fix: require ignore label for VAP exempt namespace matching

[sozercan]

Motivation

• Prevent VAP-based policy bypass when --sync-vap-enforcement-scope is enabled by aligning VAP exemption logic with the label webhook semantics that require the admission.gatekeeper.sh/ignore label on a namespace before its resources are exempted.

Description

• Tighten the CEL snippet matchGlobalExemptedNamespacesGlob in pkg/drivers/k8scel/transform/cel_snippets.go so namespaced resources are exempted only when the namespace both matches the exempt pattern and namespaceObject.metadata.labels contains admission.gatekeeper.sh/ignore while preserving existing behavior for cluster-scoped objects.
• Add a regression test TestMatchGlobalExemptedNamespacesGlobRequiresIgnoreLabel in pkg/drivers/k8scel/transform/cel_snippets_test.go that asserts the generated match condition includes the namespace label checks.
• Preserve existing VAP match construction in buildMatchConditions and keep all other behavior unchanged.

Testing

• Ran go test ./pkg/drivers/k8scel/transform -run 'TestMatchGlobalExemptedNamespacesGlobRequiresIgnoreLabel|TestBuildMatchConditions' -count=1 and the tests passed (ok).

---

Codex Task

[Copilot]

Pull request overview

Tightens Gatekeeper’s VAP “global exempted namespaces” matching to prevent policy bypass when --sync-vap-enforcement-scope is enabled by requiring the admission.gatekeeper.sh/ignore label on the namespace before namespaced resources are treated as exempt.

Changes:

• Update matchGlobalExemptedNamespacesGlob to require namespaceObject.metadata.labels to contain admission.gatekeeper.sh/ignore for namespaced resources (cluster-scoped behavior unchanged).
• Add a regression test asserting the generated match expression includes the namespace label checks.

Show a summary per file

File	Description
pkg/drivers/k8scel/transform/cel_snippets.go	Tightens global exemption CEL logic for namespaced resources to require the namespace “ignore” label.
pkg/drivers/k8scel/transform/cel_snippets_test.go	Adds a regression test checking the generated CEL includes namespace label-gating logic.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 1

[Copilot]

This regression test only asserts that the generated CEL expression contains certain substrings; it won’t catch CEL syntax/type errors (e.g., if namespaceObject isn’t available in the match-condition environment) or behavioral regressions (namespace match should not exempt unless the namespace has the ignore label). Consider compiling and evaluating the match condition against representative requests (namespaced vs cluster-scoped; namespace labeled vs unlabeled) like the other matcher tests in this file do.

[JaydipGabani]

replace substring test with an evaluation-based test using the existing TestMatchExcludedNamespacesGlob harness; verify namespaceObject null safety; add release-note callout for upgrade-time behavior migration (operators who listed a namespace in --exempt-namespace without labeling it will suddenly see enforcement)