Clarify access from all namespace

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>

controllers/imagepolicy_controller.go

@@ -320,11 +320,6 @@ func (r *ImagePolicyReconciler) hasAccessToRepository(ctx context.Context, polic
 			repo.Namespace, repo.Name)
 	}
 
-	// grant access if the repository ACL has no namespace selectors
-	if acl != nil && acl.NamespaceSelectors == nil {
-		return true, nil
-	}
-
 	// get the policy namespace labels
 	var policyNamespace v1.Namespace
 	if err := r.Get(ctx, types.NamespacedName{Name: policy.Namespace}, &policyNamespace); err != nil {

controllers/policy_test.go

@@ -383,7 +383,7 @@ var _ = Describe("ImagePolicy controller", func() {
 		})
 
 		When("is in different namespace with empty ACL", func() {
-			It("grants access", func() {
+			It("deny access", func() {
 				policyNamespace := &corev1.Namespace{}
 				policyNamespace.Name = "acl-" + randStringRunes(5)
 				policyNamespace.Labels = map[string]string{
@@ -449,16 +449,16 @@ var _ = Describe("ImagePolicy controller", func() {
 				Expect(r.Create(ctx, &pol)).To(Succeed())
 
 				Eventually(func() bool {
-					err := r.Get(ctx, polObjectName, &pol)
-					return err == nil && pol.Status.LatestImage != ""
+					_ = r.Get(ctx, polObjectName, &pol)
+					return apimeta.IsStatusConditionFalse(pol.Status.Conditions, meta.ReadyCondition)
 				}, timeout, interval).Should(BeTrue())
-				Expect(pol.Status.LatestImage).To(Equal(imgRepo + ":1.0.1"))
+				Expect(apimeta.FindStatusCondition(pol.Status.Conditions, meta.ReadyCondition).Reason).To(Equal("AccessDenied"))
 
 				Expect(r.Delete(ctx, &pol)).To(Succeed())
 			})
 		})
 
-		When("is in different namespace with no empty match labels", func() {
+		When("is in different namespace with empty match labels", func() {
 			It("grants access", func() {
 				policyNamespace := &corev1.Namespace{}
 				policyNamespace.Name = "acl-" + randStringRunes(5)

docs/spec/v1beta1/imagerepositories.md

@@ -159,6 +159,14 @@ spec:
       range: 1.0.x
 ```
 
+To grant access to all namespaces, an empty `matchLabels` must be provided:
+
+```yaml
+  accessFrom:
+    namespaceSelectors:
+      - matchLabels: {}
+```
+
 ## Status
 
 ```go