Provide feedback if policy deployment goes to error status

[itowlson]

When a policy is deployed as a config map, OPA sets the openpolicyagent.org/policy-status annotation on it to mark if it was okay or not. If we deploy a policy, and it fails, it would be good to report the error as part of deployment rather than requiring users to go check somewhere.

The difficulty would be knowing when OPA has updated the status. It would be fine on the initial creation - just wait for the presence of the annotation. But when someone updates a policy, is there a way to know when the new status has been set?

[itowlson]

Ah... For updates I guess we could (and indeed should) remove the status annotation before performing the kubectl replace. In which case we need only wait for the annotation to appear, just as in the create case.