access-engine: secret-read evaluator for warden fetch checks (CUST-WP-0075)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

charts/flex-auth/templates/deployment.yaml

@@ -39,6 +39,10 @@ spec:
             - {{ required "callerAuth.kubernetesURL is required when callerAuth.mode is warn or enforce" .Values.callerAuth.kubernetesURL | quote }}
             - --caller-binding
             - {{ $binding | quote }}
+            {{- range .Values.callerAuth.extraBindings }}
+            - --caller-binding
+            - {{ . | quote }}
+            {{- end }}
             {{- end }}
           ports:
             - name: http

charts/flex-auth/values.yaml

@@ -36,6 +36,10 @@ callerAuth:
   audience: flex-auth
   kubernetesURL: https://kubernetes.default.svc
   binding: ""
+  # Further resource.system=principal pairs, each rendered as its own
+  # --caller-binding (e.g. ops-warden-fetch binds every catalog owner system
+  # to the ops-warden ServiceAccount).
+  extraBindings: []
   reviewer:
     mountPath: /var/run/secrets/flex-auth-reviewer
     # Empty: kubelet mints the API server's default audiences so TokenReview