Feature/foreach validate

[JimBugwadia]

Related issue

Implements validate.foreach: #1745

Milestone of this PR

1.5

What type of PR is this

/kind feature

Proposed Changes

Implements foreach for validate rules

Checklist

• I have read the contributing guidelines.
• I have added tests that prove my fix is effective or that my feature works.
• My PR contains new or altered behavior to Kyverno and
  • [] I have added or changed the documentation myself in an existing PR and the link is:
  • [] I have raised an issue in kyverno/website to track the doc update and the link is:
  • [] I have read the PR documentation guide and followed the process including adding proof manifests to this PR.

Pending Tasks (before merge)

• Add tests for foreach context and preconditions
• Add element to context instead of replacing request.object
• make RuleStatus lowercase
• return RuleStatusSkip when an conditional or global anchors do not match resource
• add Validation for foreach and fields like list.
• add messages for foreach rule responses

Tasks to be complete after merge to main

• add docs for validate.foreach: [Docs] docs for validate & mutate foreach rules website#313
• fix automation tests: [BUG] fix automation test results policies#139
• fix auto-gen: [BUG] fix auto-gen for validate.foreach #2464
• run code-generator: [BUG] run code-generator for 1.5 schema changes #2465
• Test and document nested loops via JMESPath

[JimBugwadia]

Here is a sample policy for testing:

apiVersion : kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-containers
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: check-names
    match:
      resources:
        kinds:
        - Pod
    preconditions:
      - key: "{{request.type}}"
        operator: NotEquals
        value: "DELETE"    
    validate:
      message: "Container names must contain the suffix '-valid'"  
      foreach:
        list: "request.object.spec.containers"
        pattern:
          name: "*-valid"

With this policy configured, here are some tests to show it executing:

λ kubectl run nginx --image=nginx
Error from server: admission webhook "validate.kyverno.svc" denied the request:

resource Pod/default/nginx was blocked due to the following policies

check-containers:
  check-names: 'validation failed in foreach rule for validation error: Container
    names must contain the suffix ''-valid''. Rule check-names failed at path /name/'

λ kubectl run nginx-valid --image=nginx
pod/nginx-valid created

[realshuting]

@JimBugwadia - looks good, but the CLI test keeps failing without a specific error message. Does it pass for you locally?