chore(deps): update dependency kyverno/kyverno to v1.17.0

[renovate]

This PR contains the following updates:

Package	Update	Change
kyverno/kyverno	minor	1.15.1 → 1.17.0

---

Release Notes

kyverno/kyverno (kyverno/kyverno)

v1.17.0

Compare Source

v1.16.3

Compare Source

What's Changed

• feat: Implement failureActionOverrides namespaceSelector (Cherry-pick #​13750) by @​kyverno-bot in #​14671
• fix: prevent cross-namespace access in apiCall by @​realshuting in #​14843
• feat(engine): add context size limit by @​realshuting in #​14844
• Release v1.16.3-rc.1 by @​realshuting in #​14872
• Release v1.16.3 by @​realshuting in #​14881

Full Changelog: kyverno/kyverno@v1.16.2...v1.16.3

v1.16.2

Compare Source

What's Changed

• cherry-pick #​14414 by @​fjogeleit in #​14481
• fix: revert accidentally introduced breaking change for the kyverno_policy_results metric (Cherry-pick #​14471) by @​kyverno-bot in #​14479
• cherry-pick #​14470 by @​fjogeleit in #​14480
• cherry pick #​14492 by @​fjogeleit in #​14494
• execute missing controller metric (Cherry-pick #​14493) by @​kyverno-bot in #​14496
• perf(globalcontext): use DynamicInformer for optimal memory and performance (Cherry-pick #​14518) by @​kyverno-bot in #​14524
• read kind label value from AdmissionRequest (Cherry-pick #​14549) by @​kyverno-bot in #​14550
• fix: add a pre-flight check for listing CRDs in cleanup controller (Cherry-pick #​14565) by @​kyverno-bot in #​14603
• feat: release v1.16.2-rc.1 by @​realshuting in #​14610
• feat: release v1.16.2 by @​realshuting in #​14628

Full Changelog: kyverno/kyverno@v1.16.1...v1.16.2

v1.16.1

Compare Source

What's Changed

• fix nil namespace initialization for cluster wide param resources (Cherry-pick #​14327) by @​kyverno-bot in #​14328
• fix: dont register the http request type (Cherry-pick #​14238) by @​kyverno-bot in #​14340
• fix: scale test k6 installation (cherry-pick #​14338) by @​realshuting in #​14348
• fix: handle namespace match with namespaceSelector (Cherry-pick #​14339) by @​kyverno-bot in #​14356
• feat: generate and copy crd to cli for namespaced validating policy and namespaced deleting policy (Cherry-pick #​14316) by @​kyverno-bot in #​14357
• release v1.16.1-rc.1 by @​realshuting in #​14345
• fix(admissionpolicy): handle nil MatchConstraints (Cherry-pick #​14350) by @​kyverno-bot in #​14394
• fix(controllers): duplicate error accumulation (Cherry-pick #​14349) by @​kyverno-bot in #​14395
• fix(controllers): avoid cleanup on non-matching ns (Cherry-pick #​14386) by @​kyverno-bot in #​14398
• supporting wildcards in resource namespace matching (Cherry-pick #​14250) by @​kyverno-bot in #​14397
• fix: use namespaceObject in deletingpolicies (Cherry-pick #​14381) by @​kyverno-bot in #​14422
• chore: add a new test that uses both context and values (Cherry-pick #​14416) by @​kyverno-bot in #​14423
• release v1.16.0-rc.2 by @​realshuting in #​14428
• release v1.16.1 by @​realshuting in #​14435

Full Changelog: kyverno/kyverno@v1.16.0...v1.16.1

v1.16.0

Compare Source

New Adopters

• Sophotech (#​14034)
• Swiss Post (#​14054)
• Finastra (#​14107)
• Okteto (#​14269)

✨ Added ✨

• Added NamespacedValidatingPolicy type (#​14121, #​14155, #​14224, #​14245, #​14217)
• Added NamespacedImageValidatingPolicy type (#​14195, #​14242)
• Added NamespacedDeletingPolicy type (#​14050, #​14097, #​14098, #​14315)
• Supported bind to a hostIP when in hostNetwork mode (#​13714)

API Versions

• Added v1beta1 version for CEL policies: ValidatingPolicy, ImageValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy (#​14131, #​14143, #​14150, #​14202, #​14205, #​14206, #​14209, #​14306, #​14152, #​14163)
• Added v1beta1 version for PolicyException (#​14167)
• Added v2beta1 version for GlobalContextEntry (#​14165)
• Unserved v1beta1 version for UpdateRequest (#​14145)
• Supported params in VAP/MAP CLI mode (#​13734)
• Added support for fine-grained cel exceptions (#​13817, #​13922)
• Built webhooks with matchLabels defined in the policy (#​13890)
• Added performance metric for cel policies (#​13896, #​13932, #​13963, #​13980, #​14001)
• Added CLI completion command (#​13905)
• Added configurable option for policy reporting via the label option (#​13978)
• Supported CEL quantity library (#​14025)
• Made spec.evaluation.mode field selectable (#​14028)
• Added a new function overload to support resource.Get(gvr, namespace, name) and resource.List(gvr, namespace) (#​14053)
• Supported events generation for CEL policies (#​14106, #​14055)
• Supported label selector in resource.List CEL library (#​14117)
• Added a configurable option for report result via PolicyException (#​14175)
• Supported Kyverno CEL libraries in matchConditions (#​14168, #​14171, #​14116)
• Added Kubernetes v1.30-v1.32 support to podSecurity subrule (#​14255)
• Added "bind" role to the background controller default (#​14278)
• Versioned compilers (#​14153)

🐛 Fixed 🐛

• (CLI)Fixed apply command return code regardless of output format (#​12629)
• Fixed resource name matching for edge case when name is auto-generated (#​13584)
• (CLI) Fix an issue display resource names for excluded resources in kyverno test output (#​13625)
• Fixed an issue to queue reports that belong to a certain policy when this policy gets an event (#​13664)
• Fixed an issue ro update lastRefreshInterval of the globalcontextentry (#​13700)
• Fixed OpenSSF scorecard critical issue (#​13812)
• Fixed namespace termination logging (#​13866)
• Fixed a panic issue in the reports controller (#​13885)
• Updated conditional logic to correct reportsServer value reference (#​13893)
• Fixed background scan reporting to consume resourceFilter for new policy types (#​13919)
• (ClI) Fixed issue to evaluate userInfo for VAPs and MAPs in the CLI (#​13920)
• Fixed a reporting issue for pod controllers regarding reportProperties and custom messages (#​13952)
• Fixed issue to block mutating policies upon compilation errors (#​13972)
• Fixed namespace selector matching for PolicyException (#​13975)
• Reduce memory usage by disabling histogram min/max tracking (#​13962)
• Enhanced logs for generate rule attempts execution for rejected resources (#​14056)
• Fixed autogen rule conversion regarding metadata paths translation(#​14208)

Helm

• Cleaned up unused helm hooks (#​13716)
• Supported configurable podAnnotations for test pods (#​13767)
• Shortened helm hook names (#​13966)
• Create standalone CRDs chart (#​13988)
• Fixed to make helm templating value global (#​14144)
• Added new policy types to migration job (#​14162)

🔧 Others 🔧

• Removed deprecated webhook (#​13273)
• Optimized namespace fetching in policy processor and restmapper client (#​13550)
• Improved README structure, clarity, and usability (#​13569, #​13904)
• Improved sanitize extract regexes (#​13640)
• Improved resource usage by switching to a lazy loading model for updating dynamic watcher resource hashes (#​13693)
• Updated bug templates (#​13723)
• Fixed broken link (#​13749, #​13764, #​13841)
• CI enhancements (#​13773, #​13789, #​13816, #​13842)
• Fixed missing sign-off for cherry-pick commits (#​13782)
• Corrected spelling of received in API call test (#​13902)
• Added @​liuxu623 to codeowners (#​13945)
• Added @​aerosouund to codeowners in relevant packages (#​13946)
• Reduced memory allocation (#​13994)
• Set the missing object in mutatingpolicies engine eval (#​14004)
• Fixed a typo in deleting controller log (#​14082)
• Corrected spelling from 'atleast' to 'at least' (#​14089)
• Removed gvr/gvk mapping overhead for dpol (#​14108)
• Updated to ignore subchart tgz files (#​14142)
• Bumped k8s libraries to 1.34 (#​14191)
• Replaced metrics-server helm chart for performance testing setup (#​14192)
• Updated k8s versions in CI tests (#​14264, #​14277)
• Improved test coverage (#​13628, #​13747, #​13766, #​13797, #​13798, #​13801, #​13802, #​13847, #​13850)
• Removed flaky test temporary to unblock PRs (#​14199)
• Enhancement API docs (#​14259, #​14236)

Dependencies

• chore(deps): bump the kubernetes group across 2 directories with 2 updates (#​14210)
• chore(deps): bump github/codeql-action from 4.30.8 to 4.30.9 (#​14196)
• chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 in /.github/actions/run-tests (#​14188)
• chore(deps): bump ubuntu from 59a458b to 66460d5 in /.devcontainer (#​14172)
• chore(deps): bump github/codeql-action from 4.30.7 to 4.30.8 (#​14157)
• chore(deps): bump adRise/update-pr-branch from 0.10.1 to 0.10.2 (#​14156)
• chore(deps): bump ubuntu from 728785b to 59a458b in /.devcontainer (#​14147)
• chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#​14141)
• chore(deps): bump fluxcd/flux2 from 2.7.1 to 2.7.2 (#​14137)
• chore(deps): bump github/codeql-action from 3.30.6 to 4.30.7 (#​14133)
• chore(deps): bump google.golang.org/grpc from 1.75.1 to 1.76.0 (#​14126)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.3 (#​14125)
• chore(deps): bump fluxcd/flux2 from 2.7.0 to 2.7.1 (#​14123)
• chore(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 (#​14120)
• chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 (#​14118)
• chore(deps): bump ubuntu from 353675e to fdb6c9c in /.devcontainer (#​14110)
• chore(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#​14101)
• chore(deps): bump fluxcd/flux2 from 2.6.4 to 2.7.0 (#​14100)
• chore(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#​14091)
• chore(deps): bump github/codeql-action from 3.30.4 to 3.30.5 (#​14083)
• chore(deps): bump github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0 (#​14077)
• chore(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#​14074)
• chore(deps): bump github.com/aptible/supercronic from 0.2.34 to 0.2.36 (#​14064)
• chore(deps): bump sigs.k8s.io/release-utils from 0.12.1 to 0.12.2 (#​14059)
• chore(deps): bump ubuntu from 590e57a to 353675e in /.devcontainer (#​14026)
• chore(deps): bump github.com/prometheus/client_golang from 1.23.0 to 1.23.2 (#​14021)
• chore(deps): bump ubuntu from 9cbed75 to 590e57a in /.devcontainer (#​14019)
• chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0 (#​14014)
• chore(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 (#​14013)
• chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 in /.github/actions/run-tests (#​14011)
• chore(deps): bump google.golang.org/grpc from 1.74.2 to 1.75.1 (#​13986)
• chore(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#​13984)
• chore(deps): bump github/codeql-action from 3.30.0 to 3.30.2 (#​13979)
• chore(deps): bump oras-project/setup-oras from 1.2.3 to 1.2.4 (#​13970)
• chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#​13957)
• chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#​13956)
• chore(deps): bump ubuntu from 7c06e91 to 9cbed75 in /.devcontainer (#​13955)
• chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 (#​13951)
• chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 in /.github/actions/setup-build-env (#​13950)
• chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 (#​13948)
• chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 in /hack/controller-gen (#​13944)
• chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#​13942)
• chore(deps): bump github/codeql-action from 3.29.11 to 3.30.0 (#​13938)
• chore(deps): bump kyverno/action-install-chainsaw from 0.2.12 to 0.2.13 in /.github/actions/run-tests (#​13917)
• chore(deps): bump github.com/google/cel-go from 0.26.0 to 0.26.1 (#​13914)
• chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 (#​13911)
• chore(deps): bump kyverno/action-install-chainsaw from 0.2.12 to 0.2.13 (#​13906)
• chore(deps): bump github.com/onsi/gomega from 1.38.0 to 1.38.2 (#​13900)
• chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 (#​13892)
• chore(deps): bump github/codeql-action from 3.29.9 to 3.29.11 (#​13884)
• chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 (#​13882)
• chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 (#​13881)
• chore(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.8 (#​13880)
• chore(deps): bump azure/setup-helm from 4.3.0 to 4.3.1 (#​13870)
• chore(deps): bump azure/setup-helm from 4.3.0 to 4.3.1 in /.github/actions/run-tests (#​13869)
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.1.32 to 1.2.0 (#​13863)
• chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 (#​13844)
• chore(deps): bump the kubernetes group across 3 directories with 7 updates (#​13839)
• chore(deps): bump ubuntu from a08e551 to 7c06e91 in /.devcontainer (#​13833)
• chore(deps): bump github/codeql-action from 3.29.8 to 3.29.9 (#​13832)
• chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 in /.github/actions/run-tests (#​13828)
• chore(deps): bump sigs.k8s.io/release-utils from 0.12.0 to 0.12.1 (#​13815)
• chore(deps): bump github/codeql-action from 3.29.7 to 3.29.8 (#​13814)
• chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.41.0 (#​13787)
• chore(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.7 (#​13786)
• chore(deps): bump docker/login-action from 3.4.0 to 3.5.0 (#​13753)
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.1.31 to 1.1.32 (#​13742)
• chore(deps): bump github.com/prometheus/client_golang from 1.22.0 to 1.23.0 (#​13727)
• chore(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#​13713)
• chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login from 0.9.1 to 0.10.1 (#​13706)
• chore(deps): bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0 (#​13686)
• chore(deps): bump sigs.k8s.io/kustomize/api from 0.20.0 to 0.20.1 (#​13669)
• chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.20.0 to 0.20.1 (#​13668)
• chore(deps): bump github/codeql-action from 3.29.3 to 3.29.4 (#​13667)
• chore(deps): bump github.com/onsi/gomega from 1.37.0 to 1.38.0 (#​13659)
• chore(deps): bump google.golang.org/grpc from 1.74.0 to 1.74.2 (#​13658)
• chore(deps): bump go.opentelemetry.io/otel/exporters/prometheus from 0.59.0 to 0.59.1 in the otel group across 1 directory (#​13649)
• chore(deps): bump github/codeql-action from 3.29.2 to 3.29.3 (#​13648)
• chore(deps): bump ubuntu from c4570d2 to a08e551 in /.devcontainer (#​13638)
• chore(deps): bump sigstore/cosign-installer from 3.9.1 to 3.9.2 in /.github/actions/run-tests (#​13616)
• chore(deps): bump sigs.k8s.io/release-utils from 0.11.1 to 0.12.0 (#​13613)
• chore(deps): bump google.golang.org/grpc from 1.73.0 to 1.74.0 (#​13597)
• chore(deps): bump the kubernetes group across 3 directories with 7 updates (#​13596)
• chore(deps): bump ubuntu from e356c06 to c4570d2 in /.devcontainer (#​13595)
• chore(deps): bump ubuntu from 440dcf6 to e356c06 in /.devcontainer (#​13590)
• chore(deps): bump github.com/google/cel-go from 0.23.2 to 0.26.0 (#​13579)
• chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0 (#​13551)
• chore(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 (#​13542)
• chore(deps): bump fluxcd/flux2 from 2.6.3 to 2.6.4 (#​13540)
• chore(deps): bump aquasecurity/trivy-action from 0.31.0 to 0.32.0 (#​13527)
• chore(deps): bump ubuntu from 89ef6e4 to 440dcf6 in /.devcontainer (#​13516)

New Contributors

• @​Jineshbansal made their first contributihttps://github.com/kyverno/kyverno/pull/13749/13749
• @​ivankatliarchuk made their first contributihttps://github.com/kyverno/kyverno/pull/13640/13640
• @​vibecoder1234 made their first contributihttps://github.com/kyverno/kyverno/pull/13729/13729
• @​nemethloci made their first contributihttps://github.com/kyverno/kyverno/pull/12039/12039
• @​Divendra2006 made their first contributihttps://github.com/kyverno/kyverno/pull/13756/13756
• @​sslavic made their first contributihttps://github.com/kyverno/kyverno/pull/12373/12373
• @​Shreesh-Gawande made their first contributihttps://github.com/kyverno/kyverno/pull/13866/13866
• @​alexrygalov made their first contributihttps://github.com/kyverno/kyverno/pull/13893/13893
• @​florianl made their first contributihttps://github.com/kyverno/kyverno/pull/13994/13994
• @​erpel made their first contributihttps://github.com/kyverno/kyverno/pull/13966/13966
• @​abuechler made their first contributihttps://github.com/kyverno/kyverno/pull/14033/14033
• @​maheshcodes12 made their first contributihttps://github.com/kyverno/kyverno/pull/13767/13767
• @​Cellebyte made their first contributihttps://github.com/kyverno/kyverno/pull/13714/13714

Full Changelog: kyverno/kyverno@v1.15.2...v1.16.0

v1.15.3

Compare Source

What's Changed

• Correct minor typo (Cherry-pick #​14033) by @​fjogeleit in #​14035
• add check for namespace (Cherry-pick #​14109) by @​kyverno-bot in #​14114
• fix(chart): correct background-controller automountServiceAccount logic (Cherry-pick #​13878) by @​kyverno-bot in #​14104
• Backport label exclusion to 1.15 by @​aerosouund in #​14178
• fix(controllers): stop status-driven hot-loops (cherry pick #​14096) by @​fjogeleit in #​14095
• fix: Update go version to fix stdlib CVEs by @​lucchmielowski in #​14301
• feat(engine): add context size limit by @​realshuting in #​14846
• fix: prevent cross-namespace access in apiCall by @​realshuting in #​14845
• Release v1.15.3-rc.1 by @​realshuting in #​14873
• Release v1.15.3 by @​realshuting in #​14880

Full Changelog: kyverno/kyverno@v1.15.2...v1.15.3

v1.15.2

Compare Source

🐛 Fixed 🐛

• Fixed CLI apply command return code regardless of output format (#​12629)
• Fixed resource name matching for edge case when name is auto-generated (#​13584)
• Fixed namespace termination logging (#​13866)
• Updated conditional logic to correct reportsServer value reference (#​13893)
• Fixed background scan reporting to consume resourceFilter for new policy types (#​13919)
• Fixed issue to evaluate userInfo for VAPs and MAPs in the CLI (#​13920)
• Shortened helm hook names (#​13966)
• Fixed issue to block mutating policies upon compilation errors (#​13972)
• Fixed namespace selector matching for PolicyException (#​13975)

Helm

• Split openreports CRD installation from controller flag enabling in the helm chart (#​13924)
• Fixed repository customization for helm hooks (#​13933)
• Removed warnings related to VAPs in the chart (#​13990)

🔧 Others 🔧

• Used pointer in validate (assert field) (#​12373)
• Added unit test for pkg/background/dynamic_watcher.go (#​13800)
• Added tests for VAPs that match subresource (#​13947)
• Fixed chainsaw tests (#​13992, #​13976, #​13923)
• Used namespace lister in background controller (#​14002)

Full Changelog: kyverno/kyverno@v1.15.1...v1.15.2

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.