fix: remove the check of exclude in VAPs (#9331)

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

pkg/controllers/validatingadmissionpolicy-generate/policycheck.go

@@ -104,45 +104,5 @@ func canGenerateVAP(spec *kyvernov1.Spec) (bool, string) {
 		}
 	}
 
-	// since 'any' specify resources which will be ORed, it can be converted into multiple NamedRuleWithOperations in ValidatingAdmissionPolicy
-	for _, value := range exclude.Any {
-		if ok, msg := checkUserInfo(value.UserInfo); !ok {
-			return false, msg
-		}
-		if ok, msg := checkResources(value.ResourceDescription); !ok {
-			return false, msg
-		}
-
-		// since namespace/object selectors are applied to all NamedRuleWithOperations in ValidatingAdmissionPolicy, then
-		// multiple namespace/object selectors aren't applicable across the `any` clause.
-		if value.NamespaceSelector != nil {
-			if containsNamespaceSelector {
-				msg = "skip generating ValidatingAdmissionPolicy: multiple NamespaceSelector across 'any' aren't applicable."
-				return false, msg
-			}
-			containsNamespaceSelector = true
-		}
-		if value.Selector != nil {
-			if containsObjectSelector {
-				msg = "skip generating ValidatingAdmissionPolicy: multiple ObjectSelector across 'any' aren't applicable."
-				return false, msg
-			}
-			containsObjectSelector = true
-		}
-	}
-	// since 'all' specify resources which will be ANDed, we can't have more than one resource.
-	if exclude.All != nil {
-		if len(exclude.All) > 1 {
-			msg = "skip generating ValidatingAdmissionPolicy: multiple 'all' isn't applicable."
-			return false, msg
-		} else {
-			if ok, msg := checkUserInfo(exclude.All[0].UserInfo); !ok {
-				return false, msg
-			}
-			if ok, msg := checkResources(exclude.All[0].ResourceDescription); !ok {
-				return false, msg
-			}
-		}
-	}
 	return true, msg
 }

test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-exclude-namespace/chainsaw-test.yaml

@@ -0,0 +1,19 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: cpol-exclude-namespace
+spec:
+  steps:
+  - name: step-01
+    try:
+    - apply:
+        file: policy.yaml
+    - assert:
+        file: policy-assert.yaml
+  - name: step-02
+    try:
+    - error:
+        file: validatingadmissionpolicy.yaml
+    - error:
+        file: validatingadmissionpolicybinding.yaml

test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-exclude-namespace/policy-assert.yaml

@@ -0,0 +1,12 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: check-label-app2
+status:
+  conditions:
+  - reason: Succeeded
+    status: "True"
+    type: Ready
+  validatingadmissionpolicy:
+    generated: false
+  

test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-exclude-namespace/policy.yaml

@@ -0,0 +1,22 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: check-label-app2
+spec:
+  validationFailureAction: Audit
+  rules:
+    - name: check-label-app
+      match:
+        any:
+        - resources:
+            kinds:
+            - Pod
+      exclude:
+        any:
+        - resources:
+            namespaces:
+            - default
+      validate:
+        cel:
+          expressions:
+            - expression: "'app' in object.metadata.labels"

test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-exclude-namespace/validatingadmissionpolicy.yaml

@@ -0,0 +1,7 @@
+apiVersion: admissionregistration.k8s.io/v1alpha1
+kind: ValidatingAdmissionPolicy
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kyverno
+  name: check-label-app2
+spec: {}

test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-exclude-namespace/validatingadmissionpolicybinding.yaml

@@ -0,0 +1,7 @@
+apiVersion: admissionregistration.k8s.io/v1alpha1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kyverno
+  name: check-label-app2-binding
+spec: {}