Broken exclude any all

pkg/webhooks/common.go

@@ -117,7 +117,9 @@ func containsRBACInfo(policies ...[]*kyverno.ClusterPolicy) bool {
 	for _, policySlice := range policies {
 		for _, policy := range policySlice {
 			for _, rule := range policy.Spec.Rules {
-				checkForRBACInfo(rule)
+				if checkForRBACInfo(rule) {
+					return true
+				}
 			}
 		}
 	}

test/cli/test-fail/invalid-ns/kyverno-test.yaml

@@ -0,0 +1,11 @@
+name: test-exclude
+policies:
+  - policy.yaml
+resources:
+  - resources.yaml
+results:
+  - policy: restrict-labels
+    rule: restrict-labels
+    resource: kyverno-system-tst
+    kind: Namespace
+    result: fail

test/cli/test-fail/invalid-ns/policy.yaml

@@ -0,0 +1,35 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-labels
+  labels:
+    policy.schiff.telekom.de: enforced
+  annotations:
+    policies.kyverno.io/title: Restrict Labels on Namespaces
+    policies.kyverno.io/category: Labels
+    policies.kyverno.io/minversion: 1.3.0
+    policies.kyverno.io/description: >-
+      This policy prevents the use of an label beginning with a common
+      key name (in this case "platform.das-schiff.telekom.de/owner | owner"). This can be useful to ensure users either
+      don't set reserved labels or to force them to
+      use a newer version of an label.
+spec:
+  validationFailureAction: enforce
+  background: false
+  rules:
+  - name: restrict-labels
+    match:
+      resources:
+        kinds:
+        - Namespace
+    exclude:
+      clusterRoles:
+      - cluster-admin
+    validate:
+      message: 'Every namespace has to have `platform.das-schiff.telekom.de/owner` label. It must not have value `das-schiff` which is reserved for system namespaces'
+      pattern:
+        metadata:
+          labels:
+            platform.das-schiff.telekom.de/owner: "!das-schiff"
+            # For forward compatibility
+            =(schiff.telekom.de/owner): "!schiff"

test/cli/test-fail/invalid-ns/resources.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kyverno-system-tst
+  labels:
+    name: kyverno-system-tst
+    schiff.telekom.de/owner: schiff
+    platform.das-schiff.telekom.de/owner: das-schiff