Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

charts/flex-auth/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: flex-auth
 description: Independently rollable flex-auth policy-decision Deployment (one consumer per release).
 type: application
-version: 0.1.0
+version: 0.2.0
 appVersion: "0.1.0"

charts/flex-auth/templates/_helpers.tpl

@@ -18,3 +18,18 @@ app.kubernetes.io/name: {{ include "flex-auth.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: flex-auth
 {{- end -}}
+
+{{- define "flex-auth.callerAuth.mode" -}}
+{{- $mode := "disabled" -}}
+{{- if and (hasKey .Values "callerAuth") .Values.callerAuth (hasKey .Values.callerAuth "mode") .Values.callerAuth.mode -}}
+{{- $mode = .Values.callerAuth.mode -}}
+{{- end -}}
+{{- if not (has $mode (list "disabled" "warn" "enforce")) -}}
+{{- fail (printf "callerAuth.mode must be disabled, warn, or enforce; got %q" $mode) -}}
+{{- end -}}
+{{- $mode -}}
+{{- end -}}
+
+{{- define "flex-auth.callerAuth.enabled" -}}
+{{- if has (include "flex-auth.callerAuth.mode" .) (list "warn" "enforce") -}}true{{- else -}}false{{- end -}}
+{{- end -}}

charts/flex-auth/templates/deployment.yaml

@@ -15,6 +15,9 @@ spec:
         {{- include "flex-auth.labels" . | nindent 8 }}
     spec:
       automountServiceAccountToken: false
+      {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+      serviceAccountName: {{ include "flex-auth.name" . }}
+      {{- end }}
       securityContext:
         runAsNonRoot: true
         seccompProfile:
@@ -25,6 +28,15 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             {{- toYaml .Values.args | nindent 12 }}
+            {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+            {{- $binding := required "callerAuth.binding is required when callerAuth.mode is warn or enforce" .Values.callerAuth.binding }}
+            - --caller-auth-mode
+            - {{ include "flex-auth.callerAuth.mode" . | quote }}
+            - --caller-kubernetes-url
+            - {{ required "callerAuth.kubernetesURL is required when callerAuth.mode is warn or enforce" .Values.callerAuth.kubernetesURL | quote }}
+            - --caller-binding
+            - {{ $binding | quote }}
+            {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.service.port }}
@@ -46,3 +58,25 @@ spec:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
+          {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+          volumeMounts:
+            - mountPath: {{ .Values.callerAuth.reviewer.mountPath }}
+              name: flex-auth-reviewer
+              readOnly: true
+          {{- end }}
+      {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+      volumes:
+        - name: flex-auth-reviewer
+          projected:
+            defaultMode: 0440
+            sources:
+              - serviceAccountToken:
+                  audience: {{ .Values.callerAuth.reviewer.audience | quote }}
+                  expirationSeconds: {{ .Values.callerAuth.reviewer.expirationSeconds }}
+                  path: token
+              - configMap:
+                  name: kube-root-ca.crt
+                  items:
+                    - key: ca.crt
+                      path: ca.crt
+      {{- end }}

charts/flex-auth/templates/networkpolicy.yaml

@@ -11,7 +11,16 @@ spec:
   policyTypes:
     - Ingress
     - Egress
+  {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+  egress:
+    - ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+  {{- else }}
   egress: []
+  {{- end }}
   {{- if .Values.consumer.isolated }}
   ingress: []
   {{- else }}

charts/flex-auth/templates/rbac.yaml

@@ -0,0 +1,30 @@
+{{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "flex-auth.name" . }}-tokenreviewer
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "flex-auth.name" . }}-tokenreviewer
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "flex-auth.name" . }}-tokenreviewer
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flex-auth.name" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

charts/flex-auth/templates/serviceaccount.yaml

@@ -0,0 +1,9 @@
+{{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+automountServiceAccountToken: false
+{{- end }}

charts/flex-auth/values.yaml

@@ -29,6 +29,18 @@ consumer:
   namespace: ""
   podName: ""
 
+# disabled keeps the image bootable without TokenReview (isolated canary).
+# Production pins set warn, then enforce, independently per consumer.
+callerAuth:
+  mode: disabled
+  audience: flex-auth
+  kubernetesURL: https://kubernetes.default.svc
+  binding: ""
+  reviewer:
+    mountPath: /var/run/secrets/flex-auth-reviewer
+    audience: https://kubernetes.default.svc
+    expirationSeconds: 3600
+
 resources:
   requests:
     cpu: 25m