Description of problem:

When a ConfigurationPolicy defines a RoleBinding or ClusterRoleBinding, if the subjects array is set to an empty list, then the ConfigurationPolicy will constantly try to update the object.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

1. Make a policy defining a (cluster)rolebinding with an explicitly set empty subjects array.

Actual results:

The policy's compliance flaps back and forth.

Expected results:

The policy should just be compliant, and not have constant updates.

Additional info:

Example ClusterRoleBinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: empty-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: imaginary-permissions
subjects: [] 

The issue is basically that when the kube api server returns this object, it just omits the subjects array. The config policy controller thinks that it needs to add it, and doesn't "know" that such an update is a no-op.