RATATOSKRATATOSK
ログイン

Kyverno

v1.17.0Security
2026年2月2日

ACTION 1CHECK 3OTHER 142

v1.17.0では、ポリシーの適用条件や報告設定の扱いが変わり、セキュリティ修正も含まれます。`kubectl`イメージを使うデプロイメントでは、イメージ更新の影響を確認する必要があります。

要対応 (1)

  • securityセキュリティ脆弱性の修正

    セキュリティ脆弱性を修正します。

影響確認 (3)

  • securitykubectlイメージの更新

    デプロイメントでkubectlイメージを使用している場合に適用されます。

    kubectlイメージを更新し、CVEsを修正します。

  • breakingnamespaced CEL policy typesのリソースアクセス制限

    namespaced CEL policy typesでリソースアクセスを利用している場合に適用されます。

    namespaced CEL policy typesでのリソースアクセスを制限します。

  • breakingVAP/MAP reportingのオプトイン化

    VAP/MAP reportingを利用している場合に適用されます。

    VAP/MAP reportingは、明示的に有効化するオプトイン方式に変わります。

その他の記録済み変更 142 件すべてvalue changes 57 · fixes 46 · additions 25 · constraints 11 · renames 2 · defaults 1

value changes (57)

  • bump fluxcd/flux2 from … to …×3
  • bump github.com/cyphar/filepath-securejoin from … to …×2
  • bump sigs.k8s.io/controller-runtime from 0.22.0 to 0.22.4
  • bump github.com/aptible/supercronic from … to …×3
  • bump nivpol to v1beta1
  • bump sigs.k8s.io/kustomize/api from 0.20.1 to 0.21.0
  • bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login from 0.10.1 to 0.11.0
  • bump golang.org/x/sync from … to …×2
  • bump golang.org/x/crypto from … to …×3
  • bump the otel group across 1 directory with 10 updates×2
  • bump the kubernetes group across 3 directories with 7 updates×2
  • bump google.golang.org/grpc from … to …×2
  • bump github.com/sigstore/rekor from 1.3.10 to 1.4.3
  • bump github.com/go-git/go-git/v5 from 5.16.3 to 5.16.4
  • bump github.com/google/go-containerregistry from 0.20.6 to 0.20.7
  • bump github.com/google/gnostic-models from 0.7.0 to 0.7.1
  • bump the sigstore group across 1 directory with 4 updates×3
  • bump ngpol to v1beta1
  • bump github.com/spf13/cobra from 1.10.1 to 1.10.2
  • bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0
  • make vapgen output predictable
  • bump google.golang.org/protobuf from 1.36.10 to 1.36.11
  • use DynamicInformer for optimal memory and performance
  • Policies api version bump
  • bump actions/download-artifact from 6.0.0 to 7.0.0
  • bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3
  • skip mutateExisting during admission to prevent trigger mutation
  • skip nil and invalid policies to prevent panics
  • update autogen url in validation error message
  • prevent audit cancellation by HTTP request context
  • update reports-server dependency version
  • bump kube to 1.35
  • added nodeselector for linux to install.yaml generation
  • add execution stats to rule response for generate rules
  • chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.3 to 3.0.4
  • chore(deps): bump sigs.k8s.io/release-utils from 0.12.2 to 0.12.3
  • chore(deps): bump sigs.k8s.io/controller-runtime from … to …×2
  • chore(deps): bump github.com/kyverno/api from 0.0.0-20260107110632-1c7ada92d084 to 0.0.1-alpha.1
  • chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
  • chore(deps): bump github.com/theupdateframework/go-tuf/v2 from … to …×2
  • chore(deps): bump github.com/in-toto/in-toto-golang from 0.9.1-0.20240317085821-8e2966059a09 to 0.10.0
  • chore(deps): bump github.com/aptible/supercronic from 0.2.41 to 0.2.42

fixes (46)

  • fix metadata path translation
  • allow bind role to the background controller default
  • fix nil namespace initialization for cluster wide param resources
  • fix: dont register the http request type
  • fix: handle namespace match with namespaceSelector
  • fix(admissionpolicy): handle nil MatchConstraints
  • fix: use namespaceObject in deletingpolicies
  • fix: use context in deletingpolicies in the CLI
  • fix(controllers): duplicate error accumulation
  • avoid cleanup on non-matching ns
  • fix: implement the fake image metadata for the CLI
  • add webhook compatibility and admission controller to work with NamespacedGeneratingPolicy
  • revert accidentally introduced breaking change for the kyverno_policy_results metric
  • Fix namespaced watcher
  • ensure GVK infos are set when metrics are recorded
  • execute missing controller metric
  • fix: continue deletion on resource not found error
  • color issue for --remove-color flag
  • read kind label value from AdmissionRequest
  • improve error message for ClusterPolicy with namespace
  • add a pre-flight check for listing CRDs in cleanup controller
  • fix: ensure deep copy of context to prevent corruption in multi-rule
  • Fix: WarmUp only caching first policy due to early returns
  • fix: chain mutations correctly across multiple policies in CEL mutati
  • fix: prevent nil pointer panic in cleanup controller
  • fix: add missing lock in GetDownstreams to prevent data race
  • fix: add nil check in UpdateResourceHash to prevent panic
  • fix: prevent nil pointer dereference of EmitWarning in fine-grained webhook
  • Fix generate() returning nil error on failure
  • Fix: Prevent generate controller panic when policy is deleted with pending UpdateRequests
  • fix: use DeepCopy in WatchManager to prevent cache mutation
  • fix: correct ivpol slice append in scanner
  • fix: use correct resource name in metadata cache update
  • fix: propagate context in background checks and generate
  • fix: prevent nil policy panic in updaterequest event generation
  • fix: handle AddEventHandler errors in policy controller
  • fix: add missing break in namespace selector override matching
  • fix: add bounds check for Rules slice in CEL generate controller audit
  • respect the allowedResults flag in the mutate and generate engines
  • fix: new api types backward compatibility
  • fix: add missing resource migration in helm chart
  • fix import path to fix loading of policies.kyverno.io/v1 resources
  • fix(admissionpolicygenerator): callback parameter
  • fix: return error response when PolicyException lookup fails
  • fix: use leader election context to prevent split-brain on leadership
  • fix: Explicitly set empty namespaces for clusterScope FlowSchemas

additions (25)

  • Add NamespacedImageValidatingPolicy
  • generate and copy crd to cli for namespaced validating policy and namespaced deleting policy
  • feat: in-cluster concurrent resource loader
  • Add NamespacedMutatingPolicy
  • add NamespacedGeneratingPolicy to v1alpha1
  • create a custom execution cel env
  • Add kyverno.io/v2 GlobalContextEntry API
  • Create hash CEL lib
  • create CEL math lib containing the round function
  • Add CEL Json library
  • add kubernetes semantic versioning library to default env options
  • create cel random library
  • create CEL x509 decode function
  • Add --tlsKeyAlgorithm
  • added a CEL-Yaml library
  • add reports-server integration support
  • Add time library that contains time.now()
  • add time truncate cel function
  • Exclude result types
  • feat: support variable lookup for cpol
  • feat: add automatic GOMEMLIMIT configuration
  • Add CEL-based ValidatingPolicy support for Pod Security Standards
  • fix: add Deduplicate rules in webhook configurations
  • access time library functions with time.x notation
  • check reports server connectivity with a custom image to avoid using the kubectl image

constraints (11)

  • controller to work with NamespacedImageValidatingPolicy
  • supporting wildcards in resource namespace matching
  • Implement failureActionOverrides namespaceSelector
  • support nmpol for update requests
  • extend CLI policy and exception load
  • Support other key algorithms than RSA
  • Policy exception json support
  • Support cert-manager certificates in the helm chart
  • feat: Add cosign v3 support to IVPOL
  • add time to cron filter
  • feat: add Kubernetes v1.30-v1.32 support to Pod Security Standard

renames (2)

  • Transform CEL lib (replaces the object_from_lists JMESPath functionality)
  • use lowercase function names for yaml and json parse

defaults (1)

  • use v1beta1.PolicyException as new default version
Kyvernoをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Kyvernoのリリース一覧 →