Update Helm release kyverno to v3.8.0

apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: admission-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-admission-controller
     app.kubernetes.io/part-of: kyverno
 aggregationRule:
   clusterRoleSelectors:

apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: admission-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-admission-controller
     app.kubernetes.io/part-of: kyverno
 rules:
   - apiGroups:

apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: background-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-background-controller
     app.kubernetes.io/part-of: kyverno
 aggregationRule:
   clusterRoleSelectors:

apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: background-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-background-controller
     app.kubernetes.io/part-of: kyverno
 rules:
   - apiGroups:

apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: cleanup-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-cleanup-controller
     app.kubernetes.io/part-of: kyverno
 aggregationRule:
   clusterRoleSelectors:

apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: cleanup-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-cleanup-controller
     app.kubernetes.io/part-of: kyverno
 rules:
   - apiGroups:

apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: hooks
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-hooks
     app.kubernetes.io/part-of: kyverno
   annotations:
     helm.sh/hook: post-upgrade

apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: reports-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-reports-controller
     app.kubernetes.io/part-of: kyverno
 aggregationRule:
   clusterRoleSelectors:

apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: reports-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-reports-controller
     app.kubernetes.io/part-of: kyverno
 rules:
   - apiGroups:

apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: admission-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-admission-controller
     app.kubernetes.io/part-of: kyverno
 roleRef:
   apiGroup: rbac.authorization.k8s.io

apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: admission-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-admission-controller
     app.kubernetes.io/part-of: kyverno
 roleRef:
   apiGroup: rbac.authorization.k8s.io

apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: background-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-background-controller
     app.kubernetes.io/part-of: kyverno
 roleRef:
   apiGroup: rbac.authorization.k8s.io

apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: background-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-background-controller
     app.kubernetes.io/part-of: kyverno
 roleRef:
   apiGroup: rbac.authorization.k8s.io

apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: cleanup-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-cleanup-controller
     app.kubernetes.io/part-of: kyverno
 roleRef:
   apiGroup: rbac.authorization.k8s.io

apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: hooks
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-hooks
     app.kubernetes.io/part-of: kyverno
   annotations:
     helm.sh/hook: post-upgrade

apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: reports-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-reports-controller
     app.kubernetes.io/part-of: kyverno
 roleRef:
   apiGroup: rbac.authorization.k8s.io

apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml

@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/component: reports-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-reports-controller
     app.kubernetes.io/part-of: kyverno
 roleRef:
   apiGroup: rbac.authorization.k8s.io

apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml

@@ -9,6 +9,7 @@ metadata:
     app.kubernetes.io/component: admission-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-admission-controller
     app.kubernetes.io/part-of: kyverno
 spec:
   replicas: 3
@@ -29,6 +30,7 @@ spec:
         app.kubernetes.io/component: admission-controller
         app.kubernetes.io/instance: kyverno
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: kyverno-admission-controller
         app.kubernetes.io/part-of: kyverno
     spec:
       nodeSelector:
@@ -51,7 +53,7 @@ spec:
       automountServiceAccountToken: true
       initContainers:
         - name: kyverno-pre
-          image: "reg.kyverno.io/kyverno/kyvernopre:v1.17.1"
+          image: "reg.kyverno.io/kyverno/kyvernopre:v1.18.0"
           imagePullPolicy: IfNotPresent
           args:
             - --loggingFormat=text
@@ -71,7 +73,9 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 65534
             runAsNonRoot: true
+            runAsUser: 65534
             seccompProfile:
               type: RuntimeDefault
           env:
@@ -97,7 +101,7 @@ spec:
               value: kyverno-svc
       containers:
         - name: kyverno
-          image: "reg.kyverno.io/kyverno/kyverno:v1.17.1"
+          image: "reg.kyverno.io/kyverno/kyverno:v1.18.0"
           imagePullPolicy: IfNotPresent
           args:
             - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca
@@ -124,6 +128,7 @@ spec:
             - --generateMutatingAdmissionPolicy=false
             - --dumpPatches=false
             - --maxAPICallResponseLength=2000000
+            - --apiCallTimeout=30s
             - --loggingFormat=text
             - --v=2
             - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped
@@ -145,7 +150,9 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 65534
             runAsNonRoot: true
+            runAsUser: 65534
             seccompProfile:
               type: RuntimeDefault
           ports:
@@ -209,6 +216,17 @@ spec:
           volumeMounts:
             - mountPath: /.sigstore
               name: sigstore
+            - name: apicall-token
+              mountPath: /var/run/secrets/kyverno/apicall
+              readOnly: true
       volumes:
         - name: sigstore
           emptyDir: {}
+        - name: apicall-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  expirationSeconds: 3600
+                  audience: kyverno-svc.kyverno.io

apps/kyverno/manifests/Deployment-kyverno-background-controller.yml

@@ -9,6 +9,7 @@ metadata:
     app.kubernetes.io/component: background-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-background-controller
     app.kubernetes.io/part-of: kyverno
 spec:
   replicas:
@@ -29,6 +30,7 @@ spec:
         app.kubernetes.io/component: background-controller
         app.kubernetes.io/instance: kyverno
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: kyverno-background-controller
         app.kubernetes.io/part-of: kyverno
     spec:
       nodeSelector:
@@ -51,7 +53,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: controller
-          image: "reg.kyverno.io/kyverno/background-controller:v1.17.1"
+          image: "reg.kyverno.io/kyverno/background-controller:v1.18.0"
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9443
@@ -66,8 +68,10 @@ spec:
             - --metricsPort=8000
             - --resyncPeriod=15m
             - --enableConfigMapCaching=true
+            - --controllerRuntimeMetricsAddress=:8080
             - --enableDeferredLoading=true
             - --maxAPICallResponseLength=2000000
+            - --apiCallTimeout=30s
             - --loggingFormat=text
             - --v=2
             - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped
@@ -103,6 +107,21 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 65534
             runAsNonRoot: true
+            runAsUser: 65534
             seccompProfile:
               type: RuntimeDefault
+          volumeMounts:
+            - name: apicall-token
+              mountPath: /var/run/secrets/kyverno/apicall
+              readOnly: true
+      volumes:
+        - name: apicall-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  expirationSeconds: 3600
+                  audience: kyverno-svc.kyverno.io

apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml

@@ -9,6 +9,7 @@ metadata:
     app.kubernetes.io/component: cleanup-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-cleanup-controller
     app.kubernetes.io/part-of: kyverno
 spec:
   replicas:
@@ -29,6 +30,7 @@ spec:
         app.kubernetes.io/component: cleanup-controller
         app.kubernetes.io/instance: kyverno
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: kyverno-cleanup-controller
         app.kubernetes.io/part-of: kyverno
     spec:
       nodeSelector:
@@ -51,7 +53,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: controller
-          image: "reg.kyverno.io/kyverno/cleanup-controller:v1.17.1"
+          image: "reg.kyverno.io/kyverno/cleanup-controller:v1.18.0"
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9443
@@ -73,6 +75,7 @@ spec:
             - --enableDeferredLoading=true
             - --dumpPayload=false
             - --maxAPICallResponseLength=2000000
+            - --apiCallTimeout=30s
             - --loggingFormat=text
             - --v=2
             - --protectManagedResources=false
@@ -111,7 +114,9 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 65534
             runAsNonRoot: true
+            runAsUser: 65534
             seccompProfile:
               type: RuntimeDefault
           startupProbe:
@@ -142,3 +147,16 @@ spec:
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 5
+          volumeMounts:
+            - name: apicall-token
+              mountPath: /var/run/secrets/kyverno/apicall
+              readOnly: true
+      volumes:
+        - name: apicall-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  expirationSeconds: 3600
+                  audience: kyverno-svc.kyverno.io

apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml

@@ -9,6 +9,7 @@ metadata:
     app.kubernetes.io/component: reports-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-reports-controller
     app.kubernetes.io/part-of: kyverno
 spec:
   replicas:
@@ -29,6 +30,7 @@ spec:
         app.kubernetes.io/component: reports-controller
         app.kubernetes.io/instance: kyverno
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: kyverno-reports-controller
         app.kubernetes.io/part-of: kyverno
     spec:
       nodeSelector:
@@ -51,7 +53,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: controller
-          image: "reg.kyverno.io/kyverno/reports-controller:v1.17.1"
+          image: "reg.kyverno.io/kyverno/reports-controller:v1.18.0"
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 9443
@@ -78,6 +80,7 @@ spec:
             - --enableConfigMapCaching=true
             - --enableDeferredLoading=true
             - --maxAPICallResponseLength=2000000
+            - --apiCallTimeout=30s
             - --loggingFormat=text
             - --v=2
             - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped
@@ -117,12 +120,25 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 65534
             runAsNonRoot: true
+            runAsUser: 65534
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
             - mountPath: /.sigstore
               name: sigstore
+            - name: apicall-token
+              mountPath: /var/run/secrets/kyverno/apicall
+              readOnly: true
       volumes:
         - name: sigstore
           emptyDir: {}
+        - name: apicall-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  expirationSeconds: 3600
+                  audience: kyverno-svc.kyverno.io