tegwick
36465de299
Chart default request 25m/32Mi -> 5m/20Mi (user-engine, tenant-engine, ops-warden, ops-warden-fetch, secrets-engine); overrides keep 5m CPU with memory by 7d p95 x1.15: application-readback 24Mi, informed-decision-lifecycle 24Mi, informed-decision-sitting 40Mi (p95 35Mi, up from 32Mi), informed-decision-t03 16Mi. Limits unchanged. Evidence: resource-control 2026-10-21 node budget (3d9b1bd). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 276069@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
97 lines
2.5 KiB
YAML
97 lines
2.5 KiB
YAML
# Default chart values. Real pins live in values/*.yaml — never promote a tag.
|
|
name: flex-auth
|
|
namespace: flex-auth
|
|
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/flex-auth
|
|
digest: ""
|
|
pullPolicy: IfNotPresent
|
|
|
|
replicaCount: 1
|
|
|
|
# Inert until enabled for an approved pin. The outbox is single-writer.
|
|
outbox:
|
|
enabled: false
|
|
source: ""
|
|
mountPath: /var/lib/flex-auth/outbox
|
|
size: 1Gi
|
|
# Source ceiling; PVC requested capacity alone is not a filesystem quota.
|
|
maxBytes: 67108864
|
|
storageClassName: ""
|
|
existingClaim: ""
|
|
|
|
# Inert preparation: caller provides reviewed existing Secret and exact receiver.
|
|
# The chart never creates/mints sender credentials or registers a sender.
|
|
auditDelivery:
|
|
enabled: false
|
|
url: ""
|
|
secretName: ""
|
|
secretKey: ""
|
|
mountPath: /var/run/secrets/flex-auth-audit
|
|
receiverNamespace: ""
|
|
receiverPodName: ""
|
|
receiverPort: 0
|
|
dnsNamespace: ""
|
|
dnsPodLabel: ""
|
|
|
|
args:
|
|
- serve
|
|
- --addr
|
|
- 0.0.0.0:8080
|
|
- --registry
|
|
- /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
|
|
- --policy
|
|
- /opt/flex-auth/examples/tenant-engine/policy_package.md
|
|
|
|
service:
|
|
port: 8080
|
|
|
|
health:
|
|
path: /healthz
|
|
|
|
consumer:
|
|
isolated: false
|
|
namespace: ""
|
|
podName: ""
|
|
|
|
# disabled keeps the image bootable without TokenReview (isolated canary).
|
|
# Production pins set warn, then enforce, independently per consumer.
|
|
# serve-readback pins (FLEX-WP-0035) admit one readback caller via
|
|
# --readback-caller instead of --caller-binding.
|
|
readback:
|
|
enabled: false
|
|
caller: ""
|
|
|
|
callerAuth:
|
|
mode: disabled
|
|
audience: flex-auth
|
|
kubernetesURL: https://kubernetes.default.svc
|
|
binding: ""
|
|
# Further resource.system=principal pairs, each rendered as its own
|
|
# --caller-binding (e.g. ops-warden-fetch binds every catalog owner system
|
|
# to the ops-warden ServiceAccount).
|
|
extraBindings: []
|
|
reviewer:
|
|
mountPath: /var/run/secrets/flex-auth-reviewer
|
|
# Empty: kubelet mints the API server's default audiences so TokenReview
|
|
# authenticates. A custom audience (e.g. https://kubernetes.default.svc)
|
|
# 401s on this k3s cluster, whose API audiences are
|
|
# https://kubernetes.default.svc.cluster.local and k3s.
|
|
audience: ""
|
|
expirationSeconds: 3600
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 5m
|
|
memory: 20Mi
|
|
limits:
|
|
cpu: 300m
|
|
memory: 192Mi
|
|
|
|
# Inert until an independently admitted signer and existing custody Secret exist.
|
|
envelopeSigning:
|
|
enabled: false
|
|
kid: ""
|
|
secretName: ""
|
|
secretKey: ""
|
|
mountPath: /var/run/secrets/decision-envelope-signing
|