Feat/opa mgmt

packages/services/okdp-examples/okdp-examples.yaml

@@ -16,7 +16,7 @@
 
 apiVersion: v1alpha1
 name: okdp-examples
-tag: 1.2.0-p01
+tag: 1.3.0-p01
 protected: false
 description: |
   A collection of hands-on examples, helper utilities, Jupyter notebooks, 
@@ -36,7 +36,7 @@ modules:
     source:
       oci:
         repository: quay.io/okdp/charts/okdp-examples
-        tag: 1.2.0
+        tag: 1.3.0
     values: |
 
       {{- $namespace := printf "%v" .Release.spec.targetNamespace -}}

packages/services/trino/trino.yaml

@@ -19,7 +19,7 @@ name: trino
 #tag: 480-p01
 # Currently, the UI requires the version to conform to SemVer (https://simversion.github.io/)
 # https://github.com/OKDP/okdp-ui/blob/main/src/app/shared/utils/utils.ts#L131
-tag: 480.0.0-p06
+tag: 480.0.0-p07
 protected: false
 description: |
   Apache Trino - Distributed SQL query engine designed for large-scale data processing across multiple data sources.
@@ -36,6 +36,8 @@ schema:
       workerMemoryGi: { type: number, default: 2, multipleOf: 0.25, description: "Worker memory (GiB) used for Kubernetes requests/limits (recommended: request=limit)." }
       workerCpu: { type: number, default: 0.5, multipleOf: 0.25, description: "Worker CPU request in millicores (e.g., 500=0.5 vCPU, 1000=1 vCPU)." }
       enableOPA: { type: boolean, default: true, description: "Whether to enable OPA." }
+      enableOPAL: { type: boolean, default: false, description: "Whether to enable OPAL. When false, OPA policies are loaded from labeled ConfigMaps by the kube-mgmt sidecar." }
+      enableOPADebugLogs: { type: boolean, default: false, description: "Log OPA status and decision logs to the container console. Verbose, intended for debugging." }
       policyRepoUrl: { type: string, default: "https://github.com/OKDP/okdp-examples.git", description: "OPA policy repo URL" }
       policyRepoMainBranch: { type: string, default: "main", description: "OPA policy repo branch." }
       OPAL_POLICY_SUBSCRIPTION_DIRS: {type: string, default: "trino_opa_policy", description: "Policy directories in the repository for which the client will subscribe to, seperated by ':'."}
@@ -62,6 +64,7 @@ schema:
 
 modules:
   - name: opa
+    enabled: "{{ .Parameters.enableOPA }}"
     timeout: 10m
     source:
       helmRepository:
@@ -78,14 +81,33 @@ modules:
         pullPolicy: IfNotPresent
       useHttps: false
       port: 8181
+      {{- if .Parameters.enableOPADebugLogs }}
+      extraArgs:
+        - "--set=status.console=true"
+        - "--set=decision_logs.console=true"
+      {{- end }}
       mgmt:
-        enabled: false
+        enabled: {{ not .Parameters.enableOPAL }}
+        startupProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /health
+            port: 8181
+            scheme: HTTP
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 10
+        data:
+          enabled: true
+        policies:
+          enabled: true
       rbac:
-        create: false
+        create: {{ not .Parameters.enableOPAL }}
       serviceAccount:
-        create: false
+        create: {{ not .Parameters.enableOPAL }}
 
   - name: opal-secrets
+    enabled: "{{ and .Parameters.enableOPA .Parameters.enableOPAL }}"
     timeout: 10m
     source:
       oci:
@@ -94,6 +116,7 @@ modules:
     values: |
       fullnameOverride: {{ .Release.metadata.name }}-opal-secrets
   - name: opal
+    enabled: "{{ and .Parameters.enableOPA .Parameters.enableOPAL }}"
     dependsOn:
       - opa
       - opal-secrets
@@ -189,8 +212,6 @@ modules:
           OIDC_SCOPES: "{{ printf "%d %o" .Parameters.defaultclientScopes .Parameters.optionalClientScopes | join " " }}"
 
   - name: main
-    dependsOn:
-      - opal
     timeout: 10m
     source:
       helmRepository: