Fix panic for provides a set to the key of a precondition and deny condition (#3162)

pkg/policy/validate.go

@@ -1004,6 +1004,16 @@ func validateConditionValues(c kyverno.Condition) (string, error) {
 	if c.Key == nil || c.Value == nil || c.Operator == "" {
 		return "", fmt.Errorf("entered value of `key`, `value` or `operator` is missing or misspelled")
 	}
+	switch reflect.TypeOf(c.Key).Kind() {
+	case reflect.String:
+		value, err := validateValuesKeyRequest(c)
+		return value, err
+	default:
+		return "", nil
+	}
+}
+
+func validateValuesKeyRequest(c kyverno.Condition) (string, error) {
 	switch strings.ReplaceAll(c.Key.(string), " ", "") {
 	case "{{request.operation}}":
 		return validateConditionValuesKeyRequestOperation(c)

test/cli/test/multiple_condition_keys/kyverno-test.yaml

@@ -0,0 +1,17 @@
+name: test-simple
+policies:
+  - policy.yaml
+resources:
+  - resources.yaml
+results:
+  - policy: test-multiple-key
+    rule: test-multiple-key
+    resource: test-resource-pass
+    kind: Pod
+    status: pass
+  - policy: test-multiple-key
+    rule: test-multiple-key
+    resource: test-resource-fail
+    kind: Pod
+    status: fail
+  

test/cli/test/multiple_condition_keys/policy.yaml

@@ -0,0 +1,23 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: test-multiple-key
+spec:
+  validationFailureAction: enforce
+  background: false
+  rules:
+  - name: test-multiple-key
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      deny:
+        conditions:
+          any:
+          - key: 
+              - "{{request.object.metadata.labels.app}}"
+            operator: NotIn
+            value: 
+            - "busybox"
+            - "busybox1"

test/cli/test/multiple_condition_keys/resources.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-resource-pass
+  labels:
+    app: busybox
+spec:
+  containers:
+  - name: nginx
+    image: nginx:latest
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-resource-fail
+  labels:
+    app: busybox-fail
+spec:
+  containers:
+  - name: nginx
+    image: nginx:latest