Is Pinniped working with Kubernetes clusters hosted on Digitalocean?

[junoriosity]

I am interested in using Pinniped on my Kubernetes cluster hosted on Digitalocean. However, it is not listed here (https://pinniped.dev/docs/reference/supported-clusters/),

Can you tell me whether it works for Kubernetes clusters there?

[margocrawf]

tl;dr is that Pinniped on DigitalOcean should work when you follow the default install instructions on our website, but the Pinniped team hasn't tried it ourselves. We would like to verify that it works when we have the chance, but if you want to try it out before then we would love to hear how it goes.

For a little more context on why:

The Pinniped Concierge has two "strategies", one of which is the ImpersonationProxy strategy that works automatically on any cluster that supports LoadBalancer services, which includes DigitalOcean. When this strategy is run, it will automatically procure a load balancer service to provide network access to our impersonation proxy, which sits in front of the K8s API server and executes commands on behalf of the user.

The other strategy, the KubeClusterSigningCertificate strategy, requires that Pinniped have access to the Kubernetes control plane, which is an uncommon setup on hosted Kubernetes distributions like digital ocean. I don't know for sure whether it will work but it is fine if it doesn't because Pinniped can use the ImpersonationProxy instead.

You can deploy the concierge with the CredentialIssuer's spec.impersonationProxy.mode set to auto, which means it will automatically check if it can do the KubeClusterSigningCertificate strategy, and if it can't, it will try the ImpersonationProxy strategy.
This is the default configuration that we have instructions for on our website here, so if you just copy and paste the kubectl or kapp install instructions, it should work.

If you do this, you can check which strategy it is running in by running kubectl get credentialissuers and checking the DEFAULTSTRATEGY. Please let us know what you find out :)