coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after
tenant-engine 2063470 started sending a projected caller token
(sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04
cancelled: AuthZEN waits for a PEP we do not control.
This commit is contained in:
tegwick 2026-08-19 14:35:27 +02:00
parent 9514522b77
commit 6d85f95c8b
9 changed files with 41 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

3
tests/stage1.sh
View file

@ -20,7 +20,8 @@ echo "$user_render" | grep -q tokenreviews || { echo "user-engine render omits T
echo "$user_render" | grep -q flex-auth-reviewer || { echo "user-engine render omits reviewer projection" >&2; exit 1; }
tenant_render="$(helm template flex-auth-tenant-engine charts/flex-auth -f values/tenant-engine.yaml --namespace flex-auth)"
echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -q warn || { echo "tenant-engine first pin must be warn" >&2; exit 1; }
echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \
|| { echo "tenant-engine caller-auth-mode must be warn or enforce" >&2; exit 1; }
echo "$tenant_render" | grep -q 'tenant-engine=system:serviceaccount:tenant-engine:tenant-engine' \
|| { echo "tenant-engine render omits its exact binding" >&2; exit 1; }