Kyverno v1.18.0
security+++++************!
Changes
- Secure HTTP calls with blocklist/allowlist: HTTP context loading now enforces a configurable blocklist and scoped token authorization, improving security posture for policies that perform external HTTP calls (#15789, #15779).security
- Limit intermediate certs to mitigate CVE-2026-32280security
- Fix CVE-2026-32283: upgrade Go toolchain to 1.26.2security
- Fix CVE-2026-24686: bump go-tuf/v2 to v2.4.1security
- Fix stdlib CVEssecurity
- Namespaced image registry credentials: imageRegistryCredentials can now reference namespaced secrets and pod-level imagePullSecrets for image verification (#15112).added
- CLI expanded policy support: The kyverno apply and kyverno test commands now support cleanup policies, HTTP/Envoy authz policies, and mutateExisting MutatingPolicies (#15732, #15645, #15691, #15253).added
- Success event filtering: A new successEventActions ConfigMap parameter allows fine-grained control over which success events are emitted (#15466).added
- Add support for gzip library and confidential containers exampleadded
- Add successEventActions parameter to filter which success events are emittedadded
- Add --exemplarFilter flag to control exemplar collection in metricsadded
- Add exceptions-with-policies flag to kyverno apply CLIadded
96 more lines
- Add projected service account token support in Helm chartadded
- Add admission-controller autoscaling based on memory utilizationadded
- Add TLS encryption to /metrics endpointadded
- Allow output for missing resources in CLI testsadded
- Support uri suffix for defaultRegistry in configadded
- Support mutateExisting MutatingPolicy in CLI testadded
- Support cleanup policies in kyverno apply commandadded
- Support HTTP/Envoy authz policies in kyverno applyadded
- Support authz policies in kyverno testadded
- Permit imageRegistryCredentials to use namespaced secrets and pod-level imagePullSecretsadded
- Secure HTTP calls: enforce blocklist and add FLAG_HTTP_BLOCKLIST overrideadded
- Use scoped token for request authorization in HTTP contextadded
- Add controller deployment labels to Helm chartadded
- Add extraVolumes and extraVolumeMounts support to Helm chartadded
- Add Global.PriorityClassName Helm value with pod templatingadded
- Add support for excludes (namespace, subject, resource rules, and custom matchConditions) in ValidatingPoliciesadded
- Allow auditAnnotation configuration of ValidatingPoliciesadded
- Add perPolicy overrides for custom annotationsadded
- Remove kubectl from webhook cleanup binary, replacing with client-go (#15067,added
- Add output type validation for image extractorsadded
- Replace the aerosound readiness image with a purpose-built readiness-checker imageadded
- Enhance any block logs to include better context when no condition passesadded
- Fix matchImageReferences not filtering images properlyfixed
- Fix ivpol: remove early return on matchImageReference so CEL evaluation is not skippedfixed
- Fix processResourceWithPatches returning nil on patch failure, silently bypassing image verificationfixed
- Fix imageVerify multi-signature annotation validation bugfixed
- Set UseSignedTimestamps when TSACertChain is provided in IVPOL cosign verifierfixed
- Enable signed timestamp verification when TSA cert chain is providedfixed
- Relax EKU validation for DigiCert TSA (#15093,fixed
- Use kyverno namespace secrets in reports scanner for ivpolfixed
- Nil pointer dereference in Certificates branch of manifest validationfixed
- Add cert identity verification for buildpolicyfixed
- Close ReadCloser from layer.Uncompressed() in image verificationfixed
- Add HTTP 429 retry in image data loaderfixed
- Release RLock before early return in imageContext.Getfixed
- Add synchronization to TUF client initialization to prevent data racefixed
- Propagate errors in notary repositoryClient.Resolve()fixed
- Missing ivpol autogen for namespaced policies; simplify ivpol/vpol namespaced handling in CLIfixed
- CLI CRD support without cluster connectionfixed
- Bypass rule name matching for ruleless policies in CLIfixed
- Add list GVK to fake cluster scheme to prevent mutateExisting panicfixed
- Pass CRD-aware RESTMapper to GeneratingPolicy test pathfixed
- Correct test result reporting for legacy policies and CEL engine errorsfixed
- Display NonFatalErrors in CLI test commandfixed
- Return error instead of panic when imageRegistryCredentials.secrets are used in CLIfixed
- Add default message when rule message is empty in CLIfixed
- Three bugs in CLI apply commandfixed
- CLI failing selector-based policies when they did not match the resourcefixed
- Close leaked file handles in CLI apply command (#15151,fixed
- Return proper error on non-OK HTTP status in CLI resource and policy loadingfixed
- Prevent segfault when applying K8s-mode policy to JSON payloadfixed
- Support piped v1.List objects in apply commandfixed
- Check all rules in the test in case no rule is specifiedfixed
- Bypass blocklist for cluster-scoped HTTP policiesfixed
- HTTP CEL compilation error on NVPOLfixed
- Compile dpol variables before conditions to allow variable referencesfixed
- Use extended compiler for mpol variables and conditionsfixed
- Inject namespaceObject into MutatingPolicy CEL contextfixed
- Handle mutating policy variable compile errorsfixed
- Polex filtering in vpol enginefixed
- Fix vpol/ivpol: align auditAnnotation behaviour with upstream VAPfixed
- Fetch namespace-scoped enforce policies in audit query pathfixed
- UserInfo error in CEL expressions for VAPs and MAPs in background scanningfixed
- Include auditWarn policies in namespace selector checkfixed
- Panic in ExpandInMetadata when metadata is not a mapfixed
- Prevent nil pointer panic on malformed AdmissionReview requestfixed
- Clear stale error in GlobalContextEntry after successful API callfixed
- Prevent defer from overwriting named return error in validateOldfixed
- ClusterRoles should only return applicable cluster roles for the namespace of the requestfixed
- Incorrect policy exclusion reporting for Pod-targeted policies with autogen in vpol/mpolfixed
- Autogen to use fully-qualified GVKs to prevent matching non-Kubernetes resourcesfixed
- Global validationFailureActionOverrides being silently ignoredfixed
- Add explicit policy-level validationFailureAction templatingfixed
- Skip policy reports with PolicyException in background scanfixed
- Accumulate downstreams from all ForEachGeneration entriesfixed
- Prevent deleteDownstream from silently overwriting Failed UR statusfixed
- Propagate non-NotFound errors in generate clone target fetchfixed
- Use AddRateLimited instead of AddAfter in background controller handleErr to respect rate limitingfixed
- Track applyGenerate errors in failures slicefixed
- Copy properties map to prevent concurrent map writes in reports-controllerfixed
- Remove hard-wiring of v1alpha1 map informersfixed
- Use shared informers for webhook controller and handlersfixed
- Emit VAP generation events only when create/update occurredfixed
- Emit Resource Mutated event for MutatingPolicyfixed
- Warn on omitEvents/successEvents clashfixed
- Prevent deadlock in Recorderfixed
- Remove duplicate JSON log keys in validation handlerfixed
- Background-controller metrics port ignoring config and going to 8080fixed
- Prevent index out of range panic in enqueueReportsForPolicy for namespaced PolicyReportsfixed
- Restrict configmap access for namespaced policiesfixed
- Make kyverno Helm chart PSS-compliantfixed
- Add app.kubernetes.io/name label to all pods in kyverno chartfixed
- Remove finalizers and workarounds around uninstallfixed
- Update require-run-as-nonroot ValidatingPolicy CEL expressionfixed
- Improve error handling for API calls to surface permission issuesfixed
- Propagate context and add HTTP timeout in API/registry callsfixed
9 maintenance lines (dependency bumps, CI, tests, docs)
- Bump github.com/sigstore/cosign/v3 from 3.0.4 to 3.0.6 (#15321,maintenance
- Bump github.com/sigstore/sigstore to 1.10.5maintenance
- Bump github.com/sigstore/rekor to 1.5.1maintenance
- Bump github.com/google/go-containerregistry from 0.21.3 to 0.21.5 (#15797,maintenance
- Bump golang.org/x/crypto to 0.50.0 (#15551,maintenance
- Bump the Kubernetes group libraries (#15408,maintenance
- Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3maintenance
- Bump sigs.k8s.io/controller-runtime to 0.23.3maintenance
- Routine dependency updates (grpc, otel, go-git, supercronic, zerolog, envoy, and GitHub Actions)maintenance
117 lines5 security29 added74 fixed9 maintenancetyped from the source notes