File kyverno.changes of Package kyverno

Overview Repositories Revisions Requests Users Attributes Meta

File kyverno.changes of Package kyverno (Revision 8ee2d8182cbe6d06d4a1b1cb870de7f4)

Currently displaying revision 8ee2d8182cbe6d06d4a1b1cb870de7f4 , Show latest

-------------------------------------------------------------------
Mon Nov 21 09:25:18 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.2:
  * Tag v1.8.2 (#5418)
  * tag v1.8.2-rc.2 (#5408)
  * Fixed issue-3709: Image verify rule gives error for non-existing configmap (#5272) (#5407)
  * add os.Exit (#5402) (#5405)
  * Complete all basic kuttl tests for generate rules, clone and no-sync (#5400) (#5403)
  * tag v1.8.2-rc.1 (#5393)
  * [Bug]: Fix wildcard any/all issue (#5387) (#5390)
  * fix: enable policy validation for the verifyImage rule (#5383)
  * fix: set logger in metrics server (#5319) (#5377)
  * Add more kuttl generate test cases (#5364) (#5382)
  * test: add rbac kuttl test (#5337) (#5380)
  * fix: set correct logger in profiling server (#5358) (#5381)
  * fix closed watchers in the resource-report-controller (#5350) (#5378)
  * fix: add validation for generate namespace policy (#5346) (#5373)
  * fixed dryrun option to handle changes caused by mutating policy (#4899) (#5375)
  * add test cases for yaml verification feature (#5326) (#5372)
  * chore: add tempo to argocd lab (#5365) (#5370)
  * chore: add performance tests tool (#5241) (#5369)
  * fix: panic when disable metrics is true (#5366) (#5368)
  * chore: enable json logs in argocd lab (#5349) (#5359)
  * refactor: optimise and use kuttl TestStep with tests (#5328) (#5353)
  * test: add kuttl debug failure (#5339) (#5341)
  * chore: add cli binary to gitignore (#5331) (#5333)
  * test: add test to check expected webhooks are created (#5330) (#5332)
  * fix: synchronize source resource update to clone list resource (#5317) (#5320)
  * Fix issue where CLI test command ignores failures (#5189) (#5313)
  * fix: add parsing of json pointers to support special chars (#3578 #3616) (#4767) (#5315)
  * test: add kuttl tests for jmespath special chars (#5310) (#5316)
  * fix: wrong logger used (#5311) (#5314)
  * chore: Fix policy installation issue (cherry-pick #5239) (#5308)
  * fix: reduce startup probe delay (#5296) (#5302)
  * fix: send notification when stoping watching resource in reports system (#5298) (#5309)
  * fix: set rule response status as skip if precondition failed (#5162) (#5306)
  * Update kuttl test scaffolding (#5303) (#5304)
  * tests: add kuttl tests for multiple clone generate (#5280) (#5299)
  * add a note to 1.8.2-rc1 release (#5291)
  * fix: allow delete of clone target resource with synchronize false (#5161) (#5297)
  * fix: check policy is ready in kuttl tests (#5286) (#5292)
  * fix: image extractor kuttl tests (#5293) (#5295)
  * fix: kuttl test external-service (#5287) (#5290)
  * chore: update kuttl (#5285) (#5288)
  * refactor: admission metrics (counter and latency) (#5245) (#5282)
  * chore: use conditions in kuttl tests to check ready policies (#5252) (#5281)
  * fix: make zapr compatible with klog's -v argument (#5166) (#5283)
  * fix: keep admission warnings (#5269) (#5275)
  * chore: add kuttl autogen tests (#5253) (#5274)
  * fix: add missing test suite to kuttl (#5268) (#5273)
  * fix: early return in policy validation (cherry-pick #5200) (#5213)
  * chore: remove old conformance tests files (#5260) (#5263)
  * fix: account for error rules in mutation webhook (#5264) (#5267)
  * refactor: admission response utils (#5234) (#5265)
  * chore: add kuttl in makefile (#5254) (#5258)
  * Kuttl updates (#5257) (#5261)
  * More kuttl tests (#5238) (#5259)
  * add remainder of e2e verifyImages tests (#5229) (#5256)
  * add kuttl tests (cherry-pick #5204) (#5255)
  * refactor: move all middlewares in handlers sub package (cherry-pick #5244) (#5250)
  * chore: add loki to argocd lab (#5231) (#5240)
  * feat: add grafana dashboard to helm chart (#5230) (#5232)
  * feat: add policy label to policy reports (#5198) (#5225)
  * Merge 396593d8997f218270a398e18e956d892f004bc3 into b3c5a9c74165d573aab9928dd8ac1187e8d8fc3a (#5216)
  * chore: server side apply in argo lab (#5209) (#5210)
  * refactor: health check system (#5176) (#5207)
  * feat: support disabling schema validation on the patched resource (#5197) (#5206)
  * Helm chart: add extraCRDAnnotations value and set ArgoCD sync option by default (#4964) (#5195)
  * fix: deletion of reports not belonging to kyverno (#5194) (#5196)
  * fix: use pagination to aggregate reports (#5190) (#5192)
  * fix: check resource version on update notification (#5179) (#5186)
  * chore: add kind config file (#5178) (#5183)
  * fix: content type in log (#5177) (#5182)
  * fix: configure klog and global logger to use zapr in json mode (#5144) (#5181)
  * skip generating events on empty rule response (#5158) (#5160)
  * reset resource version on update (#5157) (#5159)
  * feat: add categories support to our CRDs (#5112) (#5137)
  * fix: mutation policy inconsistent patching for ephemeralContainers (#5121) (#5145)
  * Fixed issue-4655: verifyImages is executed before mutate (#4996) (#5143)
  * fix finalizers mutation with patchesJson6902 (#5132) (#5135)

-------------------------------------------------------------------
Tue Oct 25 18:44:22 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.1:
  * Tag v1.8.1 (#5133)
  * Tag v1.8.1-rc.4 (#5128)
  * remove the empty add entry in Hehlm chart manifest (#5127)
  * Remove old version of golang.org/x/sys (#5125) (#5126)
  * docs: separate dev and user docs (cherry-pick #5114) (#5117)
  * ci: Fix install manifests publishing with Flux (#5110) (#5111)
  * Tag v1.8.1-rc.3 (#5108)
  * fix: use correct side effects in validating webhooks (#5080) (#5105)
  * refactor: simplify variables regex (#5075) (#5104)
  * fix: allow delete of target resource with synchronize false (#5081) (#5095)
  * test: add best practices policies in conformance tests (#5082) (#5097)
  * fix: use correct logger in webhook controller (#5083) (#5098)
  * feat: add flag to configure the number of background scan workers (#5088) (#5096)
  * ci: Use the Docker login action for GHCR auth (#5091) (#5094)
  * fix: handle resource cleanup when policy is deleted (#5021) (#5093)
  * Cherry pick 5035, 5046 (#5090)
  * fix: make reponse order predictable (#5079) (#5087)
  * feat: add simple conformance tests (#5073) (#5086)
  * feat: add webhook server logger (#5063) (#5085)
  * release 1.8.1-rc.2 (#5072)
  * fix: image verification reports missing in admission mode (cherry-pick #5037) (#5066)
  * fix: configure idle timeout in server (#5062) (#5067)
  * fix: setup max procs with correct logger (#5059) (#5065)
  * fix: do not update reports when they are identical (#5056) (#5061)
  * fix: detection of kyverno going down (#5055) (#5064)
  * fix: go routines not gracefully shut down in controllers (#5022) (#5060)
  * fix: account for policy/rule deletion in aggregated reports (#5048) (#5058)
  * feat: add metrics server and kube-prometheus-stack to argocd lab (#4995) (#5052)
  * feat: add image verification support to background scan (#5047) (#5049)
  * feat: add controller logger helper (#5029) (#5050)
  * feat: add policy-reporter to argocd lab (#4988) (#5051)
  * feat: make shutdown more graceful (#5031) (#5040)
  * Enable adding annotations to configmaps in the helm chart (#4984) (#5039)
  * fix: wrong controller logger names (#5043)
  * chore: add argocd lab (#4884) (#5041)
  * fix: lease log message (#5030) (#5045)
  * fix: lower default qps/burst (#5034) (#5038)
  * fix: add more infos in reports printers (#5027) (#5033)
  * Tag v1.8.1-rc1 (#5020)
  * remove RBACInfo check (#5015) (#5019)
  * fix: policy not denied when kinds set is empty (#5016) (#5017)
  * fix: global anchor warning (#4962) (#5013)
  * feat: add startup probes support (#4896) (#5012)
  * fix: webhooks not registering when using name override (#4992) (#5010)
  * fix: don't process non background policies in background scan (#5008) (#5009)
  * fix principal and role variables are not substituted (#5000) (#5001)
  * fix: update policy status (#5006) (#5007)
  * fix: use default retry with retryfunc for a conflict (#4973) (#5005)
  * updates with case insensitivity guarantee (#4954) (#5003)
  * refactor: add update status helper (#4985) (#5002)
  * fix: skip admission in dry run requests (#4994) (#4999)
  * fix: improve banned types management in reports (#4953) (#4997)
  * docs: add resource exclusions note in helm docs (#4989) (#4993)
  * feat: Add container registry setting on Helm Chart (cherry-pick #4281) (#4987)
  * fix: config reloading not working correctly (#4951) (#4982)
  * fix: missing autogen rules in status (#4971) (#4978)
  * fix: missing watchers in resource report controller (#4967) (#4974)
  * fix: add user info in admission request logs (#4969) (#4976)
  * fix: don't produce empty admission reports (#4966) (#4972)
  * chore: Push and sign install manifests to GHCR (#4895) (#4970)
  * fix: admission reports printer (#4950) (#4961)
  * fix: consider generateName when matching resources (#4945) (#4960)
  * chore: bump a few deps (#4943) (#4958)
  * fix: don't report ready until certs are valid (#4934) (#4957)
  * Fix background scan with request.operation (#4947) (#4949)
  * fix: probes should work in debug mode (#4926) (#4944)
  * fix: set operation in context when necessary (#4940) (#4942)
  * chore: add COSIGN_REPOSITORY env to ko-publish-dev step (#4922) (#4936)
  * add filter for validation policies when ValidationFailureActionOverrides is used (#4809) (#4932)
  * fix: panic when bad variable substitution (#4928) (#4935)
  * feat: make cert renewer private and add server name support (#4904) (#4933)
  * [Cleanup] Disable PolicySkipped events (#4913) (#4931)
  * chore: bump a couple of deps (#4925) (#4929)
  * chore: update controller-tools to v0.10.0 (#4918) (#4923)
  * fix: use constants defined in openapi controller (#4919) (#4921)
  * chore: signing helm releases (#4801) (#4920)
  * fix: openapi controller discovery (#4912) (#4917)
  * fix: don't specify rules when aggregationRule is set (#4867) (#4915)
  * refactor: openapi controller part 2 (#4910) (#4914)
  * refactor: openapi controller part 1 (#4901) (#4906)
  * fix: clean background scan reports (#4908) (#4911)
  * fix: remove unnecessary dependencies from tls package (#4903) (#4905)
  * fix: reduce webhook controller logs (#4897) (#4900)
  * refactor: manage webhooks with webhook controller (#4846) (#4893)
  * fix: auto gen enabled when using names (#4863) (#4892)
  * fix: non watchable resources in report controller (#4888) (#4890)
  * Fix result colour (#4885) (#4887)
  * fix: background scan labels (#4865) (#4886)
  * cherry-pick (#4794 #4812 #4815 #4821 #4784 #4820 #4831 #4834 #4818 #4838 #4792 #4843 #4878) (#4882)
  * fix: hardening policy validation for generate cloneList (#4881) (#4883)
  * cherry-pick (#4811 #4849 #4842 #4829) (#4877)
  * fix test output numbering (#4853) (#4875)
  * cherry-pick (#4790 #4791 #4795 #4796 #4802 #4803) (#4861)
  * cherry-pick (#4749 #4766 #4773 #4775 #4779 #4785 #4789) (#4860)
  * cherry-pick (#4754 #4756 #4760 #4761 #4764 #4765 #4776) (#4859)
  * cherry-pick (#4745 #4746 #4747 #4750 #4752) (#4858)
  * cherry-pick (#4661 #4712 #4722 #4724 #4742) (#4857)

-------------------------------------------------------------------
Mon Oct 10 11:59:03 UTC 2022 - kastl@b1-systems.de

- Update to version 1.8.0:
  * release: 1.8 (#4851)
  * Update PSa images dsecription (#4840) (#4841)
  * tag v1.8.0-rc6 (#4839)
  * fix extension checks (#4836) (#4837)
  * Cherry pick #4814 (#4826)
  * update helm doc (#4824)
  * fix: validationFailureAction default value (#4822) (#4823)
  * Cherry-pick #4815 (#4817)
  * tag v1.8.0-rc5 (#4807)
  * fix: subject and issuer validation when attestations are present (#4786) (#4805)
  * skip succeed rules when building the blocked return message (#4804) (#4806)
  * cherry-pick #4738 (#4799)
  * cherry-pick #4793 (#4800)
  * update cosign (#4797)
  * chore: change charts registry url (#4768) (#4780)
  * tag v1.8.0-rc4 (#4759)
  * fix: watch error in resource controller (#4751) (#4753)
  * fix: reports not generated (#4743) (#4744)
  * tag v1.8.0-rc3 (#4741)
  * fix: containerd dependency vulnerability (#4629) (#4740)
  * Add PSa policy validations (#4735) (#4739)
  * Added `x509_decode` JMESPath function (#4664) (#4737)
  * feat: add matchlabel selector support with multiple clone (#4713) (#4734)
  * fix: output make messages to stderr (#4727)
  * fix crds yaml conflicts
  * feat: reports v2 implementation (#4608)
  * docs: add policy cache controller docs (#4714) (#4730)
  * chore: update client code generator (#4711) (#4728)
  * Support PSa integration by `controlName` only (#4710) (#4725)
  * chore: group unit and cli tests targets and separate sections (#4693) (#4723)
  * chore: enable overriding images repo (#4694) (#4721)
  * chore: refactor manifests related makefile targets (#4706) (#4720)
  * fix: change key used in test (#4718) (#4719)
  * fix: missing client wrapper (#4703) (#4709)
  * refactor: use pod name as leader id (#4680) (#4708)
  * fix: split webhook handlers per failure policy (#4650) (#4707)
  * fix: shutdown controllers workers gracefully (#4681) (#4704)
  * fix: namespaced policy targets namespace validation and scoping them to the policy's namespace (#4671) (#4702)
  * refactor: replace signal package by signal.NotifyContext (#4691) (#4701)
  * fix: jmespath random error handling (#4697) (#4699)
  * chore: simplify go mod (#4692) (#4696)
  * fix: bump net standard lib (#4685) (#4690)
  * fix: handle auth permission for cloneList validation (#4684) (#4687)
  * fix: namespaced policy not validated in engine (#4653) (#4682)
  * chore: bump minimum go version (#4677) (#4678)
  * Fix issue for wildcard versions (#4670) (#4673)
  * chore: publish sbom result to a different repositry from an image (#4665) (#4667)
  * refactor: update log based on the policy types (#4646) (#4658)
  * feat: add explicit key support to controller utils (#4628) (#4659)
  * feat: add feature flag to disable background scan (#4638) (#4660)
  * refactor: split policyreport api files (#4641) (#4657)
  * fix: missing elements in v2beta1 api (#4654) (#4656)
  * refactor: add a couple of constants in api (#4640) (#4652)
  * feat: introduce RCR interface (#4642) (#4651)
  * fix: incorrect namespace in report controller (#4637) (#4649)
  * fix: remove RCR from mutation webhook (#4636) (#4647)
  * chore: bump cosign 1.12.0 to fix vulnerabilities (#4631) (#4633)
  * feat: add controller utils tools (#4639) (#4645)
  * fix: background printer column (#4617) (#4620)
  * enhance jmespath random-filter (#4591) (#4619)
  * fix: lock in policy report mapper (#4601) (#4611)
  * release v1.8.0-rc2 (#4607)
  * refactor: simplify RCR creator queue (#4578) (#4606)
  * chore: add messages in makefile kind targets (#4588) (#4604)
  * refactor: info in policyreport package (#4598) (#4603)
  * Fix multiple crd slowness issue  (#4275) (#4600)
  * update helm releases path (#4596) (#4599)
  * enable autogen for validate.podsecurity with no exclude (#4594) (#4595)
  * chore: add a codegen-quick makefile target (#4583) (#4587)
  * chore: switch to github.com/IGLOU-EU/go-wildcard (#4563) (#4586)
  * allow PSa validation with no exceptions (#4558) (#4585)
  * fix: typo (#4582) (#4584)
  * fix: split policy report flag (#4576) (#4581)
  * chore: add toggle package unit tests (#4577) (#4580)
  * chore: preserve pr title in cherry picks (#4573) (#4574)
  * refactor: move generation handler out of webhooks package (#4570) (#4572)
  * refactor: move image verification handler out of webhooks package (#4569) (#4571)
  * refactor: move mutation handler out of webhooks package (#4567) (#4568)
  * refactor: move validation audit out of webhooks package (#4562) (#4566)
  * chore: add kocache (#4482) (#4564)
  * refactor: move validation handler out of webhooks package (#4556) (#4561)
  * refactor: make webhook metrics helpers static (#4554) (#4555)
  * refactor: move webhook events utils in utils package (#4545) (#4548)
  * add new patterns for releases (#4551)
  * chore: add unit test for updating ur status (#4541) (#4544)
  * - tag v1.8.0-rc1; - remove "v" from Helm charts versions (#4538)
  * fix: defer ur update until validation passes (#4540) (#4543)
  * refactor: introduce ur updater (#4535) (#4539)
  * Support V2beta1 Version (#4514)
  * refactor: webhook block and unit tests (#4531)
  * refactor: webhook propagate start time along handlers (#4529)
  * refactor: webhook exclusion and unit tests (#4528)
  * feat: allow cloning multiple resource from a namespace (#4384)
  * add random filter (#4527)
  * chore: add protectManagedResources flag to changelog (#4522)
  * refactor: utils for warnings and unit tests (#4523)
  * refactor: use generics in client wrappers (#4525)
  * refactor: add auth interface and unit tests (#4518)
  * fix: api reference docs (#4490)
  * refactor: client wrappers (#4519)
  * feat: add kyverno managed resources protection (#4414)
  * fix: load policy and add tests (#4515)
  * chore: test for k8s 1.25 (#4503)
  * chore: add unit tests for pkg/utils/json (#4516)
  * chore: add unit tests for pkg/utils/yaml (#4512)
  * chore: add unit tests for pkg/utils/wildcard (#4510)
  * chore: add unit tests for pkg/utils/os (#4509)
  * chore: add unit tests for pkg/utils/image (#4508)
  * chore: update maintainers (#4511)
  * docs: add section for generating helm docs and crds (#4507)
  * chore: add wildcard unit test (#4506)
  * chore: upgrade golang to 1.18 (#4505)
  * docs: add section about switching between docker and ko (#4501)
  * Auto-detect Kyverno version in policies chart (#4460)
  * chore: refactor helm targets in makefile (#4498)
  * feat: support switchin build with docker or ko (#4492)
  * fix: incorrect kustomize call in makefile (#4493)
  * refactor: verify codegen targets in makefile (#4494)
  * fix: fetch history in pre-checks job (#4491)
  *  Improve printer column name for validationFailureAction (#4488)
  * chore: Bump helm-docs version to v1.11.0 (#4489)
  * chore: publish helm charts to ghcr.io (#4479)
  * chore: bump cache action and improve paths (#4485)
  * chore: relax auto update PRs conditions (#4486)
  * fix: release workflow (#4483)
  * refactor: clean webhooks logs (#4484)
  * refactor: webhook policy context creation (#4480)
  * docs: add api docs generation (#4476)
  * fix: auto update pr workflow (#4478)
  * chore: add makefile help comments (#4477)
  * refactor: to remove generate cleanup controller (#4041)
  * Add PodSecurity description (#4475)
  * feat: remove context api call constraints (#4389)
  * fix logger format (#4474)
  * feat: enable autogen from makefile (#4467)
  * chore: speed up local image builds (#4468)
  * chore: enable cherry-pick bot (#4470)
  * docs: add section for generated code (#4465)
  * fix: local image build with docker (#4462)
  * fix: warning in all makefile targets (#4464)
  * Extend Pod Security Admission (#4364)
  * docs: add section for deploying a local build (#4458)
  * refactor: make toggles easier to define and use (#4456)
  * Add the metric "kyverno_client_queries_total" (#4359)
  * skip validate rules if conditional anchor key doesn't exist in the resource (#4451)
  * refactor: clearly separate makefile docker targets for build and publish (#4454)
  * Yaml signing and verification (#4235)
  * docs: add pushing images section (#4452)
  * refactor: clearly separate makefile ko targets for build and publish (#4450)
  * chore: fix workflows related to ko recent changes (#4441)
  * docs: add local image build section (#4449)
  * chore: fix workflows related to ko recent changes (#4438)
  * Update issue template drop-down version numbers (#4446)
  * docs: add section for local builds (#4445)
  * [Feature] Add ability to get additional policies from restricted (#4416)
  * fix: update go-wildcard to v1.5.0 (#4444)
  * docs: add section for dev tools (#4443)
  * chore: remove godownloader and install-cli script (#4442)
  * Added kubeconfig flag support (#4308)
  * fix: ko login (#4427)
  * fix: ko login (#4425)
  * fix: ko login (#4424)
  * fix: ko login (#4423)
  * fix: ko login (#4422)
  * fix: make ldflags optional in .ko.yaml (#4419)
  * refactor: makefile build targets (#4418)
  * fix: Add --bare for ko-build-dev targets (#4417)
  * Use ko to build images (#4366)
  * refactor: makefile (#4403)
  * [Feature] Add posibility to set validationFailureAction by Policy (#4400)
  * feat: enable autogen internals by default (#4381)
  * bump golang 1.18.5 version digest in Dockerfile (#4413)
  * bump cosign deps version to 1.11.1 (#4408)
  * chore: improve docker image tagging (#4409)
  * refactor: introduce wildcard utils package (#4406)
  * fix: chart docs for generatecontrollerExtraResources (#4405)
  * chore: enable asasalint linter (#4396)
  * bump cosign version to 1.11.0 (#4398)
  * Sync 1.7.3 Helm versions (#4395)
  * fix: goimports check not working in ci job (#4387)
  * chore: fix golangcilint timeout (#4388)
  * fix: duration metrics precision (#4393)
  * chore: add workflow to ensure github actions are pinned to a commit SHA (#4390)
  * feat: add raw api call support (#3820)
  * chore: update maintainers md (#4380)
  * chore: fix fossa ci job (#4382)
  * fix: missing aggregated role for UR (#4378)
  * fix: exclude autogen rules when autogen internals is enabled (#4370)
  * fix: prevent installing helm chart in namespace kube-system (#4368)
  * fix: fix the verbosity of reconciling logs in the config controller (#4362)
  * Update wgpolicyk8s.io CRDs (#4355)
  * Update pr_documentation.md (#4361)
  * Added remove-color flag for CLI-test  (#4345)
  * Added appropriate logging levels to log.Info() calls wherever necessary (#4341)
  * update apply help message (#4344)
  * Fix deprecated  api policy issue (#4349)
  * Treat normal and precondition variable equally (#4217)
  * fix: image verify logs (#4348)
  * Remove myself as codeowner (#4333)
  * Fix PEM delimiter parse (#4331)
  * [Helm] Added ability to remove namespaces from default resourceFilters list (#4299)
  * chore(deps): bump github.com/sigstore/cosign from 1.10.0 to 1.10.1 (#4328)
  * support failurePolicy in kyverno-policies helm chart (#4323)
  * Context vars substitution in CLI (#4290)
  * Replaced status with message (#4315)
  * Changed resource names to plurals (#4312)
  * Fix pr image verify blocked (#4297)
  * feat: use tombstone helper (#4273)
  * Tightened scope on apiGroups for Kyverno:events Clusterrole (#4292)
  * trivial typo update (#4291)
  * use failurePolicy to block or allow requests, on policy errors (#4183)
  * update log levels (#4286)
  * added additional init and sidecar container config (#4283)
  * feat: auto optimize GOMAXPROCS (#4277)
  * add applyRules to control whether one or all rules are applied (#4196)
  * feature: added new type of event, PolicySkipped (#4251)
  * Reset policy status on termination (#4269)
  * fix: use an absolute path in docker entrypoint (#4263)
  * Add shutdown methods for exporters and controllers (#4214)
  * sync Helm versions (#4262)
  * fix: use only 1 kubernetes client (#4256)
  * Add Techcombank to adopters (#4260)
  * Implementing flag to show all failing tests only through the test command (#4227)
  * fix split policyreport name with background scan (#4237)
  * chore: use new distroless base image provided by distroless org (#4219)
  * fix check depreciated api issue (#4243)
  * Cherry-pick #4233 (#4236)
  * Revert "fix:  metrics with invalid validationMode (#4198)" (#4241)
  * fix:  metrics with invalid validationMode (#4198)
  * Corrected description for UpdateRequest struct (#4215)
  * Removed confusing output message for the apply and replaced no of policies by no of policy rules count in the output message (#4229)
  * fix kyverno cli policy-report typo (#4224)
  * feat: improve flag message for disableMetricsExport (#4194)
  * precondition failure will skip rule independent of audit or enforce mode (#4163)
  * Make method public (#4207)
  * Fix UpdateRequest labeling (from pull #4199) (#4212)
  * use the unstructured list instead of interface type (#4210)
  * feat: Opentelemetry support for metrics and traces (#3910)
  * Use non-blocking channel send for UpdateWebhookChan (#4204)
  * Fix merging JSON patches (#4202)
  * Resolve conflict introduced to contributing page (#4192)
  * return helpful error message on invalid patched resources. (#4129)
  * docs(contributing): add how to cherry-pick section (#4127)
  * refactor: finish refactoring generate e2e tests (#4090)
  * feat: policy status for autogen rules (#4173)
  * fix: use official controller-gen (#4171)
  * fix external.metrics.k8s.io/v1beta1 issue (#4139)
  * fix: add seccompProfile (#4178)
  * fix: add more verify images e2e test for bool fields (#4172)
  * delete policy reports on policy deletion (#4174)
  * chore: add myself into owners (#4170)
  * feat: split policy report per policy bases (#4147)
  * Clean up RCRs if the count exceeds the threshold (#4148)
  * Wait for informers' cache to be synced before starting controllers (#4155)
  * - Disable events generation on DELETE; - Reduce event generation retry from 10 to 3 (#4159)
  * Use kyverno namespace informer to list pods while processing URs (#4156)
  * Template updates (#4150)
  * release event memory (#4138)
  * fix: use dev tag for init container local build target (#4142)
  * added resource lists for test cli (#4082)
  * update contributing guide (#4119)
  * sync release versions (#4133)
  * bump cosign to 1.9.1 to fix fulcio panic (#4117)
  * fix: use policyName key to get the policy name (#4114)
  * fix imageVerify validation checks and conversion logic (#4038)
  * fix: Stop incorrect any block condition logging (#4107)
  * set test.namespace value implict as resource namespace until and unless explict value is added (#4100)
  * remove TUF initialization from main (#4098)
  * Update CODEOWNERS to include treydock (#4097)
  * feat: add e2e framework and verify image new test (#4094)
  * add chipzoller to CODEOWNERS (#4096)
  * refactor: generate e2e GeneratePolicyDeletionforCloneTests (#4071)
  * Exclude Kyverno namespace by default (#4079)
  * docs(chart): fix deadlink in NOTES.txt (#4085)
  * Updated jp command flags and also added URL for help. (#4084)
  * update drop-downs (#4081)
  * refactor: generate e2e tests (#4068)
  * refactor: use t.Cleanup in e2e tests (#4067)
  * Remove s390X (#4063)
  * fix: add missing release notes in helm chart (#4057)
  * fix: bool fields in image verification types (#4053)
  * Print for failed test cases (#4048)
  * Sync v1.7.0 release manifests (#4051)
  * refactor: bump KIND version to use v1.24.0 k8s release (#3877)
  * feat: add aggregated cluster role support (#3845)
  * chore(dockerfile): use buildx features for cross-compilation (#4023)
  * Ensure preconditions are present with default values (#4046)
  * Fix handling of kyverno-policies version check when port in image tag (#4042)
  * fix policy typo (#4039)
  * Fix labels with invalid charrs (#4034)
  * refactor: used typed admission request in ur (#4022)
  * fix vulnerable (#4027)
  * feat: Extend CLI to cover generate policies (#3456)
  * Request operation value by default to CREATE (#3894)
  * Feature: Add support for allowing insecure registries. (#3983)
  * refactor: move policy deletion code from policy controller to ur controller (#4013)
  * fix: bypass policy mutation if autogen internals enabled (#4007)
  * fix: use background helper in ur generator (#4009)
  * fix: remove update ur status in generator (#4008)
  * refactor: add policy event listener in ur controller (#4012)
  * chore: remove unused ur errors (#4011)
  * refactor: ur cleaner controller (#3974)
  * add validation check to ensure the annotations quoted (#3976)
  * Support `@` for mutate targets (#3998)
  * fix: stop mutation policies when autogen internals is enabled (#4004)
  * refactor: background controllers cleanup (#4001)
  * fix: stop mutating cached resource in ur controller (#4003)
  * refactor: move label helper utils from policy package to background package (#3996)
  * fix attestation checks (#3999)
  * fix: init container gr copy (#3995)
  * refactor: clean updaterequest generator (#3949)
  * chore: enable nosprintfhostport linter (#3989)
  * feat: add controller utils package (#3952)
  * refactor: make registry client variables private (#3975)
  * fix: ur is nil in ur controller (#3986)
  * chore: add previous pod logs in case of job failure (#3978)
  * fix: remove unused field (#3971)
  * fix: release ur when handler pod is gone (#3973)
  * fix: move ur controller filtering in reconciler (#3964)
  * fix: mark ur retry on conflict (#3961)
  * chore: enable paralleltest linter (#3946)
  * chore: enable goimports linter (#3959)
  * chore: make kyverno informers and listers import aliases consistent (#3958)
  * chore: enable ifshort linter (#3945)
  * fix: add helmignore (#3948)
  * fix: replica count in helm chart (#3954)
  * fix panic issue for ur (#3953)
  * Cleanup URs on trigger deletion (#3955)
  * chore: make kube informers and listers import aliases consistent (#3957)
  * chore: make clients import aliases consistent (#3956)
  * chore: make dclient import aliases consistent (#3951)
  * chore: make k8s api import aliases consistent  (#3950)
  * fix: use admissionrequest subresource to filter webhooks (#3944)
  * chore: make kyverno api import aliases consistent (#3939)
  * chore: enable nolintlint linter (#3941)
  * chore: enable grouper linter (#3940)
  * fix: cache warmup log message (#3943)
  * fix: use patch to update handler status in UR (#3928)
  * chore: enable makezero linter (#3937)
  * fix: handle UR delete once trigger namespace deleted (#3934)
  * chore: enable gofmt and gofumpt linters (#3931)
  * chore: enble gci linter (#3930)
  * fix: return type changed to bool in jpfCompare fn (#3924)
  * refactor: separate policy cache and controller (#3925)
  * refactor: separate resource mutation/validation handlers from server (#3908)
  * chore: enable misspell linter (#3932)
  * chore: enable errname linter (#3926)
  * chore: enable decorder linter (#3920)
  * refactor: policy cache (#3919)
  * chore: enable dogsled linter (#3921)
  * Cleanup the UR for mutate policies once it's completed (#3912)
  * [Bugbash] Kceu22 bugbash/fix staticcheck warnings (#3917)
  * fix: gosec G304 file inclusion error (#3916)
  * refactor: separate policy mutation/validation handlers from server (#3905)
  * fix: docker build (#3907)
  * refactor: webhooks server logger (#3904)
  * feat: gracefull certificates rotation support (#3890)
  * chore: remove ca-certificates from our repository (#3859)
  * chore: enable wastedassign linter (#3898)
  * chore: enable goprintffuncname linter (#3899)
  * chore: remove unused function (#3902)
  * Remove permissions in helm-release workflow (#3901)
  * Timeout and init (#3893)
  * fix: write secret (#3891)
  * Fix subject match selector issue in cli (#3887)
  * refactor: remove deployment hash on certs secrets (#3886)
  * chore: enable noctx linter (#3888)
  * chore: enable importas linter (#3882)
  * skip var checks in attestations (#3876)
  * chore: enable gochecknoinits linter (#3874)
  * refactor: cleanup tls package (#3854)
  * chore: enable containedctx linter (#3873)
  * fix: include ca key in secret (#3804)
  * refactor: make config vars private (#3823)
  * fix: undo length validation check for generate rule resource name (#3865)
  * fix subjects in test cli (#3743)
  * chore: enable exportloopref linter (#3869)
  * chore: enable tenv thelper and tparallel linters (#3868)
  * chore: enable durationcheck linter (#3870)
  * chore: enable asciicheck and bidichk linters (#3871)
  * chore: add unconvert linter (#3867)
  * chore: enable whitespace linter (#3864)
  * Handle errors properly for mutate and generate on existing resources (#3863)
  * fix: remove code to load CA from kubeconfig (#3860)
  * chore: enable more linters (#3862)
  * chore: enable deadcode and unused linters (#3861)
  * chore: increase golangci-lint timeout (#3855)
  * refactor: init certs with certs renewer directly (#3853)
  * tests: add unit tests for utils functions (#3857)
  * chore: enable golangci-lint in ci (#3852)
  * feat: fetch tls certificate dynamically (#3851)
  * fix: golangci-lint warnings in pkg (#3846)
  * refactor: remove the need for self-signed annotation on cert secret (#3850)
  * handle subresources (#3841)
  * fix: golangci-lint warnings in cmd (#3843)
  * refactor: webhookconfig package (part 4) (#3835)
  * refactor: webhookconfig package (part 3) (#3834)
  * refactor: remove unused functions (#3840)

-------------------------------------------------------------------
Tue Sep 27 06:32:11 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.4:
  * fix: update github action to use current workflow path (#4705)
  * tag v1.7.4 (#4698)
  * fix: incorrect namespace in report controller (#4637) (#4688)
  * Fix issue for wildcard versions (#4670) (#4674)

-------------------------------------------------------------------
Wed Sep 07 06:59:32 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.3:
  * Cherry-pick #4398 - bump cosign to 1.11.0 (#4399)
  * Release v1.7.3 (#4394)
  * Fix deprecated  api policy issue (#4349) (#4350)
  * precondition failure will skip rule independent of audit or enforce mode (#4163) (#4296)

-------------------------------------------------------------------
Mon Jul 25 11:08:18 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.2:
  * tag v1.7.2 (#4261)
  * Use non-blocking channel send for UpdateWebhookChan (#4204) (#4247)
  * Release v1.7.2-rc2 (#4246)
  * fix split policyreport name with background scan (#4237) (#4245)
  * fix check depreciated api issue (#4243) (#4244)
  * fix kyverno cli policy-report typo (#4224) (#4232)
  * Limit queued events (#4233)
  * update cosign to v1.9.0 (#4231)
  * Only set up logging context if it will be used (#4213)
  * use the unstructured list instead of interface type (#4211)
  * Fix UpdateRequest labeling (#4199)
  * Release 1.7 (#4200)
  * external.metrics.k8s.io/v1beta1 issue (#4182)
  * delete policy reports on policy deletion (#4174) (#4175)
  * tag v1.7.2-rc1 (#4167)
  * feat: split policy report per policy bases (#4147) (#4166)
  * Re-implement #4159 (#4165)
  * Cherry pick #4155 (#4164)
  * Cherry-pick #4148
  * Use kyverno namespace informer to list pods while processing URs (#4156)
  * Cherry-pick #4138 to 1.7 (#4160)
  * fix: use dev tag for init container local build target (#4141)

-------------------------------------------------------------------
Wed Jun 22 08:17:51 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.1:
  * tag v1.7.1 (#4132)
  * fix build failures
  * fix: bool fields in image verification types (#4053)
  * cherry-pick #4013
  * Release 1.7 (#4130)
  * fix: use policyName key to get the policy name (#4113)
  * chore(dockerfile): use buildx features for cross-compilation (#4023) (#4123)
  * Updated jp command flags and also added URL for help. (#4122)
  * fix: handle nil ur while retry (#4109)
  * Release 1.7 (#4099)
  * Bump Charts version to 2.5.0 (#4092)
  * bump chart versions to v2.4.2 (#4089)
  * cherry-pick #4079 (#4088)
  * Remove s390X (#4063) (#4064)
  * Bump charts version to 2.4.1 (#4061)
  * Ensure preconditions are present with default values (#4046)
  * Fix handling of kyverno-policies version check when port in image tag (#4042)

-------------------------------------------------------------------
Sat Jun 04 18:55:18 UTC 2022 - kastl@b1-systems.de

- Update to version 1.7.0:
  * Tag v1.7.0 (#4050)
  * refactor: bump KIND version to use v1.24.0 k8s release (#4049)
  * fix policy typo (#4039) (#4045)
  * Tag 1.7.0-rc3 (#4036)
  * Fix labels with invalid charrs (#4034) (#4035)
  * Cherry-pick #4022 (#4033)
  * fix vulnerable (#4027) (#4028)
  * Request operation value by default to CREATE (#3894) (#4026)
  * Release v1.7.0-rc2 (#4021)
  * Cherry pick #4007 #4008 (#4020)
  * fix: stop mutation policies when autogen internals is enabled (#4004,#4009,#3996) (#4016)
  * cherry-pick fix attestation checks https://github.com/kyverno/kyverno/pull/3999 (#4015)
  * refactor: add policy event listener in ur controller (#4012) (#4014)
  * Support `@` for mutate targets (#3998) (#4010)
  * fix: stop mutating cached resource in ur controller (#4003) (#4006)
  * fix: move ur controller filtering in reconciler (#3964) (#3994)
  * fix: release ur when handler pod is gone (#3993)
  * fix: mark ur retry on conflict (#3961) (#3963)
  * fix: replica count in helm chart (#3954) (#3962)
  * Cherry pick #3953 #3955 (#3960)
  * fix: handle UR delete once trigger namespace deleted (#3934) (#3938)
  * fix: use patch to update handler status in UR (#3927)
  * Cleanup the UR for mutate policies once it's completed (#3923)
  * Remove permissions in helm-release workflow (#3901) (#3903)
  * Release v1.7.0-rc1 (#3896)
  * cherry-pick #3893 (#3895)
  * Fix subject match selector issue in cli (#3887) (#3892)
  * skip var checks in attestations (#3876) (#3885)
  * fix: undo length validation check for generate rule resource name (#3865) (#3872)
  * Handle errors properly for mutate and generate on existing resources (#3863) (#3866)
  * refactor: remove unused functions (#3844)
  * handle subresources (#3841) (#3848)
  * feat: trigger generate on existing matched resource (#3819)
  * refactor: webhook config package (part 2) (#3833)
  * refactor: webhookconfig package (part 1) (#3831)
  * fix check and add logs (#3838)
  * Allow variables of any kind to be defined (#3828)
  * fix: policy deletion in webhookconfig (#3832)
  * refactor: imported pkg redeclared and a few other unused func (#3827)
  * refactor: shell to prevent globbing and word splitting (#3829)
  * CLI should respect scored annotation for warnings (#3821)
  * Add an object_from_lists function (#3824)
  * Improve logging and error handling in json context (#3825)
  * Relax JMESPath variable validation (#3826)
  * Load `mutate.targets` via dclient (#3797)
  * Cert attestor (#3809)
  * handle duplicate images; use container name as key (#3779)
  * fix: autogen rules in status (#3728)
  * refact: disable leader for update request controller (#3807)
  * chore: remove broken .ca from helm chart (#3811)
  * fix: remove k8s apiserver from self-generated cert (#3803)
  * Policy Validation check for onPolicyUpdate flag (#3814)
  * Add `handler` to `UR.status` (#3791)
  * fix: remove kubeconfig (#3802)
  * fix: cleanup old dependencies from go.sum and go.mod (#3806)
  * feat: parse all root CA certs (#3808)
  * removed kubeconfig flags (#3744)
  * Fix issue with image registry when decoding OCI descriptors with out of spec keys (#3799)
  * refactor: move config controller in controllers package (#3790)
  * chore: add informer util (#3796)
  * chore: remove useless util NewKubeClient (#3795)
  * fix: pod stay in terminating when scaling to 0 (#3793)
  * Add JMESPath Function `items` (#3777)
  * Fix Cli test for image verification (#3760)
  * Add rule to PolicyViolation event messages (#3787)
  * chore: remove config flags (#3786)
  * fix: add missing tombstone calls (#3784)
  * refactor: create a package for controllers and move certmanager in it (#3782)
  * refactor: policycache package logger (#3783)
  * refactor: move ImageExtractorConfigs in api package (#3781)
  * refactor: dclient package logger (#3778)
  * Fix PR update flow and allow updates from release branches (#3780)
  * fix: cert manager duplicate event handler (#3772)
  * webhookconfig: if services resource, add services/status as well (#3740)
  * refactor: dclient package (#3775)
  * refactor: replace clientset by inteface (#3774)
  * refactor: cosign package logger (#3773)
  * Bump cosign and sigstore version (#3771)
  * Auto-update PRs which are enabled for auto-merging (#3766)
  * refactor: wait for cache sync (#3765)
  * Allow kyverno jp to take yaml files as inputs (#3768)
  * Allow non-object type elements for foreach rules (#3763)
  * fix: logger call depth (#3759)
  * Reduce log verbosity for image extractors (#3764)
  * chore: remove unused resourcecache package (#3762)
  * refactor: remove unstructured usage from webhookconfig (#3737)
  * refactor: use typed informers and add tombstone support to webhookconfig (#3736)
  * Remove YAML multiline support in CM values (#3721)
  * cleanup event messages and sources (#3741)
  * Add tests for required checks for image verify (#3755)
  * Add error handling and log for image extractor errors (#3724)
  * Fix verify all images (#3748)
  * Retry policy creation to avoid flaky CRD readiness (#3752)
  * Fix test Summary printing for failure test cases (#3749)
  * Enable tests in makefile (#3699)
  * refactor: metrics package logger (#3734)
  * Use inclusive language (#3738)
  * fix: block policy for missing matched kind (#3733)
  * fix: missing image verification rules in autogen (#3729)
  * Convert GenerateRequest to UpdateRequest for backward compatibility (#3730)
  * refactor: autogen package logger (#3727)
  * fix: correct tombstone usage (#3718)
  * refactor: remove some api unnecessary pointers (4)  (#3713)
  * Set policy kind to generate events in the webhook (#3726)
  * Create UR for both mutate and generate policies (#3717)
  * fix: remove supported from autogen status (#3714)
  * fix: generated api reference docs (#3711)
  * refactor: remove some api unnecessary pointers (3) (#3707)
  * Optimize UR listing on policy events (#3712)
  * - Create events for imageVerify rules (#3710)
  * refactor: remove some api unnecessary pointers (2) (#3705)
  * fix: remove unused type TargetMutation (#3706)
  * refactor: remove some api unnecessary pointers (#3704)
  * add e2e tests for mutate existing policies (#3703)
  * Verify digest (#3679)
  * fix: kind wash in mutate policy helper (#3698)
  * refactor: auth package logger (#3696)
  * chore: remove unused custom expansions from client (#3697)
  * refactor: client gen code (#3695)
  * Fix test command git issue (#3692)
  * Enable verifyImages and CLI registry tests (#3684)
  * Cherry-pick release-1.6 Helm changes (#3689)
  * Show warnings in Helm chart installation; update issue templates (#3673)
  * refactor: use typed k8s client in tls package (#3678)
  * refactor: config package logger (#3683)
  * Fix flaky e2e tests for generate policies (#3681)
  * Fix regression in wildcard matches in In/AnyIn operators (#3686)
  * feat: remove deprecated flags (#3680)
  * Logic of match service account is fixed for namespace (#3662)
  * fix test cli CI failures from main (#3682)
  * Fix issue pod should not be ready until the policy cache  loaded (#3646)
  * bug: fix nil pointer when generating events (#3677)
  * remove Validate Cmd (#3674)
  * Support context variables when using foreach CLI (#3637)
  * fix: webhooks are not configured correctly (#3660)
  * bump to Go 1.17.9 (#3671)
  * fix: api reference docs link (#3664)
  * feat: mutate existing resources (#3669)
  * fix: pass logger by value (#3666)
  * Allow definition of inline variables in context (#3658)
  * fix: add char length validation for generate rule resource name (#3640)
  * chore: remove e2e tests for kube 1.20 (#3665)
  * chore: add support for artifacthub.io/changes in helm charts (#3652)
  * fix: policy controller missing GVK (#3659)
  * [imageVerify]: adding `digestMutate` to simplify tag-to-digest mutation (#3531)
  * Multiple keys (#3636)
  * fix: do not remove webhooks during initialization (#3641)
  * fix: prevent installing chart with 2 replicas (#3647)
  * fix: print helm install warnings (#3648)
  * chore: warn if kube version is too old in helm notes (#3650)
  * chore: add artifacthub operator and prerelease annotations (#3649)
  * refactor: use the typed ns informer in GR controller (#3554)
  * refactor: image utils (#3630)
  * Remove helm mode setting (#3628)
  * refact: remove unused Run function from generate (#3638)
  * Fix race condition in pCache (#3632)
  * Allow defining imagePullSecrets (#3633)
  * Image verify attestors (#3614)
  * Allow kyverno-policies to have preconditions defined (#3606)
  * updating version in Chart.yaml (#3618)
  * Update vulnerable dependencies (#3577)
  * Add support for custom image extractors (#3596)
  * add-kms-libraries for cosign (#3603)
  * refactor cli code from pkg to cmd (#3591)
  * fix missing policy.kyverno.io/policy-name label (#3599)
  * refactor generate controller (#3589)
  * change/suppress warning messages (#3593)
  * Feat - add the new CR UpdateRequest for post mutation (#3592)
  * Update to cosign 1.7.1 (#3587)
  * Update GH workflow config (#3588)
  * Update CODEOWNER folders for @samj1912 (#3586)
  * Update hash of dependencies instead of mutable version (#3582)
  * add support for roles, cluster roles and subjects (#3188)
  * fix imageVerify rule conversion (#3583)
  * update imageVerify schema (#3574)
  * Refactor image extraction to allow extracting custom resources (#3572)
  * chore: remove dead code (#3561)
  * Add returnType for regexMatch in kyverno jp output (#3575)
  * refactor: engine context (#3563)
  * Fixes #3555 (#3558)
  * update image pull policy for YAML install which uses :latest (#3565)
  * add @eddycharly as a maintainer! (#3566)
  * chore: add some make help comments (#3560)
  * refactor: switch to admission v1 (#3526)
  * refactor: make response type (RuleType) typed (#3556)
  * refactor: metrics package (#3549)
  * refactor: webhooks metrics reporting (#3548)
  * test: pass lock by value (#3481)
  * refactor: simplify autogen package (#3532)
  * refactor: move common utils (#3553)
  * refactor: add engine utils sub package (#3552)
  * fix: checkEngineResponse in webhooks (#3551)
  * Do not generate preconditions not met warning for audit policies (#3487)
  * refactor: reduce policy mutations (#3550)
  * fix: annotation path (#3547)
  * refactor: use GetFailurePolicy method (#3545)
  * refactor: use BackgroundProcessingEnabled method (#3544)
  * refactor: move some helpers in utils package (#3539)
  * refactor: use GetValidationFailureAction method (#3546)
  * fix: disallow all in autogen annotation (#3537)
  * refactor: use existing ContainsString util (#3543)
  * Create `poddisruptionbudget.yaml` when `mode=ha` (#3536)
  * fix wildcards in value arrays (#3486)
  * refactor: separate yaml utils package (#3520)
  * refactor: separate kube utils package (#3527)
  * refactor: add os utils sub package (#3528)
  * refactor: add a json patch util and use it in autogen package (#3524)
  * fix: tls min version (#3521)
  * refactor: separate json utils package (#3523)
  * refactor: webhooks package (#3516)
  * refactor: use policy interface and introduce admission utils package (#3512)
  * fix: use github repo env instead of hardcoded repo name (#3513)
  * fix: reduce dependency to ns lister (#3509)
  * refactor: use more policy interface (#3510)
  * refactor: use policy interface in policycache package (#3503)
  * refactor: make use of policy interface (#3499)
  * refactor: improve policycache package (#3495)
  * chore: add autogen internals e2e tests (#3492)
  * refactor: factorize policy interface (#3496)
  * feat: add webhooks object selector support (#3413)
  * feat: generate support for namespace policy (#3472)
  * chore: simplify validation with named return (#3493)
  * add missing namespace to role and rolebinding (#3389) (#3429) (#3485)
  * chore(deps): add renovate.json (#3471)
  * feat: stop mutating rules (#3410)
  * use mutex as field instead of embedded (#3480)
  * refactor: create e2e infra using make to speed up e2e tests (#3470)
  * fix ordering of mutate element (#3468)
  * refactor: use abstract policy interface in webhookconfig (#3466)
  * adds lease objects for storing last-request-time and set-status annotations in deployment (#3447)
  * clean up dependencies (#3469)
  * fix: use RWMutex lock while concurrent read/write (#3462)
  * refactor: match and exclude conflict validation (#3454)
  * refactor: add ValidationFailureAction to the api (#3451)
  * refactor: remove ns lister from webhookconfig (#3452)
  * refactor: add IsNamespaced() method to API policy types (#3450)
  * fix: use PodControllersAnnotation constant (#3448)
  * Update MAINTAINERS.md (#3449)
  * support for deprecated API's (#3439)
  * Drop v1alpha1 PolicyReport CRD (#3437)
  * refactor: ExcludeResources validation (#3445)
  * refactor: replace ExcludeResources by MatchResources (#3444)
  * refactor: ResourceDescription validation (#3446)
  * Fix incorrectly renamed file (#3443)
  * Remove support for test.yaml (#3442)
  * fix cli panic for --cluster flag (#3436)
  * Fix check for generated webhook rules being equal to what the API server has (#3407)
  * refactor: MatchResources validation (#3422)
  * feat: use IsReady method (#3426)
  * refactor: ValidationFailureActionOverrides validation (#3421)
  * PR and issue template updates per contributors' meetings (#3428)
  * [imageVerify]: correcting error msg (#3398)
  * feat: add toggle package for feature flags (#3419)
  * feat: move GetRules() at the policy level (#3420)
  * feat: add conditions support (#3378)
  * feat: stop adding autogen annotation (#3379)
  * fix webhook configuration issue when auto update is disabled (#3417)
  * Ignore test files that do not end in test.yaml (#3402)
  * refactor: Policy name validation (#3409)
  * Replace `ToUnstructured()` with Marshal/Unmarshal (#3150)
  * [ImageVerify] Verify additional certificate-extensions  (#3404)
  * fix: filter resources names with helm custom release name (#3361)
  * refactor: Rule names validation (#3406)
  * refactor: Rule type validation (#3400)
  * chore: remove check-helm-docs workflow (#3408)
  * refactor: UserInfo validation (#3399)
  * Fix webhook re-creation error (#3403)
  * chore: add make help target (#3405)
  * Only queue one retry if webhook update fails (#3353)
  * chore: add more codegen target and verifications (#3393)
  * Return warning on admission response when mutating pods (#3272)
  * Add a registry flag to allow direct access to container registries in the CLI (#3396)
  * feat: add rules to status (#3376)
  * chore: makefile should not makefile go.mod (#3394)
  * refactor: ImageVerification validation (#3372)
  * Cli Apply command support Dir as resources (#3391)
  * chore: add helm crds to make codegen target (#3375)
  * fix: metrics config defaults (#3387)
  * fix for gvk not working for existing resources policy (#3384)
  * e2e test for mutate global anchor Policy (#2574)
  * Add `codecov` to CI (#3382)
  * Update cosign to v1.6.0 (#3341)
  * fix: generate api reference docs (#3377)
  * fix PodExecOptions issue (#3373)
  * Update OWNERS.md (#3371)
  * feat: add autogen controllers to policy status (#3332)
  * chore: gen helm crds from config crds (#3356)
  * refactor: introduce api common types (#3365)
  * adding emptyDir vol for keyless signing (#3366)
  * refactor: move api functions closer to the struct they belong to (#3363)
  * refactor: introduce rules getters and setters (#3350)
  * refactor: move controller autogen annotation in api package (#3364)
  * Add new test-case-selector flag to test command (#3183)
  * support RSA, ECDSA and EDDSA public key verification (#3362)
  * fix: configmap resource filters generated by helm does not account for namespace (#3358)
  * chore: check helm docs are up to date (#3310)
  * Fix any_all wildcard issue (#3352)
  * fix: invalid path in helm-test workflow (#3344)
  * Add Bloomberg to adopters (#3348)
  * updated description field of foreach (#3157)
  * chore: verify codegen in CI (#3343)
  * Update generate clusterrole (#3336)
  * fix: CRD generation (#3334)
  * refactor: reduce usage of reflect.DeepEqual (#3328)
  * fix: update codegen (#3329)
  * fix: naming typos (#3327)
  * refactor: introduce autogen package (#3316)
  * refactor: pass only spec instead of whole policy when possible (#3315)
  * fetch tag across all branches instead of current branch (#3324)
  * add separate step for digest (#3321)
  * adding check for digest and update git command
  * correcting makefile latest tag (#3314)
  * fix: helm install docs (#3312)
  * fix: seccomp profile (#3313)
  * chore: drop helm v2 (#3311)
  * feat: gen kyverno helm chart docs (#3309)
  * feat: gen kyverno-policies helm chart docs (#3301)
  * Fix workflow using regex in `main` (#3306)
  * arranging permissions (#3293)
  * fix: helm chart broken when use generatecontrollerExtraResources (#3302)
  * feat: support background mode configuration in kyverno-policies chart (#3299)
  * Improve CLI test times by instantiating openapi controller once (#3297)
  * Fix namespace typo (#3298)
  * fix: add support for other platforms before executing docker buildx (#3296)
  * validate and block policy based on the matched kind cache (#3283)
  * fix: comma separated lists in config (#3290)
  * Run E2E tests on all supported k8s versions (#3256)
  * latest will point to main (#3285)
  * Shallow clone git repositories for kyverno test command
  * update trivy scanning (#3284)
  * feat: add linux/s390x builds (#3277)
  * Fix label mutation while updating the secret (#3273)
  * Modify capabilities for compatibility with Pod Security (#3274)
  * Fix Helm releasing to preserve creation timestamps (#3268)
  * Added `kyverno test` subcommand for test manifest file (#3264)
  * Clean up commented out lines of code (#3263)
  * Add .DS_store to gitignore (#3255)
  * fix mutate wildcard issue (#3193)
  * Fix foreach validations precondition issue (#3228)
  * Fix policy report OwnerReference (#3249)
  * Improve E2E test CI timings (#3250)
  * Add openssf badge (#3246)
  * Fix old object validation check (#3248)
  * Bug fix: negation of string kernel version caused Cluster Policy to fail (#3229)
  * add helm pre-delete hook which deletes all the webhooks (#3148)
  * Skip updating webhook configs if namespaceSelector is nil (#3237)
  * Sync latest changes to release/install.yaml (#3239)
  * add aggregated role for generaterequest (#3240)
  * Remove abstraction that doesn't work anyway (#3209)
  * Fix image parsing for image referenced as digests  (#3196)
  * feat: ha mode support in helm chart (#3207)
  * Fix keyless attest (#3219)
  * update dependencies (#3221)
  * Issue forms and PR template adjustment (#3213)
  * add prateekpandey14 to codeowners (#3205)
  * Added e2e test for JSON patch mutate policy (#2966)
  * fixing bug to handle two different types of rules  (#2954)
  * Allow setting validationFailureActionOverrides for policies (#3201)
  * feat: fix app version in NOTES.txt (#3189)
  * Indentation fix (#3179)
  * Fix unused tagTest in helm chart tests (#3174)
  * Update kyverno-policies chart with latest pod-security policies (#3126)
  * Add a kyverno jp command to test jmespath expressions (#3169)
  * test-cases for wildcard match label selector (#3165)
  * Filter kyverno resources instead of entire kyverno namespace (#3170)
  * Fix panic for provides a set to the key of a precondition and deny condition (#3162)
  * Bump up verbosity for `patched resource mismatch` (#3127)
  * bump chart versions (#3160)
  * Update dev image tag in Make targets (#3159)
  * Add sam (#3155)
  * add missing patch verbs in event clusterrole (#3151)
  * fix filtered and sort patches index (#3146)
  * Fix kyverno panic with `PodSpec.containers` JSON merge patch w/o image (#3143)
  * Relax rule context validation to follow JMESPath grammar (#3129)
  * Fixed kyverno panic at JMESPath zero division (#3137)
  * Fix variable substitution when curly braces are used in jmespath (#3133)
  * Fix parsing of resources in preconditions (#3108)
  * Add cloud provider keychains to DefaultKeychain (#3116)
  * improve antiAffinity and add podAffinity and nodeAffinity for kyverno helm chart (#3067)
  * fixing and adding tests (#3112)
  * update cosign to 1.5.0 and fix issuer and subject for keyless (#3089)
  * Add b/w compat support for K8s version 1.20 and below for Kyverno 1.6 (#3100)
  * Fix the kyverno default keychain value to be the ggcr default keychain (#3096)
  * fix: typo Cluter to Cluster (#3092)
  * Fix memory leak when updating ggcr keychain (#3088)
  * Support registry keychain from cloud providers (#3036)
  * Updates Changelog to add note for anyPattern issue due to k8s v1.23 (#3045)
  * Add KYVERNO_DEPLOYMENT to initContainer (#3086)
  * apply patches cumulatively (#3083)
  * Fix CLI test/apply when any/all use namespaceSelector (#3050)
  * fix mutating ownerReferenecs (#3061)
  * update workflow configurations to fix CI failure (#3060)
  * Fix documentation for helm charts (#3056)

-------------------------------------------------------------------
Fri Apr 01 07:04:47 UTC 2022 - kastl@b1-systems.de

- Update to version 1.6.2:
  * tag v1.6.2 (#3511)
  * Cherry-pick #3111 and release v1.6.2-rc3 (#3506)
  * tag v1.6.2-rc2 (#3500)
  * feat: generate support for namespace policy (#3498)
  * use mutex as field instead of embedded (#3480) (#3489)
  * release v1.6.2-rc1 (#3482)
  * Cherry-pick #3477 (#3479)
  * adds lease objects for storing last-request-time and set-status annotations in deployment (#3447) (#3478)
  * fix: use RWMutex lock while concurrent read/write (#3462) (#3467)
  * support for deprecated API's (#3439) (#3453)
  * fix cli panic for --cluster flag (#3436) (#3438)
  * add missing namespace to role and rolebinding (#3389) (#3429)
  * fix webhook configuration issue when auto update is disabled (#3417) (#3418)
  * Cli Apply command support Dir as resources (#3391) (#3392)
  * fix for gvk not working for existing resources policy (#3384) (#3386)
  * Cherry pick/3366 (#3367)
  * Update generate clusterrole (#3336) (#3359)
  * fixing bug to handle two different types of rules  (#2954) (#3357)
  * Fix any_all wildcard issue (#3352)

-------------------------------------------------------------------
Wed Mar 02 05:51:37 UTC 2022 - kastl@b1-systems.de

- Update to version 1.6.1:
  * fix release tag command (#3323)
  * fetching proper digest for release images (#3319)
  * update release v1.6.1 manifest (#3318)
  * changing git command to fetch the tag (#3317)
  * release v1.6.1-rc2
  * cherry-pick c4075af3d17c59fe73b50083bb206d85a1cb38ba
  * Run E2E tests on all supported k8s versions (#3256)
  * Fix namespace typo (#3298)
  * feat: support background mode configuration in kyverno-policies chart (#3299)
  * fix: helm chart broken when use generatecontrollerExtraResources (#3302)
  * Shallow clone git repositories for kyverno test command
  * fix: add support for other platforms before executing docker buildx (#3296)
  * latest pointing to main
  * added condition
  * using regex
  * updated workflows
  * validate and block policy based on the matched kind cache (#3283) (#3291)
  * Filter kyverno resources instead of entire kyverno namespace (#3170) (#3171)
  * update trivy scanning (#3284)
  * tag v1.6.1-rc1
  * Fix label mutation while updating the secret (#3273) (#3278)
  * Modify capabilities for compatibility with Pod Security (#3274) (#3275)
  * Fix Helm releasing to preserve creation timestamps (#3268)
  * fix mutate wildcard issue (#3193)
  * Fix foreach validations precondition issue (#3228)
  * Fix policy report OwnerReference (#3249) (#3257)
  * Fix old object validation check (#3248)
  * Skip updating webhook configs if namespaceSelector is nil (#3237) (#3243)
  * bump chart versions to v2.3.0
  * cherry-pick #3209
  * Fix image parsing for image referenced as digests  (#3196) (#3233)
  * Fix keyless attest (#3219)
  * update dependencies (#3221)
  * release Helm chart v2.2.1
  * Allow setting validationFailureActionOverrides for policies (#3201)

-------------------------------------------------------------------
Fri Feb 18 15:07:52 UTC 2022 - Johannes Kastl <kastl@b1-systems.de>

- link /usr/bin/kyverno to /usr/bin/kubectl-kyverno to make this usable as a kubectl plugin

-------------------------------------------------------------------
Fri Feb 18 13:02:16 UTC 2022 - Johannes Kastl <kastl@b1-systems.de>

- new package kyverno: CLI and kubectl plugin for the Kyverno Policy engine

Places

File kyverno.changes of Package kyverno (Revision 8ee2d8182cbe6d06d4a1b1cb870de7f4)

Places