Fix: namespace quota policy failed to be applied for two resources named ResourceQuota with different APIVersions (#2612)

Signed-off-by: Shaohui Liu <liushaohui@xiaomi.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>

pkg/policy/validate.go

@@ -1431,9 +1431,10 @@ func checkClusterResourceInMatchAndExclude(rule kyverno.Rule, clusterResources [
 		// should not be mentioned
 		if rule.HasGenerate() {
 			generateResourceKind := rule.Generation.Kind
+			generateResourceAPIVersion := rule.Generation.APIVersion
 			for _, resList := range res {
 				for _, r := range resList.APIResources {
-					if r.Kind == generateResourceKind {
+					if r.Kind == generateResourceKind && (len(generateResourceAPIVersion) == 0 || r.Version == generateResourceAPIVersion) {
 						if r.Namespaced {
 							if rule.Generation.Namespace == "" {
 								return fmt.Errorf("path: spec.rules[%v]: please mention the namespace to generate a namespaced resource", rule.Name)

test/best_practices/add_ns_quota.yaml

@@ -22,6 +22,7 @@ spec:
           - "kube-public"
           - "kyverno"
     generate:
+      apiVersion: v1
       kind: ResourceQuota
       name: default-resourcequota
       synchronize : true
@@ -39,6 +40,7 @@ spec:
         kinds:
         - Namespace
     generate:
+      apiVersion: v1
       kind: LimitRange
       name: default-limitrange
       synchronize : true