Wildcard values

[anushkamittal20]

Related issue

closes #2571
resolve #2813

Milestone of this PR

/milestone 1.6.0

What type of PR is this

/kind cleanup

Proposed Changes

Added this segment in new operators to deal with wildcard values in key and value

if wildcard.Match(valValue, valKey) {
      return false
}

Proof Manifests

To test use the pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  containers:
  - name: test
    image: defdasdabian:923
    command: ["/bin/sh", "-c", "sleep infinity"]
    securityContext:
      capabilities:
        drop:
        - aa_orange
        - aa_blue
        - green

when the policy pol.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: drop-cap-net-raw
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: drop-cap-net-raw
    match:
      resources:
        kinds:
        - Pod
    validate:
      deny:
        conditions:
          any:
          - key: "{{ request.object.spec.[containers, initContainers][].securityContext.capabilities.drop[] }}"
            operator: AnyIn
            value: ["aa*"]

is applied the request is denied

Checklist

• I have read the contributing guidelines.
• [] I have added tests that prove my fix is effective or that my feature works.
• [] My PR contains new or altered behavior to Kyverno and
  • [] CLI support should be added my PR doesn't contain that functionality.
  • [] I have added or changed the documentation myself in an existing PR and the link is:
  • [] I have raised an issue in kyverno/website to track the doc update and the link is:
  • [] I have read the PR documentation guide and followed the process including adding proof manifests to this PR.

Further Comments

I didn't add this in the old operators In and NotIn as these are deprecated.

[realshuting]

@anushkamittal20 - can you add unit tests?

[chipzoller]

There are conflicts that must be resolved.

@MarcelMue would you mind helping to review this especially in context of the now-merged #2704 ?

[MarcelMue]

This is now LGTM - @chipzoller is there some testing you want to do here?

New changes included now.

[chipzoller]

This is now LGTM - @chipzoller is there some testing you want to do here?

Yeah, once it lands in main and gets built, I want to put it through its paces.