Add scoped LLDAP identity provisioner

identity-provisioner/copy-client-secret.py

@@ -0,0 +1,18 @@
+"""Copy only the provisioner token into a namespace-local client Secret."""
+
+import json
+import sys
+
+
+source = json.load(sys.stdin)
+target = {
+    "apiVersion": "v1",
+    "kind": "Secret",
+    "metadata": {
+        "name": "identity-provisioner-client",
+        "namespace": "user-engine",
+    },
+    "type": "Opaque",
+    "data": {"token": source["data"]["token"]},
+}
+json.dump(target, sys.stdout)