<p>I have below volumes.rego file that I want to use for OPA.</p>
<pre><code>package kubernetes.admission

deny[msg] {
  input.request.kind.kind == &quot;Pod&quot;
  path := input.request.object.spec.volumes[_].nfs.path
  allowd_paths := {
                   &quot;/ifs/public/rw/webdevel&quot;,
                   &quot;/ifs/public/rw/webdevel/prod1&quot;,
                   &quot;/ifs/public/rw/webdevel/prod2&quot;,
                   &quot;/ifs/public/rw/webdevel/prod3&quot;,
                   &quot;/ifs/public/rw/webdevel/test1&quot;,
                   &quot;/ifs/public/rw/webdevel/test2&quot;,
                   &quot;/ifs/public/rw/webdevel/test3&quot;,
                   &quot;/ifs/public/rw/webdevel/dev1&quot;,
                   &quot;/ifs/public/rw/webdevel/dev2&quot;,
                   &quot;/ifs/public/rw/webdevel/dev3&quot;,
                   &quot;/ifs/public/ro/webdevel&quot;
  }
  not allowd_paths[path]
  msg := sprintf(&quot;volume '%v' path not allowed to be mounted&quot;, [path])
}
</code></pre>
<p>As you might have observed, all the allowed paths start with /ifs/public/rw. Many new environments are created under this location. Instead of creating a new entry in rego and applying the changes everytime a new environment is created(like dev, test, prod, etc), can I use regex to match the path &quot;/ifs/public/rw&quot; and anything following that path can also be allowed by the pod to be mounted?</p>
<p>Any suggestions with examples if possible, please?</p>

Ravi Mahankali
<p>Yes, you can use regex in rego. <a href="https://www.openpolicyagent.org/docs/latest/policy-reference/#regex" rel="nofollow noreferrer">Here</a> is a reference for it.</p>
<p>For example, your policy can be written as:</p>
<pre><code>package kubernetes.admission

deny[msg] {
  input.request.kind.kind == &quot;Pod&quot;
  path := input.request.object.spec.volumes[_].nfs.path
  webdevel_regex := &quot;^/ifs/public/rw/webdevel&quot;
  not regex.match(webdevel_regex, path)
  msg := sprintf(&quot;volume '%v' path not allowed to be mounted&quot;, [path])
}
</code></pre>
<p>Of course you can always build more complicated <code>regexes</code> and always test your policies for inputs online at the <a href="https://play.openpolicyagent.org/" rel="nofollow noreferrer">rego-playground</a>.</p>
<p>Later, if you chose to add more patterns, you can OR them together either in the evaluation expression or the regex itself. Details you can find in the docs link provided.</p>
<p>Hope this helps!</p>
