Validation for generate loops and support ClusterPolicy/Policy in match block

[vyankyGH]

Signed-off-by: Vyankatesh vyankateshkd@gmail.com

Related issue

closes #2149
closes #1941

Milestone of this PR

/milestone 1.5.0

Proposed Changes

Proof Manifests

Policy with same generate kind get block while installation

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-networkpolicy
  annotations:
    policies.kyverno.io/title: Add Network Policy
    policies.kyverno.io/category: Multi-Tenancy
    policies.kyverno.io/subject: NetworkPolicy
    policies.kyverno.io/description: >-
      By default, Kubernetes allows communications across all Pods within a cluster. 
      The NetworkPolicy resource and a CNI plug-in that supports NetworkPolicy must be used to restrict 
      communications. A default NetworkPolicy should be configured for each Namespace to 
      default deny all ingress and egress traffic to the Pods in the Namespace. Application 
      teams can then configure additional NetworkPolicy resources to allow desired traffic 
      to application Pods from select sources. This policy will create a new NetworkPolicy resource
      named `default-deny` which will deny all traffic anytime a new Namespace is created.      
spec:
  validationFailureAction: audit
  rules:
  - name: default-deny
    match:
      resources: 
        kinds:
        - NetworkPolicy
    generate:
      kind: NetworkPolicy
      name: default-deny
      namespace: "{{request.object.metadata.name}}"
      synchronize: true
      data:
        spec:
          # select all pods in the namespace
          podSelector: {}
          # deny all traffic
          policyTypes: 
          - Ingress
          - Egress

Error from server: error when creating ".\\Yamls\\policy-label.yaml": admission webhook "validate-policy.kyverno.svc" denied the request: generation kind and match resource kind should not be the same.

Checklist

• I have read the contributing guidelines.
• I have added tests that prove my fix is effective or that my feature works.
• My PR contains new or altered behavior to Kyverno and
  • I have added or changed the documentation myself in an existing PR and the link is:
  • [] I have raised an issue in kyverno/website to track the doc update and the link is:
  • [] I have read the PR documentation guide and followed the process including adding proof manifests to this PR.

Further Comments

[chipzoller]

PR needs to be completed with descriptive info and proof manifests