fix: check the resource namespace (#10738)

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

cmd/cli/kubectl-kyverno/processor/policy_processor.go

@@ -254,7 +254,7 @@ func (p *PolicyProcessor) makePolicyContext(
 			return nil, fmt.Errorf("failed to update old resource in json context (%w)", err)
 		}
 	}
-	if p.Client != nil && len(namespaceLabels) == 0 && resource.GetKind() != "Namespace" {
+	if p.Client != nil && len(namespaceLabels) == 0 && resource.GetKind() != "Namespace" && resource.GetNamespace() != "" {
 		ns, err := p.Client.GetResource(context.TODO(), "v1", "Namespace", "", resource.GetNamespace())
 		if err != nil {
 			log.Log.Error(err, "failed to get the resource's namespace")

test/conformance/chainsaw/cli/apply/apply-on-cluster-scoped-resources/chainsaw-test.yaml

@@ -0,0 +1,21 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: apply-on-cluster-scoped-resources
+spec:
+  steps:
+  - name: step-01  
+    try:  
+    - script:  
+        content: kubectl create rolebinding my-rolebinding --role=my-role --user=my-user
+  - name: step-02
+    try:  
+    - script:  
+        content: kubectl create clusterrolebinding clusterrolebinding --clusterrole=my-clusterrole --user=my-user
+  - name: step-04
+    try:
+    - script:
+        content: kyverno apply policy.yaml --cluster
+        check:  
+          ($error != null): false

test/conformance/chainsaw/cli/apply/apply-on-cluster-scoped-resources/policy.yaml

@@ -0,0 +1,20 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-binding-system-groups      
+spec:
+  validationFailureAction: Enforce
+  background: true
+  rules:
+    - name: restrict-masters
+      match:
+        any:
+        - resources:
+            kinds:
+              - RoleBinding
+              - ClusterRoleBinding
+      validate:
+        message: "Binding to system:masters is not allowed."
+        pattern:
+          roleRef:
+            name: "!system:masters"