# Default chart values. Real pins live in values/*.yaml — never promote a tag.
name: flex-auth
namespace: flex-auth

image:
  repository: forgejo.coulomb.social/coulomb/flex-auth
  digest: ""
  pullPolicy: IfNotPresent

replicaCount: 1

args:
  - serve
  - --addr
  - 0.0.0.0:8080
  - --registry
  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
  - --policy
  - /opt/flex-auth/examples/tenant-engine/policy_package.md

service:
  port: 8080

health:
  path: /healthz

consumer:
  isolated: false
  namespace: ""
  podName: ""

# disabled keeps the image bootable without TokenReview (isolated canary).
# Production pins set warn, then enforce, independently per consumer.
callerAuth:
  mode: disabled
  audience: flex-auth
  kubernetesURL: https://kubernetes.default.svc
  binding: ""
  reviewer:
    mountPath: /var/run/secrets/flex-auth-reviewer
    audience: https://kubernetes.default.svc
    expirationSeconds: 3600

resources:
  requests:
    cpu: 25m
    memory: 32Mi
  limits:
    cpu: 300m
    memory: 192Mi