Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

values/stage1.yaml

@@ -2,7 +2,7 @@
 name: flex-auth-local
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+  digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
 args:
   - serve
   - --addr

values/stage2-canary.yaml

@@ -3,7 +3,7 @@
 name: flex-auth-canary
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+  digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
 args:
   - serve
   - --addr

values/stage3-production.yaml

@@ -5,7 +5,7 @@
 name: flex-auth-canary
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+  digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
 args:
   - serve
   - --addr

values/tenant-engine.yaml

@@ -1,8 +1,10 @@
 # Production pin for the tenant-engine policy service. Independently rollable.
+# Warn is safe whether or not the live tenant-engine client already sends a
+# token. Do not flip this pin to enforce until its warn logs are clean.
 name: flex-auth-tenant-engine
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc
+  digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
 args:
   - serve
   - --addr
@@ -11,6 +13,10 @@ args:
   - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
   - --policy
   - /opt/flex-auth/examples/tenant-engine/policy_package.md
+callerAuth:
+  mode: warn
+  kubernetesURL: https://10.43.0.1
+  binding: tenant-engine=system:serviceaccount:tenant-engine:tenant-engine
 consumer:
   isolated: false
   namespace: tenant-engine

values/user-engine.yaml

@@ -1,8 +1,10 @@
 # Production pin for the user-engine policy service. Independently rollable.
+# First caller-auth pin is warn (FLEX-WP-0015-T02). Flip mode to enforce only
+# after warn logs are clean of unauthenticated callers for this consumer.
 name: flex-auth-user-engine
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+  digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
 args:
   - serve
   - --addr
@@ -11,6 +13,10 @@ args:
   - /opt/flex-auth/examples/user-engine/registry_snapshot.json
   - --policy
   - /opt/flex-auth/examples/user-engine/policy_package.md
+callerAuth:
+  mode: warn
+  kubernetesURL: https://10.43.0.1
+  binding: user-engine=system:serviceaccount:user-engine:user-engine
 consumer:
   isolated: false
   namespace: user-engine