Releases

Kyverno v1.18.2 is a patch release fixing a HIGH security issue (GHSA-79gf-7frw-68m9) where generator policies could bypass namespace boundaries, plus backported security dependency updates, watcher restart fixes, and several CLI and policy improvements.

• securityPatch namespace boundary bypass in generator policies

  Generator policies could bypass namespace boundaries when applying rules, allowing cross-namespace policy enforcement. Upgrade to v1.18.2 to restore proper isolation.

• securityApply security dependency updates

  Security dependency updates have been backported to address known vulnerabilities in transitive dependencies.

SPIRE v1.15.2 is a mixed release addressing security concerns through docker/docker to moby/moby migration (resolving CVEs) and a HIGH-severity delegated identity API restriction preventing JWT-SVID exposure for admin or downstream entries. The release also introduces the SPIFFE Broker, per-caller rate limiting, TLS metrics endpoint support, and numerous performance and compatibility improvements across multiple attestors and plugins.

• securityResolve docker/docker CVEs via moby/moby migration

  docker/docker dependencies have been migrated to moby/moby equivalents to resolve Docker/Moby CVEs. Upgrade to v1.15.2.

• breakingDelegated API no longer serves JWT-SVIDs for admin/downstream entries

  The delegated identity API no longer serves JWT-SVIDs for admin or downstream entries. If you use the delegated identity API with admin or downstream entries, verify that clients no longer depend on JWT-SVID tokens from those entry types.

cert-manager v1.21.0 is a mixed release: it ships a security-hardening RBAC restriction (GHSA-8rvj-mm4h-c258) plus two other breaking Helm/RBAC changes, alongside new ARI, Vault AWS-IAM, and Gateway API capabilities and several bug fixes. Operators should review Helm values and RBAC assumptions before upgrading.

• securityReview cert-manager-edit permissions after Challenge/Order create rights removed

  cert-manager-edit no longer grants create on Challenge resources or create/patch/update on Order resources, closing a path where a user with edit access could tamper with ACME validation flow. Fixed upstream in v1.20.3 and carried into v1.21.0; upgrade if your tooling or users create Challenge/Order resources directly, since those workflows will need the cert-manager-approve or a custom role instead.

• breakingDefault tokenrequest RBAC for the controller ServiceAccount removed

  The Helm chart no longer creates the default Role/RoleBinding granting serviceaccounts/token: create to the controller's own ServiceAccount. This only affects clusters relying on the undocumented pattern of serviceAccountRef.name pointing at the controller's ServiceAccount; those setups need an explicit RBAC grant added post-upgrade.

• breakingRemove deprecated Prometheus Helm values before upgrading

  prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path are gone from the Helm values schema (the ServiceMonitor port was also renamed from tcp-prometheus-servicemonitor to http-metrics). Any values override still setting these keys will fail Helm's schema validation on upgrade; scrub them from your values files first.

OPA v1.18.2 is a routine patch that restores the original newline-preservation behavior in `opa fmt`. Policies that were already correctly formatted will no longer be rewritten when the formatter runs.