Kyverno - v1.10.0

Kyverno 1.10 is a huge release which brings breaking changes in both the application and Helm chart. Please read these release notes carefully!

Major features:

• Split the main Kyverno Deployment into 3 separate controllers/Deployments
• Intra-cluster Service calls
• Notary v2 support
• Major reworking of generate and "mutate existing" policies

NOTE: There is a limited upgrade path available when using the Helm chart, which requires manual intervention and NO upgrade path when using raw YAML manifests. Please see the Helm v2 to v3 migration guide here for full details.

❗ Breaking ❗

• This release separates Kyverno into its 3 main components: admission controller, reporting controller, and background controller. As a result, there is no direct upgrade path from previous versions. When deploying with Helm, we recommend either backing up and restoring Kyverno policies (kubectl get pol,cpol,cleanpol,ccleanpol,polex -A > backup.yaml) or scaling the Kyverno deployment(s) to zero first. Policy reports will be regenerated from existing resources when policies are reinstalled. Regardless of the option, this upgrade should be performed in a maintenance window as there will be downtime involved.
• As a result of this decomposition, aggregated ClusterRoles may need to be updated to use the new label values depending on the controller which requires those permissions.
• Policies which matched on some types of subresources (such as PodExecOptions) will need to be updated to use the standardized form of <parent>/<subresource> (Pod/exec).
• The following fields in a generate rule are now immutable once created: spec.rules.name, spec.rules.match, spec.rules.exclude, spec.rules.preconditions, spec.generate.apiVersion, spec.generate.kind, spec.generate.namespace, spec.generate.name, spec.generate.clone, and spec.generate.cloneList (#6328, #6451)
• Variables in these portions of a generate rule will now be disallowed: clone, cloneList, generate.kind, and generate.apiVersion (#6438)
• Generate and "mutate existing" policies, once installed, will check to see if Kyverno has the necessary permissions to successfully execute them. If not, Kyverno will block their creation until the permissions are available. This is added to bring behavior in alignment with how cleanup policies work and provide a better UX (#6610)
• Properly enforcing that "mutate existing" rules, when mutateExistingOnPolicyUpdate is set to true, also has mutate.targets[] defined or else the policy creation will be blocked (#6693)
• When a verifyImages policy is created in Audit mode, its creation will be rejected unless mutateDigest is set to false (#6757)
• Mutation rules which change the image field in a Pod spec and which relied on docker.io being silently added by Kyverno (when it was not explicitly defined in the image) will need to be adjusted to either use the images.*.registry predefined variable or the new normalize_image() JMESPath filter. To address other discovered issues with mutation, Kyverno can no longer add the default registry to the context. It will only be accessible to internal variables and JMESPath.
• The generate.apiVersion field is now required in a generate rule. Policies/rules without this defined will need to set it. (#7080)

✨ Added ✨

• validationFailureActionOverrides can now use namespaceSelector with expressions like is possible in match/exclude (#4461)
• The default registry Kyverno uses can now be configured in the ConfigMap (#4715)
• Separated the Kyverno Deployment into 3 new Deployments: kyverno-admission-controller, kyverno-reports-controller, and kyverno-background-controller (#5352, #6045, #6050, #6157, #6194)
• Kyverno can now make calls to any Kubernetes Service including specifying the verb (#5755)
• Support for verifying Notary v2 signatures (#6011)
• Operations are now possible to specify in match/exclude blocks without the use of preconditions (#6658)
• Mutate existing rules now support context variables and preconditions (#6754)
• PolicyExceptions now support background mode scanning (#6127)
• PolicyExceptions now support wildcards in the ruleNames field (#6773)
• Added a new --skipResourceFilters flag to the reports controller Deployment, set to true by default, which allows PolicyReports to not be created in background mode for anything in the resourceFilters ConfigMap (#6778)
• Added a new --backgroundServiceAccountName flag to the admission controller Deployment, replacing a ConfigMap key of a similar name, which is used to specify the ServiceAccount name for the background controller (#6790)
• New keys excludeRoles and excludeClusterRoles can be set in the Kyverno ConfigMap which allows global exclusion of Roles/ClusterRoles (#6779)
• Events are created for policies in Audit mode (#6125)
• New trim_prefix() JMESPath filter (#6183)
• New to_boolean() JMESPath filter (#6292)
• New sum() JMESPath filter (augments the existing) which supports summing duration and quantities (#6552)
• New image extractor field is available when using verifyImages rules to define, for Custom Resources, where Kyverno should locate the image for verification (#6183)
• Support for the DELETE operation as a trigger for use in generate and mutate existing rules (#6508, #6197, #6736)
• Support for using subresources as a triggering type (#6760, #6544)
• For a generate rule, when synchronize: true, if the triggering resource is either deleted or changed to no longer match, it will result in the generated resource being removed (#6508)
• Kyverno container images are now built for all supported platforms (#6297)
• Support for YAML manifest signing in GitHub Actions workflows using keyless signing (#6320)
• Role aggregation for the view ClusterRole (#6350)
• SLSA provenance generated for all decomposed controllers (#6384)
• Added a log message whenever a policy is added, updated, or deleted (#6601)
• A new Message column will be printed when showing Kyverno policies which can show details on if a policy is ready and why, if not (#6670)
• Added a --warn-no-pass flag in the CLI to the kyverno apply command (#6678)
• Added a new cleanup metric called cleanup_controller_deletedobjects which counts the number of resources deleted by a cleanup rule (#6338)
• Added a deployment manifest called install-latest-testing.yaml for quick and easy testing of the bleeding-edge code. This is NOT to be used for normal installations! (#6578)
• The Kyverno ConfigMap now has an entry called webhookAnnotations which can be used to add annotations to webhooks for AKS compatibility issues (#6579)
• Added ability to pin podSecurity subrule to version 1.26 (#6762)
• Introduced an engine API package (#6154, #6156, #6162, #6163, #6164, #6177, #6181, #6199, #6205, #6212)
• Introduced an internal engine package (#6241)
• Add response helpers in engine (#6262)
• Add error logs in wait for cache sync helper (#6279)
• Added new fields into the UpdateRequest resource to support changed functionality (#6294)
• New instrumented clients for API extensions and aggregation layer (#6302)
• A new kind selector is used which supports GVK and subresource (#6514)
• New container flag --enableConfigMapCaching to enable/disable the ConfigMap caching feature. (#6837)
• Begin testing against Kubernetes 1.27 (#6872)
• Added a new JMESPath filter image_normalize() which can be used to show the fully normalized image string which includes things like default registry (configurable in the Kyverno ConfigMap) and latest tag when no tag is defined. (#6911)
• The apiCall context variable, exclusively used for Kubernetes API communication, now can perform POST operations similar to the new apiCall.service (external) call. When using this new method, it is not necessary to specify a CA certificate for trust. (#6948)
• New Policy Report cleanup jobs are added as a safeguard to remove excessive intermediate reports (not final Policy Reports) in case reconciliation doesn't happen fast enough. In almost all cases, these jobs are expected to do nothing. (#6960)
• Added a new flag --registryCredentialHelpers with image registry specific credential helpers. This flag is passed by default. (#6974, #7002)
• Added a new --omit-events flag which allows defining which type of Kyverno events should not be emitted. (#7010)
• Context variables are now lazy loaded (just in time) which prevents failures of some policies. Context variables will now only be evaluated when they are needed in a policy and not all at once in the very beginning. (#7071)
• Added a new ConfigMap key called excludeUsernames which is used to exclude certain requests with these usernames from processing. The value also supports a negation operator (!) which allows inclusion of a username in cases where it might have been excluded in a different setting elsewhere. (#7082)
• Significant changes with how mutations work (#7095):
• Added a new foreach.order field to control how patches are applied internally, either Ascending or Descending.
• Instead of Kyverno patching the "final" version of the resource after every patch, it will only do so internally. All patches will be summarized and combined at the end.
• When using multiple foreach loops, they will be evaluated from top down so the result of one loop will only be available to the next after the first loop completes. They will no longer iterate independently over the same input.
• Rules which need mutations over the result of prior mutations should be separated into separate rules.
• Kyverno will now ensure that generate rules are written appropriately for namespaced and cluster-scoped resources to prevent bad policies from being accepted. (#7098)
• Conditions expressions now have an optional new field message which will be shown if that particular expression fails. Anywhere conditions are used (ex., verifyImages or validate) will have access to this field. (#7113, #7126)

Helm

• Added test for reports controller (#6081)
• Added tests for cleanup controller (#6085)
• Added names and securityContext helpers (#6136)
• Installation of the chart now displays the components selected for install (#6153)
• Enforce that the admission controller must be deployed with at least one replica (#6213)
• Added annotation support to all ServiceAccounts deployed by the chart (#6585)
• Added custom label support back to chart (#6597)
• Linting the chart for Artifact Hub (#6758)
• Added a new features section in the v3 Helm chart as an easier abstraction for feature enablement. Doesn't require knowing which controllers need which flags. (#6935)
• Split out chart values per component. (#6936)
• Added a logging.verbosity flag in the chart to control logging verbosity without the need for an extraArg. (#6940)
• Added a new upgrade.fromV2 flag in the Helm chart which is REQUIRED when upgrading from v2 of the chart. Please read the Helm migration guide for very important details on migrating from v2 to v3. (#7066, #7144)
• Added the new omit-events flag to the features section making it easier to set and not worry about which controllers need that flag. (#7185)
• Add a logging section to the features section making it easier to configure verbosity levels across all controllers without having to set the flag individually. (#7181)
• Added ability to assign labels and annotations to all controllers (#7312)

⚠️ Changed ⚠️

• For "generate existing" policies, the field spec.generateExistingOnPolicyUpdate has been deprecated in favor of spec.generateExisting. Please update your policies to use spec.generateExisting (#6321, #6655, #7324)
• Deletion of a clone source, in a generate rule, with synchronization enabled will now result in deletion of the downstream resource (#6322, issue #6266)
• Getting the "classic" behavior in a generate rule with a data type whereby changes to the rule are propagated to downstream resources (sync enabled) no longer requires setting spec.generateExistingOnPolicyUpdate. This change effectively restores the same behavior to how it was up until Kyverno 1.7 (#6322, issue #4222)
• Creation of a new generate existing rule within a policy now correctly triggers that behavior (#6472)
• Leader election is enabled for the background controller (generate and mutate existing rules) (#6237)
• Images which no longer match a verifyImages rule will no longer produce Skip results in a PolicyReport (#6733)
• Standard operators have enhanced support for duration (#5958)
• Burst limit (--clientRateLimitBurst) has its defaults increased from 50 to 300 and QPS (--clientRateLimitQPS) from 20 to 300 which should fix issues in very large clusters with admission reports not getting aggregated quickly enough to the final Policy Report (#6522)
• Report controller workers have been increased from 2 to 10 which, along with the burst and QPS increases listed above, should help reconcile reports much faster (#6522)
• Refactored how AdmissionReports are aggregated to improve performance and fix issues (#6568)
• AdmissionReview requests created as a result of Kyverno's own behavior in generate or mutate existing rules will now be ignored but configurable through a new excludeBackgroundUsernames key in the ConfigMap (#6499)
• Updated the ConfigMap resourceFilters with all the new and changed names as of this release (#6765)
• Changed matching syntax when it comes to subresources. A subresource must be specified in context of its parent (#6625)
• Policies matching on subresources are now properly rejected if background scanning is enabled (#6571)
• Controllers will quit when losing leader election (#6718)
• Policy readiness is now reflected as a condition in the .status object and the .status.ready field is deprecated (#6071)
• Changed the way anchor logic with matching is done (#6133)
• The items() JMESPath filter now supports arrays in addition to maps as the input. When an array is used, the output will contain the index number (#6180)
• The install.yaml manifest has been removed from the main branch. It is now an official release artifact for every release (#6217)
• Kyverno will use client instead of discovery for sanity checks which helps in some cases when finding CRDs (#6296)
• Image references in the JSON context are not mutated to canonical form anymore (#6397)
• Enhance the events created by PolicyExceptions to add kind and Namespace making them more consistent with other events (#6459)
• Webhook configuration has been changed to better support wildcard policies (#6534)
• Go bumped to 1.20 (#6683)
• Refactoring of the match package (#5961)
• Removed the GenerateRequest CRD since Kyverno uses a unified UpdateRequest CRD (#6043)
• Event package refactoring (#6124)
• Reduced dependency from engine to CLI (#6134)
• Renamed initContainer to kyverno-init (#6139)
• Removed PolicySpec from engine API (#6159)
• Merge engine common and utils package (#6160)
• Removed dependency on github.com/pkg/errors (#6165)
• Move client out of policy context (#6233)
• Moved engine functions to methods (#6235)
• Minor logging enhancements (#5929)
• Use more engine internals (#6247)
• Refactor of context loading and engine methods (#6253)
• Remove store dependency in engine pkg (#6260)
• Improve engine logger management (#6280)
• Cleanups in the generate controller (#6281)
• Refactor engine matching and filtering logic (#6289)
• Add label keys for generate rules (#6291)
• Refactor original resource tracking in engine response (#6293)
• Exceptions in rule responses will be propagated (#6298)
• Make engine stats standard fields (#6301)
• Removes validationFailureAction from response and take from policy directly (#6304)
• Refactored how users and group exclusions are done (#6357)
• OpenTelemetry upgraded to 0.39 (#6383)
• Refactored some userinfo dependencies (#6524)
• As part of the massive work done on the background controller (responsible for generate and "mutate existing" rules), we removed a bunch of stale code and trimmed down the permissions needed (#6598)
• Refactored more matching (#6633)
• Return structs instead of pointer in engine API (#6647)
• Removed more pointers from engine API (#6651)
• Refactored discovery client (#6652)
• Introduced engine, mutation, image validation, and validation handlers, factorize, (#6680, #6684, #6694, #6695, #6697, #6735)
• Start applying a validation when a policy is created with an invalid webhook timeout value (#6715)
• Add preconditions check to engine invokeHandler (#6721)
• Remove rules pointer (#6722)
• Introduced a PSS validation handler (#6724)
• Refactored engine responses (#6738)
• Changed context and precondition handling in invokeHandler (#6751)
• Removed admission request/response pointers (#6769, #6774)
• Resolve Roles/ClusterRoles earlier in the admission chain (#6775)
• The resourceFilters now supports subresources and the ConfigMap is updated to include some (#6780)
• Refactored engine rule response creation (#6784)
• Removed hard-coded defaults for excluded groups and excluded usernames. These will always be read from the ConfigMap now in keys excludeGroups and excludeUsernames (#6789)
• Refactored engine execution and response stats (#6796, #6792)
• Simplified engine responses (#6804)
• Optimized and improved config management (#6808)
• Engine response refactoring (#5958)
• Policies will be applied to UPDATE ops now even when the deletionTimestamp is set. (#6878)
• The x509_decode() JMESPath filter now supports decoding of CertificateSigning Requests (#6744)
• Refactored configuration ConfigMap controller. (#6829)
• Refactored engine creation code. (#6837)
• Refactored policy response. (#6877)
• Refactored Namespace labels in engine response. (#6880)
• Introduced a JMESPath interface. (#6882)
• Moved Cosign init code to an internal package. (#6846)
• Moved registry client init to an internal package. (#6853)
• Moved leader election code to an internal package. (#6854)
• Moved clients creation to an internal package. (#6924)
• Bumped Kubernetes dependencies to 1.27 (#6868)
• Tighten up permissions needed by Kyverno. (#6957, #6970, #6972)
• Improved instrumented clients by adding an UpstreamInterface that is an alias to the bare upstream interface. (#7006)
• Updated the internal Kubernetes resource schemas which will prevent some calls to deprecated/removed APIs. (#7014)
• Standardize on use of github.com/evanphx/json-patch/v5 for JSON patches. (#7015)
• Refactor of engine patchers. (#7030)
• Refactor of the engine response policy. (#7063)
• Remove the deletionTimestamp check in rules handled by the background controller. (#7039)
• All controllers' containers will print their container flags and values at the default log level upon startup. (#7127)
• Removed the --genWorker flag from the admission controller as this is only applicable to the background controller. (#7132)
• Changed the wording of the log message in the background controller when periodic reconciliation fires so it's not confused with the reporting controller's background scan ability. (#7142)
• Improved readability of a returned message in a verifyImages rule by addition of single quotes. (#7259)
• Variables used in conditions (preconditions, deny conditions, verifyImages conditions, etc) will now only be evaluated just in time (lazy) rather than up front which either prevented some types of policies from being written or made them more complex. (#7238)
• Changed the name of the metrics from the cleanup controller to be prefixed with kyverno_ like they should have been from the beginning. (#7198)

Helm

• Changed webhooksCleanup key from enable to enabled for consistency (#5837)
• Refactored the way ConfigMap is managed (#6064)
• The namespace field is renamed to namespaceOverride (#6065)
• Changed how CRDs are managed (#6067)
• Moved the imagepullsecret to a different folder (#6069)
• Refactored Helm labels (#6073)
• Refactored Helm tests (#6074)
• Refactored Helm templating management (#6076)
• Refactored Helm RBAC components with respect to role aggregation and config (#6096, #6582)
• Refactored logging, tracing, and metering configs (#6613)
• Make the Grafana ConfigMap name configurable (#6110)
• Refactored admission controller component (#6119, #6130)
• Use image registry in Helm values (#6138)
• Make the Sigstore (TUF root) volume configurable (#6211)
• Changed title of Grafana dashboard (#6236)
• Changed name of Kyverno Deployment after decomposition to kyverno-admission-controller (#6356)
• Refactored admission controller replicas (#6453)
• Refactored admission controller config (#6454, #6457, #6460, #6473, #6474, #6501, #6504)
• Refactored config (#6596)
• Refactored NetworkPolicies (#6599)
• Changed reports controller --clientRateLimitBurst flag to a value of 300 making consistent with other changes (#6541)
• Changed extraArgs to be objects rather than arrays making them easier to override individually (#6588)
• Allow overriding of the PodDisruptionBudget API version (#6708)
• Changed the chart to not kyverno.fullname over use .Release.name (#7303)

🐛 Fixed 🐛

• Fixed an issue with the new Secret type in Kyverno 1.9.0. Now, older self-managed Secrets will be deleted and recreated with the new TLS type (#6368)
• Fixed removal of generated resource when the generate rule itself was deleted with sync enabled (#6393)
• Fixed numerous issues with UpdateRequests as part of massive refactoring (#6393, #6676)
• Fixed an issue with a generate rule using a clone whereby synchronization would only happen if the source existed before the rule was created (#6439)
• Fixed an issue with a namespaced Policy generate existing rule getting triggered by matching resources in different namespaces (#6530)
• Fixed cascading mutations when one rule uses a foreach statement (#6411)
• Fixed an issue in mutate existing rules which resulted in schema validation happening on the wrong resource (#6602)
• Fixed issue with the range operator (#5962)
• Fixed an issue with events not being created for podSecurity subrule policies in Audit mode (#6083)
• Fixed ConfigMap context lookups so they can use other portions of a ConfigMap (#6120)
• Fixed an issue with namespaceSelector when used in generate or mutate existing rules (#6188)
• Fixed an issue with the items() JMESPath filter (#6196)
• Fixed an issue where excluding user names in the ConfigMap wasn't working (#6204)
• Fixed an issue with namespaceSelector for rules in Audit mode (#6216)
• Fixed an issue resulting in mutations firing when incorrectly matched (#6242)
• Fixed how Role matching is done (#6358)
• Policies in Audit mode are processed correctly when admission reports are disabled (#6531)
• Fixed an issue where PolicyExceptions didn't apply to manifest validation subrule policies (#6704)
• Fixed some issues with parsing of the image field in Pods in cases where the tag is incorrect, the image is not present, or the image is unset (#6706, #6707, #6767)
• Fixed an issue with the name of the image not being shown in an event created as a result of a blocked Pod from a verifyImages rule (#6734)
• Fixed an issue with wildcard policies which prevented TokenRequests from being created (#6766)
• Fixed an issue preventing failing resources in background mode from being reflected in the kyverno_policy_results_total metric (#6781)
• Fixed duplicate messages in a policy report message field when using a podSecurity subrule (#6634)
• Shutdown gracefulness has been improved (#5107)
• Fixed an issue where even setting --maxQueuedEvents=0 still created some events (#5994)
• Fixed comment format (#6042)
• Fixed leader election issues (#6048)
• Fixed distributed tracing length and name (#6117)
• Fixed some error management issues in JMESPath functions (#6239)
• Use apiserver instrumented client (#6303)
• Use labels.Everything() in userinfo clusterroles matching (instead of labels.NewSelector()) (#6351)
• Fixed an issue showing the kyverno_policy_results_total metric with policies in Audit mode (#6363)
• Fixes a logger call where key/value are in the wrong order (#6365)
• Remove dynamic config from match helpers (#6381)
• Fixed a panic when fetching GVK (#6424)
• Fixed an error log (#6429)
• Regexes will now be compiled globally rather than on every call (#6510)
• Fixed looking up GVK from GVR (#6516)
• Fixed looking up GVR from GVK (#6517)
• Fixed policy cache by using GVR instead of kind (#6543)
• Fixed the source of the apiVersion column in an AdmissionReport to not come from an ownerReferences (#6555)
• Fixed to use GVR when loading mutation targets (#6576)
• Map APIResource in FindResources results (#6611)
• Use GVR in reporting controller (#6612)
• Fixed a check for duplicate resources when testing in the CLI (#6630)
• Fixed an incorrect old resource check (#6635)
• Fixed a deletion check (#6640)
• Fixed a check for empty resource when matching (#6644)
• Fixed GVK fallback in policy context (#6648)
• Fixed creation of UpdateRequests in dryrun mode of admission requests (now prevented) (#6649)
• Use FindResources in CLI (#6650)
• Fixed the HasVerifyImages check (#6668)
• Fixed replacing more reflect.DeepEqual calls (#6674)
• Fixed histogram buckets (#6783)
• Added logs in webhook middleware (#6797)
• Fixed an issue in loading the config when the data is nil. (#6818)
• Fixes and improvements with SLSA provenance generation (#6821, #6824, #6825)
• Fixed an issue with the new service call feature to use the correct ServiceAccount token. (#6842)
• Fixed an issue with considering a customized Cosign image signature repository. (#6849)
• Fixed an issue where the clone source was inadvertently deleted when trigger no longer matched. (#6869)
• Fixed the auth check upon creation of generate and mutate existing rules. (#6874)
• Defaults for flags --clientRateLimitQPS and --clientRateLimitBurst are configurable. (#6883)
• Fixed the context in an API call. (#6885)
• Fixed an issue with namespace selectors not working properly in a verifyImages rule. (#6887)
• Fixed a deletion panic when a resource matched a podSecurity subrule. (#6902)
• Removed the --imageSignatureRepository flag from the background controller as it wasn't applicable here. (#6925)
• Fixed an issue with API calls showing up in traces. (#6930)
• Remove /status subresource from policy webhooks as this wasn't needed. (#6939)
• Fixed/reverted a previous check that was preventing JSON patches (mutate) with single quotes from being accepted. JSON patches can be written more simply as YAML rather than in-line JSON. (#6941)
• Fixed an issue matching on ephemeralContainers. (#6963)
• Fixed an issue validating variables in policies which disabled background scanning. (#6978)
• Fixed an issue where autogen would fire in a foreach mutation rule causing an invalid schema policy. (#6996)
• Fixed a missing serverIP parameter in the cert renewer for the cleanup controller. (#6999)
• Fixed when Kyverno reloads its ConfigMap to reduce log noise. (#7007)
• Fixed a loop prevention check in generate rules. (#7026)
• Fixed not showing the background scan interval in the report controller logs. (#7065)
• Fixed removing entries in excludeGroups from matching. (#7083)
• Removed a duplicate entry in the admission controller's ClusterRole for Leases. (#7125)
• Fixed report controller quitting when losing the lead. (#7153)
• Fixed an issue with the podSecurity subrule (validate.podSecurity) in which using the latest version of the PSS caused the Seccomp control to not be evaluated properly. (#7263)
• Fixed an issue when using the container flag --autoUpdateWebhooks=false whereby resources weren't getting blocked if a matching validate policy existed in Enforce mode. (#7261)
• Remove (i.e., include) ServiceAccounts in the kube-system Namespace from the exclusion filter in the ConfigMap. (#7225)
• Fixed a panic in the reports controller. (#7220)
• Fixed an authZ check when evaluating mutate existing rules when the targets were defined with a variable in the namespace field. (#7219)
• Fixed a matching logic issue which resulted in applying a rule when it matched the oldObject state of the resource. (#7218)
• Fixed the output message of a validate rule's message field when blocking a resource. (#7208)
• Fixed when to show the new message field in a condition (expression) in deny conditions. Now it'll be displayed when the condition evaluates to TRUE rather than when it evaluates to FALSE like it will be in other areas of Kyverno rules. (#7204)
• Removed some duplicate code. (#7203)
• Fixed an issue with the kyverno_http_requests metrics having the wrong name and not being registered. (#7197)
• Fixed an issue with evaluating preconditions in mutate existing rules. (#7183)
• Fixed a policy variable validation issue that might arise if a policy was somehow installed when Kyverno didn't run its validation checks. (#7079)
• Bumped some deps to address transient vulns. (#7171, #7172, #7177)
• Removed some insecure TLS ciphers which used 3DES (#7308)

Helm

• Fixed an issue with the test pod (#6061)
• Fixed default values file name (#6066)
• Fixed ability to override service port (#6118)
• Fixed pre-delete hook (#6121)
• Fixed an issue when adding more labels to the serviceMonitor during Helm deployment (#6414)
• Added the missing serviceMonitor for background controller (#6600)
• Fixed missing imagePullSecrets in Helm hooks (#6764)
• Fixed passing of image pull secrets to all the needed controllers. (#6858)
• Fixed an incompatible types error when deploying the chart. (#6905)
• Fixed an issue in templating of metricsRefreshInterval. (#7019)
• Fixed an issue with the registry string in the background controller (#7286)
• Fixed chart app.kubernetes.io/instance label value to use .Release.Name (#7315)