OPA Rego to deny storageclass annotate as default if name not default

[cmwatts1974]

Hello I am new to OPA policy and was looking for some input on creating a .rego that would deny service creation of a storageclass annotated as default unless name is default. See below from what I have so far that is not working.

package kubernetes.admission

import data.kubernetes.namespaces

import input.request.object.metadata.annotations as annotations

deny[msg] {
    input.request.kind.kind = "StorageClass"
    input.request.operation = "CREATE"
    input.request.object.spec.storageClassName = "Default"
    not annotations["service.beta.kubernetes.io/kubernetes.io/aws-ebs"] = "false"
    msg = "StorageClass not permitted"
}

[anderseknert]

Your policy looks fine, but I don't see any spec.storageClassName attribute in the schema for a StorageClass resource — or even a spec at all. Am I missing something?

A bit of an unrelated nit, but it's often better (as in, clearly shows intent) to use == for comparison, and := for assignment :)

[cmwatts1974]

I just guessed at that I am not sure what I should put there. What should the schema be

[anderseknert]

The schema is linked in my reply. Or what do you mean? 😊

[cmwatts1974]

Ok I did not notice so it is not storageClassName it should be storageclasses