Policy doesn't work when match.resources.kinds is set to Policy/ClusterPolicy

[abdulhaseeb2]

Software version numbers

• Controller-gen version v0.4.0
• Kubernetes v1.20.2
• Kyverno version: v1.4.0 or code against main branch

Describe the bug
If we try to create a ClusterPolicy with match.resource.kinds value set to either Policy/ClusterPolicy, the policy does not work. But if we update kinds from Policy/ClusterPolicy to for example Pod the policy will start working.

To Reproduce
Steps to reproduce the behavior:

1. Apply the following ClusterPolicy

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: deny-unauthorized-access
  annotations:
    policies.kyverno.io/title: Deny Unauthorized Access
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: kyverno.io/v1/Policy
    policies.kyverno.io/description: >-
      Deny CREATE/UPDATE/DELETE action for Kyverno.io.Policy
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: deny-kyverno-policy
    match:
      resources:
        kinds:
          - kyverno.io/v1/Policy
    validate:
      message: "Unauthorized. Access denied to resource"
      deny:
        conditions:
        - key: "{{request.operation}}"
          operator: In
          value:
          - CREATE
          - DELETE
          - UPDATE

2. Apply the following Policy to test ClusterPolicy: deny-unauthorized-access

apiVersion: kyverno.io/v1
kind: Policy
metadata:
 name: disallow-latest-tag
 namespace: test-namespace
 annotations:
   policies.kyverno.io/title: Deny Pods with latest tag
   policies.kyverno.io/category: Best Practices
   policies.kyverno.io/severity: high
   policies.kyverno.io/subject: Pod
   policies.kyverno.io/description: >-
     Deny Creation of Pods with latest image tag
spec:
 validationFailureAction: audit
 rules:
 - name: validate-image-tag
   match:
     resources:
       kinds:
       - Pod
   validate:
     message: "Using a mutable image tag e.g. 'latest' is not allowed."
     pattern:
       spec:
         containers:
         - image: "!*:latest"

3. Policy: disallow-latest-tag would be successfully created

Expected behavior
ClusterPolicy should have rejected the API request to create Policy

[vyankyGH]

@abdulhaseeb2 Thanks for creating issue. Will check on it.