platformchangelog.dev
43 tools
tools43j k move f filter
‹ tools kyvernotool

Kyverno

v1.19.1current · 2026-09-10

Kubernetes-native policy engine: validate, mutate and generate resources, and verify image signatures, using policies written as YAML.

governance CNCF·license oss
toolCost & governanceSupply chain
release lines seen1.191.181.171.161.15
homepagerepositorylatest release
alternatives1
Open Policy Agent3.269.0

Kyverno writes policies as Kubernetes YAML; OPA uses Rego and also covers decisions outside Kubernetes.

No case notes yet. Know of a public postmortem or case study? Tell us.
releases12change lines typed from the source notes
v1.19.12026-09-10patchsecurity++**************!!sharesource
  • Bump Go 1.26.6 and x/net to resolve CVE-2026-39821security
  • Update Go to address CVE-2026-56853security
  • Cherry-pick: fix IVPol PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c)security
  • Phase1 deprecation warning plumbing and CLI warning enforcement (Cherry-pickadded
  • Add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 (Cherry-pickadded
  • Extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (Cherry-pickadded
  • Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pickfixed
  • Apply HTTP blocklist to apiCall.service executor (cherry-pickfixed
  • Harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pickfixed
  • Avoid data race in image evaluator prefetch (Cherry-pickfixed
  • Close IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress (Cherry-pickfixed
  • Disable mutateDigest in exceptions-disabled IVPolfixed
19 more lines
  • Loosen chainsaw stderr checks to containsfixed
  • Disable IVPol digest defaults in leftover fixtures in v1.19fixed
  • Backport 7ac176ac apiCall urlPath hardening to release-1.19fixed
  • Validate PolicyException CEL match conditions (Cherry-pickfixed
  • Disable IVPol digest defaults in leftover report fixturesfixed
  • Watch background-scan reports for the ephemeral reports circuit breaker (Cherry-pickfixed
  • Handle missing reports CRDs as no-op in kyverno-init (Cherry-pickfixed
  • Skip namespace lookup in exception matching when no namespaceSelector is defined (Cherry-pickfixed
  • Propagate synchronize option to UpdateRequests (Cherry-pickfixed
  • Fix deadlocks in entry lifecycle and watch error handling (Cherry-pickfixed
  • Avoid redundant recorder notifications (Cherry-pickfixed
  • Fix label prefix and metadata for namespaced CEL policies (Cherry-pickfixed
  • Close layer readers per-iteration to avoid FD/memory leak (Cherry-pickfixed
  • Recreate downstream resource after repeated deletions (Cherry-pickfixed
  • Skip scalar values during wildcard image extraction (Cherry-pickfixed
  • Discover autogen'd IVPol/NIVPol targets for background scan (Cherry-pickfixed
  • [release-1.19] fix: deny globalContext in namespaced policiesother
  • [release-1.19] fix(cel): read PolicyExceptions from the manager cache, not a second informerother
  • [release-1.19] fix(deps): upgrade golang.org/x/crypto to v0.56.0 and grpc to v1.83.2other
4 maintenance lines (dependency bumps, CI, tests, docs)
  • Bump kyverno sdk to 68d74afcb07amaintenance
  • Bump golang.org/x/mod to v0.40.0maintenance
  • Cut release v1.19.1-rc.1maintenance
  • Cut release v1.19.1maintenance
35 lines3 security3 added22 fixed3 other4 maintenancetyped from the source notes
v1.19.02026-08-20minorsecurity++++-*************!sharesource
  • Limit intermediate certs to mitigate CVE-2026-32280security
  • Point to security assessmentssecurity
  • Regenerate CRDs and docs after GHSA-79gf-7frw-68m9 API bumpsecurity
  • Bump golang.org/x/crypto to v0.53.0 and x/net to v0.56.0 to resolve security CVEssecurity
  • Upgrade go toolchain to 1.26.3 to resolve CVE-2026-39836security
  • Patch ORAS and sigstore CodeQL vulnerabilitiessecurity
  • Address open CodeQL security vulnerabilitiessecurity
  • Bump cel-go to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9gsecurity
  • Cleanup: remove dead fakeContext coderemoved
  • Cli apply cross resourceadded
  • Add offline mock support for http mock request/response for GET method and global context entriesadded
  • Add updaterequest total gauge metricadded
159 more lines
  • Support extraArgs in CRDs migration jobadded
  • Add non-goalsadded
  • Add optional PrometheusRule templateadded
  • Update api docsadded
  • Add NOTICE and embed attribution in container imagesadded
  • Add opertional runbookadded
  • Add offline mock support for k8sresource-backed global context entries via inline and external resource manifestsadded
  • Enable Cosign verbosity debuggingadded
  • Support multiple CRD paths and hook CRD processor into test commandadded
  • Add image to allowed volumetypesadded
  • Honor expired CEL PolicyExceptionsadded
  • Add CEL http.Post mocking test fixtures, duplicate validation check, and integration testsadded
  • Support skipBackgroundRequests for CEL mpol/gpoladded
  • Support useServerSideApply for GeneratingPolicyadded
  • Add auditAnnotations support to GeneratingPolicyadded
  • Support MutatingPolicy target conditions and subresource targetsadded
  • Reuse image verification cache for ImageValidatingPolicyadded
  • Add YAML template mode for GeneratingPolicy with optional CEL interpolationadded
  • Support MutatingAdmissionPolicy v1 on Kubernetes 1.36added
  • Add regex.replace extension functionadded
  • Add auditAnnotations support to MutatingPolicyadded
  • Expose maxGlobalContextEntries in the Kyverno chartadded
  • Support admission operation simulation for policy testingadded
  • Surface deprecation of legacy kyverno.io policy types (warnings, helm notice, PSS default)added
  • Remove kyverno-json support from apiadded
  • Remove kyverno-json from test api (Cherry-pickadded
  • Remove chainsaw tests using kyverno-json (Cherry-pickadded
  • Remove json scan command (Cherry-pickadded
  • Add configurable lifecycle hooks to all controllers (Cherry-pickadded
  • Remove reference to kyverno-json from go modules (cherry-pickadded
  • Revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policiesfixed
  • Fix permissions for pr-branch-updaterfixed
  • Prevent panic in label_match on nested structuresfixed
  • Retry on conflict when updating policy statusfixed
  • Restart dynamic watchers in background reporting on 410fixed
  • Support cluster-scoped resource generation in GeneratingPolicyfixed
  • Pass AdmissionRequest to updaterequests for mutate existing policyfixed
  • Fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test commandfixed
  • Add generatedResources field for GeneratingPolicy multi-resource testsfixed
  • Cli multiple json payloadsfixed
  • Validate name field in globalReference context entryfixed
  • Correctly track per-loader load state to avoid skipping LoadDatafixed
  • Skip report creation for subresources with empty name/UIDfixed
  • Include CEL validation expression index in policy report propertiesfixed
  • ReportsServer.enabled=true fails with "Image tags must be strings"fixed
  • Wire readiness-checker into local kind dev workflowfixed
  • Fix crash loop, missing status, and recorder keyfixed
  • Apply namespaceSelector against Namespace resource own labelsfixed
  • Do not abort required validation on non-matching imagesfixed
  • Allow multiple CRDs in to be in the --crd-path filefixed
  • Add the readiness checker to the ci image archivefixed
  • Add access to clusterroles and bindings in the standard kyverno configfixed
  • Support cel exception in cli apply 'exceptions-within-resources'fixed
  • Wire gpolEngine and gpolProvider into policyControllerfixed
  • Nil pointer panic in getGpolTriggers on ListResource errorfixed
  • Fix UR regressionfixed
  • Fix context and SyncWatchers race conditions in GeneratingPolicyfixed
  • Batch UpdateRequests to avoid etcd size limitfixed
  • Apply orphanDownstreamOnPolicyDelete to clone cleanupfixed
  • Remove dead watcher entry on goroutine exitfixed
  • Support NamespacedGeneratingPolicy end-to-endfixed
  • Scan NamespacedImageValidatingPolicy resources toofixed
  • Validate stdin across apply pathsfixed
  • Serialize gh-pages publishes to prevent missing kyverno-policies releasesfixed
  • Unblock ko image publish by replacing escaping kodata symlinksfixed
  • Fix CEL autogen namespace replacementfixed
  • Support mixed-type aggregate literals in CEL variablesfixed
  • Preserve cluster-scoped generated resourcesfixed
  • Use allPath instead of anyPath in m.All validation loopfixed
  • Prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixesfixed
  • Use server-side apply for conformance CRD refreshfixed
  • Add sorting for ivpol targetsfixed
  • Sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's orderfixed
  • Force conflicts when server-side applying conformance CRDsfixed
  • Wire MutatingPolicy and NamespacedMutatingPolicy into background scanfixed
  • Correct label prefix for mpol/dpol policiesfixed
  • ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlogfixed
  • Surface GeneratingPolicy CEL errors when metadata.uid is missingfixed
  • Resolve context leak in dynamic resource watcherfixed
  • Add policies.kyverno.io resources to aggregate policy rolesfixed
  • Skip reports RBAC check when background scanning is disabledfixed
  • Guard nil EndpointConditions.Ready to prevent panicfixed
  • Resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggersfixed
  • Wire cleanup controller core extra resourcesfixed
  • Set a background user so CEL request.userInfo.username is available during scansfixed
  • Avoid mutating policy webhook name collisionsfixed
  • Add missing reportProperties to v2beta1 Rulefixed
  • Handle null image tags in _image.tpl and fix reports-server defaultTagfixed
  • Key generate test clone sources by policyfixed
  • Require --resource for migrate commandfixed
  • Default userInfo groups and uid during background scansfixed
  • Handle whitespace in mpol autogen Object constructorfixed
  • Suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matchesfixed
  • Handle DELETE target expression using oldObjectfixed
  • Serve NamespacedImageValidatingPolicy admission at right pathsfixed
  • Eliminate data race on shared err variable in pod creation goroutinesfixed
  • Add subtests and fix typo in ext/wildcard/match_test.gofixed
  • Resolve error shadowing in SplitDocuments signaturefixed
  • CustomNamespaceLister.List honors the label selectorfixed
  • Allow ApplyConfiguration to mutate atomic lists and structsfixed
  • Scope namespaced policies to their own namespacefixed
  • Make file extension checks case-insensitivefixed
  • Add debug logging for CEL image verification functionsfixed
  • Enforce MutatingPolicy evaluation mode semanticsfixed
  • Validate MAP-incompatible MutatingPolicy match conditionsfixed
  • Surface audit-rule warnings for mixed audit and enforce policiesfixed
  • Reject stale trigger UIDs when live resource does not matchfixed
  • Support private Sigstore/Fulcio instances for keyless verificationfixed
  • Strip cross-namespace ownerReferences in CEL-based generationfixed
  • Align dpol CLI reporting for constraint-excluded resources with vpol/mpolfixed
  • Harden validation, cover ephemeral subresource, and serialize sigstore TUF accessfixed
  • Use sigstore-go TUF client and fallback to trusted_root.jsonfixed
  • Keep autogen variants per-policy to prevent cross-policy clobberingfixed
  • Preserve namespaceSelector during policy autogenfixed
  • Align policy metrics for new policy formatsfixed
  • Validate DeletingPolicy cron schedule at admissionfixed
  • Add excludeBootstrapResources flag to skip Node and CSR on Fail webhooksfixed
  • Don't mark policies not ready or clear webhooks while health is unknownfixed
  • Prevent GlobalContextEntry informer failure from deadlocking the reconcile workerfixed
  • Use request.namespace for vpolExclude matchConditionsfixed
  • Resolve namespaceObject with live API fallback on informer cache missfixed
  • Evaluate mutateExisting mutating policies on admission in testfixed
  • Honor full-exemption PolicyException when multiple exceptions matchfixed
  • Allow pod-level seccomp in restrict-seccomp-strict vpolfixed
  • Honor per-rule failureAction in the admission block deci…fixed
  • Disable in-process cert controller when cert-manager delegation is enabledfixed
  • Fix image verification parity gapsfixed
  • IVPOL mutateDigest unimplemented stubfixed
  • Enforce verifyDigest in ImageValidatingPolicy evaluatorfixed
  • Sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching triggerfixed
  • Prevent autogen from rewriting namespaceObject in mpolfixed
  • Evaluate resource filters from background scanning jobsfixed
  • Use RESTMapper for GVK to GVR mappingfixed
  • Fix context propagation in MatchPolicyContextfixed
  • IVPOL required has no effect (Cherry-pickfixed
  • Preserve validation warnings for generate rules in validateAction (Cherry-pickfixed
  • Reject non-string values in request.operation conditions (Cherry-pickfixed
  • Fix goroutine and ticker leak in metrics initialization (Cherry-pickfixed
  • Fix ticker leak in policyController background reconciliation loop (Cherry-pickfixed
  • Fix context leak in TTL controller reconcile loop (Cherry-pickfixed
  • Fix resource leak in sigstore fetchReferrers loop (Cherry-pickfixed
  • Scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pickfixed
  • Mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pickfixed
  • Do not offload namespaceObject match conditions to the API server (Cherry-pickfixed
  • Fix ignored context in notary registry resolution (Cherry-pickfixed
  • Handle nil RequestKind and RequestResource in trace middleware (Cherry-pickfixed
  • Repopulate intoto payload on attestation cache hitfixed
  • Automate stale PR updatesother
  • Use existing PR updater tokenother
  • Return correct results for NotEquals type mismatch casesother
  • Update backoff v7other
  • Don't initialize rekor client for key or certificate based scenariosother
  • Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3other
  • Image verification credential handling refactorother
  • [Feature] add optional cache bounds via --maxGlobalContextEntriesother
  • Restrict issue self-assignment to good first issues for non-membersother
  • Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global valuesother
  • [Bug Fix] Fix data race and goroutine leak in policy_spec fuzzing on get bytes errorother
  • Release 1.19.0-rc.4other
98 maintenance lines (dependency bumps, CI, tests, docs)
  • Fix cosign releaser stepmaintenance
  • Bump github.com/rs/zerolog from 1.35.0 to 1.35.1maintenance
  • Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1maintenance
  • Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0maintenance
  • Update blocklist to allow in-cluster HTTP callsmaintenance
  • Bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1maintenance
  • Bump github.com/aptible/supercronic from 0.2.43 to 0.2.45maintenance
  • Fix http conformance test blocklistmaintenance
  • Add mpol handler gap tests (namespaced, exception, failurePolicy, dry-run, backgroundSA)maintenance
  • Update available versions in issuesmaintenance
  • Add dpol controller integration testsmaintenance
  • Add gpol exception and CEL edge case integration testsmaintenance
  • Drop reliance on EnvSet in favor of in-library versioningmaintenance
  • Add framework tests github workflowmaintenance
  • Skip framework tests on docs-only and helm-only PRsmaintenance
  • Add new gpol samplesmaintenance
  • Update dependency policymaintenance
  • Clarify performance baselinesmaintenance
  • Add NewTestEnvWithOptions for opt-in policy type wiringmaintenance
  • Add v1.18.1 CEL admission latency benchmarks and reorganize perf-testing layoutmaintenance
  • Add additional dpol controller integration testsmaintenance
  • Cache envtest binaries between framework test runsmaintenance
  • Migrate gpol sync-clone scenarios from chainsawmaintenance
  • Bump codecov-action to v6.0.2 to fix uploader GPG key verificationmaintenance
  • Fix duplicated word in cleanuppolicy validateAuth commentmaintenance
  • Bump github/codeql-action from 4.35.2 to 4.35.4maintenance
  • Bump actions/cache from 5.0.3 to 6.1.0maintenance
  • Upgrade ristretto to v2maintenance
  • Dynamically discover active branches for Trivy issue syncmaintenance
  • Fix README workflow badge and AI policy linkmaintenance
  • Bump rekor and in-toto-golang for codeql alertsmaintenance
  • Fix webhook registration typomaintenance
  • Fix NIVP background + clone-multiple-targets setupmaintenance
  • Update pond dependency to v2maintenance
  • Bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3maintenance
  • Bump fluxcd/flux2 from 2.8.5 to 2.8.6maintenance
  • Fix clone-multiple-targets dynamic lookup fixturemaintenance
  • Bump github.com/onsi/gomega from 1.39.1 to 1.40.0maintenance
  • Bump golang.org/x/net from 0.48.0 to 0.55.0 in /hack/controller-genmaintenance
  • Add YAML fixture loaders for the frameworkmaintenance
  • Bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.3maintenance
  • Bump fossas/fossa-action from 1.9.0 to 2.0.0maintenance
  • Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0maintenance
  • Bump actions/labeler from 6.0.1 to 6.2.0maintenance
  • Bump cbrgm/cleanup-stale-branches-action from 1.2.8 to 1.2.9maintenance
  • Bump the otel group across 1 directory with 4 updatesmaintenance
  • Bump Homebrew/actions/limit-pull-requests from 9ceb7934560eb61d131dde205a6c2d77b2e1529d to 18fcb8e3e06b4247c676c506750dc95ea7226479maintenance
  • Pin Sigstore scaffolding version and remove redundant UR cleanupmaintenance
  • Bump fluxcd/flux2/action from 2.8.6 to 2.9.2maintenance
  • Bump github.com/google/cel-go from 0.28.0 to 0.29.2maintenance
  • Bump cbrgm/cleanup-stale-branches-action from 1.2.9 to 1.2.11maintenance
  • Single-pass report aggregation helper + flagship testmaintenance
  • Add Semgrep SAST workflowmaintenance
  • Bump golang.org/x/crypto from 0.53.0 to 0.54.0maintenance
  • Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0maintenance
  • Bump github.com/aptible/supercronic from 0.2.45 to 0.2.47maintenance
  • Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2maintenance
  • Bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2maintenance
  • Bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1maintenance
  • Migrate pr-branch-updater to GitHub App authmaintenance
  • Bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0maintenance
  • Bump google.golang.org/grpc from 1.82.0 to 1.82.1maintenance
  • Bump github.com/onsi/gomega from 1.40.0 to 1.42.1maintenance
  • Add context propagation to background util functionsmaintenance
  • Bump sigs.k8s.io/structured-merge-diff/v6 from 6.3.2 to 6.4.2maintenance
  • Bump Homebrew/actions/limit-pull-requests from 2026.07.13.1 to 2026.07.20.1maintenance
  • Bump controller-toolsmaintenance
  • Bump actions/setup-python from 6.2.0 to 7.0.0maintenance
  • Point ivpol cosign tests at the kyverno test-images registrymaintenance
  • Assign release milestone to PRs automatically at release timemaintenance
  • Bump actions/labeler from 6.2.0 to 7.0.0maintenance
  • Bump actions/checkout from 6.0.2 to 7.0.1maintenance
  • Bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3maintenance
  • Fix DeletingPolicy objectSelector test resultsmaintenance
  • Add ImageValidatingPolicy support to the frameworkmaintenance
  • Align ivpol framework tests with single-phase image verificationmaintenance
  • Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1maintenance
  • Bump docker/login-action from 4.1.0 to 4.5.1maintenance
  • Bump the kubernetes group across 3 directories with 7 updatesmaintenance
  • Bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2maintenance
  • Bump fluxcd/flux2/action from 2.9.2 to 2.9.3maintenance
  • Bump actions/checkout from 6.0.2 to 7.0.1maintenance
  • Bump ossf/scorecard-action from 2.4.3 to 2.4.4maintenance
  • Bump github.com/aptible/supercronic from 0.2.47 to 0.2.48maintenance
  • Bump docker/login-action from 4.5.1 to 4.5.2maintenance
  • Bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2maintenance
  • Bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1maintenance
  • Bump docker/login-action from 4.5.2 to 4.6.0maintenance
  • Bump google.golang.org/grpc from 1.82.1 to 1.83.0maintenance
  • Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4maintenance
  • Upgrade gotest.tools to v3maintenance
  • Bump cbrgm/cleanup-stale-branches-action from 1.2.11 to 1.2.12maintenance
  • Bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0maintenance
  • Cut release v1.19.0-rc.1maintenance
  • Cut release v1.19.0-rc.2maintenance
  • Add configurable code freeze checkmaintenance
  • Cut release v1.19.0-rc.3maintenance
  • Cut release v1.19.0maintenance
269 lines8 security1 removed33 added117 fixed12 other98 maintenancetyped from the source notes
v1.18.22026-07-10patchsecurity+*****!!sharesource
  • Enforce namespace boundary in generator.apply() (backport GHSA-79gf-7frw-68m9 to release-1.18)security
  • Backport(release-1.18): security dependency bumps fromsecurity
  • Add image to allowed volumetypes (Cherry-pickadded
  • Restart dynamic watchers in background reporting on 410 (Cherry-pickfixed
  • Do not abort required validation on non-matching images (Cherry-pickfixed
  • Allow multiple CRDs in to be in the --crd-path file (Cherry-pickfixed
  • Roll up codeql dependency and toolchain updatesfixed
  • Correct label prefix for mpol/dpol policies (Cherry-pickfixed
2 maintenance lines (dependency bumps, CI, tests, docs)
  • Cut v1.18.2-rc.2maintenance
  • Cut v1.18.2maintenance
10 lines2 security1 added5 fixed2 maintenancetyped from the source notes
v1.18.12026-05-18patch**sharesource
  • Support cluster-scoped resource generation in GeneratingPolicy (Cherry-pickfixed
  • Pass AdmissionRequest to updaterequests for mutate existing policy (Cherry-pickfixed
  • Release v1.18.1-rc.1other
  • Release v1.18.1-rc.2other
1 maintenance lines (dependency bumps, CI, tests, docs)
  • Release v1.18.1maintenance
5 lines2 fixed2 other1 maintenancetyped from the source notes
v1.18.02026-04-29minorsecurity+++++************!sharesource
  • Secure HTTP calls with blocklist/allowlist: HTTP context loading now enforces a configurable blocklist and scoped token authorization, improving security posture for policies that perform external HTTP calls (#15789, #15779).security
  • Limit intermediate certs to mitigate CVE-2026-32280security
  • Fix CVE-2026-32283: upgrade Go toolchain to 1.26.2security
  • Fix CVE-2026-24686: bump go-tuf/v2 to v2.4.1security
  • Fix stdlib CVEssecurity
  • Namespaced image registry credentials: imageRegistryCredentials can now reference namespaced secrets and pod-level imagePullSecrets for image verification (#15112).added
  • CLI expanded policy support: The kyverno apply and kyverno test commands now support cleanup policies, HTTP/Envoy authz policies, and mutateExisting MutatingPolicies (#15732, #15645, #15691, #15253).added
  • Success event filtering: A new successEventActions ConfigMap parameter allows fine-grained control over which success events are emitted (#15466).added
  • Add support for gzip library and confidential containers exampleadded
  • Add successEventActions parameter to filter which success events are emittedadded
  • Add --exemplarFilter flag to control exemplar collection in metricsadded
  • Add exceptions-with-policies flag to kyverno apply CLIadded
96 more lines
  • Add projected service account token support in Helm chartadded
  • Add admission-controller autoscaling based on memory utilizationadded
  • Add TLS encryption to /metrics endpointadded
  • Allow output for missing resources in CLI testsadded
  • Support uri suffix for defaultRegistry in configadded
  • Support mutateExisting MutatingPolicy in CLI testadded
  • Support cleanup policies in kyverno apply commandadded
  • Support HTTP/Envoy authz policies in kyverno applyadded
  • Support authz policies in kyverno testadded
  • Permit imageRegistryCredentials to use namespaced secrets and pod-level imagePullSecretsadded
  • Secure HTTP calls: enforce blocklist and add FLAG_HTTP_BLOCKLIST overrideadded
  • Use scoped token for request authorization in HTTP contextadded
  • Add controller deployment labels to Helm chartadded
  • Add extraVolumes and extraVolumeMounts support to Helm chartadded
  • Add Global.PriorityClassName Helm value with pod templatingadded
  • Add support for excludes (namespace, subject, resource rules, and custom matchConditions) in ValidatingPoliciesadded
  • Allow auditAnnotation configuration of ValidatingPoliciesadded
  • Add perPolicy overrides for custom annotationsadded
  • Remove kubectl from webhook cleanup binary, replacing with client-go (#15067,added
  • Add output type validation for image extractorsadded
  • Replace the aerosound readiness image with a purpose-built readiness-checker imageadded
  • Enhance any block logs to include better context when no condition passesadded
  • Fix matchImageReferences not filtering images properlyfixed
  • Fix ivpol: remove early return on matchImageReference so CEL evaluation is not skippedfixed
  • Fix processResourceWithPatches returning nil on patch failure, silently bypassing image verificationfixed
  • Fix imageVerify multi-signature annotation validation bugfixed
  • Set UseSignedTimestamps when TSACertChain is provided in IVPOL cosign verifierfixed
  • Enable signed timestamp verification when TSA cert chain is providedfixed
  • Relax EKU validation for DigiCert TSA (#15093,fixed
  • Use kyverno namespace secrets in reports scanner for ivpolfixed
  • Nil pointer dereference in Certificates branch of manifest validationfixed
  • Add cert identity verification for buildpolicyfixed
  • Close ReadCloser from layer.Uncompressed() in image verificationfixed
  • Add HTTP 429 retry in image data loaderfixed
  • Release RLock before early return in imageContext.Getfixed
  • Add synchronization to TUF client initialization to prevent data racefixed
  • Propagate errors in notary repositoryClient.Resolve()fixed
  • Missing ivpol autogen for namespaced policies; simplify ivpol/vpol namespaced handling in CLIfixed
  • CLI CRD support without cluster connectionfixed
  • Bypass rule name matching for ruleless policies in CLIfixed
  • Add list GVK to fake cluster scheme to prevent mutateExisting panicfixed
  • Pass CRD-aware RESTMapper to GeneratingPolicy test pathfixed
  • Correct test result reporting for legacy policies and CEL engine errorsfixed
  • Display NonFatalErrors in CLI test commandfixed
  • Return error instead of panic when imageRegistryCredentials.secrets are used in CLIfixed
  • Add default message when rule message is empty in CLIfixed
  • Three bugs in CLI apply commandfixed
  • CLI failing selector-based policies when they did not match the resourcefixed
  • Close leaked file handles in CLI apply command (#15151,fixed
  • Return proper error on non-OK HTTP status in CLI resource and policy loadingfixed
  • Prevent segfault when applying K8s-mode policy to JSON payloadfixed
  • Support piped v1.List objects in apply commandfixed
  • Check all rules in the test in case no rule is specifiedfixed
  • Bypass blocklist for cluster-scoped HTTP policiesfixed
  • HTTP CEL compilation error on NVPOLfixed
  • Compile dpol variables before conditions to allow variable referencesfixed
  • Use extended compiler for mpol variables and conditionsfixed
  • Inject namespaceObject into MutatingPolicy CEL contextfixed
  • Handle mutating policy variable compile errorsfixed
  • Polex filtering in vpol enginefixed
  • Fix vpol/ivpol: align auditAnnotation behaviour with upstream VAPfixed
  • Fetch namespace-scoped enforce policies in audit query pathfixed
  • UserInfo error in CEL expressions for VAPs and MAPs in background scanningfixed
  • Include auditWarn policies in namespace selector checkfixed
  • Panic in ExpandInMetadata when metadata is not a mapfixed
  • Prevent nil pointer panic on malformed AdmissionReview requestfixed
  • Clear stale error in GlobalContextEntry after successful API callfixed
  • Prevent defer from overwriting named return error in validateOldfixed
  • ClusterRoles should only return applicable cluster roles for the namespace of the requestfixed
  • Incorrect policy exclusion reporting for Pod-targeted policies with autogen in vpol/mpolfixed
  • Autogen to use fully-qualified GVKs to prevent matching non-Kubernetes resourcesfixed
  • Global validationFailureActionOverrides being silently ignoredfixed
  • Add explicit policy-level validationFailureAction templatingfixed
  • Skip policy reports with PolicyException in background scanfixed
  • Accumulate downstreams from all ForEachGeneration entriesfixed
  • Prevent deleteDownstream from silently overwriting Failed UR statusfixed
  • Propagate non-NotFound errors in generate clone target fetchfixed
  • Use AddRateLimited instead of AddAfter in background controller handleErr to respect rate limitingfixed
  • Track applyGenerate errors in failures slicefixed
  • Copy properties map to prevent concurrent map writes in reports-controllerfixed
  • Remove hard-wiring of v1alpha1 map informersfixed
  • Use shared informers for webhook controller and handlersfixed
  • Emit VAP generation events only when create/update occurredfixed
  • Emit Resource Mutated event for MutatingPolicyfixed
  • Warn on omitEvents/successEvents clashfixed
  • Prevent deadlock in Recorderfixed
  • Remove duplicate JSON log keys in validation handlerfixed
  • Background-controller metrics port ignoring config and going to 8080fixed
  • Prevent index out of range panic in enqueueReportsForPolicy for namespaced PolicyReportsfixed
  • Restrict configmap access for namespaced policiesfixed
  • Make kyverno Helm chart PSS-compliantfixed
  • Add app.kubernetes.io/name label to all pods in kyverno chartfixed
  • Remove finalizers and workarounds around uninstallfixed
  • Update require-run-as-nonroot ValidatingPolicy CEL expressionfixed
  • Improve error handling for API calls to surface permission issuesfixed
  • Propagate context and add HTTP timeout in API/registry callsfixed
9 maintenance lines (dependency bumps, CI, tests, docs)
  • Bump github.com/sigstore/cosign/v3 from 3.0.4 to 3.0.6 (#15321,maintenance
  • Bump github.com/sigstore/sigstore to 1.10.5maintenance
  • Bump github.com/sigstore/rekor to 1.5.1maintenance
  • Bump github.com/google/go-containerregistry from 0.21.3 to 0.21.5 (#15797,maintenance
  • Bump golang.org/x/crypto to 0.50.0 (#15551,maintenance
  • Bump the Kubernetes group libraries (#15408,maintenance
  • Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3maintenance
  • Bump sigs.k8s.io/controller-runtime to 0.23.3maintenance
  • Routine dependency updates (grpc, otel, go-git, supercronic, zerolog, envoy, and GitHub Actions)maintenance
117 lines5 security29 added74 fixed9 maintenancetyped from the source notes
v1.17.22026-04-23patchsecurity+**************!!!!sharesource
  • CVE-2026-24051 (release 1.17)security
  • CVE-2026-1229security
  • CVE-2026-33186security
  • Disable HTTP in namespaced policies by default (CVE-2026-4789)security
  • CVE-2026-34986security
  • Support subresource (Cherry-pickadded
  • Correct verbosity and type for dpol not match logging (Cherry-pickfixed
  • Report creation for namespaced policy at admission and background (Cherry-pickfixed
  • Handle empty results for target expressions (Cherry-pickfixed
  • Check object before usage (Cherry-pickfixed
  • CLI resource lookup for ivpol (Cherry-pickfixed
  • CVES 2026-15558 for 1.17fixed
17 more lines
  • Create correct webhook key for nmpol (Cherry-pickfixed
  • Bump go to fix stdlib CVEsfixed
  • Respect policy namespace in webhook name generation (Cherry-pickfixed
  • Ensure consistent order of webhooks and webhook rules to prevent reconciliation loops (Cherry-pickfixed
  • Filter mpols with target constraints at admission time (Cherry-pickfixed
  • Handle targets in multiple namespaces correctly (Cherry-pickfixed
  • Support resourceNames for TargetMatchConstraints (Cherry-pickfixed
  • Polex fetching in background mode (Cherry-pickfixed
  • Implement user info handling in MutatingPolicy and ValidatingPolicy policies and add test cases (Cherry-pickfixed
  • Use scoped token for request authz (cherry-pick #15779 to release-1.17)fixed
  • Prevent forEach mutation panic [release-1.17]fixed
  • Set explicit cosign bundle pathfixed
  • Release cosign bundle release 1.17fixed
  • Cherry pickother
  • Cherry pickother
  • Wrong lister in GenerateNamespaced breaks sync for all NamespacedGeneratingPolicy on UPDATE (Cherry-pickother
  • Restrict configmap access for namespaced policies (Cherry-pickother
7 maintenance lines (dependency bumps, CI, tests, docs)
  • Add trivy scan workflowmaintenance
  • Backport ci changes from main to release-1.17 branchmaintenance
  • Remove unnecessary jobs in conformance tests (Cherry-pickmaintenance
  • Add missing scripts for cimaintenance
  • Release 1.17.2-rc.1maintenance
  • Fix goreleaser for cosign v3maintenance
  • Release v1.17.2maintenance
36 lines5 security1 added19 fixed4 other7 maintenancetyped from the source notes
v1.16.42026-04-23patchsecurity******!!!!!!!!!!!!sharesource
  • CVE-2025-68121 (Cherry-picksecurity
  • CVE-2026-24051 (release 1.16)security
  • Bump github.com/docker/cli to resolve CVE-2025-15558security
  • CVE-2026-1229 in release-1.16security
  • CVE-2026-26958security
  • CVE-2025-15558security
  • Bump sigstore/rekor to v1.5.1 to fix CVE-2026-23831security
  • Bump go-tuf/v2 to v2.3.1 to address CVE-2026-23992security
  • Resolve CVE-2025-66564security
  • CVE-2026-33186security
  • CVE-2026-22772security
  • Bump go-tuf/v2 to v2.4.1 to patch CVE-2026-24686security
10 more lines
  • Disable HTTP in namespaced policies by default (CVE-2026-4789)security
  • Stdlib CVEsfixed
  • CVEs - Release 1.16fixed
  • Use scoped token for request authz (cherry-pick #15779 to release-1.16)fixed
  • Add missing .chainsaw.yaml to conformance test directoriesfixed
  • Prevent forEach mutation panic [release-1.16]fixed
  • Resolve CVES for go < 1.25.8fixed
  • Backport #c558d557349a70cd5de52f761db0bb98b6b8ab57 to 1.16other
  • Cherry pickother
  • Restrict configmap access for namespaced policies (Cherry-pickother
8 maintenance lines (dependency bumps, CI, tests, docs)
  • Add trivy scan workflow (Cherry-pickmaintenance
  • Backport ci changes from main to release-1.16 branchmaintenance
  • Remove unnecessary jobs in conformance tests (Cherry-pickmaintenance
  • Add missing scripts for ci (Cherry-pickmaintenance
  • Release 1.16.4-rc.1maintenance
  • Remove wrongly backported workflowsmaintenance
  • Backport fixesmaintenance
  • Release v1.16.4maintenance
30 lines13 security6 fixed3 other8 maintenancetyped from the source notes
v1.17.12026-02-19patchsecurity~~****************!sharesource
  • CVE-2025-68121 (Cherry-picksecurity
  • Changed default value and helm values documentation from integer to duration string (Cherry-pickchanged
  • Change indentation of validationActions fields (cherry-pickchanged
  • Panic in metrics wrapper when generating response does not provide a result (Cherry-pickfixed
  • Init dclient before using it (Cherry-pickfixed
  • Eliminate memcache error spam from fake client discovery polling (Cherry-pickfixed
  • Restmapper for fakeclient (cherry-pickfixed
  • Enable signed timestamp verification when TSA cert chain is provided (Cherry-pickfixed
  • Add default message for ValidatingPolicy when message field is empty (Cherry-pickfixed
  • Return errors from syncPolicy to enable workqueue retry (Cherry-pickfixed
  • Skip side effects on dry-run in gpol/mpol (Cherry-pickfixed
  • Unauthorized error when using a private repository (Cherry-pickfixed
13 more lines
  • Add missing endpointslices list permission to cleanup controller role (Cherry-pickfixed
  • Enqueue exceptions (Cherry-pickfixed
  • Nil pointer dereference in Certificates branch of manifest valid… (Cherry-pickfixed
  • Fix Empty list in policy exclusion result in excluding all resources (Cherry-pickfixed
  • ImageVerify Multi-Signature Annotation Validation Bug (Cherry-pickfixed
  • Use Kyverno namespace secrets in reports scanner (Cherry-pickfixed
  • Handler crash for nmpol (Cherry-pickfixed
  • Race conditions in configuration.IsExcluded() and breaker.ReportsBreaker (Cherry-pickfixed
  • Make the mutating policy use its ConditionCompiler to produce the evaluator (Cherry-pickfixed
  • Set UseSignedTimestamps when TSACertChain is provided in IVPOL cosign verifier (cherry pickfixed
  • Cli: simplify namespaced policy loading in CLI (Cherry-pickother
  • Populate registry consistently (Cherry-pickother
  • Cherry pick #0ffed6fother
7 maintenance lines (dependency bumps, CI, tests, docs)
  • Remove Nirmata refs (Cherry-pickmaintenance
  • Fix Chainsaw test for MutatingPolicy add-label-applyconfiguration (Cherry-pickmaintenance
  • Bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (Cherry-pickmaintenance
  • Run unit tests in verbose mode (cherry-pickmaintenance
  • Bump the kubernetes group across 3 directories with 7 updates (Cherry-pickmaintenance
  • V1.17.1-rc.1maintenance
  • V1.17.1maintenance
32 lines1 security2 changed19 fixed3 other7 maintenancetyped from the source notes
v1.17.02026-02-02minorsecurity++++++~-***********!sharesource
  • Add Kubernetes v1.30-v1.32 support to Pod Security Standardsecurity
  • Address security vulnerabilitiessecurity
  • Add CEL-based ValidatingPolicy support for Pod Security Standards (Cherry-picksecurity
  • Remove params reference in API docsremoved
  • Make VAP/MAP reporting opt in instead of opt outchanged
  • Use DynamicInformer for optimal memory and performancechanged
  • Move policy library tests to a post merge lanechanged
  • Add NamespacedImageValidatingPolicy and common compiler interfaceadded
  • Add Okteto to the list of Kyverno adoptersadded
  • Amend the ImageValidatingPolicy controller to work with NamespacedImageValidatingPolicy, configure admission controller and webhookadded
  • Add chainsaw test for namespaced deleting policy in the ci pipelineadded
  • Generate and copy crd to cli for namespaced validating policy and namespaced deleting policyadded
127 more lines
  • In-cluster concurrent resource loaderadded
  • Implement failureActionOverrides namespaceSelectoradded
  • Update codeownersadded
  • Add NamespacedMutatingPolicy and common compiler interfaceadded
  • Add NamespacedGeneratingPolicy to v1alpha1added
  • Support nmpol for update requestsadded
  • Bump ngpol to v1beta1added
  • Add kyverno.io/v2 GlobalContextEntry APIadded
  • Support other key algorithms than RSAadded
  • Update codeownersadded
  • Add CEL Json libraryadded
  • Add kubernetes semantic versioning library to default env optionsadded
  • Create CEL x509 decode functionadded
  • Add --tlsKeyAlgorithm and support more algorithmsadded
  • Added a CEL-Yaml libraryadded
  • Add reports-server integration supportadded
  • Add time library that contains time.now()added
  • Support cert-manager certificates in the helm chartadded
  • Bump kube to 1.35added
  • Use kyverno/api repoadded
  • Added nodeselector for linux to install.yaml generationadded
  • Add time truncate cel functionadded
  • Add execution stats to rule response for generate rulesadded
  • Introduce test quarantine capabilites through inputs to the run tests actionadded
  • Support variable lookup for cpoladded
  • Add automatic GOMEMLIMIT configurationadded
  • Add cosign v3 support to IVPOLadded
  • Add time to cron filteradded
  • Use api remote chartadded
  • Fix metadata path translation and translating paths in matchConditionfixed
  • Allow bind role to the background controller defaultfixed
  • Fix nil namespace initialization for cluster wide param resourcesfixed
  • Add make+gcc and update go version in devcontainerfixed
  • Dont register the http request typefixed
  • Attempt to fix scale test k6 installationfixed
  • Handle namespace match with namespaceSelectorfixed
  • Handle nil MatchConstraintsfixed
  • Use namespaceObject in deletingpoliciesfixed
  • Use context in deletingpolicies in the CLIfixed
  • Duplicate error accumulationfixed
  • Avoid cleanup on non-matching nsfixed
  • Cli test with context file from gitfixed
  • Implement the fake image metadata for the CLIfixed
  • Add webhook compatibility and admission controller to work with NamespacedGeneratingPolicyfixed
  • Make vapgen output predictablefixed
  • Revert accidentally introduced breaking change for the kyverno_policy_results metricfixed
  • Fix namespaced watcherfixed
  • Ensure GVK infos are set when metrics are recordedfixed
  • Pin actionfixed
  • Vuln report jobfixed
  • Vuln report jobfixed
  • Continue deletion on resource not found errorfixed
  • Color issue for --remove-color flagfixed
  • Fix typos in documentationfixed
  • Resolve data race in Test_ValidateAuditWarnfixed
  • Improve error message for ClusterPolicy with namespacefixed
  • Webhooks: prevent audit cancellation by HTTP request contextfixed
  • Add a pre-flight check for listing CRDs in cleanup controllerfixed
  • Close junit system-out tags correctlyfixed
  • Ensure deep copy of context to prevent corruption in multi-rule …fixed
  • WarmUp only caching first policy due to early returnsfixed
  • Chain mutations correctly across multiple policies in CEL mutati…fixed
  • Prevent nil pointer panic in cleanup controllerfixed
  • Run go mod tidy after client codegen to prevent build failuresfixed
  • Fix misleading 'applying background rule' log messagefixed
  • Add missing lock in GetDownstreams to prevent data racefixed
  • Add nil check in UpdateResourceHash to prevent panicfixed
  • Prevent nil pointer dereference of EmitWarning in fine-grained webhookfixed
  • Use local helm-docs binary instead of Dockerfixed
  • Fix generate() returning nil error on failurefixed
  • Prevent generate controller panic when policy is deleted with pending UpdateRequestsfixed
  • Use DeepCopy in WatchManager to prevent cache mutation (Cherry-pickfixed
  • Helm release workflow (Cherry-pickfixed
  • Correct ivpol slice append in scanner (Cherry-pickfixed
  • Use correct resource name in metadata cache update (Cherry-pickfixed
  • Skip racy test (Cherry-pickfixed
  • Add Deduplicate rules in webhook configurations (Cherry-pickfixed
  • Use %w to wrap errors in registry client (Cherry-pickfixed
  • Propagate context in background checks and generate (Cherry-pickfixed
  • Refactor policy controller switch and clean up unused params (Cherry-pickfixed
  • Prevent nil policy panic in updaterequest event generation (Cherry-pickfixed
  • Handle AddEventHandler errors in policy controller (Cherry-pickfixed
  • Prevent selector map mutation in CloneList cleanup loop (Cherry-pickfixed
  • Add missing break in namespace selector override matching (Cherry-pickfixed
  • Add bounds check for Rules slice in CEL generate controller audit (Cherry-pickfixed
  • Update kubectl image to fix CVEs (Cherry-pickfixed
  • New api types backward compatibility (cherry-pickfixed
  • Add missing resource migration in helm chart (Cherry-pickfixed
  • Use correct informer in handler (Cherry-pickfixed
  • Remove some policies.kyverno.io/v1alpha1 usage (Cherry-pickfixed
  • Fix import path to fix loading of policies.kyverno.io/v1 resources (Cherry-pickfixed
  • Callback parameter (Cherry-pickfixed
  • Return error response when PolicyException lookup fails (Cherry-pickfixed
  • Use leader election context to prevent split-brain on leadership… (Cherry-pickfixed
  • Explicitly set empty namespaces for clusterScope FlowSchemas (Cherry-pickfixed
  • Update only what is needed in codegen-helm-update-versions (cherry-pickfixed
  • Restrict resource access in namespaced CEL policy typesother
  • Describe validation actions in API docsother
  • Update devcontainerother
  • Supporting wildcards in resource namespace matchingother
  • Create a chainsaw test for creating a resource with custom label using the generating policyother
  • Removing nancy testsother
  • Create a custom execution cel env to handle expressions in target match constraintsother
  • Execute missing controller metricother
  • Policies api version bumpother
  • Extend CLI policy and exception load, adding test for v1 applicationother
  • Use v1beta1.PolicyException as new default versionother
  • Read kind label value from AdmissionRequestother
  • Create hash CEL libother
  • Skip mutateExisting during admission to prevent trigger mutationother
  • Update versionsother
  • Update CODEOWNERSother
  • Policycache: skip nil and invalid policies to prevent panicsother
  • Create CEL math lib containing the round functionother
  • Policy exception json supportother
  • Set shorter period for k6 testsother
  • Create cel random libraryother
  • Update autogen url in validation error messageother
  • Transform CEL lib (replaces the object_from_lists JMESPath functionality)other
  • Bump cel policy compiler versionsother
  • Module test for function evaluation (replace_all) with shallow variables as function parameterother
  • Exclude result typesother
  • Access time library functions with time.x notation (Cherry-pickother
  • Use lowercase function names for yaml and json parse (Cherry-pickother
  • Respect the allowedResults flag in the mutate and generate engines (Cherry-pickother
  • Try to handle objects first as a map string interface before ref.Val to ref.Val (Cherry-pickother
  • Check reports server connectivity with a custom image to avoid using the kubectl image (Cherry-pickother
214 maintenance lines (dependency bumps, CI, tests, docs)
  • Add unit test for NamespacedValidatingPolicymaintenance
  • Bump actions/upload-artifact from 4.6.2 to 5.0.0maintenance
  • Bump actions/upload-artifact from 4.6.2 to 5.0.0 in /.github/actions/publish-imagemaintenance
  • Bump actions/download-artifact from 4.3.0 to 6.0.0maintenance
  • Bump fluxcd/flux2 from 2.7.2 to 2.7.3maintenance
  • Bump actions/download-artifact from 4.3.0 to 6.0.0 in /.github/actions/run-testsmaintenance
  • Bump github/codeql-action from 4.30.9 to 4.31.0maintenance
  • Add namespaced-validating-policies conformance jobmaintenance
  • (CI) update k8s versionsmaintenance
  • Bump github.com/cyphar/filepath-securejoin from 0.5.0 to 0.6.0maintenance
  • Bump cbrgm/cleanup-stale-branches-action from 1.2.0 to 1.2.2maintenance
  • Bump github/codeql-action from 4.31.0 to 4.31.2maintenance
  • Bump sigs.k8s.io/controller-runtime from 0.22.0 to 0.22.4maintenance
  • Bump github.com/aptible/supercronic from 0.2.36 to 0.2.39maintenance
  • Bump helm/kind-action from 1.12.0 to 1.13.0 in /.github/actions/run-testsmaintenance
  • Bump helm/kind-action from 1.12.0 to 1.13.0maintenance
  • Bump nivpol to v1beta1maintenance
  • Bump sigs.k8s.io/kustomize/api from 0.20.1 to 0.21.0maintenance
  • Bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login from 0.10.1 to 0.11.0maintenance
  • Bump golang.org/x/sync from 0.17.0 to 0.18.0maintenance
  • Bump github/codeql-action from 4.31.2 to 4.31.3maintenance
  • Bump golang.org/x/crypto from 0.43.0 to 0.44.0maintenance
  • Bump the otel group across 1 directory with 10 updatesmaintenance
  • Temporarily remove falky testsmaintenance
  • Bump the kubernetes group across 3 directories with 7 updatesmaintenance
  • Bump golangci/golangci-lint-action from 8.0.0 to 9.0.0maintenance
  • Bump helm/chart-testing-action from 2.7.0 to 2.8.0maintenance
  • Bump actions/checkout from 4.2.2 to 5.0.1maintenance
  • Bump google.golang.org/grpc from 1.76.0 to 1.77.0maintenance
  • Minor fixesmaintenance
  • Bump actions/checkout from 5.0.0 to 5.0.1 in /.github/actions/run-testsmaintenance
  • Bump github.com/sigstore/rekor from 1.3.10 to 1.4.3maintenance
  • Bump svenstaro/upload-release-action from 2.11.2 to 2.11.3maintenance
  • Bump github.com/go-git/go-git/v5 from 5.16.3 to 5.16.4maintenance
  • Bump github.com/cyphar/filepath-securejoin from 0.6.0 to 0.6.1maintenance
  • Bump github/codeql-action from 4.31.3 to 4.31.5maintenance
  • Add a new test that uses both context and valuesmaintenance
  • Bump actions/checkout from 5.0.1 to 6.0.0maintenance
  • Bump golangci/golangci-lint-action from 9.0.0 to 9.1.0maintenance
  • Add chainsaw test for mutating subresource: mpol:maintenance
  • Bump github.com/google/go-containerregistry from 0.20.6 to 0.20.7maintenance
  • Bump fluxcd/flux2 from 2.7.3 to 2.7.4maintenance
  • Bump actions/setup-python from 6.0.0 to 6.1.0maintenance
  • Bump actions/setup-go from 6.0.0 to 6.1.0 in /.github/actions/setup-build-envmaintenance
  • Bump github.com/google/gnostic-models from 0.7.0 to 0.7.1maintenance
  • Bump golang.org/x/crypto from 0.44.0 to 0.45.0maintenance
  • Bump cbrgm/cleanup-stale-branches-action from 1.2.2 to 1.2.3maintenance
  • Bump github/codeql-action from 4.31.5 to 4.31.6maintenance
  • Bump fluxcd/flux2 from 2.7.4 to 2.7.5maintenance
  • Bump the sigstore group across 1 directory with 4 updatesmaintenance
  • Run autogen chainsaw tests concurrentlymaintenance
  • Bump actions/checkout from 6.0.0 to 6.0.1 in /.github/actions/run-testsmaintenance
  • Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0maintenance
  • Bump actions/checkout from 6.0.0 to 6.0.1maintenance
  • Bump github.com/spf13/cobra from 1.10.1 to 1.10.2 in /hack/controller-genmaintenance
  • Update go version in devcontainermaintenance
  • Bump github.com/spf13/cobra from 1.10.1 to 1.10.2maintenance
  • Add Filter webhook handler testmaintenance
  • Add unit test for webhooks/handlermaintenance
  • Add unit and chainsaw tests for ngpol and nmpolmaintenance
  • Bump github/codeql-action from 4.31.6 to 4.31.7maintenance
  • Bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0maintenance
  • Bump chainsawmaintenance
  • Bump github.com/onsi/gomega from 1.38.2 to 1.38.3maintenance
  • Bump golang.org/x/sync from 0.18.0 to 0.19.0maintenance
  • Bump golang.org/x/crypto from 0.45.0 to 0.46.0maintenance
  • Bump github.com/aptible/supercronic from 0.2.39 to 0.2.40maintenance
  • Bump the otel group across 1 directory with 10 updatesmaintenance
  • Bump codecov/codecov-action from 5.5.1 to 5.5.2maintenance
  • Remove steps not used in conformance workflowsmaintenance
  • Improved formatting of json data in Vulnerabilities detected github workflowmaintenance
  • Bump the kubernetes group across 3 directories with 7 updatesmaintenance
  • Bump the sigstore group across 1 directory with 4 updatesmaintenance
  • Bump github.com/aptible/supercronic from 0.2.40 to 0.2.41maintenance
  • Bump actions/upload-artifact from 5.0.0 to 6.0.0 in /.github/actions/publish-imagemaintenance
  • Bump actions/download-artifact from 6.0.0 to 7.0.0 in /.github/actions/run-testsmaintenance
  • Bump actions/download-artifact from 6.0.0 to 7.0.0maintenance
  • Bump actions/upload-artifact from 5.0.0 to 6.0.0maintenance
  • Bump github/codeql-action from 4.31.7 to 4.31.8maintenance
  • Bump zgosalvez/github-actions-ensure-sha-pinned-actions from 3.0.25 to 4.0.1maintenance
  • Bump google.golang.org/protobuf from 1.36.10 to 1.36.11maintenance
  • Bump the sigstore group across 1 directory with 4 updatesmaintenance
  • Bump github/codeql-action from 4.31.8 to 4.31.9maintenance
  • Update myself in codeowners filemaintenance
  • Bump sigs.k8s.io/controller-tools from 0.18.0 to 0.20.0 in /hack/controller-genmaintenance
  • Bump actions/download-artifact from 6.0.0 to 7.0.0maintenance
  • Fix load test flakesmaintenance
  • Bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3maintenance
  • Bump google.golang.org/grpc from 1.77.0 to 1.78.0maintenance
  • Bump cbrgm/cleanup-stale-branches-action from 1.2.3 to 1.2.4maintenance
  • Update reports-server dependency versionmaintenance
  • Add k8s fake client libmaintenance
  • Fix some comments to improve readabilitymaintenance
  • Add missing api docsmaintenance
  • Bump github.com/onsi/gomega from 1.38.3 to 1.39.0maintenance
  • Bump chainsawmaintenance
  • Add option to disable kubectl-evict install in chainsaw testsmaintenance
  • Added test for pkg/utils/controller/metadata.gomaintenance
  • Bump github.com/sigstore/cosign/v3 from 3.0.3 to 3.0.4maintenance
  • Improve background-only chainsaw testsmaintenance
  • Improve cleanup chainsaw testsmaintenance
  • Improve deferred chainsaw testsmaintenance
  • Improve deleting-policy chainsaw testsmaintenance
  • Improve events chainsaw testsmaintenance
  • Improve exceptions chainsaw testsmaintenance
  • Improve filter chainsaw testsmaintenance
  • Improve webhooks chainsaw testsmaintenance
  • Bump actions/setup-go from 6.1.0 to 6.2.0 in /.github/actions/setup-build-envmaintenance
  • Bump golang.org/x/crypto from 0.46.0 to 0.47.0maintenance
  • Bump github/codeql-action from 4.31.9 to 4.31.10maintenance
  • Bump chainsawmaintenance
  • Convert chainsaw config files to v1alpha2maintenance
  • Improve conformance images build cachemaintenance
  • Add test cases for Trace Webhook Handlermaintenance
  • Add Enrich Webhook Handler unit test casesmaintenance
  • Add disk cleanup on scale-tests to avoid k6 install failmaintenance
  • Add unit tests for pkg/version and pkg/tracingmaintenance
  • Bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5maintenance
  • Use dedicated configs in test suitesmaintenance
  • Bump mikefarah/yq from 4.48.2 to 4.50.1 in /.github/actions/run-testsmaintenance
  • Better caching in conformance testsmaintenance
  • Better caching in conformance tests (part 2)maintenance
  • Improve chainsaw test shardingmaintenance
  • Disable trivy cache in devcontainer buildmaintenance
  • Improve verify codegen workflowmaintenance
  • Update trivy-action usage in our workflowsmaintenance
  • Add namespaced-XXX workflows to required conformance testsmaintenance
  • Add openreports conformance test lanemaintenance
  • Openreports PR followupmaintenance
  • Bump github.com/sirupsen/logrus from 1.9.4-0.20230606125235-dd1b4c2e81af to 1.9.4maintenance
  • Add missing step template schema in chainsaw testsmaintenance
  • Add missing chainsaw test schema directivesmaintenance
  • Refactor helm testsmaintenance
  • Bump actions/cache from 5.0.1 to 5.0.2maintenance
  • Bump sigs.k8s.io/release-utils from 0.12.2 to 0.12.3maintenance
  • Fix flake in nivpol chainsaw testsmaintenance
  • Bump kind node default image to 1.35maintenance
  • Fix flake in ivpol chainsaw testsmaintenance
  • Bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.0maintenance
  • Bump initial version for helm upgrade testmaintenance
  • Add Protect Webhook Handler Unit test casesmaintenance
  • Add Unit Test cases for Metrics Webhook Handlermaintenance
  • Added unit-test for cmd/kyverno/watch/watcher.go and pkg/utils/retry/…maintenance
  • Bump github.com/kyverno/api from 0.0.0-20260107110632-1c7ada92d084 to 0.0.1-alpha.1maintenance
  • 1.17.0-rc.1maintenance
  • Bump actions/setup-python from 6.1.0 to 6.2.0 (Cherry-pickmaintenance
  • Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (Cherry-pickmaintenance
  • Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 (Cherry-pickmaintenance
  • Bump github.com/in-toto/in-toto-golang from 0.9.1-0.20240317085821-8e2966059a09 to 0.10.0 (Cherry-pickmaintenance
  • Add caching workflow (Cherry-pickmaintenance
  • Use gomod cache in cli test workflow (Cherry-pickmaintenance
  • Add more modules to gomod cache (Cherry-pickmaintenance
  • Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 (Cherry-pickmaintenance
  • Use gomod cache in verify-codegen workflow (Cherry-pickmaintenance
  • Improve cache in images build workflow (Cherry-pickmaintenance
  • Bump actions/checkout from 6.0.1 to 6.0.2 (Cherry-pickmaintenance
  • Use gomod cache in unit tests workflow (Cherry-pickmaintenance
  • Use gomod in load testing workflow (Cherry-pickmaintenance
  • Remove unused step in sonar workflow (Cherry-pickmaintenance
  • Use gomod cache in linter workflow (Cherry-pickmaintenance
  • Bump the sigstore group across 1 directory with 4 updates (Cherry-pickmaintenance
  • Remove unused step in fossa workflow (Cherry-pickmaintenance
  • Add unit tests for admission metrics, resource counters, and UpdateRequest generation (Cherry-pickmaintenance
  • Use gomod cache in images publish workflow (Cherry-pickmaintenance
  • Fix use gomod cache in images publish workflow (Cherry-pickmaintenance
  • Use gomod cache in conformace workflow (Cherry-pickmaintenance
  • Fix images preparation (Cherry-pickmaintenance
  • Remove wrong fetch-deps in workflow (Cherry-pickmaintenance
  • Improve gobuild cache (Cherry-pickmaintenance
  • Fix unit tests cache key (Cherry-pickmaintenance
  • Use gomod cache in post conformance workflow (Cherry-pickmaintenance
  • Improve gobuild cache content (Cherry-pickmaintenance
  • Tidy up helm release workflow (Cherry-pickmaintenance
  • Added unit tests for webhook/utils and fixed a linter suggestion (Cherry-pickmaintenance
  • Bump github/codeql-action from 4.31.10 to 4.31.11 (Cherry-pickmaintenance
  • Improve release workflow (Cherry-pickmaintenance
  • Add unit tests for auth/checker package (Cherry-pickmaintenance
  • Added unit tests for CheckSubjects function (Cherry-pickmaintenance
  • Add unit tests for mutate validation (Cherry-pickmaintenance
  • Bump github/codeql-action from 4.31.11 to 4.32.0 (Cherry-pickmaintenance
  • Bump sigs.k8s.io/controller-runtime from 0.23.0 to 0.23.1 (Cherry-pickmaintenance
  • Add unit tests for ResourceFilter.IsEmpty (Cherry-pickmaintenance
  • Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 (Cherry-pickmaintenance
  • Add unit tests for background/common/labels package (Cherry-pickmaintenance
  • Add unit tests for exceptions selector (Cherry-pickmaintenance
  • Add unit tests for event creation functions (Cherry-pickmaintenance
  • Add unit tests for report results utilities (Cherry-pickmaintenance
  • Add unit tests for globalcontext/store package (Cherry-pickmaintenance
  • 1.17.0-rc.2maintenance
  • Fix helm release workflow (Cherry-pickmaintenance
  • Fix helm release workflow (Cherry-pickmaintenance
  • Add unit tests for match utils namespace functions (Cherry-pickmaintenance
  • Add unit tests for RedactSecret function (Cherry-pickmaintenance
  • Add unit tests for validate utils anchor functions (Cherry-pickmaintenance
  • Add unit tests for metrics parser functions (Cherry-pickmaintenance
  • Add unit tests for report utils functions (Cherry-pickmaintenance
  • Add unit tests for policy exception helper functions (Cherry-pickmaintenance
  • Bump docker/login-action from 3.6.0 to 3.7.0 (Cherry-pickmaintenance
  • Add unit tests for pkg/tls/reader.go (Cherry-pickmaintenance
  • Generate policies.kyverno.io client only for v1beta1 (Cherry-pickmaintenance
  • Retry devcontainer-build workflow automatically (Cherry-pickmaintenance
  • Fix retry devcontainer-build workflow (Cherry-pickmaintenance
  • Automatically retry conformance workflow (Cherry-pickmaintenance
  • Remove dummy workflow (Cherry-pickmaintenance
  • Bump github.com/onsi/gomega from 1.39.0 to 1.39.1 (Cherry-pickmaintenance
  • Bump actions/cache from 5.0.2 to 5.0.3 (Cherry-pickmaintenance
  • Add timeout in helm uninstall workflow (Cherry-pickmaintenance
  • Add missing conformance requirements (Cherry-pickmaintenance
  • V1.17.0-rc.3maintenance
  • Fix helm lintmaintenance
  • Fix deprecations in goreleaser config (Cherry-pickmaintenance
  • Fix concurrency key in retry workflow (Cherry-pickmaintenance
  • Bump github.com/aptible/supercronic from 0.2.41 to 0.2.42 (Cherry-pickmaintenance
  • V1.17.0maintenance
353 lines3 security1 removed34 added3 changed67 fixed31 other214 maintenancetyped from the source notes
v1.16.32026-01-27patch++*sharesource
  • Implement failureActionOverrides namespaceSelector (Cherry-pickadded
  • Add context size limitadded
  • Prevent cross-namespace access in apiCallfixed
  • Release v1.16.3-rc.1other
  • Release v1.16.3other
5 lines2 added1 fixed2 othertyped from the source notes
v1.15.32026-01-27patch++*****sharesource
  • Add check for namespace (Cherry-pickadded
  • Add context size limitadded
  • Correct minor typo (Cherry-pickfixed
  • Correct background-controller automountServiceAccount logic (Cherry-pickfixed
  • Stop status-driven hot-loops (cherry pickfixed
  • Update go version to fix stdlib CVEsfixed
  • Prevent cross-namespace access in apiCallfixed
  • Backport label exclusion to 1.15other
  • Release v1.15.3-rc.1other
  • Release v1.15.3other
10 lines2 added5 fixed3 othertyped from the source notes
v1.16.22026-01-09minor++~**sharesource
  • Use DynamicInformer for optimal memory and performance (Cherry-pickchanged
  • Release v1.16.2-rc.1added
  • Release v1.16.2added
  • Revert accidentally introduced breaking change for the kyverno_policy_results metric (Cherry-pickfixed
  • Add a pre-flight check for listing CRDs in cleanup controller (Cherry-pickfixed
  • Cherry-pickother
  • Cherry-pickother
  • Cherry pickother
  • Execute missing controller metric (Cherry-pickother
  • Read kind label value from AdmissionRequest (Cherry-pickother
10 lines2 added1 changed2 fixed5 othertyped from the source notes