# Production pin for the user-engine policy service. Independently rollable.
# Caller-auth pin. Warn logs on 2026-08-19 were clean for the user-engine
# projected token; this consumer is enforce. Do not copy this to
# values/tenant-engine.yaml until its warn logs are clean.
name: flex-auth-user-engine
image:
  repository: forgejo.coulomb.social/coulomb/flex-auth
  digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
args:
  - serve
  - --addr
  - 0.0.0.0:8080
  - --registry
  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
  - --policy
  - /opt/flex-auth/examples/user-engine/policy_package.md
callerAuth:
  mode: enforce
  kubernetesURL: https://10.43.0.1
  binding: user-engine=system:serviceaccount:user-engine:user-engine
consumer:
  isolated: false
  namespace: user-engine
  podName: user-engine