Skip to content
Release Radar

Kyverno

Security

Policy engine designed for Kubernetes

kyverno/kyvernoWebsiteDocumentation
v1.19.121 days after v1.19.0
View on GitHub

Release history

v1.19.1

CompareGitHub

What's Changed

New Contributors

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.19.0...v1.19.1

What's Changed

…(truncated)

What's Changed

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.18.1...v1.18.2

What's Changed

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.18.0...v1.18.1

Kyverno 1.18 Release Notes

Highlights

  • Secure HTTP calls with blocklist/allowlist: HTTP context loading now enforces a configurable blocklist and scoped token authorization, improving security posture for policies that perform external HTTP calls (#15789, #15779).
  • Namespaced image registry credentials: imageRegistryCredentials can now reference namespaced secrets and pod-level imagePullSecrets for image verification (#15112).
  • CLI expanded policy support: The kyverno apply and kyverno test commands now support cleanup policies, HTTP/Envoy authz policies, and mutateExisting MutatingPolicies (#15732, #15645, #15691, #15253).
  • Success event filtering: A new successEventActions ConfigMap parameter allows fine-grained control over which success events are emitted (#15466).

New Features

  • Add support for gzip library and confidential containers example (#15679)
  • Add successEventActions parameter to filter which success events are emitted (#15466)
  • Add --exemplarFilter flag to control exemplar collection in metrics (#15611)
  • Add exceptions-with-policies flag to kyverno apply CLI (#15167)
  • Add projected service account token support in Helm chart (#14766)
  • Add admission-controller autoscaling based on memory utilization (#15303)
  • Add TLS encryption to /metrics endpoint (#14232)
  • Allow output for missing resources in CLI tests (#14194)
  • Support uri suffix for defaultRegistry in config (#15258)
  • Support mutateExisting MutatingPolicy in CLI test (#15253)
  • Support cleanup policies in kyverno apply command (#15732)
  • Support HTTP/Envoy authz policies in kyverno apply (#15645)
  • Support authz policies in kyverno test (#15691)
  • Permit imageRegistryCredentials to use namespaced secrets and pod-level imagePullSecrets (#15112)
  • Secure HTTP calls: enforce blocklist and add FLAG_HTTP_BLOCKLIST override (#15789)
  • Use scoped token for request authorization in HTTP context (#15779)
  • Add controller deployment labels to Helm chart (#15083)
  • Add extraVolumes and extraVolumeMounts support to Helm chart (#14668)
  • Add Global.PriorityClassName Helm value with pod templating (#15712)

Policies Helm Chart

  • Add support for excludes (namespace, subject, resource rules, and custom matchConditions) in ValidatingPolicies (#15739)
  • Allow auditAnnotation configuration of ValidatingPolicies (#15777)
  • Add perPolicy overrides for custom annotations (#15805)

Bug Fixes

Image Verification

  • Fix matchImageReferences not filtering images properly (#15834)
  • Fix ivpol: remove early return on matchImageReference so CEL evaluation is not skipped (#15882)
  • Fix processResourceWithPatches returning nil on patch failure, silently bypassing image verification (#15705)
  • Fix imageVerify multi-signature annotation validation bug (#14500)
  • Fix: set UseSignedTimestamps when TSACertChain is provided in IVPOL cosign verifier (#15305)
  • Fix: enable signed timestamp verification when TSA cert chain is provided (#15192)
  • Fix: relax EKU validation for DigiCert TSA (#15093, #15148)
  • Fix: use kyverno namespace secrets in reports scanner for ivpol (#15220)
  • Fix: nil pointer dereference in Certificates branch of manifest validation (#15152)
  • Fix: add cert identity verification for buildpolicy (#15239)
  • Fix: close ReadCloser from layer.Uncompressed() in image verification (#15161)
  • Fix: add HTTP 429 retry in image data loader (#15413)
  • Fix: release RLock before early return in imageContext.Get (#15404)
  • Fix: add synchronization to TUF client initialization to prevent data race (#14829)
  • Fix: propagate errors in notary repositoryClient.Resolve() (#15222)
  • Fix: missing ivpol autogen for namespaced policies; simplify ivpol/vpol namespaced handling in CLI (#15320)

CLI

  • Fix: CLI CRD support without cluster connection (#13565)
  • Fix: bypass rule name matching for ruleless policies in CLI (#15757)
  • Fix: add list GVK to fake cluster scheme to prevent mutateExisting panic (#15746)
  • Fix: pass CRD-aware RESTMapper to GeneratingPolicy test path (#15561)
  • Fix: correct test result reporting for legacy policies and CEL engine errors (#15361)
  • Fix: display NonFatalErrors in CLI test command (#15725)
  • Fix: return error instead of panic when imageRegistryCredentials.secrets are used in CLI (#15061)
  • Fix: add default message when rule message is empty in CLI (#14700)
  • Fix: three bugs in CLI apply command (#15317)
  • Fix: CLI failing selector-based policies when they did not match the resource (#15236)
  • Fix: close leaked file handles in CLI apply command (#15151, #15150)
  • Fix: return proper error on non-OK HTTP status in CLI resource and policy loading (#15153)
  • Fix: prevent segfault when applying K8s-mode policy to JSON payload (#15332)
  • Fix: support piped v1.List objects in apply command (#13860)
  • Fix: check all rules in the test in case no rule is specified (#11739)

Policy Engine

  • Fix: bypass blocklist for cluster-scoped HTTP policies (#15880)
  • Fix: HTTP CEL compilation error on NVPOL (#15874)
  • Fix: compile dpol variables before conditions to allow variable references (#15843)
  • Fix: use extended compiler for mpol variables and conditions (#15669)
  • Fix: inject namespaceObject into MutatingPolicy CEL context (#15625)
  • Fix: handle mutating policy variable compile errors (#15453)
  • Fix: polex filtering in vpol engine (#15692)
  • Fix vpol/ivpol: align auditAnnotation behaviour with upstream VAP (#15817)
  • Fix: fetch namespace-scoped enforce policies in audit query path (#15080)
  • Fix: UserInfo error in CEL expressions for VAPs and MAPs in background scanning (#15449)
  • Fix: include auditWarn policies in namespace selector check (#15107)
  • Fix: panic in ExpandInMetadata when metadata is not a map (#15245)
  • Fix: prevent nil pointer panic on malformed AdmissionReview request (#15251)
  • Fix: clear stale error in GlobalContextEntry after successful API call (#15328)
  • Fix: prevent defer from overwriting named return error in validateOld (#15438)
  • Fix: `c

…(truncated)

What's Changed

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.16.3...v1.16.4

What's Changed

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.17.1...v1.17.2