feat(github/crds-kyverno): update v1.10.3 ➼ v1.13.2 #1485
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![tinfoild[bot]](https://avatars.githubusercontent.com/u/5709019?s=60&v=4){kind=small}
Deploying jjgadgets-biohazard with
|
| Latest commit: |
b7a7606
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://5fc6465d.jjgadgets-biohazard.pages.dev |
| Branch Preview URL: | https://renovate-crds-kyverno-1-x.jjgadgets-biohazard.pages.dev |
--- kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config GitRepository: flux-system/crds-kyverno
+++ kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config GitRepository: flux-system/crds-kyverno
@@ -12,9 +12,9 @@
# exclude all
/*
# include crd directory
!/config/crds
interval: 1h
ref:
- tag: v1.10.3
+ tag: v1.13.2
url: https://github.com/kyverno/kyverno.git
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.10.3->v1.13.2Release Notes
kyverno/kyverno (crds-kyverno)
v1.13.2Compare Source
❗ Important Notice ❗
config.webhooksfield (#11651)✨ Added ✨
manifestIndexto ImageRegistry context (#9883)patchedResourcesin the test results to specify patched resources (#11297, #11686)Helm
allowExistingViolationsoption in kyverno-policies chart (#11656,#11714)🐛 Fixed 🐛
Helm
🔧 Others 🔧
v1.13.1Compare Source
✨ Added ✨
🐛 Fixed 🐛
emitWarningfield in the v2beta1 policy (#11489)celPreconditions(#11503)namespaceSelectorlist in the webhook (#11516)Helm
🔧 Others 🔧
v1.13.0Compare Source
Note
reportsChunkSize.--tufRootRawflag to pass tuf root for custom sigstore deployments.v1.12.6Compare Source
🐛 Fixed 🐛
updaterequestcleanup cronjob (#10678)useCachefield in image verification policies (#10709)🔧 Others 🔧
v1.12.5Compare Source
✨ Added ✨
ephemeralreportsgenerated from the admission events which is used to create policy reports (#10499, #10596, #10610, #10613)updaterequestswhich is used to apply generate and mutate existing rules (#10382)🐛 Fixed 🐛
ephemeralreportsto use generate name to avoid duplicate names (#10491)foreachrules (#10615)🔧 Others 🔧
v1.12.4Compare Source
❗Important Notice ❗
If you are running 1.12, please upgrade to this version to pick up the fix for the ephemeralreports piling-up issue. Check this post and understand how to recover from an ETCD outage:
Amazon EKS- managing and fixing ETCD database size
[updated] If you are seeing consistent creation of ephemeralreports, you can:
--aggregationWorkersto increase the capacity of consuming ephemeralreports, see this comment. It can be configured directly via the container flag, or through Helm extraArgs.You can also find the script to delete a large number of reports here, thanks to @andrew-bulford-form3.
🐛 Fixed 🐛
🔧 Others 🔧
v1.12.3Compare Source
❗Important Notice ❗
If you are running 1.12, please upgrade to v1.12.4 to pick up the fix for the ephemeralreports piling-up issue. Check this post and
understand how to recover from an ETCD outage:
Amazon EKS- managing and fixing ETCD database size
If you are seeing consistent creation of ephemeralreports, please track this issue to avoid creation of too many ephemeralreports.
✨ Added ✨
🔧 Others 🔧
v1.12.2Compare Source
❗Important Notice ❗
If you are running 1.12, please upgrade to v1.12.4 to pick up the fix for the ephemeralreports piling-up issue. Check this post and
understand how to recover from an ETCD outage:
Amazon EKS- managing and fixing ETCD database size
If you are seeing consistent creation of ephemeralreports, please track this issue to avoid creation of too many ephemeralreports.
✨ Added ✨
Helm
🐛 Fixed 🐛
pod/execsubresource (#9855)policyexceptionsregardless of condition failures (#9994)pods/ephemeralcontainers, resourceNames field (#10162, #10187, #10208)foreachmutate policies withDescendingorder defined causing unexpected patches (#10252)🔧 Others 🔧
preallocto enforce slice declarations best practice (#10250)v1.12.1Compare Source
❗Important Notice ❗
If you are running 1.12, please upgrade to v1.12.4 to pick up the fix for the ephemeralreports piling-up issue. Check this post and
understand how to recover from an ETCD outage:
Amazon EKS- managing and fixing ETCD database size
If you are seeing consistent creation of ephemeralreports, please track this issue to avoid creation of too many ephemeralreports.
🐛 Fixed 🐛
celPreconditions.matchConditionsaren't met (#9940)namespaceObjectfor Kyverno policies (#9977, #9978)🔧 Others 🔧
v1.12.0Compare Source
1.12 Release Notes
❗ Importance Notice ❗
If you are running 1.12, please upgrade to v1.12.4 to pick up the fix for the ephemeralreports piling-up issue. Check this post and
understand how to recover from an ETCD outage:
Amazon EKS- managing and fixing ETCD database size
If you are seeing consistent creation of ephemeralreports, please track this issue to avoid creation of too many ephemeralreports.
Several critical issues are found in 1.12.0 and are being closely monitored within the 1.12.1 milestone. Please hold your upgrade to this release until 1.12.1 comes out.
❗ Breaking (Potentially) ❗
InandNotIn) will be blocked. Please see the current list of available operators here (#8624)✨ Added ✨
matchConditionsavailable in Kubernetes 1.27+ (#8065, #8437, #9483, #9599)--protectManagedResourcesto the cleanup controller (#8566)--renewBeforeto the admission cleanup controllers to configure the cert renewal time (#8567)--loggingtsFormatwhich can be used to change the time format of logs (#9276)validate.podSecurity(#9343, #9817)validate.podSecurity) has a new ability to exclude based on restricted fields (exclude.restrictedFieldand associated values (#8585, #9770, #9658)skipImageReferencesallowing you to exclude certain images (#8633)orphanDownstreamOnPolicyDeletewhich will preserve downstream resources when the policy/rule is deleted (#9579)reports.kyverno.iofor storing new ephemeral report kindsEphemeralReportsandClusterEphemeralReports(#9521, #9537)is_external_url()JMESPath function to determine whether a given URL is an external URL (#8614)sha256()JMESPath function to convert a string of any length to a fixed hash value (#9144)migratecommand which is used to migrate Kyverno resources to the current API version (#9296)jsoncommand which incorporates the Kyverno JSON subproject into the main CLI allowing for testing of any JSON content (#9639, #9651)testcommand now supports the same assertion trees available in Chainsaw (#9380)applycommand now supports ValidatingAdmissionPolicyBindings (#9468, #9751, #9759)applyandtestcommands now support Policy Exceptions (#9525, #9624, #9714, #9749)--resourcesflag as an alias for the existing--resourceflag (#9749)Helm
revisionHistoryLimit(#8907)spec.schemaValidationfield is formally deprecated. As of 1.11 it has no effect. (#9189)--reportsChunkSizeflag is deprecated and has no effect since aggregation has changed (#9697)--imageSignatureRepositoryflag is deprecated and has no effect, use theverifyImages.Repositoryfield instead (#9698)time_parse()JMESPath filter now supports epoch time (#9173)Helm
dashboard.jsontokyverno-dashboard.json(#9041)Performance
🐛 Fixed 🐛
failurePolicywas set toIgnore(#8952)EnforceandfailurePolicyof Ignore (#8953)-vcontainer flag for logging was not honored (#9163)excludewas used in the rule (#9331)anyPatternvalidate rules (#9713)cloneListgenerate policies withapplycommand (#9036)useServerSideApplyfield now work properly (#9385)applycommand to panic when applying a mutate existing rule (#9492)applycommand where some errors weren't shown (#9533)applycommand where aforeachwith zero elements was askip(#9534, #9543)--warn-exit-codestopped working (#9828)maxQueuedEvents(#10031)Helm
Click to expand all PRs
#10013 chore: bump chainsaw to v0.1.9
#10025 fix: add rekor opts to cosign certificate verification and make rekor url optional
#10039 chore: bump cosign to v2.2.4
#10031 fix: re-use the maxQueuedEvents
#10047 fix: policy status reconciliation
#10056 feat(audit): use a worker pool for Audit policies
#10059 fix: add mutex to mock policy context builder
#9989 chore: bump kyverno-json to latest
#9997 fix(autogen): only generate rule for request kind
#9950 feat: set default exclusions in webhooks
#9968 fix: deferred loader panic when mutate and generate policies are applied
#9971 fix: cosign ctlog unit tests
#9903 fix(globalcontext): panics and validation
#9893 fix: properly update policy context after preexisting resource in violation check
#9849 fix: release CRDs manifests
#9845 fix: add missing unit tests for podSecurity.hostpathVolume check
#9838 fix: use gcr crane opts while fetching image descriptors
#9835 fix: remove duplicate chainsaw tests for PSA
#9828 [Bug] [CLI] Restore warn-exit-code functionality for apply command
#9817 fix: add podSecurity validation checks for exceptions
#9813 fix(globalcontext): old WaitGroup not stopping
#9791 fix: remove unnecessary podSecurity chainsaw test
#9790 fix: remove unnecessary validation check for podSecurity rule
#9783 update versions
#9781 chore: add tests for exceptions in the CLI
#9775 chore: default logging format to rfc3339
#9770 fix: add validation check for podSecurity subrule
#9763 chore: bump chainsaw
#9759 feat: support bindings in Kyvenro CLI test command
#9751 feat: apply VAP bindings in CLI apply command in offline mode
#9749 add plural form aliases for resources and exceptions flags
#9719 fix: Policies skipped because of preconditions not met should not be included in admission requests denial responses
#9714 fix: add the support of v2alpha1 exceptions in the CLI
#9713 Fix :variables are not getting processed in validation message for "anyPattern"
#9710 feat: enhance global context
#9709 chore: bump otel deps
#9698 fix: remove deprecated imageSignatureRepository flag
#9697 fix: reports aggregation
#9691 fix: modify the conformance config name
#9690 chore: rename admission to ephemeral in reports aggregation controller
#9682 chore(deps): bump kyverno/action-install-chainsaw from 0.1.2 to 0.1.3
#9680 chore: bump kind and k8s images
#9679 fix: don't delete garbage collected policy reports
#9678 feat(validation-webhook): validate global context reference
#9677 feat: remove admission report controller
#9672 feat: add chainsaw tests for exceptions
#9667 feat: add chainsaw tests for pod security in exceptions
#9661 test(globalcontext): add e2e tests
#9658 [Bug] Fix message and formatting of podSecurity validation failure with restrictedField
#9657 fix: add missing migrations
#9652 chore(globalcontext): remove global context flag
#9651 feat: add scan command for generic resources
#9645 feat: add chainsaw test for policy webhook based configuration
#9643 fix: global context validation
#9639 feat: add root command to process generic json resources
#9630 chore: remove renovate config
#9628 feat: add chainsaw tests for global context crd validation
#9626 changed the log level in match policy context
#9624 support -e shorthand letter with --exception flag
#9621 fix: global context crd improvements
#9620 feat: consider maxAPICallResponseLength
#9619 feat: add global context entry validation webhook
#9618 chore: move global context package out of engine
#9616 feat: use the check block for checking CLI output in chainsaw tests
#9615 feat: update refreshInterval in globalcontext CRD to use a duration
#9614 feat: add global context support in helm chart
#9609 make exception in cli exportable
#9608 sanity check in parent chart for crd-controller mismatch
#9606 chore: enable chainsaw fail fast
#9602 feat: add globalcontext loader and interface
#9601 feat: add globalcontext controller
#9600 chore(deps): bump github.com/sigstore/cosign/v2 from 2.2.2 to 2.2.3
#9599 feat: apply
.matchConditionswhen generating reports#9598 fix: client codegen not deleting old files
#9597 fix: codecov missing token
#9596 fix: make ApplyCommandConfig public again
#9595 feat: add global context crd to codegen
#9592 fix: codecov args
#9591 feat: add global context crd
#9585 fix: update cli docs
#9583 test: added test for pkg/utils/policy/marshal.go
#9579 feat (generate): add
orphanDownstreamOnPolicyDeleteto preserve downstream on policy deletion#9574 fix: nancy ignore
#9573 chore: small nits in cli test command
#9572 fix: omit events flag
#9570 chore: remove reports aggregation per namespace
#9569 configured backoff limit in chart cronjobs
#9566 feat: Support CEL expression warnings
#9561 chore: add chainsaw tests for policy based webhook configuration
#9555 fix: helm chart jobs
#9554 fix: nancy ignore
#9553 fix: make alternate reports storage transparent
#9552 Add Helm note for AKS users
#9546 feat: add openapi-gen to policyreports
#9543 fix: follow up for #9534
#9542 fix: CRDs codegen
#9540 chore: bump a couple of deps
#9539 chore: remove reference to kuttl
#9538 test: added test for pkg/utils/admission/metadata.go
#9537 refactor: use single type for ephemeral reports
#9535 chore: configure gh workflows schemas
#9534 fix: show skip when foreach with zero elements
#9533 Fix: not showing error during policy validation error
#9531 fix: move new reports api to top level folder
#9530 #9529 Support adding extra elements to the default resourceFilters list
#9525 Support PolicyExceptions with CLI
#9521 feat: add a new API group
reports.kyverno.io#9520 test: added test for pkg/utils/admission/policy.go
#9516 Move admission controller hardcoded wildcard permissions to new opt-out value
#9515 ci: add load testing workflow
#9509 fix: reduce logs in controllers when an item is not found
#9507 feat: add more granular rbac rules to remove wildcards
#9506 feat: support vap bindings in reports
#9495 test: added test for pkg/utils/admission/exception.go
#9493 chore(helm): omit normal events by default
#9492 fix: kyverno apply panic for mutate policies
#9487 chore: bump a couple of deps
#9486 test: added test for pkg/utils/admission/cleanup.go
#9483 feat: configure admission webhooks per policy
#9482 fix: align clusterroles and bindings names
#9481 feat: improve crd migration helm hooks
#9476 feat: support all valid jsonpatches in validation webhook
#9469 chore(contrib): add Khaled Emara as contributor
#9468 feat: support validatingadmissionpolicybindings in CLI apply command
#9467 update README for new features and OSS security index card
#9465 chore: load cli image when deploying locally
#9464 Update DEVELOPMENT.md
#9463 fix: change generic policy to not return any
#9461 Update CONTRIBUTORS.md
#9459 added tests for validate foreach with 0 elements
#9442 chore: bump otel deps
#9440 chore: bump a couple of deps
#9433 chore: use upstream cosign on main
#9428 fix: nancy ignore list
#9427 chore: bump json-patch
#9426 chore: bump a couple of deps
#9420 feat: migrate existing cleanup policies to the new storage version in helm hook
#9416 feat: use awslabs keychain for AWS and gcr keychain for GCP
#9412 feat: migrate existing policy exceptions to the new storage version in helm hook
#9408 chore: bump bitnami/kubectl
[#9395](https://redirect.github.com/ky
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.