feat: skip schema validation for CRD (#7869)

Signed-off-by: ShutingZhao <shuting@nirmata.com>

pkg/openapi/manager.go

@@ -133,11 +133,20 @@ func (o *manager) ValidatePolicyMutation(policy kyvernov1.PolicyInterface) error
 	}
 
 	for kind, rules := range kindToRules {
+		if kind == "CustomResourceDefinition" {
+			continue
+		}
 		newPolicy := policy.CreateDeepCopy()
 		spec := newPolicy.GetSpec()
 		spec.SetRules(rules)
-		k, _ := o.gvkToDefinitionName.Get(kind)
-		d, _ := o.definitions.Get(k)
+		k, ok := o.gvkToDefinitionName.Get(kind)
+		if !ok {
+			continue
+		}
+		d, ok := o.definitions.Get(k)
+		if !ok {
+			continue
+		}
 		resource, _ := o.generateEmptyResource(d).(map[string]interface{})
 		if len(resource) == 0 {
 			o.logger.V(2).Info("unable to validate resource. OpenApi definition not found", "kind", kind)

test/conformance/kuttl/policy-validation/cluster-policy/schema-validation-crd/01-policy.yaml

@@ -0,0 +1,42 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations:
+    policies.kyverno.io/category: Security
+    policies.kyverno.io/description: 'This policy mutates any namespace-scoped Custom
+      Resource Definition created by the subjects in the xteam Azure AD group
+      and adds the label "createdByXteam: true".'
+    policies.kyverno.io/subject: RBAC
+    policies.kyverno.io/title: Mutate Namespace-Scoped CRDs for xteam aad
+      group
+    policy.reporter.kyverno.io/minimal: minimal
+  generation: 1
+  labels:
+    aws.cdk.eks/prune-c8b5941ff5f4fe911c5ee96472fda3d1f9866734a7: ""
+  name: mutate-xteam-namespace-scoped-crds
+spec:
+  background: false
+  rules:
+  - match:
+      all:
+      - resources:
+          kinds:
+          - CustomResourceDefinition
+      subjects:
+      - kind: Group
+        name: aad:9b9had99-6k66-2222-9999-8aadb888e888
+    mutate:
+      patchStrategicMerge:
+        metadata:
+          labels:
+            createdByXteam: "true"
+    name: mutate-xteams-crd-creation
+    preconditions:
+      all:
+      - key: '{{request.operation}}'
+        operator: Equals
+        value: CREATE
+      - key: '{{ request.object.spec.scope }}'
+        operator: Equals
+        value: Namespaced
+  validationFailureAction: audit

test/conformance/kuttl/policy-validation/cluster-policy/schema-validation-crd/README.md

@@ -0,0 +1,11 @@
+## Description
+
+This test ensures the schema validation is skipped for CustomResourceDefinition.
+
+## Expected Behavior
+
+The Pod creation should be allowed.
+
+## Reference Issue(s)
+
+https://github.com/kyverno/kyverno/issues/7844

test/conformance/kuttl/policy-validation/cluster-policy/schema-validation-crd/policy-assert.yaml

@@ -0,0 +1,9 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: mutate-xteam-namespace-scoped-crds
+status:
+  conditions:
+  - reason: Succeeded
+    status: "True"
+    type: Ready