Jim Bugwadia

Hi @pealtrufo - I see. @patelrit - did you try configuring the IAM role for the service account?

@pealtrufo - there were some recent updates in this area: See: https://github.com/kyverno/kyverno/issues/3019. Can you please try again with 1.6 and let us know? We can then update the docs as...

@pealtrufo have you tried running the job as a workaround as documented by @patelrit? I am not sure how Kyverno can be configured to do this automatically. We can investigate...

@chipzoller @praddy26 - this fix will require (potentially breaking) schema changes. My suggestion would be to move `attestations` into `attestors` - currently they are at the same level. We may...

@praddy26 - thanks for volunteering to pick this up, really appreciate the contributions and help! As a next step, can you please summarize and list the changes required to implement...

Thanks @prateekpandey14! Is there something we can do to improve the user experience here?

@prateekpandey14 - in this case did the API call return an error or just an empty list?

Adding an error log would help, but it would better to report a policy error to the user. Is the API call performed when the UR is created or when...

Here is another error for generate that does not show up in the default logs: ```sh I1009 05:45:43.111054 1 background.go:112] Generation "msg"="cannot add external data to the context" "kind"="Secret" "name"="cluster3-kubeconfig"...

Hi @obaranov1 - thanks for looking into this! To allow the `image` variable to be used, we will need to update the policy validation check here: https://github.com/kyverno/kyverno/blob/8a0083105d11181d17b312364496ecbe3d2b74e8/pkg/policy/validate.go#L511 We can add...