CARVIEW |
Navigation Menu
-
Notifications
You must be signed in to change notification settings - Fork 805
Releases: open-policy-agent/gatekeeper
v3.21.0-beta.0
62f8921
Compare
Bug Fixes
- increase webhook latency buckets up to 10 seconds (#4037) #4037 (David Blum)
- removing readinessprobe for webhook at start of the pod (#4059) #4059 (Jaydip Gabani)
Chores
- bump golang from
ee7ff13
to10f549d
in /test/export/fake-reader (#4046) #4046 (dependabot[bot]) - bump the all group with 2 updates (#4044) #4044 (dependabot[bot])
- bump golang from
ee7ff13
to10f549d
in /test/export/fake-subscriber (#4045) #4045 (dependabot[bot]) - bump golang from
10f549d
to69adc37
in /test/export/fake-subscriber (#4053) #4053 (dependabot[bot]) - bump golang from
10f549d
to69adc37
in /test/export/fake-reader (#4052) #4052 (dependabot[bot]) - Patch docs for 3.19.3 release (#4056) #4056 (github-actions[bot])
- bump the all group across 1 directory with 2 updates (#4066) #4066 (dependabot[bot])
- bump kubectl from v1.33.2 to v1.33.3 (#4063) #4063 (dependabot[bot])
- bump the k8s group with 5 updates (#4062) #4062 (dependabot[bot])
- Prepare v3.21.0-beta.0 release (#4068) #4068 (github-actions[bot])
Assets 7
v3.20.0
f42e229
Compare
Notable Changes
- 💾 A new driver to export violations on disk.
- 🎓 VAP integration is beta and enabled by default, hence VAP/VAPB resources will be generated by default for CT/C with
K8sNativeValidation
engine withCEL
code. - 🔗 A new
Connection
CRD replacedConfigMap
in order to establish connections with export backends.
Features
- mapping dryrun to audit in vapb (#3915) #3915 (Jaydip Gabani)
- adding driver to export to disk (#3832) #3832 (Jaydip Gabani)
- Graduating VAP generation to beta (#3995) #3995 (Jaydip Gabani)
- Export Connection CR (#3999) #3999 (Noah Reisch)
Bug Fixes
- removing readinessprobe for webhook at start of the pod (#4059) (#4065) #4065 (Jaydip Gabani)
- only enabling CEL driver with flag value (#3900) #3900 (Jaydip Gabani)
- error on deleting GK resources when delete operation is enabled (#3921) #3921 (Jaydip Gabani)
- scope of webhook configurations (#3676) #3676 (plavy)
- making sure latest CT version is updated in CT controller to avoid writing errors (#3983) #3983 (Jaydip Gabani)
- add RBAC for finalizers when running with OwnerReferencesPermissionEnforcement admission plugin (#3961) #3961 (Jaydip Gabani)
- unreliable webhook behaviour on gatekeeper pod startup and shutdown (#3780) #3780 (Benjamin Ritter)
- removing connection from map before closing it to avoid locking on latest connection update (#3946) #3946 (Jaydip Gabani)
- making sure VAPB is only deleted for constraints if it was enabled (#4034) #4034 (Jaydip Gabani)
- disk export path to handle dir deletes (#4021) #4021 (Noah Reisch)
Documentation
- adding opa v1 docs and tests (#3908) #3908 (Jaydip Gabani)
- adding available variables and updating faq (#3927) #3927 (Jaydip Gabani)
- Add Flags Reference (#3782) #3782 (Ian Stanton)
Continuous Integration
- bumping k8s version in testing and crd.Dockerfile (#3925) #3925 (Jaydip Gabani)
- release checklist (#3990) #3990 (Sertaç Özercan)
Chores
- Prepare v3.20.0 release (#4067) #4067 (github-actions[bot])
- bump golang from
75e6700
to00eccd4
in /test/externaldata/dummy-provider (#3914) #3914 (dependabot[bot]) - bump golang from
75e6700
to00eccd4
in /test/image (#3913) #3913 (dependabot[bot]) - bump the all group with 2 updates (#3912) #3912 (dependabot[bot])
- bump golang from
75e6700
to00eccd4
(#3911) #3911 (dependabot[bot]) - bump golang from
75e6700
to00eccd4
in /build/tooling (#3910) #3910 (dependabot[bot]) - Add
pods/resize
subresource to mutating and validating webhooks (#3778) #3778 (Ian Stanton) - bump golang.org/x/net from 0.37.0 to 0.38.0 (#3920) #3920 (dependabot[bot])
- bump codecov/codecov-action from 5.4.0 to 5.4.2 in the all group (#3924) #3924 (dependabot[bot])
- bump http-proxy-middleware from 2.0.7 to 2.0.9 in /website (#3922) #3922 (dependabot[bot])
- adding helm variable for mutating subresources (#3916) #3916 (Jaydip Gabani)
- Patch docs for 3.19.1 release (#3937) #3937 (github-actions[bot])
- Patch docs for 3.18.3 release (#3938) #3938 (github-actions[bot])
- bump the all group with 2 updates (#3940) #3940 (dependabot[bot])
- bump the k8s group with 5 updates (#3939) #3939 (dependabot[bot])
- removing gator test alpha note from
gator test --help
(#3943) #3943 (Martin Alexander) - bump the all group with 2 updates (#3951) #3951 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-reader (#3955) #3955 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm (#3957) #3957 (dependabot[bot])
- bump actions/upload-artifact from 4.6.0 to 4.6.2 in the all group (#3959) #3959 (dependabot[bot])
...
Assets 7
v3.20.0-rc.1
96a4db0
Compare
Bug Fixes
- removing readinessprobe for webhook at start of the pod (#4059) (#4065) #4065 (Jaydip Gabani)
Assets 7
v3.19.3
e06a511
Compare
Bug Fixes
- making sure VAPB is only deleted for constraints if it was enabled (#4034) (#4039) #4039 (Jaydip Gabani)
Chores
- Prepare v3.19.3 release (#4054) #4054 (github-actions[bot])
Assets 7
v3.20.0-rc.0
7833120
Compare
Features
- mapping dryrun to audit in vapb (#3915) #3915 (Jaydip Gabani)
- adding driver to export to disk (#3832) #3832 (Jaydip Gabani)
- Graduating VAP generation to beta (#3995) #3995 (Jaydip Gabani)
- Export Connection CR (#3999) #3999 (Noah Reisch)
Bug Fixes
- only enabling CEL driver with flag value (#3900) #3900 (Jaydip Gabani)
- error on deleting GK resources when delete operation is enabled (#3921) #3921 (Jaydip Gabani)
- scope of webhook configurations (#3676) #3676 (plavy)
- making sure latest CT version is updated in CT controller to avoid writing errors (#3983) #3983 (Jaydip Gabani)
- add RBAC for finalizers when running with OwnerReferencesPermissionEnforcement admission plugin (#3961) #3961 (Jaydip Gabani)
- unreliable webhook behaviour on gatekeeper pod startup and shutdown (#3780) #3780 (Benjamin Ritter)
- removing connection from map before closing it to avoid locking on latest connection update (#3946) #3946 (Jaydip Gabani)
- making sure VAPB is only deleted for constraints if it was enabled (#4034) #4034 (Jaydip Gabani)
- disk export path to handle dir deletes (#4021) #4021 (Noah Reisch)
Documentation
- adding opa v1 docs and tests (#3908) #3908 (Jaydip Gabani)
- adding available variables and updating faq (#3927) #3927 (Jaydip Gabani)
- Add Flags Reference (#3782) #3782 (Ian Stanton)
Continuous Integration
- bumping k8s version in testing and crd.Dockerfile (#3925) #3925 (Jaydip Gabani)
- release checklist (#3990) #3990 (Sertaç Özercan)
Chores
- bump golang from
75e6700
to00eccd4
in /test/externaldata/dummy-provider (#3914) #3914 (dependabot[bot]) - bump golang from
75e6700
to00eccd4
in /test/image (#3913) #3913 (dependabot[bot]) - bump the all group with 2 updates (#3912) #3912 (dependabot[bot])
- bump golang from
75e6700
to00eccd4
(#3911) #3911 (dependabot[bot]) - bump golang from
75e6700
to00eccd4
in /build/tooling (#3910) #3910 (dependabot[bot]) - Add
pods/resize
subresource to mutating and validating webhooks (#3778) #3778 (Ian Stanton) - bump golang.org/x/net from 0.37.0 to 0.38.0 (#3920) #3920 (dependabot[bot])
- bump codecov/codecov-action from 5.4.0 to 5.4.2 in the all group (#3924) #3924 (dependabot[bot])
- bump http-proxy-middleware from 2.0.7 to 2.0.9 in /website (#3922) #3922 (dependabot[bot])
- adding helm variable for mutating subresources (#3916) #3916 (Jaydip Gabani)
- Patch docs for 3.19.1 release (#3937) #3937 (github-actions[bot])
- Patch docs for 3.18.3 release (#3938) #3938 (github-actions[bot])
- bump the all group with 2 updates (#3940) #3940 (dependabot[bot])
- bump the k8s group with 5 updates (#3939) #3939 (dependabot[bot])
- removing gator test alpha note from
gator test --help
(#3943) #3943 (Martin Alexander) - bump the all group with 2 updates (#3951) #3951 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-reader (#3955) #3955 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm (#3957) #3957 (dependabot[bot])
- bump actions/upload-artifact from 4.6.0 to 4.6.2 in the all group (#3959) #3959 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/externaldata/dummy-provider (#3958) #3958 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-subscriber (#3956) #3956 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /build/tooling (#3954) #3954 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/image (#3953) #3953 ([...
Assets 7
v3.19.2
3477fb7
Compare
⚠ Warning: Operation generate is now required to guard CRD and VAP/VAPB generation. Please update your singleton deployment (e.g. gatekeeper-audit) to include --operation=generate. If you are not using audit, you need to add it to the controller manager deployment. https://open-policy-agent.github.io/gatekeeper/website/docs/operations/#generation
Chores
- bump opa to 1.5.1 and kubectl to 1.33.1 (#4001) #4001 (Jaydip Gabani)
- Prepare v3.19.2 release (#4011) #4011 (github-actions[bot])
Assets 7
v3.19.1
e80df6c
Compare
⚠ Warning: Operation generate
is now required to guard CRD and VAP/VAPB generation. Please update your singleton deployment (e.g. gatekeeper-audit) to include --operation=generate
. If you are not using audit, you need to add it to the controller manager deployment. https://open-policy-agent.github.io/gatekeeper/website/docs/operations/#generation
Bug Fixes
- error on deleting GK resources when delete operation is enabled CP(#3921) (#3929) #3929 (Jaydip Gabani)
Continuous Integration
- bumping k8s version in testing and crd.Dockerfile CP(#3925) (#3933) #3933 (Jaydip Gabani)
Chores
- Prepare v3.19.1 release (#3934) #3934 (github-actions[bot])
Assets 7
v3.18.3
5be06a9
Compare
⚠ Warning: Operation generate
is now required to guard CRD and VAP/VAPB generation. Please update your singleton deployment (e.g. gatekeeper-audit) to include --operation=generate
. If you are not using audit, you need to add it to the controller manager deployment. https://open-policy-agent.github.io/gatekeeper/website/docs/operations/#generation
Bug Fixes
Chores
- Prepare v3.18.3 release (#3936) #3936 (github-actions[bot])
Assets 7
v3.20.0-beta.0
aeadb70
Compare
Bug Fixes
- updating golang version in subscriber dockerfile (#3876) #3876 (Jaydip Gabani)
Continuous Integration
- cleaning up disk in release workflow to avoid running out of space (#3877) #3877 (Jaydip Gabani)
Chores
- bumping opa to 1.3.0 from 1.2.0 (#3882) #3882 (Jaydip Gabani)
- bump kubectl from v1.32.2 to v1.32.3 (#3890) #3890 (dependabot[bot])
- bump crate-ci/typos from 1.30.3 to 1.31.0 in the all group (#3888) #3888 (dependabot[bot])
- bump distroless/static-debian12 from
95ea148
to3d0f463
in /test/externaldata/dummy-provider (#3886) #3886 (dependabot[bot]) - bump distroless/static-debian12 from
95ea148
to3d0f463
(#3889) #3889 (dependabot[bot]) - bumping protobuf and fixing lint memory issue in GH runner (#3893) #3893 (Jaydip Gabani)
- bump google.golang.org/grpc from 1.71.0 to 1.71.1 (#3899) #3899 (dependabot[bot])
- bump the all group with 3 updates (#3894) #3894 (dependabot[bot])
- bump golang from
fa1a01d
to75e6700
(#3898) #3898 (dependabot[bot]) - bump golang from
fa1a01d
to75e6700
in /test/image (#3897) #3897 (dependabot[bot]) - bump golang from
fa1a01d
to75e6700
in /build/tooling (#3896) #3896 (dependabot[bot]) - bump golang from
fa1a01d
to75e6700
in /test/externaldata/dummy-provider (#3895) #3895 (dependabot[bot]) - Prepare v3.20.0-beta.0 release (#3904) #3904 (github-actions[bot])
Assets 7
v3.19.0
4e1ed0d
Compare
⚠ Warning: Operation generate
is now required to guard CRD and VAP/VAPB generation. Please update your singleton deployment (e.g. gatekeeper-audit) to include --operation=generate
. If you are not using audit, you need to add it to the controller manager deployment. https://open-policy-agent.github.io/gatekeeper/website/docs/operations/#generation
Notable Changes
- 🛡️OPA rego v1 syntax is available in Gatekeeper ConstraintTemplates. Find out more here.
- 📤Updated Pub/Sub mechanism to generalized export mechanism to enable additional backends such as disk to export violations.
Features
- feat: gator test --deny-only flag (#3809) (Steeve)
- feat: Update Rego driver to support rego.v1 (#3873)(Charlie Egan]
Bug Fixes
- adding a comment to clean up disk space in runner (CP: 3877) (#3878) #3878 (Jaydip Gabani)
- Add flag to enable/disable referential constraints (#3701) (David Lee)
- bumping frameworks to fix GO-2025-3372 (#3810) (Jaydip Gabani)
- fixing nil pointer error when converting VAPB from v1beta1 to v1 (#3754) (Jaydip Gabani)
- parse namespace from oldObject when processing a DELETE operation (#3837) (Clément Nussbaumer)
- replace plus character with underscore in version label (#3742) (Filippo Rossi)
Documentation
- Add connect to operations (#3785) (Martin Alexander)
- Use markdown emphasize-syntax in demo documentation (#3786) (Sascha)
- addressing deny-only gator flag nits (#3870) (Jaydip Gabani)
Chores
- Prepare v3.19.0 release (#3903) #3903 (github-actions[bot])
- Prepare v3.19.0-rc.1 release (#3879) #3879 (github-actions[bot])
- update curlimages/curl to v8.12.0 (#3817) (Thomas Berreis)
- adding FAQs for multi-engine (#3761) (Jaydip Gabani)
- adding annotation to generate VAPB right away once the waiting window is over to protect against clock skews (#3773) (Jaydip Gabani)
- adding warning for alpha flags (#3764) (Jaydip Gabani)
- bump @babel/helpers from 7.17.8 to 7.26.10 in /website (#3856) (dependabot[bot])
- bump @babel/runtime from 7.18.6 to 7.26.10 in /website (#3855) (dependabot[bot])
- bump @babel/runtime-corejs3 from 7.18.6 to 7.26.10 in /website (#3848) (dependabot[bot])
- bump distroless/static-debian12 from
3f2b64e
to95ea148
(#3866) (dependabot[bot]) - bump distroless/static-debian12 from
3f2b64e
to95ea148
in /test/externaldata/dummy-provider (#3865) (dependabot[bot]) - bump distroless/static-debian12 from
5c7e2b4
to3f2b64e
in /test/externaldata/dummy-provider (#3775) (dependabot[bot]) - bump distroless/static-debian12 from
f4a57e8
to3f2b64e
(#3774) (dependabot[bot]) - bump distroless/static-debian12 from
f4a57e8
to5c7e2b4
in /test/externaldata/dummy-provider (#3721) (dependabot[bot]) - bump frameworks and kube dep to 1.32.3 (#3873) (Jaydip Gabani)
- bump github.com/containerd/containerd from 1.7.25 to 1.7.27 (#3857) (dependabot[bot])
- bump github.com/golang/glog from 1.2.1 to 1.2.4 (#3802) (dependabot[bot])
- bump github.com/onsi/gomega from 1.34.1 to 1.34.2 (#3523) (dependabot[bot])
- bump github/codeql-action from 3.28.8 to 3.28.9 in the all group (#3813) (dependabot[bot])
- bump golang from 1.23-bookworm to 1.24-bookworm (#3821) (dependabot[bot])
- bump golang from 1.23-bookworm to 1.24-bookworm in /build/tooling (#3823) (dependabot[bot])
- bump golang from 1.23-bookworm to 1.24-bookworm in /test/externaldata/dummy-provider (#3824) (dependabot[bot])
- bump golang from 1.23-bookworm to 1.24-bookworm in /test/image (#3825) (dependabot[bot])
- bump golang from
2e83858
to3149bc5
(#3793) (dependabot[bot]) - bump golang from
2e83858
to3149bc5
in /test/externaldata/dummy-provider (#3794) (dependabot[bot]) - bump golang from
2e83858
to3149bc5
in /test/image (#3791) (dependabot[bot]) - bump golang from
3149bc5
to441f59f
(#3812) (dependabot[bot]) - bump golang from
3149bc5
to441f59f
in /build/tooling (#3811) (dependabot[bot]) - bump golang from
3149bc5
to441f59f
in /test/externaldata/dummy-provider (#3815) (dependabot[bot]) - bump golang from
3149bc5
to441f59f
in /test/image (#3814) (dependabot[bot]) - bump golang from
3f3b9da
toef30001
(#3727) (dependabot[bot]) - bump golang from
3f3b9da
toef30001
in /build/tooling (#3726) (dependabot[bot]) - bump golang from
3f3b9da
toef30001
in /test/externaldata/dummy-provider (#3730) (dependabot[bot]) - bump golang from
6260304
tob970e6d
in /build/tooling (#3834) (dependabot[bot]) - bump golang from
6260304
tob970e6d
in /test/image (#3835) (dependabot[bot]) - bump golang from
b970e6d
tod7d795d
(#3844) (dependabot[bot]) - bump golang from
b970e6d
tod7d795d
in /build/tooling (#3841) (dependabot[bot]) - bump golang from
b970e6d
tod7d795d
in /test/externaldata/dummy-provider (#3843) (dependabot[bot]) - b...