tegwick
b2431e3cad
Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347 warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens must use the API default audiences or TokenReview 401s on this k3s. Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine is unchanged. tenancy.current.A stays 0 until that pin moves.
24 lines
848 B
YAML
24 lines
848 B
YAML
# Production pin for the user-engine policy service. Independently rollable.
|
|
# Caller-auth pin. Warn logs on 2026-08-19 were clean for the user-engine
|
|
# projected token; this consumer is enforce. Do not copy this to
|
|
# values/tenant-engine.yaml until its warn logs are clean.
|
|
name: flex-auth-user-engine
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/flex-auth
|
|
digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
|
|
args:
|
|
- serve
|
|
- --addr
|
|
- 0.0.0.0:8080
|
|
- --registry
|
|
- /opt/flex-auth/examples/user-engine/registry_snapshot.json
|
|
- --policy
|
|
- /opt/flex-auth/examples/user-engine/policy_package.md
|
|
callerAuth:
|
|
mode: enforce
|
|
kubernetesURL: https://10.43.0.1
|
|
binding: user-engine=system:serviceaccount:user-engine:user-engine
|
|
consumer:
|
|
isolated: false
|
|
namespace: user-engine
|
|
podName: user-engine
|