From 33d98eaa3e944ff8bb25b9912ad152178c274a56 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Tue, 26 Feb 2019 09:37:20 -0800
Subject: [PATCH] Add kube-mgmt to OPA (#10860)

* Initial attempt at adding kube-mgmt to the chart

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Updated to add auth/imagePullPolicy/rbac

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Fix linting issues

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Update kube-mgmt image to 0.8.

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Add the ability to turn off authz

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Add note about authz.

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Add in fixes from tsandall

Signed-off-by: Kevin Fox <kevin@efox.cc>
---
 stable/opa/Chart.yaml                         |  4 +-
 stable/opa/templates/NOTES.txt                | 20 +++---
 stable/opa/templates/_helpers.tpl             |  5 ++
 stable/opa/templates/deployment.yaml          | 68 +++++++++++++++++++
 stable/opa/templates/mgmt-clusterrole.yaml    | 14 ++++
 .../templates/mgmt-clusterrolebinding.yaml    | 20 ++++++
 stable/opa/values.yaml                        | 41 ++++++++++-
 7 files changed, 160 insertions(+), 12 deletions(-)
 create mode 100644 stable/opa/templates/mgmt-clusterrole.yaml
 create mode 100644 stable/opa/templates/mgmt-clusterrolebinding.yaml

diff --git a/stable/opa/Chart.yaml b/stable/opa/Chart.yaml
index 0d451dc832..254b32c55a 100644
--- a/stable/opa/Chart.yaml
+++ b/stable/opa/Chart.yaml
@@ -1,12 +1,12 @@
 apiVersion: v1
-appVersion: 0.10.1
+appVersion: 0.10.2
 description: Open source, general-purpose policy engine. Enforce fine-grained invariants over arbitrary Kubernetes resources.
 name: opa
 keywords:
 - opa
 - admission control
 - policy
-version: 0.2.0
+version: 0.3.0
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:
diff --git a/stable/opa/templates/NOTES.txt b/stable/opa/templates/NOTES.txt
index 1264bb6da2..c3a596db53 100644
--- a/stable/opa/templates/NOTES.txt
+++ b/stable/opa/templates/NOTES.txt
@@ -2,14 +2,6 @@ Please wait while the OPA is deployed on your cluster.
 
 For example policies that you can enforce with OPA see https://www.openpolicyagent.org.
 
-You can query OPA to see the policies it has loaded:
-
-export OPA_POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "opa.fullname" . }}" -o jsonpath="{.items[0].metadata.name}")
-
-kubectl port-forward $OPA_POD_NAME 8080:443
-
-curl -k -s https://localhost:8080/v1/policies | jq -r '.result[].raw'
-
 If you installed this chart with the default values, you can exercise the sample policy.
 
 # 1. Create a namespace called "opa-example"
@@ -53,3 +45,15 @@ spec:
 EOF
 
 kubectl -n opa-example create -f ingress-bad.yaml
+
+If you want to turn off authz for debugging purposes, you can do so by upgrading the chart like so:
+helm upgrade {{ .Release.Name }} stable/opa --reuse-values --set authz.enabled=false
+
+You can query OPA to see the policies it has loaded (you will need to turn off authz as described above):
+
+export OPA_POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "opa.fullname" . }}" -o jsonpath="{.items[0].metadata.name}")
+
+kubectl port-forward $OPA_POD_NAME 8080:443
+
+curl -k -s https://localhost:8080/v1/policies | jq -r '.result[].raw'
+
diff --git a/stable/opa/templates/_helpers.tpl b/stable/opa/templates/_helpers.tpl
index 99cdea89e4..69b91ba71b 100644
--- a/stable/opa/templates/_helpers.tpl
+++ b/stable/opa/templates/_helpers.tpl
@@ -29,6 +29,11 @@ If release name contains chart name it will be used as a full name.
 {{- printf "%s-sar" $name -}}
 {{- end -}}
 
+{{- define "opa.mgmtfullname" -}}
+{{- $name := (include "opa.fullname" . | trunc 58 | trimSuffix "-") -}}
+{{- printf "%s-mgmt" $name -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
diff --git a/stable/opa/templates/deployment.yaml b/stable/opa/templates/deployment.yaml
index 7bea7c6c39..940f3736d1 100644
--- a/stable/opa/templates/deployment.yaml
+++ b/stable/opa/templates/deployment.yaml
@@ -15,9 +15,32 @@ spec:
         app: {{ template "opa.fullname" . }}
       name: {{ template "opa.fullname" . }}
     spec:
+{{- if .Values.authz.enabled }}
+      initContainers:
+        - name: initpolicy
+          image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
+          imagePullPolicy: {{ .Values.mgmt.imagePullPolicy }}
+          command:
+          - /bin/sh
+          - -c
+          - |
+            tr -dc 'A-F0-9' < /dev/urandom | dd bs=1 count=32 2>/dev/null > /authz/mgmt-token
+            TOKEN=`cat /authz/mgmt-token`
+            cat > /authz/authz.rego <<EOF
+            package system.authz
+            default allow = false
+            allow { input.path = [""]; input.method = "POST" }
+            allow { input.path = [""]; input.method = "GET" }
+            allow { input.identity = "$TOKEN" }
+            EOF
+          volumeMounts:
+            - name: authz
+              mountPath: /authz
+{{- end }}
       containers:
         - name: opa
           image: {{ .Values.image }}:{{ .Values.imageTag }}
+          imagePullPolicy: {{ .Values.imagePullPolicy }}
           args:
             - "run"
             - "--server"
@@ -25,6 +48,15 @@ spec:
             - "--tls-cert-file=/certs/tls.crt"
             - "--tls-private-key-file=/certs/tls.key"
             - "--addr=0.0.0.0:443"
+{{- if .Values.authz.enabled }}
+            - "--authentication=token"
+            - "--authorization=basic"
+            - "/authz/authz.rego"
+            - "--ignore=.*"
+{{- end }}
+{{- if .Values.mgmt.enabled }}
+            - "--insecure-addr=127.0.0.1:8181"
+{{- end }}
           volumeMounts:
             - name: certs
               readOnly: true
@@ -32,9 +64,41 @@ spec:
             - name: config
               readOnly: true
               mountPath: /config
+{{- if .Values.authz.enabled }}
+            - name: authz
+              mountPath: /authz
+{{- end }}
+{{- if .Values.mgmt.enabled }}
+        - name: mgmt
+          image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
+          imagePullPolicy: {{ .Values.mgmt.imagePullPolicy }}
+          args:
+{{- if .Values.authz.enabled }}
+            - --opa-auth-token-file=/authz/mgmt-token
+{{- end }}
+            - --opa-url=http://127.0.0.1:8181/v1
+            - --replicate-path={{ .Values.mgmt.replicate.path }}
+            - --enable-policies={{ .Values.mgmt.configmapPolicies.enabled }}
+{{- if .Values.mgmt.configmapPolicies.enabled }}
+            - --policies={{ .Values.mgmt.configmapPolicies.namespaces | join "," }}
+            - --require-policy-label={{ .Values.mgmt.configmapPolicies.requireLabel }}
+{{- end }}
+{{- if gt (len .Values.mgmt.replicate.namespace) 0 }}
+            - --replicate={{ .Values.mgmt.replicate.namespace | join ","}}
+{{- end }}
+{{- if gt (len .Values.mgmt.replicate.cluster) 0 }}
+            - --replicate-cluster={{ .Values.mgmt.replicate.cluster | join ","}}
+{{- end }}
+{{- if .Values.authz.enabled }}
+          volumeMounts:
+            - name: authz
+              mountPath: /authz
+{{- end }}
+{{- end }}
 {{- if .Values.sar.enabled }}
         - name: sarproxy
           image: {{ .Values.sar.image }}:{{ .Values.sar.imageTag }}
+          imagePullPolicy: {{ .Values.sar.imagePullPolicy }}
           command:
             - kubectl
             - proxy
@@ -52,6 +116,10 @@ spec:
         - name: config
           secret:
             secretName: {{ template "opa.fullname" . }}-config
+{{- if .Values.authz.enabled }}
+        - name: authz
+          emptyDir: {}
+{{- end }}
       nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 8 }}
       tolerations:
diff --git a/stable/opa/templates/mgmt-clusterrole.yaml b/stable/opa/templates/mgmt-clusterrole.yaml
new file mode 100644
index 0000000000..53c20c01a6
--- /dev/null
+++ b/stable/opa/templates/mgmt-clusterrole.yaml
@@ -0,0 +1,14 @@
+{{- if (and .Values.rbac.create .Values.mgmt.enabled) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: {{ template "opa.name" . }}
+    chart: {{ template "opa.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    component: mgmt
+  name: {{ template "opa.mgmtfullname" . }}
+rules:
+{{ toYaml .Values.rbac.rules.cluster | indent 2 }}
+{{- end -}}
diff --git a/stable/opa/templates/mgmt-clusterrolebinding.yaml b/stable/opa/templates/mgmt-clusterrolebinding.yaml
new file mode 100644
index 0000000000..64da3b719f
--- /dev/null
+++ b/stable/opa/templates/mgmt-clusterrolebinding.yaml
@@ -0,0 +1,20 @@
+{{- if (and .Values.rbac.create .Values.mgmt.enabled) -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "opa.name" . }}
+    chart: {{ template "opa.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    component: mgmt
+  name: {{ template "opa.mgmtfullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "opa.mgmtfullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "opa.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/stable/opa/values.yaml b/stable/opa/values.yaml
index 8aa323d4e5..ad8219726d 100644
--- a/stable/opa/values.yaml
+++ b/stable/opa/values.yaml
@@ -9,7 +9,8 @@ opa:
       url: "https://www.openpolicyagent.org"
   bundle:
     service: controller
-    name: "kubernetes/admission"
+    name: "helm-kubernetes-quickstart"
+  default_decision: "/helm_kubernetes_quickstart/main"
 
 # To enforce mutating policies, change to MutatingWebhookConfiguration.
 admissionControllerKind: ValidatingWebhookConfiguration
@@ -43,9 +44,34 @@ admissionControllerCA: ""
 admissionControllerCert: ""
 admissionControllerKey: ""
 
+authz:
+  # Disable if you don't want authorization.
+  # Mostly useful for debugging.
+  enabled: true
+
 # Docker image and tag to deploy.
 image: openpolicyagent/opa
-imageTag: 0.10.1
+imageTag: 0.10.4
+imagePullPolicy: IfNotPresent
+
+mgmt:
+  enabled: true
+  image: openpolicyagent/kube-mgmt
+  imageTag: 0.8
+  imagePullPolicy: IfNotPresent
+  extraArgs: []
+  configmapPolicies:
+    enabled: false
+    namespaces: [opa, kube-federation-scheduling-policy]
+    requireLabel: true
+  replicate:
+# NOTE IF you use these, remember to update the RBAC rules above to allow
+#      permissions to replicate these things
+    cluster: []
+#     - [group/]version/resource
+    namespace: []
+#     - [group/]version/resource
+    path: kubernetes
 
 # Number of OPA replicas to deploy. OPA maintains an eventually consistent
 # cache of policies and data. If you want high availability you can deploy two
@@ -68,6 +94,16 @@ rbac:
   # If true, create & use RBAC resources
   #
   create: true
+  rules:
+    cluster: []
+    # - apiGroups:
+    #     - ""
+    #   resources:
+    #   - namespaces
+    #   verbs:
+    #   - get
+    #   - list
+    #   - watch
 
 serviceAccount:
   # Specifies whether a ServiceAccount should be created
@@ -82,6 +118,7 @@ sar:
   enabled: false
   image: lachlanevenson/k8s-kubectl
   imageTag: latest
+  imagePullPolicy: IfNotPresent
 
 # To control the liveness and readiness probes change the fields below.
 readinessProbe: