What's New in Kyverno v1.20.0: CVE Fix, Helm Lifecycle Hooks, and CLI Breaking Changes

💡 Quick Answer: Kyverno v1.20.0 drops kyverno-json from the test API and removes the json scan CLI command (breaking for anyone using those paths), patches CVE-2026-50163 via an oras-go bump, adds configurable Helm lifecycle hooks for all controllers, and fixes several goroutine/ticker/context leaks plus a webhook match-condition offloading bug.

The Problem

Operators running Kyverno v1.19.1 are exposed to CVE-2026-50163 (via oras.land/oras-go/v2), may be relying on the now-removed kyverno-json test integration or json scan command, and could be hitting resource leaks in the metrics, policy controller TTL reconciliation, and sigstore referrer-fetching loops that degrade controller stability over time.

The Solution

Upgrade to v1.20.0 to pick up the CVE fix and leak patches, update CLI usage if you depend on kyverno-json/json scan, and optionally adopt the new Helm lifecycle hooks for safer rolling restarts/upgrades of Kyverno controllers.

Whats New

Breaking / Removed

• feat: remove kyverno-json from test api (#16929) and feat: remove json scan command (#16943) — the kyverno test API no longer integrates kyverno-json, and kyverno json scan is gone. Follow-up cleanup in #16963 and #17005 removes remaining references. If your pipelines call kyverno json scan or test cases rely on kyverno-json schema validation, migrate before upgrading.

Security

• fix: bump oras.land/oras-go/v2 to v2.6.2 to resolve CVE-2026-50163 (#16945) — pulls the registry client out of a known vulnerability; applies to clusters using OCI/Notary-based image verification.

Helm

• feat(helm): add configurable lifecycle hooks to all controllers (#16444) — new lifecycle values for admission/background/cleanup/reports controllers, useful for graceful preStop draining during rolling upgrades.

Behavior fixes worth knowing about

• fix(webhook): do not offload namespaceObject match conditions to the API server (#17069) — if you use matchConditions referencing namespaceObject, evaluation now happens correctly in Kyverno instead of being pushed to the API server. Re-test policies that depend on namespace-level CEL match conditions.
• fix(validation): reject non-string values in request.operation conditions (#16977) — policies comparing request.operation to non-string values will now fail validation; fix any malformed policies before upgrading.
• fix: IVPOL required has no effect (#16853) — required on ImageVerificationPolicies is now actually enforced; policies previously silently permissive may start blocking.
• fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (#17061) and fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (#17020) — improves GeneratingPolicy reliability and reduces incorrect downstream deletions.
• Fix: CLI apply command fails to match resources containing hyphens (#17124) — fixes a long-standing kyverno apply matching bug.

Stability (leak fixes)

• Goroutine/ticker/context leaks fixed in metrics init (#17024), policy controller reconciliation (#17027), TTL controller (#17032), and sigstore fetchReferrers (#17039) — reduces long-running memory/FD growth on busy clusters.
• fix(ttl): record deleted objects metric after deletion (#17104) and OpenTelemetry tracing fix for APICalls without custom CA bundle (#17116) improve observability accuracy.

Most remaining entries are dependency bumps (sigstore, cosign, go-containerregistry, cel-go, OTel group) and CI changes with no direct operator impact.

Upgrade Steps

Check current version first:

helm list -n kyverno
kubectl get deploy -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'

Upgrade via Helm (recommended path):

helm repo update kyverno
helm upgrade kyverno kyverno/kyverno \
  --namespace kyverno \
  --version 3.6.0 \
  --reuse-values

Confirm the Helm chart version that ships Kyverno v1.20.0 on the chart releases page before upgrading; the appVersion in the chart must match 1.20.0.

If you install manifests directly:

kubectl apply -f https://github.com/kyverno/kyverno/releases/download/v1.20.0/install.yaml

Verify

kubectl get pods -n kyverno
kubectl get deploy -n kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'
kubectl get crds | grep kyverno

Confirm the admission controller reports version v1.20.0 and all pods are Running with no restart loops (checks the leak fixes took effect under load).

Re-run kyverno test against your policy test suites to catch any breakage from the kyverno-json removal or the stricter request.operation validation.

Common Issues

• kyverno json scan not found: the command was removed in #16943; replace with standard kyverno apply/kyverno test workflows.
• Policies failing validation after upgrade: check for non-string comparisons against request.operation (#16977) and ImageVerificationPolicies with required: true that were previously no-ops (#16853).
• matchConditions using namespaceObject behaving differently: expected due to #17069; re-validate policy decisions in a staging cluster.

Best Practices

• Run kyverno test and kyverno apply --policy-report against a staging cluster before promoting v1.20.0 to production, given the validation and gpol behavior changes.
• Pin the Helm chart version explicitly rather than using latest to keep app/chart versions in sync.
• If you expose Kyverno controllers via image verification policies, prioritize this upgrade for the CVE-2026-50163 fix in oras-go.
• Adopt the new lifecycle Helm values (#16444) for preStop hooks if you run large clusters with frequent webhook controller restarts.