* servicemonitor.yaml: fixed servicemonitor.specselector.matchLabels.app value which must match with service.metadata.labels.app
* servicemonitor.yaml: fixed servicemonitor.metadata.labels.release overide support which might be required for prometheus operator servicemonitorselector matchlabels criteria
* servicemonitor.yaml: replaced hardcoded listening targetPort in favor of service port name reference
* service.yaml: Added service port declaration for prometheus port exposed by container
* deployment.yaml: added support for custom prometheus/mgmt port
* deployment.yaml: added container ports declarations for default port exposed (https) and additional port used by prometheus/mgmt (http)
* values.yaml: added support for custom prometheus/mgmt port
Signed-off-by: Franck Labatut <flabatut@gmail.com>
The documentation changes will inform user that there is a way to disable opa from loading default policies.
Fixes https://github.com/open-policy-agent/opa/issues/2410
Signed-off-by
Author: Ahil Mathew Eapachen <ahil1232@gmail.com>
Date: Mon May 25 11:27:02 2020 +1200
Signed-off-by: Ahil Mathew Eapachen <ahil1232@gmail.com>
Bumped up chart version
Incorporated PR comments
* [stable/opa] allow data loading configuration in kube-mgmt.
Signed-off-by: Ivo Verberk <iverberk@xebia.com>
* [stable/opa] bump chart version to 1.13.2
Signed-off-by: Ivo Verberk <iverberk@xebia.com>
* [stable/opa] update README to describe kube-mgmt config.
Signed-off-by: Ivo Verberk <iverberk@xebia.com>
* [stable/opa] bump chart version.
Signed-off-by: Ivo Verberk <iverberk@xebia.com>
The template uses securityContext.enabled to set whether the securityContext should be added. This fails the validation in Helm 3 because 'enabled' isn't a valid field in io.k8s.api.core.v1.PodSecurityContext, so keep using that key for the switch to maintain back compat, but don't add it to the output.
Signed-off-by: Mark Rydstrom <mark.rydstrom@sage.com>
* [stable/opa] Fix default opa config.yaml
Historically opa by default is configured to download a bundle file
with default values.yaml options to allow for it to work with only
`helm install`. At some point this changed to not include the default
configuration which effectively breaks the defaults (and invalidates
the README that explains how to customize the policies further).
This change restores the config and updates it to the latest style of
bundle configuration using the `bundles` keyword.
Signed-off-by: Patrick East <east.patrick@gmail.com>
* [stable/opa] Update OPA and kube-mgmt versions
Bumping the versions of OPA and kube-mgmt to the latest and greatest.
The newer versions include bug fixes, performance enhancements, and
features that users should have.
Signed-off-by: Patrick East <east.patrick@gmail.com>
* OPA updates.
This PR includes:
- Update OPA and `kube-mgmt` versions.
OPA version is not even listed in OPA website. Updates to latest 0.14.1.
Due to this update, change the `--insecure-addr` param as it's deprecated
in favor of `--addr`.
- Remove invalid bundle config from OPA.
OPA [documentation](https://www.openpolicyagent.org/docs/latest/management/#bundle-file-format)
specifies that bundles need to be gzipped tarballs, whereas the url specified
in the `values.yaml` produces a 404, making OPA download an HTML file.
Signed-off-by: Marc Cirauqui <mcirauqui@gmail.com>
* Change default values for OPA config
Signed-off-by: Marc Cirauqui <mcirauqui@gmail.com>
* Updated deployment to restart on new certs
- OPA does not use new certs when helm upgrade changes them
- Updated chart version
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Bumped chart version to 1.6.0
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Fixed bug in checksum annotation
- Checksum annotation should be using 'or' and not 'and'
- Updated chart version to 1.6.1
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Updated deployment to restart on new certs
- OPA does not use new certs when helm upgrade changes them
- Updated chart version
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Bumped chart version to 1.6.0
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
Making the namespace selector configurable allows for more flexibility.
e.g. we want to enable it for only 1 namespace.
Signed-off-by: Ali Rizwan <ari@hellofresh.com>
* stable/opa: add namespace selector to OPA webhook resource and bump version
Signed-off-by: Casey Lee <cplee@nektos.com>
* stable/opa: update namespace label to be 'opt-out' vs 'opt-in'
Signed-off-by: Casey Lee <cplee@nektos.com>
* Added option to provide a different port instead of 443
Signed-off-by: Joao Marcal <joao.marcal12@gmail.com>
* Fixed a bug introduced in the last commit and added some helpfull comments
to values.yaml
Signed-off-by: Joao Marcal <joao.marcal12@gmail.com>
* Removed trailing space
Signed-off-by: Joao Marcal <joao.marcal12@gmail.com>
* Separate the kube-mgmt replication arguments.
Fixes#11870
Signed-off-by: Ivo Verberk <iverberk@xebia.com>
* Bump the patch version to indicate the replication arguments bugfix.
Signed-off-by: Ivo Verberk <iverberk@xebia.com>
* Adds PodDisruptionBudget to OPA
- Defaults to off with a default min value of 1
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Fixed linting issue in values
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Fixed default values docs in README
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Adds resource limits for containers in deploy
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Updated README and bumped chart.
- README with new variables
- Bumped chart version
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Initial attempt at adding kube-mgmt to the chart
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Updated to add auth/imagePullPolicy/rbac
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Fix linting issues
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Update kube-mgmt image to 0.8.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add the ability to turn off authz
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add note about authz.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add in fixes from tsandall
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add a kubectl proxy to allow rego to make kubernetes subject access reviews.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Bumped the wrong version.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Fix lint.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Update based on feedback.
Update based on feedback by tsandall and timothyhinrichs.
Added OWNERS too for ease of management.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add Open Policy Agent chart
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Update chart with example to kick the tires
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Update chart per review feedback
- Set app version to OPA vresion per convention
- Prefer user facing chart name to local in install guide
- Refactor standard labels into helper template
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Add configuration table to README
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
