v1.13

The latest version of the 1.13 release of Enterprise Kyverno is v1.13.6-n4k.nirmata.30, released August 11, 2026.

For a complete list of changes, refer to the upstream Changelog.

• v1.13.0 — October 29, 2024
• v1.13.1 — November 12, 2024
• v1.13.2 — December 10, 2024
• v1.13.4 — February 8, 2025
• v1.13.5 — April 29, 2025
• v1.13.6 — May 8, 2025

Report Server Installation Advisory

(Kubernetes Issue #122668) where multiple components serving the same CustomResourceDefinitions (CRDs) via an APIService can lead to OpenAPI handler failures during cluster startup.

Reports Server serves the same report-related CRDs that Kyverno uses. When these CRDs are present both via the APIService (Reports Server) and within Kyverno’s installation, the Kubernetes apiserver may detect duplicate API paths, resulting in temporary failures, including potential crash loops of Kyverno pods until the APIService becomes fully available.

To mitigate this, native reports server installation with n4k(Recommended):

• Nirmata Enterprise for Kyverno chart can install reports server natively, init containers for Nirmata Enterprise for Kyverno controllers will wait till it’s APIService registers the report CRDs.

separate chart:

• Install Reports Server first, allowing its APIService to register the report CRDs.
• Once the Reports Server is fully up and its APIService is ready, install Nirmata Enterprise for Kyverno separately, so that Kyverno can detect the existing CRDs without attempting to install them again.

This installation sequence avoids CRD conflicts and ensures stable operation.

• Nirmata Enterprise for Kyverno with Reports Server
• Nirmata Enterprise for Kyverno without Reports Server

v1.13.6-n4k.nirmata.30 — August 11, 2026

Fixes

• Corrected scope inference for namespace-constrained wildcard policies in the namespaced webhook configuration.
• Added a nil check in Pod Security Standards evaluation to prevent a possible panic.

v1.13.6-n4k.nirmata.29 — July 13, 2026

Additional changes

• Library bump: go-git/go-git v5.13.0 → v5.18.0, go-git/go-billy v5.6.0 → v5.8.0, cyphar/filepath-securejoin v0.3.2 → v0.4.1, ProtonMail/go-crypto v1.1.3 → v1.1.6, plus Azure/go-ntlmssp, pjbgf/sha1cd, and skeema/knownhosts.

v1.13.6-n4k.nirmata.26 — April 14, 2026

Additional changes

• Library bump / base image: Go toolchain → 1.26.2, golang.org/x/crypto v0.47 → v0.50, golang.org/x/text → v0.36, google.golang.org/grpc → v1.80, and FIPS base-image migration across all Dockerfile.fips images.

v1.13.6-n4k.nirmata.19 — February 18, 2026

Large batch upgrading the Go toolchain and the sigstore stack to clear roughly 15 dependency CVEs. Representative advisories are listed here; the remainder are noted below the table.

Also remediated in this batch: CVE-2025-61732, CVE-2025-61728, CVE-2025-61730 (Go), CVE-2026-24117 (rekor), CVE-2026-24137 (sigstore), and CVE-2026-23991 and CVE-2026-23992 (go-tuf). The k8s.io dependencies were aligned to v0.34.1 and client wrappers regenerated as part of the sigstore upgrade.

v1.13.6-n4k.nirmata.18 — January 27, 2026

v1.13.6-n4k.nirmata.15 — December 28, 2025

Additional changes

• Library bump / base image: golang.org/x/crypto → v0.46, golang.org/x/net → v0.48, google/go-containerregistry → v0.20.7, go.step.sm/crypto → v0.75.0, plus a FIPS base-image refresh.

v1.13.6-n4k.nirmata.14 — December 11, 2025

Additional changes

• Library bump: golang.org/x/crypto → v0.45, golang.org/x/text → v0.31, golang.org/x/net → v0.47.

v1.13.6-n4k.nirmata.13 — November 24, 2025

Additional changes

• Library bump / base image: Go toolchain 1.23.12 → 1.25.3, with matching FIPS base-image updates.

v1.13.6-n4k.nirmata.10 — August 20, 2025

Targeted Report Reconciliation on Policy Changes (PR #13664)

Previously, the reports controller would reprocess all reports whenever any policy changed, leading to significant performance issues in large clusters.

This update introduces:

• A cache mapping report UUIDs to the policies that affect them
• Replacement of enqueueAll() with a targeted enqueueReportsForPolicy() method
• Reconciliation now only processes reports actually impacted by a given policy change
• A background cleanup routine to prevent memory leaks in the cache

Impact: This change dramatically reduces CPU usage and reconciliation latency by ensuring that only relevant reports are processed when policies change, rather than all reports in the cluster.

Dynamic Watcher Resource Hash Optimization (PR #13693)

Switched to a lazy loading model for updating dynamic watcher resource hashes, eliminating the need for expensive list calls on every update.

Improvements include:

• Resource hashes are now updated only when required, rather than proactively on every event
• Avoids unnecessary list calls, reducing API server load and improving scalability

Additional changes

• Fix: Go toolchain pinned to 1.23.12 (down from 1.24.6) to resolve a build regression while retaining the CVE-2025-47907 fix.

v1.13.6-n4k.nirmata.7 — August 11, 2025

Bug Fixes

Controller Report Breaker Enhancement (PR #13641)

Fixed a critical issue where controller initialization would fail completely if ephemeral reports list+watch operations encountered errors. This problem particularly affected clusters that depend on the reports server, where server unavailability could block the admission flow and cause serious cluster failures.

The fix implements:

• Centralized access to the reports creation entity (reports breaker)
• Mock entity replacement when initialization fails
• Background retry mechanism to continuously attempt watch establishment
• Improved resilience during controller startup

Important Note: This fix addresses initialization-time failures only. Runtime issues are already handled by the existing circuit breaker functionality, which allows the admission workflow to continue normally when reports become unavailable during operation.

JMESPath Expression Safety (PR #13138)

Resolved panic conditions in the getValueAsStringMap function when processing malformed JMESPath expressions. The function would previously crash when encountering nil or non-string values in map structures, particularly when using the {{@}} variable with non-existent functions.

Improvements include:

• Added proper nil checking before type assertions
• Implemented safe type switching for non-string values
• Comprehensive test coverage (increased from 16% to 70%)
• Enhanced error handling for malformed expressions

Misc

• Additional security vulnerability patches
• Fixed FIPS image workflow

v1.13.6-n4k.nirmata.5 — August 6, 2025

Additional changes

• Library bump: cloudflare/circl v1.4.0 → v1.6.0.

v1.13.6-n4k.nirmata.2 — June 16, 2025

Breaking Changes

Default exception settings: the Helm chart values of the prior versions enabled exceptions by default for all namespaces. This creates a potential security issue. See CVE-2024-48921 for more details. This change will impact users who were relying on policy exceptions to be enabled in all namespaces.

If you do not want to use Policy Exceptions, you can continue to use the default installation settings.

If you were not using Policy Exceptions previously and want to use it from 1.13 onwards, it is advised to set features.policyExceptions.enabled to true in the values.yaml file and store exceptions in a dedicated namespace by setting features.policyExceptions.namespace to nirmata-exceptions.

If you were using Policy Exceptions previously, when upgrading to this new version, set features.policyExceptions.enabled to true in the values.yaml file, and set the exception namespace value to the namespace that you used for storing exceptions. For example, if exceptions were stored in the kyverno namespace, then set features.policyExceptions.namespace to kyverno. Since it was possible to create exceptions in any namespace before, in order to maintain backwards compatibility, you can also set features.policyExceptions.namespace to *.

NOTE: Limiting exceptions to a specific namespace is recommended.

disableAutoWebhookGeneration flag: The disableAutoWebhookGeneration flag in Kyverno is a configuration option that allows users to prevent Kyverno from automatically generating webhooks for policies during or after installation. By default, Kyverno manages webhooks to ensure its policies are applied to Kubernetes resources, but in certain cases, users may want to control or manage webhooks manually.

When this flag is set to true, Kyverno will not automatically create or modify the webhooks that connect its policies to the Kubernetes API server. This can be useful in scenarios where:

• Manual control over webhook management is desired.
• Custom webhook configurations are needed for specific use cases, such as integrating with third-party systems or configuring webhooks differently.
• A user wants to avoid webhook generation on clusters where webhooks are already in place or managed separately.

You can enable the disableAutoWebhookGeneration flag by setting the config.disableAutoWebhookGeneration.enable to true and specifying name of the webhooks to disable by adding values to config.disableAutoWebhookGeneration.webhooks in values.yaml file.

Or

You can directly enable the flag and specify the webhook names to disable while installing n4k charts.

Example:

helm install kyverno nirmata/kyverno -n kyverno --create-namespace --set config.disableAutoWebhookGeneration.enable=true --set "config.disableAutoWebhookGeneration.webhooks={
kyverno-policy-validating-webhook-cfg,kyverno-exception-validating-webhook-cfg}"

This setting can be especially helpful when integrating Kyverno in environments where other tools or manual processes already manage webhook configurations, ensuring that Kyverno does not interfere with or overwrite those setups.

Major Changes

• Reports server is now disabled by default. If you are using Nirmata Enterprise for Kyverno, and want to install the reports-server chart, set the following values in the values.yaml file.

helm install kyverno --namespace kyverno --create-namespace nirmata/kyverno --set crds.reportsServer.enabled=true
```text
Starting this release, the default value of `crds.reportsServer.enabled` has changed from `true` to `false`.

**Reports Server Updates:**
* Added support for etcd compaction (auto compaction enabled by default). Use the `config.etcd.autoCompaction.mode` and `config.etcd.autoCompaction.retention` fields to override the default values.
* Optionally configure HPA for reports-server. Autoscaling is disabled by default. Use the `autoscaling.enabled` field to turn it on and also specify the HPA behavior.
* Added default resource requests and limits for reports-server pod. However, it is recommended to monitor for these values in production and adjust accordingly.

| CVE | Component | Severity | Fix type | Image(s) affected | Notes |
| --- | --- | --- | --- | --- | --- |
| [CVE-2025-22874](https://nvd.nist.gov/vuln/detail/CVE-2025-22874) | Go toolchain / dependencies | High | Library bump | all images | Cleared by the dependency and toolchain updates in this release |
| [CVE-2025-26569](https://nvd.nist.gov/vuln/detail/CVE-2025-26569) | Go toolchain / dependencies | High | Library bump | all images | Cleared by the dependency and toolchain updates in this release |
| [CVE-2025-0913](https://nvd.nist.gov/vuln/detail/CVE-2025-0913) | Go toolchain / dependencies | Medium | Library bump | all images | Cleared by the dependency and toolchain updates in this release |
| [CVE-2025-4673](https://nvd.nist.gov/vuln/detail/CVE-2025-4673) | Go toolchain / dependencies | Medium | Library bump | all images | Cleared by the dependency and toolchain updates in this release |

### Additional changes

- **Library bump:** Go toolchain 1.23.8 → 1.23.10.

## v1.13.4-n4k.nirmata.5 — April 18, 2025

| CVE | Component | Severity | Fix type | Image(s) affected | Notes |
| --- | --- | --- | --- | --- | --- |
| [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) | Go standard library (`net/http`) | Critical | Library bump | all images | Request smuggling; Go toolchain 1.23.4 → 1.23.8. Also tracked as [GHSA-g9pc-8g42-g6vq](https://github.com/advisories/GHSA-g9pc-8g42-g6vq). |

### Additional changes

- **Fix:** backport of namespace-selector error propagation and per-rule scope evaluation (prevents silent skips of namespaced policy rules).

## v1.13.4-n4k.nirmata.3 — April 1, 2025

### Additional changes

- **Library bump:** `golang-jwt/jwt` v4.5.1 → v4.5.2 and v5.2.1 → v5.2.2.

## v1.13.4-n4k.nirmata.2 — March 19, 2025

### Additional changes

- **Library bump:** `golang.org/x/crypto` → v0.35, `golang.org/x/net` → v0.36, `golang.org/x/text` → v0.22.

## v1.13.2-n4k.nirmata.4 — January 30, 2025

### Additional changes

- **Library bump:** Go toolchain 1.22.8 → 1.23.5.

## v1.13.2-n4k.nirmata.3 — January 20, 2025

### Additional changes

- **Library bump:** `golang.org/x/crypto` → v0.32, `go-git/go-git` → v5.13.0, and `notaryproject/notation-go` → v1.3.0.

## v1.13.2-n4k.nirmata.1 — December 26, 2024

### Additional changes

- **Library bump:** `golang.org/x/crypto` → v0.31, `golang.org/x/net` → v0.33, `golang.org/x/text` → v0.21.