Change kyverno-policy-operator and exception-recommender namespaces on legacy

[fhielpos]

This PR changes the default namespace from security-bundle to policy-exceptions for kyverno-policy-operator and exception-recommender apps.

[fhielpos]

This is only needed until we release exception-recommender changing the defaults:

userConfig:
  exceptionRecommender:
    configMap:
      values:
        recommender:
          createNamespace: false

[stone-z]

I agree with the namespace change, but tell me more about not creating it. It's just for the one use case we discussed already right? What about creating a policyexception for that use case and keeping the namespace creation? Or what's the plan for all the other clusters?

[fhielpos]

We don't want the app to create the namespace because it will already be created by the bundle. If exception-recommender tries to create it through its chart it will fail to install since the namespace will already exist.

Namespace creation is a feature from exception-recommender that is meant to be used only when you are creating the Drafts in another namespace. In this case they will both live together.

[stone-z]

Where is it created by the bundle?

[fhielpos]

I mean that since the installation namespace will be policy-exceptions, the namespace will be created when the app is being installed.

Not by the bundle itself but by the helm client as part of the chart install.

[stone-z]

Ok got it, and IIUC this behavior (to create the namespaces or not) is configured at the app-operator level, but the helm client will still be using chart-operator's service account. So if/when KPO and ExRec move into other namespaces we'll have to handle creating policy-exceptions somehow else

[stone-z]

Typo, but LGTM