Kyverno

v1.20.0Security

Nov 12, 2026

A substantial feature and maintenance release that adds CEL and OCI capabilities while tightening legacy-policy migration and policy behavior. It also includes broad dependency updates and fixes, with operators most affected by legacy policy execution changes, policy and chart constraints, and updated runtime dependencies.

Action needed (10)

securitycriticalx/net updated for CVE-2026-78663
The x/net dependency is updated to resolve CVE-2026-78663.
kyverno#17997
securityhighoras.land/oras-go/v2 updated for CVE-2026-50163
The release updates oras.land/oras-go/v2 to v2.6.2 to resolve CVE-2026-50163.
kyverno#16945
securityhighx/net updated for CVE-2026-56853
The x/net dependency is updated to fix the HTTP/2 ReadHeaderTimeout evasion described by CVE-2026-56853.
kyverno#17156
securityhighGo 1.26.6 for CVE-2026-56853
The Go version is bumped to 1.26.6 to address CVE-2026-56853 in the standard library.
kyverno#17189
securityhighmiekg/dns updated for CVE-2026-46600
The miekg/dns dependency is updated to fix the DNS parsing panic described by CVE-2026-46600.
kyverno#17215
securityhighGo 1.27.2 for CVE-2026-97031
The Go version is bumped to 1.27.2 to resolve CVE-2026-97031.
kyverno#17971
securityhighgolang.org/x/net updated for CVE-2026-78669
The golang.org/x/net dependency is bumped to resolve CVE-2026-78669.
kyverno#17968
securitymediumGo 1.27.3 for CVE-2026-111943
The Go toolchain is bumped to 1.27.3 to protect against CVE-2026-111943.
securityDependency CVE updates for oras-go, x/mod, and the Go toolchain
Dependency updates patch CVEs in oras-go, x/mod, and the Go toolchain.
kyverno#17160
securityrekor dependency replacement for GO-2026-5932
The rekor dependency is replaced to address GO-2026-5932.
kyverno#17269

Check if affected (17)

securityapiCall.service egress blocklist validation
Applies if you configure apiCall.service.
The IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress is closed.
kyverno#17310
breakingStricter request.operation condition validation
Applies if you configure request.operation.
Validation now rejects non-string values in request.operation conditions.
kyverno#16977
breakingNon-empty matchConstraints for ImageValidatingPolicy
Applies if you configure ImageValidatingPolicy with empty matchConstraints.
Validation rejects ImageValidatingPolicy resources with empty matchConstraints.
kyverno#17162
breakingglobalContext restriction in namespaced policies
Applies if you configure globalContext in namespaced policies.
globalContext is denied in namespaced policies.
kyverno#17377
breakingLegacy policy API writes blocked
Applies if you use legacy policy APIs.
Creates and spec updates of legacy policy APIs are blocked.
kyverno#17535
breakingDefault-on Helm gate for legacy policy CRs
Applies if you enable legacy policy CRs during installation or upgrade.
Helm adds a required default-on gate for legacy policy CRs during installation and upgrade.
kyverno#17534
breakingLegacy policy manifest handling in the CLI
Applies if you run the CLI in apply or test.
The CLI blocks legacy policy manifests in apply and test, with a migration escape hatch.
kyverno#17553
breakingexceptionNamespace enforcement for CEL PolicyExceptions
Applies if you configure exceptionNamespace for CEL PolicyExceptions.
The webhook enforces exceptionNamespace for CEL PolicyExceptions.
kyverno#17479
breakingTyped policy dependencies for legacy policy writes
Applies if you use legacy policy writes without typed policy dependencies.
Legacy policy writes are rejected when typed policy dependencies are absent.
breakingLegacy policy execution in admission binaries, removed
Applies if you use admission binaries.
Legacy policy execution is removed from admission binaries.
breakingLegacy policy execution in the background controller, removed
Applies if you run the background controller.
Legacy policy execution is removed from the background controller.
breakingLegacy policy evaluation in the reports controller, removed
Applies if you run the reports controller.
Legacy policy evaluation is removed from the reports controller.
breakingLegacy CLI execution and policy-authoring branches, removed
Applies if you use legacy CLI execution.
Legacy CLI execution and policy-authoring branches are deleted.
breakingFrozen legacy CRD schemas and shared Kyverno API types
Applies if you configure legacy CRD schemas.
The shared Kyverno API types are prepared and legacy CRD schemas are frozen.
breakingCEL policy minimum version 1.17.0
Applies if you use CEL policies.
The minimum version for CEL policies is updated to 1.17.0.
breakingLegacy kyverno.io policy engine, removed
Applies if you run the legacy kyverno.io policy engine.
The legacy kyverno.io policy engine is deleted.
breakingLegacy kyverno.io Go API, removed
Applies if you depend on the legacy kyverno.io Go API.
The legacy kyverno.io Go API is deleted and clients are regenerated.

Plan ahead (1)

deprecatedjmesPath projections deprecated
Applies if you use jmesPath projections.
jmesPath projections are deprecated, and their use is measured.

All 228 other recorded changesfixes 137 · value changes 60 · additions 28 · constraints 2 · removals 1

fixes (137)

* fix(policy): preserve validation warnings for generate rules in validateAction by @vishalmore90 in https://github.com/kyverno/kyverno/pull/16821
* fix: handle nil input in CopyMap and add unit tests by @KeerthiKumarR in https://github.com/kyverno/kyverno/pull/16979
* fix: IVPOL required has no effect by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16853
* Fix goroutine and ticker leak in metrics initialization by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17024
* Fix ticker leak in policyController background reconciliation loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17027
* Fix context leak in TTL controller reconcile loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17032
* Fix resource leak in sigstore fetchReferrers loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17039
* fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger by @realshuting in https://github.com/kyverno/kyverno/pull/17020
* fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result by @realshuting in https://github.com/kyverno/kyverno/pull/17061
* fix(webhook): do not offload namespaceObject match conditions to the API server by @realshuting in https://github.com/kyverno/kyverno/pull/17069
* Fix ignored context in notary registry resolution by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17078
* fix(webhooks): handle nil RequestKind and RequestResource in trace middleware by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17087
* fix(jmespath): correct function names in validation errors by @Hiten0305l in https://github.com/kyverno/kyverno/pull/17093
* fix(ttl): record deleted objects metric after deletion by @Hiten0305l in https://github.com/kyverno/kyverno/pull/17104
* [Bug] Fix missing OpenTelemetry tracing for APICalls without custom CA bundle by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17116
* Fix: CLI apply command fails to match resources containing hyphens by @vishalmore90 in https://github.com/kyverno/kyverno/pull/17124
* fix(webhooks): record MPOL and NMPOL metrics under WebhookMutating by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16894
* fix(imageverify): repopulate intoto payload on attestation cache hit by @Gagansharma-code in https://github.com/kyverno/kyverno/pull/17117
* fix(cli): pass resolved subresource to CEL policy engine requests by @pujitha24 in https://github.com/kyverno/kyverno/pull/17047
* fix(cli): prevent remote HTTP loaders from hanging indefinitely by @Suhani95 in https://github.com/kyverno/kyverno/pull/16608
* Fix missing autogen webhook expansion for NamespacedValidatingPolicy by @vishalmore90 in https://github.com/kyverno/kyverno/pull/17262
* fix: avoid data race in image evaluator prefetch by @realshuting in https://github.com/kyverno/kyverno/pull/17313
* fix: report all failing images in verifyImages (v1) failure message. by @pyd-07 in https://github.com/kyverno/kyverno/pull/16447
* fix: validate PolicyException CEL match conditions by @thuanlm215 in https://github.com/kyverno/kyverno/pull/17350
* feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17014
* fix(cli): use policy api version in OCI annotations by @karthikmanam in https://github.com/kyverno/kyverno/pull/16570
* fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker by @pujitha24 in https://github.com/kyverno/kyverno/pull/17136
* fix: skip namespace lookup in exception matching when no namespaceSelector is defined by @kmehta-code in https://github.com/kyverno/kyverno/pull/17140
* fix: skip scalar values during wildcard image extraction by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/16268
* Fix/ivpol ephemeral containers by @pmlopes in https://github.com/kyverno/kyverno/pull/17427
* fix(gpol): propagate synchronize option to UpdateRequests by @vflaux in https://github.com/kyverno/kyverno/pull/16920
* fix(reports): discover autogen'd IVPol/NIVPol targets for background scan by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17395
* fix(webhook): avoid redundant recorder notifications by @Udaytaneja in https://github.com/kyverno/kyverno/pull/17059
* fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling by @bhuvan-somisetty in https://github.com/kyverno/kyverno/pull/16904
* fix(cel): read PolicyExceptions from the manager cache, not a second informer by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16993
* fix(webhooks): return after writing StatusInternalServerError in Probe handler by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17288
* fix(reports): fix label prefix and metadata for namespaced CEL policies by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17460
* fix(background): use dynamic restmapper and enable crd watcher by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17482
* fix: close layer readers per-iteration to avoid FD/memory leak by @pgmpofu in https://github.com/kyverno/kyverno/pull/16994
* fix(gpol): recreate downstream resource after repeated deletions by @realshuting in https://github.com/kyverno/kyverno/pull/17453
* fix(breaker): recover the reports counter when its watch dies for good by @nissessenap in https://github.com/kyverno/kyverno/pull/17085
* fix(webhook): avoid image validating policy webhook name collisions by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17558
* fix: reuse compiled ImageValidatingPolicy CEL programs across admissions by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17599
* fix: preserve legacy report sources and webhook API versions in 1.20 by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17554
* fix(deleting): process namespaced resources with pagination by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17263
* fix(cli): resolve match constraints for namespaced validating policies by @harshrajdebug in https://github.com/kyverno/kyverno/pull/17608
* fix: autogen fine-grained namespaced image policies by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/16840
* fix(policy): resolve subresource triggers in mutating policy matchConstraints by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17495
* feat(helm): protect legacy policy CRDs from Helm prune with resource-policy keep by @thisis-manan in https://github.com/kyverno/kyverno/pull/17494
* fix: always re-arm background scan and TTL controllers after transient errors (#16109) by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16288
* fix(cel): set rule name for validate.cel results by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/17353
* fix(event): truncate event notes on a character boundary by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17581
* fix(cel): requeue namespaced policies on PolicyException changes by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17641
* fix: nil pointer dereference in validation engine on UPDATE requests by @AftAb-25 in https://github.com/kyverno/kyverno/pull/17355
* fix(cli): close the junit failure element without detailed results by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17560
* fix(cli): preserve GeneratingPolicy skips in test results by @Om-Beast in https://github.com/kyverno/kyverno/pull/17388
* fix: preserve MutatingPolicy reinvocation policy by @pyd-07 in https://github.com/kyverno/kyverno/pull/17324
* fix(controllers): honor resourceFilters in cleanup and deleting controllers by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17632
* fix(background): resolve generate triggers by name instead of listing the namespace by @kmehta-code in https://github.com/kyverno/kyverno/pull/17702
* Fix panic in metrics policy controller and add comprehensive unit tests by @nishant-devv in https://github.com/kyverno/kyverno/pull/17750
* fix(cli): aggregate test filter errors using errors.Join by @JituRewar in https://github.com/kyverno/kyverno/pull/17760
* fix(cli): flatten kind: List resources in apply and fake dynamic client by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17504
* fix(mpol): evaluate matchConditions during background mutateExisting evaluation by @pujitha24 in https://github.com/kyverno/kyverno/pull/17433
* fix(cli): support all CEL policy exception versions in policy loader (#17743) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17769
* fix: verify annotations properly for cosign v2 and v3 by @aerosouund in https://github.com/kyverno/kyverno/pull/17794
* fix: prevent panic in jmespath random() function on invalid argument type by @Zara-5 in https://github.com/kyverno/kyverno/pull/17773
* fix: preserve Cosign errors in image validation messages by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17606
* fix(chart): add policies.kyverno.io types to the Grafana dashboard by @VijayabaskarR-06 in https://github.com/kyverno/kyverno/pull/17800
* fix: mark admission replicas unready after informer watch failures by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17610
* fix(cli): report excluded DeletingPolicy resources as skipped by @pyd-07 in https://github.com/kyverno/kyverno/pull/17458
* fix(status): heal WebhookConfigured condition once a VAP is generated by @pujitha24 in https://github.com/kyverno/kyverno/pull/17119
* fix: dont treat missing digests when MutateDigest==false as an error by @aerosouund in https://github.com/kyverno/kyverno/pull/17841
* fix: evaluate ImageValidatingPolicies concurrently by @pyd-07 in https://github.com/kyverno/kyverno/pull/17496
* fix(helm): scope scale-to-zero hook to the release by @KKamJi98 in https://github.com/kyverno/kyverno/pull/17840
* fix(charts): stop denying Windows pods and refresh PSA allow-lists by @Suhani95 in https://github.com/kyverno/kyverno/pull/17684
* fix(charts): enforce drop ALL and deny pod-level runAsNonRoot=false in PSS CEL policies by @Suhani95 in https://github.com/kyverno/kyverno/pull/17672
* fix(ivpol): give each policy its own image context during concurrent evaluation by @rx18-eng in https://github.com/kyverno/kyverno/pull/17860
* fix(ivpol): contain panics in per-policy evaluation goroutines by @rx18-eng in https://github.com/kyverno/kyverno/pull/17894
* fix(cli): propagate messageExpression errors to fail cli tests by @nishant-devv in https://github.com/kyverno/kyverno/pull/17863
* fix: apply autogen path rewrite to PolicyException matchConditions (#16956) by @nishant-devv in https://github.com/kyverno/kyverno/pull/17856
* fix(cli): restore test checks with CEL expressions by @afarbos in https://github.com/kyverno/kyverno/pull/17897
* fix(vpol): keep controller metadata paths in autogen'd PolicyExceptions by @ManojLamani in https://github.com/kyverno/kyverno/pull/17903
* fix(ivpol): propagate the admission request context to image verification by @rx18-eng in https://github.com/kyverno/kyverno/pull/17895
* fix(mutate): escape YAML-forbidden characters in patchStrategicMerge by @thebearmayor in https://github.com/kyverno/kyverno/pull/17881
* fix(cli): prevent nil pointer dereference when target has no patched resource by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17843
* fix(ivpol): skip registry fetch when image verification is cached (#17969) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17974
* fix(imageverify): bind verification cache entries to the content and attestors they verified by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17993
* fix(security): CEL API path validation and mpol namespace confinement by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17985
* fix(vap): apply the runtime PolicyException gates in the CEL admission-policy generator by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17986
* fix: preserve controller-owned generation labels by @sagark-nirmata in https://github.com/kyverno/kyverno/pull/17938
* fix(engine): handle multiple cosign attestation versions by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/18010
* fix: honor wildcard excludeResourceRules in generateExisting by @Siddhartha-singh01 in https://github.com/kyverno/kyverno/pull/18026
* fix(cli): use Report kind for namespaced OpenReports output by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/17809
* fix(chart): grant the background controller what Kyverno aggregates i… by @WHOIM1205 in https://github.com/kyverno/kyverno/pull/18019
* fix(generate): fix GeneratingPolicy synchronization for custom resources and multiple triggers by @rx18-eng in https://github.com/kyverno/kyverno/pull/16748
* fix(metrics): cache GetManager() result in registerPolicyChangesMetric by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/17862
* fix(vpol): honour failurePolicy Ignore for runtime errors in the admission handler by @VijayabaskarR-06 in https://github.com/kyverno/kyverno/pull/17909
* fix(imageverify): give the image verify cache a usable byte budget by @rx18-eng in https://github.com/kyverno/kyverno/pull/17911
* fix(imageverify): extract newest attestation for ImageValidatingPolicy by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/18049
* fix(ivpol): report missing annotation keys instead of %!s(<nil>) by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/18060
* fix(webhook): populate image verification policies on fine-grained webhook routes by @nishant-devv in https://github.com/kyverno/kyverno/pull/18045
* fix(autogen): extract pod templates in a stable order by @ManojLamani in https://github.com/kyverno/kyverno/pull/17981
* fix(chart): honor global image registry for webhooks cleanup by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17970
* fix(cel/autogen): preserve object.metadata.name in autogen messageExpression by @nishant-devv in https://github.com/kyverno/kyverno/pull/17899
* fix(cli): count and print each MutatingPolicy result once by @harshrajdebug in https://github.com/kyverno/kyverno/pull/17838
* fix(cli): exclude target-only MutatingPolicies from trigger evaluation by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/17796
* fix(ext/cluster): block non-GET RawAbsPath from reaching the real client by @RudraDudhat2509 in https://github.com/kyverno/kyverno/pull/17791
* fix: propagate anchor errors using errors.As and Unwrap() method by @JituRewar in https://github.com/kyverno/kyverno/pull/17789
* fix(ext/yaml): don't swallow YAML syntax errors in SplitDocuments by @RudraDudhat2509 in https://github.com/kyverno/kyverno/pull/17785
* fix(webhook): guard nil Scope dereference in sortedRules to prevent controller panic by @7se7en72025 in https://github.com/kyverno/kyverno/pull/17457
* fix(config): reset matchConditions and updateRequestThreshold on unload by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17407
* fix(imageverify): reject non-string attestation fields instead of panicking by @omlahore in https://github.com/kyverno/kyverno/pull/17046
fix: avoid nil pointer panic verifying sigstore bundle attestations without a type
single-flight discovery refetches on cache misses
do not panic on a JSON patch value holding object initializers
skip CT log key loading for keyed cosign verification
Fix unchecked type assertion panic in apiCall.transformAndStore
--explain never re-runs expressions with non-deterministic results
drop gone downstreams from the generate watch cache
recover UpdateRequests left with an empty state
register resource CEL library for PolicyExceptions
preserve nanosecond precision in PolicyReport aggregation
honor failure policy ignore
preserve deterministic evaluation response ordering
guard cleanup deletes with object identity preconditions
restore verified referrers on a cache hit
resolve namespaces from live cluster in CEL engines under --cluster
fix data race between OnChanged and notify in discovery client
scope namespaced image policy credentials by namespace
use the workload's namespace for extracted pod templates
leave day-of-week as wildcard in time_to_cron
recover backing informers after transient relist failures
trace for ivpol policies in live admission path
respect predicate filter on JSON payloads in vpol Handle()
evaluate policies when predicate is nil in Evaluate()
dont run resource version migration for the old policy apis
fix: handle missing reports CRDs as no-op in kyverno-init

value changes (60)

* chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.4 to 5.0.6 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16933
* chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.29.1 to 2026.08.03.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16934
* chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16936
* chore(deps): Upgrade robfig/cron to v3 by @chimanjain in https://github.com/kyverno/kyverno/pull/16932
* chore(deps): bump the sigstore group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16935
* chore(deps): bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16937
* chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.03.1 to 2026.08.03.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16957
* chore(deps): bump fluxcd/flux2/action from 2.9.3 to 2.9.4 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17006
* chore(deps): bump the otel group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17007
* chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17009
* chore(deps): bump github.com/sigstore/cosign/v3 from 3.1.2 to 3.1.3 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17008
* chore(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17067
* chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17141
* chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17196
* chore(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.0 to 1.39.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17198
* chore(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17185
* chore(deps): bump github.com/aptible/supercronic from 0.2.48 to 0.2.49 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17197
* fix(helm): bump bundled reports-server dependency to v0.1.7 by @pujitha24 in https://github.com/kyverno/kyverno/pull/17138
* fix(deps): update golang.org/x/net to v0.58.0 by @Sashang-debug in https://github.com/kyverno/kyverno/pull/17242
* fix: apply HTTP blocklist to apiCall.service executor by @IceCodeBear in https://github.com/kyverno/kyverno/pull/17234
* fix: harden apiCall.service egress proxy path and cover CABundle branch by @realshuting in https://github.com/kyverno/kyverno/pull/17299
* chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17293
* chore(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17297
* chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17294
* chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17360
* fix(deps): use upstream rekor v1.5.4 instead of the fork replace by @omlahore in https://github.com/kyverno/kyverno/pull/17332
* chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17415
* chore(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17416
* fix: use Docker CE instead of moby for docker-outside-of-docker feature by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/16596
* chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17468
* chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17500
* chore(deps): bump fluxcd/flux2/action from 2.9.4 to 2.9.5 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17442
* chore(deps): bump sigs.k8s.io/controller-tools from 0.21.0 to 0.22.0 in /hack/controller-gen by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17467
* chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17499
* perf(cel): build the request activation once per admission request by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17572
* perf(cel): hoist the request-map build in the ivpol engine by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17585
* bump go to 1.27 and sigstore to v1.10.10 by @aerosouund in https://github.com/kyverno/kyverno/pull/17776
* chore(deps): bump github.com/sigstore/sigstore from 1.10.10 to 1.11.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17801
* chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17681
* chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17571
* chore(deps): bump the sigstore group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17568
* fix(imageverify): bound the reads image verification makes from a registry by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17995
* fix(wildcard): replace the glob matcher with a bounded two-pointer algorithm by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17990
* fix(cel): bound the cost of CEL policy expression evaluation by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17988
bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2
log watcher events at debug verbosity
bump the sigstore group across 1 directory with 4 updates
propagate request context and memoize image metadata per evaluation
Improve terminal output readability with colors for kyverno jp function
reuse context and compiled CEL policy providers in apply
retain released legacy image extractor filter schema
bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3
bump github.com/cenkalti/backoff/v7 from 7.0.0 to 7.0.1
bump Kubernetes libraries to v0.37 and controller-runtime to v0.25
add semantic color formatting to kyverno apply output
add semantic colors to test summary and progress output
improve ivCache hit rate by dropping policy info from key
mark legacy policies not ready in kyverno-init
mark legacy cleanup policies not ready in kyverno-init
extend provider & compiler caching to GeneratingPolicies and DeletingPolicies

additions (28)

* feat(helm): add configurable lifecycle hooks to all controllers by @mhulscher in https://github.com/kyverno/kyverno/pull/16444
* feat(cli): support JSON and YAML output for version command by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16623
* feat: phase1 deprecation warning plumbing and CLI warning enforcement by @realshuting in https://github.com/kyverno/kyverno/pull/17362
* feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 by @realshuting in https://github.com/kyverno/kyverno/pull/17428
* feat: signal remaining legacy kyverno.io policies on startup and via metrics by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17519
* feat(kyvernopre): warn about orphaned legacy webhook configurations by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17678
* feat(cli): enable OCI-native test and apply flows (#17666) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17689
* feat(cli): implement CEL resources only for kyverno oci (#17661) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17671
* feat: add compensating controls to policy exceptions by @mastersans in https://github.com/kyverno/kyverno/pull/17690
* feat: support additionalExtensions for keyless signing in the ivpol by @aerosouund in https://github.com/kyverno/kyverno/pull/17813
* Vpol wiring for trace feature by @aditip149209 in https://github.com/kyverno/kyverno/pull/17695
* feat(charts): add disallow-host-probes Baseline PSS policy by @Suhani95 in https://github.com/kyverno/kyverno/pull/17716
* ivpol: Add diagnostics to cli for notary verification by @aditip149209 in https://github.com/kyverno/kyverno/pull/17902
* feat: implement UpdateRequest cleanup TTL via configuration by @Mannan-Ali in https://github.com/kyverno/kyverno/pull/17429
* feat(report): classify validating admission policies by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17926
specify and implement the CEL policy bundle OCI format
log decision traces in the admission controller behind --enable…
add automated PSA release monitoring to prevent PSS policy drift
add output-dir and output-file flags to apply
allow configuring generation label protection
select the Pod Security Admission version for policies
add a CEL expression field to projections
measure their use
support explicit enabled toggle for pod controllers
parse the OCI bundle descriptor and derive named sets
support JSON document mutation with MutatingPolicy JSON mode
add kyverno oci validate with CEL-aware bundle validation
add kyverno oci inspect and oci resolve

constraints (2)

* fix(kube): support multi-digit API version strings in ParseKindSelector by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16874
* feat(charts): support Pod user namespaces in PSS policies by @Suhani95 in https://github.com/kyverno/kyverno/pull/17693

removals (1)

* feat: remove json scan command by @eddycharly in https://github.com/kyverno/kyverno/pull/16943

Add Kyverno to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Kyverno releases →