I want to check if an annotation exist in a namespace, if not deny. I have this code but not working. How can I get the right object path ( namespace.annotation ) to compare to ?

  violation[{"msg": msg, "details": {}}] {
        input.request.kind.kind == "Namespace"
        not input.review.object.metadata.annotations.hostPath
        msg := sprintf("no hostpath defined in namespace for this pod %v, [input.review.object.metadata.name])
    }

I have both pod and namespace specified in my constrains since I need rules that check both in my template

spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
      - apiGroups: [""]
        kinds: ["Namespace"]

thanks !