deprecated-helm-charts/stable/opa/values.yaml

# Default values for opa.
# -----------------------
#
# The 'opa' key embeds an OPA configuration file. See
# https://www.openpolicyagent.org/docs/configuration.html for more details.
# Default value is no default config. For custom config, the opa key
# needs to include the opa config yaml, eg:
opa:
  services:
    controller:
      url: 'https://www.openpolicyagent.org'
  bundles:
    quickstart:
      service: controller
      resource: /bundles/helm-kubernetes-quickstart
  default_decision: /helm_kubernetes_quickstart/main

# Setup the webhook using cert-manager
certManager:
  enabled: false

# Expose the prometheus scraping endpoint
prometheus:
  enabled: false

## ServiceMonitor consumed by prometheus-operator
serviceMonitor:
  ## If the operator is installed in your cluster, set to true to create a Service Monitor Entry
  enabled: false
  interval: "15s"
  ## Namespace in which the service monitor is created
  # namespace: monitoring
  # Added to the ServiceMonitor object so that prometheus-operator is able to discover it
  ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
  additionalLabels: {}

# Annotations in the deployment template
annotations:
  {}

# Bootstrap policies to load upon startup
# Define policies in the form of:
# <policyName> : |-
#   <regoBody>
# For example, to mask the entire input body in the decision logs:
# bootstrapPolicies:
#   log: |-
#     package system.log
#     mask["/input"]
bootstrapPolicies: {}

# To enforce mutating policies, change to MutatingWebhookConfiguration.
admissionControllerKind: ValidatingWebhookConfiguration

# To _fail closed_ on failures, change to Fail. During initial testing, we
# recommend leaving the failure policy as Ignore.
admissionControllerFailurePolicy: Ignore

# Adds a namespace selector to the admission controller webhook
admissionControllerNamespaceSelector:
  matchExpressions:
    - {key: openpolicyagent.org/webhook, operator: NotIn, values: [ignore]}

# SideEffectClass for the webhook, setting to None enables dry-run
admissionControllerSideEffect: Unknown

# To restrict the kinds of operations and resources that are subject to OPA
# policy checks, see the settings below. By default, all resources and
# operations are subject to OPA policy checks.
admissionControllerRules:
  - operations: ["*"]
    apiGroups: ["*"]
    apiVersions: ["*"]
    resources: ["*"]

# Controls a PodDisruptionBudget for the OPA pod. Suggested use if having opa
# always running for admission control is important
podDisruptionBudget:
  enabled: false
  minAvailable: 1
# maxUnavailable: 1

# The helm Chart will automatically generate a CA and server certificate for
# the OPA. If you want to supply your own certificates, set the field below to
# false and add the PEM encoded CA certificate and server key pair below.
#
# WARNING: The common name name in the server certificate MUST match the
# hostname of the service that exposes the OPA to the apiserver. For example.
# if the service name is created in the "default" nanamespace with name "opa"
# the common name MUST be set to "opa.default.svc".
#
# If the common name is not set correctly, the apiserver will refuse to
# communicate with the OPA.
generateAdmissionControllerCerts: true
admissionControllerCA: ""
admissionControllerCert: ""
admissionControllerKey: ""

authz:
  # Disable if you don't want authorization.
  # Mostly useful for debugging.
  enabled: true

# Docker image and tag to deploy.
image: openpolicyagent/opa
imageTag: 0.15.1
imagePullPolicy: IfNotPresent

# Port to which the opa pod will bind itself
# NOTE IF you use a different port make sure it maches the ones in the readinessProbe
# and livenessProbe
port: 443

mgmt:
  enabled: true
  image: openpolicyagent/kube-mgmt
  imageTag: "0.10"
  imagePullPolicy: IfNotPresent
  extraArgs: []
  resources: {}
  configmapPolicies:
# NOTE IF you use these, remember to update the RBAC rules below to allow
#      permissions to get, list, watch, patch and update configmaps
    enabled: false
    namespaces: [opa, kube-federation-scheduling-policy]
    requireLabel: true
  replicate:
# NOTE IF you use these, remember to update the RBAC rules below to allow
#      permissions to replicate these things
    cluster: []
#     - [group/]version/resource
    namespace: []
#     - [group/]version/resource
    path: kubernetes

# Log level for OPA ('debug', 'info', 'error') (app default=info)
logLevel: info

# Log format for OPA ('text', 'json') (app default=text)
logFormat: text

# Number of OPA replicas to deploy. OPA maintains an eventually consistent
# cache of policies and data. If you want high availability you can deploy two
# or more replicas.
replicas: 1

# To control how the OPA is scheduled on the cluster, set the tolerations and
# nodeSelector values below. For example, to deploy OPA onto the master nodes:
#
# tolerations: [{key: "node-role.kubernetes.io/master", effect: NoSchedule, operator: Exists}]
# nodeSelector: {"kubernetes.io/role": "master"}
tolerations: []
nodeSelector: {}

# To control the CPU and memory resource limits and requests for OPA, set the
# field below.
resources: {}

rbac:
  # If true, create & use RBAC resources
  #
  create: true
  rules:
    cluster: []
    # - apiGroups:
    #     - ""
    #   resources:
    #   - namespaces
    #   verbs:
    #   - get
    #   - list
    #   - watch

serviceAccount:
  # Specifies whether a ServiceAccount should be created
  create: true
  # The name of the ServiceAccount to use.
  # If not set and create is true, a name is generated using the fullname template
  name:

# This proxy allows opa to make Kubernetes SubjectAccessReview checks against the
# Kubernetes API. You can get a rego function at github.com/open-policy-agent/library
sar:
  enabled: false
  image: lachlanevenson/k8s-kubectl
  imageTag: latest
  imagePullPolicy: IfNotPresent
  resources: {}

# To control the liveness and readiness probes change the fields below.
readinessProbe:
  httpGet:
    path: /health
    scheme: HTTPS
    port: 443
  initialDelaySeconds: 3
  periodSeconds: 5
livenessProbe:
  httpGet:
    path: /health
    scheme: HTTPS
    port: 443
  initialDelaySeconds: 3
  periodSeconds: 5

# Set a priorityClass using priorityClassName
# priorityClassName:

# Timeout for a webhook call in seconds.
# Starting in kubernetes 1.14 you can set the timeout and it is
# encouraged to use a small timeout for webhooks. If the webhook call times out, the request
# the request is handled according to the webhook'sfailure policy.
# timeoutSeconds: 20

securityContext:
  enabled: false
  runAsNonRoot: true
  runAsUser: 1

deploymentStrategy: {}
  # rollingUpdate:
  #   maxSurge: 1
  #   maxUnavailable: 0
  # type: RollingUpdate