Update module github.com/kyverno/kyverno to v1.13.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/kyverno/kyverno	v1.12.6 -> v1.13.0

GitHub Vulnerability Alerts

CVE-2024-48921

Summary

A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace.

Details

By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions.

PoC

1. Administrator creates "disallow-privileged-containers" ClusterPolicy that applies to resources in the namespace "ubuntu-restricted"
2. Cluster user creates a PolicyException object for "disallow-privileged-containers" in namespace "ubuntu-restricted"
3. Cluster user creates a pod with a privileged container in "ubuntu-restricted"
4. Cluster user escalates to root on the node from the privileged container

Impact

Administrators attempting to enforce cluster security through kyverno policies, but that allow less privileged users to create resources

---

Release Notes

kyverno/kyverno (github.com/kyverno/kyverno)

v1.13.0

Compare Source

Note

• Removed deprecated flag reportsChunkSize.
• Added --tufRootRaw flag to pass tuf root for custom sigstore deployments.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.