Helm chart to deploy OPA

[tsandall]

Some users have asked whether we have a Helm chart for OPA. As far as I know, today the answer is no. It would be useful to create a Helm chart that (minimally) could be used for the admission control use case on top of Kubernetes. I haven't worked with Helm before, so I don't know if there are gotchas.

• Should the helm chart require a cert (which is required in the admission control use case)?
• Should the helm chart assist in registering OPA as an admission controller?
• Should users be able to manage policies via Helm? We can probably defer this one for now.

In the admission control use case, some users have requested that OPA be scheduled onto the master node(s). The Helm chart must not preclude this.

[nrshrivatsan]

For the Policy Store, given OPA has support for S3, I propose using minio.io for a Cloud-Native helm.sh for OPA!

[srenatus]

It might be a bit of a digression, but I'd be happy to contribute a Habitat plan for OPA. From that, we could, among other things, export a helm chart. ("Habi-what?" 👉 https://habitat.sh)

[tsandall]

@srenatus having a Habitat plan for OPA would be cool. I'm not familiar with Habitat so I don't know what the Helm output would look like. I'd like the Helm chart to be as clear/idiomatic as possible--I think we should start with writing one from scratch, but we can always revisit that in the future.

[srenatus]

having a Habitat plan for OPA would be cool.

🎉 core/opa

I certainly agree with being as idiomatic as possible with the helm chart. So, this just adds another deployment option, and it happens to fill a need I had 😄

[tsandall]

@srenatus cool! do you mind if I put a link to the habitat plan in the contrib repo README?

[srenatus]

@tsandall not at all! thank you 😃

[tsandall]

Ref: helm/charts#8915

[gtaylor]

I haven't forgotten about this, btw. Will try to get a first pass done on the Chart PR tonight or tomorrow.

[tsandall]

@gtaylor sounds good. Just FYI, I've updated the chart PR so that by default it'll pull down a policy from openpolicyagent.org that you can kick the tires with.

[tsandall]

This has been merged into the upstream helm repo. helm/charts#8915