coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/charts/flex-auth/values.yaml

55 lines
1.2 KiB
YAML
Raw Normal View History

Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
# Default chart values. Real pins live in values/*.yaml — never promote a tag.
name: flex-auth
namespace: flex-auth
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
digest: ""
pullPolicy: IfNotPresent
replicaCount: 1
args:
- serve
- --addr
- 0.0.0.0:8080
- --registry
- /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
- --policy
- /opt/flex-auth/examples/tenant-engine/policy_package.md
service:
port: 8080
health:
path: /healthz
consumer:
isolated: false
namespace: ""
podName: ""
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
# disabled keeps the image bootable without TokenReview (isolated canary).
# Production pins set warn, then enforce, independently per consumer.
callerAuth:
mode: disabled
audience: flex-auth
kubernetesURL: https://kubernetes.default.svc
binding: ""
reviewer:
mountPath: /var/run/secrets/flex-auth-reviewer
Enforce caller-auth on flex-auth-user-engine and record the live A2 probe Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347 warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens must use the API default audiences or TokenReview 401s on this k3s. Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine is unchanged. tenancy.current.A stays 0 until that pin moves.
2026-08-19 14:00:53 +02:00
# Empty: kubelet mints the API server's default audiences so TokenReview
# authenticates. A custom audience (e.g. https://kubernetes.default.svc)
# 401s on this k3s cluster, whose API audiences are
# https://kubernetes.default.svc.cluster.local and k3s.
audience: ""
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
expirationSeconds: 3600
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
resources:
requests:
cpu: 25m
memory: 32Mi
limits:
cpu: 300m
memory: 192Mi
Reference in a new issue Copy permalink