From 0d0646bd4e0b63cd03d0d9211edfd777eed17da4 Mon Sep 17 00:00:00 2001
From: Xin Jin <51680961+xin-styra@users.noreply.github.com>
Date: Sat, 6 Jul 2019 18:52:33 -0700
Subject: [PATCH] stable/opa: Fix OPA installation script with the right authz
 rego. (#15222)

Signed-off-by: Xin Jin <xin@styra.com>
---
 stable/opa/Chart.yaml                | 2 +-
 stable/opa/templates/deployment.yaml | 5 ++++-
 stable/opa/values.yaml               | 4 ++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/stable/opa/Chart.yaml b/stable/opa/Chart.yaml
index 2e84bddc4e..6f7aa0d9ba 100644
--- a/stable/opa/Chart.yaml
+++ b/stable/opa/Chart.yaml
@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.5.0
+version: 1.5.1
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:
diff --git a/stable/opa/templates/deployment.yaml b/stable/opa/templates/deployment.yaml
index efaa91a23a..43c98c4b90 100644
--- a/stable/opa/templates/deployment.yaml
+++ b/stable/opa/templates/deployment.yaml
@@ -34,9 +34,12 @@ spec:
             cat > /authz/authz.rego <<EOF
             package system.authz
             default allow = false
+            # Allow anonymous access to the default policy decision.
             allow { input.path = [""]; input.method = "POST" }
             allow { input.path = [""]; input.method = "GET" }
-            allow { input.identity = "$TOKEN" }
+            # This is only used for health check in liveness and readiness probe
+            allow { input.path = ["health"]; input.method = "GET" }
+            allow { input.identity == "$TOKEN" }
             EOF
           volumeMounts:
             - name: authz
diff --git a/stable/opa/values.yaml b/stable/opa/values.yaml
index 976bfc6133..f2fb487741 100644
--- a/stable/opa/values.yaml
+++ b/stable/opa/values.yaml
@@ -158,14 +158,14 @@ sar:
 # To control the liveness and readiness probes change the fields below.
 readinessProbe:
   httpGet:
-    path: /
+    path: /health
     scheme: HTTPS
     port: 443
   initialDelaySeconds: 3
   periodSeconds: 5
 livenessProbe:
   httpGet:
-    path: /
+    path: /health
     scheme: HTTPS
     port: 443
   initialDelaySeconds: 3