stable/opa: Fix OPA installation script with the right authz rego. (#15222)

Signed-off-by: Xin Jin <xin@styra.com>

stable/opa/Chart.yaml

@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.5.0
+version: 1.5.1
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:

stable/opa/templates/deployment.yaml

@@ -34,9 +34,12 @@ spec:
             cat > /authz/authz.rego <<EOF
             package system.authz
             default allow = false
+            # Allow anonymous access to the default policy decision.
             allow { input.path = [""]; input.method = "POST" }
             allow { input.path = [""]; input.method = "GET" }
-            allow { input.identity = "$TOKEN" }
+            # This is only used for health check in liveness and readiness probe
+            allow { input.path = ["health"]; input.method = "GET" }
+            allow { input.identity == "$TOKEN" }
             EOF
           volumeMounts:
             - name: authz

stable/opa/values.yaml

@@ -158,14 +158,14 @@ sar:
 # To control the liveness and readiness probes change the fields below.
 readinessProbe:
   httpGet:
-    path: /
+    path: /health
     scheme: HTTPS
     port: 443
   initialDelaySeconds: 3
   periodSeconds: 5
 livenessProbe:
   httpGet:
-    path: /
+    path: /health
     scheme: HTTPS
     port: 443
   initialDelaySeconds: 3