Kyverno v1.19.0
security++++-*************!
Changes
- Limit intermediate certs to mitigate CVE-2026-32280security
- Point to security assessmentssecurity
- Regenerate CRDs and docs after GHSA-79gf-7frw-68m9 API bumpsecurity
- Bump golang.org/x/crypto to v0.53.0 and x/net to v0.56.0 to resolve security CVEssecurity
- Upgrade go toolchain to 1.26.3 to resolve CVE-2026-39836security
- Patch ORAS and sigstore CodeQL vulnerabilitiessecurity
- Address open CodeQL security vulnerabilitiessecurity
- Bump cel-go to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9gsecurity
- Cleanup: remove dead fakeContext coderemoved
- Cli apply cross resourceadded
- Add offline mock support for http mock request/response for GET method and global context entriesadded
- Add updaterequest total gauge metricadded
159 more lines
- Support extraArgs in CRDs migration jobadded
- Add non-goalsadded
- Add optional PrometheusRule templateadded
- Update api docsadded
- Add NOTICE and embed attribution in container imagesadded
- Add opertional runbookadded
- Add offline mock support for k8sresource-backed global context entries via inline and external resource manifestsadded
- Enable Cosign verbosity debuggingadded
- Support multiple CRD paths and hook CRD processor into test commandadded
- Add image to allowed volumetypesadded
- Honor expired CEL PolicyExceptionsadded
- Add CEL http.Post mocking test fixtures, duplicate validation check, and integration testsadded
- Support skipBackgroundRequests for CEL mpol/gpoladded
- Support useServerSideApply for GeneratingPolicyadded
- Add auditAnnotations support to GeneratingPolicyadded
- Support MutatingPolicy target conditions and subresource targetsadded
- Reuse image verification cache for ImageValidatingPolicyadded
- Add YAML template mode for GeneratingPolicy with optional CEL interpolationadded
- Support MutatingAdmissionPolicy v1 on Kubernetes 1.36added
- Add regex.replace extension functionadded
- Add auditAnnotations support to MutatingPolicyadded
- Expose maxGlobalContextEntries in the Kyverno chartadded
- Support admission operation simulation for policy testingadded
- Surface deprecation of legacy kyverno.io policy types (warnings, helm notice, PSS default)added
- Remove kyverno-json support from apiadded
- Remove kyverno-json from test api (Cherry-pickadded
- Remove chainsaw tests using kyverno-json (Cherry-pickadded
- Remove json scan command (Cherry-pickadded
- Add configurable lifecycle hooks to all controllers (Cherry-pickadded
- Remove reference to kyverno-json from go modules (cherry-pickadded
- Revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policiesfixed
- Fix permissions for pr-branch-updaterfixed
- Prevent panic in label_match on nested structuresfixed
- Retry on conflict when updating policy statusfixed
- Restart dynamic watchers in background reporting on 410fixed
- Support cluster-scoped resource generation in GeneratingPolicyfixed
- Pass AdmissionRequest to updaterequests for mutate existing policyfixed
- Fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test commandfixed
- Add generatedResources field for GeneratingPolicy multi-resource testsfixed
- Cli multiple json payloadsfixed
- Validate name field in globalReference context entryfixed
- Correctly track per-loader load state to avoid skipping LoadDatafixed
- Skip report creation for subresources with empty name/UIDfixed
- Include CEL validation expression index in policy report propertiesfixed
- ReportsServer.enabled=true fails with "Image tags must be strings"fixed
- Wire readiness-checker into local kind dev workflowfixed
- Fix crash loop, missing status, and recorder keyfixed
- Apply namespaceSelector against Namespace resource own labelsfixed
- Do not abort required validation on non-matching imagesfixed
- Allow multiple CRDs in to be in the --crd-path filefixed
- Add the readiness checker to the ci image archivefixed
- Add access to clusterroles and bindings in the standard kyverno configfixed
- Support cel exception in cli apply 'exceptions-within-resources'fixed
- Wire gpolEngine and gpolProvider into policyControllerfixed
- Nil pointer panic in getGpolTriggers on ListResource errorfixed
- Fix UR regressionfixed
- Fix context and SyncWatchers race conditions in GeneratingPolicyfixed
- Batch UpdateRequests to avoid etcd size limitfixed
- Apply orphanDownstreamOnPolicyDelete to clone cleanupfixed
- Remove dead watcher entry on goroutine exitfixed
- Support NamespacedGeneratingPolicy end-to-endfixed
- Scan NamespacedImageValidatingPolicy resources toofixed
- Validate stdin across apply pathsfixed
- Serialize gh-pages publishes to prevent missing kyverno-policies releasesfixed
- Unblock ko image publish by replacing escaping kodata symlinksfixed
- Fix CEL autogen namespace replacementfixed
- Support mixed-type aggregate literals in CEL variablesfixed
- Preserve cluster-scoped generated resourcesfixed
- Use allPath instead of anyPath in m.All validation loopfixed
- Prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixesfixed
- Use server-side apply for conformance CRD refreshfixed
- Add sorting for ivpol targetsfixed
- Sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's orderfixed
- Force conflicts when server-side applying conformance CRDsfixed
- Wire MutatingPolicy and NamespacedMutatingPolicy into background scanfixed
- Correct label prefix for mpol/dpol policiesfixed
- ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlogfixed
- Surface GeneratingPolicy CEL errors when metadata.uid is missingfixed
- Resolve context leak in dynamic resource watcherfixed
- Add policies.kyverno.io resources to aggregate policy rolesfixed
- Skip reports RBAC check when background scanning is disabledfixed
- Guard nil EndpointConditions.Ready to prevent panicfixed
- Resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggersfixed
- Wire cleanup controller core extra resourcesfixed
- Set a background user so CEL request.userInfo.username is available during scansfixed
- Avoid mutating policy webhook name collisionsfixed
- Add missing reportProperties to v2beta1 Rulefixed
- Handle null image tags in _image.tpl and fix reports-server defaultTagfixed
- Key generate test clone sources by policyfixed
- Require --resource for migrate commandfixed
- Default userInfo groups and uid during background scansfixed
- Handle whitespace in mpol autogen Object constructorfixed
- Suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matchesfixed
- Handle DELETE target expression using oldObjectfixed
- Serve NamespacedImageValidatingPolicy admission at right pathsfixed
- Eliminate data race on shared err variable in pod creation goroutinesfixed
- Add subtests and fix typo in ext/wildcard/match_test.gofixed
- Resolve error shadowing in SplitDocuments signaturefixed
- CustomNamespaceLister.List honors the label selectorfixed
- Allow ApplyConfiguration to mutate atomic lists and structsfixed
- Scope namespaced policies to their own namespacefixed
- Make file extension checks case-insensitivefixed
- Add debug logging for CEL image verification functionsfixed
- Enforce MutatingPolicy evaluation mode semanticsfixed
- Validate MAP-incompatible MutatingPolicy match conditionsfixed
- Surface audit-rule warnings for mixed audit and enforce policiesfixed
- Reject stale trigger UIDs when live resource does not matchfixed
- Support private Sigstore/Fulcio instances for keyless verificationfixed
- Strip cross-namespace ownerReferences in CEL-based generationfixed
- Align dpol CLI reporting for constraint-excluded resources with vpol/mpolfixed
- Harden validation, cover ephemeral subresource, and serialize sigstore TUF accessfixed
- Use sigstore-go TUF client and fallback to trusted_root.jsonfixed
- Keep autogen variants per-policy to prevent cross-policy clobberingfixed
- Preserve namespaceSelector during policy autogenfixed
- Align policy metrics for new policy formatsfixed
- Validate DeletingPolicy cron schedule at admissionfixed
- Add excludeBootstrapResources flag to skip Node and CSR on Fail webhooksfixed
- Don't mark policies not ready or clear webhooks while health is unknownfixed
- Prevent GlobalContextEntry informer failure from deadlocking the reconcile workerfixed
- Use request.namespace for vpolExclude matchConditionsfixed
- Resolve namespaceObject with live API fallback on informer cache missfixed
- Evaluate mutateExisting mutating policies on admission in testfixed
- Honor full-exemption PolicyException when multiple exceptions matchfixed
- Allow pod-level seccomp in restrict-seccomp-strict vpolfixed
- Honor per-rule failureAction in the admission block deci…fixed
- Disable in-process cert controller when cert-manager delegation is enabledfixed
- Fix image verification parity gapsfixed
- IVPOL mutateDigest unimplemented stubfixed
- Enforce verifyDigest in ImageValidatingPolicy evaluatorfixed
- Sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching triggerfixed
- Prevent autogen from rewriting namespaceObject in mpolfixed
- Evaluate resource filters from background scanning jobsfixed
- Use RESTMapper for GVK to GVR mappingfixed
- Fix context propagation in MatchPolicyContextfixed
- IVPOL required has no effect (Cherry-pickfixed
- Preserve validation warnings for generate rules in validateAction (Cherry-pickfixed
- Reject non-string values in request.operation conditions (Cherry-pickfixed
- Fix goroutine and ticker leak in metrics initialization (Cherry-pickfixed
- Fix ticker leak in policyController background reconciliation loop (Cherry-pickfixed
- Fix context leak in TTL controller reconcile loop (Cherry-pickfixed
- Fix resource leak in sigstore fetchReferrers loop (Cherry-pickfixed
- Scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pickfixed
- Mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pickfixed
- Do not offload namespaceObject match conditions to the API server (Cherry-pickfixed
- Fix ignored context in notary registry resolution (Cherry-pickfixed
- Handle nil RequestKind and RequestResource in trace middleware (Cherry-pickfixed
- Repopulate intoto payload on attestation cache hitfixed
- Automate stale PR updatesother
- Use existing PR updater tokenother
- Return correct results for NotEquals type mismatch casesother
- Update backoff v7other
- Don't initialize rekor client for key or certificate based scenariosother
- Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3other
- Image verification credential handling refactorother
- [Feature] add optional cache bounds via --maxGlobalContextEntriesother
- Restrict issue self-assignment to good first issues for non-membersother
- Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global valuesother
- [Bug Fix] Fix data race and goroutine leak in policy_spec fuzzing on get bytes errorother
- Release 1.19.0-rc.4other
98 maintenance lines (dependency bumps, CI, tests, docs)
- Fix cosign releaser stepmaintenance
- Bump github.com/rs/zerolog from 1.35.0 to 1.35.1maintenance
- Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1maintenance
- Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0maintenance
- Update blocklist to allow in-cluster HTTP callsmaintenance
- Bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1maintenance
- Bump github.com/aptible/supercronic from 0.2.43 to 0.2.45maintenance
- Fix http conformance test blocklistmaintenance
- Add mpol handler gap tests (namespaced, exception, failurePolicy, dry-run, backgroundSA)maintenance
- Update available versions in issuesmaintenance
- Add dpol controller integration testsmaintenance
- Add gpol exception and CEL edge case integration testsmaintenance
- Drop reliance on EnvSet in favor of in-library versioningmaintenance
- Add framework tests github workflowmaintenance
- Skip framework tests on docs-only and helm-only PRsmaintenance
- Add new gpol samplesmaintenance
- Update dependency policymaintenance
- Clarify performance baselinesmaintenance
- Add NewTestEnvWithOptions for opt-in policy type wiringmaintenance
- Add v1.18.1 CEL admission latency benchmarks and reorganize perf-testing layoutmaintenance
- Add additional dpol controller integration testsmaintenance
- Cache envtest binaries between framework test runsmaintenance
- Migrate gpol sync-clone scenarios from chainsawmaintenance
- Bump codecov-action to v6.0.2 to fix uploader GPG key verificationmaintenance
- Fix duplicated word in cleanuppolicy validateAuth commentmaintenance
- Bump github/codeql-action from 4.35.2 to 4.35.4maintenance
- Bump actions/cache from 5.0.3 to 6.1.0maintenance
- Upgrade ristretto to v2maintenance
- Dynamically discover active branches for Trivy issue syncmaintenance
- Fix README workflow badge and AI policy linkmaintenance
- Bump rekor and in-toto-golang for codeql alertsmaintenance
- Fix webhook registration typomaintenance
- Fix NIVP background + clone-multiple-targets setupmaintenance
- Update pond dependency to v2maintenance
- Bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3maintenance
- Bump fluxcd/flux2 from 2.8.5 to 2.8.6maintenance
- Fix clone-multiple-targets dynamic lookup fixturemaintenance
- Bump github.com/onsi/gomega from 1.39.1 to 1.40.0maintenance
- Bump golang.org/x/net from 0.48.0 to 0.55.0 in /hack/controller-genmaintenance
- Add YAML fixture loaders for the frameworkmaintenance
- Bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.3maintenance
- Bump fossas/fossa-action from 1.9.0 to 2.0.0maintenance
- Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0maintenance
- Bump actions/labeler from 6.0.1 to 6.2.0maintenance
- Bump cbrgm/cleanup-stale-branches-action from 1.2.8 to 1.2.9maintenance
- Bump the otel group across 1 directory with 4 updatesmaintenance
- Bump Homebrew/actions/limit-pull-requests from 9ceb7934560eb61d131dde205a6c2d77b2e1529d to 18fcb8e3e06b4247c676c506750dc95ea7226479maintenance
- Pin Sigstore scaffolding version and remove redundant UR cleanupmaintenance
- Bump fluxcd/flux2/action from 2.8.6 to 2.9.2maintenance
- Bump github.com/google/cel-go from 0.28.0 to 0.29.2maintenance
- Bump cbrgm/cleanup-stale-branches-action from 1.2.9 to 1.2.11maintenance
- Single-pass report aggregation helper + flagship testmaintenance
- Add Semgrep SAST workflowmaintenance
- Bump golang.org/x/crypto from 0.53.0 to 0.54.0maintenance
- Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0maintenance
- Bump github.com/aptible/supercronic from 0.2.45 to 0.2.47maintenance
- Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2maintenance
- Bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2maintenance
- Bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1maintenance
- Migrate pr-branch-updater to GitHub App authmaintenance
- Bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0maintenance
- Bump google.golang.org/grpc from 1.82.0 to 1.82.1maintenance
- Bump github.com/onsi/gomega from 1.40.0 to 1.42.1maintenance
- Add context propagation to background util functionsmaintenance
- Bump sigs.k8s.io/structured-merge-diff/v6 from 6.3.2 to 6.4.2maintenance
- Bump Homebrew/actions/limit-pull-requests from 2026.07.13.1 to 2026.07.20.1maintenance
- Bump controller-toolsmaintenance
- Bump actions/setup-python from 6.2.0 to 7.0.0maintenance
- Point ivpol cosign tests at the kyverno test-images registrymaintenance
- Assign release milestone to PRs automatically at release timemaintenance
- Bump actions/labeler from 6.2.0 to 7.0.0maintenance
- Bump actions/checkout from 6.0.2 to 7.0.1maintenance
- Bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3maintenance
- Fix DeletingPolicy objectSelector test resultsmaintenance
- Add ImageValidatingPolicy support to the frameworkmaintenance
- Align ivpol framework tests with single-phase image verificationmaintenance
- Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1maintenance
- Bump docker/login-action from 4.1.0 to 4.5.1maintenance
- Bump the kubernetes group across 3 directories with 7 updatesmaintenance
- Bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2maintenance
- Bump fluxcd/flux2/action from 2.9.2 to 2.9.3maintenance
- Bump actions/checkout from 6.0.2 to 7.0.1maintenance
- Bump ossf/scorecard-action from 2.4.3 to 2.4.4maintenance
- Bump github.com/aptible/supercronic from 0.2.47 to 0.2.48maintenance
- Bump docker/login-action from 4.5.1 to 4.5.2maintenance
- Bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2maintenance
- Bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1maintenance
- Bump docker/login-action from 4.5.2 to 4.6.0maintenance
- Bump google.golang.org/grpc from 1.82.1 to 1.83.0maintenance
- Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4maintenance
- Upgrade gotest.tools to v3maintenance
- Bump cbrgm/cleanup-stale-branches-action from 1.2.11 to 1.2.12maintenance
- Bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0maintenance
- Cut release v1.19.0-rc.1maintenance
- Cut release v1.19.0-rc.2maintenance
- Add configurable code freeze checkmaintenance
- Cut release v1.19.0-rc.3maintenance
- Cut release v1.19.0maintenance
269 lines8 security1 removed33 added117 fixed12 other98 maintenancetyped from the source notes