shuting

@chetak123 - are you actively working on this??

I'm closing this PR. Please refer to this page for performance benchmarking: https://github.com/kyverno/kyverno/wiki/Performance-Benchmarking

Hi @zurrehma - thanks for the work! However we are getting this error while [singing provenance](https://github.com/kyverno/kyverno/actions/runs/3346128691/jobs/5542625443): ``` Error: signing ghcr.io/kyverno/kyverno@: parsing reference: could not parse reference: ghcr.io/kyverno/kyverno@ main.go:62: error during...

What's the best way to replicate the issue? There was a new container flag `--renewBefore` introduced in 1.12: "The certificate renewal time before expiration", @MariamFahmy98 - can we leverage it...

Chainsaw tests are needed.

> That would only solve the autogen use case but there could be others. Not sure an auto-expansion is the right approach. Would be curious to get others' opinions here....

Discussed in the community meeting today, we want to be restricted on the default exclusions and reply on users to add exceptions for pod controllers' rules.

And moving away from wildcard is a breaking change, should we bump the apiversion to v2beta2?

How many replicas of the admission controller were running? You may need to adjust the replicas number and qps/burst ([clientRateLimitQPS /clientRateLimitBurst](https://kyverno.io/docs/installation/customization/#container-flags)), here's the scaling test data performed against 1.11.x admission...

@exklamationmark @cwstrommer - can you verify the issue with the latest v1.12.1-rc.1 release? We have tested 10k pods creations on 100 nodes with server-side dry run and didn't see any...