coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/values/user-engine.yaml

25 lines
848 B
YAML
Raw Permalink Normal View History

Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
# Production pin for the user-engine policy service. Independently rollable.
Enforce caller-auth on flex-auth-user-engine and record the live A2 probe Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347 warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens must use the API default audiences or TokenReview 401s on this k3s. Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine is unchanged. tenancy.current.A stays 0 until that pin moves.
2026-08-19 14:00:53 +02:00
# Caller-auth pin. Warn logs on 2026-08-19 were clean for the user-engine
# projected token; this consumer is enforce. Do not copy this to
# values/tenant-engine.yaml until its warn logs are clean.
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
name: flex-auth-user-engine
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
args:
- serve
- --addr
- 0.0.0.0:8080
- --registry
- /opt/flex-auth/examples/user-engine/registry_snapshot.json
- --policy
- /opt/flex-auth/examples/user-engine/policy_package.md
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
callerAuth:
Enforce caller-auth on flex-auth-user-engine and record the live A2 probe Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347 warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens must use the API default audiences or TokenReview 401s on this k3s. Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine is unchanged. tenancy.current.A stays 0 until that pin moves.
2026-08-19 14:00:53 +02:00
mode: enforce
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
kubernetesURL: https://10.43.0.1
binding: user-engine=system:serviceaccount:user-engine:user-engine
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
consumer:
isolated: false
namespace: user-engine
podName: user-engine
Reference in a new issue Copy permalink