chore(chart-deps): update policy-reporter to version 3.9.1

chart/chart-index/Chart.yaml

@@ -92,7 +92,7 @@ dependencies:
     version: 0.117.0
     repository: https://open-telemetry.github.io/opentelemetry-helm-charts
   - name: policy-reporter
-    version: 3.7.4
+    version: 3.9.1
     repository: https://kyverno.github.io/policy-reporter
   - name: prometheus-blackbox-exporter
     version: 11.15.1

charts/policy-reporter/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 3.7.4
+appVersion: 3.9.0
 description: 'Policy Reporter watches for PolicyReport Resources. It creates Prometheus
   Metrics and can send rule validation events to different targets like Loki, Elasticsearch,
   Slack or Discord '
@@ -12,4 +12,4 @@ name: policy-reporter
 sources:
 - https://github.com/kyverno/policy-reporter
 type: application
-version: 3.7.4
+version: 3.9.1

charts/policy-reporter/README.md

@@ -3,7 +3,7 @@
 Policy Reporter watches for PolicyReport Resources.
 It creates Prometheus Metrics and can send rule validation events to different targets like Loki, Elasticsearch, Slack or Discord
 
-![Version: 3.7.4](https://img.shields.io/badge/Version-3.7.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.7.4](https://img.shields.io/badge/AppVersion-3.7.4-informational?style=flat-square)
+![Version: 3.9.1](https://img.shields.io/badge/Version-3.9.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.9.0](https://img.shields.io/badge/AppVersion-3.9.0-informational?style=flat-square)
 
 ## Documentation
 
@@ -110,7 +110,7 @@ Open `http://localhost:8082/` in your browser.
 | sourceFilters[0].selector.sources | list | `["kyverno","KyvernoValidatingPolicy","KyvernoImageValidatingPolicy"]` | select Report by source |
 | sourceFilters[0].uncontrolledOnly | bool | `true` | Filter out Reports of controlled Pods and Jobs, only works for Reports with scope resource |
 | sourceFilters[0].disableClusterReports | bool | `false` | Filter out cluster scoped Reports |
-| sourceFilters[0].kinds | object | `{"exclude":["ReplicaSet"]}` | Filter out Reports based on the scope resource kind |
+| sourceFilters[0].kinds | object | `{"exclude":[]}` | Filter out Reports based on the scope resource kind |
 | global.labels | object | `{}` | additional labels added on each resource |
 | basicAuth.username | string | `""` | HTTP BasicAuth username |
 | basicAuth.password | string | `""` | HTTP BasicAuth password |
@@ -127,6 +127,17 @@ Open `http://localhost:8082/` in your browser.
 | emailReports.smtp.encryption | string | `""` | SMTP Encryption Default is none, supports ssl/tls and starttls |
 | emailReports.smtp.skipTLS | bool | `false` | Skip SMTP TLS verification |
 | emailReports.smtp.certificate | string | `""` | SMTP Server Certificate file path |
+| emailReports.graphAPI.enabled | bool | `false` | Enable Microsoft Graph API for E-Mail reports, takes precedence over SMTP |
+| emailReports.graphAPI.tenant | string | `""` | Microsoft Graph API Tenant ID |
+| emailReports.graphAPI.clientID | string | `""` | Microsoft Graph API Client ID |
+| emailReports.graphAPI.clientSecret | string | `""` | Microsoft Graph API Client Secret |
+| emailReports.graphAPI.secretRef | optional | `""` | Name of an existing Secret with a `clientSecret` key, used instead of `clientSecret` |
+| emailReports.graphAPI.userID | string | `""` | Microsoft Graph API User ID (Sender) |
+| emailReports.graphAPI.cc | list | `[]` | Microsoft Graph API CC Recipients |
+| emailReports.graphAPI.bcc | list | `[]` | Microsoft Graph API BCC Recipients |
+| emailReports.graphAPI.disableSaveToSentItems | bool | `false` | Disable saving sent messages to the Sent Items folder |
+| emailReports.graphAPI.azureADEndpoint | string | `"https://login.microsoftonline.com"` | Microsoft Graph API Azure AD Endpoint override |
+| emailReports.graphAPI.graphEndpoint | string | `"https://graph.microsoft.com"` | Microsoft Graph API endpoint override |
 | emailReports.summary.enabled | bool | `false` | Enable Summary E-Mail reports |
 | emailReports.summary.schedule | string | `"0 8 * * *"` | CronJob schedule |
 | emailReports.summary.activeDeadlineSeconds | int | `300` | CronJob activeDeadlineSeconds |
@@ -379,6 +390,8 @@ Open `http://localhost:8082/` in your browser.
 | database.mountedSecret | string | `""` |  |
 | periodicSync.enabled | bool | `false` |  |
 | periodicSync.interval | int | `30` |  |
+| autoMemoryLimit.enabled | bool | `true` |  |
+| autoMemoryLimit.ratio | float | `0.9` |  |
 | podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for policy-reporter disruptions. Cannot be used if `maxUnavailable` is set. |
 | podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for policy-reporter disruptions. Cannot be used if `minAvailable` is set. |
 | nodeSelector | object | `{}` | Node labels for pod assignment ref: https://kubernetes.io/docs/user-guide/node-selection/ |
@@ -396,7 +409,7 @@ Open `http://localhost:8082/` in your browser.
 | ui.image.registry | string | `"ghcr.io"` | Image registry |
 | ui.image.repository | string | `"kyverno/policy-reporter-ui"` | Image repository |
 | ui.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |
-| ui.image.tag | string | `"2.5.1"` | Image tag |
+| ui.image.tag | string | `"2.7.0"` | Image tag |
 | ui.crds.customBoard | bool | `false` | Install UI CustomBoard CRDs |
 | ui.replicaCount | int | `1` | Deployment replica count |
 | ui.priorityClassName | string | `""` | Deployment priorityClassName |
@@ -492,7 +505,7 @@ Open `http://localhost:8082/` in your browser.
 | plugin.kyverno.image.registry | string | `"ghcr.io"` | Image registry |
 | plugin.kyverno.image.repository | string | `"kyverno/policy-reporter/kyverno-plugin"` | Image repository |
 | plugin.kyverno.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |
-| plugin.kyverno.image.tag | string | `"0.6.0"` | Image tag |
+| plugin.kyverno.image.tag | string | `"0.7.0"` | Image tag |
 | plugin.kyverno.replicaCount | int | `1` | Deployment replica count |
 | plugin.kyverno.priorityClassName | string | `""` | Deployment priorityClassName |
 | plugin.kyverno.logging.api | bool | `false` | Enables external API request logging |
@@ -565,11 +578,11 @@ Open `http://localhost:8082/` in your browser.
 | plugin.trivy.image.registry | string | `"ghcr.io"` | Image registry |
 | plugin.trivy.image.repository | string | `"kyverno/policy-reporter/trivy-plugin"` | Image repository |
 | plugin.trivy.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |
-| plugin.trivy.image.tag | string | `"0.4.12"` | Image tag Defaults to `Chart.AppVersion` if omitted |
+| plugin.trivy.image.tag | string | `"0.5.0"` | Image tag Defaults to `Chart.AppVersion` if omitted |
 | plugin.trivy.cli.image.registry | string | `"ghcr.io"` | Image registry |
 | plugin.trivy.cli.image.repository | string | `"aquasecurity/trivy"` | Image repository |
 | plugin.trivy.cli.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |
-| plugin.trivy.cli.image.tag | string | `"0.69.3"` | Image tag Defaults to `Chart.AppVersion` if omitted |
+| plugin.trivy.cli.image.tag | string | `"0.72.0"` | Image tag Defaults to `Chart.AppVersion` if omitted |
 | plugin.trivy.extraArgs | object | `{}` | Additional container args. |
 | plugin.trivy.cveawg.disable | bool | `false` | disable external CVEAWG API calls. |
 | plugin.trivy.github.disable | bool | `false` | disable GitHub API calls. |
@@ -633,6 +646,7 @@ Open `http://localhost:8082/` in your browser.
 | plugin.trivy.extraConfig | object | `{}` | Extra configuration options appended to trivy plugin settings |
 | monitoring.enabled | bool | `false` | Enables the Prometheus Operator integration |
 | monitoring.annotations | object | `{}` | Key/value pairs that are attached to all resources. |
+| monitoring.serviceMonitor.enabled | bool | `true` |  |
 | monitoring.serviceMonitor.honorLabels | bool | `false` | HonorLabels chooses the metrics labels on collisions with target labels |
 | monitoring.serviceMonitor.namespace | string | `nil` | Allow to override the namespace for serviceMonitor |
 | monitoring.serviceMonitor.labels | object | `{}` | Labels to match the serviceMonitorSelector of the Prometheus Resource |

charts/policy-reporter/configs/core.tmpl

@@ -209,6 +209,11 @@ periodicSync:
   {{- toYaml . | nindent 2 }}
 {{- end }}
 
+{{- with .Values.autoMemoryLimit }}
+autoMemoryLimit:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+
 {{- with .Values.extraConfig }}
 {{- toYaml . | nindent 0 }}
 {{- end }}

charts/policy-reporter/configs/email-reports.tmpl

@@ -5,6 +5,10 @@ emailReports:
   smtp:
     {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- with .Values.emailReports.graphAPI }}
+  graphAPI:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 
   summary:
     {{- with .Values.emailReports.summary.to }}

charts/policy-reporter/templates/clusterrole.yaml

@@ -59,4 +59,10 @@ rules:
   - jobs
   verbs:
   - get
+- apiGroups:
+  - 'apps'
+  resources:
+  - replicasets
+  verbs:
+  - get
 {{- end -}}

charts/policy-reporter/templates/cronjob-summary-report.yaml

@@ -72,8 +72,12 @@ spec:
               {{- with .Values.extraVolumes.volumeMounts }}
               {{ toYaml . | nindent 14 | trim }}
               {{- end }}
-              {{- if .Values.emailReports.smtp.secret }}
               env:
+              - name: POD_NAMESPACE
+                valueFrom:
+                  fieldRef:
+                    fieldPath: metadata.namespace
+              {{- if .Values.emailReports.smtp.secret }}
               - name: EMAIL_REPORTS_SMTP_HOST
                 valueFrom:
                   secretKeyRef:

charts/policy-reporter/templates/cronjob-violations-report.yaml

@@ -72,8 +72,12 @@ spec:
               {{- with .Values.extraVolumes.volumeMounts }}
               {{ toYaml . | nindent 14 | trim }}
               {{- end }}
-              {{- if .Values.emailReports.smtp.secret }}
               env:
+              - name: POD_NAMESPACE
+                valueFrom:
+                  fieldRef:
+                    fieldPath: metadata.namespace
+              {{- if .Values.emailReports.smtp.secret }}
               - name: EMAIL_REPORTS_SMTP_HOST
                 valueFrom:
                   secretKeyRef:

charts/policy-reporter/templates/httproute.yaml

@@ -42,7 +42,9 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       backendRefs:
-        - name: {{ $fullName }}
+        - group: ''
+          kind: Service
+          name: {{ $fullName }}
           port: {{ $svcPort }}
           weight: 1
     {{- end }}

charts/policy-reporter/templates/monitoring/servicemonitor.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.monitoring.enabled }}
+{{- if and .Values.monitoring.enabled .Values.monitoring.serviceMonitor.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:

charts/policy-reporter/templates/plugins/kyverno/httproute.yaml

@@ -36,7 +36,9 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       backendRefs:
-        - name: {{ $fullName }}
+        - group: ''
+          kind: Service
+          name: {{ $fullName }}
           port: {{ $svcPort }}
           weight: 1
     {{- end }}

charts/policy-reporter/templates/ui/httproute.yaml

@@ -36,7 +36,9 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       backendRefs:
-        - name: {{ $fullName }}
+        - group: ''
+          kind: Service
+          name: {{ $fullName }}
           port: {{ $svcPort }}
           weight: 1
     {{- end }}

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml

@@ -80,7 +80,9 @@ spec:
                 - enabled
                 type: object
               display:
-                description: Allowed values are "resources" or "results".
+                description: |-
+                  Allowed values are "resources" or "results".
+                  NOTE: "Name" is being deprecated in favor of "renderOptions.resultView".
                 type: string
               filter:
                 properties:
@@ -95,6 +97,17 @@ spec:
                           type: string
                         type: array
                     type: object
+                  clusterResources:
+                    properties:
+                      exclude:
+                        items:
+                          type: string
+                        type: array
+                      include:
+                        items:
+                          type: string
+                        type: array
+                    type: object
                   namespaceKinds:
                     properties:
                       exclude:
@@ -106,6 +119,17 @@ spec:
                           type: string
                         type: array
                     type: object
+                  resources:
+                    properties:
+                      exclude:
+                        items:
+                          type: string
+                        type: array
+                      include:
+                        items:
+                          type: string
+                        type: array
+                    type: object
                   results:
                     properties:
                       exclude:
@@ -153,6 +177,24 @@ spec:
                     additionalProperties:
                       type: string
                     type: object
+                required:
+                - labelSelector
+                type: object
+              renderOptions:
+                description: NamespaceSelector allows to select visualized namespaces
+                properties:
+                  dashboardMode:
+                    default: detailed
+                    enum:
+                    - detailed
+                    - compact
+                    type: string
+                  resultView:
+                    default: resources
+                    enum:
+                    - resources
+                    - results
+                    type: string
                 type: object
               sources:
                 description: SourceSelector allows to select visualized sources
@@ -161,6 +203,8 @@ spec:
                     items:
                       type: string
                     type: array
+                required:
+                - list
                 type: object
               title:
                 type: string

charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml

@@ -3,7 +3,10 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v2.4.5-0.20250927090338-8022a0e22018+incompatible.dirty
+  {{- if .Values.annotations }}
+  annotations:
+    {{- toYaml .Values.annotations | nindent 4 }}
+  {{- end }}
   name: namespacecustomboards.ui.policyreporter.kyverno.io
 spec:
   group: ui.policyreporter.kyverno.io
@@ -87,6 +90,17 @@ spec:
                           type: string
                         type: array
                     type: object
+                  clusterResources:
+                    properties:
+                      exclude:
+                        items:
+                          type: string
+                        type: array
+                      include:
+                        items:
+                          type: string
+                        type: array
+                    type: object
                   namespaceKinds:
                     properties:
                       exclude:
@@ -98,6 +112,17 @@ spec:
                           type: string
                         type: array
                     type: object
+                  resources:
+                    properties:
+                      exclude:
+                        items:
+                          type: string
+                        type: array
+                      include:
+                        items:
+                          type: string
+                        type: array
+                    type: object
                   results:
                     properties:
                       exclude:
@@ -128,6 +153,8 @@ spec:
                     additionalProperties:
                       type: string
                     type: object
+                required:
+                - labelSelector
                 type: object
               sources:
                 description: SourceSelector allows to select visualized sources
@@ -136,6 +163,8 @@ spec:
                     items:
                       type: string
                     type: array
+                required:
+                - list
                 type: object
               title:
                 type: string