Fix - policy gets blocked with 1.4.3-rc1 if any/all is defined in match block

[realshuting]

Related issue

Fixes #2392.

Also relates to #2337.

Milestone of this PR

/milestone 1.4.3

What type of PR is this

/kind bug

Proposed Changes

PR #2261 converts GVK to its valid format during policy mutation, while any/all is not handled properly.

This PR covers any/all conversion in both match and exclude, to name them: match.any.resources.kinds, match.all.resources.kinds, exclude.any.resources.kinds, exclude.all.resources.kinds.

Proof Manifests

The following policies creation passes:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: test
spec:
  rules:
    - name: test
      match:
        all:
        - resources:
            kinds:
            - configmap
      exclude:
        all:
        - resources:
            kinds:
            - configmap
      validate:
        message: "Metadata label 'name' is required."
        pattern:
          metadata:
            labels:
              name: "?*"

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: test
spec:
  rules:
    - name: test
      match:
        any:
        - resources:
            kinds:
            - configmap
      exclude:
        any:
        - resources:
            kinds:
            - Pod
      validate:
        message: "Metadata label 'name' is required."
        pattern:
          metadata:
            labels:
              name: "?*"

Checklist

• I have read the contributing guidelines.
• I have added tests that prove my fix is effective or that my feature works.
• [] My PR contains new or altered behavior to Kyverno and
  • [] I have added or changed the documentation myself in an existing PR and the link is:
  • [] I have raised an issue in kyverno/website to track the doc update and the link is:
  • [] I have read the PR documentation guide and followed the process including adding proof manifests to this PR.

Further Comments