# KeyCape service client for the bounded executor's approval calls (NK-WP-0056-T06 prerequisite).
# The case of record; identical parameters to the type's first example. Status proposed until the founder
# accepts it (type acceptance: owner and founder). Going live makes oidc-service-client 0.2 `implemented`.
apiVersion: netkingdom.io/security-case/v0.1
kind: SecurityCase
spec:
  id: nk-bind-executor-approval
  type: oidc-service-client@0.2
  status: proposed
  owner:
    repo: net-kingdom
    person: founder
  parameters:
    client_id: nk-bind-executor-approval
    display_name: NetKingdom bounded executor (approval-engine)
    audience: approval-engine
    allowed_scopes: approval:create,approval:read,approval:consume
    service_subject: service:nk-bind-executor
    tenant: tenant:platform
    roles: bounded-executor
    token_lifetime: 15m
    consuming_service: bounded-executor
    consumer_namespace: sso
    consumer_service_account: nk-bind-executor
    consumer_owner_repo: rapp-bounded-executor