23 lines
790 B
YAML
23 lines
790 B
YAML
|
# Independently rollable ops-warden signing-policy pin (FLEX-WP-0016).
|
||
|
|
# Isolated: no in-cluster PEP namespace yet. Workstation warden sign is not a
|
||
|
|
# Kubernetes ServiceAccount, so first mode is warn. Do not copy enforce from
|
||
|
|
# the user-engine/tenant-engine pins.
|
||
|
|
name: flex-auth-ops-warden
|
||
|
|
image:
|
||
|
|
repository: forgejo.coulomb.social/coulomb/flex-auth
|
||
|
|
digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
|
||
|
|
args:
|
||
|
|
- serve
|
||
|
|
- --addr
|
||
|
|
- 0.0.0.0:8080
|
||
|
|
- --registry
|
||
|
|
- /opt/flex-auth/examples/ops-warden/production_registry_snapshot.json
|
||
|
|
- --policy
|
||
|
|
- /opt/flex-auth/examples/ops-warden/policy_package.md
|
||
|
|
callerAuth:
|
||
|
|
mode: warn
|
||
|
|
kubernetesURL: https://10.43.0.1
|
||
|
|
binding: ops-warden=system:serviceaccount:ops-warden:ops-warden
|
||
|
|
consumer:
|
||
|
|
isolated: true
|