feat: Added Ingress SecurityContext and ServiceAccount

[tomassatka]

Made few improvements

1. Added securityContext to be able to run this application on more restricted k8s
2. Added ingress for opal-client to be able to expose inner opa server
3. Added serviceAccount in case user wants to run client/server with different SA. Good use case is query k8s api with http fetcher (considering to write k8s fetcher)

[EliMoshkovich]

Please add:

service:
port: 7000

To avoid the following error during Helm install:
Error: INSTALLATION FAILED: template: opal/templates/ingress-client.yaml:40:30: executing "opal/templates/ingress-client.yaml" at <$.Values.service.port>: nil pointer evaluating interface {}.port

[tomassatka]

Yes good catch. Sorry for that. I corrected it and point to client.opaPort

[fililand]

Hi, is there any follow-up to this PR? Having an ingress as well would be useful

[eduard-k1]

Any moves here? Having service account would be very useful.

[EliMoshkovich]

Hi @tomassatka — thanks a lot for this contribution, and thanks @fililand and @eduard-k1 for your interest in it! 🙏

This is a useful addition and we'd love to get it merged. Since it was opened, master has moved on a fair bit (we added OpenShift support and pod scheduling), so a few things need updating first:

To get this mergeable:

1. Rebase onto the latest master and resolve conflicts in: deployment-client.yaml, deployment-server.yaml, deployment-pgsql.yaml, values.yaml, and values.schema.json.
2. Reconcile the security context settings — master already added client.securityContext (used for OpenShift), so please align your new securityContext/serviceAccount values with the existing ones to avoid clashes. Also note the postgres values now use the postgresql key.
3. Fix the ingress example port in values.yaml — the /client path points to 7002, but the client service exposes 7000.
4. Optional: the values.schema.json diff is mostly reformatting — reverting that would keep the change focused and easier to review.

Once that's done we'll re-review and get it merged. Thanks again for your patience! 🚀