# Production pin for the tenant-engine policy service. Independently rollable.
# Caller-auth pin. Warn logs on 2026-08-19 were clean for the tenant-engine
# projected token after image sha256:7dc9d7bf… started sending it.
name: flex-auth-tenant-engine
image:
  repository: forgejo.coulomb.social/coulomb/flex-auth
  digest: sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd
args:
  - serve
  - --addr
  - 0.0.0.0:8080
  - --registry
  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
  - --policy
  - /opt/flex-auth/examples/tenant-engine/policy_package.md
callerAuth:
  mode: enforce
  kubernetesURL: https://10.43.0.1
  binding: tenant-engine=system:serviceaccount:tenant-engine:tenant-engine
consumer:
  isolated: false
  namespace: tenant-engine
  podName: tenant-engine