fix: namespace label matching for Namespace (#7837)

* Feat: namespaceLabel matching for ns

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Fix: update kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>

pkg/engine/utils/match.go

@@ -115,8 +115,10 @@ func doesResourceMatchConditionBlock(
 		}
 	}
 
-	if conditionBlock.NamespaceSelector != nil && resource.GetKind() != "Namespace" &&
+	if conditionBlock.NamespaceSelector != nil {
-		(resource.GetKind() != "" || slices.Contains(conditionBlock.Kinds, "*") && wildcard.Match("*", resource.GetKind())) {
+		if resource.GetKind() == "Namespace" {
+			errs = append(errs, fmt.Errorf("namespace selector is not applicable for namespace resource"))
+		} else if resource.GetKind() != "" || slices.Contains(conditionBlock.Kinds, "*") && wildcard.Match("*", resource.GetKind()) {
 			hasPassed, err := matchutils.CheckSelector(conditionBlock.NamespaceSelector, namespaceLabels)
 			if err != nil {
 				errs = append(errs, fmt.Errorf("failed to parse namespace selector: %v", err))
@@ -126,6 +128,7 @@ func doesResourceMatchConditionBlock(
 				}
 			}
 		}
+	}
 
 	if len(conditionBlock.Operations) > 0 {
 		if !slices.Contains(conditionBlock.Operations, operation) {

test/conformance/kuttl/validate/clusterpolicy/standard/enforce/ns-selector-with-wildcard-kind/04-clusterrole.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pod-reader-fake
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch

test/conformance/kuttl/validate/clusterpolicy/standard/enforce/ns-selector-with-wildcard-kind/05-delete-ns.yaml

@@ -0,0 +1,7 @@
+# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+delete:
+- apiVersion: v1
+  kind: Namespace
+  name: test-wildcard

test/conformance/kuttl/validate/clusterpolicy/standard/enforce/ns-selector-with-wildcard-kind/06-delete-clulsterrole.yaml

@@ -0,0 +1,7 @@
+# Specifying the kind as `TestStep` performs certain behaviors like this delete operation.
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+delete:
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  name: pod-reader-fake

test/conformance/kuttl/validate/clusterpolicy/standard/enforce/ns-selector-with-wildcard-kind/README.md

@@ -10,3 +10,4 @@ The pod `test-validate/nginx-block` is blocked, and the pod `default/nginx-pass`
 ## Reference Issue(s)
 
 https://github.com/kyverno/kyverno/issues/6015
+https://github.com/kyverno/kyverno/issues/7771