# Independently rollable ops-warden signing-policy pin (FLEX-WP-0016).
# Isolated: workstation reaches it by port-forward/tunnel. Binding matches
# ServiceAccount ops-warden/ops-warden (WARDEN-WP-0031). Enforce after their
# T04 authenticated gate held the warn-log count at 4.
name: flex-auth-ops-warden
image:
  repository: forgejo.coulomb.social/coulomb/flex-auth
  digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
args:
  - serve
  - --addr
  - 0.0.0.0:8080
  - --registry
  - /opt/flex-auth/examples/ops-warden/production_registry_snapshot.json
  - --policy
  - /opt/flex-auth/examples/ops-warden/policy_package.md
callerAuth:
  mode: enforce
  kubernetesURL: https://10.43.0.1
  binding: ops-warden=system:serviceaccount:ops-warden:ops-warden
consumer:
  isolated: true