blog-opa-example2.rego.rb

package authorization

import data.k8s.matches

deny[{
	"id": "storageclasses",
	"resource": {
		"kind": kind,
		"namespace": namespace,
		"name": name,
	},
	"resolution": {"message": "Your're not allowed to create/update/delete the StorageClass 'ceph'"},
}] {
	matches[[kind, namespace, name, resource]]

	resource.spec.resourceAttributes.resource = "storageclasses"
	resource.spec.resourceAttributes.name = "ceph"
	re_match("^(create|update|delete|deletecollections)$", resource.spec.resourceAttributes.verb)
}