From 588c8602be38acd30e243fbe9b8e29aa169796d5 Mon Sep 17 00:00:00 2001
From: bruce-au <51087152+bruce-au@users.noreply.github.com>
Date: Tue, 13 Aug 2019 17:22:23 -0400
Subject: [PATCH] Adding the ability to add annotations to the template spec.
 Added a (#16299)

prometheus flag to allow for exposing endpoints that enable metric
scraping.

Signed-off-by: Bruce Yu <bruce@autonomic.ai>
---
 stable/opa/Chart.yaml                |  2 +-
 stable/opa/README.md                 |  2 ++
 stable/opa/templates/deployment.yaml | 11 ++++++++++-
 stable/opa/values.yaml               |  8 ++++++++
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/stable/opa/Chart.yaml b/stable/opa/Chart.yaml
index 5e7b90744a..edb7c7ef70 100644
--- a/stable/opa/Chart.yaml
+++ b/stable/opa/Chart.yaml
@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.6.1
+version: 1.7.0
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:
diff --git a/stable/opa/README.md b/stable/opa/README.md
index 4951a5ba53..1d1c5b4112 100644
--- a/stable/opa/README.md
+++ b/stable/opa/README.md
@@ -84,3 +84,5 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `mgmt.resources` | CPU and memory limits for the kube-mgmt container. | `{}` |
 | `sar.resources` | CPU and memory limits for the sar container. | `{}` |
 | `priorityClassName` | The name of the priorityClass for the pods. | Unset |
+| `prometheus.enabled` | Flag to expose the `/metrics` endpoint to be scraped. | `false` | 
+| `annotations` | Annotations to be added to the deployment template. | `{}` |
\ No newline at end of file
diff --git a/stable/opa/templates/deployment.yaml b/stable/opa/templates/deployment.yaml
index a68f5acbfd..2e8986d6f5 100644
--- a/stable/opa/templates/deployment.yaml
+++ b/stable/opa/templates/deployment.yaml
@@ -19,6 +19,9 @@ spec:
 {{- if .Values.opa }}
         checksum/config: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
 {{- end }}
+{{- end }}
+{{- if .Values.annotations }}
+{{ toYaml .Values.annotations | indent 8 }}
 {{- end }}
       labels:
         app: {{ template "opa.fullname" . }}
@@ -48,6 +51,10 @@ spec:
             allow { input.path = [""]; input.method = "GET" }
             # This is only used for health check in liveness and readiness probe
             allow { input.path = ["health"]; input.method = "GET" }
+{{- if .Values.prometheus.enabled }}
+            # This allows metrics to be scraped by prometheus
+            allow { input.path = ["metrics"]; input.method = "GET" }
+{{- end }}
             allow { input.identity == "$TOKEN" }
             EOF
           volumeMounts:
@@ -77,7 +84,9 @@ spec:
             - "/authz/authz.rego"
             - "--ignore=.*"
 {{- end }}
-{{- if .Values.mgmt.enabled }}
+{{- if .Values.prometheus.enabled }}
+            - "--insecure-addr=0.0.0.0:8181"
+{{- else if .Values.mgmt.enabled }}
             - "--insecure-addr=127.0.0.1:8181"
 {{- end }}
           volumeMounts:
diff --git a/stable/opa/values.yaml b/stable/opa/values.yaml
index f2fb487741..5ee1da6a52 100644
--- a/stable/opa/values.yaml
+++ b/stable/opa/values.yaml
@@ -17,6 +17,14 @@ opa:
 certManager:
   enabled: false
 
+# Expose the prometheus scraping endpoint
+prometheus:
+  enabled: false
+
+# Annotations in the deployment template
+annotations:
+  {}
+
 # To enforce mutating policies, change to MutatingWebhookConfiguration.
 admissionControllerKind: ValidatingWebhookConfiguration