coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce caller-auth on flex-auth-ops-warden (FLEX-WP-0016-T03)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
ops-warden WARDEN-WP-0031 T04 minted audience-flex-auth tokens as
system:serviceaccount:ops-warden:ops-warden and held the warn-log count.
Helm rev 2 is enforce. Live probe 200/401/403. policy.enabled is theirs.
This commit is contained in:
tegwick 2026-08-19 20:10:31 +02:00
parent f51f50ae8d
commit 249ee146ba
5 changed files with 24 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/stage1.sh
View file

@ -26,8 +26,8 @@ echo "$tenant_render" | grep -q 'tenant-engine=system:serviceaccount:tenant-engi
|| { echo "tenant-engine render omits its exact binding" >&2; exit 1; }
ops_render="$(helm template flex-auth-ops-warden charts/flex-auth -f values/ops-warden.yaml --namespace flex-auth)"
echo "$ops_render" | grep -A1 -- '--caller-auth-mode' | grep -q warn \
|| { echo "ops-warden first pin must be warn" >&2; exit 1; }
echo "$ops_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \
|| { echo "ops-warden caller-auth-mode must be warn or enforce" >&2; exit 1; }
echo "$ops_render" | grep -q 'ops-warden=system:serviceaccount:ops-warden:ops-warden' \
|| { echo "ops-warden render omits its exact binding" >&2; exit 1; }
echo "$ops_render" | grep -q production_registry_snapshot.json \