Kyverno v1.17.0
security++++++~-***********!
Changes
- Add Kubernetes v1.30-v1.32 support to Pod Security Standardsecurity
- Address security vulnerabilitiessecurity
- Add CEL-based ValidatingPolicy support for Pod Security Standards (Cherry-picksecurity
- Remove params reference in API docsremoved
- Make VAP/MAP reporting opt in instead of opt outchanged
- Use DynamicInformer for optimal memory and performancechanged
- Move policy library tests to a post merge lanechanged
- Add NamespacedImageValidatingPolicy and common compiler interfaceadded
- Add Okteto to the list of Kyverno adoptersadded
- Amend the ImageValidatingPolicy controller to work with NamespacedImageValidatingPolicy, configure admission controller and webhookadded
- Add chainsaw test for namespaced deleting policy in the ci pipelineadded
- Generate and copy crd to cli for namespaced validating policy and namespaced deleting policyadded
127 more lines
- In-cluster concurrent resource loaderadded
- Implement failureActionOverrides namespaceSelectoradded
- Update codeownersadded
- Add NamespacedMutatingPolicy and common compiler interfaceadded
- Add NamespacedGeneratingPolicy to v1alpha1added
- Support nmpol for update requestsadded
- Bump ngpol to v1beta1added
- Add kyverno.io/v2 GlobalContextEntry APIadded
- Support other key algorithms than RSAadded
- Update codeownersadded
- Add CEL Json libraryadded
- Add kubernetes semantic versioning library to default env optionsadded
- Create CEL x509 decode functionadded
- Add --tlsKeyAlgorithm and support more algorithmsadded
- Added a CEL-Yaml libraryadded
- Add reports-server integration supportadded
- Add time library that contains time.now()added
- Support cert-manager certificates in the helm chartadded
- Bump kube to 1.35added
- Use kyverno/api repoadded
- Added nodeselector for linux to install.yaml generationadded
- Add time truncate cel functionadded
- Add execution stats to rule response for generate rulesadded
- Introduce test quarantine capabilites through inputs to the run tests actionadded
- Support variable lookup for cpoladded
- Add automatic GOMEMLIMIT configurationadded
- Add cosign v3 support to IVPOLadded
- Add time to cron filteradded
- Use api remote chartadded
- Fix metadata path translation and translating paths in matchConditionfixed
- Allow bind role to the background controller defaultfixed
- Fix nil namespace initialization for cluster wide param resourcesfixed
- Add make+gcc and update go version in devcontainerfixed
- Dont register the http request typefixed
- Attempt to fix scale test k6 installationfixed
- Handle namespace match with namespaceSelectorfixed
- Handle nil MatchConstraintsfixed
- Use namespaceObject in deletingpoliciesfixed
- Use context in deletingpolicies in the CLIfixed
- Duplicate error accumulationfixed
- Avoid cleanup on non-matching nsfixed
- Cli test with context file from gitfixed
- Implement the fake image metadata for the CLIfixed
- Add webhook compatibility and admission controller to work with NamespacedGeneratingPolicyfixed
- Make vapgen output predictablefixed
- Revert accidentally introduced breaking change for the kyverno_policy_results metricfixed
- Fix namespaced watcherfixed
- Ensure GVK infos are set when metrics are recordedfixed
- Pin actionfixed
- Vuln report jobfixed
- Vuln report jobfixed
- Continue deletion on resource not found errorfixed
- Color issue for --remove-color flagfixed
- Fix typos in documentationfixed
- Resolve data race in Test_ValidateAuditWarnfixed
- Improve error message for ClusterPolicy with namespacefixed
- Webhooks: prevent audit cancellation by HTTP request contextfixed
- Add a pre-flight check for listing CRDs in cleanup controllerfixed
- Close junit system-out tags correctlyfixed
- Ensure deep copy of context to prevent corruption in multi-rule …fixed
- WarmUp only caching first policy due to early returnsfixed
- Chain mutations correctly across multiple policies in CEL mutati…fixed
- Prevent nil pointer panic in cleanup controllerfixed
- Run go mod tidy after client codegen to prevent build failuresfixed
- Fix misleading 'applying background rule' log messagefixed
- Add missing lock in GetDownstreams to prevent data racefixed
- Add nil check in UpdateResourceHash to prevent panicfixed
- Prevent nil pointer dereference of EmitWarning in fine-grained webhookfixed
- Use local helm-docs binary instead of Dockerfixed
- Fix generate() returning nil error on failurefixed
- Prevent generate controller panic when policy is deleted with pending UpdateRequestsfixed
- Use DeepCopy in WatchManager to prevent cache mutation (Cherry-pickfixed
- Helm release workflow (Cherry-pickfixed
- Correct ivpol slice append in scanner (Cherry-pickfixed
- Use correct resource name in metadata cache update (Cherry-pickfixed
- Skip racy test (Cherry-pickfixed
- Add Deduplicate rules in webhook configurations (Cherry-pickfixed
- Use %w to wrap errors in registry client (Cherry-pickfixed
- Propagate context in background checks and generate (Cherry-pickfixed
- Refactor policy controller switch and clean up unused params (Cherry-pickfixed
- Prevent nil policy panic in updaterequest event generation (Cherry-pickfixed
- Handle AddEventHandler errors in policy controller (Cherry-pickfixed
- Prevent selector map mutation in CloneList cleanup loop (Cherry-pickfixed
- Add missing break in namespace selector override matching (Cherry-pickfixed
- Add bounds check for Rules slice in CEL generate controller audit (Cherry-pickfixed
- Update kubectl image to fix CVEs (Cherry-pickfixed
- New api types backward compatibility (cherry-pickfixed
- Add missing resource migration in helm chart (Cherry-pickfixed
- Use correct informer in handler (Cherry-pickfixed
- Remove some policies.kyverno.io/v1alpha1 usage (Cherry-pickfixed
- Fix import path to fix loading of policies.kyverno.io/v1 resources (Cherry-pickfixed
- Callback parameter (Cherry-pickfixed
- Return error response when PolicyException lookup fails (Cherry-pickfixed
- Use leader election context to prevent split-brain on leadership… (Cherry-pickfixed
- Explicitly set empty namespaces for clusterScope FlowSchemas (Cherry-pickfixed
- Update only what is needed in codegen-helm-update-versions (cherry-pickfixed
- Restrict resource access in namespaced CEL policy typesother
- Describe validation actions in API docsother
- Update devcontainerother
- Supporting wildcards in resource namespace matchingother
- Create a chainsaw test for creating a resource with custom label using the generating policyother
- Removing nancy testsother
- Create a custom execution cel env to handle expressions in target match constraintsother
- Execute missing controller metricother
- Policies api version bumpother
- Extend CLI policy and exception load, adding test for v1 applicationother
- Use v1beta1.PolicyException as new default versionother
- Read kind label value from AdmissionRequestother
- Create hash CEL libother
- Skip mutateExisting during admission to prevent trigger mutationother
- Update versionsother
- Update CODEOWNERSother
- Policycache: skip nil and invalid policies to prevent panicsother
- Create CEL math lib containing the round functionother
- Policy exception json supportother
- Set shorter period for k6 testsother
- Create cel random libraryother
- Update autogen url in validation error messageother
- Transform CEL lib (replaces the object_from_lists JMESPath functionality)other
- Bump cel policy compiler versionsother
- Module test for function evaluation (replace_all) with shallow variables as function parameterother
- Exclude result typesother
- Access time library functions with time.x notation (Cherry-pickother
- Use lowercase function names for yaml and json parse (Cherry-pickother
- Respect the allowedResults flag in the mutate and generate engines (Cherry-pickother
- Try to handle objects first as a map string interface before ref.Val to ref.Val (Cherry-pickother
- Check reports server connectivity with a custom image to avoid using the kubectl image (Cherry-pickother
214 maintenance lines (dependency bumps, CI, tests, docs)
- Add unit test for NamespacedValidatingPolicymaintenance
- Bump actions/upload-artifact from 4.6.2 to 5.0.0maintenance
- Bump actions/upload-artifact from 4.6.2 to 5.0.0 in /.github/actions/publish-imagemaintenance
- Bump actions/download-artifact from 4.3.0 to 6.0.0maintenance
- Bump fluxcd/flux2 from 2.7.2 to 2.7.3maintenance
- Bump actions/download-artifact from 4.3.0 to 6.0.0 in /.github/actions/run-testsmaintenance
- Bump github/codeql-action from 4.30.9 to 4.31.0maintenance
- Add namespaced-validating-policies conformance jobmaintenance
- (CI) update k8s versionsmaintenance
- Bump github.com/cyphar/filepath-securejoin from 0.5.0 to 0.6.0maintenance
- Bump cbrgm/cleanup-stale-branches-action from 1.2.0 to 1.2.2maintenance
- Bump github/codeql-action from 4.31.0 to 4.31.2maintenance
- Bump sigs.k8s.io/controller-runtime from 0.22.0 to 0.22.4maintenance
- Bump github.com/aptible/supercronic from 0.2.36 to 0.2.39maintenance
- Bump helm/kind-action from 1.12.0 to 1.13.0 in /.github/actions/run-testsmaintenance
- Bump helm/kind-action from 1.12.0 to 1.13.0maintenance
- Bump nivpol to v1beta1maintenance
- Bump sigs.k8s.io/kustomize/api from 0.20.1 to 0.21.0maintenance
- Bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login from 0.10.1 to 0.11.0maintenance
- Bump golang.org/x/sync from 0.17.0 to 0.18.0maintenance
- Bump github/codeql-action from 4.31.2 to 4.31.3maintenance
- Bump golang.org/x/crypto from 0.43.0 to 0.44.0maintenance
- Bump the otel group across 1 directory with 10 updatesmaintenance
- Temporarily remove falky testsmaintenance
- Bump the kubernetes group across 3 directories with 7 updatesmaintenance
- Bump golangci/golangci-lint-action from 8.0.0 to 9.0.0maintenance
- Bump helm/chart-testing-action from 2.7.0 to 2.8.0maintenance
- Bump actions/checkout from 4.2.2 to 5.0.1maintenance
- Bump google.golang.org/grpc from 1.76.0 to 1.77.0maintenance
- Minor fixesmaintenance
- Bump actions/checkout from 5.0.0 to 5.0.1 in /.github/actions/run-testsmaintenance
- Bump github.com/sigstore/rekor from 1.3.10 to 1.4.3maintenance
- Bump svenstaro/upload-release-action from 2.11.2 to 2.11.3maintenance
- Bump github.com/go-git/go-git/v5 from 5.16.3 to 5.16.4maintenance
- Bump github.com/cyphar/filepath-securejoin from 0.6.0 to 0.6.1maintenance
- Bump github/codeql-action from 4.31.3 to 4.31.5maintenance
- Add a new test that uses both context and valuesmaintenance
- Bump actions/checkout from 5.0.1 to 6.0.0maintenance
- Bump golangci/golangci-lint-action from 9.0.0 to 9.1.0maintenance
- Add chainsaw test for mutating subresource: mpol:maintenance
- Bump github.com/google/go-containerregistry from 0.20.6 to 0.20.7maintenance
- Bump fluxcd/flux2 from 2.7.3 to 2.7.4maintenance
- Bump actions/setup-python from 6.0.0 to 6.1.0maintenance
- Bump actions/setup-go from 6.0.0 to 6.1.0 in /.github/actions/setup-build-envmaintenance
- Bump github.com/google/gnostic-models from 0.7.0 to 0.7.1maintenance
- Bump golang.org/x/crypto from 0.44.0 to 0.45.0maintenance
- Bump cbrgm/cleanup-stale-branches-action from 1.2.2 to 1.2.3maintenance
- Bump github/codeql-action from 4.31.5 to 4.31.6maintenance
- Bump fluxcd/flux2 from 2.7.4 to 2.7.5maintenance
- Bump the sigstore group across 1 directory with 4 updatesmaintenance
- Run autogen chainsaw tests concurrentlymaintenance
- Bump actions/checkout from 6.0.0 to 6.0.1 in /.github/actions/run-testsmaintenance
- Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0maintenance
- Bump actions/checkout from 6.0.0 to 6.0.1maintenance
- Bump github.com/spf13/cobra from 1.10.1 to 1.10.2 in /hack/controller-genmaintenance
- Update go version in devcontainermaintenance
- Bump github.com/spf13/cobra from 1.10.1 to 1.10.2maintenance
- Add Filter webhook handler testmaintenance
- Add unit test for webhooks/handlermaintenance
- Add unit and chainsaw tests for ngpol and nmpolmaintenance
- Bump github/codeql-action from 4.31.6 to 4.31.7maintenance
- Bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0maintenance
- Bump chainsawmaintenance
- Bump github.com/onsi/gomega from 1.38.2 to 1.38.3maintenance
- Bump golang.org/x/sync from 0.18.0 to 0.19.0maintenance
- Bump golang.org/x/crypto from 0.45.0 to 0.46.0maintenance
- Bump github.com/aptible/supercronic from 0.2.39 to 0.2.40maintenance
- Bump the otel group across 1 directory with 10 updatesmaintenance
- Bump codecov/codecov-action from 5.5.1 to 5.5.2maintenance
- Remove steps not used in conformance workflowsmaintenance
- Improved formatting of json data in Vulnerabilities detected github workflowmaintenance
- Bump the kubernetes group across 3 directories with 7 updatesmaintenance
- Bump the sigstore group across 1 directory with 4 updatesmaintenance
- Bump github.com/aptible/supercronic from 0.2.40 to 0.2.41maintenance
- Bump actions/upload-artifact from 5.0.0 to 6.0.0 in /.github/actions/publish-imagemaintenance
- Bump actions/download-artifact from 6.0.0 to 7.0.0 in /.github/actions/run-testsmaintenance
- Bump actions/download-artifact from 6.0.0 to 7.0.0maintenance
- Bump actions/upload-artifact from 5.0.0 to 6.0.0maintenance
- Bump github/codeql-action from 4.31.7 to 4.31.8maintenance
- Bump zgosalvez/github-actions-ensure-sha-pinned-actions from 3.0.25 to 4.0.1maintenance
- Bump google.golang.org/protobuf from 1.36.10 to 1.36.11maintenance
- Bump the sigstore group across 1 directory with 4 updatesmaintenance
- Bump github/codeql-action from 4.31.8 to 4.31.9maintenance
- Update myself in codeowners filemaintenance
- Bump sigs.k8s.io/controller-tools from 0.18.0 to 0.20.0 in /hack/controller-genmaintenance
- Bump actions/download-artifact from 6.0.0 to 7.0.0maintenance
- Fix load test flakesmaintenance
- Bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3maintenance
- Bump google.golang.org/grpc from 1.77.0 to 1.78.0maintenance
- Bump cbrgm/cleanup-stale-branches-action from 1.2.3 to 1.2.4maintenance
- Update reports-server dependency versionmaintenance
- Add k8s fake client libmaintenance
- Fix some comments to improve readabilitymaintenance
- Add missing api docsmaintenance
- Bump github.com/onsi/gomega from 1.38.3 to 1.39.0maintenance
- Bump chainsawmaintenance
- Add option to disable kubectl-evict install in chainsaw testsmaintenance
- Added test for pkg/utils/controller/metadata.gomaintenance
- Bump github.com/sigstore/cosign/v3 from 3.0.3 to 3.0.4maintenance
- Improve background-only chainsaw testsmaintenance
- Improve cleanup chainsaw testsmaintenance
- Improve deferred chainsaw testsmaintenance
- Improve deleting-policy chainsaw testsmaintenance
- Improve events chainsaw testsmaintenance
- Improve exceptions chainsaw testsmaintenance
- Improve filter chainsaw testsmaintenance
- Improve webhooks chainsaw testsmaintenance
- Bump actions/setup-go from 6.1.0 to 6.2.0 in /.github/actions/setup-build-envmaintenance
- Bump golang.org/x/crypto from 0.46.0 to 0.47.0maintenance
- Bump github/codeql-action from 4.31.9 to 4.31.10maintenance
- Bump chainsawmaintenance
- Convert chainsaw config files to v1alpha2maintenance
- Improve conformance images build cachemaintenance
- Add test cases for Trace Webhook Handlermaintenance
- Add Enrich Webhook Handler unit test casesmaintenance
- Add disk cleanup on scale-tests to avoid k6 install failmaintenance
- Add unit tests for pkg/version and pkg/tracingmaintenance
- Bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5maintenance
- Use dedicated configs in test suitesmaintenance
- Bump mikefarah/yq from 4.48.2 to 4.50.1 in /.github/actions/run-testsmaintenance
- Better caching in conformance testsmaintenance
- Better caching in conformance tests (part 2)maintenance
- Improve chainsaw test shardingmaintenance
- Disable trivy cache in devcontainer buildmaintenance
- Improve verify codegen workflowmaintenance
- Update trivy-action usage in our workflowsmaintenance
- Add namespaced-XXX workflows to required conformance testsmaintenance
- Add openreports conformance test lanemaintenance
- Openreports PR followupmaintenance
- Bump github.com/sirupsen/logrus from 1.9.4-0.20230606125235-dd1b4c2e81af to 1.9.4maintenance
- Add missing step template schema in chainsaw testsmaintenance
- Add missing chainsaw test schema directivesmaintenance
- Refactor helm testsmaintenance
- Bump actions/cache from 5.0.1 to 5.0.2maintenance
- Bump sigs.k8s.io/release-utils from 0.12.2 to 0.12.3maintenance
- Fix flake in nivpol chainsaw testsmaintenance
- Bump kind node default image to 1.35maintenance
- Fix flake in ivpol chainsaw testsmaintenance
- Bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.0maintenance
- Bump initial version for helm upgrade testmaintenance
- Add Protect Webhook Handler Unit test casesmaintenance
- Add Unit Test cases for Metrics Webhook Handlermaintenance
- Added unit-test for cmd/kyverno/watch/watcher.go and pkg/utils/retry/…maintenance
- Bump github.com/kyverno/api from 0.0.0-20260107110632-1c7ada92d084 to 0.0.1-alpha.1maintenance
- 1.17.0-rc.1maintenance
- Bump actions/setup-python from 6.1.0 to 6.2.0 (Cherry-pickmaintenance
- Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (Cherry-pickmaintenance
- Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 (Cherry-pickmaintenance
- Bump github.com/in-toto/in-toto-golang from 0.9.1-0.20240317085821-8e2966059a09 to 0.10.0 (Cherry-pickmaintenance
- Add caching workflow (Cherry-pickmaintenance
- Use gomod cache in cli test workflow (Cherry-pickmaintenance
- Add more modules to gomod cache (Cherry-pickmaintenance
- Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 (Cherry-pickmaintenance
- Use gomod cache in verify-codegen workflow (Cherry-pickmaintenance
- Improve cache in images build workflow (Cherry-pickmaintenance
- Bump actions/checkout from 6.0.1 to 6.0.2 (Cherry-pickmaintenance
- Use gomod cache in unit tests workflow (Cherry-pickmaintenance
- Use gomod in load testing workflow (Cherry-pickmaintenance
- Remove unused step in sonar workflow (Cherry-pickmaintenance
- Use gomod cache in linter workflow (Cherry-pickmaintenance
- Bump the sigstore group across 1 directory with 4 updates (Cherry-pickmaintenance
- Remove unused step in fossa workflow (Cherry-pickmaintenance
- Add unit tests for admission metrics, resource counters, and UpdateRequest generation (Cherry-pickmaintenance
- Use gomod cache in images publish workflow (Cherry-pickmaintenance
- Fix use gomod cache in images publish workflow (Cherry-pickmaintenance
- Use gomod cache in conformace workflow (Cherry-pickmaintenance
- Fix images preparation (Cherry-pickmaintenance
- Remove wrong fetch-deps in workflow (Cherry-pickmaintenance
- Improve gobuild cache (Cherry-pickmaintenance
- Fix unit tests cache key (Cherry-pickmaintenance
- Use gomod cache in post conformance workflow (Cherry-pickmaintenance
- Improve gobuild cache content (Cherry-pickmaintenance
- Tidy up helm release workflow (Cherry-pickmaintenance
- Added unit tests for webhook/utils and fixed a linter suggestion (Cherry-pickmaintenance
- Bump github/codeql-action from 4.31.10 to 4.31.11 (Cherry-pickmaintenance
- Improve release workflow (Cherry-pickmaintenance
- Add unit tests for auth/checker package (Cherry-pickmaintenance
- Added unit tests for CheckSubjects function (Cherry-pickmaintenance
- Add unit tests for mutate validation (Cherry-pickmaintenance
- Bump github/codeql-action from 4.31.11 to 4.32.0 (Cherry-pickmaintenance
- Bump sigs.k8s.io/controller-runtime from 0.23.0 to 0.23.1 (Cherry-pickmaintenance
- Add unit tests for ResourceFilter.IsEmpty (Cherry-pickmaintenance
- Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 (Cherry-pickmaintenance
- Add unit tests for background/common/labels package (Cherry-pickmaintenance
- Add unit tests for exceptions selector (Cherry-pickmaintenance
- Add unit tests for event creation functions (Cherry-pickmaintenance
- Add unit tests for report results utilities (Cherry-pickmaintenance
- Add unit tests for globalcontext/store package (Cherry-pickmaintenance
- 1.17.0-rc.2maintenance
- Fix helm release workflow (Cherry-pickmaintenance
- Fix helm release workflow (Cherry-pickmaintenance
- Add unit tests for match utils namespace functions (Cherry-pickmaintenance
- Add unit tests for RedactSecret function (Cherry-pickmaintenance
- Add unit tests for validate utils anchor functions (Cherry-pickmaintenance
- Add unit tests for metrics parser functions (Cherry-pickmaintenance
- Add unit tests for report utils functions (Cherry-pickmaintenance
- Add unit tests for policy exception helper functions (Cherry-pickmaintenance
- Bump docker/login-action from 3.6.0 to 3.7.0 (Cherry-pickmaintenance
- Add unit tests for pkg/tls/reader.go (Cherry-pickmaintenance
- Generate policies.kyverno.io client only for v1beta1 (Cherry-pickmaintenance
- Retry devcontainer-build workflow automatically (Cherry-pickmaintenance
- Fix retry devcontainer-build workflow (Cherry-pickmaintenance
- Automatically retry conformance workflow (Cherry-pickmaintenance
- Remove dummy workflow (Cherry-pickmaintenance
- Bump github.com/onsi/gomega from 1.39.0 to 1.39.1 (Cherry-pickmaintenance
- Bump actions/cache from 5.0.2 to 5.0.3 (Cherry-pickmaintenance
- Add timeout in helm uninstall workflow (Cherry-pickmaintenance
- Add missing conformance requirements (Cherry-pickmaintenance
- V1.17.0-rc.3maintenance
- Fix helm lintmaintenance
- Fix deprecations in goreleaser config (Cherry-pickmaintenance
- Fix concurrency key in retry workflow (Cherry-pickmaintenance
- Bump github.com/aptible/supercronic from 0.2.41 to 0.2.42 (Cherry-pickmaintenance
- V1.17.0maintenance
353 lines3 security1 removed34 added3 changed67 fixed31 other214 maintenancetyped from the source notes