30 lines
1.3 KiB
YAML
30 lines
1.3 KiB
YAML
# ops-warden secret-read pin (CUST-WP-0075, access-engine ADHOC-2026-10-03).
|
|
# Answers warden check_fetch_policy: action read on resource type secret, system =
|
|
# the lane's owner_repo. Separate from flex-auth-ops-warden (SSH signing) so each
|
|
# decision class rolls independently (FLEX-WP-0016). Isolated: the workstation
|
|
# reaches it through the ops-bridge tunnel flex-auth-ops-warden-fetch-railiance01
|
|
# (127.0.0.1:19091). Every owner system is bound to the ops-warden ServiceAccount,
|
|
# so only ops-warden may ask; callerAuth enforce as on the signing pin.
|
|
#
|
|
# GENERATED by tools/gen_ops_warden_fetch.py from ops-warden's routing catalog,
|
|
# except image.digest, which the script preserves. Regenerate, do not hand-edit.
|
|
name: flex-auth-ops-warden-fetch
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/flex-auth
|
|
digest: sha256:419bc37420d0d0a5304a8587448f1fdbf87117fb041fb43081b0449b4a7bb13b
|
|
args:
|
|
- serve
|
|
- --addr
|
|
- 0.0.0.0:8080
|
|
- --registry
|
|
- /opt/flex-auth/examples/ops-warden-fetch/registry_snapshot.json
|
|
- --policy
|
|
- /opt/flex-auth/examples/ops-warden-fetch/policy_package.md
|
|
callerAuth:
|
|
mode: enforce
|
|
kubernetesURL: https://10.43.0.1
|
|
binding: key-cape=system:serviceaccount:ops-warden:ops-warden
|
|
extraBindings:
|
|
- railiance-platform=system:serviceaccount:ops-warden:ops-warden
|
|
consumer:
|
|
isolated: true
|