Release 1.5.8 (#3090)

* Fix CLI test/apply when any/all use namespaceSelector (#3050)

* Fix CLI test/apply when any/all use namespaceSelector
Fixes #3047

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* gofmt fix

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>

* tag v1.5.8

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: treydock <tdockendorf@osc.edu>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>

CHANGELOG.md

@@ -1,3 +1,7 @@
+## v1.5.8
+## Bug Fixes
+- Kyverno CLI test and apply both fail when using `namespaceSelector` under `match.any` or `exclude.any` #3047
+
 ## v1.5.7
 
 ## Bug Fixes

charts/kyverno-policies/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: kyverno-policies
-version: v2.1.9
+version: v2.1.10
-appVersion: v1.5.7
+appVersion: v1.5.8
 icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png
 description: Kubernetes Native Policy Management Policies
 keywords:

charts/kyverno/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: kyverno
-version: v2.1.9
+version: v2.1.10
-appVersion: v1.5.7
+appVersion: v1.5.8
 icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png
 description: Kubernetes Native Policy Management
 keywords:

charts/kyverno/templates/crds.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterpolicies.kyverno.io
 spec:
   group: kyverno.io
@@ -1313,7 +1313,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterpolicyreports.wgpolicyk8s.io
 spec:
   group: wgpolicyk8s.io
@@ -1806,7 +1806,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterreportchangerequests.kyverno.io
 spec:
   group: kyverno.io
@@ -2299,7 +2299,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: generaterequests.kyverno.io
 spec:
   group: kyverno.io
@@ -2480,7 +2480,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: policies.kyverno.io
 spec:
   group: kyverno.io
@@ -3781,7 +3781,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: policyreports.wgpolicyk8s.io
 spec:
   group: wgpolicyk8s.io
@@ -4274,7 +4274,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: reportchangerequests.kyverno.io
 spec:
   group: kyverno.io

definitions/install.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno
 ---
 apiVersion: apiextensions.k8s.io/v1
@@ -23,7 +23,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterpolicies.kyverno.io
 spec:
   group: kyverno.io
@@ -2074,7 +2074,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterpolicyreports.wgpolicyk8s.io
 spec:
   group: wgpolicyk8s.io
@@ -2755,7 +2755,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterreportchangerequests.kyverno.io
 spec:
   group: kyverno.io
@@ -3436,7 +3436,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: generaterequests.kyverno.io
 spec:
   group: kyverno.io
@@ -3632,7 +3632,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: policies.kyverno.io
 spec:
   group: kyverno.io
@@ -5685,7 +5685,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: policyreports.wgpolicyk8s.io
 spec:
   group: wgpolicyk8s.io
@@ -6364,7 +6364,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: reportchangerequests.kyverno.io
 spec:
   group: kyverno.io
@@ -7043,7 +7043,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno-service-account
   namespace: kyverno
 ---
@@ -7057,7 +7057,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
   name: kyverno:admin-policies
 rules:
@@ -7079,7 +7079,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
   name: kyverno:admin-policyreport
 rules:
@@ -7101,7 +7101,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
   name: kyverno:admin-reportchangerequest
 rules:
@@ -7123,7 +7123,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:customresources
 rules:
 - apiGroups:
@@ -7169,7 +7169,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:generatecontroller
 rules:
 - apiGroups:
@@ -7204,7 +7204,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:leaderelection
 rules:
 - apiGroups:
@@ -7228,7 +7228,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:policycontroller
 rules:
 - apiGroups:
@@ -7251,7 +7251,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:userinfo
 rules:
 - apiGroups:
@@ -7277,7 +7277,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:webhook
 rules:
 - apiGroups:
@@ -7329,7 +7329,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:customresources
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7350,7 +7350,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:generatecontroller
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7371,7 +7371,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:leaderelection
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7392,7 +7392,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:policycontroller
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7413,7 +7413,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:userinfo
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7434,7 +7434,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:webhook
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7459,7 +7459,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno
   namespace: kyverno
 ---
@@ -7476,7 +7476,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno-metrics
   namespace: kyverno
 ---
@@ -7490,7 +7490,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno-svc
   namespace: kyverno
 spec:
@@ -7512,7 +7512,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno-svc-metrics
   namespace: kyverno
 spec:
@@ -7534,7 +7534,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno
   namespace: kyverno
 spec:
@@ -7557,7 +7557,7 @@ spec:
         app.kubernetes.io/managed-by: Kustomize
         app.kubernetes.io/name: kyverno
         app.kubernetes.io/part-of: kyverno
-        app.kubernetes.io/version: v1.5.7
+        app.kubernetes.io/version: v1.5.8
     spec:
       affinity:
         podAntiAffinity:
@@ -7586,7 +7586,7 @@ spec:
               fieldPath: metadata.namespace
         - name: KYVERNO_SVC
           value: kyverno-svc
-        image: ghcr.io/kyverno/kyverno:v1.5.7
+        image: ghcr.io/kyverno/kyverno:v1.5.8
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 2
@@ -7638,7 +7638,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: ghcr.io/kyverno/kyvernopre:v1.5.7
+        image: ghcr.io/kyverno/kyvernopre:v1.5.8
         imagePullPolicy: IfNotPresent
         name: kyverno-pre
         resources:
@@ -7670,7 +7670,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno
   namespace: kyverno
 spec:

definitions/release/install.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno
 ---
 apiVersion: apiextensions.k8s.io/v1
@@ -23,7 +23,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterpolicies.kyverno.io
 spec:
   group: kyverno.io
@@ -2074,7 +2074,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterpolicyreports.wgpolicyk8s.io
 spec:
   group: wgpolicyk8s.io
@@ -2755,7 +2755,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: clusterreportchangerequests.kyverno.io
 spec:
   group: kyverno.io
@@ -3436,7 +3436,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: generaterequests.kyverno.io
 spec:
   group: kyverno.io
@@ -3632,7 +3632,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: policies.kyverno.io
 spec:
   group: kyverno.io
@@ -5685,7 +5685,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: policyreports.wgpolicyk8s.io
 spec:
   group: wgpolicyk8s.io
@@ -6364,7 +6364,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: reportchangerequests.kyverno.io
 spec:
   group: kyverno.io
@@ -7043,7 +7043,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno-service-account
   namespace: kyverno
 ---
@@ -7057,7 +7057,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
   name: kyverno:admin-policies
 rules:
@@ -7079,7 +7079,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
   name: kyverno:admin-policyreport
 rules:
@@ -7101,7 +7101,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
   name: kyverno:admin-reportchangerequest
 rules:
@@ -7123,7 +7123,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:customresources
 rules:
 - apiGroups:
@@ -7169,7 +7169,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:generatecontroller
 rules:
 - apiGroups:
@@ -7204,7 +7204,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:leaderelection
 rules:
 - apiGroups:
@@ -7228,7 +7228,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:policycontroller
 rules:
 - apiGroups:
@@ -7251,7 +7251,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:userinfo
 rules:
 - apiGroups:
@@ -7277,7 +7277,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:webhook
 rules:
 - apiGroups:
@@ -7329,7 +7329,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:customresources
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7350,7 +7350,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:generatecontroller
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7371,7 +7371,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:leaderelection
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7392,7 +7392,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:policycontroller
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7413,7 +7413,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:userinfo
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7434,7 +7434,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno:webhook
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -7459,7 +7459,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno
   namespace: kyverno
 ---
@@ -7476,7 +7476,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno-metrics
   namespace: kyverno
 ---
@@ -7490,7 +7490,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno-svc
   namespace: kyverno
 spec:
@@ -7512,7 +7512,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno-svc-metrics
   namespace: kyverno
 spec:
@@ -7534,7 +7534,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno
   namespace: kyverno
 spec:
@@ -7557,7 +7557,7 @@ spec:
         app.kubernetes.io/managed-by: Kustomize
         app.kubernetes.io/name: kyverno
         app.kubernetes.io/part-of: kyverno
-        app.kubernetes.io/version: v1.5.7
+        app.kubernetes.io/version: v1.5.8
     spec:
       affinity:
         podAntiAffinity:
@@ -7586,7 +7586,7 @@ spec:
               fieldPath: metadata.namespace
         - name: KYVERNO_SVC
           value: kyverno-svc
-        image: ghcr.io/kyverno/kyverno:v1.5.7
+        image: ghcr.io/kyverno/kyverno:v1.5.8
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 2
@@ -7638,7 +7638,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: ghcr.io/kyverno/kyvernopre:v1.5.7
+        image: ghcr.io/kyverno/kyvernopre:v1.5.8
         imagePullPolicy: IfNotPresent
         name: kyverno-pre
         resources:
@@ -7670,7 +7670,7 @@ metadata:
     app.kubernetes.io/managed-by: Kustomize
     app.kubernetes.io/name: kyverno
     app.kubernetes.io/part-of: kyverno
-    app.kubernetes.io/version: v1.5.7
+    app.kubernetes.io/version: v1.5.8
   name: kyverno
   namespace: kyverno
 spec:

definitions/release/kustomization.yaml

@@ -9,6 +9,6 @@ transformers:
 
 images:
 - name: ghcr.io/kyverno/kyverno
-  newTag: v1.5.7
+  newTag: v1.5.8
 - name: ghcr.io/kyverno/kyvernopre
-  newTag: v1.5.7
+  newTag: v1.5.8

definitions/release/labels.yaml

@@ -4,7 +4,7 @@ kind: LabelTransformer
 metadata:
   name: labelTransformer
 labels:
-  app.kubernetes.io/version: v1.5.7
+  app.kubernetes.io/version: v1.5.8
 fieldSpecs:
 - path: metadata/labels
   create: true

pkg/kyverno/common/common.go

@@ -450,12 +450,37 @@ func ApplyPolicyOnResource(policy *v1.ClusterPolicy, resource *unstructured.Unst
 	}
 
 	policyWithNamespaceSelector := false
+OuterLoop:
 	for _, p := range policy.Spec.Rules {
 		if p.MatchResources.ResourceDescription.NamespaceSelector != nil ||
 			p.ExcludeResources.ResourceDescription.NamespaceSelector != nil {
 			policyWithNamespaceSelector = true
 			break
 		}
+		for _, m := range p.MatchResources.Any {
+			if m.ResourceDescription.NamespaceSelector != nil {
+				policyWithNamespaceSelector = true
+				break OuterLoop
+			}
+		}
+		for _, m := range p.MatchResources.All {
+			if m.ResourceDescription.NamespaceSelector != nil {
+				policyWithNamespaceSelector = true
+				break OuterLoop
+			}
+		}
+		for _, e := range p.ExcludeResources.Any {
+			if e.ResourceDescription.NamespaceSelector != nil {
+				policyWithNamespaceSelector = true
+				break OuterLoop
+			}
+		}
+		for _, e := range p.ExcludeResources.All {
+			if e.ResourceDescription.NamespaceSelector != nil {
+				policyWithNamespaceSelector = true
+				break OuterLoop
+			}
+		}
 	}
 
 	if policyWithNamespaceSelector {

test/cli/test/any-namespaceSelector/policy.yaml

@@ -0,0 +1,25 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: enforce-pod-name
+spec:
+  validationFailureAction: audit
+  background: true
+  rules:
+    - name: validate-name
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              namespaceSelector:
+                matchExpressions:
+                - key: foo.com/managed-state
+                  operator: In
+                  values:
+                  - managed
+      validate:
+        message: "The Pod must end with -nginx"
+        pattern:
+          metadata:
+            name: "*-nginx"

test/cli/test/any-namespaceSelector/resource.yaml

@@ -0,0 +1,9 @@
+kind: Pod
+apiVersion: v1
+metadata:
+  name: test-nginx
+  namespace: test1
+spec:
+  containers:
+  - name: nginx
+    image: nginx:latest

test/cli/test/any-namespaceSelector/test.yaml

@@ -0,0 +1,14 @@
+---
+name: enforce-pod-name
+policies:
+  - policy.yaml
+resources:
+  - resource.yaml
+variables: value.yaml
+results:
+  - policy: enforce-pod-name
+    rule: validate-name
+    resource: test-nginx
+    kind: Pod
+    namespace: test1
+    result: pass

test/cli/test/any-namespaceSelector/value.yaml

@@ -0,0 +1,4 @@
+namespaceSelector:
+  - name: test1
+    labels:
+      foo.com/managed-state: managed