From efd98f2d23e4fe52f6f94dfb68acf59ebf28cbb9 Mon Sep 17 00:00:00 2001
From: Marc Cirauqui <mcirauqui@gmail.com>
Date: Mon, 14 Oct 2019 17:28:38 +0200
Subject: [PATCH] [stable/opa] OPA updates. (#17947)

* OPA updates.

This PR includes:

- Update OPA and `kube-mgmt` versions.

OPA version is not even listed in OPA website. Updates to latest 0.14.1.
Due to this update, change the `--insecure-addr` param as it's deprecated
in favor of `--addr`.

- Remove invalid bundle config from OPA.

OPA [documentation](https://www.openpolicyagent.org/docs/latest/management/#bundle-file-format)
specifies that bundles need to be gzipped tarballs, whereas the url specified
in the `values.yaml` produces a 404, making OPA download an HTML file.

Signed-off-by: Marc Cirauqui <mcirauqui@gmail.com>

* Change default values for OPA config

Signed-off-by: Marc Cirauqui <mcirauqui@gmail.com>
---
 stable/opa/Chart.yaml                |  4 ++--
 stable/opa/templates/deployment.yaml |  4 ++--
 stable/opa/values.yaml               | 24 +++++++++++++-----------
 3 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/stable/opa/Chart.yaml b/stable/opa/Chart.yaml
index dac1b2cae2..407b1caabf 100644
--- a/stable/opa/Chart.yaml
+++ b/stable/opa/Chart.yaml
@@ -1,12 +1,12 @@
 apiVersion: v1
-appVersion: 0.10.2
+appVersion: 0.14.1
 description: Open source, general-purpose policy engine. Enforce fine-grained invariants over arbitrary Kubernetes resources.
 name: opa
 keywords:
 - opa
 - admission control
 - policy
-version: 1.8.0
+version: 1.9.0
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:
diff --git a/stable/opa/templates/deployment.yaml b/stable/opa/templates/deployment.yaml
index 0d9d2528ff..0fa5d47c58 100644
--- a/stable/opa/templates/deployment.yaml
+++ b/stable/opa/templates/deployment.yaml
@@ -92,9 +92,9 @@ spec:
             - "--ignore=.*"
 {{- end }}
 {{- if .Values.prometheus.enabled }}
-            - "--insecure-addr=0.0.0.0:8181"
+            - "--addr=http://0.0.0.0:8181"
 {{- else if .Values.mgmt.enabled }}
-            - "--insecure-addr=127.0.0.1:8181"
+            - "--addr=http://127.0.0.1:8181"
 {{- end }}
 {{- if or .Values.authz.enabled .Values.bootstrapPolicies }}
             - "/bootstrap"
diff --git a/stable/opa/values.yaml b/stable/opa/values.yaml
index 481da7e7ad..7b5acd86f8 100644
--- a/stable/opa/values.yaml
+++ b/stable/opa/values.yaml
@@ -3,15 +3,17 @@
 #
 # The 'opa' key embeds an OPA configuration file. See
 # https://www.openpolicyagent.org/docs/configuration.html for more details.
-# If no default config wanted just set opa: false
-opa:
-  services:
-    controller:
-      url: "https://www.openpolicyagent.org"
-  bundle:
-    service: controller
-    name: "helm-kubernetes-quickstart"
-  default_decision: "/helm_kubernetes_quickstart/main"
+# Default value is no default config. For custom config, the opa key
+# needs to include the opa config yaml, eg:
+# opa:
+#   services:
+#     controller:
+#       url: https://some.bundle.host
+#   bundle:
+#     service: controller
+#     name: some-bundle-name.tgz
+#   default_decision: "/some_bundle_name/main"
+opa: false
 
 # Setup the webhook using cert-manager
 certManager:
@@ -90,7 +92,7 @@ authz:
 
 # Docker image and tag to deploy.
 image: openpolicyagent/opa
-imageTag: 0.10.7
+imageTag: 0.14.1
 imagePullPolicy: IfNotPresent
 
 # Port to which the opa pod will bind itself
@@ -101,7 +103,7 @@ port: 443
 mgmt:
   enabled: true
   image: openpolicyagent/kube-mgmt
-  imageTag: 0.8
+  imageTag: 0.9
   imagePullPolicy: IfNotPresent
   extraArgs: []
   resources: {}