* [stable/opa] Fix default opa config.yaml
Historically opa by default is configured to download a bundle file
with default values.yaml options to allow for it to work with only
`helm install`. At some point this changed to not include the default
configuration which effectively breaks the defaults (and invalidates
the README that explains how to customize the policies further).
This change restores the config and updates it to the latest style of
bundle configuration using the `bundles` keyword.
Signed-off-by: Patrick East <east.patrick@gmail.com>
* [stable/opa] Update OPA and kube-mgmt versions
Bumping the versions of OPA and kube-mgmt to the latest and greatest.
The newer versions include bug fixes, performance enhancements, and
features that users should have.
Signed-off-by: Patrick East <east.patrick@gmail.com>
* OPA updates.
This PR includes:
- Update OPA and `kube-mgmt` versions.
OPA version is not even listed in OPA website. Updates to latest 0.14.1.
Due to this update, change the `--insecure-addr` param as it's deprecated
in favor of `--addr`.
- Remove invalid bundle config from OPA.
OPA [documentation](https://www.openpolicyagent.org/docs/latest/management/#bundle-file-format)
specifies that bundles need to be gzipped tarballs, whereas the url specified
in the `values.yaml` produces a 404, making OPA download an HTML file.
Signed-off-by: Marc Cirauqui <mcirauqui@gmail.com>
* Change default values for OPA config
Signed-off-by: Marc Cirauqui <mcirauqui@gmail.com>
* Updated deployment to restart on new certs
- OPA does not use new certs when helm upgrade changes them
- Updated chart version
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Bumped chart version to 1.6.0
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Fixed bug in checksum annotation
- Checksum annotation should be using 'or' and not 'and'
- Updated chart version to 1.6.1
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Updated deployment to restart on new certs
- OPA does not use new certs when helm upgrade changes them
- Updated chart version
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Bumped chart version to 1.6.0
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
Making the namespace selector configurable allows for more flexibility.
e.g. we want to enable it for only 1 namespace.
Signed-off-by: Ali Rizwan <ari@hellofresh.com>
* stable/opa: add namespace selector to OPA webhook resource and bump version
Signed-off-by: Casey Lee <cplee@nektos.com>
* stable/opa: update namespace label to be 'opt-out' vs 'opt-in'
Signed-off-by: Casey Lee <cplee@nektos.com>
* Added option to provide a different port instead of 443
Signed-off-by: Joao Marcal <joao.marcal12@gmail.com>
* Fixed a bug introduced in the last commit and added some helpfull comments
to values.yaml
Signed-off-by: Joao Marcal <joao.marcal12@gmail.com>
* Removed trailing space
Signed-off-by: Joao Marcal <joao.marcal12@gmail.com>
* Separate the kube-mgmt replication arguments.
Fixes#11870
Signed-off-by: Ivo Verberk <iverberk@xebia.com>
* Bump the patch version to indicate the replication arguments bugfix.
Signed-off-by: Ivo Verberk <iverberk@xebia.com>
* Adds PodDisruptionBudget to OPA
- Defaults to off with a default min value of 1
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Fixed linting issue in values
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Fixed default values docs in README
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Adds resource limits for containers in deploy
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Updated README and bumped chart.
- README with new variables
- Bumped chart version
Signed-off-by: Thomas Miller <thomas@tlm.id.au>
* Initial attempt at adding kube-mgmt to the chart
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Updated to add auth/imagePullPolicy/rbac
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Fix linting issues
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Update kube-mgmt image to 0.8.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add the ability to turn off authz
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add note about authz.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add in fixes from tsandall
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add a kubectl proxy to allow rego to make kubernetes subject access reviews.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Bumped the wrong version.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Fix lint.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Update based on feedback.
Update based on feedback by tsandall and timothyhinrichs.
Added OWNERS too for ease of management.
Signed-off-by: Kevin Fox <kevin@efox.cc>
* Add Open Policy Agent chart
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Update chart with example to kick the tires
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Update chart per review feedback
- Set app version to OPA vresion per convention
- Prefer user facing chart name to local in install guide
- Refactor standard labels into helper template
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Add configuration table to README
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Patrick East
Eric Bailey
Tharaka De Silva
Ondrej Kuchar
Marc Cirauqui
bruce-au
Thomas Miller
Carlo Columna
Xin Jin
Ali Rizwan
Adam Graves
Adam Cheney
Casey Lee
João Marçal
kfox1111
Ivo Verberk
Thomas Miller
matthope
Jeff Bachtel
Torin Sandall