chore: update kyverno to 3.7.1 (1.17.1)

[CasLubbers]

📌 Summary

🔍 Reviewer Notes

🧹 Checklist

• Code is readable, maintainable, and robust.
• Unit tests added/updated

[svcAPLBot]

Comparison of Helm chart templating output:

@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/kyverno:admission-controller:core
! - two list entries removed:
- - resources:
-   - mutatingwebhookconfigurations
-   - validatingadmissionpolicies
-   - validatingadmissionpolicybindings
-   - validatingwebhookconfigurations
-   apiGroups:
-   - admissionregistration.k8s.io
-   verbs:
-   - create
-   - delete
-   - deletecollection
-   - get
-   - list
-   - patch
-   - update
-   - watch
- - resources:
-   - generatingpolicies
-   - generatingpolicies/status
-   - imagevalidatingpolicies
-   - imagevalidatingpolicies/status
-   - mutatingpolicies
-   - mutatingpolicies/status
-   - validatingpolicies
-   - validatingpolicies/status
-   apiGroups:
-   - policies.kyverno.io
-   verbs:
-   - create
-   - delete
-   - deletecollection
-   - get
-   - list
-   - patch
-   - update
-   - watch
! + two list entries added:
+ - resources:
+   - mutatingadmissionpolicies
+   - mutatingadmissionpolicybindings
+   - mutatingwebhookconfigurations
+   - validatingadmissionpolicies
+   - validatingadmissionpolicybindings
+   - validatingwebhookconfigurations
+   apiGroups:
+   - admissionregistration.k8s.io
+   verbs:
+   - create
+   - delete
+   - deletecollection
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - generatingpolicies
+   - generatingpolicies/status
+   - imagevalidatingpolicies
+   - imagevalidatingpolicies/status
+   - mutatingpolicies
+   - mutatingpolicies/status
+   - namespacedgeneratingpolicies
+   - namespacedgeneratingpolicies/status
+   - namespacedimagevalidatingpolicies
+   - namespacedimagevalidatingpolicies/status
+   - namespacedmutatingpolicies
+   - namespacedmutatingpolicies/status
+   - namespacedvalidatingpolicies
+   - namespacedvalidatingpolicies/status
+   - validatingpolicies
+   - validatingpolicies/status
+   apiGroups:
+   - policies.kyverno.io
+   verbs:
+   - create
+   - delete
+   - deletecollection
+   - get
+   - list
+   - patch
+   - update
+   - watch



@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+   kubernetes.io/os: linux

@@ spec.template.spec.initContainers.kyverno-pre.image @@
! ± value change
- reg.kyverno.io/kyverno/kyvernopre:v1.15.2
+ reg.kyverno.io/kyverno/kyvernopre:v1.17.1

@@ spec.template.spec.containers.kyverno.image @@
! ± value change
- reg.kyverno.io/kyverno/kyverno:v1.15.2
+ reg.kyverno.io/kyverno/kyverno:v1.17.1

@@ spec.template.spec.containers.kyverno.args @@
! + one list entry added:
+ - "--tlsKeyAlgorithm=RSA"







@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/kyverno:background-controller:core
! - one list entry removed:
- - resources:
-   - generatingpolicies
-   - mutatingpolicies
-   - policyexceptions
-   apiGroups:
-   - policies.kyverno.io
-   verbs:
-   - create
-   - delete
-   - deletecollection
-   - get
-   - list
-   - patch
-   - update
-   - watch
! + two list entries added:
+ - resources:
+   - generatingpolicies
+   - mutatingpolicies
+   - namespacedgeneratingpolicies
+   - namespacedmutatingpolicies
+   - policyexceptions
+   apiGroups:
+   - policies.kyverno.io
+   verbs:
+   - create
+   - delete
+   - deletecollection
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - resourceclaims
+   - resourceclaimtemplates
+   apiGroups:
+   - resource.k8s.io
+   verbs:
+   - create
+   - delete
+   - deletecollection
+   - patch
+   - update



@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+   kubernetes.io/os: linux

@@ spec.template.spec.containers.controller.image @@
! ± value change
- reg.kyverno.io/kyverno/background-controller:v1.15.2
+ reg.kyverno.io/kyverno/background-controller:v1.17.1







@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/kyverno:cleanup-controller:core
! - two list entries removed:
- - resources:
-   - deletingpolicies
-   apiGroups:
-   - policies.kyverno.io
-   verbs:
-   - get
-   - list
-   - watch
- - resources:
-   - deletingpolicies/status
-   apiGroups:
-   - policies.kyverno.io
-   verbs:
-   - update
! + two list entries added:
+ - resources:
+   - deletingpolicies
+   - namespaceddeletingpolicies
+   apiGroups:
+   - policies.kyverno.io
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - deletingpolicies/status
+   - namespaceddeletingpolicies/status
+   apiGroups:
+   - policies.kyverno.io
+   verbs:
+   - update



@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+   kubernetes.io/os: linux

@@ spec.template.spec.containers.controller.image @@
! ± value change
- reg.kyverno.io/kyverno/cleanup-controller:v1.15.2
+ reg.kyverno.io/kyverno/cleanup-controller:v1.17.1

@@ spec.template.spec.containers.controller.args @@
! - one list entry removed:
- - "--webhookServerPort=9443"
! + one list entry added:
+ - "--tlsKeyAlgorithm=RSA"


@@ rules @@
! + one list entry added:
+ - resources:
+   - endpointslices
+   apiGroups:
+   - discovery.k8s.io
+   verbs:
+   - list






@@ data.metricsExposure @@
! ± value change
- {"kyverno_admission_requests_total":{"disabledLabelDimensions":["resource_namespace"]},"kyverno_admission_review_duration_seconds":{"disabledLabelDimensions":["resource_namespace"]},"kyverno_cleanup_controller_deletedobjects_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_policy_results_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_policy_rule_info_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]}}
+ {"kyverno_admission_requests_total":{"disabledLabelDimensions":["resource_namespace"]},"kyverno_admission_review_duration_seconds":{"disabledLabelDimensions":["resource_namespace"]},"kyverno_cleanup_controller_deletedobjects_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_generating_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_image_validating_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_mutating_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_policy_results_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_policy_rule_info_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_validating_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]}}


@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/kyverno:migrate-resources
! + one list entry added:
+ - resources:
+   - "*"
+   apiGroups:
+   - policies.kyverno.io
+   verbs:
+   - get
+   - list
+   - update

@@ metadata.annotations @@
# batch/v1/Job/kyverno/kyverno-migrate-resources
! - one map entry removed:
- helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded,hook-failed"

@@ spec.template.spec.containers.kubectl.image @@
# batch/v1/Job/kyverno/kyverno-migrate-resources
! ± value change
- reg.kyverno.io/kyverno/kyverno-cli:v1.15.2
+ reg.kyverno.io/kyverno/kyverno-cli:v1.17.1

@@ spec.template.spec.containers.kubectl.args @@
# batch/v1/Job/kyverno/kyverno-migrate-resources
! + 22 list entries added:
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - "--resource"
+ - deletingpolicies.policies.kyverno.io
+ - generatingpolicies.policies.kyverno.io
+ - imagevalidatingpolicies.policies.kyverno.io
+ - mutatingpolicies.policies.kyverno.io
+ - namespaceddeletingpolicies.policies.kyverno.io
+ - namespacedgeneratingpolicies.policies.kyverno.io
+ - namespacedimagevalidatingpolicies.policies.kyverno.io
+ - namespacedmutatingpolicies.policies.kyverno.io
+ - namespacedvalidatingpolicies.policies.kyverno.io
+ - policyexceptions.policies.kyverno.io
+ - validatingpolicies.policies.kyverno.io


@@ spec.template.spec.containers.kubectl.image @@
! ± value change
- registry.k8s.io/kubectl:v1.32.7
+ registry.k8s.io/kubectl:v1.34.3


@@ spec.template.spec.containers.kubectl.image @@
! ± value change
- registry.k8s.io/kubectl:v1.32.7
+ registry.k8s.io/kubectl:v1.34.3


@@ spec.template.spec.containers.kubectl.image @@
! ± value change
- registry.k8s.io/kubectl:v1.32.7
+ registry.k8s.io/kubectl:v1.34.3






@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/kyverno:reports-controller:core
! - one list entry removed:
- - resources:
-   - generatingpolicies
-   - imagevalidatingpolicies
-   - imagevalidatingpolicies/status
-   - mutatingpolicies
-   - validatingpolicies
-   - validatingpolicies/status
-   apiGroups:
-   - policies.kyverno.io
-   verbs:
-   - create
-   - delete
-   - deletecollection
-   - get
-   - list
-   - patch
-   - update
-   - watch
! + one list entry added:
+ - resources:
+   - generatingpolicies
+   - imagevalidatingpolicies
+   - imagevalidatingpolicies/status
+   - mutatingpolicies
+   - namespacedgeneratingpolicies
+   - namespacedimagevalidatingpolicies
+   - namespacedimagevalidatingpolicies/status
+   - namespacedmutatingpolicies
+   - namespacedvalidatingpolicies
+   - namespacedvalidatingpolicies/status
+   - validatingpolicies
+   - validatingpolicies/status
+   apiGroups:
+   - policies.kyverno.io
+   verbs:
+   - create
+   - delete
+   - deletecollection
+   - get
+   - list
+   - patch
+   - update
+   - watch



@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+   kubernetes.io/os: linux

@@ spec.template.spec.containers.controller.image @@
! ± value change
- reg.kyverno.io/kyverno/reports-controller:v1.15.2
+ reg.kyverno.io/kyverno/reports-controller:v1.17.1






@@ spec.containers.test @@
! - one map entry removed:
- command:
- - /bin/sh
- - "-c"
- - "sleep 20 ; wget -O- -S --no-check-certificate http://kyverno-svc-metrics.kyverno:8000/metrics"
! + one map entry added:
+ args:
+ - check-http
+ - "--service-name=kyverno-svc-metrics"
+ - "--namespace=kyverno"
+ - "--port=8000"
+ - "--path=metrics"

@@ spec.containers.test.image @@
! ± value change
- busybox:1.35
+ ghcr.io/kyverno/readiness-checker:v0.1.0


@@ spec.containers.test @@
! - one map entry removed:
- command:
- - /bin/sh
- - "-c"
- - "sleep 20 ; wget -O- -S --no-check-certificate https://kyverno-cleanup-controller.kyverno:443/health/liveness"
! + one map entry added:
+ args:
+ - check-http
+ - "--service-name=kyverno-cleanup-controller"
+ - "--namespace=kyverno"
+ - "--port=443"
+ - "--path=health/liveness"
+ - "--https"

@@ spec.containers.test.image @@
! ± value change
- busybox:1.35
+ ghcr.io/kyverno/readiness-checker:v0.1.0


@@ spec.containers.test @@
! - one map entry removed:
- command:
- - /bin/sh
- - "-c"
- - "sleep 20 ; wget -O- -S --no-check-certificate http://kyverno-cleanup-controller-metrics.kyverno:8000/metrics"
! + one map entry added:
+ args:
+ - check-http
+ - "--service-name=kyverno-cleanup-controller-metrics"
+ - "--namespace=kyverno"
+ - "--port=8000"
+ - "--path=metrics"

@@ spec.containers.test.image @@
! ± value change
- busybox:1.35
+ ghcr.io/kyverno/readiness-checker:v0.1.0


@@ spec.containers.test @@
! - one map entry removed:
- command:
- - /bin/sh
- - "-c"
- - "sleep 20 ; wget -O- -S --no-check-certificate https://kyverno-cleanup-controller.kyverno:443/health/readiness"
! + one map entry added:
+ args:
+ - check-http
+ - "--service-name=kyverno-cleanup-controller"
+ - "--namespace=kyverno"
+ - "--port=443"
+ - "--path=health/readiness"
+ - "--https"

@@ spec.containers.test.image @@
! ± value change
- busybox:1.35
+ ghcr.io/kyverno/readiness-checker:v0.1.0


@@ spec.containers.test @@
! - one map entry removed:
- command:
- - /bin/sh
- - "-c"
- - "sleep 20 ; wget -O- -S --no-check-certificate http://kyverno-reports-controller-metrics.kyverno:8000/metrics"
! + one map entry added:
+ args:
+ - check-http
+ - "--service-name=kyverno-reports-controller-metrics"
+ - "--namespace=kyverno"
+ - "--port=8000"
+ - "--path=metrics"

@@ spec.containers.test.image @@
! ± value change
- busybox:1.35
+ ghcr.io/kyverno/readiness-checker:v0.1.0


@@ data.core.yaml @@
! ± value change in multiline text (one insert, one deletion)
  adminApps:
  - deps:
    - prometheus
    ingress:
  
  [460 lines unchanged)]
  
    kyverno:
      about: Kyverno is a policy engine designed for Kubernetes. It can validate, mutate,
        and generate configurations using admission controls and background scans. Kyverno
        policies are Kubernetes resources and do not require learning a new language.
-     appVersion: 1.15.2
+     appVersion: 1.17.1
      license: Apache 2.0
      maintainers: Nirmata
      relatedLinks:
      - https://kyverno.io/docs/kyverno-policies/
  
  [253 lines unchanged)]
  
      svc: tekton-dashboard
      type: public
    name: tekton
    ownHost: true