File kyverno.changes of Package kyverno

Overview Repositories Revisions Requests Users Attributes Meta

File kyverno.changes of Package kyverno (Revision 31d5cd4d87d87a3ad49f42bb349e6664)

Currently displaying revision 31d5cd4d87d87a3ad49f42bb349e6664 , Show latest

-------------------------------------------------------------------
Wed May 10 04:36:18 UTC 2023 - kastl@b1-systems.de

- Update to version 1.9.3:
  * feat: release 1.9.3 (#7137)
  * fix conflicts (#7109)
  * fix: do not pass dynamicConfig to
    matchesResourceDescriptionMatchHelper (#6231) (#6242) (#6331)
  * cherry-pick #6787 (#7108)
  * chore: update argocd lab (#6698) (#6702)

-------------------------------------------------------------------
Wed Mar 22 05:56:36 UTC 2023 - kastl@b1-systems.de

- Update to version 1.9.2:
  * fix: skip duplicate PSa checks for the latest version (#6634)
    (#6636)
  * tag v1.9.2 (#6637)
  * fix: add message to bypass schema validation when it fails
    (#6604) (#6606)
  * fix: controller duration computation (#6569) (#6574)
  * release v1.9.2-rc.1 (#6536)
  * fix: process audit policies when admission reports are disabled
    (#6531) (#6545)
  * More kuttl standard generate tests (#6332) (#6533)
  * fix: increase burst (#6540)
  * fix: improve reports controller default values and workers
    (cherry-pick #6522) (#6532)

-------------------------------------------------------------------
Thu Mar 09 19:38:28 UTC 2023 - kastl@b1-systems.de

- Update to version 1.9.1:
  * release v1.9.1 (#6520)
  * fix: missing metrics for policies in audit mode (#6509)
  * fix: release (#6502)
  * fix: release (#6498)
  * release v1.9.1-rc.1 (#6485)
  * cherry-pick #6459 (#6468)
  * fix: error log (#6429) (#6437)
  * check errors (#6424) (#6426)
  * fix: autoUpdateWebhooks=false causes ClusterPolicy to never be
    ready (#6374) (#6382)
  * fix: delete certificate secret if type is not TLS
    (#6368) (#6373)
  * oldObject translation solved in autogen (#6305) (#6372)
  * chore(deps): bump github.com/sigstore/k8s-manifest-sigstore
    (cherry-pick #6320) (#6359)
  * fix: dump admission response (#6349) (#6352)
  * chore(deps): bump golang.org/x/net (#6344)
  * fix: add roles and clusterroles when dumping admission requests
    (#6319) (#6323)
  * fix: use client instead of discovery for sanity checks
    (cherry-pick #6296) (#6299)
  * cherry-pick #6237 (#6273)
  * chore: add error logs in wait for cache sync helper (#6275)
  * fix: jp divide quantities (#6229) (#6232)
  * Cherry-pick #6126 (#6228)
  * fix: admission review variables for DELETE operations
    (#6197) (#6214)
  * cherry-pick #6188 (#6209)
  * fix: image tagging strategy (#6200)

-------------------------------------------------------------------
Thu Feb 02 06:49:27 UTC 2023 - kastl@b1-systems.de

- Update to version 1.9.0:
  * tag v1.9.0 (#6186)
  * fix: policy exception event source (#6122)
  * Release v1.9.0-rc.4 (#6108)
  * fix: tracing attributes length and tracer name (#6112)
  * fix: cleanup-controller version (#6100) (#6105)
  * fix: flag added to init container mistake (#6103)
  * fix: allow deletion of namespace containing managed resources (#6098) (#6102)
  * fix: flag added to init container mistake (#6103)
  * Release v1.9.0-rc.3 (#6095)
  * validate polex activation and namespace (#6046) (#6080)
  * fix: pin busybox image tag in helm tests (#6051) (#6063)
  * fix: replace + with _ in Chart.Version label field (#6047) (#6056)
  * cherry-pick #6030 (#6034)
  * tag v1.9.0-rc.2 (#6023)
  * fix ns labels matching (#6022)
  * tag v1.9.0-rc.1 (#6012)
  * fix: policy match Kind case-senstive (#6010)
  * fix: policy exceptions not working in background mode (#5980) (#6003)
  * chore: log out cleanup policy events (#5998) (#6000)
  * create failure events on errors (#5988) (#5997)
  * fix: generate policy exception events (#5987) (#5996)
  * cherry-pick #5920 (#5990)
  * Fixes time_now failing (cherry-pick 5928) (#5991)
  * create events for cleanup policies (#5982) (#5983)
  * fix: invoke cleanup process during shutdown (#5974) (#5981)
  * cherry-pick #5967 (#5970)
  * log out deleted resources at default level (#5977) (#5978)
  * fix: helm selector (#5965) (#5969)
  * feat: add cluster role aggregation to cleanup controller (#5966) (#5968)
  * fix chart invalid annotations (#5960) (#5963)
  * tag v1.9.0-beta.2 (#5959)
  * fix imageRef matching (#5956) (#5957)
  * cherry-pick #5950 (#5955)
  * Cherry-pick #5941 (#5952)
  * fix: update policy exception CRD description (#5948) (#5951)
  * chore: fix releaser badge (#5910) (#5947)
  *  Added a time_add() filter to add duration and absolute time (#5817) (#5946)
  * fix: cleanup policies with user infos in match/exclude should be rejected (#5943) (#5944)
  * test: add kuttl test for policy exception (#5935) (#5936)
  * fix: missing user info matching (#5931) (#5934)
  * chore: add missing gh workflow concurrency statements (#5914) (#5924)
  * restrict cjs by PSS restricted checks (#5904) (#5922)
  * fix: Configure webhook to add ephemeralcontainers for policies matching on Pod (#5886) (#5919)
  * fix: golangci-lint workflow (#5913) (#5917)
  * set resourceVersion before update (#5906) (#5916)
  * fix: configure gh workflow permission (#5909) (#5915)
  * chore: make check actions pinned by hash a standalone ci job (#5907) (#5911)
  * feat: add violation details to report.results.properties for PSa policies (#5908) (#5912)
  * Adds JMESPath filter for returning cron expression for absolute time (#5814) (#5905)
  * chore: add setup test env gh action (#5897) (#5899)
  * chore: add setup-build-env gh action (#5892) (#5896)
  * fix cleanup var 'target.*' (#5888) (#5895)
  * add kuttl assert file (#5870) (#5894)
  * chore: small gh workflows improvements (#5883) (#5887)
  * chore: use gh composite actions (#5885) (#5893)
  * fix: Add group to subresources declaration in value.yaml file for CLI (#5881) (#5884)
  * refactor: improve background scan reconciliation (#5871) (#5882)
  * fix: Add subresources support to policy exceptions (#5839) (#5880)
  * fix validation checks for foreach and nested foreach (#5875) (#5877)
  * fix: force background scan recomputation (#5865) (#5868)
  * fix: background scan events (#5807) (#5874)
  * feat: cleanup enhancements-1 (cherry-pick #5796) (#5867)
  * fix mutate targets variable (#5862) (#5866)
  * chore: move ConvertToUnstructured from engine utils to kube utils (#5847) (#5863)
  * cleanup new validate webhooks (#5851) (#5857)
  * Walk back change in PSS policy to send to to_upper (#5823) (#5856)
  * cherry-pick #5846 (#5855)
  * feat: improve background scan reports enqueue logic (#5810) (#5853)
  * chore: cleanup a couple workflows (#5844) (#5854)
  * fix: improve cli help message (#5843) (#5849)
  * chore: bump a couple of deps (#5840) (#5850)
  * refactor: move utils into sub packages (#5828) (#5845)
  * chore: add a couple unit tests (#5834) (#5842)
  * chore: cleanup codecov workflow (#5829) (#5838)
  * fix: enum values for ValidationFailureActionOverride (#5835) (#5836)
  * fix: default value for validationFailureAction (#5832) (#5833)
  * Adds JMESPath filter for returning current time (#5813) (#5831)
  * add source archive checksum into the checksums.txt (#5819) (#5827)
  * Adds notes to functions (#5824) (#5826)
  * fix: error handling in last scan time parsing (#5808) (#5809)
  * fix arguments passed to DeepEqual (#5801) (#5806)
  * refactor: policy controller package (#5747) (#5803)
  * enhance logging, fix pull flag description (#5797) (#5798)
  * chore: switch to kyverno/kuttl (#5504) (#5794)
  * fix cli output adjustments (#5787) (#5793)
  * redirect stderr to get digest successfully (#5782) (#5791)
  * chore: update publicKey description (#5789) (#5792)
  * fix delete policy (#5776) (#5790)
  * fix helm chart version (#5775)
  * bump dep (#5765)
  * fix image digest (#5762)
  * tag v1.9.0-beta.1 (#5761)
  * chore(deps): bump JasonEtco/create-an-issue from 2.8.2 to 2.9.0 (#5760)
  * chore(deps): bump fluxcd/flux2 from 0.37.0 to 0.38.1 (#5759)
  * chore(deps): bump actions/cache from 3.0.11 to 3.2.0 (#5758)
  * refactor: move util funcs in sub packages (#5754)
  * refactor: cleanup controller validating webhook (#5756)
  * test: add unit test for GetResourceName util (#5752)
  * refactor: auth package and add full unit test coverage (#5749)
  * chore: bump deps including k8s ones (#5751)
  * refactor: remove common package (#5750)
  * refactor: use typed client in auth (#5743)
  * refactor: remove a couple of old util funcs (#5746)
  * chore: remove e2e tests (#5742)
  * Issue_templates (#5741)
  * chore: remove autogen internals tests (#5740)
  * fix: cleanup controller image build (#5739)
  * chore: build cleanup controller image (#5737)
  * generate SLSA provenance on releases (#5735)
  * run conformance tests on different k8s versions (#5733)
  * Allows {{image}} var to be used in policies (#5122)
  * refactor: split CLI jp command (#5566)
  * chore: update k8s versions test grid (#5732)
  * feat: add exception logic (#5712)
  * fix: remove all category from all our CRDs (#5731)
  * feat: force background scan regularly (#5727)
  * add rule type pkg/metrics/parsers.go (#5729)
  * bump Go 1.19.4 (#5728)
  * Revert "chore(deps): bump ossf/scorecard-action from 2.1.0 to 2.1.1 (#5724)" (#5725)
  * chore(deps): bump ossf/scorecard-action from 2.1.0 to 2.1.1 (#5724)
  * feat: propagate psa checks results (#5719)
  * fix: add back install.yaml manifest (#5721)
  * refactor: supress usage of kustomize in build (#5691)
  * Require predicate type (#5713)
  * fix logger panic (#5715)
  * fix: interface conversion panic (#5708)
  * fix missing assignment (#5710)
  * feat: add kuttl tests for #5704 (#5707)
  * fix: allow policies from stdin in apply again (#5668)
  * initialize configmap resolver in background components (#5705)
  * feat: Implement PolicyException (#5680)
  * fix digest and verify logic (#5703)
  * fix: block policy admission if kyverno is down (#5677)
  * fix info kind error (#5701)
  * fix: exception validation follow up (#5697)
  * chore(deps): bump github/codeql-action from 2.1.36 to 2.1.37 (#5696)
  * feat: add policy exception validation webhook (#5679)
  * chore(deps): bump ossf/scorecard-action from 2.0.6 to 2.1.0 (#5695)
  * chore: bump a couple of deps (#5688)
  * chore(deps): bump github.com/onsi/gomega from 1.24.1 to 1.24.2 (#5694)
  * chore(deps): bump goreleaser/goreleaser-action from 3.2.0 to 4.1.0 (#5683)
  * fix: bump log level for autogen debug logs (#5687)
  * chore: remove deprecated flag splitPolicyReport (#5686)
  * chore(deps): bump actions/setup-go from 3.4.0 to 3.5.0 (#5684)
  * chore(deps): bump JasonEtco/create-an-issue from 2.8.1 to 2.8.2 (#5685)
  * chore: remove secrets client from webhook controller (#5682)
  * chore: rename exclude into match in policy exception (#5681)
  * fix: case where deny message is not a string (#5678)
  * feat: Introduce PolicyException CRD (#5662)
  * feat: add certs controller to cleanup policies (#5671)
  * chore(deps): bump actions/checkout from 3.1.0 to 3.2.0 (#5666)
  * Update version drop-downs in issue templates (#5674)
  * fix AllNotIn operator (#5636)
  * chore(deps): bump go.uber.org/multierr from 1.8.0 to 1.9.0 (#5663)
  * chore(deps): bump azure/setup-helm from 3.4 to 3.5 (#5667)
  * feat: add engine traces (#5463)
  * use camel case for ForEach naming (#5660)
  * feat: add metrics service and service monitor to cleanup controller (#5653)
  * Support existing imagePullSecrets for image verify functionality (#5627)
  * Nested foreach (#5589)
  * chore(deps): bump github.com/sigstore/sigstore from 1.4.6 to 1.5.0 (#5652)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.4.2 to 5.5.1 (#5650)
  * feat: add dev config with support for prom loki and tempo (#5647)
  * fix: grafana dashboard (#5645)
  * fix: missing permission in cleanup controller role (#5646)
  * refactor: tracing package (#5643)
  * added Arrikto and Trendyol as adopters (via Google Form) (#5644)
  * feat: improve cleanup policies controller and chart (#5628)
  * feat: add support for subresources to validating and mutating policies (#4916)
  * fix: Improve helm-test workflow (#5640)
  * feat: propagate context through engine (#5639)
  * chore(deps): bump github/codeql-action from 2.1.35 to 2.1.36 (#5631)
  * feat: add conditions matching to cleanup controller (#5626)
  * fix: setup tracing and minor cleanup in tracing and metrics code (#5629)
  * feat: add http clients tracing (#5630)
  * chore(deps): bump actions/setup-python from 4.3.0 to 4.3.1 (#5632)
  * chore(deps): bump k8s.io/cli-runtime from 0.25.4 to 0.25.5 (#5635)
  * Add api docs (#5605)
  * feat: use lister in registry client (#5620)
  * fix: registry client not propagated correctly (#5622)
  * fix: don't create orphan spans in instrumented clients (#5624)
  * feat: introduce v2alpha1 (#5625)
  * feat: implement cleanup policy matching (#5614)
  * fix nil error panic (#5619)
  * chore(deps): bump golang.org/x/crypto from 0.3.0 to 0.4.0 (#5618)
  * add 1.8.3 to version drop-downs (#5616)
  * fix: mutation of cached object in bg scan controller (#5608)
  * refactor: registry client (#5596)
  * use helm values for crd labels (#5594)
  * chore: bump a couple of deps (#5611)
  * chore(deps): bump reviewdog/action-golangci-lint from 1.25.0 to 2.2.2 (#5603)
  * chore(deps): bump azure/setup-helm from 1.1 to 3.4 (#5604)
  * refactor: improve color management in cli test (#5609)
  * chore: bump a couple of deps (#5610)
  * chore(deps): bump CycloneDX/gh-gomod-generate-sbom from 1.0.0 to 1.1.0 (#5601)
  * feat: add cleanup handler (#5576)
  * chore(deps): bump actions/download-artifact from 3.0.0 to 3.0.1 (#5602)
  * Fix: handling unexpected global-anchor-variable for the apply command (#5590)
  * chore: bump a couple of deps (#5593)
  * fix: use lister for CA secret (#5598)
  * add logging guideline (#5406)
  * Delete category all from CRDs (#5557)
  * refactor: update otlp packages (#5367)
  * chore: bump flux action (#5578)
  * chore(deps): bump aquasecurity/trivy-action from 0.2.3 to 0.8.0 (#5584)
  * fix: replace + symbol with _ symbol on the Chart.Version field (#5591)
  * chore(deps): bump helm/chart-testing-action from 2.0.1 to 2.3.1 (#5586)
  * chore(deps): bump rajatjindal/krew-release-bot from 0.0.38 to 0.0.43 (#5588)
  * chore(deps): bump ossf/scorecard-action from 2.0.4 to 2.0.6 (#5587)
  * chore(deps): bump actions/setup-go from 2.1.5 to 3.4.0 (#5585)
  * chore(deps): bump actions/setup-python from 2.3.1 to 4.3.0 (#5562)
  * chore(deps): bump sonarsource/sonarcloud-github-action from 1.7 to 1.8 (#5563)
  * chore(deps): bump codecov/codecov-action from 2.1.0 to 3.1.1 (#5573)
  * chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (#5559)
  * adding --warn-exit-code flag (#5577)
  * feat: add cleanup controller BYOSA and RBAC extensions (#5580)
  * chore(deps): bump goreleaser/goreleaser-action from 2.8.0 to 3.2.0 (#5572)
  * chore(deps): bump golang.org/x/text from 0.4.0 to 0.5.0 (#5574)
  * chore(deps): bump JasonEtco/create-an-issue from 2.8.0 to 2.8.1 (#5571)
  * chore: disable dependabot auto rebase (#5567)
  * chore(deps): bump go.uber.org/zap from 1.23.0 to 1.24.0 (#5560)
  * refactor: jmespath arithmetic operations (#5544)
  * chore(deps): bump golangci/golangci-lint-action from 3.2.0 to 3.3.1 (#5561)
  * chore(deps): bump actions/checkout from 2.4.0 to 3.1.0 (#5564)
  * chore(deps): bump actions/cache from 3.0.8 to 3.0.11 (#5565)
  * refactor: cli test command (#5550)
  * refactor: cli jp command (#5552)
  * add Wayfair to adopters (#5547)
  * Kyverno CLI: added method to detect duplicate resource in kyverno test (#3612)
  * To support gitURLs for "apply" command (#4502)
  * issue-4613: Add support for cache enhancements with informers (#5484)
  * chore(deps): bump stefanprodan/helm-gh-pages from 1.5.0 to 1.7.0 (#5534)
  * chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions (#5532)
  * chore(deps): bump github/codeql-action from 1.0.26 to 2.1.35 (#5536)
  * bump slsa GH generator to 1.4.0 (#5530)
  * chore(deps): bump actions/upload-artifact from 3.1.0 to 3.1.1 (#5535)
  * chore(deps): bump sigstore/cosign-installer from 2.8.0 to 2.8.1 (#5533)
  * chore: enable dependabot (#5531)
  * refactor: make policy context immutable and fields private (#5523)
  * configure opentelemetry logger (#5513)
  * feat: support attestations with multiple signatures (#5409)
  * fix: bug in report resource watcher (#5525)
  * Adding Rafay Systems to Kyverno Adopters list. (#5524)
  * feat: Add default CI test values for helm charts (#5518)
  * feat(policies chart): Add ability to set autogen behavior (#5517)
  * fix: cleanup policy validation (#5514)
  * fix: pod anti affinity (#5516)
  * chore: improve cleanup controller (#5509)
  * feat: use admission review v1 (#5464)
  * refactor: use internal cmd package in kyverno (#5507)
  * chore: bump a few deps (#5512)
  * chore: stop using set-output in gh actions (#5500)
  * refactor: add controller helper to internal package (#5506)
  * chore: use builtin slices.Clone (#5510)
  * feat: add webhook type to admission metrics (#5493)
  * feat: propagate context to dynamic client (#5495)
  * chore: bump a couple of deps (#5503)
  * feat: add controller metrics (#5494)
  * fix: panic when response is nil (#5502)
  * fix: report deletion fighting with garbage collection (#5486)
  * feat: add dynamic client support to internal cmd package (#5477)
  * Migrate all mutate e2e tests to kuttl and expand (#5491)
  * chore: replace utils.ContainsString with builtin slices.Contains (#5496)
  * fix: add image extractor for ReplicationController (#5497)
  * refactor: move metrics closer to the code that use them (#5492)
  * chore: refactor metrics namespace check (#5489)
  * Migrate validate e2e tests to kuttl tests (#5483)
  * Fix: handled skip rule processing in anyPattern field (#5191)
  * feat: propagate context to the metrics package (#5479)
  * fix: fix mutating the "/metadata/serverAddress" section of a keda.s/v1alpha1/ScaledObject object (#5374)
  * feat: add allowed label to admission metrics (#5478)
  * chore: bump kyverno version in argo lab (#5482)
  * fix: typo in autogen package (#5480)
  * chore: improve tracing instrumented clients (#5474)
  * refactor: metrics configuration code (#5475)
  * feat: create a policy utils package (#5473)
  * Add reconciling logic for creating cronjobs whenever a new cleanup policy is created (#5385)
  * feat: add new filtering handlers (#5472)
  * fix: remove filtering for policy admission handlers (#5462)
  * fix: add clone check before validating namespace policy (#5459)
  * fix: issue when calling kustomize concurrently (#5465)
  * feat: support flagsets in internal cmd package (#5461)
  * chore: add instrumented clients codegen verification (#5460)
  * fix: reading policies for oci command and pushing image (#5435)
  * fix: admission reports stacking up (#5457)
  * docs: add controllers README (#5434)
  * fix: log watcher error in reports controller (#5449)
  * ci: cancel redundant builds of workflow on push (#5427)
  * feat: use client funcs from internal cmd package (#5443)
  * docs: add reports troubleshooting tips (#5448)
  * fix: argocd lab monitoring namespace (#5446)
  * fix: mutate existing policy does not get applied when background=false (#5439)
  * feat: add signal in internal cmd package (#5444)
  * feat: improve handlers tracing code (#5442)
  * chore: bump a bunch of deps (#5440)
  * feat: add logging support to instrumented clients (#5438)
  * feat: add discovery support in instrumented clients (#5437)
  * refactor: dynamic client use instrumented clients (#5436)
  * fix request.operation in globalValues is always set to CREATE (#5423)
  * chore: remove obsolete metrics client code (#5401)
  * refactor: improve instrumented clients code and support dynamic/metadata client  (#5428)
  * refactor: split argocd lab into multiple steps (#5410)
  * Fix multi attestor keyless (#5432)
  * Handle  Match resources kind (#5421)
  * udpate slsa to v1.3.0 (#5419)
  * chore: bump sigstore deps (#5376)
  * fix blank lines in crds (#5422)
  * refactor: improve instrumented clients creation (#5417)
  * logging action (#5416)
  * adding --audit-warn flag (#5321)
  * Update version drop-downs; bump Trivy (#5425)
  * Add most basic kuttl tests for generate rules, clone and sync (#5413)
  * fix: typo (#5415)
  * feat: make traces better (#5412)
  * refactor: introduce cmd internal package (#5404)
  * refactor: generated instrumented client code part 2 (#5398)
  * feat: add tracing middleware (#5397)
  * Fixed issue-3709: Image verify rule gives error for non-existing configmap (#5272)
  * add os.Exit (#5402)
  * Complete all basic kuttl tests for generate rules, clone and no-sync (#5400)
  * refactor: generate instrumented client code (#5362)
  * refactor: propagate context through admission handlers (#5392)
  * refactor: improve tracing package (#5391)
  * [Bug]: Fix wildcard any/all issue (#5387)
  * Fix incorrect step ID reference (#5388)
  * fix the entry length validation for the verify image rule (#5384)
  * Add more kuttl generate test cases (#5364)
  * fix: set correct logger in profiling server (#5358)
  * fix closed watchers in the resource-report-controller (#5350)
  * fix: set logger in metrics server (#5319)
  * fixed dryrun option to handle changes caused by mutating policy (#4899)
  * fix: add validation for generate namespace policy (#5346)
  * chore: add tempo to argocd lab (#5365)
  * chore: add performance tests tool (#5241)
  * fix: panic when disable metrics is true (#5366)
  * feat: add CleanupPolicy validation code to CleanupPolicyHandler  (#5338)
  * test: simplify autogen kuttl tests (#5343)
  * chore: enable json logs in argocd lab (#5349)
  * fix digest variable (#5356)
  * chore: add helm ci values with cleanup controller (#5357)
  * fix: add some missing options in cleanup helm chart (#5351)
  * add test cases for yaml verification feature (#5326)
  * refactor: optimise and use kuttl TestStep with tests (#5328)
  * test: add rbac kuttl test (#5337)
  * Update SLSA generator workflow to v1.2.2 (#5323)
  * test: add kuttl debug failure (#5339)
  * fix: add replicaset and replicationController kinds in podsecurity validation (#5336)
  * feat: add cleanup controller to helm chart (#5329)
  * chore: remove docker support (#5324)
  * chore: add cli binary to gitignore (#5331)
  * test: add test to check expected webhooks are created (#5330)
  * feat: add cleanup controller makefile targets (#5327)
  * feat: add replicaset and replicationcontroller to autogen (#4975)
  * feat: add cleanupPolicy validation code (#5279)
  * fix: synchronize source resource update to clone list resource (#5317)
  * allow list with policies in test (#5227)
  * test: add kuttl tests for jmespath special chars (#5310)
  * Fix issue where CLI test command ignores failures (#5189)
  * fix: wrong logger used (#5311)
  * fix: send notification when stoping watching resource in reports system (#5298)
  * fix: add parsing of json pointers to support special chars (#3578 #3616) (#4767)
  * fix: set rule response status as skip if precondition failed (#5162)
  * Update kuttl test scaffolding (#5303)
  * fix: reduce startup probe delay (#5296)
  * tests: add kuttl tests for multiple clone generate (#5280)
  * fix: allow delete of clone target resource with synchronize false (#5161)
  * fix: image extractor kuttl tests (#5293)
  * fix: check policy is ready in kuttl tests (#5286)
  * fix: kuttl test external-service (#5287)
  * chore: update kuttl (#5285)
  * fix: make zapr compatible with klog's -v argument (#5166)
  * feat: add flag to control leader election frequency (#5172)
  * refactor: admission metrics (counter and latency) (#5245)
  * fix: resource schema validation in policies under any/all match (#5246)
  * fix: keep admission warnings (#5269)
  * add test instructions (#5271)
  * chore: add kuttl autogen tests (#5253)
  * fix: add missing test suite to kuttl (#5268)
  * fix: account for error rules in mutation webhook (#5264)
  * refactor: admission response utils (#5234)
  * feat: create cleanup new CRDs (#5233)
  * chore: remove old conformance tests files (#5260)
  * fix: add warning when using deprecated validation failure action (#5219)
  * Kuttl updates (#5257)
  * chore: use conditions in kuttl tests to check ready policies (#5252)
  * chore: add kuttl in makefile (#5254)
  * More kuttl tests (#5238)
  * fix: remove unused code in config (#5242)
  * feat: separate webhook rules per GVK/rule (#4986)
  * fix: kyverno Dockerfile base image tag and sha256 hash (#5248)
  * refactor: move all middlewares in handlers sub package (#5244)
  * fix generateName mutation (#5146)
  * Fix Keda policy installation issue (#5239)
  * fix: remove /approve from prow actions (#5243)
  * [Feature] Pin Dependencies by Hash (#5168)
  * chore: add loki to argocd lab (#5231)
  * Fixed description for secret name (#5228)
  * feat: add grafana dashboard to helm chart (#5230)
  * add remainder of e2e verifyImages tests (#5229)
  * add kuttl tests (#5204)
  * [BUG] Fix foreach deletion issue (#5224)
  * feat: add policy label to policy reports (#5198)
  * fix: too much information for the Policy Rule Execution Latency metric (#5208)
  * chore: server side apply in argo lab (#5209)
  * refactor: health check system (#5176)
  * fix: early return in policy validation (#5200)
  * feat: support disabling schema validation on the patched resource (#5197)
  * fix: deletion of reports not belonging to kyverno (#5194)
  * Helm chart: add extraCRDAnnotations value and set ArgoCD sync option by default (#4964)
  * refactor: remove policyreport package (#5174)
  * fix: use pagination to aggregate reports (#5190)
  * fix: check resource version on update notification (#5179)
  * fix: do not cancel context when loosing the lead (#5180)
  * chore: add kind config file (#5178)
  * fix: content type in log (#5177)
  * feat: run leader election in loop (#5173)
  * refactor: support Audit and Enforce validation failure actions (#5152)
  * Corrected Kubernetes spelling (#5134)
  * fix 5151 issue (#5170)
  * Add ability to use commands in comments (#5154)
  * fix: configure klog and global logger to use zapr in json mode (#5144)
  * feature: SLSA Level 3 provenance generation for Kyverno images: kyverno init, kyverno and kyvernopre (#4268)
  * Fixed issue-5102: Show rule count and type in output (#5106)
  * skip generating events on empty rule response (#5158)
  * reset resource version on update (#5157)
  * fix: mutation policy inconsistent patching for ephemeralContainers (#5121)
  * feat: remove policy mutation for auto-gen rules (#5123)
  * chore: remove old docs (#5130)
  * fix finalizers mutation with patchesJson6902 (#5132)
  * Add AGE in printer columns of CRDs (#5119)
  * feat: oci pull/push support for policie(s) (#5026)
  * feat: add categories support to our CRDs (#5112)
  * Remove old version of golang.org/x/sys (#5125)
  * fix: conformance tests (#5118)
  * [Feature] create command line option to set failurePolicy globally (#4991)
  * clean conformance (#5089)
  * feat: enable/disable Debug mode which shows entire AdmissionReview payload (#5024)
  * docs: separate dev and user docs (#5114)
  * ci: Fix install manifests publishing with Flux (#5110)
  * fix: use correct side effects in validating webhooks (#5080)
  * refactor: simplify variables regex (#5075)
  * feat: add flag to configure the number of background scan workers (#5088)
  * fix: allow delete of target resource with synchronize false (#5081)
  * ci: Use the Docker login action for GHCR auth (#5091)
  * fix: handle resource cleanup when policy is deleted (#5021)
  * test: add best practices policies in conformance tests (#5082)
  * fix: use correct logger in webhook controller (#5083)
  * feat: add simple conformance tests (#5073)
  * fix: make reponse order predictable (#5079)
  * added apiCalls support in kyverno-apply command (#4938)
  * feat: add webhook server logger (#5063)
  * fix: configure idle timeout in server (#5062)
  * fix: image verification reports missing in admission mode (#5037)
  * fix: setup max procs with correct logger (#5059)
  * fix: detection of kyverno going down (#5055)
  * fix: do not update reports when they are identical (#5056)
  * fix: go routines not gracefully shut down in controllers (#5022)
  * fix: account for policy/rule deletion in aggregated reports (#5048)
  * Created configuration file for Openssf scorecard (#4778)
  * feat: add image verification support to background scan (#5047)
  * feat: add controller logger helper (#5029)
  * fix env (#5046)
  * fix: lease log message (#5030)
  * feat: make shutdown more graceful (#5031)
  * fix: lower default qps/burst (#5034)
  * fix: Attempt to fix the CI failure, extract CI job push-sign-install-manifest (#5035)
  * Fixed issue-4655: verifyImages is executed before mutate (#4996)
  * fix: add more infos in reports printers (#5027)
  * Enable adding annotations to configmaps in the helm chart (#4984)
  * validate patchJSON6902 (#4469)
  * remove RBACInfo check (#5015)
  * fix: policy not denied when kinds set is empty (#5016)
  * fix: global anchor warning (#4962)
  * fix: don't process non background policies in background scan (#5008)
  * fix: update policy status (#5006)
  * fix: use default retry with retryfunc for a conflict (#4973)
  * updates with case insensitivity guarantee (#4954)
  * refactor: add update status helper (#4985)
  * fix principal and role variables are not substituted (#5000)
  * fix: skip admission in dry run requests (#4994)
  * fix: webhooks not registering when using name override (#4992)
  * feat: add metrics server and kube-prometheus-stack to argocd lab (#4995)
  * feat: add startup probes support (#4896)
  * feat: add policy-reporter to argocd lab (#4988)
  * docs: add resource exclusions note in helm docs (#4989)
  * chore: add myself in approvers (#4990)
  * feat: Add container registry setting on Helm Chart (#4281)
  * fix: config reloading not working correctly (#4951)
  * fix: missing autogen rules in status (#4971)
  * fix: add user info in admission request logs (#4969)
  * fix: don't produce empty admission reports (#4966)
  * fix: improve banned types management in reports (#4953)
  * fix: missing watchers in resource report controller (#4967)
  * chore: Push and sign install manifests to GHCR (#4895)
  * Fixed issue-4530: Added separate attestor type for secrets and KMS (#4733)
  * fix: admission reports printer (#4950)
  * chore: bump a few deps (#4943)
  * Added support to specify key signature algorithm in verifyImages (#4855)
  * fix: don't report ready until certs are valid (#4934)
  * Update issue templates and scan for vulns action (#4952)
  * Fix background scan with request.operation (#4947)
  * fix: consider generateName when matching resources (#4945)
  * fix: probes should work in debug mode (#4926)
  * fix: set operation in context when necessary (#4940)
  * chore: add COSIGN_REPOSITORY env to ko-publish-dev step (#4922)
  * fix: panic when bad variable substitution (#4928)
  * feat: make cert renewer private and add server name support (#4904)
  * chore: bump a couple of deps (#4925)
  * [Cleanup] Disable PolicySkipped events (#4913)
  * add filter for validation policies when ValidationFailureActionOverrides is used (#4809)
  * chore: update controller-tools to v0.10.0 (#4918)
  * fix: use constants defined in openapi controller (#4919)
  * chore: signing helm releases (#4801)
  * fix: openapi controller discovery (#4912)
  * refactor: openapi controller part 2 (#4910)
  * fix: clean background scan reports (#4908)
  * fix: don't specify rules when aggregationRule is set (#4867)
  * refactor: openapi controller part 1 (#4901)
  * fix: remove unnecessary dependencies from tls package (#4903)
  * fix: reduce webhook controller logs (#4897)
  * chore: add argocd lab (#4884)
  * refactor: manage webhooks with webhook controller (#4846)
  * fix: auto gen enabled when using names (#4863)
  * fix: non watchable resources in report controller (#4888)
  * Fix result colour (#4885)
  * fix: background scan labels (#4865)
  * fix: hardening policy validation for generate cloneList (#4881)
  * docs: add section in helm docs to install with argocd (#4878)
  * fix test output numbering (#4853)
  * feature: use cert extension oid as key (#4854)
  * chore: add launch.json for vscode debugging (#4856)
  * Add workflow to detect and report on image vulns (#4850)
  * docs: add debug instructions (#4843)
  * e2e test for mutate policy (#3383)
  * fix: replace AbsPath with RequestURI to support query params (#4849)
  * refactor: make cert manager a real controller (#4792)
  * refactor: add config support to webhook controller (#4838)
  * feat: use a dedicated policy metrics controller (#4818)
  * chore: bump a couple of deps (#4842)
  * Update PSa images dsecription (#4840)
  * refactor: leader controllers management (#4832)
  * fix extension checks (#4836)
  * fix: call depth in logging package and global logger support for call depth (#4834)
  * upgrade controller-runtime dependency (#4829)
  * refactor: non leader controllers management (#4831)
  * refactor: make tls cert func not depending on cert controller (#4820)
  * fix: use new client in tls package (#4746)
  * fix: debug mode (#4785)
  * fix: add policy validation for ValidationFailureActionOverride field (#4784)
  * update helm doc
  * Fix CRD format issue
  * Bump k8s libraries to v0.25.2
  * Fix PSa the control name validation
  * fix: validationFailureAction default value (#4822)
  * refactor: split main into sub funcs (#4821)
  * chore: use concurrent map v2 (generics) (#4803)
  * fix: controllers start in loop (#4815)
  * refactor: split main into sub func (#4810)
  * feat: add context support to leader election (#4811)
  * feat: add context funcs to logging package (#4812)
  * skip succeed rules when building the blocked return message (#4804)
  * fix: subject and issuer validation when attestations are present (#4786)
  * refactor: split main func for metrics (#4796)
  * fix: remove error prone debug field (#4794)
  * chore: bump a couple of deps (#4802)
  * refactor: split main into funcs (#4795)
  * fix: logger panic (#4793)
  * fix: publish yaml manifests in release instead of repo (#4738)
  * fix: remove explicit wait for cache sync (#4791)
  * Add security context and resource block to test (#4712)
  * fix: new cert manager controller never returns error (#4789)
  * chore: bump a few deps (#4790)
  * refact：update script of generate-self-signed-cert-and-k8secrets.sh to supports custom namespace (#4758)
  * refactor: introduce webhook controller (#4749)
  * fix: remove reference to controller runtime log (#4779)
  * refactor: more context less chans (#4764)
  * Fix: Typo in x509_decode JMESPath function's note (#4773)
  * fix: add workers to the controller interface (#4776)
  * update cosign and k8s-manifest-sigstore (#4781)
  * chore: change charts registry url (#4768)
  * add package logger in files (#4766)
  * fix: parse flags error handling (#4775)
  * refactor: make server owner of the cleanup chan (#4765)
  * refactor: use context in openapi controller (#4760)
  * refactor: use context in controllers instead of chan (#4761)
  * refactor: use context in dynamic client instead of chan (#4756)
  * refactor: move from io/ioutil to io and os packages (#4752)
  * refactor: split main in a couple of funcs and use local loggers (#4754)
  * fix: helm self signed cert (#4745)
  * add and use package level logger (#4750)
  * fix: watch error in resource controller (#4751)
  * chore: use constant in cert manager controller (#4747)
  * feat: add typed client support and metrics wrapper (#4724)
  * chore: speed up helm docs gen on mac (#4742)
  * fix: reports not generated (#4743)
  * feat: allow users enable JSON logging with a --loggingFormat=json flag (#4661)
  * fix: use a single leader election (#4722)
  * fix: containerd dependency vulnerability (#4629)
  * Add PSa policy validations (#4735)
  * Added `x509_decode` JMESPath function (#4664)
  * feat: add matchlabel selector support with multiple clone (#4713)
  * docs: add policy cache controller docs (#4714)
  * fix: output make messages to stderr (#4727)
  * feat: reports v2 implementation (#4608)
  * Support PSa integration by `controlName` only (#4710)
  * chore: update client code generator (#4711)
  * chore: group unit and cli tests targets and separate sections (#4693)
  * fix: remove deprecation notice (#4635)
  * chore: enable overriding images repo (#4694)
  * fix: change key used in test (#4718)
  * chore: refactor manifests related makefile targets (#4706)
  * fix: missing client wrapper (#4703)
  * refactor: use pod name as leader id (#4680)
  * fix: split webhook handlers per failure policy (#4650)
  * fix: shutdown controllers workers gracefully (#4681)
  * fix: namespaced policy targets namespace validation and scoping them to the policy's namespace (#4671)
  * refactor: replace signal package by signal.NotifyContext (#4691)
  * fix: jmespath random error handling (#4697)
  * chore: simplify go mod (#4692)
  * fix: bump net standard lib (#4685)
  * fix: handle auth permission for cloneList validation (#4684)
  * fix: namespaced policy not validated in engine (#4653)
  * chore: bump minimum go version (#4677)
  * Fix issue for wildcard versions (#4670)
  * chore: publish sbom result to a different repositry from an image (#4665)
  * added kubeconfig and context flag to kyverno apply (#4524)
  * feat: add feature flag to disable background scan (#4638)
  * feat: add explicit key support to controller utils (#4628)
  * refactor: update log based on the policy types (#4646)
  * refactor: split policyreport api files (#4641)
  * fix: missing elements in v2beta1 api (#4654)
  * refactor: add a couple of constants in api (#4640)
  * feat: introduce RCR interface (#4642)
  * fix: incorrect namespace in report controller (#4637)
  * fix: remove RCR from mutation webhook (#4636)
  * feat: add controller utils tools (#4639)
  * chore: bump cosign 1.12.0 to fix vulnerabilities (#4631)
  * chore: add makefile target to deploy metrics server (#4627)
  * chore: add target to deploy policy reporter (#4621)
  * Integrate Sonarcloud and Nancy github action (#3491)
  * fix: background printer column (#4617)
  * enhance jmespath random-filter (#4591)
  * fix: lock in policy report mapper (#4601)
  * refactor: simplify RCR creator queue (#4578)
  * chore: add messages in makefile kind targets (#4588)
  * refactor: info in policyreport package (#4598)
  * Fix multiple crd slowness issue  (#4275)
  * update helm releases path (#4596)
  * enable autogen for validate.podsecurity with no exclude (#4594)
  * chore: add a codegen-quick makefile target (#4583)
  * chore: switch to github.com/IGLOU-EU/go-wildcard (#4563)
  * allow PSa validation with no exceptions (#4558)
  * fix: typo (#4582)
  * fix: split policy report flag (#4576)
  * update version drop-down (#4579)
  * chore: add toggle package unit tests (#4577)
  * chore: preserve pr title in cherry picks (#4573)
  * refactor: move generation handler out of webhooks package (#4570)
  * refactor: move image verification handler out of webhooks package (#4569)
  * refactor: move mutation handler out of webhooks package (#4567)
  * refactor: move validation audit out of webhooks package (#4562)
  * chore: add kocache (#4482)
  * docs: add help on fetching tags (#4560)
  * refactor: move validation handler out of webhooks package (#4556)
  * refactor: make webhook metrics helpers static (#4554)
  * add new patterns for releases (#4552)
  * refactor: move webhook events utils in utils package (#4545)
  * chore: add unit test for updating ur status (#4541)
  * fix: defer ur update until validation passes (#4540)
  * refactor: introduce ur updater (#4535)

-------------------------------------------------------------------
Tue Dec 20 12:22:22 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.5:
  * release v1.8.5 (#5726)
  * tag v1.8.5-rc.1 (#5718)
  * Cherry-pick Require predicate type (#5717)
  * cherry-pick: fix digest and verify logic (#5706)
  * fix: interface conversion panic (#5708) (#5711)
  * Delete category all from CRDs (cherry-pick #5557) (#5709)

-------------------------------------------------------------------
Fri Dec 09 19:49:45 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.4:
  * release v1.8.4 (#5638)
  * tag v1.8.4-rc.1 (#5623)
  * fix nil error panic (#5619) (#5621)
  * fix: mutation of cached object in bg scan controller (#5608) (#5613)

-------------------------------------------------------------------
Tue Dec 06 06:10:10 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.3:
  * tag v1.8.3 (#5579)
  * tag v1.8.3-rc.2 (#5529)
  * feat: support attestations with multiple signatures (cherry-pick #5409) (#5528)
  * logging action (#5416) (#5527)
  * fix: bug in report resource watcher (#5525) (#5526)
  * feat: Add default CI test values for helm charts (#5518) (#5521)
  * feat(policies chart): Add ability to set autogen behavior (#5517) (#5520)
  * tag 1.8.3-rc.1 (#5508)
  * fix: report deletion fighting with garbage collection (#5486) (#5501)
  * Migrate all mutate e2e tests to kuttl and expand (#5491) (#5499)
  * Cherry-pick ff9328809b62097895b99d866d0d3c6d6a801ae9 (#5488)
  * fix: fix mutating the "/metadata/serverAddress" section of a keda.s/v1alpha1/ScaledObject object (#5374) (#5487)
  * fix: typo in autogen package (#5480) (#5481)
  * fix: add clone check before validating namespace policy (#5459) (#5471)
  * fix: issue when calling kustomize concurrently (cherry-pick #5465) (#5470)
  * fix: admission reports stacking up (#5457) (#5467)
  * fix: log watcher error in reports controller (#5449) (#5455)
  * Handle  Match resources kind (#5421) (#5450)
  * fix: mutate existing policy does not get applied when background=false (#5439) (#5447)
  * Fix multi attestor keyless (#5432) (#5433)
  * fix validationFailureAction case in kuttl tests (#5426)
  * Add most basic kuttl tests for generate rules, clone and sync (#5413) (#5424)

-------------------------------------------------------------------
Mon Nov 21 09:25:18 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.2:
  * Tag v1.8.2 (#5418)
  * tag v1.8.2-rc.2 (#5408)
  * Fixed issue-3709: Image verify rule gives error for non-existing configmap (#5272) (#5407)
  * add os.Exit (#5402) (#5405)
  * Complete all basic kuttl tests for generate rules, clone and no-sync (#5400) (#5403)
  * tag v1.8.2-rc.1 (#5393)
  * [Bug]: Fix wildcard any/all issue (#5387) (#5390)
  * fix: enable policy validation for the verifyImage rule (#5383)
  * fix: set logger in metrics server (#5319) (#5377)
  * Add more kuttl generate test cases (#5364) (#5382)
  * test: add rbac kuttl test (#5337) (#5380)
  * fix: set correct logger in profiling server (#5358) (#5381)
  * fix closed watchers in the resource-report-controller (#5350) (#5378)
  * fix: add validation for generate namespace policy (#5346) (#5373)
  * fixed dryrun option to handle changes caused by mutating policy (#4899) (#5375)
  * add test cases for yaml verification feature (#5326) (#5372)
  * chore: add tempo to argocd lab (#5365) (#5370)
  * chore: add performance tests tool (#5241) (#5369)
  * fix: panic when disable metrics is true (#5366) (#5368)
  * chore: enable json logs in argocd lab (#5349) (#5359)
  * refactor: optimise and use kuttl TestStep with tests (#5328) (#5353)
  * test: add kuttl debug failure (#5339) (#5341)
  * chore: add cli binary to gitignore (#5331) (#5333)
  * test: add test to check expected webhooks are created (#5330) (#5332)
  * fix: synchronize source resource update to clone list resource (#5317) (#5320)
  * Fix issue where CLI test command ignores failures (#5189) (#5313)
  * fix: add parsing of json pointers to support special chars (#3578 #3616) (#4767) (#5315)
  * test: add kuttl tests for jmespath special chars (#5310) (#5316)
  * fix: wrong logger used (#5311) (#5314)
  * chore: Fix policy installation issue (cherry-pick #5239) (#5308)
  * fix: reduce startup probe delay (#5296) (#5302)
  * fix: send notification when stoping watching resource in reports system (#5298) (#5309)
  * fix: set rule response status as skip if precondition failed (#5162) (#5306)
  * Update kuttl test scaffolding (#5303) (#5304)
  * tests: add kuttl tests for multiple clone generate (#5280) (#5299)
  * add a note to 1.8.2-rc1 release (#5291)
  * fix: allow delete of clone target resource with synchronize false (#5161) (#5297)
  * fix: check policy is ready in kuttl tests (#5286) (#5292)
  * fix: image extractor kuttl tests (#5293) (#5295)
  * fix: kuttl test external-service (#5287) (#5290)
  * chore: update kuttl (#5285) (#5288)
  * refactor: admission metrics (counter and latency) (#5245) (#5282)
  * chore: use conditions in kuttl tests to check ready policies (#5252) (#5281)
  * fix: make zapr compatible with klog's -v argument (#5166) (#5283)
  * fix: keep admission warnings (#5269) (#5275)
  * chore: add kuttl autogen tests (#5253) (#5274)
  * fix: add missing test suite to kuttl (#5268) (#5273)
  * fix: early return in policy validation (cherry-pick #5200) (#5213)
  * chore: remove old conformance tests files (#5260) (#5263)
  * fix: account for error rules in mutation webhook (#5264) (#5267)
  * refactor: admission response utils (#5234) (#5265)
  * chore: add kuttl in makefile (#5254) (#5258)
  * Kuttl updates (#5257) (#5261)
  * More kuttl tests (#5238) (#5259)
  * add remainder of e2e verifyImages tests (#5229) (#5256)
  * add kuttl tests (cherry-pick #5204) (#5255)
  * refactor: move all middlewares in handlers sub package (cherry-pick #5244) (#5250)
  * chore: add loki to argocd lab (#5231) (#5240)
  * feat: add grafana dashboard to helm chart (#5230) (#5232)
  * feat: add policy label to policy reports (#5198) (#5225)
  * Merge 396593d8997f218270a398e18e956d892f004bc3 into b3c5a9c74165d573aab9928dd8ac1187e8d8fc3a (#5216)
  * chore: server side apply in argo lab (#5209) (#5210)
  * refactor: health check system (#5176) (#5207)
  * feat: support disabling schema validation on the patched resource (#5197) (#5206)
  * Helm chart: add extraCRDAnnotations value and set ArgoCD sync option by default (#4964) (#5195)
  * fix: deletion of reports not belonging to kyverno (#5194) (#5196)
  * fix: use pagination to aggregate reports (#5190) (#5192)
  * fix: check resource version on update notification (#5179) (#5186)
  * chore: add kind config file (#5178) (#5183)
  * fix: content type in log (#5177) (#5182)
  * fix: configure klog and global logger to use zapr in json mode (#5144) (#5181)
  * skip generating events on empty rule response (#5158) (#5160)
  * reset resource version on update (#5157) (#5159)
  * feat: add categories support to our CRDs (#5112) (#5137)
  * fix: mutation policy inconsistent patching for ephemeralContainers (#5121) (#5145)
  * Fixed issue-4655: verifyImages is executed before mutate (#4996) (#5143)
  * fix finalizers mutation with patchesJson6902 (#5132) (#5135)

-------------------------------------------------------------------
Tue Oct 25 18:44:22 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.1:
  * Tag v1.8.1 (#5133)
  * Tag v1.8.1-rc.4 (#5128)
  * remove the empty add entry in Hehlm chart manifest (#5127)
  * Remove old version of golang.org/x/sys (#5125) (#5126)
  * docs: separate dev and user docs (cherry-pick #5114) (#5117)
  * ci: Fix install manifests publishing with Flux (#5110) (#5111)
  * Tag v1.8.1-rc.3 (#5108)
  * fix: use correct side effects in validating webhooks (#5080) (#5105)
  * refactor: simplify variables regex (#5075) (#5104)
  * fix: allow delete of target resource with synchronize false (#5081) (#5095)
  * test: add best practices policies in conformance tests (#5082) (#5097)
  * fix: use correct logger in webhook controller (#5083) (#5098)
  * feat: add flag to configure the number of background scan workers (#5088) (#5096)
  * ci: Use the Docker login action for GHCR auth (#5091) (#5094)
  * fix: handle resource cleanup when policy is deleted (#5021) (#5093)
  * Cherry pick 5035, 5046 (#5090)
  * fix: make reponse order predictable (#5079) (#5087)
  * feat: add simple conformance tests (#5073) (#5086)
  * feat: add webhook server logger (#5063) (#5085)
  * release 1.8.1-rc.2 (#5072)
  * fix: image verification reports missing in admission mode (cherry-pick #5037) (#5066)
  * fix: configure idle timeout in server (#5062) (#5067)
  * fix: setup max procs with correct logger (#5059) (#5065)
  * fix: do not update reports when they are identical (#5056) (#5061)
  * fix: detection of kyverno going down (#5055) (#5064)
  * fix: go routines not gracefully shut down in controllers (#5022) (#5060)
  * fix: account for policy/rule deletion in aggregated reports (#5048) (#5058)
  * feat: add metrics server and kube-prometheus-stack to argocd lab (#4995) (#5052)
  * feat: add image verification support to background scan (#5047) (#5049)
  * feat: add controller logger helper (#5029) (#5050)
  * feat: add policy-reporter to argocd lab (#4988) (#5051)
  * feat: make shutdown more graceful (#5031) (#5040)
  * Enable adding annotations to configmaps in the helm chart (#4984) (#5039)
  * fix: wrong controller logger names (#5043)
  * chore: add argocd lab (#4884) (#5041)
  * fix: lease log message (#5030) (#5045)
  * fix: lower default qps/burst (#5034) (#5038)
  * fix: add more infos in reports printers (#5027) (#5033)
  * Tag v1.8.1-rc1 (#5020)
  * remove RBACInfo check (#5015) (#5019)
  * fix: policy not denied when kinds set is empty (#5016) (#5017)
  * fix: global anchor warning (#4962) (#5013)
  * feat: add startup probes support (#4896) (#5012)
  * fix: webhooks not registering when using name override (#4992) (#5010)
  * fix: don't process non background policies in background scan (#5008) (#5009)
  * fix principal and role variables are not substituted (#5000) (#5001)
  * fix: update policy status (#5006) (#5007)
  * fix: use default retry with retryfunc for a conflict (#4973) (#5005)
  * updates with case insensitivity guarantee (#4954) (#5003)
  * refactor: add update status helper (#4985) (#5002)
  * fix: skip admission in dry run requests (#4994) (#4999)
  * fix: improve banned types management in reports (#4953) (#4997)
  * docs: add resource exclusions note in helm docs (#4989) (#4993)
  * feat: Add container registry setting on Helm Chart (cherry-pick #4281) (#4987)
  * fix: config reloading not working correctly (#4951) (#4982)
  * fix: missing autogen rules in status (#4971) (#4978)
  * fix: missing watchers in resource report controller (#4967) (#4974)
  * fix: add user info in admission request logs (#4969) (#4976)
  * fix: don't produce empty admission reports (#4966) (#4972)
  * chore: Push and sign install manifests to GHCR (#4895) (#4970)
  * fix: admission reports printer (#4950) (#4961)
  * fix: consider generateName when matching resources (#4945) (#4960)
  * chore: bump a few deps (#4943) (#4958)
  * fix: don't report ready until certs are valid (#4934) (#4957)
  * Fix background scan with request.operation (#4947) (#4949)
  * fix: probes should work in debug mode (#4926) (#4944)
  * fix: set operation in context when necessary (#4940) (#4942)
  * chore: add COSIGN_REPOSITORY env to ko-publish-dev step (#4922) (#4936)
  * add filter for validation policies when ValidationFailureActionOverrides is used (#4809) (#4932)
  * fix: panic when bad variable substitution (#4928) (#4935)
  * feat: make cert renewer private and add server name support (#4904) (#4933)
  * [Cleanup] Disable PolicySkipped events (#4913) (#4931)
  * chore: bump a couple of deps (#4925) (#4929)
  * chore: update controller-tools to v0.10.0 (#4918) (#4923)
  * fix: use constants defined in openapi controller (#4919) (#4921)
  * chore: signing helm releases (#4801) (#4920)
  * fix: openapi controller discovery (#4912) (#4917)
  * fix: don't specify rules when aggregationRule is set (#4867) (#4915)
  * refactor: openapi controller part 2 (#4910) (#4914)
  * refactor: openapi controller part 1 (#4901) (#4906)
  * fix: clean background scan reports (#4908) (#4911)
  * fix: remove unnecessary dependencies from tls package (#4903) (#4905)
  * fix: reduce webhook controller logs (#4897) (#4900)
  * refactor: manage webhooks with webhook controller (#4846) (#4893)
  * fix: auto gen enabled when using names (#4863) (#4892)
  * fix: non watchable resources in report controller (#4888) (#4890)
  * Fix result colour (#4885) (#4887)
  * fix: background scan labels (#4865) (#4886)
  * cherry-pick (#4794 #4812 #4815 #4821 #4784 #4820 #4831 #4834 #4818 #4838 #4792 #4843 #4878) (#4882)
  * fix: hardening policy validation for generate cloneList (#4881) (#4883)
  * cherry-pick (#4811 #4849 #4842 #4829) (#4877)
  * fix test output numbering (#4853) (#4875)
  * cherry-pick (#4790 #4791 #4795 #4796 #4802 #4803) (#4861)
  * cherry-pick (#4749 #4766 #4773 #4775 #4779 #4785 #4789) (#4860)
  * cherry-pick (#4754 #4756 #4760 #4761 #4764 #4765 #4776) (#4859)
  * cherry-pick (#4745 #4746 #4747 #4750 #4752) (#4858)
  * cherry-pick (#4661 #4712 #4722 #4724 #4742) (#4857)

-------------------------------------------------------------------
Mon Oct 10 11:59:03 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.0:
  * release: 1.8 (#4851)
  * Update PSa images dsecription (#4840) (#4841)
  * tag v1.8.0-rc6 (#4839)
  * fix extension checks (#4836) (#4837)
  * Cherry pick #4814 (#4826)
  * update helm doc (#4824)
  * fix: validationFailureAction default value (#4822) (#4823)
  * Cherry-pick #4815 (#4817)
  * tag v1.8.0-rc5 (#4807)
  * fix: subject and issuer validation when attestations are present (#4786) (#4805)
  * skip succeed rules when building the blocked return message (#4804) (#4806)
  * cherry-pick #4738 (#4799)
  * cherry-pick #4793 (#4800)
  * update cosign (#4797)
  * chore: change charts registry url (#4768) (#4780)
  * tag v1.8.0-rc4 (#4759)
  * fix: watch error in resource controller (#4751) (#4753)
  * fix: reports not generated (#4743) (#4744)
  * tag v1.8.0-rc3 (#4741)
  * fix: containerd dependency vulnerability (#4629) (#4740)
  * Add PSa policy validations (#4735) (#4739)
  * Added `x509_decode` JMESPath function (#4664) (#4737)
  * feat: add matchlabel selector support with multiple clone (#4713) (#4734)
  * fix: output make messages to stderr (#4727)
  * fix crds yaml conflicts
  * feat: reports v2 implementation (#4608)
  * docs: add policy cache controller docs (#4714) (#4730)
  * chore: update client code generator (#4711) (#4728)
  * Support PSa integration by `controlName` only (#4710) (#4725)
  * chore: group unit and cli tests targets and separate sections (#4693) (#4723)
  * chore: enable overriding images repo (#4694) (#4721)
  * chore: refactor manifests related makefile targets (#4706) (#4720)
  * fix: change key used in test (#4718) (#4719)
  * fix: missing client wrapper (#4703) (#4709)
  * refactor: use pod name as leader id (#4680) (#4708)
  * fix: split webhook handlers per failure policy (#4650) (#4707)
  * fix: shutdown controllers workers gracefully (#4681) (#4704)
  * fix: namespaced policy targets namespace validation and scoping them to the policy's namespace (#4671) (#4702)
  * refactor: replace signal package by signal.NotifyContext (#4691) (#4701)
  * fix: jmespath random error handling (#4697) (#4699)
  * chore: simplify go mod (#4692) (#4696)
  * fix: bump net standard lib (#4685) (#4690)
  * fix: handle auth permission for cloneList validation (#4684) (#4687)
  * fix: namespaced policy not validated in engine (#4653) (#4682)
  * chore: bump minimum go version (#4677) (#4678)
  * Fix issue for wildcard versions (#4670) (#4673)
  * chore: publish sbom result to a different repositry from an image (#4665) (#4667)
  * refactor: update log based on the policy types (#4646) (#4658)
  * feat: add explicit key support to controller utils (#4628) (#4659)
  * feat: add feature flag to disable background scan (#4638) (#4660)
  * refactor: split policyreport api files (#4641) (#4657)
  * fix: missing elements in v2beta1 api (#4654) (#4656)
  * refactor: add a couple of constants in api (#4640) (#4652)
  * feat: introduce RCR interface (#4642) (#4651)
  * fix: incorrect namespace in report controller (#4637) (#4649)
  * fix: remove RCR from mutation webhook (#4636) (#4647)
  * chore: bump cosign 1.12.0 to fix vulnerabilities (#4631) (#4633)
  * feat: add controller utils tools (#4639) (#4645)
  * fix: background printer column (#4617) (#4620)
  * enhance jmespath random-filter (#4591) (#4619)
  * fix: lock in policy report mapper (#4601) (#4611)
  * release v1.8.0-rc2 (#4607)
  * refactor: simplify RCR creator queue (#4578) (#4606)
  * chore: add messages in makefile kind targets (#4588) (#4604)
  * refactor: info in policyreport package (#4598) (#4603)
  * Fix multiple crd slowness issue  (#4275) (#4600)
  * update helm releases path (#4596) (#4599)
  * enable autogen for validate.podsecurity with no exclude (#4594) (#4595)
  * chore: add a codegen-quick makefile target (#4583) (#4587)
  * chore: switch to github.com/IGLOU-EU/go-wildcard (#4563) (#4586)
  * allow PSa validation with no exceptions (#4558) (#4585)
  * fix: typo (#4582) (#4584)
  * fix: split policy report flag (#4576) (#4581)
  * chore: add toggle package unit tests (#4577) (#4580)
  * chore: preserve pr title in cherry picks (#4573) (#4574)
  * refactor: move generation handler out of webhooks package (#4570) (#4572)
  * refactor: move image verification handler out of webhooks package (#4569) (#4571)
  * refactor: move mutation handler out of webhooks package (#4567) (#4568)
  * refactor: move validation audit out of webhooks package (#4562) (#4566)
  * chore: add kocache (#4482) (#4564)
  * refactor: move validation handler out of webhooks package (#4556) (#4561)
  * refactor: make webhook metrics helpers static (#4554) (#4555)
  * refactor: move webhook events utils in utils package (#4545) (#4548)
  * add new patterns for releases (#4551)
  * chore: add unit test for updating ur status (#4541) (#4544)
  * - tag v1.8.0-rc1; - remove "v" from Helm charts versions (#4538)
  * fix: defer ur update until validation passes (#4540) (#4543)
  * refactor: introduce ur updater (#4535) (#4539)
  * Support V2beta1 Version (#4514)
  * refactor: webhook block and unit tests (#4531)
  * refactor: webhook propagate start time along handlers (#4529)
  * refactor: webhook exclusion and unit tests (#4528)
  * feat: allow cloning multiple resource from a namespace (#4384)
  * add random filter (#4527)
  * chore: add protectManagedResources flag to changelog (#4522)
  * refactor: utils for warnings and unit tests (#4523)
  * refactor: use generics in client wrappers (#4525)
  * refactor: add auth interface and unit tests (#4518)
  * fix: api reference docs (#4490)
  * refactor: client wrappers (#4519)
  * feat: add kyverno managed resources protection (#4414)
  * fix: load policy and add tests (#4515)
  * chore: test for k8s 1.25 (#4503)
  * chore: add unit tests for pkg/utils/json (#4516)
  * chore: add unit tests for pkg/utils/yaml (#4512)
  * chore: add unit tests for pkg/utils/wildcard (#4510)
  * chore: add unit tests for pkg/utils/os (#4509)
  * chore: add unit tests for pkg/utils/image (#4508)
  * chore: update maintainers (#4511)
  * docs: add section for generating helm docs and crds (#4507)
  * chore: add wildcard unit test (#4506)
  * chore: upgrade golang to 1.18 (#4505)
  * docs: add section about switching between docker and ko (#4501)
  * Auto-detect Kyverno version in policies chart (#4460)
  * chore: refactor helm targets in makefile (#4498)
  * feat: support switchin build with docker or ko (#4492)
  * fix: incorrect kustomize call in makefile (#4493)
  * refactor: verify codegen targets in makefile (#4494)
  * fix: fetch history in pre-checks job (#4491)
  *  Improve printer column name for validationFailureAction (#4488)
  * chore: Bump helm-docs version to v1.11.0 (#4489)
  * chore: publish helm charts to ghcr.io (#4479)
  * chore: bump cache action and improve paths (#4485)
  * chore: relax auto update PRs conditions (#4486)
  * fix: release workflow (#4483)
  * refactor: clean webhooks logs (#4484)
  * refactor: webhook policy context creation (#4480)
  * docs: add api docs generation (#4476)
  * fix: auto update pr workflow (#4478)
  * chore: add makefile help comments (#4477)
  * refactor: to remove generate cleanup controller (#4041)
  * Add PodSecurity description (#4475)
  * feat: remove context api call constraints (#4389)
  * fix logger format (#4474)
  * feat: enable autogen from makefile (#4467)
  * chore: speed up local image builds (#4468)
  * chore: enable cherry-pick bot (#4470)
  * docs: add section for generated code (#4465)
  * fix: local image build with docker (#4462)
  * fix: warning in all makefile targets (#4464)
  * Extend Pod Security Admission (#4364)
  * docs: add section for deploying a local build (#4458)
  * refactor: make toggles easier to define and use (#4456)
  * Add the metric "kyverno_client_queries_total" (#4359)
  * skip validate rules if conditional anchor key doesn't exist in the resource (#4451)
  * refactor: clearly separate makefile docker targets for build and publish (#4454)
  * Yaml signing and verification (#4235)
  * docs: add pushing images section (#4452)
  * refactor: clearly separate makefile ko targets for build and publish (#4450)
  * chore: fix workflows related to ko recent changes (#4441)
  * docs: add local image build section (#4449)
  * chore: fix workflows related to ko recent changes (#4438)
  * Update issue template drop-down version numbers (#4446)
  * docs: add section for local builds (#4445)
  * [Feature] Add ability to get additional policies from restricted (#4416)
  * fix: update go-wildcard to v1.5.0 (#4444)
  * docs: add section for dev tools (#4443)
  * chore: remove godownloader and install-cli script (#4442)
  * Added kubeconfig flag support (#4308)
  * fix: ko login (#4427)
  * fix: ko login (#4425)
  * fix: ko login (#4424)
  * fix: ko login (#4423)
  * fix: ko login (#4422)
  * fix: make ldflags optional in .ko.yaml (#4419)
  * refactor: makefile build targets (#4418)
  * fix: Add --bare for ko-build-dev targets (#4417)
  * Use ko to build images (#4366)
  * refactor: makefile (#4403)
  * [Feature] Add posibility to set validationFailureAction by Policy (#4400)
  * feat: enable autogen internals by default (#4381)
  * bump golang 1.18.5 version digest in Dockerfile (#4413)
  * bump cosign deps version to 1.11.1 (#4408)
  * chore: improve docker image tagging (#4409)
  * refactor: introduce wildcard utils package (#4406)
  * fix: chart docs for generatecontrollerExtraResources (#4405)
  * chore: enable asasalint linter (#4396)
  * bump cosign version to 1.11.0 (#4398)
  * Sync 1.7.3 Helm versions (#4395)
  * fix: goimports check not working in ci job (#4387)
  * chore: fix golangcilint timeout (#4388)
  * fix: duration metrics precision (#4393)
  * chore: add workflow to ensure github actions are pinned to a commit SHA (#4390)
  * feat: add raw api call support (#3820)
  * chore: update maintainers md (#4380)
  * chore: fix fossa ci job (#4382)
  * fix: missing aggregated role for UR (#4378)
  * fix: exclude autogen rules when autogen internals is enabled (#4370)
  * fix: prevent installing helm chart in namespace kube-system (#4368)
  * fix: fix the verbosity of reconciling logs in the config controller (#4362)
  * Update wgpolicyk8s.io CRDs (#4355)
  * Update pr_documentation.md (#4361)
  * Added remove-color flag for CLI-test  (#4345)
  * Added appropriate logging levels to log.Info() calls wherever necessary (#4341)
  * update apply help message (#4344)
  * Fix deprecated  api policy issue (#4349)
  * Treat normal and precondition variable equally (#4217)
  * fix: image verify logs (#4348)
  * Remove myself as codeowner (#4333)
  * Fix PEM delimiter parse (#4331)
  * [Helm] Added ability to remove namespaces from default resourceFilters list (#4299)
  * chore(deps): bump github.com/sigstore/cosign from 1.10.0 to 1.10.1 (#4328)
  * support failurePolicy in kyverno-policies helm chart (#4323)
  * Context vars substitution in CLI (#4290)
  * Replaced status with message (#4315)
  * Changed resource names to plurals (#4312)
  * Fix pr image verify blocked (#4297)
  * feat: use tombstone helper (#4273)
  * Tightened scope on apiGroups for Kyverno:events Clusterrole (#4292)
  * trivial typo update (#4291)
  * use failurePolicy to block or allow requests, on policy errors (#4183)
  * update log levels (#4286)
  * added additional init and sidecar container config (#4283)
  * feat: auto optimize GOMAXPROCS (#4277)
  * add applyRules to control whether one or all rules are applied (#4196)
  * feature: added new type of event, PolicySkipped (#4251)
  * Reset policy status on termination (#4269)
  * fix: use an absolute path in docker entrypoint (#4263)
  * Add shutdown methods for exporters and controllers (#4214)
  * sync Helm versions (#4262)
  * fix: use only 1 kubernetes client (#4256)
  * Add Techcombank to adopters (#4260)
  * Implementing flag to show all failing tests only through the test command (#4227)
  * fix split policyreport name with background scan (#4237)
  * chore: use new distroless base image provided by distroless org (#4219)
  * fix check depreciated api issue (#4243)
  * Cherry-pick #4233 (#4236)
  * Revert "fix:  metrics with invalid validationMode (#4198)" (#4241)
  * fix:  metrics with invalid validationMode (#4198)
  * Corrected description for UpdateRequest struct (#4215)
  * Removed confusing output message for the apply and replaced no of policies by no of policy rules count in the output message (#4229)
  * fix kyverno cli policy-report typo (#4224)
  * feat: improve flag message for disableMetricsExport (#4194)
  * precondition failure will skip rule independent of audit or enforce mode (#4163)
  * Make method public (#4207)
  * Fix UpdateRequest labeling (from pull #4199) (#4212)
  * use the unstructured list instead of interface type (#4210)
  * feat: Opentelemetry support for metrics and traces (#3910)
  * Use non-blocking channel send for UpdateWebhookChan (#4204)
  * Fix merging JSON patches (#4202)
  * Resolve conflict introduced to contributing page (#4192)
  * return helpful error message on invalid patched resources. (#4129)
  * docs(contributing): add how to cherry-pick section (#4127)
  * refactor: finish refactoring generate e2e tests (#4090)
  * feat: policy status for autogen rules (#4173)
  * fix: use official controller-gen (#4171)
  * fix external.metrics.k8s.io/v1beta1 issue (#4139)
  * fix: add seccompProfile (#4178)
  * fix: add more verify images e2e test for bool fields (#4172)
  * delete policy reports on policy deletion (#4174)
  * chore: add myself into owners (#4170)
  * feat: split policy report per policy bases (#4147)
  * Clean up RCRs if the count exceeds the threshold (#4148)
  * Wait for informers' cache to be synced before starting controllers (#4155)
  * - Disable events generation on DELETE; - Reduce event generation retry from 10 to 3 (#4159)
  * Use kyverno namespace informer to list pods while processing URs (#4156)
  * Template updates (#4150)
  * release event memory (#4138)
  * fix: use dev tag for init container local build target (#4142)
  * added resource lists for test cli (#4082)
  * update contributing guide (#4119)
  * sync release versions (#4133)
  * bump cosign to 1.9.1 to fix fulcio panic (#4117)
  * fix: use policyName key to get the policy name (#4114)
  * fix imageVerify validation checks and conversion logic (#4038)
  * fix: Stop incorrect any block condition logging (#4107)
  * set test.namespace value implict as resource namespace until and unless explict value is added (#4100)
  * remove TUF initialization from main (#4098)
  * Update CODEOWNERS to include treydock (#4097)
  * feat: add e2e framework and verify image new test (#4094)
  * add chipzoller to CODEOWNERS (#4096)
  * refactor: generate e2e GeneratePolicyDeletionforCloneTests (#4071)
  * Exclude Kyverno namespace by default (#4079)
  * docs(chart): fix deadlink in NOTES.txt (#4085)
  * Updated jp command flags and also added URL for help. (#4084)
  * update drop-downs (#4081)
  * refactor: generate e2e tests (#4068)
  * refactor: use t.Cleanup in e2e tests (#4067)
  * Remove s390X (#4063)
  * fix: add missing release notes in helm chart (#4057)
  * fix: bool fields in image verification types (#4053)
  * Print for failed test cases (#4048)
  * Sync v1.7.0 release manifests (#4051)
  * refactor: bump KIND version to use v1.24.0 k8s release (#3877)
  * feat: add aggregated cluster role support (#3845)
  * chore(dockerfile): use buildx features for cross-compilation (#4023)
  * Ensure preconditions are present with default values (#4046)
  * Fix handling of kyverno-policies version check when port in image tag (#4042)
  * fix policy typo (#4039)
  * Fix labels with invalid charrs (#4034)
  * refactor: used typed admission request in ur (#4022)
  * fix vulnerable (#4027)
  * feat: Extend CLI to cover generate policies (#3456)
  * Request operation value by default to CREATE (#3894)
  * Feature: Add support for allowing insecure registries. (#3983)
  * refactor: move policy deletion code from policy controller to ur controller (#4013)
  * fix: bypass policy mutation if autogen internals enabled (#4007)
  * fix: use background helper in ur generator (#4009)
  * fix: remove update ur status in generator (#4008)
  * refactor: add policy event listener in ur controller (#4012)
  * chore: remove unused ur errors (#4011)
  * refactor: ur cleaner controller (#3974)
  * add validation check to ensure the annotations quoted (#3976)
  * Support `@` for mutate targets (#3998)
  * fix: stop mutation policies when autogen internals is enabled (#4004)
  * refactor: background controllers cleanup (#4001)
  * fix: stop mutating cached resource in ur controller (#4003)
  * refactor: move label helper utils from policy package to background package (#3996)
  * fix attestation checks (#3999)
  * fix: init container gr copy (#3995)
  * refactor: clean updaterequest generator (#3949)
  * chore: enable nosprintfhostport linter (#3989)
  * feat: add controller utils package (#3952)
  * refactor: make registry client variables private (#3975)
  * fix: ur is nil in ur controller (#3986)
  * chore: add previous pod logs in case of job failure (#3978)
  * fix: remove unused field (#3971)
  * fix: release ur when handler pod is gone (#3973)
  * fix: move ur controller filtering in reconciler (#3964)
  * fix: mark ur retry on conflict (#3961)
  * chore: enable paralleltest linter (#3946)
  * chore: enable goimports linter (#3959)
  * chore: make kyverno informers and listers import aliases consistent (#3958)
  * chore: enable ifshort linter (#3945)
  * fix: add helmignore (#3948)
  * fix: replica count in helm chart (#3954)
  * fix panic issue for ur (#3953)
  * Cleanup URs on trigger deletion (#3955)
  * chore: make kube informers and listers import aliases consistent (#3957)
  * chore: make clients import aliases consistent (#3956)
  * chore: make dclient import aliases consistent (#3951)
  * chore: make k8s api import aliases consistent  (#3950)
  * fix: use admissionrequest subresource to filter webhooks (#3944)
  * chore: make kyverno api import aliases consistent (#3939)
  * chore: enable nolintlint linter (#3941)
  * chore: enable grouper linter (#3940)
  * fix: cache warmup log message (#3943)
  * fix: use patch to update handler status in UR (#3928)
  * chore: enable makezero linter (#3937)
  * fix: handle UR delete once trigger namespace deleted (#3934)
  * chore: enable gofmt and gofumpt linters (#3931)
  * chore: enble gci linter (#3930)
  * fix: return type changed to bool in jpfCompare fn (#3924)
  * refactor: separate policy cache and controller (#3925)
  * refactor: separate resource mutation/validation handlers from server (#3908)
  * chore: enable misspell linter (#3932)
  * chore: enable errname linter (#3926)
  * chore: enable decorder linter (#3920)
  * refactor: policy cache (#3919)
  * chore: enable dogsled linter (#3921)
  * Cleanup the UR for mutate policies once it's completed (#3912)
  * [Bugbash] Kceu22 bugbash/fix staticcheck warnings (#3917)
  * fix: gosec G304 file inclusion error (#3916)
  * refactor: separate policy mutation/validation handlers from server (#3905)
  * fix: docker build (#3907)
  * refactor: webhooks server logger (#3904)
  * feat: gracefull certificates rotation support (#3890)
  * chore: remove ca-certificates from our repository (#3859)
  * chore: enable wastedassign linter (#3898)
  * chore: enable goprintffuncname linter (#3899)
  * chore: remove unused function (#3902)
  * Remove permissions in helm-release workflow (#3901)
  * Timeout and init (#3893)
  * fix: write secret (#3891)
  * Fix subject match selector issue in cli (#3887)
  * refactor: remove deployment hash on certs secrets (#3886)
  * chore: enable noctx linter (#3888)
  * chore: enable importas linter (#3882)
  * skip var checks in attestations (#3876)
  * chore: enable gochecknoinits linter (#3874)
  * refactor: cleanup tls package (#3854)
  * chore: enable containedctx linter (#3873)
  * fix: include ca key in secret (#3804)
  * refactor: make config vars private (#3823)
  * fix: undo length validation check for generate rule resource name (#3865)
  * fix subjects in test cli (#3743)
  * chore: enable exportloopref linter (#3869)
  * chore: enable tenv thelper and tparallel linters (#3868)
  * chore: enable durationcheck linter (#3870)
  * chore: enable asciicheck and bidichk linters (#3871)
  * chore: add unconvert linter (#3867)
  * chore: enable whitespace linter (#3864)
  * Handle errors properly for mutate and generate on existing resources (#3863)
  * fix: remove code to load CA from kubeconfig (#3860)
  * chore: enable more linters (#3862)
  * chore: enable deadcode and unused linters (#3861)
  * chore: increase golangci-lint timeout (#3855)
  * refactor: init certs with certs renewer directly (#3853)
  * tests: add unit tests for utils functions (#3857)
  * chore: enable golangci-lint in ci (#3852)
  * feat: fetch tls certificate dynamically (#3851)
  * fix: golangci-lint warnings in pkg (#3846)
  * refactor: remove the need for self-signed annotation on cert secret (#3850)
  * handle subresources (#3841)
  * fix: golangci-lint warnings in cmd (#3843)
  * refactor: webhookconfig package (part 4) (#3835)
  * refactor: webhookconfig package (part 3) (#3834)
  * refactor: remove unused functions (#3840)

-------------------------------------------------------------------
Tue Sep 27 06:32:11 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.4:
  * fix: update github action to use current workflow path (#4705)
  * tag v1.7.4 (#4698)
  * fix: incorrect namespace in report controller (#4637) (#4688)
  * Fix issue for wildcard versions (#4670) (#4674)

-------------------------------------------------------------------
Wed Sep 07 06:59:32 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.3:
  * Cherry-pick #4398 - bump cosign to 1.11.0 (#4399)
  * Release v1.7.3 (#4394)
  * Fix deprecated  api policy issue (#4349) (#4350)
  * precondition failure will skip rule independent of audit or enforce mode (#4163) (#4296)

-------------------------------------------------------------------
Mon Jul 25 11:08:18 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.2:
  * tag v1.7.2 (#4261)
  * Use non-blocking channel send for UpdateWebhookChan (#4204) (#4247)
  * Release v1.7.2-rc2 (#4246)
  * fix split policyreport name with background scan (#4237) (#4245)
  * fix check depreciated api issue (#4243) (#4244)
  * fix kyverno cli policy-report typo (#4224) (#4232)
  * Limit queued events (#4233)
  * update cosign to v1.9.0 (#4231)
  * Only set up logging context if it will be used (#4213)
  * use the unstructured list instead of interface type (#4211)
  * Fix UpdateRequest labeling (#4199)
  * Release 1.7 (#4200)
  * external.metrics.k8s.io/v1beta1 issue (#4182)
  * delete policy reports on policy deletion (#4174) (#4175)
  * tag v1.7.2-rc1 (#4167)
  * feat: split policy report per policy bases (#4147) (#4166)
  * Re-implement #4159 (#4165)
  * Cherry pick #4155 (#4164)
  * Cherry-pick #4148
  * Use kyverno namespace informer to list pods while processing URs (#4156)
  * Cherry-pick #4138 to 1.7 (#4160)
  * fix: use dev tag for init container local build target (#4141)

-------------------------------------------------------------------
Wed Jun 22 08:17:51 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.1:
  * tag v1.7.1 (#4132)
  * fix build failures
  * fix: bool fields in image verification types (#4053)
  * cherry-pick #4013
  * Release 1.7 (#4130)
  * fix: use policyName key to get the policy name (#4113)
  * chore(dockerfile): use buildx features for cross-compilation (#4023) (#4123)
  * Updated jp command flags and also added URL for help. (#4122)
  * fix: handle nil ur while retry (#4109)
  * Release 1.7 (#4099)
  * Bump Charts version to 2.5.0 (#4092)
  * bump chart versions to v2.4.2 (#4089)
  * cherry-pick #4079 (#4088)
  * Remove s390X (#4063) (#4064)
  * Bump charts version to 2.4.1 (#4061)
  * Ensure preconditions are present with default values (#4046)
  * Fix handling of kyverno-policies version check when port in image tag (#4042)

-------------------------------------------------------------------
Sat Jun 04 18:55:18 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.0:
  * Tag v1.7.0 (#4050)
  * refactor: bump KIND version to use v1.24.0 k8s release (#4049)
  * fix policy typo (#4039) (#4045)
  * Tag 1.7.0-rc3 (#4036)
  * Fix labels with invalid charrs (#4034) (#4035)
  * Cherry-pick #4022 (#4033)
  * fix vulnerable (#4027) (#4028)
  * Request operation value by default to CREATE (#3894) (#4026)
  * Release v1.7.0-rc2 (#4021)
  * Cherry pick #4007 #4008 (#4020)
  * fix: stop mutation policies when autogen internals is enabled (#4004,#4009,#3996) (#4016)
  * cherry-pick fix attestation checks https://github.com/kyverno/kyverno/pull/3999 (#4015)
  * refactor: add policy event listener in ur controller (#4012) (#4014)
  * Support `@` for mutate targets (#3998) (#4010)
  * fix: stop mutating cached resource in ur controller (#4003) (#4006)
  * fix: move ur controller filtering in reconciler (#3964) (#3994)
  * fix: release ur when handler pod is gone (#3993)
  * fix: mark ur retry on conflict (#3961) (#3963)
  * fix: replica count in helm chart (#3954) (#3962)
  * Cherry pick #3953 #3955 (#3960)
  * fix: handle UR delete once trigger namespace deleted (#3934) (#3938)
  * fix: use patch to update handler status in UR (#3927)
  * Cleanup the UR for mutate policies once it's completed (#3923)
  * Remove permissions in helm-release workflow (#3901) (#3903)
  * Release v1.7.0-rc1 (#3896)
  * cherry-pick #3893 (#3895)
  * Fix subject match selector issue in cli (#3887) (#3892)
  * skip var checks in attestations (#3876) (#3885)
  * fix: undo length validation check for generate rule resource name (#3865) (#3872)
  * Handle errors properly for mutate and generate on existing resources (#3863) (#3866)
  * refactor: remove unused functions (#3844)
  * handle subresources (#3841) (#3848)
  * feat: trigger generate on existing matched resource (#3819)
  * refactor: webhook config package (part 2) (#3833)
  * refactor: webhookconfig package (part 1) (#3831)
  * fix check and add logs (#3838)
  * Allow variables of any kind to be defined (#3828)
  * fix: policy deletion in webhookconfig (#3832)
  * refactor: imported pkg redeclared and a few other unused func (#3827)
  * refactor: shell to prevent globbing and word splitting (#3829)
  * CLI should respect scored annotation for warnings (#3821)
  * Add an object_from_lists function (#3824)
  * Improve logging and error handling in json context (#3825)
  * Relax JMESPath variable validation (#3826)
  * Load `mutate.targets` via dclient (#3797)
  * Cert attestor (#3809)
  * handle duplicate images; use container name as key (#3779)
  * fix: autogen rules in status (#3728)
  * refact: disable leader for update request controller (#3807)
  * chore: remove broken .ca from helm chart (#3811)
  * fix: remove k8s apiserver from self-generated cert (#3803)
  * Policy Validation check for onPolicyUpdate flag (#3814)
  * Add `handler` to `UR.status` (#3791)
  * fix: remove kubeconfig (#3802)
  * fix: cleanup old dependencies from go.sum and go.mod (#3806)
  * feat: parse all root CA certs (#3808)
  * removed kubeconfig flags (#3744)
  * Fix issue with image registry when decoding OCI descriptors with out of spec keys (#3799)
  * refactor: move config controller in controllers package (#3790)
  * chore: add informer util (#3796)
  * chore: remove useless util NewKubeClient (#3795)
  * fix: pod stay in terminating when scaling to 0 (#3793)
  * Add JMESPath Function `items` (#3777)
  * Fix Cli test for image verification (#3760)
  * Add rule to PolicyViolation event messages (#3787)
  * chore: remove config flags (#3786)
  * fix: add missing tombstone calls (#3784)
  * refactor: create a package for controllers and move certmanager in it (#3782)
  * refactor: policycache package logger (#3783)
  * refactor: move ImageExtractorConfigs in api package (#3781)
  * refactor: dclient package logger (#3778)
  * Fix PR update flow and allow updates from release branches (#3780)
  * fix: cert manager duplicate event handler (#3772)
  * webhookconfig: if services resource, add services/status as well (#3740)
  * refactor: dclient package (#3775)
  * refactor: replace clientset by inteface (#3774)
  * refactor: cosign package logger (#3773)
  * Bump cosign and sigstore version (#3771)
  * Auto-update PRs which are enabled for auto-merging (#3766)
  * refactor: wait for cache sync (#3765)
  * Allow kyverno jp to take yaml files as inputs (#3768)
  * Allow non-object type elements for foreach rules (#3763)
  * fix: logger call depth (#3759)
  * Reduce log verbosity for image extractors (#3764)
  * chore: remove unused resourcecache package (#3762)
  * refactor: remove unstructured usage from webhookconfig (#3737)
  * refactor: use typed informers and add tombstone support to webhookconfig (#3736)
  * Remove YAML multiline support in CM values (#3721)
  * cleanup event messages and sources (#3741)
  * Add tests for required checks for image verify (#3755)
  * Add error handling and log for image extractor errors (#3724)
  * Fix verify all images (#3748)
  * Retry policy creation to avoid flaky CRD readiness (#3752)
  * Fix test Summary printing for failure test cases (#3749)
  * Enable tests in makefile (#3699)
  * refactor: metrics package logger (#3734)
  * Use inclusive language (#3738)
  * fix: block policy for missing matched kind (#3733)
  * fix: missing image verification rules in autogen (#3729)
  * Convert GenerateRequest to UpdateRequest for backward compatibility (#3730)
  * refactor: autogen package logger (#3727)
  * fix: correct tombstone usage (#3718)
  * refactor: remove some api unnecessary pointers (4)  (#3713)
  * Set policy kind to generate events in the webhook (#3726)
  * Create UR for both mutate and generate policies (#3717)
  * fix: remove supported from autogen status (#3714)
  * fix: generated api reference docs (#3711)
  * refactor: remove some api unnecessary pointers (3) (#3707)
  * Optimize UR listing on policy events (#3712)
  * - Create events for imageVerify rules (#3710)
  * refactor: remove some api unnecessary pointers (2) (#3705)
  * fix: remove unused type TargetMutation (#3706)
  * refactor: remove some api unnecessary pointers (#3704)
  * add e2e tests for mutate existing policies (#3703)
  * Verify digest (#3679)
  * fix: kind wash in mutate policy helper (#3698)
  * refactor: auth package logger (#3696)
  * chore: remove unused custom expansions from client (#3697)
  * refactor: client gen code (#3695)
  * Fix test command git issue (#3692)
  * Enable verifyImages and CLI registry tests (#3684)
  * Cherry-pick release-1.6 Helm changes (#3689)
  * Show warnings in Helm chart installation; update issue templates (#3673)
  * refactor: use typed k8s client in tls package (#3678)
  * refactor: config package logger (#3683)
  * Fix flaky e2e tests for generate policies (#3681)
  * Fix regression in wildcard matches in In/AnyIn operators (#3686)
  * feat: remove deprecated flags (#3680)
  * Logic of match service account is fixed for namespace (#3662)
  * fix test cli CI failures from main (#3682)
  * Fix issue pod should not be ready until the policy cache  loaded (#3646)
  * bug: fix nil pointer when generating events (#3677)
  * remove Validate Cmd (#3674)
  * Support context variables when using foreach CLI (#3637)
  * fix: webhooks are not configured correctly (#3660)
  * bump to Go 1.17.9 (#3671)
  * fix: api reference docs link (#3664)
  * feat: mutate existing resources (#3669)
  * fix: pass logger by value (#3666)
  * Allow definition of inline variables in context (#3658)
  * fix: add char length validation for generate rule resource name (#3640)
  * chore: remove e2e tests for kube 1.20 (#3665)
  * chore: add support for artifacthub.io/changes in helm charts (#3652)
  * fix: policy controller missing GVK (#3659)
  * [imageVerify]: adding `digestMutate` to simplify tag-to-digest mutation (#3531)
  * Multiple keys (#3636)
  * fix: do not remove webhooks during initialization (#3641)
  * fix: prevent installing chart with 2 replicas (#3647)
  * fix: print helm install warnings (#3648)
  * chore: warn if kube version is too old in helm notes (#3650)
  * chore: add artifacthub operator and prerelease annotations (#3649)
  * refactor: use the typed ns informer in GR controller (#3554)
  * refactor: image utils (#3630)
  * Remove helm mode setting (#3628)
  * refact: remove unused Run function from generate (#3638)
  * Fix race condition in pCache (#3632)
  * Allow defining imagePullSecrets (#3633)
  * Image verify attestors (#3614)
  * Allow kyverno-policies to have preconditions defined (#3606)
  * updating version in Chart.yaml (#3618)
  * Update vulnerable dependencies (#3577)
  * Add support for custom image extractors (#3596)
  * add-kms-libraries for cosign (#3603)
  * refactor cli code from pkg to cmd (#3591)
  * fix missing policy.kyverno.io/policy-name label (#3599)
  * refactor generate controller (#3589)
  * change/suppress warning messages (#3593)
  * Feat - add the new CR UpdateRequest for post mutation (#3592)
  * Update to cosign 1.7.1 (#3587)
  * Update GH workflow config (#3588)
  * Update CODEOWNER folders for @samj1912 (#3586)
  * Update hash of dependencies instead of mutable version (#3582)
  * add support for roles, cluster roles and subjects (#3188)
  * fix imageVerify rule conversion (#3583)
  * update imageVerify schema (#3574)
  * Refactor image extraction to allow extracting custom resources (#3572)
  * chore: remove dead code (#3561)
  * Add returnType for regexMatch in kyverno jp output (#3575)
  * refactor: engine context (#3563)
  * Fixes #3555 (#3558)
  * update image pull policy for YAML install which uses :latest (#3565)
  * add @eddycharly as a maintainer! (#3566)
  * chore: add some make help comments (#3560)
  * refactor: switch to admission v1 (#3526)
  * refactor: make response type (RuleType) typed (#3556)
  * refactor: metrics package (#3549)
  * refactor: webhooks metrics reporting (#3548)
  * test: pass lock by value (#3481)
  * refactor: simplify autogen package (#3532)
  * refactor: move common utils (#3553)
  * refactor: add engine utils sub package (#3552)
  * fix: checkEngineResponse in webhooks (#3551)
  * Do not generate preconditions not met warning for audit policies (#3487)
  * refactor: reduce policy mutations (#3550)
  * fix: annotation path (#3547)
  * refactor: use GetFailurePolicy method (#3545)
  * refactor: use BackgroundProcessingEnabled method (#3544)
  * refactor: move some helpers in utils package (#3539)
  * refactor: use GetValidationFailureAction method (#3546)
  * fix: disallow all in autogen annotation (#3537)
  * refactor: use existing ContainsString util (#3543)
  * Create `poddisruptionbudget.yaml` when `mode=ha` (#3536)
  * fix wildcards in value arrays (#3486)
  * refactor: separate yaml utils package (#3520)
  * refactor: separate kube utils package (#3527)
  * refactor: add os utils sub package (#3528)
  * refactor: add a json patch util and use it in autogen package (#3524)
  * fix: tls min version (#3521)
  * refactor: separate json utils package (#3523)
  * refactor: webhooks package (#3516)
  * refactor: use policy interface and introduce admission utils package (#3512)
  * fix: use github repo env instead of hardcoded repo name (#3513)
  * fix: reduce dependency to ns lister (#3509)
  * refactor: use more policy interface (#3510)
  * refactor: use policy interface in policycache package (#3503)
  * refactor: make use of policy interface (#3499)
  * refactor: improve policycache package (#3495)
  * chore: add autogen internals e2e tests (#3492)
  * refactor: factorize policy interface (#3496)
  * feat: add webhooks object selector support (#3413)
  * feat: generate support for namespace policy (#3472)
  * chore: simplify validation with named return (#3493)
  * add missing namespace to role and rolebinding (#3389) (#3429) (#3485)
  * chore(deps): add renovate.json (#3471)
  * feat: stop mutating rules (#3410)
  * use mutex as field instead of embedded (#3480)
  * refactor: create e2e infra using make to speed up e2e tests (#3470)
  * fix ordering of mutate element (#3468)
  * refactor: use abstract policy interface in webhookconfig (#3466)
  * adds lease objects for storing last-request-time and set-status annotations in deployment (#3447)
  * clean up dependencies (#3469)
  * fix: use RWMutex lock while concurrent read/write (#3462)
  * refactor: match and exclude conflict validation (#3454)
  * refactor: add ValidationFailureAction to the api (#3451)
  * refactor: remove ns lister from webhookconfig (#3452)
  * refactor: add IsNamespaced() method to API policy types (#3450)
  * fix: use PodControllersAnnotation constant (#3448)
  * Update MAINTAINERS.md (#3449)
  * support for deprecated API's (#3439)
  * Drop v1alpha1 PolicyReport CRD (#3437)
  * refactor: ExcludeResources validation (#3445)
  * refactor: replace ExcludeResources by MatchResources (#3444)
  * refactor: ResourceDescription validation (#3446)
  * Fix incorrectly renamed file (#3443)
  * Remove support for test.yaml (#3442)
  * fix cli panic for --cluster flag (#3436)
  * Fix check for generated webhook rules being equal to what the API server has (#3407)
  * refactor: MatchResources validation (#3422)
  * feat: use IsReady method (#3426)
  * refactor: ValidationFailureActionOverrides validation (#3421)
  * PR and issue template updates per contributors' meetings (#3428)
  * [imageVerify]: correcting error msg (#3398)
  * feat: add toggle package for feature flags (#3419)
  * feat: move GetRules() at the policy level (#3420)
  * feat: add conditions support (#3378)
  * feat: stop adding autogen annotation (#3379)
  * fix webhook configuration issue when auto update is disabled (#3417)
  * Ignore test files that do not end in test.yaml (#3402)
  * refactor: Policy name validation (#3409)
  * Replace `ToUnstructured()` with Marshal/Unmarshal (#3150)
  * [ImageVerify] Verify additional certificate-extensions  (#3404)
  * fix: filter resources names with helm custom release name (#3361)
  * refactor: Rule names validation (#3406)
  * refactor: Rule type validation (#3400)
  * chore: remove check-helm-docs workflow (#3408)
  * refactor: UserInfo validation (#3399)
  * Fix webhook re-creation error (#3403)
  * chore: add make help target (#3405)
  * Only queue one retry if webhook update fails (#3353)
  * chore: add more codegen target and verifications (#3393)
  * Return warning on admission response when mutating pods (#3272)
  * Add a registry flag to allow direct access to container registries in the CLI (#3396)
  * feat: add rules to status (#3376)
  * chore: makefile should not makefile go.mod (#3394)
  * refactor: ImageVerification validation (#3372)
  * Cli Apply command support Dir as resources (#3391)
  * chore: add helm crds to make codegen target (#3375)
  * fix: metrics config defaults (#3387)
  * fix for gvk not working for existing resources policy (#3384)
  * e2e test for mutate global anchor Policy (#2574)
  * Add `codecov` to CI (#3382)
  * Update cosign to v1.6.0 (#3341)
  * fix: generate api reference docs (#3377)
  * fix PodExecOptions issue (#3373)
  * Update OWNERS.md (#3371)
  * feat: add autogen controllers to policy status (#3332)
  * chore: gen helm crds from config crds (#3356)
  * refactor: introduce api common types (#3365)
  * adding emptyDir vol for keyless signing (#3366)
  * refactor: move api functions closer to the struct they belong to (#3363)
  * refactor: introduce rules getters and setters (#3350)
  * refactor: move controller autogen annotation in api package (#3364)
  * Add new test-case-selector flag to test command (#3183)
  * support RSA, ECDSA and EDDSA public key verification (#3362)
  * fix: configmap resource filters generated by helm does not account for namespace (#3358)
  * chore: check helm docs are up to date (#3310)
  * Fix any_all wildcard issue (#3352)
  * fix: invalid path in helm-test workflow (#3344)
  * Add Bloomberg to adopters (#3348)
  * updated description field of foreach (#3157)
  * chore: verify codegen in CI (#3343)
  * Update generate clusterrole (#3336)
  * fix: CRD generation (#3334)
  * refactor: reduce usage of reflect.DeepEqual (#3328)
  * fix: update codegen (#3329)
  * fix: naming typos (#3327)
  * refactor: introduce autogen package (#3316)
  * refactor: pass only spec instead of whole policy when possible (#3315)
  * fetch tag across all branches instead of current branch (#3324)
  * add separate step for digest (#3321)
  * adding check for digest and update git command
  * correcting makefile latest tag (#3314)
  * fix: helm install docs (#3312)
  * fix: seccomp profile (#3313)
  * chore: drop helm v2 (#3311)
  * feat: gen kyverno helm chart docs (#3309)
  * feat: gen kyverno-policies helm chart docs (#3301)
  * Fix workflow using regex in `main` (#3306)
  * arranging permissions (#3293)
  * fix: helm chart broken when use generatecontrollerExtraResources (#3302)
  * feat: support background mode configuration in kyverno-policies chart (#3299)
  * Improve CLI test times by instantiating openapi controller once (#3297)
  * Fix namespace typo (#3298)
  * fix: add support for other platforms before executing docker buildx (#3296)
  * validate and block policy based on the matched kind cache (#3283)
  * fix: comma separated lists in config (#3290)
  * Run E2E tests on all supported k8s versions (#3256)
  * latest will point to main (#3285)
  * Shallow clone git repositories for kyverno test command
  * update trivy scanning (#3284)
  * feat: add linux/s390x builds (#3277)
  * Fix label mutation while updating the secret (#3273)
  * Modify capabilities for compatibility with Pod Security (#3274)
  * Fix Helm releasing to preserve creation timestamps (#3268)
  * Added `kyverno test` subcommand for test manifest file (#3264)
  * Clean up commented out lines of code (#3263)
  * Add .DS_store to gitignore (#3255)
  * fix mutate wildcard issue (#3193)
  * Fix foreach validations precondition issue (#3228)
  * Fix policy report OwnerReference (#3249)
  * Improve E2E test CI timings (#3250)
  * Add openssf badge (#3246)
  * Fix old object validation check (#3248)
  * Bug fix: negation of string kernel version caused Cluster Policy to fail (#3229)
  * add helm pre-delete hook which deletes all the webhooks (#3148)
  * Skip updating webhook configs if namespaceSelector is nil (#3237)
  * Sync latest changes to release/install.yaml (#3239)
  * add aggregated role for generaterequest (#3240)
  * Remove abstraction that doesn't work anyway (#3209)
  * Fix image parsing for image referenced as digests  (#3196)
  * feat: ha mode support in helm chart (#3207)
  * Fix keyless attest (#3219)
  * update dependencies (#3221)
  * Issue forms and PR template adjustment (#3213)
  * add prateekpandey14 to codeowners (#3205)
  * Added e2e test for JSON patch mutate policy (#2966)
  * fixing bug to handle two different types of rules  (#2954)
  * Allow setting validationFailureActionOverrides for policies (#3201)
  * feat: fix app version in NOTES.txt (#3189)
  * Indentation fix (#3179)
  * Fix unused tagTest in helm chart tests (#3174)
  * Update kyverno-policies chart with latest pod-security policies (#3126)
  * Add a kyverno jp command to test jmespath expressions (#3169)
  * test-cases for wildcard match label selector (#3165)
  * Filter kyverno resources instead of entire kyverno namespace (#3170)
  * Fix panic for provides a set to the key of a precondition and deny condition (#3162)
  * Bump up verbosity for `patched resource mismatch` (#3127)
  * bump chart versions (#3160)
  * Update dev image tag in Make targets (#3159)
  * Add sam (#3155)
  * add missing patch verbs in event clusterrole (#3151)
  * fix filtered and sort patches index (#3146)
  * Fix kyverno panic with `PodSpec.containers` JSON merge patch w/o image (#3143)
  * Relax rule context validation to follow JMESPath grammar (#3129)
  * Fixed kyverno panic at JMESPath zero division (#3137)
  * Fix variable substitution when curly braces are used in jmespath (#3133)
  * Fix parsing of resources in preconditions (#3108)
  * Add cloud provider keychains to DefaultKeychain (#3116)
  * improve antiAffinity and add podAffinity and nodeAffinity for kyverno helm chart (#3067)
  * fixing and adding tests (#3112)
  * update cosign to 1.5.0 and fix issuer and subject for keyless (#3089)
  * Add b/w compat support for K8s version 1.20 and below for Kyverno 1.6 (#3100)
  * Fix the kyverno default keychain value to be the ggcr default keychain (#3096)
  * fix: typo Cluter to Cluster (#3092)
  * Fix memory leak when updating ggcr keychain (#3088)
  * Support registry keychain from cloud providers (#3036)
  * Updates Changelog to add note for anyPattern issue due to k8s v1.23 (#3045)
  * Add KYVERNO_DEPLOYMENT to initContainer (#3086)
  * apply patches cumulatively (#3083)
  * Fix CLI test/apply when any/all use namespaceSelector (#3050)
  * fix mutating ownerReferenecs (#3061)
  * update workflow configurations to fix CI failure (#3060)
  * Fix documentation for helm charts (#3056)

-------------------------------------------------------------------
Fri Apr 01 07:04:47 UTC 2022 - kastl@b1-systems.de

- Update to version 1.6.2:
  * tag v1.6.2 (#3511)
  * Cherry-pick #3111 and release v1.6.2-rc3 (#3506)
  * tag v1.6.2-rc2 (#3500)
  * feat: generate support for namespace policy (#3498)
  * use mutex as field instead of embedded (#3480) (#3489)
  * release v1.6.2-rc1 (#3482)
  * Cherry-pick #3477 (#3479)
  * adds lease objects for storing last-request-time and set-status annotations in deployment (#3447) (#3478)
  * fix: use RWMutex lock while concurrent read/write (#3462) (#3467)
  * support for deprecated API's (#3439) (#3453)
  * fix cli panic for --cluster flag (#3436) (#3438)
  * add missing namespace to role and rolebinding (#3389) (#3429)
  * fix webhook configuration issue when auto update is disabled (#3417) (#3418)
  * Cli Apply command support Dir as resources (#3391) (#3392)
  * fix for gvk not working for existing resources policy (#3384) (#3386)
  * Cherry pick/3366 (#3367)
  * Update generate clusterrole (#3336) (#3359)
  * fixing bug to handle two different types of rules  (#2954) (#3357)
  * Fix any_all wildcard issue (#3352)

-------------------------------------------------------------------
Wed Mar 02 05:51:37 UTC 2022 - kastl@b1-systems.de

- Update to version 1.6.1:
  * fix release tag command (#3323)
  * fetching proper digest for release images (#3319)
  * update release v1.6.1 manifest (#3318)
  * changing git command to fetch the tag (#3317)
  * release v1.6.1-rc2
  * cherry-pick c4075af3d17c59fe73b50083bb206d85a1cb38ba
  * Run E2E tests on all supported k8s versions (#3256)
  * Fix namespace typo (#3298)
  * feat: support background mode configuration in kyverno-policies chart (#3299)
  * fix: helm chart broken when use generatecontrollerExtraResources (#3302)
  * Shallow clone git repositories for kyverno test command
  * fix: add support for other platforms before executing docker buildx (#3296)
  * latest pointing to main
  * added condition
  * using regex
  * updated workflows
  * validate and block policy based on the matched kind cache (#3283) (#3291)
  * Filter kyverno resources instead of entire kyverno namespace (#3170) (#3171)
  * update trivy scanning (#3284)
  * tag v1.6.1-rc1
  * Fix label mutation while updating the secret (#3273) (#3278)
  * Modify capabilities for compatibility with Pod Security (#3274) (#3275)
  * Fix Helm releasing to preserve creation timestamps (#3268)
  * fix mutate wildcard issue (#3193)
  * Fix foreach validations precondition issue (#3228)
  * Fix policy report OwnerReference (#3249) (#3257)
  * Fix old object validation check (#3248)
  * Skip updating webhook configs if namespaceSelector is nil (#3237) (#3243)
  * bump chart versions to v2.3.0
  * cherry-pick #3209
  * Fix image parsing for image referenced as digests  (#3196) (#3233)
  * Fix keyless attest (#3219)
  * update dependencies (#3221)
  * release Helm chart v2.2.1
  * Allow setting validationFailureActionOverrides for policies (#3201)

-------------------------------------------------------------------
Fri Feb 18 15:07:52 UTC 2022 - Johannes Kastl <kastl@b1-systems.de>

- link /usr/bin/kyverno to /usr/bin/kubectl-kyverno to make this usable as a kubectl plugin

-------------------------------------------------------------------
Fri Feb 18 13:02:16 UTC 2022 - Johannes Kastl <kastl@b1-systems.de>

- new package kyverno: CLI and kubectl plugin for the Kyverno Policy engine

Places

File kyverno.changes of Package kyverno (Revision 31d5cd4d87d87a3ad49f42bb349e6664)

Places