From e1a4f5fc3759dc659e6c6df97d49a686ab9b2564 Mon Sep 17 00:00:00 2001
From: bruce-au <51087152+bruce-au@users.noreply.github.com>
Date: Wed, 14 Aug 2019 13:28:25 -0400
Subject: [PATCH] Adding ability to define additional bootstrap policies loaded
 upon OPA startup, in addition to the authz policy. (#16332)

Signed-off-by: Bruce Yu <bruce@autonomic.ai>
---
 stable/opa/Chart.yaml                |  2 +-
 stable/opa/README.md                 |  3 +-
 stable/opa/templates/deployment.yaml | 44 +++++++++++++++++-----------
 stable/opa/values.yaml               | 11 +++++++
 4 files changed, 41 insertions(+), 19 deletions(-)

diff --git a/stable/opa/Chart.yaml b/stable/opa/Chart.yaml
index edb7c7ef70..dac1b2cae2 100644
--- a/stable/opa/Chart.yaml
+++ b/stable/opa/Chart.yaml
@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.7.0
+version: 1.8.0
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:
diff --git a/stable/opa/README.md b/stable/opa/README.md
index 1d1c5b4112..b3039e1f2e 100644
--- a/stable/opa/README.md
+++ b/stable/opa/README.md
@@ -85,4 +85,5 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `sar.resources` | CPU and memory limits for the sar container. | `{}` |
 | `priorityClassName` | The name of the priorityClass for the pods. | Unset |
 | `prometheus.enabled` | Flag to expose the `/metrics` endpoint to be scraped. | `false` | 
-| `annotations` | Annotations to be added to the deployment template. | `{}` |
\ No newline at end of file
+| `annotations` | Annotations to be added to the deployment template. | `{}` |
+| `bootstrapPolicies` | Bootstrap policies to be loaded during OPA startup. | `{}` |
\ No newline at end of file
diff --git a/stable/opa/templates/deployment.yaml b/stable/opa/templates/deployment.yaml
index 2e8986d6f5..0d9d2528ff 100644
--- a/stable/opa/templates/deployment.yaml
+++ b/stable/opa/templates/deployment.yaml
@@ -30,7 +30,7 @@ spec:
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
-{{- if .Values.authz.enabled }}
+{{- if or .Values.authz.enabled .Values.bootstrapPolicies}}
       initContainers:
         - name: initpolicy
           image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
@@ -41,9 +41,10 @@ spec:
           - /bin/sh
           - -c
           - |
-            tr -dc 'A-F0-9' < /dev/urandom | dd bs=1 count=32 2>/dev/null > /authz/mgmt-token
-            TOKEN=`cat /authz/mgmt-token`
-            cat > /authz/authz.rego <<EOF
+{{- if .Values.authz.enabled }}
+            tr -dc 'A-F0-9' < /dev/urandom | dd bs=1 count=32 2>/dev/null > /bootstrap/mgmt-token
+            TOKEN=`cat /bootstrap/mgmt-token`
+            cat > /bootstrap/authz.rego <<EOF
             package system.authz
             default allow = false
             # Allow anonymous access to the default policy decision.
@@ -57,10 +58,17 @@ spec:
 {{- end }}
             allow { input.identity == "$TOKEN" }
             EOF
-          volumeMounts:
-            - name: authz
-              mountPath: /authz
 {{- end }}
+{{- range $policyName, $policy := .Values.bootstrapPolicies }}
+            cat > /bootstrap/{{ $policyName }}.rego <<EOF
+{{ $policy | indent 12 }}
+            EOF
+{{- end }}
+          volumeMounts:
+            - name: bootstrap
+              mountPath: /bootstrap
+{{- end }}
+
       containers:
         - name: opa
           image: {{ .Values.image }}:{{ .Values.imageTag }}
@@ -81,13 +89,15 @@ spec:
 {{- if .Values.authz.enabled }}
             - "--authentication=token"
             - "--authorization=basic"
-            - "/authz/authz.rego"
             - "--ignore=.*"
 {{- end }}
 {{- if .Values.prometheus.enabled }}
             - "--insecure-addr=0.0.0.0:8181"
 {{- else if .Values.mgmt.enabled }}
             - "--insecure-addr=127.0.0.1:8181"
+{{- end }}
+{{- if or .Values.authz.enabled .Values.bootstrapPolicies }}
+            - "/bootstrap"
 {{- end }}
           volumeMounts:
             - name: certs
@@ -98,10 +108,10 @@ spec:
               readOnly: true
               mountPath: /config
 {{- end }}
-{{- if .Values.authz.enabled }}
-            - name: authz
+{{- if or .Values.authz.enabled .Values.bootstrapPolicies }}
+            - name: bootstrap
               readOnly: true
-              mountPath: /authz
+              mountPath: /bootstrap
 {{- end }}
           readinessProbe:
 {{ toYaml .Values.readinessProbe | indent 12 }}
@@ -115,7 +125,7 @@ spec:
 {{ toYaml .Values.mgmt.resources | indent 12 }}
           args:
 {{- if .Values.authz.enabled }}
-            - --opa-auth-token-file=/authz/mgmt-token
+            - --opa-auth-token-file=/bootstrap/mgmt-token
 {{- end }}
             - --opa-url=http://127.0.0.1:8181/v1
             - --replicate-path={{ .Values.mgmt.replicate.path }}
@@ -130,11 +140,11 @@ spec:
 {{- range .Values.mgmt.replicate.cluster }}
             - --replicate-cluster={{ . }}
 {{- end }}
-{{- if .Values.authz.enabled }}
+{{- if or .Values.authz.enabled .Values.bootstrapPolicies }}
           volumeMounts:
-            - name: authz
+            - name: bootstrap
               readOnly: true
-              mountPath: /authz
+              mountPath: /bootstrap
 {{- end }}
 {{- end }}
 {{- if .Values.sar.enabled }}
@@ -158,8 +168,8 @@ spec:
           secret:
             secretName: {{ template "opa.fullname" . }}-config
 {{- end }}
-{{- if .Values.authz.enabled }}
-        - name: authz
+{{- if or .Values.authz.enabled .Values.bootstrapPolicies}}
+        - name: bootstrap
           emptyDir: {}
 {{- end }}
       nodeSelector:
diff --git a/stable/opa/values.yaml b/stable/opa/values.yaml
index 5ee1da6a52..481da7e7ad 100644
--- a/stable/opa/values.yaml
+++ b/stable/opa/values.yaml
@@ -25,6 +25,17 @@ prometheus:
 annotations:
   {}
 
+# Bootstrap policies to load upon startup
+# Define policies in the form of:
+# <policyName> : |-
+#   <regoBody>
+# For example, to mask the entire input body in the decision logs:
+# bootstrapPolicies:
+#   log: |-
+#     package system.log
+#     mask["/input"]
+bootstrapPolicies: {}
+
 # To enforce mutating policies, change to MutatingWebhookConfiguration.
 admissionControllerKind: ValidatingWebhookConfiguration