Feature Request: validate resources targeted by AdmissionPolicy

[flavio]

Is your feature request related to a problem?

AdmissionPolicy can only listen for events happening inside of a specific Namespace, the one where they are deployed.

It does not make sense to deploy a AdmissionPolicy that watches cluster-wide resources (like Namespace, PersistentVolume,...) since the policy will never be triggered.

Solution you'd like

The controller also provides an admission webhook that validates our own CRDs. We should implement a new validation for the AdmissionPolicy that rejects policies that are targeting cluster-wide resources.

The information about whether a Kubernetes resource is cluster-wide or namespaced can be obtained by querying the Kubernetes API

Alternatives you've considered

No response

Anything else?

Kinda related with kubewarden/kwctl#503