Add Open Policy Agent (OPA) to Kubernetes cluster

[mitchellhuang]

Description

• Add Open Policy Agent (OPA) admission controller to the Kubernetes (k8s) cluster installed by Tectonic.
• I tried to be as modular as possible, for example, re-using the Terraform tls module to generate OPA self-signed certs.

Submission

• terraform plan: https://gist.github.com/mitchellhuang/30f9d4f3a66914686beec94fb9a22420
  • Relevant changes start on L1336

Notes

• I assumed that by installing OPA, we meant the full OPA admission controller.
• I assumed that we wanted the k8s manifests in HCL instead of YAML so I used the Terraform Kubernetes provider.
• Looks like there is a bug with the Terraform k8s provider which causes Terraform to dial the k8s cluster during a terraform plan when specifying kubernetes_namespace so I have submitted my terraform plan without namespace.tf

Update 2020-07-14

I've identified two critical issues with my PR:

1. I did not implement the last step of the OPA admission controller documentation: the ValidatingWebhookConfiguration CRD. I have solved this by actually adding this step to the pull request (ha): 5c21bf9 09453ea

2. OPA was sharing the same CA with the Tectonic control panel. Because of how OPA works, I assume we either want to create an independent CA for OPA or use a user provided CA for OPA. I have gone ahead and added those variables to config.tf, and if they are not supplied, they will be auto-generated, similar to tls/kube/self-signed: 3bf71b8