Using rego to enforce storage class

[erezo9]

im trying to put a rego with gatekeeper, for some reason the rego allows the creating to continure although there is no storageclassname provided, what am i doing wrong?

    package k8srequirestorageclass
    violation[{"msg": msg}] {
      provided:= input.review.object.spec.storageClassName
      not provided
      msg := sprintf("you must provide a storage class %v ",  provided)
    }

[srenatus]

If input.review.object.spec.storageClassName is not defined, then

provided:= input.review.object.spec.storageClassName

will fail -- and not provided is never evaluated.

Try combining it:

not input.review.object.spec.storageClassName

[erezo9]

Hey @srenatus thanks for that,
by it self it works
now im trying to do that if its not null. and if its not ""
but it doesnt seem to let the pvc to continue and create
should i merge the two violation into one?

        package k8srequirestroageclass

        violation[{"msg": msg}] {
          not input.review.object.spec.storageClassName
          msg := "you must have a stroage class"
        }

        violation[{"msg": msg}] {
          obj := input.review.object
          not match_class_name(obj)
          msg := sprintf("you must have a stroage class  %v", obj.spec.storageClassName)
        }
        
        match_class_name(obj) {
          obj.spec.storageClassName == ""
        }

[erezo9]

@srenatus answer was

package kubernetes.validating.existence
import future.keywords

deny contains msg if {
	invalidSCN(input)
	msg := "Every resource must have a storageClassName"
}

invalidSCN(obj) {
  obj.spec.storageClassName == ""
}

invalidSCN(obj) {
  not obj.spec.storageClassName
}