coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce caller-auth on flex-auth-ops-warden (FLEX-WP-0016-T03)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
ops-warden WARDEN-WP-0031 T04 minted audience-flex-auth tokens as
system:serviceaccount:ops-warden:ops-warden and held the warn-log count.
Helm rev 2 is enforce. Live probe 200/401/403. policy.enabled is theirs.
This commit is contained in:
tegwick 2026-08-19 20:10:31 +02:00
parent f51f50ae8d
commit 249ee146ba
5 changed files with 24 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

8
values/ops-warden.yaml
View file

@ -1,7 +1,7 @@
# Independently rollable ops-warden signing-policy pin (FLEX-WP-0016).
# Isolated: no in-cluster PEP namespace yet. Workstation warden sign is not a
# Kubernetes ServiceAccount, so first mode is warn. Do not copy enforce from
# the user-engine/tenant-engine pins.
# Isolated: workstation reaches it by port-forward/tunnel. Binding matches
# ServiceAccount ops-warden/ops-warden (WARDEN-WP-0031). Enforce after their
# T04 authenticated gate held the warn-log count at 4.
name: flex-auth-ops-warden
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
@ -15,7 +15,7 @@ args:
- --policy
- /opt/flex-auth/examples/ops-warden/policy_package.md
callerAuth:
mode: warn
mode: enforce
kubernetesURL: https://10.43.0.1
binding: ops-warden=system:serviceaccount:ops-warden:ops-warden
consumer: