Adding the ability to add annotations to the template spec. Added a (#16299)

prometheus flag to allow for exposing endpoints that enable metric
scraping.

Signed-off-by: Bruce Yu <bruce@autonomic.ai>

stable/opa/Chart.yaml

@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.6.1
+version: 1.7.0
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:

stable/opa/README.md

@@ -84,3 +84,5 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `mgmt.resources` | CPU and memory limits for the kube-mgmt container. | `{}` |
 | `sar.resources` | CPU and memory limits for the sar container. | `{}` |
 | `priorityClassName` | The name of the priorityClass for the pods. | Unset |
+| `prometheus.enabled` | Flag to expose the `/metrics` endpoint to be scraped. | `false` | 
+| `annotations` | Annotations to be added to the deployment template. | `{}` |

stable/opa/templates/deployment.yaml

@@ -19,6 +19,9 @@ spec:
 {{- if .Values.opa }}
         checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
 {{- end }}
+{{- end }}
+{{- if .Values.annotations }}
+{{ toYaml .Values.annotations | indent 8 }}
 {{- end }}
       labels:
         app: {{ template "opa.fullname" . }}
@@ -48,6 +51,10 @@ spec:
             allow { input.path = [""]; input.method = "GET" }
             # This is only used for health check in liveness and readiness probe
             allow { input.path = ["health"]; input.method = "GET" }
+{{- if .Values.prometheus.enabled }}
+            # This allows metrics to be scraped by prometheus
+            allow { input.path = ["metrics"]; input.method = "GET" }
+{{- end }}
             allow { input.identity == "$TOKEN" }
             EOF
           volumeMounts:
@@ -77,7 +84,9 @@ spec:
             - "/authz/authz.rego"
             - "--ignore=.*"
 {{- end }}
-{{- if .Values.mgmt.enabled }}
+{{- if .Values.prometheus.enabled }}
+            - "--insecure-addr=0.0.0.0:8181"
+{{- else if .Values.mgmt.enabled }}
             - "--insecure-addr=127.0.0.1:8181"
 {{- end }}
           volumeMounts:

stable/opa/values.yaml

@@ -17,6 +17,14 @@ opa:
 certManager:
   enabled: false
 
+# Expose the prometheus scraping endpoint
+prometheus:
+  enabled: false
+
+# Annotations in the deployment template
+annotations:
+  {}
+
 # To enforce mutating policies, change to MutatingWebhookConfiguration.
 admissionControllerKind: ValidatingWebhookConfiguration