RATATOSKRATATOSK
ログイン

Kyverno

v1.19.1Security
2026年9月10日

ACTION 2CHECK 3OTHER 22

セキュリティ対応を中心とした保守リリースで、依存関係の更新と正確性の修正が含まれます。非推奨機能の扱いが厳格になり、ポリシーの制約変更によって運用者の対応が必要になる場合があります。

要対応 (2)

影響確認 (3)

  • securityPolicyException のスコープ回避の修正

    PolicyException CRDを使用している場合に適用されます。

    IVPol における PolicyException のスコープ回避を修正しました。

    kyverno#17307

  • securityapiCall.service egressのブロックリスト回避対策

    apiCall.service egressを設定している場合に適用されます。

    apiCall.service の egress で、IPv6 に埋め込まれた IPv4 によるブロックリスト回避を防止しました。

    kyverno#17329

  • breaking名前空間付きポリシーにおける globalContext の制約

    名前空間付きポリシーで globalContext を使用している場合に適用されます。

    名前空間付きポリシーでの globalContext の使用を拒否するようになりました。

    kyverno#17455

その他の記録済み変更 22 件すべてfixes 17 · additions 2 · value changes 2 · constraints 1

fixes (17)

  • * Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pick #17262) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17273
  • * fix: apply HTTP blocklist to apiCall.service executor (cherry-pick #17234) by @realshuting in https://github.com/kyverno/kyverno/pull/17298
  • * fix: harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pick #17299) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17302
  • * fix: avoid data race in image evaluator prefetch (Cherry-pick #17313) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17327
  • * fix: backport 7ac176ac apiCall urlPath hardening to release-1.19 by @realshuting in https://github.com/kyverno/kyverno/pull/17361
  • * fix: validate PolicyException CEL match conditions (Cherry-pick #17350) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17373
  • * fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker (Cherry-pick #17136) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17430
  • * fix: handle missing reports CRDs as no-op in kyverno-init (Cherry-pick #17420) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17435
  • * fix: skip namespace lookup in exception matching when no namespaceSelector is defined (Cherry-pick #17140) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17437
  • * fix(gpol): propagate synchronize option to UpdateRequests (Cherry-pick #16920) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17446
  • * fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling (Cherry-pick #16904) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17454
  • * fix(webhook): avoid redundant recorder notifications (Cherry-pick #17059) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17451
  • * fix(reports): fix label prefix and metadata for namespaced CEL policies (Cherry-pick #17460) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17480
  • * fix: close layer readers per-iteration to avoid FD/memory leak (Cherry-pick #16994) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17498
  • * fix(gpol): recreate downstream resource after repeated deletions (Cherry-pick #17453) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17520
  • * fix: skip scalar values during wildcard image extraction (Cherry-pick #16268) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17521
  • * fix(reports): discover autogen'd IVPol/NIVPol targets for background scan (Cherry-pick #17395) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17447

additions (2)

  • * feat: phase1 deprecation warning plumbing and CLI warning enforcement (Cherry-pick #17362) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17378
  • * feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 (Cherry-pick #17428) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17434

value changes (2)

  • * fix(deps): bump golang.org/x/mod to v0.40.0 by @IceCodeBear in https://github.com/kyverno/kyverno/pull/17358
  • * [release-1.19] fix(deps): upgrade golang.org/x/crypto to v0.56.0 and grpc to v1.83.2 by @realshuting in https://github.com/kyverno/kyverno/pull/17513

constraints (1)

  • * feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (Cherry-pick #17014) by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17530
Kyvernoをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Kyvernoのリリース一覧 →