chore: add kuttl test for namespace exclusion (#6914)

* chore: add kuttl test for namespace exclusion

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix readme

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* Update test/conformance/kuttl/validate/clusterpolicy/standard/exclude/exclude-namespace/README.md

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

test/conformance/kuttl/validate/clusterpolicy/standard/exclude/exclude-namespace/01-policies.yaml

@@ -0,0 +1,6 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+apply:
+- policies.yaml
+assert:
+- policies-assert.yaml

test/conformance/kuttl/validate/clusterpolicy/standard/exclude/exclude-namespace/02-resources.yaml

@@ -0,0 +1,4 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+apply:
+- resources.yaml

test/conformance/kuttl/validate/clusterpolicy/standard/exclude/exclude-namespace/README.md

@@ -0,0 +1,11 @@
+## Description
+
+This test creates a policy to validate all resources have a `foo: bar` label.
+The policy matches on a wildcard but excludes a whole Namespace.
+The net result should be any Namespaced resource in the excluded Namespace should not be processed.
+It then creates a configmap in the default namespace that doesn't have the expected label.
+
+
+## Expected Behavior
+
+The configmap should be created successfully as it is excluded by the policy.

test/conformance/kuttl/validate/clusterpolicy/standard/exclude/exclude-namespace/policies-assert.yaml

@@ -0,0 +1,9 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-label
+status:
+  conditions:
+    - reason: Succeeded
+      status: "True"
+      type: Ready

test/conformance/kuttl/validate/clusterpolicy/standard/exclude/exclude-namespace/policies.yaml

@@ -0,0 +1,30 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-label
+spec:
+  validationFailureAction: Enforce
+  background: false
+  rules:
+    - name: require-label
+      match:
+        any:
+        - resources:
+            kinds:
+              - "*"
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - default
+      preconditions:
+        all:
+          - key: "{{ request.operation }}"
+            operator: NotEquals
+            value: DELETE
+      validate:
+        message: 'Test'
+        pattern:
+          metadata:
+            labels:
+              foo: bar

test/conformance/kuttl/validate/clusterpolicy/standard/exclude/exclude-namespace/resources.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-name
+  namespace: default

test/conformance/kuttl/validate/clusterpolicy/standard/wildcard/block-verifyimage/README.md

@@ -1,2 +1,3 @@
 ## Description 
+
 Basic validate test to check that a verify-image policy cannot be created when the policy has wildcard(*)  included in match any/all resource block.