tegwick
fa278674c1
The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
23 lines
813 B
YAML
23 lines
813 B
YAML
# Production pin for the tenant-engine policy service. Independently rollable.
|
|
# Warn is safe whether or not the live tenant-engine client already sends a
|
|
# token. Do not flip this pin to enforce until its warn logs are clean.
|
|
name: flex-auth-tenant-engine
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/flex-auth
|
|
digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
|
|
args:
|
|
- serve
|
|
- --addr
|
|
- 0.0.0.0:8080
|
|
- --registry
|
|
- /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
|
|
- --policy
|
|
- /opt/flex-auth/examples/tenant-engine/policy_package.md
|
|
callerAuth:
|
|
mode: warn
|
|
kubernetesURL: https://10.43.0.1
|
|
binding: tenant-engine=system:serviceaccount:tenant-engine:tenant-engine
|
|
consumer:
|
|
isolated: false
|
|
namespace: tenant-engine
|
|
podName: tenant-engine
|