coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce caller-auth on flex-auth-user-engine and record the live A2 probe
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347
warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens
must use the API default audiences or TokenReview 401s on this k3s.
Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine
is unchanged. tenancy.current.A stays 0 until that pin moves.
This commit is contained in:
tegwick 2026-08-19 14:00:53 +02:00
parent ebde4ecba6
commit b2431e3cad
12 changed files with 60 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

7
values/user-engine.yaml
View file

@ -1,6 +1,7 @@
# Production pin for the user-engine policy service. Independently rollable.
# First caller-auth pin is warn (FLEX-WP-0015-T02). Flip mode to enforce only
# after warn logs are clean of unauthenticated callers for this consumer.
# Caller-auth pin. Warn logs on 2026-08-19 were clean for the user-engine
# projected token; this consumer is enforce. Do not copy this to
# values/tenant-engine.yaml until its warn logs are clean.
name: flex-auth-user-engine
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
@ -14,7 +15,7 @@ args:
- --policy
- /opt/flex-auth/examples/user-engine/policy_package.md
callerAuth:
mode: warn
mode: enforce
kubernetesURL: https://10.43.0.1
binding: user-engine=system:serviceaccount:user-engine:user-engine
consumer: