fix: namespace label matching for Namespace (#7837)

* Feat: namespaceLabel matching for ns

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Fix: update kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>

pkg/engine/utils/match.go

@@ -115,14 +115,17 @@ func doesResourceMatchConditionBlock(
 		}
 	}
 
-	if conditionBlock.NamespaceSelector != nil && resource.GetKind() != "Namespace" &&
-		(resource.GetKind() != "" || slices.Contains(conditionBlock.Kinds, "*") && wildcard.Match("*", resource.GetKind())) {
-		hasPassed, err := matchutils.CheckSelector(conditionBlock.NamespaceSelector, namespaceLabels)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("failed to parse namespace selector: %v", err))
-		} else {
-			if !hasPassed {
-				errs = append(errs, fmt.Errorf("namespace selector does not match labels"))
+	if conditionBlock.NamespaceSelector != nil {
+		if resource.GetKind() == "Namespace" {
+			errs = append(errs, fmt.Errorf("namespace selector is not applicable for namespace resource"))
+		} else if resource.GetKind() != "" || slices.Contains(conditionBlock.Kinds, "*") && wildcard.Match("*", resource.GetKind()) {
+			hasPassed, err := matchutils.CheckSelector(conditionBlock.NamespaceSelector, namespaceLabels)
+			if err != nil {
+				errs = append(errs, fmt.Errorf("failed to parse namespace selector: %v", err))
+			} else {
+				if !hasPassed {
+					errs = append(errs, fmt.Errorf("namespace selector does not match labels"))
+				}
 			}
 		}
 	}

test/conformance/kuttl/validate/clusterpolicy/standard/enforce/ns-selector-with-wildcard-kind/04-clusterrole.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pod-reader-fake
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch

test/conformance/kuttl/validate/clusterpolicy/standard/enforce/ns-selector-with-wildcard-kind/05-delete-ns.yaml

@@ -0,0 +1,7 @@
+# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+delete:
+- apiVersion: v1
+  kind: Namespace
+  name: test-wildcard

test/conformance/kuttl/validate/clusterpolicy/standard/enforce/ns-selector-with-wildcard-kind/06-delete-clulsterrole.yaml

@@ -0,0 +1,7 @@
+# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+delete:
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  name: pod-reader-fake

test/conformance/kuttl/validate/clusterpolicy/standard/enforce/ns-selector-with-wildcard-kind/README.md

@@ -9,4 +9,5 @@ The pod `test-validate/nginx-block` is blocked, and the pod `default/nginx-pass`
 
 ## Reference Issue(s)
 
-https://github.com/kyverno/kyverno/issues/6015
+https://github.com/kyverno/kyverno/issues/6015
+https://github.com/kyverno/kyverno/issues/7771