OPA Policy

[cmwatts1974]

I am having trouble with a policy to prevent creation of default storage class. I am trying to create an OPA policy that prevents creation or update to a storage class if it contains a annotation and the name of the storage class is not "default"

This is what I have below but that is not quite correct. Any suggestions?

import future.keywords.in

deny[msg] {
input.request.operation = "CREATE"
input.request.kind.kind = "storageclass"

"storageclass" in input.request.object.spec.type
annotations["service.beta.kubernetes.io/is-default-class"] != "true"

msg = "StorageClass not permitted"

}

[charlieegan3]

Hey, I think there might be a few missed parts of the paths to fields here. You can see the schema of a request here: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#webhook-request-and-response

I've had a go at the policy in the playground, does this look like it could work for you?

https://play.openpolicyagent.org/p/8R3Hyzf0jz

[charlieegan3]

Ahh, so if the name of the storage class resource is default, then no annotation is needed?

This should do that: https://play.openpolicyagent.org/p/Q8tzfuwKP2

[cmwatts1974]

that seems to work...let me try it in action

[cmwatts1974]

Sorry for delay...I try to use this yaml

GNU nano 6.2 annotateworks.yaml
apiVersion: storage.k8s.io/v1
kind:
group: storage.k8s.io
kind: StorageClass
version: v1
object:
allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
annotations:
service.beta.kubernetes.io/is-default-class: test
name: default
mountOptions:
- debug
parameters:
type: gp2
provisioner: kubernetes.io/aws-ebs
reclaimPolicy: Retain
volumeBindingMode: Immediate
operation: CREATE

I get the following error:

error: error parsing annotateworks.yaml: error converting YAML to JSON: yaml: line 2: mapping values are not allowed in this context

[anderseknert]

Could that be some whitespace error? YAML tends to be very sensitive with that.

[charlieegan3]

I'm not sure what is going on with the YAML formatting here but this part doesn't look right:

apiVersion: storage.k8s.io/v1
kind: # THIS
group: storage.k8s.io
kind: StorageClass # AND THIS

Like Anders says, make sure that you have checked the whitespace here. http://json2yaml.com is a good site to convert between the json and the yaml.