blog-opa-example1.rego.rb

package authorization

import data.k8s.matches

deny[{
	"id": "pods-kube-system",
	"resource": {
		"kind": kind,
		"namespace": namespace,
		"name": name,
	},
	"resolution": {"message": "Your're not allowed to create/update/delete pods in kube-system"},
}] {
	matches[[kind, namespace, name, resource]]

	not re_match("^(system:kube-controller-manager|system:kube-scheduler)$", resource.spec.user)
	resource.spec.resourceAttributes.namespace = "kube-system"
	resource.spec.resourceAttributes.resource = "pods"
	re_match("^(create|update|delete|deletecollections)$", resource.spec.resourceAttributes.verb)
}