<p>I want to check if an annotation exist in a namespace, if not deny. I have this code but not working. How can I get the right object path ( namespace.annotation ) to compare to  ?</p>
<pre><code>  violation[{&quot;msg&quot;: msg, &quot;details&quot;: {}}] {
        input.request.kind.kind == &quot;Namespace&quot;
        not input.review.object.metadata.annotations.hostPath
        msg := sprintf(&quot;no hostpath defined in namespace for this pod %v, [input.review.object.metadata.name])
    }
</code></pre>
<p>I have both pod and namespace specified in my constrains since I need rules that check both in my template</p>
<pre><code>spec:
  match:
    kinds:
      - apiGroups: [&quot;&quot;]
        kinds: [&quot;Pod&quot;]
      - apiGroups: [&quot;&quot;]
        kinds: [&quot;Namespace&quot;]
</code></pre>
<p>thanks !</p>

mohbar
<p>Check it out <a href="https://github.com/open-policy-agent/gatekeeper-library/blob/master/library/general/requiredlabels/src.rego#L13" rel="nofollow noreferrer">this nearly identical example</a> from the gatekeeper library repository.<br />
I think the specific issue is with the way you are extracting the annotation itself (notice the example is using square brackets while you are using a dot notation).</p>
