Add Open Policy Agent chart

[tsandall]

Hello 👋

This is my first chart. Let me know what should be fixed and what can be improved.

What this PR does / why we need it:

This PR adds a chart to deploy OPA as an admission controller. Hopefully this will be useful for others.

Special notes for your reviewer:

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

• DCO signed
• Variables are documented in the README.md (docs are inlined into the values.yaml, hopefully this is ok!)

/cc @gtaylor

[k8s-ci-robot]

@tsandall: GitHub didn't allow me to request PR reviews from the following users: gtaylor.

Note that only helm members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

Hello 👋

What this PR does / why we need it:

This PR adds a chart to deploy OPA as an admission controller. Hopefully this will be useful for others.

Special notes for your reviewer:

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

• DCO signed
• Variables are documented in the README.md (docs are inlined into the values.yaml, hopefully this is ok!)

/cc @gtaylor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

Hi @tsandall. Thanks for your PR.

I'm waiting for a helm member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[gtaylor]

Just two very minor suggestions!

As a very optional pointer, it could be worth considering defining a helper to hold your common labels, per this example. This cuts down on some noise in the resource templates, and also allows your users to quickly fork the Chart to add their org-standard labels.

[tsandall]

@gtaylor thanks for the feedback. I've added another commit addressing those comments.

[gtaylor]

I don't have perms to OK this for CI, but this looks good to me!

[tsandall]

@gtaylor is there someone else who we should ping to look at this? It would be cool if we could get this merged. I know of at least one OPA user that's already rolled their own helm chart.

[gtaylor]

I'll see if I can rouse someone in the #charts room in the Kubernetes Slack org. It looks like the review volume has increased to the point of overwhelming the reviewers.

[mattfarina]

Can you please document the configuration in a table. See the wordpress chart for an example.

[mattfarina]

/ok-to-test

I'm sorry for the delay in reviewing. We are a bit overwhelmed. Look out for changes coming to reduce that pressure on the maintainers.

[mattfarina]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mattfarina, tsandall

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [mattfarina]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[alexellis]

@tsandall are there any plans to create an upstream chart outside of the charts repo? Many projects are moving away from the "stable" repo which is going to be considered deprecated for most projects going forward. open-policy-agent/opa#1035

[alexellis]

https://www.reddit.com/r/kubernetes/comments/f1rnn4/helmstable_is_going_away_now_what/

[tsandall]

@alexellis no immediate plans, though if someone wants to take this on, I'd be happy to support.

[phisco]

Hi @tsandall, me and @angelbarrera92 would be interested in helping to bring the helm chart to https://artifacthub.io/ .
In case having a vanilla opa chart is still interesting for the project let us know what would be your requirements/expectations.

[tsandall]

@phisco that would be great. Can we migrate the existing (deprecated) chart as-is or will changes be needed? If you can drive the effort, that would be excellent.

[angelbarrera92]

@phisco that would be great. Can we migrate the existing (deprecated) chart as-is or will changes be needed? If you can drive the effort, that would be excellent.

Cio @tsandall !!!

As @phisco said, we want to contribute helping hosting/automating the OPA helm chart releases. I saw in the following thread/issue and interesting comment from a guy who created a guide to migrate helm charts: https://github.com/helm/charts/issues/21103#issuecomment-715907845

TL;DR: We followed: https://github.com/torstenwalter/helm-chart-hosting

This one uses a completly empty github repository + github actions in place to automatic release everything.

We've created a repository under our organization: https://github.com/sighupio/opa-helm-charts, feel free to take a look.
Now, we have multiple options:

1. We can transfer the ownership of the repository to your organization + We can PR to the new destination with the needed changes (uris mostly).
2. Create a new repository from scratch. Then we can PR it.
3. If you consider that's is not the best option for your chart, we can work in another different approach.
   3.1 Maybe include the helm chart inside the same OPA repository.

Thanks!

[alexellis]

@AlexsJones don't you use OPA in your stack? Would this be relevant to you too?

Once the dust as settled, it would be great to get an arkade app for OPA too.

[angelbarrera92]

@phisco that would be great. Can we migrate the existing (deprecated) chart as-is or will changes be needed? If you can drive the effort, that would be excellent.

Cio @tsandall !!!

As @phisco said, we want to contribute helping hosting/automating the OPA helm chart releases. I saw in the following thread/issue and interesting comment from a guy who created a guide to migrate helm charts: #21103 (comment)

TL;DR: We followed: https://github.com/torstenwalter/helm-chart-hosting

This one uses a completly empty github repository + github actions in place to automatic release everything.

We've created a repository under our organization: https://github.com/sighupio/opa-helm-charts, feel free to take a look.
Now, we have multiple options:

1. We can transfer the ownership of the repository to your organization + We can PR to the new destination with the needed changes (uris mostly).

2. Create a new repository from scratch. Then we can PR it.

3. If you consider that's is not the best option for your chart, we can work in another different approach.
   3.1 Maybe include the helm chart inside the same OPA repository.

Thanks!

We can also think about integrating the same release workflow @ gatekeeper repository into the OPA one.

[tsandall]

@angelbarrera92 would it be possible to host the chart under an existing repo? I think that putting into https://github.com/open-policy-agent/kube-mgmt would make the most sense. If that's possible, let me know and we can setup a GitHub team and add you to it so that you can manage it.

[angelbarrera92]

@angelbarrera92 would it be possible to host the chart under an existing repo? I think that putting into https://github.com/open-policy-agent/kube-mgmt would make the most sense. If that's possible, let me know and we can setup a GitHub team and add you to it so that you can manage it.

Ciao @tsandall! Sure it is possible, but it makes it really hard to maintain the git history of the original helm chart (unless you rewriting the kube-mgmt history).
If the git history is something that is not really relevant at this point, I can work on it without major problems.

Feel free to create that team including me and @phisco!

Thanks!

[tsandall]

In this case, I'm not too worried about the git history. I've made a team, granted rights on the kube-mgmt repo, and added both of you! Thanks for working on this!