Enforce caller-auth on flex-auth-user-engine and record the live A2 probe

Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347
warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens
must use the API default audiences or TokenReview 401s on this k3s.
Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine
is unchanged. tenancy.current.A stays 0 until that pin moves.

charts/flex-auth/templates/deployment.yaml

@@ -20,6 +20,9 @@ spec:
       {{- end }}
       securityContext:
         runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -71,7 +74,9 @@ spec:
             defaultMode: 0440
             sources:
               - serviceAccountToken:
+                  {{- if .Values.callerAuth.reviewer.audience }}
                   audience: {{ .Values.callerAuth.reviewer.audience | quote }}
+                  {{- end }}
                   expirationSeconds: {{ .Values.callerAuth.reviewer.expirationSeconds }}
                   path: token
               - configMap:

charts/flex-auth/values.yaml

@@ -38,7 +38,11 @@ callerAuth:
   binding: ""
   reviewer:
     mountPath: /var/run/secrets/flex-auth-reviewer
-    audience: https://kubernetes.default.svc
+    # Empty: kubelet mints the API server's default audiences so TokenReview
+    # authenticates. A custom audience (e.g. https://kubernetes.default.svc)
+    # 401s on this k3s cluster, whose API audiences are
+    # https://kubernetes.default.svc.cluster.local and k3s.
+    audience: ""
     expirationSeconds: 3600
 
 resources: