From eb30c73f95a5b77af4be3ab289020c4e4583b445 Mon Sep 17 00:00:00 2001
From: Ashutosh Narkar <anarkar4387@gmail.com>
Date: Tue, 21 Jan 2025 15:54:23 -0800
Subject: [PATCH] charts: Update authz policy to be v1 compatible

Fixes: #272

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
---
 charts/opa-kube-mgmt/templates/deployment.yaml | 13 +++++++------
 charts/opa-kube-mgmt/values.yaml               |  2 +-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/charts/opa-kube-mgmt/templates/deployment.yaml b/charts/opa-kube-mgmt/templates/deployment.yaml
index cf43d357..70a5ff22 100644
--- a/charts/opa-kube-mgmt/templates/deployment.yaml
+++ b/charts/opa-kube-mgmt/templates/deployment.yaml
@@ -58,17 +58,18 @@ spec:
             TOKEN=`cat /bootstrap/mgmt-token`
             cat > /bootstrap/authz.rego <<EOF
             package system.authz
-            default allow = false
+            import rego.v1
+            default allow := false
             # Allow anonymous access to the default policy decision.
-            allow { input.path = [""]; input.method = "POST" }
-            allow { input.path = [""]; input.method = "GET" }
+            allow if { input.path = [""]; input.method == "POST" }
+            allow if { input.path = [""]; input.method == "GET" }
             # This is only used for health check in liveness and readiness probe
-            allow { input.path = ["health"]; input.method = "GET" }
+            allow if { input.path = ["health"]; input.method == "GET" }
 {{- if .Values.prometheus.enabled }}
             # This allows metrics to be scraped by prometheus
-            allow { input.path = ["metrics"]; input.method = "GET" }
+            allow if { input.path = ["metrics"]; input.method == "GET" }
 {{- end }}
-            allow { input.identity == "$TOKEN" }
+            allow if { input.identity == "$TOKEN" }
             EOF
 {{- end }}
 {{- range $policyName, $policy := .Values.bootstrapPolicies }}
diff --git a/charts/opa-kube-mgmt/values.yaml b/charts/opa-kube-mgmt/values.yaml
index b74c3ae5..ee1f0323 100644
--- a/charts/opa-kube-mgmt/values.yaml
+++ b/charts/opa-kube-mgmt/values.yaml
@@ -112,7 +112,7 @@ hostNetwork:
 # OPA docker image configuration.
 image:
   repository: openpolicyagent/opa
-  tag: 0.69.0
+  tag: 1.0.1
   pullPolicy: IfNotPresent
 
 # One or more secrets to be used when pulling images