coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/values/tenant-engine.yaml

24 lines
813 B
YAML
Raw Permalink Normal View History

Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
# Production pin for the tenant-engine policy service. Independently rollable.
Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after tenant-engine 2063470 started sending a projected caller token (sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04 cancelled: AuthZEN waits for a PEP we do not control.
2026-08-19 14:35:27 +02:00
# Caller-auth pin. Warn logs on 2026-08-19 were clean for the tenant-engine
# projected token after image sha256:7dc9d7bf… started sending it.
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
name: flex-auth-tenant-engine
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
args:
- serve
- --addr
- 0.0.0.0:8080
- --registry
- /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
- --policy
- /opt/flex-auth/examples/tenant-engine/policy_package.md
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
callerAuth:
Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after tenant-engine 2063470 started sending a projected caller token (sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04 cancelled: AuthZEN waits for a PEP we do not control.
2026-08-19 14:35:27 +02:00
mode: enforce
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
kubernetesURL: https://10.43.0.1
binding: tenant-engine=system:serviceaccount:tenant-engine:tenant-engine
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
consumer:
isolated: false
namespace: tenant-engine
podName: tenant-engine
Reference in a new issue Copy permalink