use official upstream yaml library v3

Signed-off-by: Jan Larwig <jan@larwig.com>

pkg/apis/options/alpha_options.go

@@ -12,13 +12,13 @@ type AlphaOptions struct {
 	// UpstreamConfig is used to configure upstream servers.
 	// Once a user is authenticated, requests to the server will be proxied to
 	// these upstream servers based on the path mappings defined in this list.
-	UpstreamConfig UpstreamConfig `json:"upstreamConfig,omitempty"`
+	UpstreamConfig UpstreamConfig `yaml:"upstreamConfig,omitempty"`
 
 	// InjectRequestHeaders is used to configure headers that should be added
 	// to requests to upstream servers.
 	// Headers may source values from either the authenticated user's session
 	// or from a static secret value.
-	InjectRequestHeaders []Header `json:"injectRequestHeaders,omitempty"`
+	InjectRequestHeaders []Header `yaml:"injectRequestHeaders,omitempty"`
 
 	// InjectResponseHeaders is used to configure headers that should be added
 	// to responses from the proxy.
@@ -27,24 +27,24 @@ type AlphaOptions struct {
 	// auth_request module.
 	// Headers may source values from either the authenticated user's session
 	// or from a static secret value.
-	InjectResponseHeaders []Header `json:"injectResponseHeaders,omitempty"`
+	InjectResponseHeaders []Header `yaml:"injectResponseHeaders,omitempty"`
 
 	// Server is used to configure the HTTP(S) server for the proxy application.
 	// You may choose to run both HTTP and HTTPS servers simultaneously.
 	// This can be done by setting the BindAddress and the SecureBindAddress simultaneously.
 	// To use the secure server you must configure a TLS certificate and key.
-	Server Server `json:"server,omitempty"`
+	Server Server `yaml:"server,omitempty"`
 
 	// MetricsServer is used to configure the HTTP(S) server for metrics.
 	// You may choose to run both HTTP and HTTPS servers simultaneously.
 	// This can be done by setting the BindAddress and the SecureBindAddress simultaneously.
 	// To use the secure server you must configure a TLS certificate and key.
-	MetricsServer Server `json:"metricsServer,omitempty"`
+	MetricsServer Server `yaml:"metricsServer,omitempty"`
 
 	// Providers is used to configure your provider. **Multiple-providers is not
 	// yet working.** [This feature is tracked in
 	// #925](https://github.com/oauth2-proxy/oauth2-proxy/issues/926)
-	Providers Providers `json:"providers,omitempty"`
+	Providers Providers `yaml:"providers,omitempty"`
 }
 
 // Initialize alpha options with default values and settings of the core options

pkg/apis/options/duration_test.go

@@ -7,7 +7,7 @@ import (
 
 func TestDecode(t *testing.T) {
 	type result struct {
-		Duration time.Duration `json:"duration"`
+		Duration time.Duration `yaml:"duration"`
 	}
 
 	tests := []struct {
@@ -64,7 +64,7 @@ func TestDecode(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			var result struct {
-				Duration time.Duration `json:"duration"`
+				Duration time.Duration `yaml:"duration"`
 			}
 
 			err := Decode(tt.input, &result)

pkg/apis/options/header.go

@@ -5,13 +5,13 @@ package options
 type Header struct {
 	// Name is the header name to be used for this set of values.
 	// Names should be unique within a list of Headers.
-	Name string `json:"name,omitempty"`
+	Name string `yaml:"name,omitempty"`
 
 	// PreserveRequestValue determines whether any values for this header
 	// should be preserved for the request to the upstream server.
 	// This option only applies to injected request headers.
 	// Defaults to false (headers that match this header will be stripped).
-	PreserveRequestValue bool `json:"preserveRequestValue,omitempty"`
+	PreserveRequestValue bool `yaml:"preserveRequestValue,omitempty"`
 
 	// InsecureSkipHeaderNormalization disables normalizing the header name
 	// According to RFC 7230 Section 3.2 there aren't any rules about
@@ -24,17 +24,17 @@ type Header struct {
 	InsecureSkipHeaderNormalization bool `json:"InsecureSkipHeaderNormalization,omitempty"`
 
 	// Values contains the desired values for this header
-	Values []HeaderValue `json:"values,omitempty"`
+	Values []HeaderValue `yaml:"values,omitempty"`
 }
 
 // HeaderValue represents a single header value and the sources that can
 // make up the header value
 type HeaderValue struct {
 	// Allow users to load the value from a secret source
-	*SecretSource `json:"secretSource,omitempty"`
+	*SecretSource `yaml:"secretSource,omitempty"`
 
 	// Allow users to load the value from a session claim
-	*ClaimSource `json:"claimSource,omitempty"`
+	*ClaimSource `yaml:"claimSource,omitempty"`
 }
 
 // ClaimSource allows loading a header value from a claim within the session
@@ -42,14 +42,14 @@ type ClaimSource struct {
 	// Claim is the name of the claim in the session that the value should be
 	// loaded from. Available claims: `access_token` `id_token` `created_at`
 	// `expires_on` `refresh_token` `email` `user` `groups` `preferred_username`.
-	Claim string `json:"claim,omitempty"`
+	Claim string `yaml:"claim,omitempty"`
 
 	// Prefix is an optional prefix that will be prepended to the value of the
 	// claim if it is non-empty.
-	Prefix string `json:"prefix,omitempty"`
+	Prefix string `yaml:"prefix,omitempty"`
 
 	// BasicAuthPassword converts this claim into a basic auth header.
 	// Note the value of claim will become the basic auth username and the
 	// basicAuthPassword will be used as the password value.
-	BasicAuthPassword *SecretSource `json:"basicAuthPassword,omitempty"`
+	BasicAuthPassword *SecretSource `yaml:"basicAuthPassword,omitempty"`
 }

pkg/apis/options/load.go

@@ -9,10 +9,10 @@ import (
 	"strings"
 
 	"github.com/a8m/envsubst"
-	"github.com/ghodss/yaml"
 	"github.com/go-viper/mapstructure/v2"
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
+	"gopkg.in/yaml.v3"
 )
 
 // Load reads in the config file at the path given, then merges in environment
@@ -92,7 +92,7 @@ func Decode(input interface{}, result interface{}) error {
 		DecodeHook:           mapstructure.ComposeDecodeHookFunc(toDurationHookFunc()),
 		Metadata:             nil,    // Don't track any metadata
 		Result:               result, // Decode the result into the prefilled options
-		TagName:              "json", // Parse all fields that use the json tag
+		TagName:              "yaml", // Parse all fields that use the json tag
 		ZeroFields:           false,  // Don't clean the default values from the result map (options)
 		ErrorUnused:          true,   // Throw an error if keys have been used that aren't mapped to any struct fields
 		IgnoreUntaggedFields: true,   // Ignore fields in structures that aren't tagged with json

pkg/apis/options/load_test.go

@@ -355,15 +355,15 @@ var _ = Describe("Load", func() {
 var _ = Describe("LoadYAML", func() {
 	Context("with a testOptions structure", func() {
 		type TestOptionSubStruct struct {
-			StringSliceOption []string `json:"stringSliceOption,omitempty"`
+			StringSliceOption []string `yaml:"stringSliceOption,omitempty"`
 		}
 
 		type TestOptions struct {
-			StringOption string              `json:"stringOption,omitempty"`
-			Sub          TestOptionSubStruct `json:"sub,omitempty"`
+			StringOption string              `yaml:"stringOption,omitempty"`
+			Sub          TestOptionSubStruct `yaml:"sub,omitempty"`
 
 			// Check that embedded fields can be unmarshalled
-			TestOptionSubStruct `json:",inline,squash"`
+			TestOptionSubStruct `yaml:",inline,squash"`
 		}
 
 		var testOptionsConfigBytesFull = []byte(`
@@ -445,7 +445,7 @@ sub:
 				configFile:     []byte("\tfoo: bar"),
 				input:          &TestOptions{},
 				expectedOutput: &TestOptions{},
-				expectedErr:    errors.New("error unmarshalling config: error converting YAML to JSON: yaml: found character that cannot start any token"),
+				expectedErr:    errors.New("error unmarshalling config: yaml: found character that cannot start any token"),
 			}),
 			Entry("with extra fields in the YAML", loadYAMLTableInput{
 				configFile: append(testOptionsConfigBytesFull, []byte("foo: bar\n")...),

pkg/apis/options/login_url_parameters.go

@@ -71,19 +71,19 @@ package options
 // character.
 type LoginURLParameter struct {
 	// Name specifies the name of the query parameter.
-	Name string `json:"name"`
+	Name string `yaml:"name"`
 
 	// Default specifies a default value or values that will be
 	// passed to the IdP if not overridden.
 	//+optional
-	Default []string `json:"default,omitempty"`
+	Default []string `yaml:"default,omitempty"`
 
 	// Allow specifies rules about how the default (if any) may be
 	// overridden via the query string to `/oauth2/start`.  Only
 	// values that match one or more of the allow rules will be
 	// forwarded to the IdP.
 	//+optional
-	Allow []URLParameterRule `json:"allow,omitempty"`
+	Allow []URLParameterRule `yaml:"allow,omitempty"`
 }
 
 // URLParameterRule represents a rule by which query parameters
@@ -92,11 +92,11 @@ type LoginURLParameter struct {
 // login URL.  Either Value or Pattern should be supplied, not both.
 type URLParameterRule struct {
 	// A Value rule matches just this specific value
-	Value *string `json:"value,omitempty"`
+	Value *string `yaml:"value,omitempty"`
 
 	// A Pattern rule gives a regular expression that must be matched by
 	// some substring of the value.  The expression is _not_ automatically
 	// anchored to the start and end of the value, if you _want_ to restrict
 	// the whole parameter value you must anchor it yourself with `^` and `$`.
-	Pattern *string `json:"pattern,omitempty"`
+	Pattern *string `yaml:"pattern,omitempty"`
 }

pkg/apis/options/providers.go

@@ -22,78 +22,78 @@ type Providers []Provider
 type Provider struct {
 	// ClientID is the OAuth Client ID that is defined in the provider
 	// This value is required for all providers.
-	ClientID string `json:"clientID,omitempty"`
+	ClientID string `yaml:"clientID,omitempty"`
 	// ClientSecret is the OAuth Client Secret that is defined in the provider
 	// This value is required for all providers.
-	ClientSecret string `json:"clientSecret,omitempty"`
+	ClientSecret string `yaml:"clientSecret,omitempty"`
 	// ClientSecretFile is the name of the file
 	// containing the OAuth Client Secret, it will be used if ClientSecret is not set.
-	ClientSecretFile string `json:"clientSecretFile,omitempty"`
+	ClientSecretFile string `yaml:"clientSecretFile,omitempty"`
 
 	// KeycloakConfig holds all configurations for Keycloak provider.
-	KeycloakConfig KeycloakOptions `json:"keycloakConfig,omitempty"`
+	KeycloakConfig KeycloakOptions `yaml:"keycloakConfig,omitempty"`
 	// AzureConfig holds all configurations for Azure provider.
-	AzureConfig AzureOptions `json:"azureConfig,omitempty"`
+	AzureConfig AzureOptions `yaml:"azureConfig,omitempty"`
 	// MicrosoftEntraIDConfig holds all configurations for Entra ID provider.
-	MicrosoftEntraIDConfig MicrosoftEntraIDOptions `json:"microsoftEntraIDConfig,omitempty"`
+	MicrosoftEntraIDConfig MicrosoftEntraIDOptions `yaml:"microsoftEntraIDConfig,omitempty"`
 	// ADFSConfig holds all configurations for ADFS provider.
-	ADFSConfig ADFSOptions `json:"ADFSConfig,omitempty"`
+	ADFSConfig ADFSOptions `yaml:"ADFSConfig,omitempty"`
 	// BitbucketConfig holds all configurations for Bitbucket provider.
-	BitbucketConfig BitbucketOptions `json:"bitbucketConfig,omitempty"`
+	BitbucketConfig BitbucketOptions `yaml:"bitbucketConfig,omitempty"`
 	// GitHubConfig holds all configurations for GitHubC provider.
-	GitHubConfig GitHubOptions `json:"githubConfig,omitempty"`
+	GitHubConfig GitHubOptions `yaml:"githubConfig,omitempty"`
 	// GitLabConfig holds all configurations for GitLab provider.
-	GitLabConfig GitLabOptions `json:"gitlabConfig,omitempty"`
+	GitLabConfig GitLabOptions `yaml:"gitlabConfig,omitempty"`
 	// GoogleConfig holds all configurations for Google provider.
-	GoogleConfig GoogleOptions `json:"googleConfig,omitempty"`
+	GoogleConfig GoogleOptions `yaml:"googleConfig,omitempty"`
 	// OIDCConfig holds all configurations for OIDC provider
 	// or providers utilize OIDC configurations.
-	OIDCConfig OIDCOptions `json:"oidcConfig,omitempty"`
+	OIDCConfig OIDCOptions `yaml:"oidcConfig,omitempty"`
 	// LoginGovConfig holds all configurations for LoginGov provider.
-	LoginGovConfig LoginGovOptions `json:"loginGovConfig,omitempty"`
+	LoginGovConfig LoginGovOptions `yaml:"loginGovConfig,omitempty"`
 
 	// ID should be a unique identifier for the provider.
 	// This value is required for all providers.
-	ID string `json:"id,omitempty"`
+	ID string `yaml:"id,omitempty"`
 	// Type is the OAuth provider
 	// must be set from the supported providers group,
 	// otherwise 'Google' is set as default
-	Type ProviderType `json:"provider,omitempty"`
+	Type ProviderType `yaml:"provider,omitempty"`
 	// Name is the providers display name
 	// if set, it will be shown to the users in the login page.
-	Name string `json:"name,omitempty"`
+	Name string `yaml:"name,omitempty"`
 	// CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.
 	// If not specified, the default Go trust sources are used instead
-	CAFiles []string `json:"caFiles,omitempty"`
+	CAFiles []string `yaml:"caFiles,omitempty"`
 	// UseSystemTrustStore determines if your custom CA files and the system trust store are used
 	// If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files.
-	UseSystemTrustStore bool `json:"useSystemTrustStore,omitempty"`
+	UseSystemTrustStore bool `yaml:"useSystemTrustStore,omitempty"`
 	// LoginURL is the authentication endpoint
-	LoginURL string `json:"loginURL,omitempty"`
+	LoginURL string `yaml:"loginURL,omitempty"`
 	// LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL
-	LoginURLParameters []LoginURLParameter `json:"loginURLParameters,omitempty"`
+	LoginURLParameters []LoginURLParameter `yaml:"loginURLParameters,omitempty"`
 	// AuthRequestResponseMode defines the response mode to request during authorization request
-	AuthRequestResponseMode string `json:"authRequestResponseMode,omitempty"`
+	AuthRequestResponseMode string `yaml:"authRequestResponseMode,omitempty"`
 	// RedeemURL is the token redemption endpoint
-	RedeemURL string `json:"redeemURL,omitempty"`
+	RedeemURL string `yaml:"redeemURL,omitempty"`
 	// ProfileURL is the profile access endpoint
-	ProfileURL string `json:"profileURL,omitempty"`
+	ProfileURL string `yaml:"profileURL,omitempty"`
 	// SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token
 	// default set to 'false'
-	SkipClaimsFromProfileURL bool `json:"skipClaimsFromProfileURL,omitempty"`
+	SkipClaimsFromProfileURL bool `yaml:"skipClaimsFromProfileURL,omitempty"`
 	// ProtectedResource is the resource that is protected (Azure AD and ADFS only)
-	ProtectedResource string `json:"resource,omitempty"`
+	ProtectedResource string `yaml:"resource,omitempty"`
 	// ValidateURL is the access token validation endpoint
-	ValidateURL string `json:"validateURL,omitempty"`
+	ValidateURL string `yaml:"validateURL,omitempty"`
 	// Scope is the OAuth scope specification
-	Scope string `json:"scope,omitempty"`
+	Scope string `yaml:"scope,omitempty"`
 	// AllowedGroups is a list of restrict logins to members of this group
-	AllowedGroups []string `json:"allowedGroups,omitempty"`
+	AllowedGroups []string `yaml:"allowedGroups,omitempty"`
 	// The code challenge method
-	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+	CodeChallengeMethod string `yaml:"code_challenge_method,omitempty"`
 
 	// URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session
-	BackendLogoutURL string `json:"backendLogoutURL"`
+	BackendLogoutURL string `yaml:"backendLogoutURL"`
 }
 
 // ProviderType is used to enumerate the different provider type options
@@ -157,19 +157,19 @@ const (
 
 type KeycloakOptions struct {
 	// Group enables to restrict login to members of indicated group
-	Groups []string `json:"groups,omitempty"`
+	Groups []string `yaml:"groups,omitempty"`
 
 	// Role enables to restrict login to users with role (only available when using the keycloak-oidc provider)
-	Roles []string `json:"roles,omitempty"`
+	Roles []string `yaml:"roles,omitempty"`
 }
 
 type AzureOptions struct {
 	// Tenant directs to a tenant-specific or common (tenant-independent) endpoint
 	// Default value is 'common'
-	Tenant string `json:"tenant,omitempty"`
+	Tenant string `yaml:"tenant,omitempty"`
 	// GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph
 	// Default value is 'id'
-	GraphGroupField string `json:"graphGroupField,omitempty"`
+	GraphGroupField string `yaml:"graphGroupField,omitempty"`
 }
 
 type MicrosoftEntraIDOptions struct {
@@ -177,114 +177,114 @@ type MicrosoftEntraIDOptions struct {
 	// issued by different issuers and OIDC issuer verification needs to be disabled.
 	// When not specified, all tenants are allowed. Redundant for single-tenant apps
 	// (regular ID token validation matches the issuer).
-	AllowedTenants []string `json:"allowedTenants,omitempty"`
+	AllowedTenants []string `yaml:"allowedTenants,omitempty"`
 
 	// FederatedTokenAuth enable oAuth2 client authentication with federated token projected
 	// by Entra Workload Identity plugin, instead of client secret.
-	FederatedTokenAuth bool `json:"federatedTokenAuth,omitempty"`
+	FederatedTokenAuth bool `yaml:"federatedTokenAuth,omitempty"`
 }
 
 type ADFSOptions struct {
 	// Skip adding the scope parameter in login request
 	// Default value is 'false'
-	SkipScope bool `json:"skipScope,omitempty"`
+	SkipScope bool `yaml:"skipScope,omitempty"`
 }
 
 type BitbucketOptions struct {
 	// Team sets restrict logins to members of this team
-	Team string `json:"team,omitempty"`
+	Team string `yaml:"team,omitempty"`
 	// Repository sets restrict logins to user with access to this repository
-	Repository string `json:"repository,omitempty"`
+	Repository string `yaml:"repository,omitempty"`
 }
 
 type GitHubOptions struct {
 	// Org sets restrict logins to members of this organisation
-	Org string `json:"org,omitempty"`
+	Org string `yaml:"org,omitempty"`
 	// Team sets restrict logins to members of this team
-	Team string `json:"team,omitempty"`
+	Team string `yaml:"team,omitempty"`
 	// Repo sets restrict logins to collaborators of this repository
-	Repo string `json:"repo,omitempty"`
+	Repo string `yaml:"repo,omitempty"`
 	// Token is the token to use when verifying repository collaborators
 	// it must have push access to the repository
-	Token string `json:"token,omitempty"`
+	Token string `yaml:"token,omitempty"`
 	// Users allows users with these usernames to login
 	// even if they do not belong to the specified org and team or collaborators
-	Users []string `json:"users,omitempty"`
+	Users []string `yaml:"users,omitempty"`
 }
 
 type GitLabOptions struct {
 	// Group sets restrict logins to members of this group
-	Group []string `json:"group,omitempty"`
+	Group []string `yaml:"group,omitempty"`
 	// Projects restricts logins to members of these projects
-	Projects []string `json:"projects,omitempty"`
+	Projects []string `yaml:"projects,omitempty"`
 }
 
 type GoogleOptions struct {
 	// Groups sets restrict logins to members of this Google group
-	Groups []string `json:"group,omitempty"`
+	Groups []string `yaml:"group,omitempty"`
 	// AdminEmail is the Google admin to impersonate for api calls
-	AdminEmail string `json:"adminEmail,omitempty"`
+	AdminEmail string `yaml:"adminEmail,omitempty"`
 	// ServiceAccountJSON is the path to the service account json credentials
-	ServiceAccountJSON string `json:"serviceAccountJson,omitempty"`
+	ServiceAccountJSON string `yaml:"serviceAccountJson,omitempty"`
 	// UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON
-	UseApplicationDefaultCredentials bool `json:"useApplicationDefaultCredentials,omitempty"`
+	UseApplicationDefaultCredentials bool `yaml:"useApplicationDefaultCredentials,omitempty"`
 	// TargetPrincipal is the Google Service Account used for Application Default Credentials
-	TargetPrincipal string `json:"targetPrincipal,omitempty"`
+	TargetPrincipal string `yaml:"targetPrincipal,omitempty"`
 	// UseOrganizationId indicates whether to use the organization ID as the UserName claim
-	UseOrganizationID bool `json:"useOrganizationID,omitempty"`
+	UseOrganizationID bool `yaml:"useOrganizationID,omitempty"`
 	// admin scope needed for fetching user organization information from admin api, can be one of cloud, user or defaults to readonly
-	AdminAPIUserScope string `json:"adminAPIUserScope,omitempty"`
+	AdminAPIUserScope string `yaml:"adminAPIUserScope,omitempty"`
 }
 
 type OIDCOptions struct {
 	// IssuerURL is the OpenID Connect issuer URL
 	// eg: https://accounts.google.com
-	IssuerURL string `json:"issuerURL,omitempty"`
+	IssuerURL string `yaml:"issuerURL,omitempty"`
 	// InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified
 	// default set to 'false'
-	InsecureAllowUnverifiedEmail bool `json:"insecureAllowUnverifiedEmail"`
+	InsecureAllowUnverifiedEmail bool `yaml:"insecureAllowUnverifiedEmail"`
 	// InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL
 	// default set to 'false'
-	InsecureSkipIssuerVerification bool `json:"insecureSkipIssuerVerification"`
+	InsecureSkipIssuerVerification bool `yaml:"insecureSkipIssuerVerification"`
 	// InsecureSkipNonce skips verifying the ID Token's nonce claim that must match
 	// the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked
 	// after the initial OAuth redeem & subsequent token refreshes.
 	// default set to 'true'
 	// Warning: In a future release, this will change to 'false' by default for enhanced security.
-	InsecureSkipNonce bool `json:"insecureSkipNonce"`
+	InsecureSkipNonce bool `yaml:"insecureSkipNonce"`
 	// SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints
 	// default set to 'false'
-	SkipDiscovery bool `json:"skipDiscovery,omitempty"`
+	SkipDiscovery bool `yaml:"skipDiscovery,omitempty"`
 	// JwksURL is the OpenID Connect JWKS URL
 	// eg: https://www.googleapis.com/oauth2/v3/certs
-	JwksURL string `json:"jwksURL,omitempty"`
+	JwksURL string `yaml:"jwksURL,omitempty"`
 	// PublicKeyFiles is a list of paths pointing to public key files in PEM format to use
 	// for verifying JWT tokens
-	PublicKeyFiles []string `json:"publicKeyFiles,omitempty"`
+	PublicKeyFiles []string `yaml:"publicKeyFiles,omitempty"`
 	// EmailClaim indicates which claim contains the user email,
 	// default set to 'email'
-	EmailClaim string `json:"emailClaim,omitempty"`
+	EmailClaim string `yaml:"emailClaim,omitempty"`
 	// GroupsClaim indicates which claim contains the user groups
 	// default set to 'groups'
-	GroupsClaim string `json:"groupsClaim,omitempty"`
+	GroupsClaim string `yaml:"groupsClaim,omitempty"`
 	// UserIDClaim indicates which claim contains the user ID
 	// default set to 'email'
-	UserIDClaim string `json:"userIDClaim,omitempty"`
+	UserIDClaim string `yaml:"userIDClaim,omitempty"`
 	// AudienceClaim allows to define any claim that is verified against the client id
 	// By default `aud` claim is used for verification.
-	AudienceClaims []string `json:"audienceClaims,omitempty"`
+	AudienceClaims []string `yaml:"audienceClaims,omitempty"`
 	// ExtraAudiences is a list of additional audiences that are allowed
 	// to pass verification in addition to the client id.
-	ExtraAudiences []string `json:"extraAudiences,omitempty"`
+	ExtraAudiences []string `yaml:"extraAudiences,omitempty"`
 }
 
 type LoginGovOptions struct {
 	// JWTKey is a private key in PEM format used to sign JWT,
-	JWTKey string `json:"jwtKey,omitempty"`
+	JWTKey string `yaml:"jwtKey,omitempty"`
 	// JWTKeyFile is a path to the private key file in PEM format used to sign the JWT
-	JWTKeyFile string `json:"jwtKeyFile,omitempty"`
+	JWTKeyFile string `yaml:"jwtKeyFile,omitempty"`
 	// PubJWKURL is the JWK pubkey access endpoint
-	PubJWKURL string `json:"pubjwkURL,omitempty"`
+	PubJWKURL string `yaml:"pubjwkURL,omitempty"`
 }
 
 func providerDefaults() Providers {

pkg/apis/options/secret_source.go

@@ -4,11 +4,11 @@ package options
 // Only one source within the struct should be defined at any time.
 type SecretSource struct {
 	// Value expects a base64 encoded string value.
-	Value string `json:"value,omitempty"`
+	Value string `yaml:"value,omitempty"`
 
 	// FromEnv expects the name of an environment variable.
-	FromEnv string `json:"fromEnv,omitempty"`
+	FromEnv string `yaml:"fromEnv,omitempty"`
 
 	// FromFile expects a path to a file containing the secret value.
-	FromFile string `json:"fromFile,omitempty"`
+	FromFile string `yaml:"fromFile,omitempty"`
 }

pkg/apis/options/server.go

@@ -4,15 +4,15 @@ package options
 type Server struct {
 	// BindAddress is the address on which to serve traffic.
 	// Leave blank or set to "-" to disable.
-	BindAddress string
+	BindAddress string `yaml:"bindAddress,omitempty"`
 
 	// SecureBindAddress is the address on which to serve secure traffic.
 	// Leave blank or set to "-" to disable.
-	SecureBindAddress string
+	SecureBindAddress string `yaml:"secureBindAddress,omitempty"`
 
 	// TLS contains the information for loading the certificate and key for the
 	// secure traffic and further configuration for the TLS server.
-	TLS *TLS
+	TLS *TLS `yaml:"tls,omitempty"`
 }
 
 // TLS contains the information for loading a TLS certificate and key
@@ -20,15 +20,15 @@ type Server struct {
 type TLS struct {
 	// Key is the TLS key data to use.
 	// Typically this will come from a file.
-	Key *SecretSource
+	Key *SecretSource `yaml:"key,omitempty"`
 
 	// Cert is the TLS certificate data to use.
 	// Typically this will come from a file.
-	Cert *SecretSource
+	Cert *SecretSource `yaml:"cert,omitempty"`
 
 	// MinVersion is the minimal TLS version that is acceptable.
 	// E.g. Set to "TLS1.3" to select TLS version 1.3
-	MinVersion string
+	MinVersion string `yaml:"minVersion,omitempty"`
 
 	// CipherSuites is a list of TLS cipher suites that are allowed.
 	// E.g.:
@@ -36,5 +36,5 @@ type TLS struct {
 	// - TLS_RSA_WITH_AES_256_GCM_SHA384
 	// If not specified, the default Go safe cipher list is used.
 	// List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants).
-	CipherSuites []string
+	CipherSuites []string `yaml:"cipherSuites,omitempty"`
 }

pkg/apis/options/upstreams.go

@@ -14,11 +14,11 @@ const (
 type UpstreamConfig struct {
 	// ProxyRawPath will pass the raw url path to upstream allowing for urls
 	// like: "/%2F/" which would otherwise be redirected to "/"
-	ProxyRawPath bool `json:"proxyRawPath,omitempty"`
+	ProxyRawPath bool `yaml:"proxyRawPath,omitempty"`
 
 	// Upstreams represents the configuration for the upstream servers.
 	// Requests will be proxied to this upstream if the path matches the request path.
-	Upstreams []Upstream `json:"upstreams,omitempty"`
+	Upstreams []Upstream `yaml:"upstreams,omitempty"`
 }
 
 // Upstream represents the configuration for an upstream server.
@@ -26,7 +26,7 @@ type UpstreamConfig struct {
 type Upstream struct {
 	// ID should be a unique identifier for the upstream.
 	// This value is required for all upstreams.
-	ID string `json:"id,omitempty"`
+	ID string `yaml:"id,omitempty"`
 
 	// Path is used to map requests to the upstream server.
 	// The closest match will take precedence and all Paths must be unique.
@@ -36,7 +36,7 @@ type Upstream struct {
 	// - `^/foo$`: Match only the explicit path `/foo`
 	// - `^/bar/$`: Match any path prefixed with `/bar/`
 	// - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget
-	Path string `json:"path,omitempty"`
+	Path string `yaml:"path,omitempty"`
 
 	// RewriteTarget allows users to rewrite the request path before it is sent to
 	// the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem
@@ -46,7 +46,7 @@ type Upstream struct {
 	// the request `/baz/abc/123` to `/foo/abc/123` before proxying to the
 	// upstream server.  Or if the upstream were `file:///app`, a request for
 	// `/baz/info.html` would return the contents of the file `/app/foo/info.html`.
-	RewriteTarget string `json:"rewriteTarget,omitempty"`
+	RewriteTarget string `yaml:"rewriteTarget,omitempty"`
 
 	// The URI of the upstream server. This may be an HTTP(S) server of a File
 	// based URL. It may include a path, in which case all requests will be served
@@ -58,43 +58,43 @@ type Upstream struct {
 	// - file://host/path
 	// If the URI's path is "/base" and the incoming request was for "/dir",
 	// the upstream request will be for "/base/dir".
-	URI string `json:"uri,omitempty"`
+	URI string `yaml:"uri,omitempty"`
 
 	// InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
 	// This option is insecure and will allow potential Man-In-The-Middle attacks
 	// between OAuth2 Proxy and the upstream server.
 	// Defaults to false.
-	InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`
+	InsecureSkipTLSVerify bool `yaml:"insecureSkipTLSVerify,omitempty"`
 
 	// Static will make all requests to this upstream have a static response.
 	// The response will have a body of "Authenticated" and a response code
 	// matching StaticCode.
 	// If StaticCode is not set, the response will return a 200 response.
-	Static bool `json:"static,omitempty"`
+	Static bool `yaml:"static,omitempty"`
 
 	// StaticCode determines the response code for the Static response.
 	// This option can only be used with Static enabled.
-	StaticCode *int `json:"staticCode,omitempty"`
+	StaticCode *int `yaml:"staticCode,omitempty"`
 
 	// FlushInterval is the period between flushing the response buffer when
 	// streaming response from the upstream.
 	// Defaults to 1 second.
-	FlushInterval *time.Duration `json:"flushInterval,omitempty"`
+	FlushInterval *time.Duration `yaml:"flushInterval,omitempty"`
 
 	// PassHostHeader determines whether the request host header should be proxied
 	// to the upstream server.
 	// Defaults to true.
-	PassHostHeader *bool `json:"passHostHeader,omitempty"`
+	PassHostHeader *bool `yaml:"passHostHeader,omitempty"`
 
 	// ProxyWebSockets enables proxying of websockets to upstream servers
 	// Defaults to true.
-	ProxyWebSockets *bool `json:"proxyWebSockets,omitempty"`
+	ProxyWebSockets *bool `yaml:"proxyWebSockets,omitempty"`
 
 	// Timeout is the maximum duration the server will wait for a response from the upstream server.
 	// Defaults to 30 seconds.
-	Timeout *time.Duration `json:"timeout,omitempty"`
+	Timeout *time.Duration `yaml:"timeout,omitempty"`
 
 	// DisableKeepAlives disables HTTP keep-alive connections to the upstream server.
 	// Defaults to false.
-	DisableKeepAlives bool `json:"disableKeepAlives,omitempty"`
+	DisableKeepAlives bool `yaml:"disableKeepAlives,omitempty"`
 }

pkg/requests/result_test.go

@@ -104,8 +104,8 @@ var _ = Describe("Result suite", func() {
 
 	Context("UnmarshalInto", func() {
 		type testStruct struct {
-			A string `json:"a"`
-			B int    `json:"b"`
+			A string `yaml:"a"`
+			B int    `yaml:"b"`
 		}
 
 		type unmarshalIntoTableInput struct {