Central opa deployment

charts/apps/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v2
 name: authz
 description: ArgoCD Apps used to deploy Authorization infrastructure
 type: application
-version: 0.1.0
+version: 0.2.0

charts/apps/templates/opa-app.yaml

@@ -0,0 +1,28 @@
+{{ if .Values.opa.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: opa
+  namespace: {{ .Release.Namespace }}
+  finalizers:
+    - resources-finalizer.argocd.arogproj.io
+spec:
+  project: {{ default .Release.Namespace .Values.project }}
+  source:
+    repoURL: {{ .Values.opa.repoUrl }}
+    targetRevision: {{ .Values.opa.targetRevision }}
+    path: {{ .Values.opa.path }}
+    {{- if .Values.opa.valuesObject }}
+    helm:
+      valuesObject:
+          {{ .Values.opa.valuesObject | toYaml | nindent 10 }}
+    {{- end }}
+  destination:
+    name: {{ .Values.destination.name }}
+    server: {{ .Values.destination.server }}
+    namespace: {{ default .Release.Namespace .Values.destination.namespace }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+{{- end }}

charts/apps/values.yaml

@@ -10,3 +10,26 @@ bundler:
   repoUrl: https://github.com/DiamondLightSource/authz.git
   targetRevision: HEAD
   path: charts/bundler
+
+opa:
+  enabled: true
+  repoUrl: https://github.com/DiamondLightSource/authz.git
+  targetRevision: HEAD
+  path: charts/opa
+  valuesObject:
+    orgData:
+      bundlerSecret:
+        name: token-authorization
+        key: bearer
+    orgPolicy:
+      enabled: true
+    autoscaling:
+      enabled: true
+      minReplicas: 2
+    ingress:
+      enabled: true
+      hosts:
+        - host: authz.diamond.ac.uk
+          paths:
+            - path: /
+              pathType: Prefix

charts/bundler/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: bundler
 description: A Open Policy Agent (OPA) Data Bundle Server providing permissionable data from ISPyB
 type: application
-version: 0.4.0
+version: 0.5.0
 appVersion: 0.0.13
 maintainers:
   - name: garryod

charts/bundler/values.yaml

@@ -43,8 +43,8 @@ ingress:
   hosts:
     - host: authz.diamond.ac.uk
       paths:
-        - path: /
-          pathType: Prefix
+        - path: /bundle.tar.gz
+          pathType: ImplementationSpecific
   tls: []
 
 resources: {}

charts/opa/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: opa
 description: An OPA deployment to run alongside applications requiring authorization
 type: application
-version: 0.4.0
+version: 0.5.0
 appVersion: 0.59.0
 maintainers:
   - name: garryod

charts/opa/templates/deployment.yaml

@@ -25,7 +25,11 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "common.names.fullname" . }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
+      {{- else }}
+      serviceAccountName: {{ default "default" .Values.serviceAccount.name }}
+      {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
@@ -55,9 +59,9 @@ spec:
                     name: {{ tpl .Values.orgData.bundlerSecret.name . }}
                     key: {{ .Values.orgData.bundlerSecret.key }}
             {{- end -}}
-            {{- if and .Values.orgPolicy.enabled .Values.orgPolicy.userinfoEndpoint }}
-            - name: USERINFO_ENDPOINT
-              value: {{ .Values.orgPolicy.userinfoEndpoint }}
+            {{- if and .Values.orgPolicy.enabled .Values.orgPolicy.jwksEndpoint }}
+            - name: JWKS_ENDPOINT
+              value: {{ .Values.orgPolicy.jwksEndpoint }}
             {{- end }}
             {{- if .Values.extraEnv }}
               {{- .Values.extraEnv | toYaml | nindent 12 }}

charts/opa/templates/ingress.yaml

@@ -0,0 +1,44 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if .pathType  }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              service:
+                name: {{ include "common.names.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/opa/values.yaml

@@ -17,7 +17,7 @@ orgData:
     key: bearer-token
 orgPolicy:
   enabled: false
-  userinfoEndpoint: https://auth.diamond.ac.uk/cas/oidc/oidcProfile
+  jwksEndpoint: https://authn.diamond.ac.uk/realms/master/protocol/openid-connect/certs
 configOverride: {}
 extraConfig: {}
 extraServices: {}
@@ -27,7 +27,7 @@ extraEnv: []
 portOverride: ""
 
 serviceAccount:
-  create: false
+  create: true
   name: ""
 
 podAnnotations: {}
@@ -40,6 +40,13 @@ service:
   type: ClusterIP
   port: 80
 
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts: []
+  tls: []
+
 resources: {}
 
 replicaCount: 1