RATATOSKRATATOSK
ログイン

Kyverno

v1.19.0Security
2026年8月20日

ACTION 7CHECK 6PLAN 1OTHER 160

CLI、Helm、ポリシー機能の追加に加え、修正、依存関係の更新、非推奨化、削除、制約の変更を含む、運用者向けの大きな更新です。アップグレード前に環境への影響を確認する必要が生じる場合があります。`cel-go` を含む複数のセキュリティ修正も含まれますが、有効なセキュリティアドバイザリ識別子は示されていません。

要対応 (7)

  • securityhigh中間証明書の制限

    中間証明書を制限し、CVE-2026-32280 の影響を緩和します。

    kyverno#15858

  • securityhighGoツールチェーンの更新

    go toolchain を 1.26.3 に更新し、CVE-2026-39836 に対応しました。

    kyverno#16361

  • securityCRDとドキュメントの再生成

    APIの更新に伴い、CRDとドキュメントを再生成しました。対象となる更新には GHSA-79gf-7frw-68m9 が含まれます。

    kyverno#16241

  • security暗号関連依存関係の更新

    golang.org/x/crypto を v0.53.0 に、x/net を v0.56.0 に更新し、セキュリティCVEに対応しました。

    kyverno#16340

  • securityORASとsigstoreのCodeQL脆弱性修正

    ORAS と sigstore に関する CodeQL の脆弱性を修正しました。

    kyverno#16426

  • securityCodeQL脆弱性の修正

    未対応だった CodeQL のセキュリティ脆弱性を修正しました。

    kyverno#16528

  • securitycel-goの更新

    cel-go を v0.30.0 に更新し、CVE-2026-GHSA-gcjh-h69q-9w9g に対応しました。

    kyverno#16782

影響確認 (6)

  • breakingmigrate コマンドでの--resource必須化

    migrate コマンドを実行する場合に適用されます。

    migrate コマンドで --resource の指定が必須になりました。

    kyverno#16471

  • breakingバックグラウンドスキャンのユーザー情報デフォルト値

    バックグラウンドスキャンを実行する場合に適用されます。

    バックグラウンドスキャン中の userInfo のグループ情報と uid のデフォルト値を設定します。

    kyverno#16592

  • breakingFail webhookのブートストラップリソース除外

    Fail webhookを設定する場合に適用されます。

    Fail webhookで excludeBootstrapResources を設定できるようになり、Node と CSR をスキップできます。

    kyverno#16397

  • breakingAPIのkyverno-jsonサポート削除

    APIで kyverno-json のサポートを使用する場合に適用されます。

    APIから kyverno-json のサポートを削除しました。

    kyverno#16792

  • breakingJSONスキャンコマンドの削除

    JSONスキャンコマンドを使用する場合に適用されます。

    json scan コマンドを削除しました。

    kyverno#16973

  • breakingrequest.operation 条件値の型制限

    request.operation 条件を設定する場合に適用されます。

    request.operation 条件で文字列以外の値を受け付けなくなりました。

    kyverno#17013

事前準備 (1)

  • deprecated従来のkyverno.ioポリシータイプの非推奨化

    従来の kyverno.io ポリシータイプを使用する場合に適用されます。

    従来の kyverno.io ポリシータイプが非推奨であることを、警告、Helm通知、PSSのデフォルト設定で示します。

    kyverno#16868

その他の記録済み変更 160 件すべてfixes 91 · value changes 36 · additions 23 · constraints 9 · renames 1

fixes (91)

  • * fix(jmespath): prevent panic in label_match on nested structures by @pulkitvats2007-crypto in https://github.com/kyverno/kyverno/pull/15827
  • * fix: retry on conflict when updating policy status by @williamclot in https://github.com/kyverno/kyverno/pull/15754
  • * fix: restart dynamic watchers in background reporting on 410 by @aerosouund in https://github.com/kyverno/kyverno/pull/16028
  • * fix: support cluster-scoped resource generation in GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16018
  • * fix: pass AdmissionRequest to updaterequests for mutate existing policy by @realshuting in https://github.com/kyverno/kyverno/pull/16050
  • * fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by @SargamPuram in https://github.com/kyverno/kyverno/pull/15784
  • * fix: validate name field in globalReference context entry by @atharrva01 in https://github.com/kyverno/kyverno/pull/16003
  • * fix(gctx): correctly track per-loader load state to avoid skipping LoadData by @liuxu623 in https://github.com/kyverno/kyverno/pull/16099
  • * fix: skip report creation for subresources with empty name/UID by @realshuting in https://github.com/kyverno/kyverno/pull/16114
  • * fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/16167
  • * fix(dpol): apply namespaceSelector against Namespace resource own labels by @realshuting in https://github.com/kyverno/kyverno/pull/16200
  • * fix: do not abort required validation on non-matching images by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16208
  • * return correct results for NotEquals type mismatch cases by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16276
  • * fix: wire gpolEngine and gpolProvider into policyController by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/16171
  • * fix: nil pointer panic in getGpolTriggers on ListResource error by @senutpal in https://github.com/kyverno/kyverno/pull/16245
  • * Fix UR regression by @avoidik in https://github.com/kyverno/kyverno/pull/16280
  • * Fix context and SyncWatchers race conditions in GeneratingPolicy by @Aneesh-Hegde in https://github.com/kyverno/kyverno/pull/16041
  • * fix(generate): batch UpdateRequests to avoid etcd size limit by @vmsilvamolina in https://github.com/kyverno/kyverno/pull/15872
  • * fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by @realshuting in https://github.com/kyverno/kyverno/pull/16329
  • * fix(background): remove dead watcher entry on goroutine exit by @Ebraam-Ashraf in https://github.com/kyverno/kyverno/pull/16130
  • * fix(generate): support NamespacedGeneratingPolicy end-to-end by @realshuting in https://github.com/kyverno/kyverno/pull/16338
  • * fix(background): scan NamespacedImageValidatingPolicy resources too by @Proximyst in https://github.com/kyverno/kyverno/pull/16301
  • * fix: validate stdin across apply paths by @karthikmanam in https://github.com/kyverno/kyverno/pull/16347
  • * fix CEL autogen namespace replacement by @dag-andersen in https://github.com/kyverno/kyverno/pull/16039
  • * fix(gpol): support mixed-type aggregate literals in CEL variables by @realshuting in https://github.com/kyverno/kyverno/pull/16339
  • * fix: preserve cluster-scoped generated resources by @Suhani95 in https://github.com/kyverno/kyverno/pull/16362
  • * fix(api): use allPath instead of anyPath in m.All validation loop by @Utkal059 in https://github.com/kyverno/kyverno/pull/16296
  • * fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes #16256 by @pyd-07 in https://github.com/kyverno/kyverno/pull/16258
  • * fix: add sorting for ivpol targets by @1vanden in https://github.com/kyverno/kyverno/pull/16252
  • * fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by @InsomniaCoder in https://github.com/kyverno/kyverno/pull/15865
  • * fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by @sandert-k8s in https://github.com/kyverno/kyverno/pull/16255
  • * fix(reports): correct label prefix for mpol/dpol policies by @atharrva01 in https://github.com/kyverno/kyverno/pull/16452
  • * fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by @hugolevino in https://github.com/kyverno/kyverno/pull/16298
  • * fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16287
  • * fix: resolve context leak in dynamic resource watcher by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16087
  • * fix: skip reports RBAC check when background scanning is disabled by @p-fruck in https://github.com/kyverno/kyverno/pull/16490
  • * fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by @rootp1 in https://github.com/kyverno/kyverno/pull/16544
  • * fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by @Karthikk-18 in https://github.com/kyverno/kyverno/pull/16525
  • * fix(chart): wire cleanup controller core extra resources by @Suhani95 in https://github.com/kyverno/kyverno/pull/16165
  • * fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by @rx18-eng in https://github.com/kyverno/kyverno/pull/16561
  • * fix: avoid mutating policy webhook name collisions by @realshuting in https://github.com/kyverno/kyverno/pull/16578
  • * fix(helm): handle null image tags in _image.tpl and fix reports-server defaultTag by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16063
  • * fix: key generate test clone sources by policy by @Suhani95 in https://github.com/kyverno/kyverno/pull/16450
  • * fix: handle whitespace in mpol autogen Object constructor by @santhil-cyber in https://github.com/kyverno/kyverno/pull/16292
  • * fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by @pyd-07 in https://github.com/kyverno/kyverno/pull/16588
  • * fix(mpol): handle DELETE target expression using oldObject by @realshuting in https://github.com/kyverno/kyverno/pull/16610
  • * fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by @rx18-eng in https://github.com/kyverno/kyverno/pull/16611
  • * fix: CustomNamespaceLister.List honors the label selector by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16628
  • * fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by @rx18-eng in https://github.com/kyverno/kyverno/pull/16509
  • * fix(webhook): scope namespaced policies to their own namespace by @rx18-eng in https://github.com/kyverno/kyverno/pull/16615
  • * fix(ivpol): add debug logging for CEL image verification functions by @amarkdotdev in https://github.com/kyverno/kyverno/pull/16305
  • * fix: enforce MutatingPolicy evaluation mode semantics by @realshuting in https://github.com/kyverno/kyverno/pull/16686
  • * fix: validate MAP-incompatible MutatingPolicy match conditions by @realshuting in https://github.com/kyverno/kyverno/pull/16698
  • * fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by @rx18-eng in https://github.com/kyverno/kyverno/pull/16594
  • * fix(generate): reject stale trigger UIDs when live resource does not match by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16603
  • * fix: strip cross-namespace ownerReferences in CEL-based generation by @realshuting in https://github.com/kyverno/kyverno/pull/16716
  • * Fix DeletingPolicy objectSelector test results by @Prachidg in https://github.com/kyverno/kyverno/pull/16431
  • * fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by @realshuting in https://github.com/kyverno/kyverno/pull/16727
  • * fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16663
  • * fix(verification): use sigstore-go TUF client and fallback to trusted_root.json by @rseleven in https://github.com/kyverno/kyverno/pull/16591
  • * fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by @rx18-eng in https://github.com/kyverno/kyverno/pull/16731
  • * fix: preserve namespaceSelector during policy autogen by @pyd-07 in https://github.com/kyverno/kyverno/pull/16476
  • * fix: align policy metrics for new policy formats by @aditip149209 in https://github.com/kyverno/kyverno/pull/16359
  • * fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by @rx18-eng in https://github.com/kyverno/kyverno/pull/16434
  • * fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by @realshuting in https://github.com/kyverno/kyverno/pull/16739
  • * fix(helm): use request.namespace for vpolExclude matchConditions by @swastikCommits in https://github.com/kyverno/kyverno/pull/16751
  • * fix: resolve namespaceObject with live API fallback on informer cache miss by @realshuting in https://github.com/kyverno/kyverno/pull/16784
  • * fix(cli): evaluate mutateExisting mutating policies on admission in test by @rx18-eng in https://github.com/kyverno/kyverno/pull/16618
  • * fix: honor full-exemption PolicyException when multiple exceptions match by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16060
  • * fix(engine): honor per-rule failureAction in the admission block deci… by @rx18-eng in https://github.com/kyverno/kyverno/pull/16558
  • * fix(helm): disable in-process cert controller when cert-manager delegation is enabled by @realshuting in https://github.com/kyverno/kyverno/pull/16804
  • * Fix image verification parity gaps by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16800
  • * fix: IVPOL mutateDigest unimplemented stub by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16815
  • * fix: enforce verifyDigest in ImageValidatingPolicy evaluator by @pyd-07 in https://github.com/kyverno/kyverno/pull/16817
  • * fix: sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching trigger by @realshuting in https://github.com/kyverno/kyverno/pull/16838
  • * fix: prevent autogen from rewriting namespaceObject in mpol by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15947
  • * fix: evaluate resource filters from background scanning jobs by @sagarkhandagre998 in https://github.com/kyverno/kyverno/pull/16469
  • * fix(dclient): use RESTMapper for GVK to GVR mapping by @FirePheonix in https://github.com/kyverno/kyverno/pull/16905
  • * Fix context propagation in MatchPolicyContext by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/16910
  • * fix: IVPOL required has no effect (Cherry-pick #16853) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/16987
  • * fix(policy): preserve validation warnings for generate rules in validateAction (Cherry-pick #16821) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17012
  • * Fix goroutine and ticker leak in metrics initialization (Cherry-pick #17024) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17025
  • * Fix ticker leak in policyController background reconciliation loop (Cherry-pick #17027) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17030
  • * Fix context leak in TTL controller reconcile loop (Cherry-pick #17032) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17034
  • * Fix resource leak in sigstore fetchReferrers loop (Cherry-pick #17039) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17042
  • * fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pick #17020) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17048
  • * fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pick #17061) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17064
  • * fix(webhook): do not offload namespaceObject match conditions to the API server (Cherry-pick #17069) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17072
  • * Fix ignored context in notary registry resolution (Cherry-pick #17078) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17079
  • * fix(webhooks): handle nil RequestKind and RequestResource in trace middleware (Cherry-pick #17087) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17091
  • * fix(imageverify): repopulate intoto payload on attestation cache hit (#17117) by @realshuting in https://github.com/kyverno/kyverno/pull/17195

value changes (36)

  • * chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15917
  • * chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15954
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15961
  • * fix(engine/vpol): include CEL validation expression index in policy report properties by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/15916
  • * feat: honor expired CEL PolicyExceptions by @realshuting in https://github.com/kyverno/kyverno/pull/16299
  • * fix(deps): upgrade ristretto to v2 by @chimanjain in https://github.com/kyverno/kyverno/pull/16360
  • * fix(deps): bump rekor and in-toto-golang for codeql alerts by @realshuting in https://github.com/kyverno/kyverno/pull/16394
  • * chore: update pond dependency to v2 by @chimanjain in https://github.com/kyverno/kyverno/pull/16379
  • * Update backoff v7 by @khiemdoan in https://github.com/kyverno/kyverno/pull/16405
  • * Don't initialize rekor client for key or certificate based scenarios by @aerosouund in https://github.com/kyverno/kyverno/pull/16415
  • * chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16516
  • * chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16515
  • * chore(deps): bump the otel group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16539
  • * chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16575
  • * fix: add missing reportProperties to v2beta1 Rule by @zyzzmohit in https://github.com/kyverno/kyverno/pull/15564
  • * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16576
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16599
  • * chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16600
  • * chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16620
  • * chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16669
  • * feat: reuse image verification cache for ImageValidatingPolicy by @bhuvan-somisetty in https://github.com/kyverno/kyverno/pull/16694
  • * chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16679
  • * chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16680
  • * chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16697
  • * chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16770
  • * chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16767
  • * chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16737
  • * chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16738
  • * Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by @kubeagon in https://github.com/kyverno/kyverno/pull/15873
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.47 to 0.2.48 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16802
  • * chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16818
  • * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16837
  • * chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16836
  • * chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16834
  • * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16835
  • * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16912

additions (23)

  • * Feat/cli apply cross resource by @SargamPuram in https://github.com/kyverno/kyverno/pull/15846
  • * fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16034
  • * Fix/cli multiple json payloads by @SargamPuram in https://github.com/kyverno/kyverno/pull/15584
  • * feat(cli): add offline mock support for http mock request/response for GET method and global context entries by @SargamPuram in https://github.com/kyverno/kyverno/pull/15948
  • * feat: add updaterequest total gauge metric by @realshuting in https://github.com/kyverno/kyverno/pull/16115
  • * feat(helm): support extraArgs in CRDs migration job by @Suhani95 in https://github.com/kyverno/kyverno/pull/16132
  • * feat(helm): add optional PrometheusRule template by @realshuting in https://github.com/kyverno/kyverno/pull/16155
  • * feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16123
  • * fix: add access to clusterroles and bindings in the standard kyverno config by @aerosouund in https://github.com/kyverno/kyverno/pull/16219
  • * feat: Enable Cosign verbosity debugging by @naseyro in https://github.com/kyverno/kyverno/pull/16207
  • * feat(cli): support multiple CRD paths and hook CRD processor into test command by @asiyani in https://github.com/kyverno/kyverno/pull/15824
  • * feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16297
  • * feat: support skipBackgroundRequests for CEL mpol/gpol by @realshuting in https://github.com/kyverno/kyverno/pull/16369
  • * feat(gpol): support useServerSideApply for GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16403
  • * feat(gpol): add auditAnnotations support to GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16505
  • * fix: add policies.kyverno.io resources to aggregate policy roles by @volantebjb in https://github.com/kyverno/kyverno/pull/16239
  • * feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by @realshuting in https://github.com/kyverno/kyverno/pull/16699
  • * feat(cel): add regex.replace extension function by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/16438
  • * feat(mpol): add auditAnnotations support to MutatingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16721
  • * [Feature] add optional cache bounds via --maxGlobalContextEntries by @IceCodeBear in https://github.com/kyverno/kyverno/pull/16560
  • * feat(helm): expose maxGlobalContextEntries in the Kyverno chart by @IceCodeBear in https://github.com/kyverno/kyverno/pull/16749
  • * feat(cli): support admission operation simulation for policy testing by @realshuting in https://github.com/kyverno/kyverno/pull/16787
  • * feat(helm): add configurable lifecycle hooks to all controllers (Cherry-pick #16444) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17011

constraints (9)

  • * update blocklist to allow in-cluster HTTP calls by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15973
  • * fix(cli): allow multiple CRDs in to be in the --crd-path file by @the-technat in https://github.com/kyverno/kyverno/pull/16161
  • * fix: support cel exception in cli apply 'exceptions-within-resources' by @bakito in https://github.com/kyverno/kyverno/pull/16178
  • * feat(pss-helm): add image to allowed volumetypes by @yehlo in https://github.com/kyverno/kyverno/pull/15906
  • * feat: support MutatingPolicy target conditions and subresource targets by @realshuting in https://github.com/kyverno/kyverno/pull/16614
  • * fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16666
  • * feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by @realshuting in https://github.com/kyverno/kyverno/pull/16703
  • * fix: validate DeletingPolicy cron schedule at admission by @Jayashanker-Padishala in https://github.com/kyverno/kyverno/pull/16728
  • * fix: allow pod-level seccomp in restrict-seccomp-strict vpol by @Suhani95 in https://github.com/kyverno/kyverno/pull/16249

renames (1)

  • * Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by @chimanjain in https://github.com/kyverno/kyverno/pull/16511
Kyvernoをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Kyvernoのリリース一覧 →