizeToken(data *osin.AuthorizeData) (*api.OAuthA

 			Name:              data.Code,

 			CreationTimestamp: unversioned.Time{Time: data.CreatedAt},

 		},

-		ClientName:  data.Client.GetId(),

-		ExpiresIn:   int64(data.ExpiresIn),

-		Scopes:      scope.Split(data.Scope),

-		RedirectURI: data.RedirectUri,

-		State:       data.State,

+		CodeChallenge:       data.CodeChallenge,

+		CodeChallengeMethod: data.CodeChallengeMethod,

+		ClientName:          data.Client.GetId(),

+		ExpiresIn:           int64(data.ExpiresIn),

+		Scopes:              scope.Split(data.Scope),

+		RedirectURI:         data.RedirectUri,

+		State:               data.State,

 	}

 	if err := s.user.ConvertToAuthorizeToken(data.UserData, token); err != nil {

 		return nil, err

@@ -211,14 +213,16 @@ func (s *storage) convertFromAuthorizeToken(authorize *api.OAuthAuthorizeToken)

 	}

 	return &osin.AuthorizeData{

-		Code:        authorize.Name,

-		Client:      &clientWrapper{authorize.ClientName, client},

-		ExpiresIn:   int32(authorize.ExpiresIn),

-		Scope:       scope.Join(authorize.Scopes),

-		RedirectUri: authorize.RedirectURI,

-		State:       authorize.State,

-		CreatedAt:   authorize.CreationTimestamp.Time,

-		UserData:    user,

+		Code:                authorize.Name,

+		CodeChallenge:       authorize.CodeChallenge,

+		CodeChallengeMethod: authorize.CodeChallengeMethod,

+		Client:              &clientWrapper{authorize.ClientName, client},

+		ExpiresIn:           int32(authorize.ExpiresIn),

+		Scope:               scope.Join(authorize.Scopes),

+		RedirectUri:         authorize.RedirectURI,

+		State:               authorize.State,

+		CreatedAt:           authorize.CreationTimestamp.Time,

+		UserData:            user,

 	}, nil

 }