Security
Added
- Adds
VerticalPodAutoscaler for kyverno-plugin deployment.
Changed
VericalPodAutoscaler can now be enabled for individual components.- Removes GiantSwarm specific labels from
monitoring ServiceMonitors. - Update
kyverno-policy-reporter to upstream version 2.14.0 / chart version 2.18.0.
Added
- Chart: Add
CiliumNetworkPolicy. (#301)
Changed
- Push to
kvm and capz app collections.
Changed
- Don’t push to
openstack-app-collection. - Rename
vmware-app-collection to vsphere-app-collection. - Consider PolicyExceptions from all namespaces.
Added
- Added Kyverno
PolicyExceptions for necessary capabilities normally prohibited by PSS policies.
Changed
- Update
kyverno to upstream version 1.9.2 / chart version 2.7.2.
Added
- Add
node-role.kubernetes.io/control-plane key to list of tolerations
Fixed
- The VPA for
external-secrets erroneously picks up the kubectl pod created by the CRD installer job and changes the resource requirements for it potentially causing OOM kill for it
Added
- Added the use of the runtime/default seccomp profile.
Fixed
- Prevented deletion of Organization CR until the organization namespace is deleted successfully