RATATOSKRATATOSK
로그인

Kyverno

v1.19.0Security
2026년 8월 20일

ACTION 7CHECK 6PLAN 1OTHER 160

운영자를 대상으로 CLI, Helm, 정책 기능을 확장하고 여러 수정과 의존성 업데이트를 반영한 릴리스입니다. 사용 중단 및 제거, 제약 변경도 포함되어 업그레이드 전에 환경별 검토가 필요하며, `cel-go` 취약점 수정을 비롯한 보안 수정도 포함되지만 유효한 보안 권고 식별자는 제공되지 않았습니다.

조치 필요 (7)

  • securityhigh중간 인증서 수 제한

    중간 인증서 수를 제한해 CVE-2026-32280 완화 조치를 적용했습니다.

    kyverno#15858

  • securityhighgo toolchain 1.26.3 업데이트

    go toolchain을 1.26.3으로 올려 CVE-2026-39836을 해결했습니다.

    kyverno#16361

  • securityCRDs와 문서 재생성

    GHSA-79gf-7frw-68m9 API가 상향된 뒤 CRDs와 문서를 다시 생성했습니다.

    kyverno#16241

  • security보안 의존성 버전 업데이트

    golang.org/x/crypto를 v0.53.0으로, x/net을 v0.56.0으로 올려 보안 CVE를 해결했습니다.

    kyverno#16340

  • securityORAS와 sigstore CodeQL 취약점 패치

    ORAS와 sigstore의 CodeQL 취약점에 대한 패치를 반영했습니다.

    kyverno#16426

  • securityCodeQL 보안 취약점 수정

    공개된 CodeQL 보안 취약점을 해결했습니다.

    kyverno#16528

  • securitycel-go v0.30.0 업데이트

    cel-go를 v0.30.0으로 올려 CVE-2026-GHSA-gcjh-h69q-9w9g를 해결했습니다.

    kyverno#16782

영향 확인 (6)

  • breakingmigrate 명령의 --resource 요구

    migrate 명령을 실행할 때 적용됩니다.

    migrate 명령에 --resource 인자를 지정하도록 요구합니다.

    kyverno#16471

  • breaking백그라운드 스캔의 사용자 정보 기본값

    백그라운드 스캔이 실행될 때 적용됩니다.

    백그라운드 스캔에서 사용자 정보의 그룹과 UID 기본값을 설정합니다.

    kyverno#16592

  • breakingFail 웹훅의 부트스트랩 리소스 제외

    Fail 웹훅을 설정할 때 적용됩니다.

    Fail 웹훅에서 Node와 CSR을 건너뛸 수 있도록 excludeBootstrapResources 플래그를 추가했습니다.

    kyverno#16397

  • breakingAPI의 kyverno-json 지원 제거

    API에서 kyverno-json 지원을 사용할 때 적용됩니다.

    API에서 kyverno-json 지원을 제거했습니다.

    kyverno#16792

  • breakingjson scan 명령 제거

    JSON scan 명령을 사용할 때 적용됩니다.

    json scan 명령을 제거했습니다.

    kyverno#16973

  • breakingrequest.operation 조건의 값 검증

    request.operation 조건을 설정할 때 적용됩니다.

    request.operation 조건에서 문자열이 아닌 값을 거부합니다.

    kyverno#17013

미리 준비 (1)

  • deprecated레거시 kyverno.io 정책 유형 사용 중단 안내

    레거시 kyverno.io 정책 유형을 사용할 때 적용됩니다.

    레거시 kyverno.io 정책 유형이 더 이상 사용되지 않음을 경고, Helm 알림, PSS 기본 설정으로 표시합니다.

    kyverno#16868

그 외 기록된 변경 160건 전체fixes 91 · value changes 36 · additions 23 · constraints 9 · renames 1

fixes (91)

  • * fix(jmespath): prevent panic in label_match on nested structures by @pulkitvats2007-crypto in https://github.com/kyverno/kyverno/pull/15827
  • * fix: retry on conflict when updating policy status by @williamclot in https://github.com/kyverno/kyverno/pull/15754
  • * fix: restart dynamic watchers in background reporting on 410 by @aerosouund in https://github.com/kyverno/kyverno/pull/16028
  • * fix: support cluster-scoped resource generation in GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16018
  • * fix: pass AdmissionRequest to updaterequests for mutate existing policy by @realshuting in https://github.com/kyverno/kyverno/pull/16050
  • * fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by @SargamPuram in https://github.com/kyverno/kyverno/pull/15784
  • * fix: validate name field in globalReference context entry by @atharrva01 in https://github.com/kyverno/kyverno/pull/16003
  • * fix(gctx): correctly track per-loader load state to avoid skipping LoadData by @liuxu623 in https://github.com/kyverno/kyverno/pull/16099
  • * fix: skip report creation for subresources with empty name/UID by @realshuting in https://github.com/kyverno/kyverno/pull/16114
  • * fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/16167
  • * fix(dpol): apply namespaceSelector against Namespace resource own labels by @realshuting in https://github.com/kyverno/kyverno/pull/16200
  • * fix: do not abort required validation on non-matching images by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16208
  • * return correct results for NotEquals type mismatch cases by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16276
  • * fix: wire gpolEngine and gpolProvider into policyController by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/16171
  • * fix: nil pointer panic in getGpolTriggers on ListResource error by @senutpal in https://github.com/kyverno/kyverno/pull/16245
  • * Fix UR regression by @avoidik in https://github.com/kyverno/kyverno/pull/16280
  • * Fix context and SyncWatchers race conditions in GeneratingPolicy by @Aneesh-Hegde in https://github.com/kyverno/kyverno/pull/16041
  • * fix(generate): batch UpdateRequests to avoid etcd size limit by @vmsilvamolina in https://github.com/kyverno/kyverno/pull/15872
  • * fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by @realshuting in https://github.com/kyverno/kyverno/pull/16329
  • * fix(background): remove dead watcher entry on goroutine exit by @Ebraam-Ashraf in https://github.com/kyverno/kyverno/pull/16130
  • * fix(generate): support NamespacedGeneratingPolicy end-to-end by @realshuting in https://github.com/kyverno/kyverno/pull/16338
  • * fix(background): scan NamespacedImageValidatingPolicy resources too by @Proximyst in https://github.com/kyverno/kyverno/pull/16301
  • * fix: validate stdin across apply paths by @karthikmanam in https://github.com/kyverno/kyverno/pull/16347
  • * fix CEL autogen namespace replacement by @dag-andersen in https://github.com/kyverno/kyverno/pull/16039
  • * fix(gpol): support mixed-type aggregate literals in CEL variables by @realshuting in https://github.com/kyverno/kyverno/pull/16339
  • * fix: preserve cluster-scoped generated resources by @Suhani95 in https://github.com/kyverno/kyverno/pull/16362
  • * fix(api): use allPath instead of anyPath in m.All validation loop by @Utkal059 in https://github.com/kyverno/kyverno/pull/16296
  • * fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes #16256 by @pyd-07 in https://github.com/kyverno/kyverno/pull/16258
  • * fix: add sorting for ivpol targets by @1vanden in https://github.com/kyverno/kyverno/pull/16252
  • * fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by @InsomniaCoder in https://github.com/kyverno/kyverno/pull/15865
  • * fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by @sandert-k8s in https://github.com/kyverno/kyverno/pull/16255
  • * fix(reports): correct label prefix for mpol/dpol policies by @atharrva01 in https://github.com/kyverno/kyverno/pull/16452
  • * fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by @hugolevino in https://github.com/kyverno/kyverno/pull/16298
  • * fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16287
  • * fix: resolve context leak in dynamic resource watcher by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16087
  • * fix: skip reports RBAC check when background scanning is disabled by @p-fruck in https://github.com/kyverno/kyverno/pull/16490
  • * fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by @rootp1 in https://github.com/kyverno/kyverno/pull/16544
  • * fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by @Karthikk-18 in https://github.com/kyverno/kyverno/pull/16525
  • * fix(chart): wire cleanup controller core extra resources by @Suhani95 in https://github.com/kyverno/kyverno/pull/16165
  • * fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by @rx18-eng in https://github.com/kyverno/kyverno/pull/16561
  • * fix: avoid mutating policy webhook name collisions by @realshuting in https://github.com/kyverno/kyverno/pull/16578
  • * fix(helm): handle null image tags in _image.tpl and fix reports-server defaultTag by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16063
  • * fix: key generate test clone sources by policy by @Suhani95 in https://github.com/kyverno/kyverno/pull/16450
  • * fix: handle whitespace in mpol autogen Object constructor by @santhil-cyber in https://github.com/kyverno/kyverno/pull/16292
  • * fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by @pyd-07 in https://github.com/kyverno/kyverno/pull/16588
  • * fix(mpol): handle DELETE target expression using oldObject by @realshuting in https://github.com/kyverno/kyverno/pull/16610
  • * fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by @rx18-eng in https://github.com/kyverno/kyverno/pull/16611
  • * fix: CustomNamespaceLister.List honors the label selector by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16628
  • * fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by @rx18-eng in https://github.com/kyverno/kyverno/pull/16509
  • * fix(webhook): scope namespaced policies to their own namespace by @rx18-eng in https://github.com/kyverno/kyverno/pull/16615
  • * fix(ivpol): add debug logging for CEL image verification functions by @amarkdotdev in https://github.com/kyverno/kyverno/pull/16305
  • * fix: enforce MutatingPolicy evaluation mode semantics by @realshuting in https://github.com/kyverno/kyverno/pull/16686
  • * fix: validate MAP-incompatible MutatingPolicy match conditions by @realshuting in https://github.com/kyverno/kyverno/pull/16698
  • * fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by @rx18-eng in https://github.com/kyverno/kyverno/pull/16594
  • * fix(generate): reject stale trigger UIDs when live resource does not match by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16603
  • * fix: strip cross-namespace ownerReferences in CEL-based generation by @realshuting in https://github.com/kyverno/kyverno/pull/16716
  • * Fix DeletingPolicy objectSelector test results by @Prachidg in https://github.com/kyverno/kyverno/pull/16431
  • * fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by @realshuting in https://github.com/kyverno/kyverno/pull/16727
  • * fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16663
  • * fix(verification): use sigstore-go TUF client and fallback to trusted_root.json by @rseleven in https://github.com/kyverno/kyverno/pull/16591
  • * fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by @rx18-eng in https://github.com/kyverno/kyverno/pull/16731
  • * fix: preserve namespaceSelector during policy autogen by @pyd-07 in https://github.com/kyverno/kyverno/pull/16476
  • * fix: align policy metrics for new policy formats by @aditip149209 in https://github.com/kyverno/kyverno/pull/16359
  • * fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by @rx18-eng in https://github.com/kyverno/kyverno/pull/16434
  • * fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by @realshuting in https://github.com/kyverno/kyverno/pull/16739
  • * fix(helm): use request.namespace for vpolExclude matchConditions by @swastikCommits in https://github.com/kyverno/kyverno/pull/16751
  • * fix: resolve namespaceObject with live API fallback on informer cache miss by @realshuting in https://github.com/kyverno/kyverno/pull/16784
  • * fix(cli): evaluate mutateExisting mutating policies on admission in test by @rx18-eng in https://github.com/kyverno/kyverno/pull/16618
  • * fix: honor full-exemption PolicyException when multiple exceptions match by @AftAb-25 in https://github.com/kyverno/kyverno/pull/16060
  • * fix(engine): honor per-rule failureAction in the admission block deci… by @rx18-eng in https://github.com/kyverno/kyverno/pull/16558
  • * fix(helm): disable in-process cert controller when cert-manager delegation is enabled by @realshuting in https://github.com/kyverno/kyverno/pull/16804
  • * Fix image verification parity gaps by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16800
  • * fix: IVPOL mutateDigest unimplemented stub by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16815
  • * fix: enforce verifyDigest in ImageValidatingPolicy evaluator by @pyd-07 in https://github.com/kyverno/kyverno/pull/16817
  • * fix: sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching trigger by @realshuting in https://github.com/kyverno/kyverno/pull/16838
  • * fix: prevent autogen from rewriting namespaceObject in mpol by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15947
  • * fix: evaluate resource filters from background scanning jobs by @sagarkhandagre998 in https://github.com/kyverno/kyverno/pull/16469
  • * fix(dclient): use RESTMapper for GVK to GVR mapping by @FirePheonix in https://github.com/kyverno/kyverno/pull/16905
  • * Fix context propagation in MatchPolicyContext by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/16910
  • * fix: IVPOL required has no effect (Cherry-pick #16853) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/16987
  • * fix(policy): preserve validation warnings for generate rules in validateAction (Cherry-pick #16821) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17012
  • * Fix goroutine and ticker leak in metrics initialization (Cherry-pick #17024) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17025
  • * Fix ticker leak in policyController background reconciliation loop (Cherry-pick #17027) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17030
  • * Fix context leak in TTL controller reconcile loop (Cherry-pick #17032) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17034
  • * Fix resource leak in sigstore fetchReferrers loop (Cherry-pick #17039) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17042
  • * fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pick #17020) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17048
  • * fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pick #17061) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17064
  • * fix(webhook): do not offload namespaceObject match conditions to the API server (Cherry-pick #17069) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17072
  • * Fix ignored context in notary registry resolution (Cherry-pick #17078) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17079
  • * fix(webhooks): handle nil RequestKind and RequestResource in trace middleware (Cherry-pick #17087) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17091
  • * fix(imageverify): repopulate intoto payload on attestation cache hit (#17117) by @realshuting in https://github.com/kyverno/kyverno/pull/17195

value changes (36)

  • * chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15917
  • * chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15954
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15961
  • * fix(engine/vpol): include CEL validation expression index in policy report properties by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/15916
  • * feat: honor expired CEL PolicyExceptions by @realshuting in https://github.com/kyverno/kyverno/pull/16299
  • * fix(deps): upgrade ristretto to v2 by @chimanjain in https://github.com/kyverno/kyverno/pull/16360
  • * fix(deps): bump rekor and in-toto-golang for codeql alerts by @realshuting in https://github.com/kyverno/kyverno/pull/16394
  • * chore: update pond dependency to v2 by @chimanjain in https://github.com/kyverno/kyverno/pull/16379
  • * Update backoff v7 by @khiemdoan in https://github.com/kyverno/kyverno/pull/16405
  • * Don't initialize rekor client for key or certificate based scenarios by @aerosouund in https://github.com/kyverno/kyverno/pull/16415
  • * chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16516
  • * chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16515
  • * chore(deps): bump the otel group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16539
  • * chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16575
  • * fix: add missing reportProperties to v2beta1 Rule by @zyzzmohit in https://github.com/kyverno/kyverno/pull/15564
  • * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16576
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16599
  • * chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16600
  • * chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16620
  • * chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16669
  • * feat: reuse image verification cache for ImageValidatingPolicy by @bhuvan-somisetty in https://github.com/kyverno/kyverno/pull/16694
  • * chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16679
  • * chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16680
  • * chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16697
  • * chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16770
  • * chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16767
  • * chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16737
  • * chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16738
  • * Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by @kubeagon in https://github.com/kyverno/kyverno/pull/15873
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.47 to 0.2.48 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16802
  • * chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16818
  • * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16837
  • * chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16836
  • * chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16834
  • * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16835
  • * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16912

additions (23)

  • * Feat/cli apply cross resource by @SargamPuram in https://github.com/kyverno/kyverno/pull/15846
  • * fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16034
  • * Fix/cli multiple json payloads by @SargamPuram in https://github.com/kyverno/kyverno/pull/15584
  • * feat(cli): add offline mock support for http mock request/response for GET method and global context entries by @SargamPuram in https://github.com/kyverno/kyverno/pull/15948
  • * feat: add updaterequest total gauge metric by @realshuting in https://github.com/kyverno/kyverno/pull/16115
  • * feat(helm): support extraArgs in CRDs migration job by @Suhani95 in https://github.com/kyverno/kyverno/pull/16132
  • * feat(helm): add optional PrometheusRule template by @realshuting in https://github.com/kyverno/kyverno/pull/16155
  • * feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16123
  • * fix: add access to clusterroles and bindings in the standard kyverno config by @aerosouund in https://github.com/kyverno/kyverno/pull/16219
  • * feat: Enable Cosign verbosity debugging by @naseyro in https://github.com/kyverno/kyverno/pull/16207
  • * feat(cli): support multiple CRD paths and hook CRD processor into test command by @asiyani in https://github.com/kyverno/kyverno/pull/15824
  • * feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by @SargamPuram in https://github.com/kyverno/kyverno/pull/16297
  • * feat: support skipBackgroundRequests for CEL mpol/gpol by @realshuting in https://github.com/kyverno/kyverno/pull/16369
  • * feat(gpol): support useServerSideApply for GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16403
  • * feat(gpol): add auditAnnotations support to GeneratingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16505
  • * fix: add policies.kyverno.io resources to aggregate policy roles by @volantebjb in https://github.com/kyverno/kyverno/pull/16239
  • * feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by @realshuting in https://github.com/kyverno/kyverno/pull/16699
  • * feat(cel): add regex.replace extension function by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/16438
  • * feat(mpol): add auditAnnotations support to MutatingPolicy by @realshuting in https://github.com/kyverno/kyverno/pull/16721
  • * [Feature] add optional cache bounds via --maxGlobalContextEntries by @IceCodeBear in https://github.com/kyverno/kyverno/pull/16560
  • * feat(helm): expose maxGlobalContextEntries in the Kyverno chart by @IceCodeBear in https://github.com/kyverno/kyverno/pull/16749
  • * feat(cli): support admission operation simulation for policy testing by @realshuting in https://github.com/kyverno/kyverno/pull/16787
  • * feat(helm): add configurable lifecycle hooks to all controllers (Cherry-pick #16444) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17011

constraints (9)

  • * update blocklist to allow in-cluster HTTP calls by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15973
  • * fix(cli): allow multiple CRDs in to be in the --crd-path file by @the-technat in https://github.com/kyverno/kyverno/pull/16161
  • * fix: support cel exception in cli apply 'exceptions-within-resources' by @bakito in https://github.com/kyverno/kyverno/pull/16178
  • * feat(pss-helm): add image to allowed volumetypes by @yehlo in https://github.com/kyverno/kyverno/pull/15906
  • * feat: support MutatingPolicy target conditions and subresource targets by @realshuting in https://github.com/kyverno/kyverno/pull/16614
  • * fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by @JimBugwadia in https://github.com/kyverno/kyverno/pull/16666
  • * feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by @realshuting in https://github.com/kyverno/kyverno/pull/16703
  • * fix: validate DeletingPolicy cron schedule at admission by @Jayashanker-Padishala in https://github.com/kyverno/kyverno/pull/16728
  • * fix: allow pod-level seccomp in restrict-seccomp-strict vpol by @Suhani95 in https://github.com/kyverno/kyverno/pull/16249

renames (1)

  • * Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by @chimanjain in https://github.com/kyverno/kyverno/pull/16511
Kyverno 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Kyverno 릴리스 전체 →