coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after
tenant-engine 2063470 started sending a projected caller token
(sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04
cancelled: AuthZEN waits for a PEP we do not control.
This commit is contained in:
tegwick 2026-08-19 14:35:27 +02:00
parent 9514522b77
commit 6d85f95c8b
9 changed files with 41 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

6
values/tenant-engine.yaml
View file

@ -1,6 +1,6 @@
# Production pin for the tenant-engine policy service. Independently rollable.
# Warn is safe whether or not the live tenant-engine client already sends a
# token. Do not flip this pin to enforce until its warn logs are clean.
# Caller-auth pin. Warn logs on 2026-08-19 were clean for the tenant-engine
# projected token after image sha256:7dc9d7bf… started sending it.
name: flex-auth-tenant-engine
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
@ -14,7 +14,7 @@ args:
- --policy
- /opt/flex-auth/examples/tenant-engine/policy_package.md
callerAuth:
mode: warn
mode: enforce
kubernetesURL: https://10.43.0.1
binding: tenant-engine=system:serviceaccount:tenant-engine:tenant-engine
consumer: