kubescape/helm-charts kubescape-operator-1.42.0

on GitHub

Kubescape is an E2E Kubernetes cluster security platform

What's Changed

• feat: integrate live namespace filtering in Helm by @ANAMASGARD in #975
• feat(storage): add storage.mcp values for the read-only MCP endpoint by @Sarthak-Shreshtha01 in #989
• feat(node-agent): add sandboxSeccomp capability by @AlonLiwsky in #988
• feat(node-agent): sync default rules with kubescape/rulelibrary by @matthyx in #990
• chore(components): SUB-9486 bump storage, node-agent and kubevuln for syft v1.55 by @matthyx in #991
• ci: remove the dead component auto-bump workflow by @matthyx in #992
• feat(networkpolicy): enable NetworkPolicies by default by @matthyx in #993
• feat(apiauth): service-account authentication for the in-cluster APIs by @slashben in #995
• fix(networkpolicy): handle unset proxy IP/port and derive proxy port for egress by @harshitnub077 in #998
• feat(images): add a create-operator-command subcommand to kubescape-ops-tool by @ahauserv in #996
• feat(scheduler): run the scan schedulers on kubescape-ops-tool by @matthyx in #1000
• feat(storage): add opt-in ContainerProfile SQLite backend settings by @matthyx in #1001
• ci: pin the Helm unittest image by @dakshhhhh16 in #1002
• feat: add opt-in gVisor start collection deployment by @dakshhhhh16 in #994
• chore(components): bump images that enforce in-cluster API auth by @slashben in #999
• chore(release): prepare kubescape-operator 1.42.0 by @matthyx in #1005
• kubescape/kubescape@v4.0.17...v4.0.20
  • ci: run the OSPS Baseline scan on push to master and weekly by @khuswant18 in kubescape/kubescape#4425
  • fix(scan): preserve inline YAML document starts by @Somilg11 in kubescape/kubescape#4414
  • feat(config): add cyan keys, white values, and yellow secret masks to config view by @vjkumar2756 in kubescape/kubescape#4406
  • fix(imagescan): keep Azure scans on one authenticated session by @dakshhhhh16 in kubescape/kubescape#4443
  • fix(download): validate and trim identifier whitespace by @KeerthiKumarR in kubescape/kubescape#4432
  • fix(printer): normalize Windows paths in CI outputs by @arnavghai07 in kubescape/kubescape#4439
  • fix(scan): reject posture control and rule flags on image scans by @WKr1shna in kubescape/kubescape#4440
  • fix(scan): stop a timed out scan during setup by @Ady0333 in kubescape/kubescape#4431
  • fix(imagescan): protect GCP sessions during active scans by @priyanshu2838 in kubescape/kubescape#4444
  • fix(update): report up-to-date releases and "dev" builds correctly by @NopeCharon in kubescape/kubescape#4434
  • fix(pss): match local workloads by API group as well as kind by @NopeCharon in kubescape/kubescape#4433
  • fix(predict): protect PSS input manifests from report overwrites by @dakshhhhh16 in kubescape/kubescape#4448
  • fix(scancache): reset dirty flag after Flush writes cache file by @shivv23 in kubescape/kubescape#4428
  • feat(config): colorize config validate overall status and diagnostic checks by @vjkumar2756 in kubescape/kubescape#4437
  • test(fleet): end to end fleet scans against fake clusters [LFX 2026] by @Ady0333 in kubescape/kubescape#4451
  • fix(scan): validate --view flag and reject for image scans by @WKr1shna in kubescape/kubescape#4442
  • fix(mapreconcile): honor definite exclusions before unknown labels by @priyanshu2838 in kubescape/kubescape#4446
  • fix(mcpserver): validate arguments, port range, and transport early by @WKr1shna in kubescape/kubescape#4468
  • feat(opa): add cosign.verify_keyless for keyless-signed images in C-0236 by @Yash121l in kubescape/kubescape#4449
  • fix(config): trim whitespace around keys in config view and delete by @itsnjstyle27 in kubescape/kubescape#4474
  • docs: fix dead links in README, MCP server, getting started and Krew docs by @sarankumar1325 in kubescape/kubescape#4469
  • fix: try all matching image pull secret credentials by @Karman580 in kubescape/kubescape#4452
  • fix(imagescan): protect GCP clients while scans are active by @dakshhhhh16 in kubescape/kubescape#4447
  • test(imagescan): cover failed Azure probes during active scans by @priyanshu2838 in kubescape/kubescape#4445
  • fix(update): honor command output writer, normalize format, and reject extraneous arguments by @WKr1shna in kubescape/kubescape#4471
  • fix(diff): normalize and validate output format and severity threshold by @KeerthiKumarR in kubescape/kubescape#4463
  • test: cover Negligible severity filtering in vulnerability exposure by @pratik-naik003 in kubescape/kubescape#4457
  • fix: apply image scan severity filters by @pratik-naik003 in kubescape/kubescape#4455
  • test: cover deterministic vulnerability finding order by @pratik-naik003 in kubescape/kubescape#4461
  • Fix typos in swagger descriptions, comments and GCP example script by @sarankumar1325 in kubescape/kubescape#4462
  • feat(componentvulns): expose cluster component vulnerabilities as external resources by @Nakshatra480 in kubescape/kubescape#4466
  • test: cover vulnerability finding severity ordering by @pratik-naik003 in kubescape/kubescape#4459
  • fix(predict): locate local PSS findings in their manifest files in SARIF by @NopeCharon in kubescape/kubescape#4465
  • test: cover vulnerability fix availability combinations by @pratik-naik003 in kubescape/kubescape#4478
  • test: cover deterministic skipped workload ordering by @pratik-naik003 in kubescape/kubescape#4480
  • feat(cli): highlight version badges, commit hashes, and update notices by @vjkumar2756 in kubescape/kubescape#4473
  • feat(vap): colorize list-policies table headers, control IDs, and parameter badges by @vjkumar2756 in kubescape/kubescape#4476
  • docs(cli-reference): document missing scan, fix, patch, list and vap … by @adityacosmos24 in kubescape/kubescape#4385
  • fix(imagescan): reject missing Quay security reports by @priyanshu2838 in kubescape/kubescape#4511
  • fix(policy): don't print usage when policy test or init fails by @NopeCharon in kubescape/kubescape#4507
  • fix(scan): normalize output formats and allow case-insensitive formats by @KeerthiKumarR in kubescape/kubescape#4521
  • fix: isolate exception and control input caches by source by @Karman580 in kubescape/kubescape#4489
  • ci: bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.16 by @dependabot[bot] in kubescape/kubescape#4524
  • ci: bump revanite-io/osps-baseline-action from 1.5.3 to 1.5.4 by @dependabot[bot] in kubescape/kubescape#4525
  • fix(scan): reject baseline and compliance threshold flags on image scans by @WKr1shna in kubescape/kubescape#4499
  • test(anonymizer): add unit tests for mapping transformer by @ANAMASGARD in kubescape/kubescape#4508
  • docs(fleet): measure fleet scans of 1, 5 and 10 clusters [LFX 2026] by @Ady0333 in kubescape/kubescape#4487
  • test(cautils): add unit tests for scan-contract provenance helpers by @pratik-naik003 in kubescape/kubescape#4491
  • fix(policy): read JSON fixture inputs in policy test by @NopeCharon in kubescape/kubescape#4506
  • ci: bump github.com/mark3labs/mcp-go from 1.0.0 to 1.4.0 by @dependabot[bot] in kubescape/kubescape#4523
  • fix(mcpserver): propagate labels and annotations in scan_resource_slice by @Rucha0901 in kubescape/kubescape#4497
  • fix(version): reject extraneous arguments and normalize output format by @KeerthiKumarR in kubescape/kubescape#4486
  • ci: bump the kubernetes group with 4 updates by @dependabot[bot] in kubescape/kubescape#4522
  • fix(config): honor command output writer and reject unexpected arguments by @WKr1shna in kubescape/kubescape#4517
  • fix(policy): report the flagged field of scaffolded rules in deletePaths by @NopeCharon in kubescape/kubescape#4505
  • fix(imagescan): report missing GitLab vulnerability connections by @priyanshu2838 in kubescape/kubescape#4512
  • feat(rules): add modify-admission-webhooks-v1 by @ahmedhany-cys in kubescape/kubescape#4509
  • test(fix): add tests for control-selection flags by @Nachiket-Roy in kubescape/kubescape#4484
  • fix(vap): honor command output writer, reject unexpected arguments, and validate non-negative timeout by @WKr1shna in kubescape/kubescape#4483
  • ci: bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in kubescape/kubescape#4526
  • test(getter): add unit tests for default control inputs by @pratik-naik003 in kubescape/kubescape#4495
  • fix(scan): keep the source of a single JSON or Terraform file by @itsnjstyle27 in kubescape/kubescape#4515
  • fix(fix): reject --output-post-renderer without --output-kustomize by @adityacosmos24 in kubescape/kubescape#4504
  • fix(imagescan): invalidate ECR sessions during teardown by @priyanshu2838 in kubescape/kubescape#4513
  • feat(imagescan): add --fail-on-kev and --epss-threshold risk gates by @aryanghai12 in kubescape/kubescape#4453
  • fix(vap): normalize and validate output format in list-policies by @KeerthiKumarR in kubescape/kubescape#4485
  • test(getter): add unit tests for control identifier matching by @pratik-naik003 in kubescape/kubescape#4493
  • Remove unused cliinterfaces package by @shivv23 in kubescape/kubescape#4530
  • fix(list): honor command output writer and reject unexpected arguments by @harshitnub077 in kubescape/kubescape#4529
  • feat(policy): read control inputs from a case's data.json in policy test by @NopeCharon in kubescape/kubescape#4531
  • fix(policy): don't overwrite existing files in policy init without --… by @adityacosmos24 in kubescape/kubescape#4502
  • fix(kustomize): enforce output safety, atomic publication, namespace matching, and value parity by @Nachiket-Roy in kubescape/kubescape#4412
  • fix(prerequisites): reject unexpected positional arguments by @shivansh-gohem in kubescape/kubescape#4536
  • fix(list): normalize policy target aliases, singular forms, and case-insensitivity by @KeerthiKumarR in kubescape/kubescape#4540
  • fix(predict): honor command output writer and normalize format in predict pss by @WKr1shna in kubescape/kubescape#4535
  • fix(scan): reject coverage, degraded-config, controls-config, and baseline-granularity flags on image scans by @WKr1shna in kubescape/kubescape#4539
  • fix(prerequisites): reject extraneous positional arguments and enhance command tests by @KeerthiKumarR in kubescape/kubescape#4537
  • docs: clarify private vulnerability reporting for CRA readiness by @khuswant18 in kubescape/kubescape#4227
  • ci: publish OSPS Baseline results to grc.store (#4094) by @Rucha0901 in kubescape/kubescape#4543
  • fix(scan): validate and normalize output format in validate-contract by @WKr1shna in kubescape/kubescape#4542
  • ci(security-insights): add OSPS Baseline scanner (#4094) by @Rucha0901 in kubescape/kubescape#4544
  • feat(operator-scan): trigger through OperatorCommand CRs by @slashben in kubescape/kubescape#4545
  • fix(scan): require --baseline for baseline flags and validate granularity upfront by @WKr1shna in kubescape/kubescape#4549
  • feat(fix): colorize expected patch preview, resource labels, and unfi… by @vjkumar2756 in kubescape/kubescape#4519
  • fix(operator): reject unexpected arguments in operator scan commands by @harshitnub077 in kubescape/kubescape#4561
  • feat(componentvulns): assess node kernels against distro advisories by @Nakshatra480 in kubescape/kubescape#4552
  • fix(scan): reject namespace, kind, label, incremental, and dry-run flags on image scans by @WKr1shna in kubescape/kubescape#4551
  • ci: bump github.com/open-policy-agent/opa from 1.19.0 to 1.22.0 by @dependabot[bot] in kubescape/kubescape#4527
  • fix(helm): include install-only resources in chart scans by @FayezBast in kubescape/kubescape#4559
  • fix(scan): validate --control-timeout against --scan-timeout and reject posture control flags on image scan by @WKr1shna in kubescape/kubescape#4563
  • fix(patch): standardize positional argument validation with cobra.NoArgs by @Nachiket-Roy in kubescape/kubescape#4553
  • fix(download): reject extraneous positional arguments across policy targets by @Nachiket-Roy in kubescape/kubescape#4555
  • fix(scan): route fleet scan summary output through configurable writer by @Nachiket-Roy in kubescape/kubescape#4554
  • fix(diff): honor command output writer and propagate destination writer by @Nachiket-Roy in kubescape/kubescape#4556
  • feat(printer): add KEV and EPSS to SARIF, JUnit and Prometheus image output by @aryanghai12 in kubescape/kubescape#4520
  • refactor(pathcontainment): extract canonical workspace containment engine and symlink validation by @vjkumar2756 in kubescape/kubescape#4533
  • feat(httphandler): require service-account tokens, authorize with RBAC by @slashben in kubescape/kubescape#4546
  • ci: bump sigs.k8s.io/kustomize/kyaml from 0.21.2 to 0.21.3 by @dependabot[bot] in kubescape/kubescape#4363
  • ci: bump github.com/kubescape/regolibrary/v2 from 2.0.38 to 2.0.39 by @dependabot[bot] in kubescape/kubescape#4565
  • ci: bump github.com/schollz/progressbar/v3 from 3.13.0 to 3.19.1 by @dependabot[bot] in kubescape/kubescape#4567
  • ci: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.71.0 to 0.72.0 by @dependabot[bot] in kubescape/kubescape#4568
  • fix(fix): honor command output writer in cluster fixes and add nil-safety check by @KeerthiKumarR in kubescape/kubescape#4570
  • ci: bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.25.2 by @dependabot[bot] in kubescape/kubescape#4566
  • ci: bump k8s.io/pod-security-admission from 0.37.1 to 0.37.2 in the kubernetes group by @dependabot[bot] in kubescape/kubescape#4564
  • fix(scan): reject conflicting --file-path flag with positional paths in framework and control scans by @Nachiket-Roy in kubescape/kubescape#4571
  • ci: bump mikepenz/action-junit-report from 6.6.1 to 6.6.2 by @dependabot[bot] in kubescape/kubescape#4569
  • fix(download): reject extraneous positional arguments and sanitize output path by @KeerthiKumarR in kubescape/kubescape#4547
  • feat(mcpserver): enforce workspace boundary containment for local IaC scans by @vjkumar2756 in kubescape/kubescape#4558
  • fix: clean up exceptions temp files on rejected REST scans by @Karman580 in kubescape/kubescape#4574
  • fix: prevent resource loss across multiple scan input roots by @Karman580 in kubescape/kubescape#4575
  • fix(mcpserver): collect full vulnerability reports for exposure analysis by @priyanshu2838 in kubescape/kubescape#4579
  • fix(rbac): require an authorized username for group impersonation by @priyanshu2838 in kubescape/kubescape#4578
  • fix(opaprocessor): harden incremental cache correctness by @arnavghai07 in kubescape/kubescape#4580
  • chore(security): declare secret-scanning tooling in security-insights.yml by @matthyx in kubescape/kubescape#4581
  • fix(scan): prepare local inputs and validate stdin for root and security view scans by @harshitnub077 in kubescape/kubescape#4584
  • fix(scan): prevent contract validation from overwriting input by @Somilg11 in kubescape/kubescape#4596
  • fix(scan): reject namespace and resource kind filter flags on workload scan by @WKr1shna in kubescape/kubescape#4602
  • fix(scan): reject Helm and file-path flags on image scans by @Nachiket-Roy in kubescape/kubescape#4588
  • fix(fixhandler): bound and validate report file reads to prevent DoS (CWE-400) by @sapnilbiswas in kubescape/kubescape#4592
  • fix(config): enforce Cobra argument bounds on config set command by @Nachiket-Roy in kubescape/kubescape#4590
  • fix(imagescan): preserve source selectors in registry fallback by @Somilg11 in kubescape/kubescape#4600
  • fix(resourcehandler): bound HTTP response body in httpGet to prevent DoS (CWE-400) by @sapnilbiswas in kubescape/kubescape#4594
  • fix(rules): stop reporting cluster-scoped grants made through RoleBindings by @NopeCharon in kubescape/kubescape#4611
  • fix(rules): match RBAC subresource grants the way the authorizer does by @NopeCharon in kubescape/kubescape#4610
  • fix(policy): treat nil and empty response lists as equal in policy test by @NopeCharon in kubescape/kubescape#4612
  • fix(scan): reject null entries in contract string lists by @Somilg11 in kubescape/kubescape#4598
  • fix(version,update): check nil kubescape interface and empty format validation by @KeerthiKumarR in kubescape/kubescape#4587
  • fix(diff): prevent diff output from overwriting input reports and validate arguments by @WKr1shna in kubescape/kubescape#4604
  • fix(vap): bound downloaded CEL policy response body to prevent DoS (CWE-400) by @sapnilbiswas in kubescape/kubescape#4615
  • fix(cautils): apply positive LARGE_CLUSTER_SIZE fallback to streaming auto-enable check by @Nakshatra480 in kubescape/kubescape#4613
  • fix(exceptions): emit ExceptionMatched events only when allowed to by @matthyx in kubescape/kubescape#4616
• kubescape/kubevuln@v0.3.571...v0.3.578
  • fix(deps): update golang.org/x/net to v0.60.0 by @devantler in kubescape/kubevuln#1218
  • chore(deps): bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in kubescape/kubevuln#1222
  • fix(registry): keep one SBOM and CVE manifest per requested platform by @blacksoxx in kubescape/kubevuln#1216
  • chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in kubescape/kubevuln#1221
  • docs(vex): clarify external ingestion implementation status by @aaa-aashna in kubescape/kubevuln#1219
  • chore(deps): bump cue-lang/setup-cue from 1.0.1 to 2.0.0 by @dependabot[bot] in kubescape/kubevuln#1223
  • chore(deps): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 by @dependabot[bot] in kubescape/kubevuln#1220
  • chore(deps): SUB-9486 upgrade to grype v0.121.0 and syft v1.55.0 by @jnathangreeg in kubescape/kubevuln#1224
  • chore(deps): SUB-9486 bump kubescape/storage to v0.0.382 by @matthyx in kubescape/kubevuln#1225
  • fix(deps): replace retracted mimetype release by @devantler in kubescape/kubevuln#1226
  • chore(deps): SUB-9486 bump kubescape/storage to v0.0.387 by @matthyx in kubescape/kubevuln#1227
  • ci: bump kubescape/workflows pin to stop the helm-charts dispatch by @matthyx in kubescape/kubevuln#1228
  • feat: authenticate the scan API with apiauth by @slashben in kubescape/kubevuln#1229
• kubescape/node-agent@v0.3.299...v0.3.310
  • fix(utils): apply the jitter in AddJitter by @matthyx in kubescape/node-agent#1060
  • fix(healthmanager): serve probes on a dedicated mux by @slashben in kubescape/node-agent#1057
  • build(deps): upgrade Inspektor Gadget to v0.57.0 via kubescape fork by @matthyx in kubescape/node-agent#1062
  • fix(processtree): re-read the parent from procfs for unknown host parents by @matthyx in kubescape/node-agent#1063
  • SUB-9486: move to syft v1.55.0 and drop the stereoscope v0.1.9 pin by @jnathangreeg in kubescape/node-agent#1061
  • feat(cel): expose the executed file as event.file by @matthyx in kubescape/node-agent#1065
  • fix(sbom): exclude per-pod kubelet directories from host scans by @matthyx in kubescape/node-agent#1066
  • feat(gvisor): export runtime-verified container starts by @dakshhhhh16 in kubescape/node-agent#1069
  • ci: stop dispatching the helm-charts auto-bump workflow on release by @matthyx in kubescape/node-agent#1071
  • feat(http exporter): bearer token from a projected token file by @slashben in kubescape/node-agent#1070
• kubescape/operator@v0.2.204...v0.2.209
  • fix(watcher): handle ephemeral container statuses in watcher utils by @Rucha0901 in kubescape/operator#468
  • fix(watcher): resolve the pod of every workload kind for ContainerProfile scans by @blacksoxx in kubescape/operator#471
  • ci: bump kubescape/workflows pin to stop the helm-charts dispatch by @matthyx in kubescape/operator#473
  • feat(apiauth): send tokens to kubescape, kubevuln and synchronizer; protect the trigger API by @slashben in kubescape/operator#472
  • feat(mainhandler): re-render schedules whose containers differ from the template by @ahauserv in kubescape/operator#476
• kubescape/storage@v0.0.378...v0.0.382
  • fix(cleanup): delete under the write gate and only what the decision was made on by @blacksoxx in kubescape/storage#469
  • feat(mcp): add list_sboms and list_sbom_packages by @Sarthak-Shreshtha01 in kubescape/storage#472
  • fix: synchronize IgnoreRule apply configuration with provenance fields by @ANAMASGARD in kubescape/storage#473
  • SUB-9486: bump anchore/syft to v1.55.0 and sync package metadata types by @jnathangreeg in kubescape/storage#471
• kubescape/synchronizer@v0.0.173...v0.0.175
  • test(backend): tell callbacks apart by what they do by @blacksoxx in kubescape/synchronizer#194
  • ci: bump kubescape/workflows pin to stop the helm-charts dispatch by @matthyx in kubescape/synchronizer#195
  • feat(httpendpoint): authenticate with apiauth by @slashben in kubescape/synchronizer#196
• Bump kubescape-ops-tool from 0.1.0-r1 to 0.2.0-r1

Full Changelog: kubescape-operator-1.41.0...kubescape-operator-1.42.0