tegwick
56a0efe679
The shared chart emits railiance.io/release-unit only when releaseUnit is set, and only this release sets it. The claim names the live Deployment and its image digest. RELREG-WP-0002-T01 Assistant: grok Assistant-Session: 01a15f9f-3d77-7d21-911b-d93c86f9d14f
25 lines
914 B
YAML
25 lines
914 B
YAML
# Dedicated secrets-engine policy service; CI build dd8dd517438b876fdadf27770e3f7e7f55ea69cf.
|
|
name: flex-auth-secrets-engine
|
|
# Only this release claims the unit. Other flex-auth pins leave the label unset.
|
|
releaseUnit: flex-auth-secrets-engine
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/flex-auth
|
|
digest: sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd
|
|
args:
|
|
- serve
|
|
- --addr
|
|
- 0.0.0.0:8080
|
|
- --registry
|
|
- /opt/flex-auth/examples/secrets-engine/registry_snapshot.json
|
|
- --policy
|
|
- /opt/flex-auth/examples/secrets-engine/policy_package.md
|
|
callerAuth:
|
|
mode: enforce
|
|
# Retained runtime audience is explicit; signer preparation does not rename it.
|
|
audience: flex-auth
|
|
kubernetesURL: https://10.43.0.1
|
|
binding: secrets-engine=system:serviceaccount:secrets-engine:secrets-engine
|
|
consumer:
|
|
isolated: false
|
|
namespace: secrets-engine
|
|
podName: secrets-engine
|