# ops-warden secret-read pin (CUST-WP-0075, access-engine ADHOC-2026-10-03).
# Answers warden check_fetch_policy: action read on resource type secret, system =
# the lane's owner_repo. Separate from flex-auth-ops-warden (SSH signing) so each
# decision class rolls independently (FLEX-WP-0016). Isolated: the workstation
# reaches it through the ops-bridge tunnel flex-auth-ops-warden-fetch-railiance01
# (127.0.0.1:19091). Every owner system is bound to the ops-warden ServiceAccount,
# so only ops-warden may ask; callerAuth enforce as on the signing pin.
#
# GENERATED by tools/gen_ops_warden_fetch.py from ops-warden's routing catalog,
# except image.digest, which the script preserves. Regenerate, do not hand-edit.
name: flex-auth-ops-warden-fetch
image:
  repository: forgejo.coulomb.social/coulomb/flex-auth
  digest: sha256:419bc37420d0d0a5304a8587448f1fdbf87117fb041fb43081b0449b4a7bb13b
args:
  - serve
  - --addr
  - 0.0.0.0:8080
  - --registry
  - /opt/flex-auth/examples/ops-warden-fetch/registry_snapshot.json
  - --policy
  - /opt/flex-auth/examples/ops-warden-fetch/policy_package.md
callerAuth:
  mode: enforce
  kubernetesURL: https://10.43.0.1
  binding: key-cape=system:serviceaccount:ops-warden:ops-warden
  extraBindings:
    - railiance-platform=system:serviceaccount:ops-warden:ops-warden
consumer:
  isolated: true