fix: add resourceNames field in the generated VAPs

[MariamFahmy98]

Explanation

This PR adds resourceNames field in the generated VAP in case Kyverno policy matches resources by names. Also, VAPs don't support wildcards in resource names so we skip generating them in case one of the resource names has a wildcard.

Related issue

Closes #10186

Milestone of this PR

/milestone 1.12.2

Documentation (required for features)

My PR contains new or altered behavior to Kyverno.

• I have sent the draft PR to add or update the documentation and the link is:

What type of PR is this

/kind bug

Proposed Changes

Proof Manifests

Resource Names without wildcards

1. Create the following policy:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-label-app-4
spec:
  validationFailureAction: Audit
  rules:
    - name: check-label-app
      match:
        any:
        - resources:
            kinds:
            - Pod
            - Deployment
            names: 
            - "staging"
      validate:
        cel:
          expressions:
            - expression: "'app' in object.metadata.labels"

2. Check that the corresponding VAP is generated:

apiVersion: admissionregistration.k8s.io/v1alpha1
kind: ValidatingAdmissionPolicy
metadata:
  labels:
    app.kubernetes.io/managed-by: kyverno
  name: check-label-app-4
  ownerReferences:
  - apiVersion: kyverno.io/v1
    kind: ClusterPolicy
    name: check-label-app-4
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ""
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resourceNames:
      - staging
      resources:
      - pods
      - pods/ephemeralcontainers
    - apiGroups:
      - apps
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resourceNames:
      - staging
      resources:
      - deployments
  validations:
  - expression: "'app' in object.metadata.labels"

Resource names with wildcards

1. Create the following policy:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-label-app-3
spec:
  validationFailureAction: Audit
  rules:
    - name: check-label-app
      match:
        any:
        - resources:
            kinds:
            - Pod
            names: 
            - "prod-*"
            - "staging"
      validate:
        cel:
          expressions:
            - expression: "'app' in object.metadata.labels"

2. Check the status:

status:
  validatingadmissionpolicy:
    generated: false
    message: ""

3. Check that there are no generated VAPs:

$ kubectl get validatingadmissionpolicy
No resources found

$ kubectl get validatingadmissionpolicybindings                                                               
No resources found

Checklist

• I have read the contributing guidelines.
• I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
• This is a bug fix and I have added unit tests that prove my fix is effective.
• This is a feature and I have added CLI tests that are applicable.
• My PR needs to be cherry picked to a specific release branch which is .
• My PR contains new or altered behavior to Kyverno and
  • CLI support should be added and my PR doesn't contain that functionality.

Further Comments

[codecov]

Codecov Report

Attention: Patch coverage is 21.73913% with 18 lines in your changes are missing coverage. Please review.

Project coverage is 10.15%. Comparing base (4bbb57a) to head (7007dd7).

Files	Patch %	Lines
...validatingadmissionpolicy/kyvernopolicy_checker.go	33.33%	8 Missing and 2 partials ⚠️
pkg/validatingadmissionpolicy/builder.go	0.00%	8 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10187      +/-   ##
==========================================
- Coverage   10.15%   10.15%   -0.01%     
==========================================
  Files        1030     1030              
  Lines       91785    91796      +11     
==========================================
  Hits         9319     9319              
- Misses      81448    81457       +9     
- Partials     1018     1020       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[realshuting]

Please make sure PRs are cherry-picked to patch versions.

[MariamFahmy98]

/cherry-pick release-1.12