v1.12.6

🐛 Fixed 🐛

• Change: Disable updaterequest cleanup cronjob (#10678)
• Fix(helm): Remove namespace from RoleBinding/roleRef field (#10685)
• Fix: Properly use useCache field in image verification policies (#10709)
• Fix: Check for the client being nil before applying a mutation (#10726)
• Fix: Resource namespace checks for Kyverno CLI (#10738)
• Fix: Range through all resources to build webhook (#10748)
• Fix: Get namespace labels before creating a policy context (#10773)
• Fix: Wrong evaluation of pod security standard version (#10924)
• Fix: Frequent API GET/UPDATE requests regarding webhooks reconciliation when no policies (#11203, #11225, #11230, #11233)

🔧 Others 🔧

• Fix: Bump docker in release 1.12 (#11088)
• Fix: Updated Go version to v1.22.7 to address CVE-2024-34156 (#11142)
• Chore: Bump chainsaw (#10687)
• Chore: Bump github.com/docker/docker from 26.1.3+incompatible to 26.1.4+incompatible (#10750)

v1.13.0-rc.1

tag v1.13.0-rc.1

v1.12.6-rc.3

tag v1.12.6-rc.3

v1.12.6-rc.2

tag v1.12.6-rc.2

v1.12.6-rc.1

tag v1.12.6-rc.1

v1.13.0-beta.1

This is for internal testing only.

v1.12.5

✨ Added ✨

• Added the circuit breaker for ephemeralreports generated from the admission events which is used to create policy reports (#10499, #10596, #10610, #10613)
• Added the circuit breaker for updaterequests which is used to apply generate and mutate existing rules (#10382)

🐛 Fixed 🐛

• Fixed an issue for generate policies to correctly validate patterns for old and new objects (#10310)
• Fixed a CLI issue to get namespace's labels in the cluster mode (#10348)
• Normalized Global Context event's reason to be inline with other policies (#10395)
• Fixed the ephemeralreports to use generate name to avoid duplicate names (#10491)
• Fixed notary tests (#10579)
• Fixed to delete resources for the cleanup policy (#10582)
• Fixed a log issue to not append cleanup policy names (#10583)
• Fixed CEL policies to be applied to deleted resources (#10611)
• Fixed an Json context issue to delete non-exist old values for foreach rules (#10615)
• Renamed level 1 logs to INFO from DEBUG (#10617)
• Truncated event messages to 1024 chars (#10636)
• Fixed mutatingwebhookconfiguraition configured rules (#10639)

🔧 Others 🔧

• Refactored VAPs registrations (#10014)
• Removed unused parameters (#10330)
• Bumped Chainsaw (#10345)

v1.12.5-rc.2

🐛 Fixed 🐛

• Renamed level 1 logs to INFO from DEBUG (#10617)
• Truncated event messages to 1024 chars (#10636)
• Fixed mutatingwebhookconfiguraition configured rules (#10639)

v1.12.5-rc.1

✨ Added ✨

• Added the circuit breaker for ephemeralreports generated from the admission events which is used to create policy reports (#10499, #10596, #10610, #10613)
• Added the circuit breaker for updaterequests which is used to apply generate and mutate existing rules (#10382)

🐛 Fixed 🐛

• Fixed an issue for generate policies to correctly validate patterns for old and new objects (#10310)
• Fixed a CLI issue to get namespace's labels in the cluster mode (#10348)
• Normalized Global Context event's reason to be inline with other policies (#10395)
• Fixed the ephemeralreports to use generate name to avoid duplicate names (#10491)
• Fixed notary tests (#10579)
• Fixed to delete resources for the cleanup policy (#10582)
• Fixed a log issue to not append cleanup policy names (#10583)
• Fixed CEL policies to be applied to deleted resources (#10611)
• Fixed an Json context issue to delete non-exist old values for foreach rules (#10615)

🔧 Others 🔧

• Refactored VAPs registrations (#10014)
• Removed unused parameters (#10330)
• Bumped Chainsaw (#10345)

v1.12.4

❗Important Notice ❗

If you are running 1.12, please upgrade to this version to pick up the fix for the ephemeralreports piling-up issue. Check this post and understand how to recover from an ETCD outage:

Amazon EKS- managing and fixing ETCD database size

[updated] If you are seeing consistent creation of ephemeralreports, you can:

1. disable reporting for admission events, please see this comment.
2. tune --aggregationWorkers to increase the capacity of consuming ephemeralreports, see this comment. It can be configured directly via the container flag, or through Helm extraArgs.
3. as a user of Argo CD, check whether something is causing continuous reconcile operations.

You can also find the script to delete a large number of reports here, thanks to @andrew-bulford-form3.

🐛 Fixed 🐛

• Added condition checking to notary attestation verify chainsaw test (#10288)
• Fixed a CLI issue to apply namespace labels in the cluster mode (#10348)
• Fixed a gloabl context look up issue to return the error properly (#10398)
• Fixed logging verbosity got the background scanner (#10404)
• Shutdown the controller properly when the context is canceled (#10415)
• Fixed duplicate updaterequest creation for background policies (#10431)

🔧 Others 🔧

• Bumped chainsaw (#10345)
• Added chainsaw test for controllers leader election (#10416)