v1.18

The latest version of the 1.18 release of Enterprise Kyverno is v1.18.0-n4k.nirmata.6, released September 5, 2026.

Enterprise Kyverno 1.18 is built on upstream Kyverno 1.18 and supports Kubernetes 1.33 through 1.37. For the full support matrix, see Compatibility.

For a complete list of changes, refer to the upstream Changelog.

• v1.18.0 — April 29, 2026
• v1.18.1 — May 18, 2026
• v1.18.2 — July 10, 2026

v1.18.0-n4k.nirmata.6 — September 5, 2026

Beyond the rows above, the remaining scanner findings in this batch were cleared by the same module and toolchain bumps: the Go toolchain (1.26.3 → 1.26.7), golang.org/x/crypto (0.50.0 → 0.55.0), go-git, fulcio, rekor, golang.org/x/mod, google.golang.org/grpc (1.80.0 → 1.83.2), and oras.land/oras-go/v2 (2.6.0 → 2.6.2). All findings were Go standard library or Go module issues; the Wolfi runtime base image was not affected.

Fixes

• Stopped a reports-server watcher leak that caused an out-of-memory cascade.
• Inferred a Namespaced webhook scope for namespace-constrained wildcard policies, and backported the related namespaced-policy fixes.
• Handled missing reports CRDs as a no-op in kyverno-init so initialization no longer fails when the reports CRDs are absent.
• Granted watch on deleting policies to the licensing informers so the live policy counter stays in sync.
• Pointed the webhooks-cleanup readiness checker at the Nirmata image.

Additional changes

• Added the --apiCallBlocklist and --apiCallAllowlist flags (settable through Helm values) to control which destinations context.apiCall.service may reach; these are separate from the CEL --httpBlocklist/--httpAllowlist flags, so in-cluster ClusterIP calls keep working by default.
• Extended conformance coverage to Kubernetes 1.36 and 1.37.
• Fixed the FIPS image builds: stopped shipping the whole build context, bumped the kubectl-kyverno FIPS builder to Go 1.26.7, and mounted the private-module secret in the kubectl-kyverno FIPS build.

v1.18.0-n4k.nirmata.2 — August 17, 2026

Licensing

• Added a free community tier so open-source use runs without a commercial license.
• Enforced commercial licensing for policy capacity and commercial features.
• Set the license evaluation interval to 15 minutes.
• Included licensing fixes for enterprise deployments.

Additional changes

• Base image: bumped Go to 1.26.3 across the FIPS Dockerfiles and toolchain to pick up the latest runtime security fixes.