deprecated-helm-charts/stable/opa/templates/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "opa.fullname" . }}
  labels:
{{ include "opa.labels.standard" . | indent 4 }}
spec:
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels:
      app: {{ template "opa.fullname" . }}
  template:
    metadata:
      labels:
        app: {{ template "opa.fullname" . }}
      name: {{ template "opa.fullname" . }}
    spec:
{{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
{{- if .Values.authz.enabled }}
      initContainers:
        - name: initpolicy
          image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
          imagePullPolicy: {{ .Values.mgmt.imagePullPolicy }}
          resources:
{{ toYaml .Values.mgmt.resources | indent 12 }}
          command:
          - /bin/sh
          - -c
          - |
            tr -dc 'A-F0-9' < /dev/urandom | dd bs=1 count=32 2>/dev/null > /authz/mgmt-token
            TOKEN=`cat /authz/mgmt-token`
            cat > /authz/authz.rego <<EOF
            package system.authz
            default allow = false
            # Allow anonymous access to the default policy decision.
            allow { input.path = [""]; input.method = "POST" }
            allow { input.path = [""]; input.method = "GET" }
            # This is only used for health check in liveness and readiness probe
            allow { input.path = ["health"]; input.method = "GET" }
            allow { input.identity == "$TOKEN" }
            EOF
          volumeMounts:
            - name: authz
              mountPath: /authz
{{- end }}
      containers:
        - name: opa
          image: {{ .Values.image }}:{{ .Values.imageTag }}
          imagePullPolicy: {{ .Values.imagePullPolicy }}
          resources:
{{ toYaml .Values.resources | indent 12 }}
          args:
            - "run"
            - "--server"
{{- if .Values.opa }}
            - "--config-file=/config/config.yaml"
{{- end }}
            - "--tls-cert-file=/certs/tls.crt"
            - "--tls-private-key-file=/certs/tls.key"
            - "--addr=0.0.0.0:{{ .Values.port }}"
            - "--log-level={{ .Values.logLevel }}"
            - "--log-format={{ .Values.logFormat }}"
{{- if .Values.authz.enabled }}
            - "--authentication=token"
            - "--authorization=basic"
            - "/authz/authz.rego"
            - "--ignore=.*"
{{- end }}
{{- if .Values.mgmt.enabled }}
            - "--insecure-addr=127.0.0.1:8181"
{{- end }}
          volumeMounts:
            - name: certs
              readOnly: true
              mountPath: /certs
{{- if .Values.opa }}
            - name: config
              readOnly: true
              mountPath: /config
{{- end }}
{{- if .Values.authz.enabled }}
            - name: authz
              readOnly: true
              mountPath: /authz
{{- end }}
          readinessProbe:
{{ toYaml .Values.readinessProbe | indent 12 }}
          livenessProbe:
{{ toYaml .Values.livenessProbe | indent 12 }}
{{- if .Values.mgmt.enabled }}
        - name: mgmt
          image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
          imagePullPolicy: {{ .Values.mgmt.imagePullPolicy }}
          resources:
{{ toYaml .Values.mgmt.resources | indent 12 }}
          args:
{{- if .Values.authz.enabled }}
            - --opa-auth-token-file=/authz/mgmt-token
{{- end }}
            - --opa-url=http://127.0.0.1:8181/v1
            - --replicate-path={{ .Values.mgmt.replicate.path }}
            - --enable-policies={{ .Values.mgmt.configmapPolicies.enabled }}
{{- if .Values.mgmt.configmapPolicies.enabled }}
            - --policies={{ .Values.mgmt.configmapPolicies.namespaces | join "," }}
            - --require-policy-label={{ .Values.mgmt.configmapPolicies.requireLabel }}
{{- end }}
{{- range .Values.mgmt.replicate.namespace }}
            - --replicate={{ . }}
{{- end }}
{{- range .Values.mgmt.replicate.cluster }}
            - --replicate-cluster={{ . }}
{{- end }}
{{- if .Values.authz.enabled }}
          volumeMounts:
            - name: authz
              readOnly: true
              mountPath: /authz
{{- end }}
{{- end }}
{{- if .Values.sar.enabled }}
        - name: sarproxy
          image: {{ .Values.sar.image }}:{{ .Values.sar.imageTag }}
          imagePullPolicy: {{ .Values.sar.imagePullPolicy }}
          resources:
{{ toYaml .Values.sar.resources | indent 12 }}
          command:
            - kubectl
            - proxy
            - --accept-paths=^/apis/authorization.k8s.io/v1/subjectaccessreviews$
{{- end }}
      serviceAccountName: {{ template "opa.serviceAccountName" .}}
      volumes:
        - name: certs
          secret:
            secretName: {{ template "opa.fullname" . }}-cert
{{- if .Values.opa }}
        - name: config
          secret:
            secretName: {{ template "opa.fullname" . }}-config
{{- end }}
{{- if .Values.authz.enabled }}
        - name: authz
          emptyDir: {}
{{- end }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}