Bug fix background scan issue for any/all in match/exclude

[vyankyGH]

Signed-off-by: Vyankatesh vyankateshkd@gmail.com

Related issue

closes #2299

Milestone of this PR

/milestone 1.4.3

What type of PR is this

fix issue of any / all functionality with to match / exclude block

Proposed Changes

Proof Manifests

Apply these resources:

apiVersion: v1
kind: Namespace
metadata:
  name: test
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: test
  namespace: test
data:
  foo: bar

Apply policy with any

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: test
spec:
  background: true
  validationFailureAction: audit # even with enforce
  rules:
    - name: test
      match:
        any:
          - resources:
              kinds:
                - ConfigMap
      validate:
        message: "Metadata label 'name' is required."
        pattern:
          metadata:
            labels:
              name: "?*"

Result
kubectl get  polr -n test
NAME           PASS   FAIL   WARN   ERROR   SKIP   AGE
polr-ns-test   0      2      0      0       0      7m

Checklist

• I have read the contributing guidelines.
• I have added tests that prove my fix is effective or that my feature works.
• My PR contains new or altered behavior to Kyverno and
  • I have added or changed the documentation myself in an existing PR and the link is:
  • [] I have raised an issue in kyverno/website to track the doc update and the link is:
  • [] I have read the PR documentation guide and followed the process including adding proof manifests to this PR.

Further Comments

[realshuting]

processExistingKinds takes the matching kind to fetch the list of resources. Why do we pass exclude kinds list here?

We should update this logic to filter out resources excluded from any/all:

kyverno/pkg/policy/common.go

Line 223 in e6317da

excludeResources(resourceMap, rule.ExcludeResources.ResourceDescription, pc.configHandler, log)

Note that we need to exclude each entry individually in any, but all (merged) entries in all. For example:
The following rule excludes all Pods and all resources in namespace staging.

exclude:
  any:
  - resources:
      kinds:
      - Pod
  - resources:
      namespaces:
      - staging

While this rule excludes the Pod from the staging namespace only.

exclude:
  all:
  - resources:
      kinds:
      - Pod
  - resources:
      namespaces:
      - staging