access-engine/charts/flex-auth/templates/serviceaccount.yaml

{{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "flex-auth.name" . }}
  labels:
    {{- include "flex-auth.labels" . | nindent 4 }}
automountServiceAccountToken: false
{{- end }}
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine. 2026-08-19 12:31:08 +02:00			`{{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}`
			`apiVersion: v1`
			`kind: ServiceAccount`
			`metadata:`
			`name: {{ include "flex-auth.name" . }}`
			`labels:`
			`{{- include "flex-auth.labels" . \| nindent 4 }}`
			`automountServiceAccountToken: false`
			`{{- end }}`