apiVersion: v1
kind: ConfigMap
metadata:
    name: k8s-policy-{{ .Values.policy_config.name}}-{{ randAlphaNum 5 | lower }}
data:
    conditional-annotation.rego: |
        package admission
        import data.k8s.matches
        deny[{
            "id": "conditional-annotation",
            "resource": {"kind": kind, "namespace": namespace, "name": name},
            "resolution": {"patches":  p, "message" : "{{ .Values.policy_parameters.message }}"},
            }] {
                matches[[kind, namespace, name, matched_object]]
                matched_object.metadata.annotations["{{ .Values.policy_parameters.matching_annotation.key}}"] == "{{ .Values.policy_parameters.matching_annotation.value }}"
                p = [{"op": "add", "path": "/metadata/annotations/{{ .Values.policy_parameters.target_annotation.key }}", "value": "{{ .Values.policy_parameters.target_annotation.value }}"}]
                }