# Default chart values. Real pins live in values/*.yaml — never promote a tag.
name: flex-auth
namespace: flex-auth

image:
  repository: forgejo.coulomb.social/coulomb/flex-auth
  digest: ""
  pullPolicy: IfNotPresent

replicaCount: 1

# Inert until enabled for an approved pin. The outbox is single-writer.
outbox:
  enabled: false
  source: ""
  mountPath: /var/lib/flex-auth/outbox
  size: 1Gi
  # Source ceiling; PVC requested capacity alone is not a filesystem quota.
  maxBytes: 67108864
  storageClassName: ""
  existingClaim: ""

# Inert preparation: caller provides reviewed existing Secret and exact receiver.
# The chart never creates/mints sender credentials or registers a sender.
auditDelivery:
  enabled: false
  url: ""
  secretName: ""
  secretKey: ""
  mountPath: /var/run/secrets/flex-auth-audit
  receiverNamespace: ""
  receiverPodName: ""
  receiverPort: 0
  dnsNamespace: ""
  dnsPodLabel: ""

args:
  - serve
  - --addr
  - 0.0.0.0:8080
  - --registry
  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
  - --policy
  - /opt/flex-auth/examples/tenant-engine/policy_package.md

service:
  port: 8080

health:
  path: /healthz

consumer:
  isolated: false
  namespace: ""
  podName: ""

# disabled keeps the image bootable without TokenReview (isolated canary).
# Production pins set warn, then enforce, independently per consumer.
# serve-readback pins (FLEX-WP-0035) admit one readback caller via
# --readback-caller instead of --caller-binding.
readback:
  enabled: false
  caller: ""

callerAuth:
  mode: disabled
  audience: flex-auth
  kubernetesURL: https://kubernetes.default.svc
  binding: ""
  # Further resource.system=principal pairs, each rendered as its own
  # --caller-binding (e.g. ops-warden-fetch binds every catalog owner system
  # to the ops-warden ServiceAccount).
  extraBindings: []
  reviewer:
    mountPath: /var/run/secrets/flex-auth-reviewer
    # Empty: kubelet mints the API server's default audiences so TokenReview
    # authenticates. A custom audience (e.g. https://kubernetes.default.svc)
    # 401s on this k3s cluster, whose API audiences are
    # https://kubernetes.default.svc.cluster.local and k3s.
    audience: ""
    expirationSeconds: 3600

resources:
  requests:
    cpu: 25m
    memory: 32Mi
  limits:
    cpu: 300m
    memory: 192Mi

# Inert until an independently admitted signer and existing custody Secret exist.
envelopeSigning:
  enabled: false
  kid: ""
  secretName: ""
  secretKey: ""
  mountPath: /var/run/secrets/decision-envelope-signing