#9903 fix(globalcontext): panics and validation #9893 fix: properly update policy context after preexisting resource in violation check #9849 fix: release CRDs manifests #9845 fix: add missing unit tests for podSecurity.hostpathVolume check #9838 fix: use gcr crane opts while fetching image descriptors #9835 fix: remove duplicate chainsaw tests for PSA #9828 [Bug] [CLI] Restore warn-exit-code functionality for apply command #9817 fix: add podSecurity validation checks for exceptions #9813 fix(globalcontext): old WaitGroup not stopping #9791 fix: remove unnecessary podSecurity chainsaw test #9790 fix: remove unnecessary validation check for podSecurity rule #9783 update versions #9781 chore: add tests for exceptions in the CLI #9775 chore: default logging format to rfc3339 #9770 fix: add validation check for podSecurity subrule #9763 chore: bump chainsaw #9759 feat: support bindings in Kyvenro CLI test command #9751 feat: apply VAP bindings in CLI apply command in offline mode #9749 add plural form aliases for resources and exceptions flags #9719 fix: Policies skipped because of preconditions not met should not be included in admission requests denial responses #9714 fix: add the support of v2alpha1 exceptions in the CLI #9713 Fix :variables are not getting processed in validation message for "anyPattern" #9710 feat: enhance global context #9709 chore: bump otel deps #9698 fix: remove deprecated imageSignatureRepository flag #9697 fix: reports aggregation #9691 fix: modify the conformance config name #9690 chore: rename admission to ephemeral in reports aggregation controller #9682 chore(deps): bump kyverno/action-install-chainsaw from 0.1.2 to 0.1.3 #9680 chore: bump kind and k8s images #9679 fix: don't delete garbage collected policy reports #9678 feat(validation-webhook): validate global context reference #9677 feat: remove admission report controller #9672 feat: add chainsaw tests for exceptions #9667 feat: add chainsaw tests for pod security in exceptions #9661 test(globalcontext): add e2e tests #9658 [Bug] Fix message and formatting of podSecurity validation failure with restrictedField #9657 fix: add missing migrations #9652 chore(globalcontext): remove global context flag #9651 feat: add scan command for generic resources #9645 feat: add chainsaw test for policy webhook based configuration #9643 fix: global context validation #9639 feat: add root command to process generic json resources #9630 chore: remove renovate config #9628 feat: add chainsaw tests for global context crd validation #9626 changed the log level in match policy context #9624 support -e shorthand letter with --exception flag #9621 fix: global context crd improvements #9620 feat: consider maxAPICallResponseLength #9619 feat: add global context entry validation webhook #9618 chore: move global context package out of engine #9616 feat: use the check block for checking CLI output in chainsaw tests #9615 feat: update refreshInterval in globalcontext CRD to use a duration #9614 feat: add global context support in helm chart #9609 make exception in cli exportable #9608 sanity check in parent chart for crd-controller mismatch #9606 chore: enable chainsaw fail fast #9602 feat: add globalcontext loader and interface #9601 feat: add globalcontext controller #9600 chore(deps): bump github.com/sigstore/cosign/v2 from 2.2.2 to 2.2.3 #9599 feat: apply .matchConditions when generating reports #9598 fix: client codegen not deleting old files #9597 fix: codecov missing token #9596 fix: make ApplyCommandConfig public again #9595 feat: add global context crd to codegen #9592 fix: codecov args #9591 feat: add global context crd #9585 fix: update cli docs #9583 test: added test for pkg/utils/policy/marshal.go #9579 feat (generate): add orphanDownstreamOnPolicyDelete to preserve downstream on policy deletion #9574 fix: nancy ignore #9573 chore: small nits in cli test command #9572 fix: omit events flag #9570 chore: remove reports aggregation per namespace #9569 configured backoff limit in chart cronjobs #9566 feat: Support CEL expression warnings #9561 chore: add chainsaw tests for policy based webhook configuration #9555 fix: helm chart jobs #9554 fix: nancy ignore #9553 fix: make alternate reports storage transparent #9552 Add Helm note for AKS users #9546 feat: add openapi-gen to policyreports #9543 fix: follow up for #9534 #9542 fix: CRDs codegen #9540 chore: bump a couple of deps #9539 chore: remove reference to kuttl #9538 test: added test for pkg/utils/admission/metadata.go #9537 refactor: use single type for ephemeral reports #9535 chore: configure gh workflows schemas #9534 fix: show skip when foreach with zero elements #9533 Fix: not showing error during policy validation error #9531 fix: move new reports api to top level folder #9530 #9529 Support adding extra elements to the default resourceFilters list #9525 Support PolicyExceptions with CLI #9521 feat: add a new API group reports.kyverno.io #9520 test: added test for pkg/utils/admission/policy.go #9516 Move admission controller hardcoded wildcard permissions to new opt-out value #9515 ci: add load testing workflow #9509 fix: reduce logs in controllers when an item is not found #9507 feat: add more granular rbac rules to remove wildcards #9506 feat: support vap bindings in reports #9495 test: added test for pkg/utils/admission/exception.go #9493 chore(helm): omit normal events by default #9492 fix: kyverno apply panic for mutate policies #9487 chore: bump a couple of deps #9486 test: added test for pkg/utils/admission/cleanup.go #9483 feat: configure admission webhooks per policy #9482 fix: align clusterroles and bindings names #9481 feat: improve crd migration helm hooks #9476 feat: support all valid jsonpatches in validation webhook #9469 chore(contrib): add Khaled Emara as contributor #9468 feat: support validatingadmissionpolicybindings in CLI apply command #9467 update README for new features and OSS security index card #9465 chore: load cli image when deploying locally #9464 Update DEVELOPMENT.md #9463 fix: change generic policy to not return any #9461 Update CONTRIBUTORS.md #9459 added tests for validate foreach with 0 elements #9442 chore: bump otel deps #9440 chore: bump a couple of deps #9433 chore: use upstream cosign on main #9428 fix: nancy ignore list #9427 chore: bump json-patch #9426 chore: bump a couple of deps #9420 feat: migrate existing cleanup policies to the new storage version in helm hook #9416 feat: use awslabs keychain for AWS and gcr keychain for GCP #9412 feat: migrate existing policy exceptions to the new storage version in helm hook #9408 chore: bump bitnami/kubectl #9395 [Feature] Security Improvements based on CLOMonitor Checks #9392 fix: use the correct API version for VAPs in the generated events #9391 feat: add podLabels to the hook jobs pod template #9389 fix PSA chainsaw tests #9386 feat: skip generating VAP when an exception is defined #9385 fix: Allow generate cli tests to work with server-side apply policies #9380 feat: use assertion trees in cli test command #9362 chore(deps): bump golang.org/x/crypto from 0.17.0 to 0.18.0 #9360 chore(deps): bump github.com/cloudflare/circl from 1.3.6 to 1.3.7 #9355 fix: clean up URs if the trigger doesn't exist #9348 Fix report-on-vulnerabilities #9343 feat: support podSecurity exclusion in exceptions #9341 fix PSA chainsaw tests #9339 Add global nodeSelector #9338 feat: add profiling to the helm Chart #9332 fix a chainsaw test #9331 fix: remove the check of exclude in VAPs #9326 chore(deps): bump kubectl-validate version #9324 feat: use custom events watcher #9323 feat: add new client for events #9296 feat: add resource migration command #9279 fix: remove policy informer from vap controller #9276 Feat: Human readable timestamps in logs #9270 feat: stop serving v2alpha1 cleanup policies #9269 Support setting global extraEnvVars #9267 chore: introduce v2 for updaterequests #9262 chore: introduce v2 for internal reports resources #9261 feat: add cleanup policies v2 #9260 chore: bump a couple of deps #9255 refactor: mutate checks #9254 fix: set v2beta1 of exceptions the storage version #9240 fix: remove unused file in a test #9238 move error message to log #9236 refactor: events controller #9232 Fixed error log #9220 feat: enable kubectl-validate by default in cli #9218 chore: add k8s 1.29 in custom-sigstore test #9213 chore: add missing context unit test #9212 (docs) changed docs tool to kubernetes-sigs/reference-docs #9211 chore: remove v2alpha1 version of policy exceptions #9208 feat: promote policy exceptions to v2 #9200 refactor: make CLI store non static #9198 chore: bump a couple of deps #9192 chore: add cli update test #9191 fix: deep copy resource in cli when operation is update #9189 fix: deprecate spec.schemaValidation #9187 chore: fix conformance tests #9180 Minor fix #9179 chore: use sigstore/cosign 2.2.2 on main #9175 fix: updates make codegen-deepcopy back to make codegen-deepcopy-all flag back to api deep copy function generatio... #9173 feat(jmespath):time_parse() support epoch time #9165 chore: move a mutateExisting chainsaw test under its directory #9163 fix: set logger level #9161 chore: add 1.29 to all test grids and remove 1.25 #9158 chore: add 1.29 to the test grid #9155 fix: validate pattern premature skip #9148 fix: chainsaw test #9144 support for SHA256 jmespath function #9143 chore: use new chainsaw github action #9140 chore: bump chainsaw #9130 chore: add myself to the maintainers list #9125 feat: add myself (vishal-chdhry) to maintainers list #9124 support for Add Variable unit test #9120 chore: bump chainsaw #9114 chore: bump chainsaw #9113 chore: convert chainsaw tests to Test resource #9109 chore: convert chainsaw tests to Test resource #9108 chore: update PR template to require documentation PR #9103 chore: improve cluster startup in conformance tests #9100 chore: convert chainsaw tests to Test resource #9099 chore: convert chainsaw tests to Test resource #9098 chore: improve ci perf #9094 chore: convert chainsaw tests to Test resource #9093 chore: install kind from binaries #9092 chore: remove kuttl from makefile #9088 fix: nancy ignore #9087 chore: convert chainsaw tests to Test resource #9086 chore: improve conformance tests ci perf #9085 fix: conformance tests #9071 chore: bump chainsaw #9066 Fix Helm chart to not error when replicas defined #9064 chore: bump chainsaw #9057 Update helm docs #9052 chore: use Kubernetes 1.28 by default #9046 Use nancy on actually included dependencies #9045 chore: add 1.10.4-6 & 1.11.1 to github issue templates #9041 fix(helm): Rename dashboard.json to kyverno-dashboard.json #9038 chore: bump chainsaw #9036 fix: Provide kind list hints to the fake dynamic client. #9028 chore: fix chainsaw tests cleanup timeout #9023 chore: remove kuttl tests folder #9018 chore: replace more kuttl tests by chainsaw #9017 chore: replace more kuttl tests by chainsaw #9016 chore: replace standard kuttl tests by chainsaw ones #9015 feat: webhook labels #9013 chore: fix chainsaw exec timeout issue #9012 chore: enable all chainsaw tests #9011 chore: all chainsaw tests #9008 fix: extend chainsaw cleanup timeout #8999 chore: cleanup go.mod #8998 chore: bump chainsaw #8997 chore: migrate tests to chainsaw #8987 chore: bump a couple of deps #8985 chore: bump otel libs #8969 Allow defining ca-certificates bundle for Kyverno deployments #8967 chore: bump chainsaw #8966 chore: run force-failure-policy-ignore test using chainsaw #8965 chore: run vap reports test suite using chainsaw #8958 chore: run generate VAP test suite using chainsaw #8956 chore: run range operators tests with chainsaw #8953 fix: update KeysAreMissing() to ignore negations in resource #8952 fix: block mutation only when failurePolicy is set to fail #8951 chore: run events test suite using chainsaw #8950 chore: run rbac testsuite using chainsaw #8947 fix: change names of fuzzing policies #8946 Allow excluding resources from config.resourceFilters #8937 chore: run autogen tests with chainsaw #8932 feat: allow setting admission controller replica count to 2 #8929 chore: bump k8s package to 1.29 #8913 Revert "fix(chart): only create ServiceMonitor if cluster supports it (#7926) #8911 [Helm] correct typo in README for Kyverno 1.10+ #8907 fix: Add chart parameters for setting revisionHistoryLimit #8903 Extended the Trivy scan for N-2 Kyverno versions #8894 Close reponse right after succesful request #8893 chore(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.45.0 to 0.46.0 #8880 fix: allow multiple keys in verifyImages.attestations.attestors.entries #8861 Adopters groww #8857 feat: added ability to bump version using in-file editing #8849 Deploy specific controllers #8827 Add policyKind option to kyverno-policies chart #8780 refactor: move resource loader package to ext #8772 chore: move utils/wildcard in ext #8769 refactor: move resource/convert in ext #8767 feat: add force color in color ext pkg #8766 feat: add utils packages in ext #8762 chore: run tests with chainsaw #8761 chore: fix nancy ignore #8760 feat: add ext/yaml package #8758 chore: init ext packages #8713 feat: compute policy exceptions as a part of the rule execution #8675 feat: add arm64 support in devcontainers #8672 feat: adds ci test for building devcontainer image #8659 feat: re-evaluate policy exceptions for existing resources and modify reports accordingly #8654 Reduce deps #8647 feat: use ubuntu:22.04 in devcontainer #8633 feat: add skipImageReferences in verify images #8624 feat: add fail/warn on deprecated/invalid operators #8614 feat: Add external_url_check custom JMESPath function #8585 [Feature] New restrictedField in podSecurity subrule #8577 feat: support conditions in PolicyException #8567 chore: set cert renewal time to 15 days before expiration #8566 feat: reuse --protectManagedResources flag in the cleanup controller #8544 fix: apply exceptions after executing the policy itself #8518 fix: cache error in gh workflows #8437 Changes to dynamically configure webhooks #8322 optimize JSON context processing using in-memory maps #8311 fix: use ungreedy pattern to process all variables #8299 create interpreter once and reuse across searches #8065 feat: configure webhook scope based on resource and policy type #7728 Make server ports configurable, resolves #7279