RATATOSKRATATOSK
Sign in

Kyverno

v1.19.0Security
Aug 20, 2026

ACTION 7CHECK 6PLAN 1OTHER 160

A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.

Action needed (7)

  • securityhighIntermediate certificate limits

    Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.

    kyverno#15858

  • securityhighGo toolchain 1.26.3

    The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.

    kyverno#16361

  • securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9

    CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.

    kyverno#16241

  • securityUpdated golang.org/x/crypto and x/net dependencies

    The golang.org/x/crypto dependency was updated to v0.53.0 and x/net to v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.

    kyverno#16340

  • securityPatched ORAS and sigstore vulnerabilities

    The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.

    kyverno#16426

  • securityCodeQL vulnerability fixes

    Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.

    kyverno#16528

  • securitycel-go v0.30.0

    cel-go was updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.

    kyverno#16782

Check if affected (6)

  • breakingRequired --resource for the migrate command

    Applies when the migrate command runs.

    The migrate command now requires --resource. This constraint ships in Kyverno v1.19.0.

    kyverno#16471

  • breakingDefault userInfo groups and UID during background scans

    Applies when background scans run.

    Background scans now default userInfo groups and UID for admission policies. The corrected defaults ship in Kyverno v1.19.0.

    kyverno#16592

  • breakingexcludeBootstrapResources webhook flag

    Applies when you configure Fail webhooks.

    The webhook configuration adds the excludeBootstrapResources flag, which skips Node and CSR resources on Fail webhooks. The flag ships in Kyverno v1.19.0.

    kyverno#16397

  • breakingkyverno-json API support removal

    Applies when you use kyverno-json support from the API.

    kyverno-json support was removed from the API. The removal ships in Kyverno v1.19.0.

    kyverno#16792

  • breakingJSON scan command removal

    Applies when you use the JSON scan command.

    The JSON scan command was removed. The removal ships in Kyverno v1.19.0.

    kyverno#16973

  • breakingString-only request.operation conditions

    Applies when you configure request.operation conditions.

    Validation now rejects non-string values in request.operation conditions. The stricter validation ships in Kyverno v1.19.0.

    kyverno#17013

Plan ahead (1)

  • deprecatedDeprecation notices for legacy kyverno.io policy types

    Applies when you use legacy kyverno.io policy types.

    Deprecation of legacy kyverno.io policy types is surfaced through warnings, a Helm notice, and the PSS default. This deprecation notice ships in Kyverno v1.19.0.

    kyverno#16868

All 160 other recorded changesfixes 91 · value changes 36 · additions 23 · constraints 9 · renames 1

fixes (91)

  • * fix(jmespath): prevent panic in label_match on nested structures by @pulkitvats2007-crypto in https://github.com/kyverno/kyverno/pull/15827
  • * fix: retry on conflict when updating policy status by @williamclot in https://github.com/kyverno/kyverno/pull/15754
  • * fix: restart dynamic watchers in background reporting on 410 by @aerosouund in https://github.com/kyverno/kyverno/pull/16028
  • * fix: support cluster-scoped resource generation in GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16018
  • * fix: pass AdmissionRequest to updaterequests for mutate existing policy by @realshuting in https://github.com/kyverno/kyverno/pull/16050
  • * fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by @SargamPuram in https://github.com/kyverno/kyverno/pull/15784
  • * fix: validate name field in globalReference context entry by @atharrva01 in https://github.com/kyverno/kyverno/pull/16003
  • * fix(gctx): correctly track per-loader load state to avoid skipping LoadData by @liuxu623 in https://github.com/kyverno/kyverno/pull/16099
  • * fix: skip report creation for subresources with empty name/UID by @realshuting in https://github.com/kyverno/kyverno/pull/16114
  • * fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/16167
  • * fix(dpol): apply namespaceSelector against Namespace resource own labels by @realshuting in https://github.com/kyverno/kyverno/pull/16200
  • * fix: do not abort required validation on non-matching images by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16208
  • * return correct results for NotEquals type mismatch cases by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16276
  • * fix: wire gpolEngine and gpolProvider into policyController by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/16171
  • * fix: nil pointer panic in getGpolTriggers on ListResource error by @senutpal in https://github.com/kyverno/kyverno/pull/16245
  • * Fix UR regression by @avoidik in https://github.com/kyverno/kyverno/pull/16280
  • * Fix context and SyncWatchers race conditions in GeneratingPolicy by @Aneesh-Hegde in https://github.com/kyverno/kyverno/pull/16041
  • * fix(generate): batch UpdateRequests to avoid etcd size limit by @vmsilvamolina in https://github.com/kyverno/kyverno/pull/15872
  • * fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by @realshuting in https://github.com/kyverno/kyverno/pull/16329
  • * fix(background): remove dead watcher entry on goroutine exit by @Ebraam-Ashraf in https://github.com/kyverno/kyverno/pull/16130
  • * fix(generate): support NamespacedGeneratingPolicy end-to-end by @realshuting in https://github.com/kyverno/kyverno/pull/16338
  • * fix(background): scan NamespacedImageValidatingPolicy resources too by @Proximyst in https://github.com/kyverno/kyverno/pull/16301
  • * fix: validate stdin across apply paths by @karthikmanam in https://github.com/kyverno/kyverno/pull/16347
  • * fix CEL autogen namespace replacement by @dag-andersen in https://github.com/kyverno/kyverno/pull/16039
  • * fix(gpol): support mixed-type aggregate literals in CEL variables by @realshuting in https://github.com/kyverno/kyverno/pull/16339
  • * fix: preserve cluster-scoped generated resources by @Suhani95 in https://github.com/kyverno/kyverno/pull/16362
  • * fix(api): use allPath instead of anyPath in m.All validation loop by @Utkal059 in https://github.com/kyverno/kyverno/pull/16296
  • * fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes #16256 by @pyd-07 in https://github.com/kyverno/kyverno/pull/16258
  • * fix: add sorting for ivpol targets by @1vanden in https://github.com/kyverno/kyverno/pull/16252
  • * fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by @InsomniaCoder in https://github.com/kyverno/kyverno/pull/15865
  • * fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by @sandert-k8s in https://github.com/kyverno/kyverno/pull/16255
  • * fix(reports): correct label prefix for mpol/dpol policies by @atharrva01 in https://github.com/kyverno/kyverno/pull/16452
  • * fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by @hugolevino in https://github.com/kyverno/kyverno/pull/16298
  • * fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16287
  • * fix: resolve context leak in dynamic resource watcher by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16087
  • * fix: skip reports RBAC check when background scanning is disabled by @p-fruck in https://github.com/kyverno/kyverno/pull/16490
  • * fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by @rootp1 in https://github.com/kyverno/kyverno/pull/16544
  • * fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by @Karthikk-18 in https://github.com/kyverno/kyverno/pull/16525
  • * fix(chart): wire cleanup controller core extra resources by @Suhani95 in https://github.com/kyverno/kyverno/pull/16165
  • * fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by @rx18-eng in https://github.com/kyverno/kyverno/pull/16561
  • * fix: avoid mutating policy webhook name collisions by @realshuting in https://github.com/kyverno/kyverno/pull/16578
  • * fix(helm): handle null image tags in _image.tpl and fix reports-server defaultTag by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16063
  • * fix: key generate test clone sources by policy by @Suhani95 in https://github.com/kyverno/kyverno/pull/16450
  • * fix: handle whitespace in mpol autogen Object constructor by @santhil-cyber in https://github.com/kyverno/kyverno/pull/16292
  • * fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by @pyd-07 in https://github.com/kyverno/kyverno/pull/16588
  • * fix(mpol): handle DELETE target expression using oldObject by @realshuting in https://github.com/kyverno/kyverno/pull/16610
  • * fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by @rx18-eng in https://github.com/kyverno/kyverno/pull/16611
  • * fix: CustomNamespaceLister.List honors the label selector by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16628
  • * fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by @rx18-eng in https://github.com/kyverno/kyverno/pull/16509
  • * fix(webhook): scope namespaced policies to their own namespace by @rx18-eng in https://github.com/kyverno/kyverno/pull/16615
  • * fix(ivpol): add debug logging for CEL image verification functions by @amarkdotdev in https://github.com/kyverno/kyverno/pull/16305
  • * fix: enforce MutatingPolicy evaluation mode semantics by @realshuting in https://github.com/kyverno/kyverno/pull/16686
  • * fix: validate MAP-incompatible MutatingPolicy match conditions by @realshuting in https://github.com/kyverno/kyverno/pull/16698
  • * fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by @rx18-eng in https://github.com/kyverno/kyverno/pull/16594
  • * fix(generate): reject stale trigger UIDs when live resource does not match by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16603
  • * fix: strip cross-namespace ownerReferences in CEL-based generation by @realshuting in https://github.com/kyverno/kyverno/pull/16716
  • * Fix DeletingPolicy objectSelector test results by @Prachidg in https://github.com/kyverno/kyverno/pull/16431
  • * fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by @realshuting in https://github.com/kyverno/kyverno/pull/16727
  • * fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16663
  • * fix(verification): use sigstore-go TUF client and fallback to trusted_root.json by @rseleven in https://github.com/kyverno/kyverno/pull/16591
  • * fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by @rx18-eng in https://github.com/kyverno/kyverno/pull/16731
  • * fix: preserve namespaceSelector during policy autogen by @pyd-07 in https://github.com/kyverno/kyverno/pull/16476
  • * fix: align policy metrics for new policy formats by @aditip149209 in https://github.com/kyverno/kyverno/pull/16359
  • * fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by @rx18-eng in https://github.com/kyverno/kyverno/pull/16434
  • * fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by @realshuting in https://github.com/kyverno/kyverno/pull/16739
  • * fix(helm): use request.namespace for vpolExclude matchConditions by @swastikCommits in https://github.com/kyverno/kyverno/pull/16751
  • * fix: resolve namespaceObject with live API fallback on informer cache miss by @realshuting in https://github.com/kyverno/kyverno/pull/16784
  • * fix(cli): evaluate mutateExisting mutating policies on admission in test by @rx18-eng in https://github.com/kyverno/kyverno/pull/16618
  • * fix: honor full-exemption PolicyException when multiple exceptions match by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16060
  • * fix(engine): honor per-rule failureAction in the admission block deci… by @rx18-eng in https://github.com/kyverno/kyverno/pull/16558
  • * fix(helm): disable in-process cert controller when cert-manager delegation is enabled by @realshuting in https://github.com/kyverno/kyverno/pull/16804
  • * Fix image verification parity gaps by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16800
  • * fix: IVPOL mutateDigest unimplemented stub by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16815
  • * fix: enforce verifyDigest in ImageValidatingPolicy evaluator by @pyd-07 in https://github.com/kyverno/kyverno/pull/16817
  • * fix: sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching trigger by @realshuting in https://github.com/kyverno/kyverno/pull/16838
  • * fix: prevent autogen from rewriting namespaceObject in mpol by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15947
  • * fix: evaluate resource filters from background scanning jobs by @sagarkhandagre998 in https://github.com/kyverno/kyverno/pull/16469
  • * fix(dclient): use RESTMapper for GVK to GVR mapping by @FirePheonix in https://github.com/kyverno/kyverno/pull/16905
  • * Fix context propagation in MatchPolicyContext by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/16910
  • * fix: IVPOL required has no effect (Cherry-pick #16853) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/16987
  • * fix(policy): preserve validation warnings for generate rules in validateAction (Cherry-pick #16821) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17012
  • * Fix goroutine and ticker leak in metrics initialization (Cherry-pick #17024) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17025
  • * Fix ticker leak in policyController background reconciliation loop (Cherry-pick #17027) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17030
  • * Fix context leak in TTL controller reconcile loop (Cherry-pick #17032) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17034
  • * Fix resource leak in sigstore fetchReferrers loop (Cherry-pick #17039) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17042
  • * fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pick #17020) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17048
  • * fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pick #17061) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17064
  • * fix(webhook): do not offload namespaceObject match conditions to the API server (Cherry-pick #17069) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17072
  • * Fix ignored context in notary registry resolution (Cherry-pick #17078) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17079
  • * fix(webhooks): handle nil RequestKind and RequestResource in trace middleware (Cherry-pick #17087) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17091
  • * fix(imageverify): repopulate intoto payload on attestation cache hit (#17117) by @realshuting in https://github.com/kyverno/kyverno/pull/17195

value changes (36)

  • * chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15917
  • * chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15954
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15961
  • * fix(engine/vpol): include CEL validation expression index in policy report properties by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/15916
  • * feat: honor expired CEL PolicyExceptions by @realshuting in https://github.com/kyverno/kyverno/pull/16299
  • * fix(deps): upgrade ristretto to v2 by @chimanjain in https://github.com/kyverno/kyverno/pull/16360
  • * fix(deps): bump rekor and in-toto-golang for codeql alerts by @realshuting in https://github.com/kyverno/kyverno/pull/16394
  • * chore: update pond dependency to v2 by @chimanjain in https://github.com/kyverno/kyverno/pull/16379
  • * Update backoff v7 by @khiemdoan in https://github.com/kyverno/kyverno/pull/16405
  • * Don't initialize rekor client for key or certificate based scenarios by @aerosouund in https://github.com/kyverno/kyverno/pull/16415
  • * chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16516
  • * chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16515
  • * chore(deps): bump the otel group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16539
  • * chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16575
  • * fix: add missing reportProperties to v2beta1 Rule by @zyzzmohit in https://github.com/kyverno/kyverno/pull/15564
  • * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16576
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16599
  • * chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16600
  • * chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16620
  • * chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16669
  • * feat: reuse image verification cache for ImageValidatingPolicy by @bhuvan-somisetty in https://github.com/kyverno/kyverno/pull/16694
  • * chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16679
  • * chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16680
  • * chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16697
  • * chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16770
  • * chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16767
  • * chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16737
  • * chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16738
  • * Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by @kubeagon in https://github.com/kyverno/kyverno/pull/15873
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.47 to 0.2.48 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16802
  • * chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16818
  • * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16837
  • * chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16836
  • * chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16834
  • * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16835
  • * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16912

additions (23)

  • * Feat/cli apply cross resource by @SargamPuram in https://github.com/kyverno/kyverno/pull/15846
  • * fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16034
  • * Fix/cli multiple json payloads by @SargamPuram in https://github.com/kyverno/kyverno/pull/15584
  • * feat(cli): add offline mock support for http mock request/response for GET method and global context entries by @SargamPuram in https://github.com/kyverno/kyverno/pull/15948
  • * feat: add updaterequest total gauge metric by @realshuting in https://github.com/kyverno/kyverno/pull/16115
  • * feat(helm): support extraArgs in CRDs migration job by @Suhani95 in https://github.com/kyverno/kyverno/pull/16132
  • * feat(helm): add optional PrometheusRule template by @realshuting in https://github.com/kyverno/kyverno/pull/16155
  • * feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16123
  • * fix: add access to clusterroles and bindings in the standard kyverno config by @aerosouund in https://github.com/kyverno/kyverno/pull/16219
  • * feat: Enable Cosign verbosity debugging by @naseyro in https://github.com/kyverno/kyverno/pull/16207
  • * feat(cli): support multiple CRD paths and hook CRD processor into test command by @asiyani in https://github.com/kyverno/kyverno/pull/15824
  • * feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16297
  • * feat: support skipBackgroundRequests for CEL mpol/gpol by @realshuting in https://github.com/kyverno/kyverno/pull/16369
  • * feat(gpol): support useServerSideApply for GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16403
  • * feat(gpol): add auditAnnotations support to GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16505
  • * fix: add policies.kyverno.io resources to aggregate policy roles by @volantebjb in https://github.com/kyverno/kyverno/pull/16239
  • * feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by @realshuting in https://github.com/kyverno/kyverno/pull/16699
  • * feat(cel): add regex.replace extension function by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/16438
  • * feat(mpol): add auditAnnotations support to MutatingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16721
  • * [Feature] add optional cache bounds via --maxGlobalContextEntries by @IceCodeBear in https://github.com/kyverno/kyverno/pull/16560
  • * feat(helm): expose maxGlobalContextEntries in the Kyverno chart by @IceCodeBear in https://github.com/kyverno/kyverno/pull/16749
  • * feat(cli): support admission operation simulation for policy testing by @realshuting in https://github.com/kyverno/kyverno/pull/16787
  • * feat(helm): add configurable lifecycle hooks to all controllers (Cherry-pick #16444) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17011

constraints (9)

  • * update blocklist to allow in-cluster HTTP calls by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15973
  • * fix(cli): allow multiple CRDs in to be in the --crd-path file by @the-technat in https://github.com/kyverno/kyverno/pull/16161
  • * fix: support cel exception in cli apply 'exceptions-within-resources' by @bakito in https://github.com/kyverno/kyverno/pull/16178
  • * feat(pss-helm): add image to allowed volumetypes by @yehlo in https://github.com/kyverno/kyverno/pull/15906
  • * feat: support MutatingPolicy target conditions and subresource targets by @realshuting in https://github.com/kyverno/kyverno/pull/16614
  • * fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16666
  • * feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by @realshuting in https://github.com/kyverno/kyverno/pull/16703
  • * fix: validate DeletingPolicy cron schedule at admission by @Jayashanker-Padishala in https://github.com/kyverno/kyverno/pull/16728
  • * fix: allow pod-level seccomp in restrict-seccomp-strict vpol by @Suhani95 in https://github.com/kyverno/kyverno/pull/16249

renames (1)

  • * Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by @chimanjain in https://github.com/kyverno/kyverno/pull/16511
Add Kyverno to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Kyverno releases →