tegwick
b429dcba8a
values/ops-warden.yaml and its generated twin values/access-engine/ops-warden.yaml move from sha256:138aa347 (main-3de72fe, rollback target) to sha256:f7c04991a54ebc5fd2a55939e2f68efc7400a51f8773fb6703487833c65b3893. No Argo application; rollout is an attended helm upgrade (FLEX-WP-0037-T03). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
22 lines
807 B
YAML
22 lines
807 B
YAML
# Independently rollable ops-warden signing-policy pin (FLEX-WP-0016).
|
|
# Isolated: workstation reaches it by port-forward/tunnel. Binding matches
|
|
# ServiceAccount ops-warden/ops-warden (WARDEN-WP-0031). Enforce after their
|
|
# T04 authenticated gate held the warn-log count at 4.
|
|
name: flex-auth-ops-warden
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/flex-auth
|
|
digest: sha256:f7c04991a54ebc5fd2a55939e2f68efc7400a51f8773fb6703487833c65b3893
|
|
args:
|
|
- serve
|
|
- --addr
|
|
- 0.0.0.0:8080
|
|
- --registry
|
|
- /opt/flex-auth/examples/ops-warden/production_registry_snapshot.json
|
|
- --policy
|
|
- /opt/flex-auth/examples/ops-warden/policy_package.md
|
|
callerAuth:
|
|
mode: enforce
|
|
kubernetesURL: https://10.43.0.1
|
|
binding: ops-warden=system:serviceaccount:ops-warden:ops-warden
|
|
consumer:
|
|
isolated: true
|