1. Docs
  2. Changes and releases

kyverno-app release v0.26.0

Security kyverno-app v0.26.0

Added

  • Allow in-cluster ingress to the Policy Reporter MCP server’s port (policy-reporter.mcp.port, default 9090) in the allow-kyverno-policy-reporter-talk-to-apiserver CiliumNetworkPolicy when policy-reporter.mcp.enabled is true, so muster and teleport-kube-agent can reach it.
  • Added ciliumNetworkPolicy.imageVerificationEgress, enabled by default, which allows the Kyverno admission and reports controllers to reach the Giant Swarm container registry and Sigstore for image signature verification. Customers can add their own registries to the fqdns list.

Changed

  • set size limits for emptyDir volumes
  • Updated policy-reporter to upstream version v3.11.2.
  • Updated kyverno to upstream version v1.19.2.
  • Raise policy-reporter-ui memory limit to 64Mi to stop OOM kills at startup.
  • Cap the policy-reporter-ui and kyverno-plugin VPAs at 64Mi memory.

Fixed

  • Point the policy-reporter-ui and kyverno-plugin VPAs at their actual Deployments.