violation to check if key exists

[equick]

How do I raise a violation if a key is missing in a pod? For example, this violation prevents a pod being created if nodeSelectorTerms don't match. However it ignores the pod if the affinity configuration is missing.

pod := input.review.object

violation[{"msg": msg}] {
  provided = pod.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[_]
  required = input.parameters.nodeSelectorTerms
  not matches_any(provided, required)
  msg := "Affinity matchExpression is incorrect"
}

Do I need another violation to check if pod.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms exists? And if so, please could you show me an example of how to achieve this?

Thanks,
Ed

[equick]

This works using object.get :

violation[{"msg": msg}] {
  provided = object.get(pod, ["spec", "affinity", "nodeAffinity", "requiredDuringSchedulingIgnoredDuringExecution", "nodeSelectorTerms"], {{"matchExpressions": []}})
  required = input.parameters.nodeSelectorTerms
  field = provided[_]
  not matches_any(field, required)
  msg := "Affinity matchExpression is incorrect"
}

[anderseknert]

If you want to make that attribute required, I'd add another violation. That way you'll can have the error message explain in detail why it fails:

violation[{"msg": msg}] {
  not pod.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms

  msg := "missing required pod.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms"
}

[equick]

That's exactly what I needed. Thank you!