RATATOSKRATATOSK
로그인

Kyverno

v1.20.0Security
2026년 11월 12일

ACTION 10CHECK 17PLAN 1OTHER 228

CEL 및 OCI 기능을 확장하고, 레거시 정책에서 옮겨가는 과정의 제한과 보호 장치를 강화한 릴리스입니다. CLI와 정책 동작도 넓어졌으며, 정확성, 성능, 의존성, 안정성 문제를 수정했습니다. 레거시 정책 실행 제거, 정책 및 차트 제약 변경, 보안 의존성 업데이트를 사용하는 운영 환경은 영향을 확인해야 합니다.

조치 필요 (10)

영향 확인 (17)

  • securityapiCall.service의 차단 목록 우회 수정

    apiCall.service를 설정한 경우 적용됩니다.

    apiCall.service 송신에서 IPv6 내장 IPv4 주소로 차단 목록을 우회할 수 있던 문제를 수정했습니다.

    kyverno#17310

  • breakingrequest.operation 조건의 값 형식 검증 강화

    request.operation을 설정한 경우 적용됩니다.

    request.operation 조건에는 문자열이 아닌 값을 사용할 수 없도록 검증합니다.

    kyverno#16977

  • breaking빈 matchConstraints를 가진 ImageValidatingPolicy 거부

    비어 있는 matchConstraints로 ImageValidatingPolicy를 설정한 경우 적용됩니다.

    비어 있는 matchConstraints를 가진 ImageValidatingPolicy는 허용하지 않습니다.

    kyverno#17162

  • breaking이름공간 정책의 globalContext 사용 제한

    이름공간 정책에 globalContext를 설정한 경우 적용됩니다.

    이름공간 정책에서는 globalContext를 사용할 수 없습니다.

    kyverno#17377

  • breaking레거시 정책 API 생성 및 spec 업데이트 차단

    레거시 정책 API를 사용하는 경우 적용됩니다.

    레거시 정책 API의 새 리소스 생성과 spec 업데이트를 차단합니다.

    kyverno#17535

  • breaking레거시 정책 CR 활성화 게이트 추가

    설치 또는 업그레이드 때 레거시 정책 CR을 활성화한 경우 적용됩니다.

    설치와 업그레이드 시 레거시 정책 CR을 위한 기본 활성화 게이트를 추가했습니다.

    kyverno#17534

  • breakingCLI의 레거시 정책 매니페스트 차단

    CLI에서 apply 또는 test를 실행한 경우 적용됩니다.

    CLI의 apply와 test는 레거시 정책 매니페스트를 차단하며, 마이그레이션을 위한 예외 경로를 추가했습니다.

    kyverno#17553

  • breakingCEL PolicyExceptions의 exceptionNamespace 적용

    CEL PolicyExceptions에 exceptionNamespace를 설정한 경우 적용됩니다.

    CEL PolicyExceptions에 설정한 exceptionNamespace를 웹훅이 적용합니다.

    kyverno#17479

  • breaking의존성이 없는 레거시 정책 쓰기 거부

    형식이 지정된 정책 의존성 없이 레거시 정책을 쓰는 경우 적용됩니다.

    형식이 지정된 정책 의존성 없이 수행하는 레거시 정책 쓰기를 거부합니다.

  • breaking승인 바이너리의 레거시 정책 실행 제거

    승인 바이너리를 사용하는 경우 적용됩니다.

    승인 바이너리에서 레거시 정책 실행을 제거했습니다.

  • breaking백그라운드 컨트롤러의 레거시 정책 실행 제거

    백그라운드 컨트롤러를 실행하는 경우 적용됩니다.

    백그라운드 컨트롤러에서 레거시 정책 실행을 제거했습니다.

  • breaking리포트 컨트롤러의 레거시 정책 평가 제거

    리포트 컨트롤러를 실행하는 경우 적용됩니다.

    리포트 컨트롤러에서 레거시 정책 평가를 제거했습니다.

  • breaking레거시 CLI 실행 및 정책 작성 분기 제거

    레거시 CLI 실행을 사용하는 경우 적용됩니다.

    레거시 CLI 실행과 정책 작성 분기를 삭제했습니다.

  • breaking레거시 CRD 스키마 동결

    레거시 CRD 스키마를 설정한 경우 적용됩니다.

    공유 Kyverno API 형식을 준비하고 레거시 CRD 스키마를 동결했습니다.

  • breakingCEL 정책 최소 버전 1.17.0

    CEL 정책을 사용하는 경우 적용됩니다.

    CEL 정책의 최소 버전을 1.17.0으로 올렸습니다.

  • breaking레거시 kyverno.io 정책 엔진 제거

    레거시 kyverno.io 정책 엔진을 실행하는 경우 적용됩니다.

    레거시 kyverno.io 정책 엔진을 삭제했습니다.

  • breaking레거시 kyverno.io Go API 제거

    레거시 kyverno.io Go API에 의존하는 경우 적용됩니다.

    레거시 kyverno.io Go API를 삭제하고 클라이언트를 다시 생성했습니다.

미리 준비 (1)

  • deprecatedjmesPath 프로젝션 사용 중단 예정

    jmesPath 프로젝션을 사용하는 경우 적용됩니다.

    jmesPath 프로젝션을 더 이상 권장하지 않으며, 사용량을 측정합니다.

그 외 기록된 변경 228건 전체fixes 137 · value changes 60 · additions 28 · constraints 2 · removals 1

fixes (137)

  • * fix(policy): preserve validation warnings for generate rules in validateAction by @vishalmore90 in https://github.com/kyverno/kyverno/pull/16821
  • * fix: handle nil input in CopyMap and add unit tests by @KeerthiKumarR in https://github.com/kyverno/kyverno/pull/16979
  • * fix: IVPOL required has no effect by @lucchmielowski in https://github.com/kyverno/kyverno/pull/16853
  • * Fix goroutine and ticker leak in metrics initialization by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17024
  • * Fix ticker leak in policyController background reconciliation loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17027
  • * Fix context leak in TTL controller reconcile loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17032
  • * Fix resource leak in sigstore fetchReferrers loop by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17039
  • * fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger by @realshuting in https://github.com/kyverno/kyverno/pull/17020
  • * fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result by @realshuting in https://github.com/kyverno/kyverno/pull/17061
  • * fix(webhook): do not offload namespaceObject match conditions to the API server by @realshuting in https://github.com/kyverno/kyverno/pull/17069
  • * Fix ignored context in notary registry resolution by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17078
  • * fix(webhooks): handle nil RequestKind and RequestResource in trace middleware by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17087
  • * fix(jmespath): correct function names in validation errors by @Hiten0305l in https://github.com/kyverno/kyverno/pull/17093
  • * fix(ttl): record deleted objects metric after deletion by @Hiten0305l in https://github.com/kyverno/kyverno/pull/17104
  • * [Bug] Fix missing OpenTelemetry tracing for APICalls without custom CA bundle by @itsvishalyadav in https://github.com/kyverno/kyverno/pull/17116
  • * Fix: CLI apply command fails to match resources containing hyphens by @vishalmore90 in https://github.com/kyverno/kyverno/pull/17124
  • * fix(webhooks): record MPOL and NMPOL metrics under WebhookMutating by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16894
  • * fix(imageverify): repopulate intoto payload on attestation cache hit by @Gagansharma-code in https://github.com/kyverno/kyverno/pull/17117
  • * fix(cli): pass resolved subresource to CEL policy engine requests by @pujitha24 in https://github.com/kyverno/kyverno/pull/17047
  • * fix(cli): prevent remote HTTP loaders from hanging indefinitely by @Suhani95 in https://github.com/kyverno/kyverno/pull/16608
  • * Fix missing autogen webhook expansion for NamespacedValidatingPolicy by @vishalmore90 in https://github.com/kyverno/kyverno/pull/17262
  • * fix: avoid data race in image evaluator prefetch by @realshuting in https://github.com/kyverno/kyverno/pull/17313
  • * fix: report all failing images in verifyImages (v1) failure message. by @pyd-07 in https://github.com/kyverno/kyverno/pull/16447
  • * fix: validate PolicyException CEL match conditions by @thuanlm215 in https://github.com/kyverno/kyverno/pull/17350
  • * feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17014
  • * fix(cli): use policy api version in OCI annotations by @karthikmanam in https://github.com/kyverno/kyverno/pull/16570
  • * fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker by @pujitha24 in https://github.com/kyverno/kyverno/pull/17136
  • * fix: skip namespace lookup in exception matching when no namespaceSelector is defined by @kmehta-code in https://github.com/kyverno/kyverno/pull/17140
  • * fix: skip scalar values during wildcard image extraction by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/16268
  • * Fix/ivpol ephemeral containers by @pmlopes in https://github.com/kyverno/kyverno/pull/17427
  • * fix(gpol): propagate synchronize option to UpdateRequests by @vflaux in https://github.com/kyverno/kyverno/pull/16920
  • * fix(reports): discover autogen'd IVPol/NIVPol targets for background scan by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17395
  • * fix(webhook): avoid redundant recorder notifications by @Udaytaneja in https://github.com/kyverno/kyverno/pull/17059
  • * fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling by @bhuvan-somisetty in https://github.com/kyverno/kyverno/pull/16904
  • * fix(cel): read PolicyExceptions from the manager cache, not a second informer by @7se7en72025 in https://github.com/kyverno/kyverno/pull/16993
  • * fix(webhooks): return after writing StatusInternalServerError in Probe handler by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17288
  • * fix(reports): fix label prefix and metadata for namespaced CEL policies by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17460
  • * fix(background): use dynamic restmapper and enable crd watcher by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17482
  • * fix: close layer readers per-iteration to avoid FD/memory leak by @pgmpofu in https://github.com/kyverno/kyverno/pull/16994
  • * fix(gpol): recreate downstream resource after repeated deletions by @realshuting in https://github.com/kyverno/kyverno/pull/17453
  • * fix(breaker): recover the reports counter when its watch dies for good by @nissessenap in https://github.com/kyverno/kyverno/pull/17085
  • * fix(webhook): avoid image validating policy webhook name collisions by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17558
  • * fix: reuse compiled ImageValidatingPolicy CEL programs across admissions by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17599
  • * fix: preserve legacy report sources and webhook API versions in 1.20 by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17554
  • * fix(deleting): process namespaced resources with pagination by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17263
  • * fix(cli): resolve match constraints for namespaced validating policies by @harshrajdebug in https://github.com/kyverno/kyverno/pull/17608
  • * fix: autogen fine-grained namespaced image policies by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/16840
  • * fix(policy): resolve subresource triggers in mutating policy matchConstraints by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17495
  • * feat(helm): protect legacy policy CRDs from Helm prune with resource-policy keep by @thisis-manan in https://github.com/kyverno/kyverno/pull/17494
  • * fix: always re-arm background scan and TTL controllers after transient errors (#16109) by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/16288
  • * fix(cel): set rule name for validate.cel results by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/17353
  • * fix(event): truncate event notes on a character boundary by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17581
  • * fix(cel): requeue namespaced policies on PolicyException changes by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17641
  • * fix: nil pointer dereference in validation engine on UPDATE requests by @AftAb-25 in https://github.com/kyverno/kyverno/pull/17355
  • * fix(cli): close the junit failure element without detailed results by @Ahmad-Faraj in https://github.com/kyverno/kyverno/pull/17560
  • * fix(cli): preserve GeneratingPolicy skips in test results by @Om-Beast in https://github.com/kyverno/kyverno/pull/17388
  • * fix: preserve MutatingPolicy reinvocation policy by @pyd-07 in https://github.com/kyverno/kyverno/pull/17324
  • * fix(controllers): honor resourceFilters in cleanup and deleting controllers by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17632
  • * fix(background): resolve generate triggers by name instead of listing the namespace by @kmehta-code in https://github.com/kyverno/kyverno/pull/17702
  • * Fix panic in metrics policy controller and add comprehensive unit tests by @nishant-devv in https://github.com/kyverno/kyverno/pull/17750
  • * fix(cli): aggregate test filter errors using errors.Join by @JituRewar in https://github.com/kyverno/kyverno/pull/17760
  • * fix(cli): flatten kind: List resources in apply and fake dynamic client by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17504
  • * fix(mpol): evaluate matchConditions during background mutateExisting evaluation by @pujitha24 in https://github.com/kyverno/kyverno/pull/17433
  • * fix(cli): support all CEL policy exception versions in policy loader (#17743) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17769
  • * fix: verify annotations properly for cosign v2 and v3 by @aerosouund in https://github.com/kyverno/kyverno/pull/17794
  • * fix: prevent panic in jmespath random() function on invalid argument type by @Zara-5 in https://github.com/kyverno/kyverno/pull/17773
  • * fix: preserve Cosign errors in image validation messages by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17606
  • * fix(chart): add policies.kyverno.io types to the Grafana dashboard by @VijayabaskarR-06 in https://github.com/kyverno/kyverno/pull/17800
  • * fix: mark admission replicas unready after informer watch failures by @ANAMASGARD in https://github.com/kyverno/kyverno/pull/17610
  • * fix(cli): report excluded DeletingPolicy resources as skipped by @pyd-07 in https://github.com/kyverno/kyverno/pull/17458
  • * fix(status): heal WebhookConfigured condition once a VAP is generated by @pujitha24 in https://github.com/kyverno/kyverno/pull/17119
  • * fix: dont treat missing digests when MutateDigest==false as an error by @aerosouund in https://github.com/kyverno/kyverno/pull/17841
  • * fix: evaluate ImageValidatingPolicies concurrently by @pyd-07 in https://github.com/kyverno/kyverno/pull/17496
  • * fix(helm): scope scale-to-zero hook to the release by @KKamJi98 in https://github.com/kyverno/kyverno/pull/17840
  • * fix(charts): stop denying Windows pods and refresh PSA allow-lists by @Suhani95 in https://github.com/kyverno/kyverno/pull/17684
  • * fix(charts): enforce drop ALL and deny pod-level runAsNonRoot=false in PSS CEL policies by @Suhani95 in https://github.com/kyverno/kyverno/pull/17672
  • * fix(ivpol): give each policy its own image context during concurrent evaluation by @rx18-eng in https://github.com/kyverno/kyverno/pull/17860
  • * fix(ivpol): contain panics in per-policy evaluation goroutines by @rx18-eng in https://github.com/kyverno/kyverno/pull/17894
  • * fix(cli): propagate messageExpression errors to fail cli tests by @nishant-devv in https://github.com/kyverno/kyverno/pull/17863
  • * fix: apply autogen path rewrite to PolicyException matchConditions (#16956) by @nishant-devv in https://github.com/kyverno/kyverno/pull/17856
  • * fix(cli): restore test checks with CEL expressions by @afarbos in https://github.com/kyverno/kyverno/pull/17897
  • * fix(vpol): keep controller metadata paths in autogen'd PolicyExceptions by @ManojLamani in https://github.com/kyverno/kyverno/pull/17903
  • * fix(ivpol): propagate the admission request context to image verification by @rx18-eng in https://github.com/kyverno/kyverno/pull/17895
  • * fix(mutate): escape YAML-forbidden characters in patchStrategicMerge by @thebearmayor in https://github.com/kyverno/kyverno/pull/17881
  • * fix(cli): prevent nil pointer dereference when target has no patched resource by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17843
  • * fix(ivpol): skip registry fetch when image verification is cached (#17969) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17974
  • * fix(imageverify): bind verification cache entries to the content and attestors they verified by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17993
  • * fix(security): CEL API path validation and mpol namespace confinement by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17985
  • * fix(vap): apply the runtime PolicyException gates in the CEL admission-policy generator by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17986
  • * fix: preserve controller-owned generation labels by @sagark-nirmata in https://github.com/kyverno/kyverno/pull/17938
  • * fix(engine): handle multiple cosign attestation versions by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/18010
  • * fix: honor wildcard excludeResourceRules in generateExisting by @Siddhartha-singh01 in https://github.com/kyverno/kyverno/pull/18026
  • * fix(cli): use Report kind for namespaced OpenReports output by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/17809
  • * fix(chart): grant the background controller what Kyverno aggregates i… by @WHOIM1205 in https://github.com/kyverno/kyverno/pull/18019
  • * fix(generate): fix GeneratingPolicy synchronization for custom resources and multiple triggers by @rx18-eng in https://github.com/kyverno/kyverno/pull/16748
  • * fix(metrics): cache GetManager() result in registerPolicyChangesMetric by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/17862
  • * fix(vpol): honour failurePolicy Ignore for runtime errors in the admission handler by @VijayabaskarR-06 in https://github.com/kyverno/kyverno/pull/17909
  • * fix(imageverify): give the image verify cache a usable byte budget by @rx18-eng in https://github.com/kyverno/kyverno/pull/17911
  • * fix(imageverify): extract newest attestation for ImageValidatingPolicy by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/18049
  • * fix(ivpol): report missing annotation keys instead of %!s(<nil>) by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/18060
  • * fix(webhook): populate image verification policies on fine-grained webhook routes by @nishant-devv in https://github.com/kyverno/kyverno/pull/18045
  • * fix(autogen): extract pod templates in a stable order by @ManojLamani in https://github.com/kyverno/kyverno/pull/17981
  • * fix(chart): honor global image registry for webhooks cleanup by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17970
  • * fix(cel/autogen): preserve object.metadata.name in autogen messageExpression by @nishant-devv in https://github.com/kyverno/kyverno/pull/17899
  • * fix(cli): count and print each MutatingPolicy result once by @harshrajdebug in https://github.com/kyverno/kyverno/pull/17838
  • * fix(cli): exclude target-only MutatingPolicies from trigger evaluation by @Elvand-Lie in https://github.com/kyverno/kyverno/pull/17796
  • * fix(ext/cluster): block non-GET RawAbsPath from reaching the real client by @RudraDudhat2509 in https://github.com/kyverno/kyverno/pull/17791
  • * fix: propagate anchor errors using errors.As and Unwrap() method by @JituRewar in https://github.com/kyverno/kyverno/pull/17789
  • * fix(ext/yaml): don't swallow YAML syntax errors in SplitDocuments by @RudraDudhat2509 in https://github.com/kyverno/kyverno/pull/17785
  • * fix(webhook): guard nil Scope dereference in sortedRules to prevent controller panic by @7se7en72025 in https://github.com/kyverno/kyverno/pull/17457
  • * fix(config): reset matchConditions and updateRequestThreshold on unload by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/17407
  • * fix(imageverify): reject non-string attestation fields instead of panicking by @omlahore in https://github.com/kyverno/kyverno/pull/17046
  • fix: avoid nil pointer panic verifying sigstore bundle attestations without a type
  • single-flight discovery refetches on cache misses
  • do not panic on a JSON patch value holding object initializers
  • skip CT log key loading for keyed cosign verification
  • Fix unchecked type assertion panic in apiCall.transformAndStore
  • --explain never re-runs expressions with non-deterministic results
  • drop gone downstreams from the generate watch cache
  • recover UpdateRequests left with an empty state
  • register resource CEL library for PolicyExceptions
  • preserve nanosecond precision in PolicyReport aggregation
  • honor failure policy ignore
  • preserve deterministic evaluation response ordering
  • guard cleanup deletes with object identity preconditions
  • restore verified referrers on a cache hit
  • resolve namespaces from live cluster in CEL engines under --cluster
  • fix data race between OnChanged and notify in discovery client
  • scope namespaced image policy credentials by namespace
  • use the workload's namespace for extracted pod templates
  • leave day-of-week as wildcard in time_to_cron
  • recover backing informers after transient relist failures
  • trace for ivpol policies in live admission path
  • respect predicate filter on JSON payloads in vpol Handle()
  • evaluate policies when predicate is nil in Evaluate()
  • dont run resource version migration for the old policy apis
  • fix: handle missing reports CRDs as no-op in kyverno-init

value changes (60)

  • * chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.4 to 5.0.6 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16933
  • * chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.29.1 to 2026.08.03.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16934
  • * chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16936
  • * chore(deps): Upgrade robfig/cron to v3 by @chimanjain in https://github.com/kyverno/kyverno/pull/16932
  • * chore(deps): bump the sigstore group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16935
  • * chore(deps): bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16937
  • * chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.03.1 to 2026.08.03.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/16957
  • * chore(deps): bump fluxcd/flux2/action from 2.9.3 to 2.9.4 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17006
  • * chore(deps): bump the otel group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17007
  • * chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17009
  • * chore(deps): bump github.com/sigstore/cosign/v3 from 3.1.2 to 3.1.3 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17008
  • * chore(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17067
  • * chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17141
  • * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17196
  • * chore(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.0 to 1.39.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17198
  • * chore(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17185
  • * chore(deps): bump github.com/aptible/supercronic from 0.2.48 to 0.2.49 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17197
  • * fix(helm): bump bundled reports-server dependency to v0.1.7 by @pujitha24 in https://github.com/kyverno/kyverno/pull/17138
  • * fix(deps): update golang.org/x/net to v0.58.0 by @Sashang-debug in https://github.com/kyverno/kyverno/pull/17242
  • * fix: apply HTTP blocklist to apiCall.service executor by @IceCodeBear in https://github.com/kyverno/kyverno/pull/17234
  • * fix: harden apiCall.service egress proxy path and cover CABundle branch by @realshuting in https://github.com/kyverno/kyverno/pull/17299
  • * chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17293
  • * chore(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17297
  • * chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17294
  • * chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17360
  • * fix(deps): use upstream rekor v1.5.4 instead of the fork replace by @omlahore in https://github.com/kyverno/kyverno/pull/17332
  • * chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17415
  • * chore(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17416
  • * fix: use Docker CE instead of moby for docker-outside-of-docker feature by @tendinginfinity24 in https://github.com/kyverno/kyverno/pull/16596
  • * chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17468
  • * chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17500
  • * chore(deps): bump fluxcd/flux2/action from 2.9.4 to 2.9.5 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17442
  • * chore(deps): bump sigs.k8s.io/controller-tools from 0.21.0 to 0.22.0 in /hack/controller-gen by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17467
  • * chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17499
  • * perf(cel): build the request activation once per admission request by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17572
  • * perf(cel): hoist the request-map build in the ivpol engine by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17585
  • * bump go to 1.27 and sigstore to v1.10.10 by @aerosouund in https://github.com/kyverno/kyverno/pull/17776
  • * chore(deps): bump github.com/sigstore/sigstore from 1.10.10 to 1.11.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17801
  • * chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17681
  • * chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17571
  • * chore(deps): bump the sigstore group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/17568
  • * fix(imageverify): bound the reads image verification makes from a registry by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17995
  • * fix(wildcard): replace the glob matcher with a bounded two-pointer algorithm by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17990
  • * fix(cel): bound the cost of CEL policy expression evaluation by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17988
  • bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2
  • log watcher events at debug verbosity
  • bump the sigstore group across 1 directory with 4 updates
  • propagate request context and memoize image metadata per evaluation
  • Improve terminal output readability with colors for kyverno jp function
  • reuse context and compiled CEL policy providers in apply
  • retain released legacy image extractor filter schema
  • bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3
  • bump github.com/cenkalti/backoff/v7 from 7.0.0 to 7.0.1
  • bump Kubernetes libraries to v0.37 and controller-runtime to v0.25
  • add semantic color formatting to kyverno apply output
  • add semantic colors to test summary and progress output
  • improve ivCache hit rate by dropping policy info from key
  • mark legacy policies not ready in kyverno-init
  • mark legacy cleanup policies not ready in kyverno-init
  • extend provider & compiler caching to GeneratingPolicies and DeletingPolicies

additions (28)

  • * feat(helm): add configurable lifecycle hooks to all controllers by @mhulscher in https://github.com/kyverno/kyverno/pull/16444
  • * feat(cli): support JSON and YAML output for version command by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16623
  • * feat: phase1 deprecation warning plumbing and CLI warning enforcement by @realshuting in https://github.com/kyverno/kyverno/pull/17362
  • * feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 by @realshuting in https://github.com/kyverno/kyverno/pull/17428
  • * feat: signal remaining legacy kyverno.io policies on startup and via metrics by @raunak-nirmata in https://github.com/kyverno/kyverno/pull/17519
  • * feat(kyvernopre): warn about orphaned legacy webhook configurations by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17678
  • * feat(cli): enable OCI-native test and apply flows (#17666) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17689
  • * feat(cli): implement CEL resources only for kyverno oci (#17661) by @anushkagupta200615-jpg in https://github.com/kyverno/kyverno/pull/17671
  • * feat: add compensating controls to policy exceptions by @mastersans in https://github.com/kyverno/kyverno/pull/17690
  • * feat: support additionalExtensions for keyless signing in the ivpol by @aerosouund in https://github.com/kyverno/kyverno/pull/17813
  • * Vpol wiring for trace feature by @aditip149209 in https://github.com/kyverno/kyverno/pull/17695
  • * feat(charts): add disallow-host-probes Baseline PSS policy by @Suhani95 in https://github.com/kyverno/kyverno/pull/17716
  • * ivpol: Add diagnostics to cli for notary verification by @aditip149209 in https://github.com/kyverno/kyverno/pull/17902
  • * feat: implement UpdateRequest cleanup TTL via configuration by @Mannan-Ali in https://github.com/kyverno/kyverno/pull/17429
  • * feat(report): classify validating admission policies by @ShreyanshK1103 in https://github.com/kyverno/kyverno/pull/17926
  • specify and implement the CEL policy bundle OCI format
  • log decision traces in the admission controller behind --enable…
  • add automated PSA release monitoring to prevent PSS policy drift
  • add output-dir and output-file flags to apply
  • allow configuring generation label protection
  • select the Pod Security Admission version for policies
  • add a CEL expression field to projections
  • measure their use
  • support explicit enabled toggle for pod controllers
  • parse the OCI bundle descriptor and derive named sets
  • support JSON document mutation with MutatingPolicy JSON mode
  • add kyverno oci validate with CEL-aware bundle validation
  • add kyverno oci inspect and oci resolve

constraints (2)

  • * fix(kube): support multi-digit API version strings in ParseKindSelector by @AYUSH-P-SINGH in https://github.com/kyverno/kyverno/pull/16874
  • * feat(charts): support Pod user namespaces in PSS policies by @Suhani95 in https://github.com/kyverno/kyverno/pull/17693

removals (1)

  • * feat: remove json scan command by @eddycharly in https://github.com/kyverno/kyverno/pull/16943
Kyverno 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Kyverno 릴리스 전체 →