[BUG] Don't allow policy with variables within specific fields.

[kacejot]

Software version numbers
State the version numbers of applications involved in the bug.

• Kubernetes version: 1.21.0
• Kyverno version: 1.3.5

Describe the bug
For now we can create a policy with variables within path field in JSONPatch mutation.
We should disallow such cases.

Example policy

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: policy-patch-cm
spec:
  rules:
    - name: pCM1
      match:
        resources:
          name: "config-game"
          kinds:
          - ConfigMap
      mutate:
        patchesJson6902: |-
          - path: "{{request.object.path.root}}/data/ship.properties"
            op: add
            value: |
              type=starship
              owner=utany.corp
          - path: "/data/newKey1"
            op: add
            value: newValue1

[kacejot]

@JimBugwadia, could you please describe additional fields that should not contain variables?

[JimBugwadia]

@kacejot - the other place we do not allow variables is in match / exclude kind fields.

[NoSkillGirl]

@JimBugwadia - we do not allow variables in the complete match/exclude block or just in match.kind/exclude.kind?

[NoSkillGirl]

@JimBugwadia - we do not allow variables in the complete match/exclude block or just in match.kind/exclude.kind?

@JimBugwadia , @chipzoller , @realshuting ??

[JimBugwadia]

Variables are currently not allowed in the kind field. I am not aware of any other restrictions.

However, see: #1954