File kyverno.changes of Package kyverno

Overview Repositories Revisions Requests Users Attributes Meta

File kyverno.changes of Package kyverno (Revision 0125aa64f70bed1206dc33b1436aaa27)

Currently displaying revision 0125aa64f70bed1206dc33b1436aaa27 , Show latest

-------------------------------------------------------------------
Wed Sep 07 06:59:32 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.3:
  * Cherry-pick #4398 - bump cosign to 1.11.0 (#4399)
  * Release v1.7.3 (#4394)
  * Fix deprecated  api policy issue (#4349) (#4350)
  * precondition failure will skip rule independent of audit or enforce mode (#4163) (#4296)

-------------------------------------------------------------------
Mon Jul 25 11:08:18 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.2:
  * tag v1.7.2 (#4261)
  * Use non-blocking channel send for UpdateWebhookChan (#4204) (#4247)
  * Release v1.7.2-rc2 (#4246)
  * fix split policyreport name with background scan (#4237) (#4245)
  * fix check depreciated api issue (#4243) (#4244)
  * fix kyverno cli policy-report typo (#4224) (#4232)
  * Limit queued events (#4233)
  * update cosign to v1.9.0 (#4231)
  * Only set up logging context if it will be used (#4213)
  * use the unstructured list instead of interface type (#4211)
  * Fix UpdateRequest labeling (#4199)
  * Release 1.7 (#4200)
  * external.metrics.k8s.io/v1beta1 issue (#4182)
  * delete policy reports on policy deletion (#4174) (#4175)
  * tag v1.7.2-rc1 (#4167)
  * feat: split policy report per policy bases (#4147) (#4166)
  * Re-implement #4159 (#4165)
  * Cherry pick #4155 (#4164)
  * Cherry-pick #4148
  * Use kyverno namespace informer to list pods while processing URs (#4156)
  * Cherry-pick #4138 to 1.7 (#4160)
  * fix: use dev tag for init container local build target (#4141)

-------------------------------------------------------------------
Wed Jun 22 08:17:51 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.1:
  * tag v1.7.1 (#4132)
  * fix build failures
  * fix: bool fields in image verification types (#4053)
  * cherry-pick #4013
  * Release 1.7 (#4130)
  * fix: use policyName key to get the policy name (#4113)
  * chore(dockerfile): use buildx features for cross-compilation (#4023) (#4123)
  * Updated jp command flags and also added URL for help. (#4122)
  * fix: handle nil ur while retry (#4109)
  * Release 1.7 (#4099)
  * Bump Charts version to 2.5.0 (#4092)
  * bump chart versions to v2.4.2 (#4089)
  * cherry-pick #4079 (#4088)
  * Remove s390X (#4063) (#4064)
  * Bump charts version to 2.4.1 (#4061)
  * Ensure preconditions are present with default values (#4046)
  * Fix handling of kyverno-policies version check when port in image tag (#4042)

-------------------------------------------------------------------
Sat Jun 04 18:55:18 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.0:
  * Tag v1.7.0 (#4050)
  * refactor: bump KIND version to use v1.24.0 k8s release (#4049)
  * fix policy typo (#4039) (#4045)
  * Tag 1.7.0-rc3 (#4036)
  * Fix labels with invalid charrs (#4034) (#4035)
  * Cherry-pick #4022 (#4033)
  * fix vulnerable (#4027) (#4028)
  * Request operation value by default to CREATE (#3894) (#4026)
  * Release v1.7.0-rc2 (#4021)
  * Cherry pick #4007 #4008 (#4020)
  * fix: stop mutation policies when autogen internals is enabled (#4004,#4009,#3996) (#4016)
  * cherry-pick fix attestation checks https://github.com/kyverno/kyverno/pull/3999 (#4015)
  * refactor: add policy event listener in ur controller (#4012) (#4014)
  * Support `@` for mutate targets (#3998) (#4010)
  * fix: stop mutating cached resource in ur controller (#4003) (#4006)
  * fix: move ur controller filtering in reconciler (#3964) (#3994)
  * fix: release ur when handler pod is gone (#3993)
  * fix: mark ur retry on conflict (#3961) (#3963)
  * fix: replica count in helm chart (#3954) (#3962)
  * Cherry pick #3953 #3955 (#3960)
  * fix: handle UR delete once trigger namespace deleted (#3934) (#3938)
  * fix: use patch to update handler status in UR (#3927)
  * Cleanup the UR for mutate policies once it's completed (#3923)
  * Remove permissions in helm-release workflow (#3901) (#3903)
  * Release v1.7.0-rc1 (#3896)
  * cherry-pick #3893 (#3895)
  * Fix subject match selector issue in cli (#3887) (#3892)
  * skip var checks in attestations (#3876) (#3885)
  * fix: undo length validation check for generate rule resource name (#3865) (#3872)
  * Handle errors properly for mutate and generate on existing resources (#3863) (#3866)
  * refactor: remove unused functions (#3844)
  * handle subresources (#3841) (#3848)
  * feat: trigger generate on existing matched resource (#3819)
  * refactor: webhook config package (part 2) (#3833)
  * refactor: webhookconfig package (part 1) (#3831)
  * fix check and add logs (#3838)
  * Allow variables of any kind to be defined (#3828)
  * fix: policy deletion in webhookconfig (#3832)
  * refactor: imported pkg redeclared and a few other unused func (#3827)
  * refactor: shell to prevent globbing and word splitting (#3829)
  * CLI should respect scored annotation for warnings (#3821)
  * Add an object_from_lists function (#3824)
  * Improve logging and error handling in json context (#3825)
  * Relax JMESPath variable validation (#3826)
  * Load `mutate.targets` via dclient (#3797)
  * Cert attestor (#3809)
  * handle duplicate images; use container name as key (#3779)
  * fix: autogen rules in status (#3728)
  * refact: disable leader for update request controller (#3807)
  * chore: remove broken .ca from helm chart (#3811)
  * fix: remove k8s apiserver from self-generated cert (#3803)
  * Policy Validation check for onPolicyUpdate flag (#3814)
  * Add `handler` to `UR.status` (#3791)
  * fix: remove kubeconfig (#3802)
  * fix: cleanup old dependencies from go.sum and go.mod (#3806)
  * feat: parse all root CA certs (#3808)
  * removed kubeconfig flags (#3744)
  * Fix issue with image registry when decoding OCI descriptors with out of spec keys (#3799)
  * refactor: move config controller in controllers package (#3790)
  * chore: add informer util (#3796)
  * chore: remove useless util NewKubeClient (#3795)
  * fix: pod stay in terminating when scaling to 0 (#3793)
  * Add JMESPath Function `items` (#3777)
  * Fix Cli test for image verification (#3760)
  * Add rule to PolicyViolation event messages (#3787)
  * chore: remove config flags (#3786)
  * fix: add missing tombstone calls (#3784)
  * refactor: create a package for controllers and move certmanager in it (#3782)
  * refactor: policycache package logger (#3783)
  * refactor: move ImageExtractorConfigs in api package (#3781)
  * refactor: dclient package logger (#3778)
  * Fix PR update flow and allow updates from release branches (#3780)
  * fix: cert manager duplicate event handler (#3772)
  * webhookconfig: if services resource, add services/status as well (#3740)
  * refactor: dclient package (#3775)
  * refactor: replace clientset by inteface (#3774)
  * refactor: cosign package logger (#3773)
  * Bump cosign and sigstore version (#3771)
  * Auto-update PRs which are enabled for auto-merging (#3766)
  * refactor: wait for cache sync (#3765)
  * Allow kyverno jp to take yaml files as inputs (#3768)
  * Allow non-object type elements for foreach rules (#3763)
  * fix: logger call depth (#3759)
  * Reduce log verbosity for image extractors (#3764)
  * chore: remove unused resourcecache package (#3762)
  * refactor: remove unstructured usage from webhookconfig (#3737)
  * refactor: use typed informers and add tombstone support to webhookconfig (#3736)
  * Remove YAML multiline support in CM values (#3721)
  * cleanup event messages and sources (#3741)
  * Add tests for required checks for image verify (#3755)
  * Add error handling and log for image extractor errors (#3724)
  * Fix verify all images (#3748)
  * Retry policy creation to avoid flaky CRD readiness (#3752)
  * Fix test Summary printing for failure test cases (#3749)
  * Enable tests in makefile (#3699)
  * refactor: metrics package logger (#3734)
  * Use inclusive language (#3738)
  * fix: block policy for missing matched kind (#3733)
  * fix: missing image verification rules in autogen (#3729)
  * Convert GenerateRequest to UpdateRequest for backward compatibility (#3730)
  * refactor: autogen package logger (#3727)
  * fix: correct tombstone usage (#3718)
  * refactor: remove some api unnecessary pointers (4)  (#3713)
  * Set policy kind to generate events in the webhook (#3726)
  * Create UR for both mutate and generate policies (#3717)
  * fix: remove supported from autogen status (#3714)
  * fix: generated api reference docs (#3711)
  * refactor: remove some api unnecessary pointers (3) (#3707)
  * Optimize UR listing on policy events (#3712)
  * - Create events for imageVerify rules (#3710)
  * refactor: remove some api unnecessary pointers (2) (#3705)
  * fix: remove unused type TargetMutation (#3706)
  * refactor: remove some api unnecessary pointers (#3704)
  * add e2e tests for mutate existing policies (#3703)
  * Verify digest (#3679)
  * fix: kind wash in mutate policy helper (#3698)
  * refactor: auth package logger (#3696)
  * chore: remove unused custom expansions from client (#3697)
  * refactor: client gen code (#3695)
  * Fix test command git issue (#3692)
  * Enable verifyImages and CLI registry tests (#3684)
  * Cherry-pick release-1.6 Helm changes (#3689)
  * Show warnings in Helm chart installation; update issue templates (#3673)
  * refactor: use typed k8s client in tls package (#3678)
  * refactor: config package logger (#3683)
  * Fix flaky e2e tests for generate policies (#3681)
  * Fix regression in wildcard matches in In/AnyIn operators (#3686)
  * feat: remove deprecated flags (#3680)
  * Logic of match service account is fixed for namespace (#3662)
  * fix test cli CI failures from main (#3682)
  * Fix issue pod should not be ready until the policy cache  loaded (#3646)
  * bug: fix nil pointer when generating events (#3677)
  * remove Validate Cmd (#3674)
  * Support context variables when using foreach CLI (#3637)
  * fix: webhooks are not configured correctly (#3660)
  * bump to Go 1.17.9 (#3671)
  * fix: api reference docs link (#3664)
  * feat: mutate existing resources (#3669)
  * fix: pass logger by value (#3666)
  * Allow definition of inline variables in context (#3658)
  * fix: add char length validation for generate rule resource name (#3640)
  * chore: remove e2e tests for kube 1.20 (#3665)
  * chore: add support for artifacthub.io/changes in helm charts (#3652)
  * fix: policy controller missing GVK (#3659)
  * [imageVerify]: adding `digestMutate` to simplify tag-to-digest mutation (#3531)
  * Multiple keys (#3636)
  * fix: do not remove webhooks during initialization (#3641)
  * fix: prevent installing chart with 2 replicas (#3647)
  * fix: print helm install warnings (#3648)
  * chore: warn if kube version is too old in helm notes (#3650)
  * chore: add artifacthub operator and prerelease annotations (#3649)
  * refactor: use the typed ns informer in GR controller (#3554)
  * refactor: image utils (#3630)
  * Remove helm mode setting (#3628)
  * refact: remove unused Run function from generate (#3638)
  * Fix race condition in pCache (#3632)
  * Allow defining imagePullSecrets (#3633)
  * Image verify attestors (#3614)
  * Allow kyverno-policies to have preconditions defined (#3606)
  * updating version in Chart.yaml (#3618)
  * Update vulnerable dependencies (#3577)
  * Add support for custom image extractors (#3596)
  * add-kms-libraries for cosign (#3603)
  * refactor cli code from pkg to cmd (#3591)
  * fix missing policy.kyverno.io/policy-name label (#3599)
  * refactor generate controller (#3589)
  * change/suppress warning messages (#3593)
  * Feat - add the new CR UpdateRequest for post mutation (#3592)
  * Update to cosign 1.7.1 (#3587)
  * Update GH workflow config (#3588)
  * Update CODEOWNER folders for @samj1912 (#3586)
  * Update hash of dependencies instead of mutable version (#3582)
  * add support for roles, cluster roles and subjects (#3188)
  * fix imageVerify rule conversion (#3583)
  * update imageVerify schema (#3574)
  * Refactor image extraction to allow extracting custom resources (#3572)
  * chore: remove dead code (#3561)
  * Add returnType for regexMatch in kyverno jp output (#3575)
  * refactor: engine context (#3563)
  * Fixes #3555 (#3558)
  * update image pull policy for YAML install which uses :latest (#3565)
  * add @eddycharly as a maintainer! (#3566)
  * chore: add some make help comments (#3560)
  * refactor: switch to admission v1 (#3526)
  * refactor: make response type (RuleType) typed (#3556)
  * refactor: metrics package (#3549)
  * refactor: webhooks metrics reporting (#3548)
  * test: pass lock by value (#3481)
  * refactor: simplify autogen package (#3532)
  * refactor: move common utils (#3553)
  * refactor: add engine utils sub package (#3552)
  * fix: checkEngineResponse in webhooks (#3551)
  * Do not generate preconditions not met warning for audit policies (#3487)
  * refactor: reduce policy mutations (#3550)
  * fix: annotation path (#3547)
  * refactor: use GetFailurePolicy method (#3545)
  * refactor: use BackgroundProcessingEnabled method (#3544)
  * refactor: move some helpers in utils package (#3539)
  * refactor: use GetValidationFailureAction method (#3546)
  * fix: disallow all in autogen annotation (#3537)
  * refactor: use existing ContainsString util (#3543)
  * Create `poddisruptionbudget.yaml` when `mode=ha` (#3536)
  * fix wildcards in value arrays (#3486)
  * refactor: separate yaml utils package (#3520)
  * refactor: separate kube utils package (#3527)
  * refactor: add os utils sub package (#3528)
  * refactor: add a json patch util and use it in autogen package (#3524)
  * fix: tls min version (#3521)
  * refactor: separate json utils package (#3523)
  * refactor: webhooks package (#3516)
  * refactor: use policy interface and introduce admission utils package (#3512)
  * fix: use github repo env instead of hardcoded repo name (#3513)
  * fix: reduce dependency to ns lister (#3509)
  * refactor: use more policy interface (#3510)
  * refactor: use policy interface in policycache package (#3503)
  * refactor: make use of policy interface (#3499)
  * refactor: improve policycache package (#3495)
  * chore: add autogen internals e2e tests (#3492)
  * refactor: factorize policy interface (#3496)
  * feat: add webhooks object selector support (#3413)
  * feat: generate support for namespace policy (#3472)
  * chore: simplify validation with named return (#3493)
  * add missing namespace to role and rolebinding (#3389) (#3429) (#3485)
  * chore(deps): add renovate.json (#3471)
  * feat: stop mutating rules (#3410)
  * use mutex as field instead of embedded (#3480)
  * refactor: create e2e infra using make to speed up e2e tests (#3470)
  * fix ordering of mutate element (#3468)
  * refactor: use abstract policy interface in webhookconfig (#3466)
  * adds lease objects for storing last-request-time and set-status annotations in deployment (#3447)
  * clean up dependencies (#3469)
  * fix: use RWMutex lock while concurrent read/write (#3462)
  * refactor: match and exclude conflict validation (#3454)
  * refactor: add ValidationFailureAction to the api (#3451)
  * refactor: remove ns lister from webhookconfig (#3452)
  * refactor: add IsNamespaced() method to API policy types (#3450)
  * fix: use PodControllersAnnotation constant (#3448)
  * Update MAINTAINERS.md (#3449)
  * support for deprecated API's (#3439)
  * Drop v1alpha1 PolicyReport CRD (#3437)
  * refactor: ExcludeResources validation (#3445)
  * refactor: replace ExcludeResources by MatchResources (#3444)
  * refactor: ResourceDescription validation (#3446)
  * Fix incorrectly renamed file (#3443)
  * Remove support for test.yaml (#3442)
  * fix cli panic for --cluster flag (#3436)
  * Fix check for generated webhook rules being equal to what the API server has (#3407)
  * refactor: MatchResources validation (#3422)
  * feat: use IsReady method (#3426)
  * refactor: ValidationFailureActionOverrides validation (#3421)
  * PR and issue template updates per contributors' meetings (#3428)
  * [imageVerify]: correcting error msg (#3398)
  * feat: add toggle package for feature flags (#3419)
  * feat: move GetRules() at the policy level (#3420)
  * feat: add conditions support (#3378)
  * feat: stop adding autogen annotation (#3379)
  * fix webhook configuration issue when auto update is disabled (#3417)
  * Ignore test files that do not end in test.yaml (#3402)
  * refactor: Policy name validation (#3409)
  * Replace `ToUnstructured()` with Marshal/Unmarshal (#3150)
  * [ImageVerify] Verify additional certificate-extensions  (#3404)
  * fix: filter resources names with helm custom release name (#3361)
  * refactor: Rule names validation (#3406)
  * refactor: Rule type validation (#3400)
  * chore: remove check-helm-docs workflow (#3408)
  * refactor: UserInfo validation (#3399)
  * Fix webhook re-creation error (#3403)
  * chore: add make help target (#3405)
  * Only queue one retry if webhook update fails (#3353)
  * chore: add more codegen target and verifications (#3393)
  * Return warning on admission response when mutating pods (#3272)
  * Add a registry flag to allow direct access to container registries in the CLI (#3396)
  * feat: add rules to status (#3376)
  * chore: makefile should not makefile go.mod (#3394)
  * refactor: ImageVerification validation (#3372)
  * Cli Apply command support Dir as resources (#3391)
  * chore: add helm crds to make codegen target (#3375)
  * fix: metrics config defaults (#3387)
  * fix for gvk not working for existing resources policy (#3384)
  * e2e test for mutate global anchor Policy (#2574)
  * Add `codecov` to CI (#3382)
  * Update cosign to v1.6.0 (#3341)
  * fix: generate api reference docs (#3377)
  * fix PodExecOptions issue (#3373)
  * Update OWNERS.md (#3371)
  * feat: add autogen controllers to policy status (#3332)
  * chore: gen helm crds from config crds (#3356)
  * refactor: introduce api common types (#3365)
  * adding emptyDir vol for keyless signing (#3366)
  * refactor: move api functions closer to the struct they belong to (#3363)
  * refactor: introduce rules getters and setters (#3350)
  * refactor: move controller autogen annotation in api package (#3364)
  * Add new test-case-selector flag to test command (#3183)
  * support RSA, ECDSA and EDDSA public key verification (#3362)
  * fix: configmap resource filters generated by helm does not account for namespace (#3358)
  * chore: check helm docs are up to date (#3310)
  * Fix any_all wildcard issue (#3352)
  * fix: invalid path in helm-test workflow (#3344)
  * Add Bloomberg to adopters (#3348)
  * updated description field of foreach (#3157)
  * chore: verify codegen in CI (#3343)
  * Update generate clusterrole (#3336)
  * fix: CRD generation (#3334)
  * refactor: reduce usage of reflect.DeepEqual (#3328)
  * fix: update codegen (#3329)
  * fix: naming typos (#3327)
  * refactor: introduce autogen package (#3316)
  * refactor: pass only spec instead of whole policy when possible (#3315)
  * fetch tag across all branches instead of current branch (#3324)
  * add separate step for digest (#3321)
  * adding check for digest and update git command
  * correcting makefile latest tag (#3314)
  * fix: helm install docs (#3312)
  * fix: seccomp profile (#3313)
  * chore: drop helm v2 (#3311)
  * feat: gen kyverno helm chart docs (#3309)
  * feat: gen kyverno-policies helm chart docs (#3301)
  * Fix workflow using regex in `main` (#3306)
  * arranging permissions (#3293)
  * fix: helm chart broken when use generatecontrollerExtraResources (#3302)
  * feat: support background mode configuration in kyverno-policies chart (#3299)
  * Improve CLI test times by instantiating openapi controller once (#3297)
  * Fix namespace typo (#3298)
  * fix: add support for other platforms before executing docker buildx (#3296)
  * validate and block policy based on the matched kind cache (#3283)
  * fix: comma separated lists in config (#3290)
  * Run E2E tests on all supported k8s versions (#3256)
  * latest will point to main (#3285)
  * Shallow clone git repositories for kyverno test command
  * update trivy scanning (#3284)
  * feat: add linux/s390x builds (#3277)
  * Fix label mutation while updating the secret (#3273)
  * Modify capabilities for compatibility with Pod Security (#3274)
  * Fix Helm releasing to preserve creation timestamps (#3268)
  * Added `kyverno test` subcommand for test manifest file (#3264)
  * Clean up commented out lines of code (#3263)
  * Add .DS_store to gitignore (#3255)
  * fix mutate wildcard issue (#3193)
  * Fix foreach validations precondition issue (#3228)
  * Fix policy report OwnerReference (#3249)
  * Improve E2E test CI timings (#3250)
  * Add openssf badge (#3246)
  * Fix old object validation check (#3248)
  * Bug fix: negation of string kernel version caused Cluster Policy to fail (#3229)
  * add helm pre-delete hook which deletes all the webhooks (#3148)
  * Skip updating webhook configs if namespaceSelector is nil (#3237)
  * Sync latest changes to release/install.yaml (#3239)
  * add aggregated role for generaterequest (#3240)
  * Remove abstraction that doesn't work anyway (#3209)
  * Fix image parsing for image referenced as digests  (#3196)
  * feat: ha mode support in helm chart (#3207)
  * Fix keyless attest (#3219)
  * update dependencies (#3221)
  * Issue forms and PR template adjustment (#3213)
  * add prateekpandey14 to codeowners (#3205)
  * Added e2e test for JSON patch mutate policy (#2966)
  * fixing bug to handle two different types of rules  (#2954)
  * Allow setting validationFailureActionOverrides for policies (#3201)
  * feat: fix app version in NOTES.txt (#3189)
  * Indentation fix (#3179)
  * Fix unused tagTest in helm chart tests (#3174)
  * Update kyverno-policies chart with latest pod-security policies (#3126)
  * Add a kyverno jp command to test jmespath expressions (#3169)
  * test-cases for wildcard match label selector (#3165)
  * Filter kyverno resources instead of entire kyverno namespace (#3170)
  * Fix panic for provides a set to the key of a precondition and deny condition (#3162)
  * Bump up verbosity for `patched resource mismatch` (#3127)
  * bump chart versions (#3160)
  * Update dev image tag in Make targets (#3159)
  * Add sam (#3155)
  * add missing patch verbs in event clusterrole (#3151)
  * fix filtered and sort patches index (#3146)
  * Fix kyverno panic with `PodSpec.containers` JSON merge patch w/o image (#3143)
  * Relax rule context validation to follow JMESPath grammar (#3129)
  * Fixed kyverno panic at JMESPath zero division (#3137)
  * Fix variable substitution when curly braces are used in jmespath (#3133)
  * Fix parsing of resources in preconditions (#3108)
  * Add cloud provider keychains to DefaultKeychain (#3116)
  * improve antiAffinity and add podAffinity and nodeAffinity for kyverno helm chart (#3067)
  * fixing and adding tests (#3112)
  * update cosign to 1.5.0 and fix issuer and subject for keyless (#3089)
  * Add b/w compat support for K8s version 1.20 and below for Kyverno 1.6 (#3100)
  * Fix the kyverno default keychain value to be the ggcr default keychain (#3096)
  * fix: typo Cluter to Cluster (#3092)
  * Fix memory leak when updating ggcr keychain (#3088)
  * Support registry keychain from cloud providers (#3036)
  * Updates Changelog to add note for anyPattern issue due to k8s v1.23 (#3045)
  * Add KYVERNO_DEPLOYMENT to initContainer (#3086)
  * apply patches cumulatively (#3083)
  * Fix CLI test/apply when any/all use namespaceSelector (#3050)
  * fix mutating ownerReferenecs (#3061)
  * update workflow configurations to fix CI failure (#3060)
  * Fix documentation for helm charts (#3056)

-------------------------------------------------------------------
Fri Apr 01 07:04:47 UTC 2022 - kastl@b1-systems.de

- Update to version 1.6.2:
  * tag v1.6.2 (#3511)
  * Cherry-pick #3111 and release v1.6.2-rc3 (#3506)
  * tag v1.6.2-rc2 (#3500)
  * feat: generate support for namespace policy (#3498)
  * use mutex as field instead of embedded (#3480) (#3489)
  * release v1.6.2-rc1 (#3482)
  * Cherry-pick #3477 (#3479)
  * adds lease objects for storing last-request-time and set-status annotations in deployment (#3447) (#3478)
  * fix: use RWMutex lock while concurrent read/write (#3462) (#3467)
  * support for deprecated API's (#3439) (#3453)
  * fix cli panic for --cluster flag (#3436) (#3438)
  * add missing namespace to role and rolebinding (#3389) (#3429)
  * fix webhook configuration issue when auto update is disabled (#3417) (#3418)
  * Cli Apply command support Dir as resources (#3391) (#3392)
  * fix for gvk not working for existing resources policy (#3384) (#3386)
  * Cherry pick/3366 (#3367)
  * Update generate clusterrole (#3336) (#3359)
  * fixing bug to handle two different types of rules  (#2954) (#3357)
  * Fix any_all wildcard issue (#3352)

-------------------------------------------------------------------
Wed Mar 02 05:51:37 UTC 2022 - kastl@b1-systems.de

- Update to version 1.6.1:
  * fix release tag command (#3323)
  * fetching proper digest for release images (#3319)
  * update release v1.6.1 manifest (#3318)
  * changing git command to fetch the tag (#3317)
  * release v1.6.1-rc2
  * cherry-pick c4075af3d17c59fe73b50083bb206d85a1cb38ba
  * Run E2E tests on all supported k8s versions (#3256)
  * Fix namespace typo (#3298)
  * feat: support background mode configuration in kyverno-policies chart (#3299)
  * fix: helm chart broken when use generatecontrollerExtraResources (#3302)
  * Shallow clone git repositories for kyverno test command
  * fix: add support for other platforms before executing docker buildx (#3296)
  * latest pointing to main
  * added condition
  * using regex
  * updated workflows
  * validate and block policy based on the matched kind cache (#3283) (#3291)
  * Filter kyverno resources instead of entire kyverno namespace (#3170) (#3171)
  * update trivy scanning (#3284)
  * tag v1.6.1-rc1
  * Fix label mutation while updating the secret (#3273) (#3278)
  * Modify capabilities for compatibility with Pod Security (#3274) (#3275)
  * Fix Helm releasing to preserve creation timestamps (#3268)
  * fix mutate wildcard issue (#3193)
  * Fix foreach validations precondition issue (#3228)
  * Fix policy report OwnerReference (#3249) (#3257)
  * Fix old object validation check (#3248)
  * Skip updating webhook configs if namespaceSelector is nil (#3237) (#3243)
  * bump chart versions to v2.3.0
  * cherry-pick #3209
  * Fix image parsing for image referenced as digests  (#3196) (#3233)
  * Fix keyless attest (#3219)
  * update dependencies (#3221)
  * release Helm chart v2.2.1
  * Allow setting validationFailureActionOverrides for policies (#3201)

-------------------------------------------------------------------
Fri Feb 18 15:07:52 UTC 2022 - Johannes Kastl <kastl@b1-systems.de>

- link /usr/bin/kyverno to /usr/bin/kubectl-kyverno to make this usable as a kubectl plugin

-------------------------------------------------------------------
Fri Feb 18 13:02:16 UTC 2022 - Johannes Kastl <kastl@b1-systems.de>

- new package kyverno: CLI and kubectl plugin for the Kyverno Policy engine

Places

File kyverno.changes of Package kyverno (Revision 0125aa64f70bed1206dc33b1436aaa27)

Places