coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/values/user-engine.yaml

24 lines
799 B
YAML
Raw Normal View History

Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
# Production pin for the user-engine policy service. Independently rollable.
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
# First caller-auth pin is warn (FLEX-WP-0015-T02). Flip mode to enforce only
# after warn logs are clean of unauthenticated callers for this consumer.
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
name: flex-auth-user-engine
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
args:
- serve
- --addr
- 0.0.0.0:8080
- --registry
- /opt/flex-auth/examples/user-engine/registry_snapshot.json
- --policy
- /opt/flex-auth/examples/user-engine/policy_package.md
Pin caller-auth digest in warn on independently rollable overlay pins The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
2026-08-19 12:31:08 +02:00
callerAuth:
mode: warn
kubernetesURL: https://10.43.0.1
binding: user-engine=system:serviceaccount:user-engine:user-engine
Add Railiance staged-promotion overlay for flex-auth FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00
consumer:
isolated: false
namespace: user-engine
podName: user-engine
Reference in a new issue Copy permalink