RATATOSKRATATOSK
ログイン

Kyverno

v1.20.0Security
2026年11月12日

ACTION 10CHECK 17PLAN 1OTHER 228

CEL と OCI を含む機能拡張に加え、レガシーポリシーからの移行を支える制約変更と、CLI・ポリシー動作の更新が入っています。レガシーポリシーの実行削除やポリシーとチャートの制約変更、依存関係のセキュリティ更新があるため、該当する構成では確認が必要です。

要対応 (10)

  • securitycriticalx/net のセキュリティ更新

    CVE-2026-78663 に対応するため、x/net を更新しました。

    kyverno#17997

  • securityhighoras.land/oras-go/v2 の更新

    oras.land/oras-go/v2 を v2.6.2 に更新し、CVE-2026-50163 を解消しました。

    kyverno#16945

  • securityhighx/net の更新

    x/net を更新し、HTTP/2 の ReadHeaderTimeout 回避に関する CVE-2026-56853 を解消しました。

    kyverno#17156

  • securityhighGo 1.26.6 への更新

    標準ライブラリでの CVE-2026-56853 に対応するため、Go を 1.26.6 に更新しました。

    kyverno#17189

  • securityhighmiekg/dns の更新

    DNS 解析時のパニックに関する CVE-2026-46600 に対応するため、miekg/dns を更新しました。

    kyverno#17215

  • securityhighGo 1.27.2 への更新

    CVE-2026-97031 に対応するため、Go を 1.27.2 に更新しました。

    kyverno#17971

  • securityhighgolang.org/x/net のセキュリティ更新

    CVE-2026-78669 に対応するため、golang.org/x/net を更新しました。

    kyverno#17968

  • securitymediumgolang 1.27.3 への更新

    CVE-2026-111943 に対応するため、golang を 1.27.3 に更新しました。

  • security依存関係の CVE 対応

    oras-go、x/mod、Go toolchain の依存関係を更新し、依存関係に含まれる CVE に対応しました。

    kyverno#17160

  • securityrekor 依存関係の置き換え

    GO-2026-5932 に対応するため、rekor の依存関係を置き換えました。

    kyverno#17269

影響確認 (17)

  • securityapiCall.service のアドレス検証

    apiCall.service を設定している場合に適用されます。

    apiCall.service の送信先で、IPv6 に埋め込まれた IPv4 アドレスによるブロックリスト回避を防ぐようになりました。

    kyverno#17310

  • breakingrequest.operation の値検証

    request.operation を設定している場合に適用されます。

    request.operation の条件で文字列以外の値を受け付けなくなりました。

    kyverno#16977

  • breakingImageValidatingPolicy の matchConstraints 検証

    ImageValidatingPolicy に空の matchConstraints を設定している場合に適用されます。

    空の matchConstraints を持つ ImageValidatingPolicy を拒否するようになりました。

    kyverno#17162

  • breaking名前空間付きポリシーの globalContext 制約

    名前空間付きポリシーで globalContext を設定している場合に適用されます。

    名前空間付きポリシーで globalContext を使用できなくなりました。

    kyverno#17377

  • breakingレガシーポリシー API の作成と更新の制限

    レガシーなポリシー API を使用している場合に適用されます。

    レガシーなポリシー API の作成と spec の更新がブロックされるようになりました。

    kyverno#17535

  • breakingレガシーポリシー CR 用のインストールゲート

    インストール時またはアップグレード時にレガシーポリシー CR を有効にする場合に適用されます。

    インストール時とアップグレード時に、レガシーポリシー CR を有効にするための必須ゲートが追加されました。

    kyverno#17534

  • breakingCLI でのレガシーポリシーマニフェスト制限

    CLI を apply または test で実行する場合に適用されます。

    apply または test でレガシーポリシーマニフェストがブロックされ、移行用の回避手段が追加されました。

    kyverno#17553

  • breakingCEL PolicyException の exceptionNamespace 適用

    CEL PolicyException に exceptionNamespace を設定している場合に適用されます。

    CEL PolicyException で exceptionNamespace が適用されるようになりました。

    kyverno#17479

  • breaking型付き依存関係のないレガシーポリシー書き込みの制限

    型付きポリシー依存関係なしでレガシーポリシーを書き込んでいる場合に適用されます。

    型付きポリシー依存関係を持たないレガシーポリシーの書き込みが拒否されるようになりました。

  • breakingアドミッションバイナリのレガシーポリシー実行削除

    アドミッションバイナリを使用している場合に適用されます。

    アドミッションバイナリからレガシーポリシーの実行が削除されました。

  • breakingバックグラウンドコントローラーのレガシーポリシー実行削除

    バックグラウンドコントローラーを実行している場合に適用されます。

    バックグラウンドコントローラーからレガシーポリシーの実行が削除されました。

  • breakingレポートコントローラーのレガシーポリシー評価削除

    レポートコントローラーを実行している場合に適用されます。

    レポートコントローラーからレガシーポリシーの評価が削除されました。

  • breakingレガシー CLI 実行の削除

    レガシー CLI 実行を使用している場合に適用されます。

    レガシー CLI 実行とポリシー作成処理の分岐が削除されました。

  • breakinglegacy CRD schemas の固定

    レガシー CRD スキーマを設定している場合に適用されます。

    共有 kyverno API 型を整備し、legacy CRD schemas が固定されました。

  • breakingCEL ポリシーの最小バージョン更新

    CEL ポリシーを使用している場合に適用されます。

    CEL ポリシーの最小バージョンが 1.17.0 に更新されました。

  • breakingレガシー kyverno.io ポリシーエンジンの削除

    レガシーな kyverno.io ポリシーエンジンを実行している場合に適用されます。

    レガシーな kyverno.io ポリシーエンジンが削除されました。

  • breakingレガシー kyverno.io Go API の削除

    レガシーな kyverno.io Go API に依存している場合に適用されます。

    レガシーな kyverno.io Go API が削除され、クライアントが再生成されました。

事前準備 (1)

  • deprecatedjmesPath projections の非推奨化

    jmesPath projections を使用している場合に適用されます。

    jmesPath projections が非推奨になり、その利用状況を計測するようになりました。

その他の記録済み変更 228 件すべてfixes 137 · value changes 60 · additions 28 · constraints 2 · removals 1

fixes (137)

  • * fix(policy): preserve validation warnings for generate rules in validateAction by @vishalmore90 in https://github.com/kyverno/kyverno/pull/16821
  • * fix: handle nil input in CopyMap and add unit tests by @KeerthiKumarR in https://github.com/kyverno/kyverno/pull/16979
  • * fix: IVPOL required has no effect by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16853
  • * Fix goroutine and ticker leak in metrics initialization by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17024
  • * Fix ticker leak in policyController background reconciliation loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17027
  • * Fix context leak in TTL controller reconcile loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17032
  • * Fix resource leak in sigstore fetchReferrers loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17039
  • * fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger by @realshuting in https://github.com/kyverno/kyverno/pull/17020
  • * fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result by @realshuting in https://github.com/kyverno/kyverno/pull/17061
  • * fix(webhook): do not offload namespaceObject match conditions to the API server by @realshuting in https://github.com/kyverno/kyverno/pull/17069
  • * Fix ignored context in notary registry resolution by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17078
  • * fix(webhooks): handle nil RequestKind and RequestResource in trace middleware by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17087
  • * fix(jmespath): correct function names in validation errors by @Hiten0305l in https://github.com/kyverno/kyverno/pull/17093
  • * fix(ttl): record deleted objects metric after deletion by @Hiten0305l in https://github.com/kyverno/kyverno/pull/17104
  • * [Bug] Fix missing OpenTelemetry tracing for APICalls without custom CA bundle by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17116
  • * Fix: CLI apply command fails to match resources containing hyphens by @vishalmore90 in https://github.com/kyverno/kyverno/pull/17124
  • * fix(webhooks): record MPOL and NMPOL metrics under WebhookMutating by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16894
  • * fix(imageverify): repopulate intoto payload on attestation cache hit by @Gagansharma-code in https://github.com/kyverno/kyverno/pull/17117
  • * fix(cli): pass resolved subresource to CEL policy engine requests by @pujitha24 in https://github.com/kyverno/kyverno/pull/17047
  • * fix(cli): prevent remote HTTP loaders from hanging indefinitely by @Suhani95 in https://github.com/kyverno/kyverno/pull/16608
  • * Fix missing autogen webhook expansion for NamespacedValidatingPolicy by @vishalmore90 in https://github.com/kyverno/kyverno/pull/17262
  • * fix: avoid data race in image evaluator prefetch by @realshuting in https://github.com/kyverno/kyverno/pull/17313
  • * fix: report all failing images in verifyImages (v1) failure message. by @pyd-07 in https://github.com/kyverno/kyverno/pull/16447
  • * fix: validate PolicyException CEL match conditions by @thuanlm215 in https://github.com/kyverno/kyverno/pull/17350
  • * feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17014
  • * fix(cli): use policy api version in OCI annotations by @karthikmanam in https://github.com/kyverno/kyverno/pull/16570
  • * fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker by @pujitha24 in https://github.com/kyverno/kyverno/pull/17136
  • * fix: skip namespace lookup in exception matching when no namespaceSelector is defined by @kmehta-code in https://github.com/kyverno/kyverno/pull/17140
  • * fix: skip scalar values during wildcard image extraction by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/16268
  • * Fix/ivpol ephemeral containers by @pmlopes in https://github.com/kyverno/kyverno/pull/17427
  • * fix(gpol): propagate synchronize option to UpdateRequests by @vflaux in https://github.com/kyverno/kyverno/pull/16920
  • * fix(reports): discover autogen'd IVPol/NIVPol targets for background scan by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17395
  • * fix(webhook): avoid redundant recorder notifications by @Udaytaneja in https://github.com/kyverno/kyverno/pull/17059
  • * fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling by @bhuvan-somisetty in https://github.com/kyverno/kyverno/pull/16904
  • * fix(cel): read PolicyExceptions from the manager cache, not a second informer by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16993
  • * fix(webhooks): return after writing StatusInternalServerError in Probe handler by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17288
  • * fix(reports): fix label prefix and metadata for namespaced CEL policies by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17460
  • * fix(background): use dynamic restmapper and enable crd watcher by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17482
  • * fix: close layer readers per-iteration to avoid FD/memory leak by @pgmpofu in https://github.com/kyverno/kyverno/pull/16994
  • * fix(gpol): recreate downstream resource after repeated deletions by @realshuting in https://github.com/kyverno/kyverno/pull/17453
  • * fix(breaker): recover the reports counter when its watch dies for good by @nissessenap in https://github.com/kyverno/kyverno/pull/17085
  • * fix(webhook): avoid image validating policy webhook name collisions by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17558
  • * fix: reuse compiled ImageValidatingPolicy CEL programs across admissions by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17599
  • * fix: preserve legacy report sources and webhook API versions in 1.20 by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17554
  • * fix(deleting): process namespaced resources with pagination by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17263
  • * fix(cli): resolve match constraints for namespaced validating policies by @harshrajdebug in https://github.com/kyverno/kyverno/pull/17608
  • * fix: autogen fine-grained namespaced image policies by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/16840
  • * fix(policy): resolve subresource triggers in mutating policy matchConstraints by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17495
  • * feat(helm): protect legacy policy CRDs from Helm prune with resource-policy keep by @thisis-manan in https://github.com/kyverno/kyverno/pull/17494
  • * fix: always re-arm background scan and TTL controllers after transient errors (#16109) by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16288
  • * fix(cel): set rule name for validate.cel results by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/17353
  • * fix(event): truncate event notes on a character boundary by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17581
  • * fix(cel): requeue namespaced policies on PolicyException changes by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17641
  • * fix: nil pointer dereference in validation engine on UPDATE requests by @AftAb-25 in https://github.com/kyverno/kyverno/pull/17355
  • * fix(cli): close the junit failure element without detailed results by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17560
  • * fix(cli): preserve GeneratingPolicy skips in test results by @Om-Beast in https://github.com/kyverno/kyverno/pull/17388
  • * fix: preserve MutatingPolicy reinvocation policy by @pyd-07 in https://github.com/kyverno/kyverno/pull/17324
  • * fix(controllers): honor resourceFilters in cleanup and deleting controllers by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17632
  • * fix(background): resolve generate triggers by name instead of listing the namespace by @kmehta-code in https://github.com/kyverno/kyverno/pull/17702
  • * Fix panic in metrics policy controller and add comprehensive unit tests by @nishant-devv in https://github.com/kyverno/kyverno/pull/17750
  • * fix(cli): aggregate test filter errors using errors.Join by @JituRewar in https://github.com/kyverno/kyverno/pull/17760
  • * fix(cli): flatten kind: List resources in apply and fake dynamic client by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17504
  • * fix(mpol): evaluate matchConditions during background mutateExisting evaluation by @pujitha24 in https://github.com/kyverno/kyverno/pull/17433
  • * fix(cli): support all CEL policy exception versions in policy loader (#17743) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17769
  • * fix: verify annotations properly for cosign v2 and v3 by @aerosouund in https://github.com/kyverno/kyverno/pull/17794
  • * fix: prevent panic in jmespath random() function on invalid argument type by @Zara-5 in https://github.com/kyverno/kyverno/pull/17773
  • * fix: preserve Cosign errors in image validation messages by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17606
  • * fix(chart): add policies.kyverno.io types to the Grafana dashboard by @VijayabaskarR-06 in https://github.com/kyverno/kyverno/pull/17800
  • * fix: mark admission replicas unready after informer watch failures by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17610
  • * fix(cli): report excluded DeletingPolicy resources as skipped by @pyd-07 in https://github.com/kyverno/kyverno/pull/17458
  • * fix(status): heal WebhookConfigured condition once a VAP is generated by @pujitha24 in https://github.com/kyverno/kyverno/pull/17119
  • * fix: dont treat missing digests when MutateDigest==false as an error by @aerosouund in https://github.com/kyverno/kyverno/pull/17841
  • * fix: evaluate ImageValidatingPolicies concurrently by @pyd-07 in https://github.com/kyverno/kyverno/pull/17496
  • * fix(helm): scope scale-to-zero hook to the release by @KKamJi98 in https://github.com/kyverno/kyverno/pull/17840
  • * fix(charts): stop denying Windows pods and refresh PSA allow-lists by @Suhani95 in https://github.com/kyverno/kyverno/pull/17684
  • * fix(charts): enforce drop ALL and deny pod-level runAsNonRoot=false in PSS CEL policies by @Suhani95 in https://github.com/kyverno/kyverno/pull/17672
  • * fix(ivpol): give each policy its own image context during concurrent evaluation by @rx18-eng in https://github.com/kyverno/kyverno/pull/17860
  • * fix(ivpol): contain panics in per-policy evaluation goroutines by @rx18-eng in https://github.com/kyverno/kyverno/pull/17894
  • * fix(cli): propagate messageExpression errors to fail cli tests by @nishant-devv in https://github.com/kyverno/kyverno/pull/17863
  • * fix: apply autogen path rewrite to PolicyException matchConditions (#16956) by @nishant-devv in https://github.com/kyverno/kyverno/pull/17856
  • * fix(cli): restore test checks with CEL expressions by @afarbos in https://github.com/kyverno/kyverno/pull/17897
  • * fix(vpol): keep controller metadata paths in autogen'd PolicyExceptions by @ManojLamani in https://github.com/kyverno/kyverno/pull/17903
  • * fix(ivpol): propagate the admission request context to image verification by @rx18-eng in https://github.com/kyverno/kyverno/pull/17895
  • * fix(mutate): escape YAML-forbidden characters in patchStrategicMerge by @thebearmayor in https://github.com/kyverno/kyverno/pull/17881
  • * fix(cli): prevent nil pointer dereference when target has no patched resource by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17843
  • * fix(ivpol): skip registry fetch when image verification is cached (#17969) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17974
  • * fix(imageverify): bind verification cache entries to the content and attestors they verified by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17993
  • * fix(security): CEL API path validation and mpol namespace confinement by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17985
  • * fix(vap): apply the runtime PolicyException gates in the CEL admission-policy generator by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17986
  • * fix: preserve controller-owned generation labels by @sagark-nirmata in https://github.com/kyverno/kyverno/pull/17938
  • * fix(engine): handle multiple cosign attestation versions by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/18010
  • * fix: honor wildcard excludeResourceRules in generateExisting by @Siddhartha-singh01 in https://github.com/kyverno/kyverno/pull/18026
  • * fix(cli): use Report kind for namespaced OpenReports output by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/17809
  • * fix(chart): grant the background controller what Kyverno aggregates i… by @WHOIM1205 in https://github.com/kyverno/kyverno/pull/18019
  • * fix(generate): fix GeneratingPolicy synchronization for custom resources and multiple triggers by @rx18-eng in https://github.com/kyverno/kyverno/pull/16748
  • * fix(metrics): cache GetManager() result in registerPolicyChangesMetric by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/17862
  • * fix(vpol): honour failurePolicy Ignore for runtime errors in the admission handler by @VijayabaskarR-06 in https://github.com/kyverno/kyverno/pull/17909
  • * fix(imageverify): give the image verify cache a usable byte budget by @rx18-eng in https://github.com/kyverno/kyverno/pull/17911
  • * fix(imageverify): extract newest attestation for ImageValidatingPolicy by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/18049
  • * fix(ivpol): report missing annotation keys instead of %!s(<nil>) by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/18060
  • * fix(webhook): populate image verification policies on fine-grained webhook routes by @nishant-devv in https://github.com/kyverno/kyverno/pull/18045
  • * fix(autogen): extract pod templates in a stable order by @ManojLamani in https://github.com/kyverno/kyverno/pull/17981
  • * fix(chart): honor global image registry for webhooks cleanup by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17970
  • * fix(cel/autogen): preserve object.metadata.name in autogen messageExpression by @nishant-devv in https://github.com/kyverno/kyverno/pull/17899
  • * fix(cli): count and print each MutatingPolicy result once by @harshrajdebug in https://github.com/kyverno/kyverno/pull/17838
  • * fix(cli): exclude target-only MutatingPolicies from trigger evaluation by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/17796
  • * fix(ext/cluster): block non-GET RawAbsPath from reaching the real client by @RudraDudhat2509 in https://github.com/kyverno/kyverno/pull/17791
  • * fix: propagate anchor errors using errors.As and Unwrap() method by @JituRewar in https://github.com/kyverno/kyverno/pull/17789
  • * fix(ext/yaml): don't swallow YAML syntax errors in SplitDocuments by @RudraDudhat2509 in https://github.com/kyverno/kyverno/pull/17785
  • * fix(webhook): guard nil Scope dereference in sortedRules to prevent controller panic by @7se7en72025 in https://github.com/kyverno/kyverno/pull/17457
  • * fix(config): reset matchConditions and updateRequestThreshold on unload by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17407
  • * fix(imageverify): reject non-string attestation fields instead of panicking by @omlahore in https://github.com/kyverno/kyverno/pull/17046
  • fix: avoid nil pointer panic verifying sigstore bundle attestations without a type
  • single-flight discovery refetches on cache misses
  • do not panic on a JSON patch value holding object initializers
  • skip CT log key loading for keyed cosign verification
  • Fix unchecked type assertion panic in apiCall.transformAndStore
  • --explain never re-runs expressions with non-deterministic results
  • drop gone downstreams from the generate watch cache
  • recover UpdateRequests left with an empty state
  • register resource CEL library for PolicyExceptions
  • preserve nanosecond precision in PolicyReport aggregation
  • honor failure policy ignore
  • preserve deterministic evaluation response ordering
  • guard cleanup deletes with object identity preconditions
  • restore verified referrers on a cache hit
  • resolve namespaces from live cluster in CEL engines under --cluster
  • fix data race between OnChanged and notify in discovery client
  • scope namespaced image policy credentials by namespace
  • use the workload's namespace for extracted pod templates
  • leave day-of-week as wildcard in time_to_cron
  • recover backing informers after transient relist failures
  • trace for ivpol policies in live admission path
  • respect predicate filter on JSON payloads in vpol Handle()
  • evaluate policies when predicate is nil in Evaluate()
  • dont run resource version migration for the old policy apis
  • fix: handle missing reports CRDs as no-op in kyverno-init

value changes (60)

  • * chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.4 to 5.0.6 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16933
  • * chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.29.1 to 2026.08.03.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16934
  • * chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16936
  • * chore(deps): Upgrade robfig/cron to v3 by @chimanjain in https://github.com/kyverno/kyverno/pull/16932
  • * chore(deps): bump the sigstore group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16935
  • * chore(deps): bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16937
  • * chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.03.1 to 2026.08.03.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16957
  • * chore(deps): bump fluxcd/flux2/action from 2.9.3 to 2.9.4 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17006
  • * chore(deps): bump the otel group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17007
  • * chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17009
  • * chore(deps): bump github.com/sigstore/cosign/v3 from 3.1.2 to 3.1.3 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17008
  • * chore(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17067
  • * chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17141
  • * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17196
  • * chore(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.0 to 1.39.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17198
  • * chore(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17185
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.48 to 0.2.49 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17197
  • * fix(helm): bump bundled reports-server dependency to v0.1.7 by @pujitha24 in https://github.com/kyverno/kyverno/pull/17138
  • * fix(deps): update golang.org/x/net to v0.58.0 by @Sashang-debug in https://github.com/kyverno/kyverno/pull/17242
  • * fix: apply HTTP blocklist to apiCall.service executor by @IceCodeBear in https://github.com/kyverno/kyverno/pull/17234
  • * fix: harden apiCall.service egress proxy path and cover CABundle branch by @realshuting in https://github.com/kyverno/kyverno/pull/17299
  • * chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17293
  • * chore(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17297
  • * chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17294
  • * chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17360
  • * fix(deps): use upstream rekor v1.5.4 instead of the fork replace by @omlahore in https://github.com/kyverno/kyverno/pull/17332
  • * chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17415
  • * chore(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17416
  • * fix: use Docker CE instead of moby for docker-outside-of-docker feature by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/16596
  • * chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17468
  • * chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17500
  • * chore(deps): bump fluxcd/flux2/action from 2.9.4 to 2.9.5 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17442
  • * chore(deps): bump sigs.k8s.io/controller-tools from 0.21.0 to 0.22.0 in /hack/controller-gen by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17467
  • * chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17499
  • * perf(cel): build the request activation once per admission request by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17572
  • * perf(cel): hoist the request-map build in the ivpol engine by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17585
  • * bump go to 1.27 and sigstore to v1.10.10 by @aerosouund in https://github.com/kyverno/kyverno/pull/17776
  • * chore(deps): bump github.com/sigstore/sigstore from 1.10.10 to 1.11.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17801
  • * chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17681
  • * chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17571
  • * chore(deps): bump the sigstore group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17568
  • * fix(imageverify): bound the reads image verification makes from a registry by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17995
  • * fix(wildcard): replace the glob matcher with a bounded two-pointer algorithm by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17990
  • * fix(cel): bound the cost of CEL policy expression evaluation by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17988
  • bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2
  • log watcher events at debug verbosity
  • bump the sigstore group across 1 directory with 4 updates
  • propagate request context and memoize image metadata per evaluation
  • Improve terminal output readability with colors for kyverno jp function
  • reuse context and compiled CEL policy providers in apply
  • retain released legacy image extractor filter schema
  • bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3
  • bump github.com/cenkalti/backoff/v7 from 7.0.0 to 7.0.1
  • bump Kubernetes libraries to v0.37 and controller-runtime to v0.25
  • add semantic color formatting to kyverno apply output
  • add semantic colors to test summary and progress output
  • improve ivCache hit rate by dropping policy info from key
  • mark legacy policies not ready in kyverno-init
  • mark legacy cleanup policies not ready in kyverno-init
  • extend provider & compiler caching to GeneratingPolicies and DeletingPolicies

additions (28)

  • * feat(helm): add configurable lifecycle hooks to all controllers by @mhulscher in https://github.com/kyverno/kyverno/pull/16444
  • * feat(cli): support JSON and YAML output for version command by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16623
  • * feat: phase1 deprecation warning plumbing and CLI warning enforcement by @realshuting in https://github.com/kyverno/kyverno/pull/17362
  • * feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 by @realshuting in https://github.com/kyverno/kyverno/pull/17428
  • * feat: signal remaining legacy kyverno.io policies on startup and via metrics by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17519
  • * feat(kyvernopre): warn about orphaned legacy webhook configurations by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17678
  • * feat(cli): enable OCI-native test and apply flows (#17666) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17689
  • * feat(cli): implement CEL resources only for kyverno oci (#17661) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17671
  • * feat: add compensating controls to policy exceptions by @mastersans in https://github.com/kyverno/kyverno/pull/17690
  • * feat: support additionalExtensions for keyless signing in the ivpol by @aerosouund in https://github.com/kyverno/kyverno/pull/17813
  • * Vpol wiring for trace feature by @aditip149209 in https://github.com/kyverno/kyverno/pull/17695
  • * feat(charts): add disallow-host-probes Baseline PSS policy by @Suhani95 in https://github.com/kyverno/kyverno/pull/17716
  • * ivpol: Add diagnostics to cli for notary verification by @aditip149209 in https://github.com/kyverno/kyverno/pull/17902
  • * feat: implement UpdateRequest cleanup TTL via configuration by @Mannan-Ali in https://github.com/kyverno/kyverno/pull/17429
  • * feat(report): classify validating admission policies by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17926
  • specify and implement the CEL policy bundle OCI format
  • log decision traces in the admission controller behind --enable…
  • add automated PSA release monitoring to prevent PSS policy drift
  • add output-dir and output-file flags to apply
  • allow configuring generation label protection
  • select the Pod Security Admission version for policies
  • add a CEL expression field to projections
  • measure their use
  • support explicit enabled toggle for pod controllers
  • parse the OCI bundle descriptor and derive named sets
  • support JSON document mutation with MutatingPolicy JSON mode
  • add kyverno oci validate with CEL-aware bundle validation
  • add kyverno oci inspect and oci resolve

constraints (2)

  • * fix(kube): support multi-digit API version strings in ParseKindSelector by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16874
  • * feat(charts): support Pod user namespaces in PSS policies by @Suhani95 in https://github.com/kyverno/kyverno/pull/17693

removals (1)

  • * feat: remove json scan command by @eddycharly in https://github.com/kyverno/kyverno/pull/16943
Kyvernoをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Kyvernoのリリース一覧 →