Releases: open-policy-agent/gatekeeper
Releases · open-policy-agent/gatekeeper
v3.12.0
This stable release has no other functional changes from v3.12.0-rc.0.
Notable changes
- 📦 New
AssignImage
mutator #2429 - 📢 Emit events in the involved objects namespace #2360
- 🥳 Update to Open Policy Agent (OPA) v0.49.2 #2611
- 🚂 Added multi-engine support to allow integration with Kubernetes CEL
ValidatingAdmissionPolicy
in the future #2616 - 👏 Enable exempt namespace suffix with
--exempt-namespace-suffix
flag #2636
Features
- Allow writing logs to custom file (#2473) #2473 (Max Smythe)
- More verbose logging for audit (#2503) #2503 (Max Smythe)
- helm: Add a network policy for the controller manager (#2514) #2514 (Kyle Michel)
- enforce kind on admission review (#2512) #2512 (alex)
- add the errorlint check for golangci-lint (#2519) #2519 (Fish-pro)
- implement AssignImage mutator (#2429) #2429 (Davis Haba)
- introduce
gci
to unify the order of package import (#2545) #2545 (Fish-pro) - add unconvert check for golang-lint (#2554) #2554 (Fish-pro)
- Emit events in the involved objects namespace (#2360) #2360 (Craig Trought)
- add support for exempt namespace suffix (#2636) #2636 (Janusz Marcinkiewicz)
Bug Fixes
- cutpath for ../ paths (#2498) #2498 (alex)
- when docker build in arm or other not amd64 env. (#2492) #2492 (yanggang)
- high-risk vulnerabilities caused by low version of kubebuilder and yq (#2505) #2505 (fsl)
- syntax errors in the document (#2520) #2520 (Fish-pro)
- updating url in doc config (#2549) #2549 (Jaydipkumar Arvindbhai Gabani)
- add --operation=mutation-controller flag (#2542) #2542 (Davis Haba)
- add vendor manifests back (#2558) #2558 (Sertaç Özercan)
- add missing namespace to static Helm templates (#2593) #2593 (Devon Crouse)
- handle empty spec for modifyset (#2585) #2585 (alex)
- piping input in gator (#2589) #2589 (alex)
- generate mock name for expanded resources (#2529) #2529 (Davis Haba)
- Allow to change WebhookConfiguration name and change preInstall crd image (#2563) #2563 (Jiri Tyr)
- support source field in Constraints (#2552) #2552 (Davis Haba)
- helm: switch to curl as ENTRYPOINT for probeWebhook (#2632) #2632 (thomasmckay)
- index readiness trackers by GK (not GVK) (#2635) #2635 (Davis Haba)
Documentation
- generate 3.11 docs (#2501) #2501 (Sertaç Özercan)
- fix syntax errors (#2513) #2513 (Nico Wang)
- Fix typo in website docs (#2528) #2528 (triangularcover)
- fix example code snippet for docs (#2539) #2539 (triangularcover)
- fix expansion yaml example (#2551) #2551 (Sertaç Özercan)
- update k8s.gcr.io to registry.k8s.io (#2588) #2588 (Rita Zhang)
- Add background information on mutation (#2387) #2387 (Max Smythe)
- Add mutation background to 3.11 (#2590) #2590 (Max Smythe)
- helm: Fix helm chart documentation for setting audit and webhook selectors and affinity (#2617) #2617 (Max Falk)
Code Refactoring
- use Go 1.18 buildinfo (#2541) #2541 (Sertaç Özercan)
Tests
- add some audit tests (#2489) #2489 (Sertaç Özercan)
Continuous Integration
- Releasing benchmarks and benchmarking PR (#2432) #2432 (Jaydipkumar Arvindbhai Gabani)
- add license lint wf for cncf approved licenses (#2461) #2461 ...
v3.12.0-rc.0
Features
- Allow writing logs to custom file (#2473) #2473 (Max Smythe)
- More verbose logging for audit (#2503) #2503 (Max Smythe)
- helm: Add a network policy for the controller manager (#2514) #2514 (Kyle Michel)
- enforce kind on admission review (#2512) #2512 (alex)
- add the errorlint check for golangci-lint (#2519) #2519 (Fish-pro)
- implement AssignImage mutator (#2429) #2429 (Davis Haba)
- introduce
gci
to unify the order of package import (#2545) #2545 (Fish-pro) - add unconvert check for golang-lint (#2554) #2554 (Fish-pro)
- Emit events in the involved objects namespace (#2360) #2360 (Craig Trought)
- add support for exempt namespace suffix (#2636) #2636 (Janusz Marcinkiewicz)
Bug Fixes
- cutpath for ../ paths (#2498) #2498 (alex)
- when docker build in arm or other not amd64 env. (#2492) #2492 (yanggang)
- high-risk vulnerabilities caused by low version of kubebuilder and yq (#2505) #2505 (fsl)
- syntax errors in the document (#2520) #2520 (Fish-pro)
- updating url in doc config (#2549) #2549 (Jaydipkumar Arvindbhai Gabani)
- add --operation=mutation-controller flag (#2542) #2542 (Davis Haba)
- add vendor manifests back (#2558) #2558 (Sertaç Özercan)
- add missing namespace to static Helm templates (#2593) #2593 (Devon Crouse)
- handle empty spec for modifyset (#2585) #2585 (alex)
- piping input in gator (#2589) #2589 (alex)
- generate mock name for expanded resources (#2529) #2529 (Davis Haba)
- Allow to change WebhookConfiguration name and change preInstall crd image (#2563) #2563 (Jiri Tyr)
- support source field in Constraints (#2552) #2552 (Davis Haba)
- helm: switch to curl as ENTRYPOINT for probeWebhook (#2632) #2632 (thomasmckay)
- index readiness trackers by GK (not GVK) (#2635) #2635 (Davis Haba)
Documentation
- generate 3.11 docs (#2501) #2501 (Sertaç Özercan)
- fix syntax errors (#2513) #2513 (Nico Wang)
- Fix typo in website docs (#2528) #2528 (triangularcover)
- fix example code snippet for docs (#2539) #2539 (triangularcover)
- fix expansion yaml example (#2551) #2551 (Sertaç Özercan)
- update k8s.gcr.io to registry.k8s.io (#2588) #2588 (Rita Zhang)
- Add background information on mutation (#2387) #2387 (Max Smythe)
- Add mutation background to 3.11 (#2590) #2590 (Max Smythe)
- helm: Fix helm chart documentation for setting audit and webhook selectors and affinity (#2617) #2617 (Max Falk)
Code Refactoring
- use Go 1.18 buildinfo (#2541) #2541 (Sertaç Özercan)
Tests
- add some audit tests (#2489) #2489 (Sertaç Özercan)
Continuous Integration
- Releasing benchmarks and benchmarking PR (#2432) #2432 (Jaydipkumar Arvindbhai Gabani)
- add license lint wf for cncf approved licenses (#2461) #2461 (alex)
- remove kubebuilder dependency (#2524) #2524 (Sertaç Özercan)
- helm: remove unused kustomize step when upgrading (#2564) #2564 (Sertaç Özercan)
- pin golang image to unblock ci (#2573) #2573 (Sertaç Özercan)
- move k8s.gcr.io to registry.k8s.io (#2572) #2572 (Sertaç Özercan)
- remove k8s 1.23 from matrix (#2609) #2609 (Sertaç Özercan)
- bump ci t...
v3.12.0-beta.0
Features
- log constraint annotations (#2464) #2464 (alex)
- helm: extra annotations for postInstall/postUpgrade jobs (#2468) #2468 (Mathieu Parent)
- allow for log-level to be independently configured (#2389) #2389 (congiv)
Bug Fixes
- audit merge errors (#2478) #2478 (Sertaç Özercan)
- include cmd/gator in native-test and fix gatortest_test.go (#2486) #2486 (Davis Haba)
- setup.Info not support format and use
%s
formatint
(#2484) #2484 (Fish-pro)
Documentation
- clarify supported k8s versions (#2475) #2475 (Sertaç Özercan)
- audit-from-cache uses the informer cache instead of opa cache (#2479) #2479 (Rita Zhang)
Continuous Integration
- fix tagged release test (#2466) #2466 (Sertaç Özercan)
- bump release timeout to 45m (#2470) #2470 (Sertaç Özercan)
Chores
- bump github/codeql-action from 2.1.36 to 2.1.37 (#2463) #2463 (dependabot[bot])
- use errors.Is to check for a specific error (#2483) #2483 (Fish-pro)
- bump oras.land/oras-go from 1.2.1 to 1.2.2 (#2480) #2480 (dependabot[bot])
- bump json5 from 2.2.1 to 2.2.3 in /website (#2494) #2494 (dependabot[bot])
- Prepare v3.12.0-beta.0 release (#2493) #2493 (github-actions[bot])
v3.11.0
This stable release has no other changes from v3.11.0-rc.1.
Notable changes
- External data is promoted to beta ✨
- 📢 It is now required to use TLS/mTLS with external data providers
- Gator CLI is promoted to beta 🐊
- Gator CLI now supports
trace
,AdmissionReview
and specifying an OCI image 🎉
Features
- add resource labels to audit logs (#2354) #2354 (davis-haba)
- expose AdmissionReview for gator verify (#2348) #2348 (alex)
- add tracing to gator test, verify (#2364) #2364 (alex)
- add --image flag in gator test|expand (#2398) #2398 (davis-haba)
Bug Fixes
- helm: allow installation of post-install and post-upgrade jobs (#2351) #2351 (Mathieu Parent)
- exclude gs namespace in matchExpressions (#2385) #2385 (Rita Zhang)
- log constraint violations on log denies (#2428) #2428 (alex)
- make gator output relative paths (#2443) #2443 (alex)
- make audit fault tolerant (#2447) #2447 (Rita Zhang)
- docs: adjust link to the mutation docs (#2445) #2445 (Tolleiv Nietsch)
- helm: do not mix ignore and podSecurity labels (#2451) #2451 (Mathieu Parent)
Documentation
- update required version for expansion and rel link for versione… (#2350) #2350 (Rita Zhang)
- search docs (#2362) #2362 (Sertaç Özercan)
- add external data provider list (#2369) #2369 (Sertaç Özercan)
- add expansion and warn to demo (#2368) #2368 (Rita Zhang)
- clairfy g8r requires user for tracing (#2358) #2358 (alex)
- adding doc to enable apiserver authentication in versioned docs (#2378) #2378 (Jaydipkumar Arvindbhai Gabani)
- rename policy library on website (#2414) #2414 (Rita Zhang)
- add library and new features to website (#2417) #2417 (Sertaç Özercan)
- gator: add addmission review doc (#2388) #2388 (alex)
Tests
Continuous Integration
- add k8s 1.26 (#2446) #2446 (Sertaç Özercan)
- bump bats to v1.8.2 🦇 (#2441) #2441 (Sertaç Özercan)
- fix tagged release test for release-3.11 (#2467) #2467 (Sertaç Özercan)
- bump release timeout to 45m (release-3.11) (#2471) #2471 (Sertaç Özercan)
Chores
- bump peaceiris/actions-gh-pages from 3.8.0 to 3.9.0 (#2356) #2356 (dependabot[bot])
- bump github/codeql-action from 2.1.28 to 2.1.29 (#2361) #2361 (dependabot[bot])
- bump @docusaurus/core from 2.1.0 to 2.2.0 in /website (#2371) #2371 (dependabot[bot])
- bump @docusaurus/preset-classic from 2.1.0 to 2.2.0 in /website (#2370) #2370 (dependabot[bot])
- Authenticating api server against webhook (#2359) #2359 (Jaydipkumar Arvindbhai Gabani)
- bump github/codeql-action from 2.1.29 to 2.1.30 (#2383) #2383 (dependabot[bot])
- bump github.com/prometheus/client_golang from 1.13.0 to 1.13.1 (#2384) #2384 (dependabot[bot])
- adding a tag to indicate dry run requests in valication request count metric (#2379) #2379 (Jaydipkumar Arvindbhai Gabani)
- bump loader-utils from 2.0.2 to 2.0.3 in /website (#2392) #2392 (dependabot[bot])
- bump github/codeql-action from 2.1.30 to 2.1.31 (#2391) #2391 (dependabot[bot])
- bump k8s.io/client-go from 0.24.7 to 0.24.8 (#2405) #2405 (dependabot[bot])
- bump github/codeql-action from 2.1.31 to 2.1.32 (#2409) #2409 (dependabot[bot])
- bump loader-utils from 2.0.3 to 2.0.4 in /website (#2411) #2411 (dependabot[bot])
- bump stefanprodan/helm-gh-pages from 1.6.0 to 1.7.0 (#2412) #2412 (dependabot[bot])
- bump github/codeql-action from 2.1.32 to 2.1.33 (#2415) #2415 ([dependabot[b...
v3.11.0-rc.1
Notable changes
- External data is promoted to beta ✨
- 📢 It is now required to use TLS/mTLS with external data providers
- Gator CLI is promoted to beta 🐊
- Gator CLI now supports
trace
,AdmissionReview
and specifying an OCI image 🎉
Features
- add resource labels to audit logs (#2354) #2354 (davis-haba)
- expose AdmissionReview for gator verify (#2348) #2348 (alex)
- add tracing to gator test, verify (#2364) #2364 (alex)
- add --image flag in gator test|expand (#2398) #2398 (davis-haba)
Bug Fixes
- helm: allow installation of post-install and post-upgrade jobs (#2351) #2351 (Mathieu Parent)
- exclude gs namespace in matchExpressions (#2385) #2385 (Rita Zhang)
- log constraint violations on log denies (#2428) #2428 (alex)
- make gator output relative paths (#2443) #2443 (alex)
- make audit fault tolerant (#2447) #2447 (Rita Zhang)
- docs: adjust link to the mutation docs (#2445) #2445 (Tolleiv Nietsch)
- helm: do not mix ignore and podSecurity labels (#2451) #2451 (Mathieu Parent)
Documentation
- update required version for expansion and rel link for versione… (#2350) #2350 (Rita Zhang)
- search docs (#2362) #2362 (Sertaç Özercan)
- add external data provider list (#2369) #2369 (Sertaç Özercan)
- add expansion and warn to demo (#2368) #2368 (Rita Zhang)
- clairfy g8r requires user for tracing (#2358) #2358 (alex)
- adding doc to enable apiserver authentication in versioned docs (#2378) #2378 (Jaydipkumar Arvindbhai Gabani)
- rename policy library on website (#2414) #2414 (Rita Zhang)
- add library and new features to website (#2417) #2417 (Sertaç Özercan)
- gator: add addmission review doc (#2388) #2388 (alex)
Tests
Continuous Integration
- add k8s 1.26 (#2446) #2446 (Sertaç Özercan)
- bump bats to v1.8.2 🦇 (#2441) #2441 (Sertaç Özercan)
- fix tagged release test for release-3.11 (#2467) #2467 (Sertaç Özercan)
Chores
- bump peaceiris/actions-gh-pages from 3.8.0 to 3.9.0 (#2356) #2356 (dependabot[bot])
- bump github/codeql-action from 2.1.28 to 2.1.29 (#2361) #2361 (dependabot[bot])
- bump @docusaurus/core from 2.1.0 to 2.2.0 in /website (#2371) #2371 (dependabot[bot])
- bump @docusaurus/preset-classic from 2.1.0 to 2.2.0 in /website (#2370) #2370 (dependabot[bot])
- Authenticating api server against webhook (#2359) #2359 (Jaydipkumar Arvindbhai Gabani)
- bump github/codeql-action from 2.1.29 to 2.1.30 (#2383) #2383 (dependabot[bot])
- bump github.com/prometheus/client_golang from 1.13.0 to 1.13.1 (#2384) #2384 (dependabot[bot])
- adding a tag to indicate dry run requests in valication request count metric (#2379) #2379 (Jaydipkumar Arvindbhai Gabani)
- bump loader-utils from 2.0.2 to 2.0.3 in /website (#2392) #2392 (dependabot[bot])
- bump github/codeql-action from 2.1.30 to 2.1.31 (#2391) #2391 (dependabot[bot])
- bump k8s.io/client-go from 0.24.7 to 0.24.8 (#2405) #2405 (dependabot[bot])
- bump github/codeql-action from 2.1.31 to 2.1.32 (#2409) #2409 (dependabot[bot])
- bump loader-utils from 2.0.3 to 2.0.4 in /website (#2411) #2411 (dependabot[bot])
- bump stefanprodan/helm-gh-pages from 1.6.0 to 1.7.0 (#2412) #2412 (dependabot[bot])
- bump github/codeql-action from 2.1.32 to 2.1.33 (#2415) #2415 (dependabot[bot])
- Verify CN name as part of client cert check while authenticating api server (#2396) #2396 ([Jaydipkumar Arvindbhai Gabani](21345e1...
v3.11.0-beta.0
Features
- Add extraEnv support to deployments (#2330) #2330 (Matthew Field)
Bug Fixes
- fix CVE-2022-32149 (#2332) #2332 (Sertaç Özercan)
- inject namespace into review data when auditing from cache (#2335) #2335 (davis-haba)
Documentation
- Updating slack community ref in footer (#2336) #2336 (Jaydipkumar Arvindbhai Gabani)
- update audit userinfo (#2340) #2340 (Rita Zhang)
- Change mutation to Stable (#2308) #2308 (Max Smythe)
Styles
Performance Improvements
- Upgrade constraint framework to v0.8.0 (#2317) #2317 (Max Smythe)
- unset CPU limit (#2326) #2326 (alex)
- set mem request and limit to the same value (#2327) #2327 (alex)
Continuous Integration
- bump trivy to 0.32.1 (#2312) #2312 (Sertaç Özercan)
- update set-output usage (#2337) #2337 (Stephan Renatus)
Chores
- bump github/codeql-action from 2.1.26 to 2.1.27 (#2320) #2320 (dependabot[bot])
- bump stefanprodan/helm-gh-pages from 1.5.0 to 1.6.0 (#2321) #2321 (dependabot[bot])
- bump actions/checkout from 3 to 3.1.0 (#2323) #2323 (dependabot[bot])
- bump k8s.io/client-go from 0.24.6 to 0.24.7 (#2343) #2343 (dependabot[bot])
- Adding version info for gk, opa, and frameworks in gator cmd (#2338) #2338 (Jaydipkumar Arvindbhai Gabani)
- bump github/codeql-action from 2.1.27 to 2.1.28 (#2346) #2346 (dependabot[bot])
- Prepare v3.11.0-beta.0 release (#2349) #2349 (github-actions[bot])
v3.10.0
Notable changes
- If you are using Kubernetes v1.25 or later, this release includes removal of Pod Security Policies and migration to Pod Security Admission 🔐
- Mutation is promoted to stable 🦠
- Introducing Validation of Workload Resources as alpha 🚀
- Performance improvements 🏃
Features
- Promote mutation to v1 (#2305) #2305 (Max Smythe)
- Expose options to allow injection of external certificates (#2249) #2249 (Ethan Range)
- Expanding generator resources (#2062) #2062 (davis-haba)
- Return violating resource in pkg/gator/test.Test (#2198) #2198 (Julian Katz)
- Add controllerManager tlsMinVersion option to values (#2289) #2289 (Grace Do)
- Add metric reporting to ExpansionTemplate controller (#2276) #2276 (davis-haba)
- enforcement action override for ExpansionTemplates (#2277) #2277 (davis-haba)
- helm: add topologySpread to controller (#2206) #2206 (Viktor Oreshkin)
- helm: unify and extend hook job pod labels (#2205) #2205 (Viktor Oreshkin)
- helm: add options for hook jobs (#2202) #2202 (Viktor Oreshkin)
- helm: Allow configuration of probe timeouts in Helm Chart (#2220) #2220 (Ethan Range)
- helm: Allow setting annotations for mutating and validating webhook configurations (#2231) #2231 (Ethan Range)
- add audit_last_run_end_time metric (#2235) #2235 (Viktor Oreshkin)
- Add --host as a command line flag (#2227) #2227 (Max Smythe)
- remove PSP and migrate to PSA (#2174) #2174 (Sertaç Özercan)
Bug Fixes
- Ignore all stackdriver errors if --stackdriver-only-when-available is set (#2304) #2304 (Max Smythe)
- fix CVE-2022-27664 (#2310) #2310 (Sertaç Özercan)
- Namespace should be nil for audited cluster-scoped resources (#2243) #2243 (Max Smythe)
- skip empty k8s resources (#2247) #2247 (qa-ship-it)
- helm: Fix "Label exempted namespaces" (#2246) #2246 (Mathieu Parent)
- helm upgrade test (#2263) #2263 (Sertaç Özercan)
- Change 'securityContext/capabilities/drop' from 'all' to 'ALL'. (#2273) #2273 (BoatMisser)
- helm: Fix "Label exempted namespaces" (#2290) #2290 (Zhimin Xiang)
- update website/versions.json (#2175) #2175 (Ernest Wong)
- chart always use v1beta1 as pdb api version (#2164) #2164 (Mingfei Huang)
- Set spec.hard.pod value to string (#1928) #1928 (Ahmed)
- document mutations name matcher (#2168) #2168 (Nicholas Blott)
- helm: helm chart updates for disabling psp and default api for poddisruptionbudget (#2187) #2187 (Boojapho)
- helm: explicitly specify curl in probeWebhook (#2207) #2207 (Viktor Oreshkin)
- Docker related Makefile improvements (#2209) #2209 (Viktor Oreshkin)
- Only set ConstraintTemplate's status.created on success (#2208) #2208 (Viktor Oreshkin)
- sed on specific tag in
make release-manifest
(#2153) #2153 (Ernest Wong) - make audit more fault tolerant, log error instead of skipping update (#2162) #2162 (Rita Zhang)
Documentation
- Update default auditChunkSize in readme (#2303) #2303 (Simeon Bobylev)
- enforcement action override in ExpansionTemplate (#2300) #2300 (davis-haba)
- update feature state for alpha and beta things (#2260) #2260 (Rita Zhang)
- add brew install instructions to gator docs (#2255) #2255 (Xander Grzywinski)
- Update library links to point to website (#2264) #2264 (Max Smythe)
- Update contributing guide (#2275) #2275 (Rita Zhang)
- documentation for generator resource expansion feature (#2229) [#2229](https://github.com/open-policy-agen...
v3.10.0-rc.2
Performance Improvements
- Upgrade constraint framework to v0.8.0 (#2319) #2319 (Max Smythe)
Chores
- Prepare v3.10.0-rc.1 release (#2313) #2313 (github-actions[bot])
- Prepare v3.10.0-rc.2 release (#2325) #2325 (github-actions[bot])
v3.9.2
Performance Improvements
- Upgrade constraint framework to v0.8.0 (#2318) #2318 (Max Smythe)
Chores
- Prepare v3.9.2 release (ritazh)
v3.9.1
Bug Fixes
- Automated cherry pick of #2272: perf: Upgrade Constraint Framework to v0.7.0 (#2299) #2299 (Rita Zhang)
- fix CVE-2022-27664 (#2316) #2316 (Sertaç Özercan)
Chores
- Prepare v3.9.1 release (#2315) #2315 (github-actions[bot])