chore(chart-deps): update policy-reporter to version 3.9.1

[svcAPLBot]

This PR updates the dependency policy-reporter to version 3.9.1.

[Copilot]

Pull request overview

This PR bumps the vendored policy-reporter Helm chart to 3.9.1 and aligns chart defaults/templates/README with the updated upstream chart behavior.

Changes:

• Update chart metadata (Chart.yaml, chart-index) and various default image tags/values to match policy-reporter chart v3.9.1.
• Add new configuration surfaces (e.g., Microsoft Graph API email reports, autoMemoryLimit) and wire them into rendered config templates.
• Adjust rendered resources (HTTPRoute backendRefs, ServiceMonitor gating, CronJob env vars, RBAC additions) to reflect upstream chart updates.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
charts/policy-reporter/values.yaml	Updates defaults (image tags, new graphAPI + autoMemoryLimit, ServiceMonitor flag, source filter defaults).
charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml	Updates NamespaceCustomBoard CRD schema and adds templated annotations support.
charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml	Updates CustomBoard CRD schema and documentation strings.
charts/policy-reporter/templates/ui/httproute.yaml	Makes backendRefs explicit (group/kind/name) for Gateway API.
charts/policy-reporter/templates/plugins/kyverno/httproute.yaml	Same backendRefs explicitness for kyverno plugin route.
charts/policy-reporter/templates/monitoring/servicemonitor.yaml	Gates ServiceMonitor rendering on new monitoring.serviceMonitor.enabled.
charts/policy-reporter/templates/httproute.yaml	Makes backendRefs explicit (group/kind/name) for core route.
charts/policy-reporter/templates/cronjob-violations-report.yaml	Adds POD_NAMESPACE env var and ensures env: always exists.
charts/policy-reporter/templates/cronjob-summary-report.yaml	Adds POD_NAMESPACE env var and ensures env: always exists.
charts/policy-reporter/templates/clusterrole.yaml	Adds apps/replicasets read permission.
charts/policy-reporter/README.md	Updates version/appVersion badges and values documentation tables.
charts/policy-reporter/configs/email-reports.tmpl	Wires emailReports.graphAPI into generated config.
charts/policy-reporter/configs/core.tmpl	Wires autoMemoryLimit into generated config.
charts/policy-reporter/Chart.yaml	Bumps chart version to 3.9.1 and appVersion to 3.9.0 per upstream chart.
chart/chart-index/Chart.yaml	Updates chart dependency version reference to 3.9.1.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:9

• metadata currently contains two annotations: keys: an empty annotations: line plus a conditional annotations: block. This renders invalid/ambiguous YAML (duplicate keys) and can cause CRD apply failures or unexpected annotation behavior.

  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}

charts/policy-reporter/templates/monitoring/servicemonitor.yaml:1

• The ServiceMonitor gate now requires .Values.monitoring.serviceMonitor.enabled to be set. On helm upgrade --reuse-values, newly-added defaults are not merged, so this can evaluate to false and unexpectedly stop rendering the ServiceMonitor even though monitoring.enabled is true. Consider defaulting this flag to true at template time to preserve prior behavior for existing installs.

{{- if and .Values.monitoring.enabled .Values.monitoring.serviceMonitor.enabled }}

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:9

• The CRD template renders an empty metadata.annotations: line and can also render a second annotations: key when .Values.annotations is set, producing invalid YAML (duplicate key / empty value). This will break helm template/apply for the UI CRDs.

  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml:184

• renderOptions is not a namespace selector, but its schema description currently says "NamespaceSelector allows to select visualized namespaces", which is misleading for CRD users and generated docs.

              renderOptions:
                description: NamespaceSelector allows to select visualized namespaces
                properties:

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (2)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:9

• metadata currently renders an empty annotations: key and then (optionally) renders a second annotations: key. This results in duplicate YAML keys and invalid output when .Values.annotations is set (and can also produce a dangling annotations: when it is not). Remove the stray annotations: line so only a single annotations map is rendered under metadata.

  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml:185

• The renderOptions schema description looks copy/pasted (it currently says it's a NamespaceSelector). This is misleading in generated CRD docs and kubectl explain. Update the description to reflect what renderOptions actually configures.

              renderOptions:
                description: NamespaceSelector allows to select visualized namespaces
                properties:

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (1)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:10

• In ui.policyreporter.kyverno.io_namespacecustomboards.yaml, metadata currently contains an unconditional annotations: key (with no value) followed by a conditional second annotations: block. This can render invalid YAML / invalid CRD metadata (duplicate key, or annotations: null when .Values.annotations is empty). Remove the stray annotations: line and keep only the conditional block.

metadata:
  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}
  name: namespacecustomboards.ui.policyreporter.kyverno.io

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (1)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:9

• The CRD template currently renders an empty metadata.annotations: key and then conditionally renders a second annotations: key when .Values.annotations is set. This results in duplicate YAML keys under metadata, which can break YAML parsing / CRD application.

  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (1)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:9

• This template now renders an empty metadata.annotations: key unconditionally and (when .Values.annotations is set) renders a second annotations: key, producing invalid YAML for the CRD metadata. Kubernetes expects metadata.annotations to be a map (not null), and duplicate keys can fail manifest parsing/apply.

  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (2)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:8

• metadata currently renders two annotations keys (one empty and one conditional), which produces invalid YAML (duplicate key) when .Values.annotations is set, and a meaningless annotations: null when it is not. Remove the unconditional annotations: line and keep a single conditional annotations block.

metadata:
  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml:184

• The renderOptions schema description is a copy/paste from namespaces ("NamespaceSelector...") and is misleading for CRD consumers. Update it to describe what renderOptions actually controls.

                description: NamespaceSelector allows to select visualized namespaces

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (1)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:10

• metadata contains two annotations: keys: an unconditional empty annotations: line followed by a conditional annotations: block. This renders invalid YAML (duplicate key) and can cause Helm/Kubernetes to reject the CRD manifest.

metadata:
  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}
  name: namespacecustomboards.ui.policyreporter.kyverno.io

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (1)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:9

• metadata currently emits an empty annotations: key and then conditionally emits a second annotations: block, resulting in duplicate keys / invalid YAML (and metadata.annotations becoming null when .Values.annotations is unset). This CRD will fail to apply.

  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (1)

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml:9

• The CRD template renders an annotations: key unconditionally (line 5) and then conditionally renders a second annotations: block. This produces duplicate YAML keys and can also render annotations: null when .Values.annotations is unset, which is invalid for Kubernetes object metadata.

  annotations:
  {{- if .Values.annotations }}
  annotations:
    {{- toYaml .Values.annotations | nindent 4 }}
  {{- end }}