fix(container): update kyverno (3.2.6 → 3.2.7)

[bot-blake]

This PR contains the following updates:

Package	Update	Change
kyverno	patch	3.2.6 -> 3.2.7

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[bot-blake]

--- HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-admission-controller

+++ HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-admission-controller

@@ -51,13 +51,13 @@

                   - admission-controller
               topologyKey: kubernetes.io/hostname
             weight: 1
       serviceAccountName: kyverno-admission-controller
       initContainers:
       - name: kyverno-pre
-        image: ghcr.io/kyverno/kyvernopre:v1.12.5
+        image: ghcr.io/kyverno/kyvernopre:v1.12.6
         imagePullPolicy: IfNotPresent
         args:
         - --loggingFormat=text
         - --v=2
         resources:
           limits:
@@ -94,13 +94,13 @@

         - name: KYVERNO_DEPLOYMENT
           value: kyverno-admission-controller
         - name: KYVERNO_SVC
           value: kyverno-svc
       containers:
       - name: kyverno
-        image: ghcr.io/kyverno/kyverno:v1.12.5
+        image: ghcr.io/kyverno/kyverno:v1.12.6
         imagePullPolicy: IfNotPresent
         args:
         - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca
         - --tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair
         - --backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller
         - --servicePort=443
--- HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-background-controller

+++ HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-background-controller

@@ -43,13 +43,13 @@

                   - background-controller
               topologyKey: kubernetes.io/hostname
             weight: 1
       serviceAccountName: kyverno-background-controller
       containers:
       - name: controller
-        image: ghcr.io/kyverno/background-controller:v1.12.5
+        image: ghcr.io/kyverno/background-controller:v1.12.6
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9443
           name: https
           protocol: TCP
         - containerPort: 8000
--- HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-cleanup-controller

+++ HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-cleanup-controller

@@ -43,13 +43,13 @@

                   - cleanup-controller
               topologyKey: kubernetes.io/hostname
             weight: 1
       serviceAccountName: kyverno-cleanup-controller
       containers:
       - name: controller
-        image: ghcr.io/kyverno/cleanup-controller:v1.12.5
+        image: ghcr.io/kyverno/cleanup-controller:v1.12.6
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9443
           name: https
           protocol: TCP
         - containerPort: 8000
--- HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-reports-controller

+++ HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-reports-controller

@@ -43,13 +43,13 @@

                   - reports-controller
               topologyKey: kubernetes.io/hostname
             weight: 1
       serviceAccountName: kyverno-reports-controller
       containers:
       - name: controller
-        image: ghcr.io/kyverno/reports-controller:v1.12.5
+        image: ghcr.io/kyverno/reports-controller:v1.12.6
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9443
           name: https
           protocol: TCP
         - containerPort: 8000
--- HelmRelease: kyverno/kyverno CronJob: kyverno/kyverno-cleanup-update-requests

+++ HelmRelease: kyverno/kyverno CronJob: kyverno/kyverno-cleanup-update-requests

@@ -1,51 +0,0 @@

----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: kyverno-cleanup-update-requests
-  namespace: kyverno
-  labels:
-    app.kubernetes.io/component: cleanup
-    app.kubernetes.io/instance: kyverno
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/part-of: kyverno
-spec:
-  schedule: '*/10 * * * *'
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 1
-  jobTemplate:
-    spec:
-      backoffLimit: 3
-      template:
-        metadata: null
-        spec:
-          serviceAccountName: kyverno-cleanup-jobs
-          containers:
-          - name: cleanup
-            image: bitnami/kubectl:1.28.5
-            imagePullPolicy: null
-            command:
-            - /bin/bash
-            - -c
-            - |
-              set -euo pipefail
-              COUNT=$(kubectl get updaterequests.kyverno.io -A | wc -l)
-              if [ "$COUNT" -gt 10000 ]; then
-                echo "too many updaterequests found ($COUNT), cleaning up..."
-                kubectl delete updaterequests.kyverno.io --all -n kyverno
-              else
-                echo "($COUNT) reports found, no clean up needed"
-              fi
-            securityContext:
-              allowPrivilegeEscalation: false
-              capabilities:
-                drop:
-                - ALL
-              privileged: false
-              readOnlyRootFilesystem: true
-              runAsNonRoot: true
-              seccompProfile:
-                type: RuntimeDefault
-          restartPolicy: OnFailure
-
--- HelmRelease: kyverno/kyverno RoleBinding: kyverno/kyverno:remove-configmap

+++ HelmRelease: kyverno/kyverno RoleBinding: kyverno/kyverno:remove-configmap

@@ -14,12 +14,11 @@

     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
     helm.sh/hook-weight: '0'
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: kyverno:remove-configmap
-  namespace: kyverno
 subjects:
 - kind: ServiceAccount
   name: kyverno-remove-configmap
   namespace: kyverno
 
--- HelmRelease: kyverno/kyverno Job: kyverno/kyverno-migrate-resources

+++ HelmRelease: kyverno/kyverno Job: kyverno/kyverno-migrate-resources

@@ -19,13 +19,13 @@

     metadata: null
     spec:
       serviceAccount: kyverno-migrate-resources
       restartPolicy: Never
       containers:
       - name: kubectl
-        image: ghcr.io/kyverno/kyverno-cli:v1.12.5
+        image: ghcr.io/kyverno/kyverno-cli:v1.12.6
         imagePullPolicy: IfNotPresent
         args:
         - migrate
         - --resource
         - admissionreports.kyverno.io
         - --resource

[bot-blake]

--- kubernetes/apps/kyverno/kyverno/app Kustomization: flux-system/kyverno HelmRelease: kyverno/kyverno

+++ kubernetes/apps/kyverno/kyverno/app Kustomization: flux-system/kyverno HelmRelease: kyverno/kyverno

@@ -13,13 +13,13 @@

     spec:
       chart: kyverno
       sourceRef:
         kind: HelmRepository
         name: kyverno-charts
         namespace: flux-system
-      version: 3.2.6
+      version: 3.2.7
   install:
     remediation:
       retries: 3
   interval: 30m
   upgrade:
     cleanupOnFail: true