Pass --opa.skip-namespace-inference flag to OPA openshift

jotak · jotak · commit 90bfdaf3c012 · 2024-05-21T14:10:36.000+02:00
In Loki operator, when set up with openshift for network logs, pass the --opa.skip-namespace-inference flag set to true to allow fine-grained RBAC Related: observatorium/opa-openshift#24 Signed-off-by: Joel Takvorian <jtakvori@redhat.com>
diff --git a/operator/internal/manifests/openshift/opa_openshift.go b/operator/internal/manifests/openshift/opa_openshift.go
@@ -58,6 +58,7 @@ func newOPAOpenShiftContainer(mode lokiv1.ModeType, secretVolumeName, tlsDir, mi
 		args = append(args, []string{
 			fmt.Sprintf("--opa.matcher=%s", opaNetworkLabelMatchers),
 			"--opa.matcher-op=or",
+			"--opa.skip-namespace-inference=true",
 		}...)
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -58,6 +58,7 @@ func newOPAOpenShiftContainer(mode lokiv1.ModeType, secretVolumeName, tlsDir, mi`
`58`	`58`	`args = append(args, []string{`
`59`	`59`	`fmt.Sprintf("--opa.matcher=%s", opaNetworkLabelMatchers),`
`60`	`60`	`"--opa.matcher-op=or",`
	`61`	`+ "--opa.skip-namespace-inference=true",`
`61`	`62`	`}...)`
`62`	`63`	`}`
`63`	`64`