Gatekeeper

Bug Fixes

• Make generated VAP deterministic to stop reconcile loop (CP #4640) (#4792) #4792 (abhisheksheth28)
• Surface namespace cache errors and avoid redundant VAP status updates (CP #4656, CP #4703) (#4795) #4795 (abhisheksheth28)
• Add default failure policy for K8sNativeValidation templates (CP #4568) (#4796) #4796 (abhisheksheth28)
• Prevent generated VAP update churn from defaulted scope (#4793) CP (#4794) #4794 (Anlan Du)

Chores

• Backport security updates for v3.23.1 (#4791) #4791 (abhisheksheth28)

Dependencies

• Bump go.opentelemetry.io/otel to from v1.43.0 to v1.44.0 (CP #4652) (#4653) #4653 (abhisheksheth28)
• Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 (CP #4647) (#4664) #4664 (abhisheksheth28)
• Bump golang from 68b7145 to 1164890 (CP #4665) (#4666) #4666 (abhisheksheth28)

Bug Fixes

• Update runner for release workflow (CP #4636) (#4638) #4638 (abhisheksheth28)

Features

• Mark semantic log lines with structured field (#4482) #4482 (Ogulcan Aydogan)
• Implemented status resource routing for remote cluster mode (#4579) #4579 (abhisheksheth28)
• Add operations field to mutation ApplyTo spec (#4135) #4135 (Sai Kiran Pikili)

Bug Fixes

• Update runner for release workflow (CP #4636) (#4638) #4638 (abhisheksheth28)
• Allow mutation-webhook only operation without constraint client (#4423) #4423 (Alan Diaz)
• Retry VAP API discovery on transient failures (#4455) #4455 (Jaydip Gabani)
• Share StatsReporter across mutator controllers (#4465) #4465 (Jaydip Gabani)
• Unexport SupportedDrivers to enforce mutex-protected access (#4468) #4468 (Raajhesh Kannaa Chidambaram)
• Migrate OCI pulls to oras-go v2 (#4489) #4489 (Jaydip Gabani)
• Restore mutator conflict propagation via events channel (#4478) #4478 (Jaydip Gabani)
• Clean up stale VAPB when vap.k8s.io removed from constraint (#4446) #4446 (Jaydip Gabani)
• Propagate caller context in System.Publish (#4508) #4508 (Vedant Madane)
• audit: Keep export publish state updates across helpers (#4500) #4500 (Sertaç Özercan)
• Reject negative maxAuditResults in disk exporter config (#4506) #4506 (Sertaç Özercan)
• export: Synchronize disk cleanup map access in CloseConnection (#4505) #4505 (Sertaç Özercan)
• Cap gator Rego print buffering to prevent unbounded memory growth (#4503) #4503 (Sertaç Özercan)
• Avoid externaldata provider status reconcile loop (#4504) #4504 (Sertaç Özercan)
• Restore TLS readiness gate for webhook server (#4502) #4502 (Sertaç Özercan)
• Gh cli to support immutable releases (#4522) #4522 (abhisheksheth28)
• ci: Cve golang/net (#4562) #4562 (Nolan Emirot)
• Allow overlength status.gatekeeper.sh names in admission validation (#4529) #4529 (Copilot)
• Quote webhook exempt label values (#4557) #4557 (Zakhar Dvurechensky)
• Avoid ConstraintPodStatus update churn during VAPB generation wait (#4599) #4599 (Jaydip Gabani)
• Preserve admission operation for expanded reviews (#4560) #4560 (Zakhar Dvurechensky)
• Allow root file catalog content paths (#4583) #4583 (Immanuel Tikhonov)

Documentation

• Add Adoption and Integration section to website homepage (#4454) #4454 (Jaydip Gabani)
• Adding DELETE operation context for VAP integration (#4421) #4421 (Jaydip Gabani)
• Clarify validation and mutation scope (#4556) #4556 (Zakhar Dvurechensky)
• Guidance around how to safely disable audit #4483 (#4582) #4582 (Mallikarjuna Muchu)

Tests

• Add t.Parallel() to pkg/gator unit tests (#4610) #4610 (Ogulcan Aydogan)

Continuous Integration

• Publish fake-reader and fake-subscriber images to GHCR (#4408) #4408 (abhisheksheth28)
• Fix Slack meeting reminder schedule (#4584) #4584 (Jaydip Gabani)
• Fix license-lint checkout order (#4627) #4627 (Jaydip Gabani)
• Check out release PR workflow before Go setup (#4634) #4634 (Jaydip Gabani)

Dependencies

• Bump go.opentelemetry.io/otel to from v1.43.0 to v1.44.0 (CP #4652) (#4653) #4653 (abhisheksheth28)
• Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 (CP #4647) (#4664) #4664 (abhisheksheth28)
• Bump golang from 68b7145 to 1164890 (CP #4665) (#4666) #4666 (abhisheksheth28)
• Bump the k8s group with 5 updates (#4412) #4412 (dependabot[bot])
• Bump golang from 889885d to 100774d in /build/tooling (#4413) #4413 (dependabot[bot])
• Bump golang from 889885d to 100774d in /test/image (#4414) #4414 (dependabot[bot])
• Bump golang from 889885d to 100774d (#4415) [#4415](https://github.com/open-policy-agent

…(truncated)

Bug Fixes

• Gh cli to support immutable releases (CP #4522) (#4541) #4541 (abhisheksheth28)

⚠️ v3.22.1 had a failure while publishing release artifacts. Please make sure to use v3.22.2 release instead.

Bug Fixes

• allow mutation-webhook only operation without constraint client … (#4453) #4453 (Alan Diaz)
• migrate OCI pulls to oras-go v2 CP(4489) (#4494) #4494 (Jaydip Gabani)
• retry VAP API discovery on transient failures CP(#4455) (#4485) #4485 (Jaydip Gabani)
• share StatsReporter across mutator controllers CP (#4465) (#4487) #4487 (Jaydip Gabani)
• restore mutator conflict propagation via events channel (CP #4478) (#4496) #4496 (Jaydip Gabani)
• clean up stale VAPB when vap.k8s.io removed from constraint (CP #4446) (#4507) #4507 (Jaydip Gabani)

Chores

• bumping on sha that pins deps to full commit (cherry-pick to release-3.22) (#4486) #4486 (Jaydip Gabani)
• bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#4488) #4488 (Jaydip Gabani)
• bump kubectl from v1.35.2 to v1.35.3 (CP #4458) (#4497) #4497 (Jaydip Gabani)
• bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.40.0 to 1.43.0 (CP #4499) (#4516) #4516 (abhisheksheth28)
• Prepare v3.22.1 release (#4517) #4517 (github-actions[bot])

🚀 Notable Changes

• ✅ sync-vap-enforcement-scope now enabled by default: The flag for syncing ValidatingAdmissionPolicy enforcement scope is now true by default, ensuring VAP resources reflect constraint enforcement actions out of the box (#4332).
• 🏷️ Namespace support for CEL and Rego engines: CEL expressions can now access namespaceObject and Rego policies can access input.namespace for namespace-scoped policy decisions during both admission and audit (#4285)
• ⚡ gator bench — policy performance benchmarking: New CLI command to benchmark Rego and CEL engines with latency percentiles, throughput metrics, memory profiling, concurrent load testing, and baseline comparison for CI/CD regression detection (#4287)
• 📋 gator policy — brew-inspired policy management: New CLI for discovering, installing, upgrading, and uninstalling policies from the gatekeeper-library with support for bundles (e.g., pod-security-baseline), enforcement overrides, and dry-run previews (#4331)
• 🔇 Disable audit sidecar support: Users who have their own log monitoring (e.g., OTel collector) can now disable the forced fake-reader sidecar when audit file-based logging is enabled (#4280)
• 🌐 Out-of-cluster / remote cluster support: New --enable-remote-cluster flag allows Gatekeeper to run outside the target cluster (e.g., nested/hosted control planes), fixing a crash when the Gatekeeper pod doesn't exist in the managed cluster (#4368)
• ⏱️ External data provider timeout enforcement: Mutation-path requests to external data providers now enforce the provider's configured timeout (default 5s), preventing unbounded requests that could outlive the webhook timeout and cause resource exhaustion (#4351)

Features

• Support disabling audit sidecar (#4280) #4280 (Jorge Turrado Ferrero)
• add namespace support for CEL and Rego engines (#4285) #4285 (Jaydip Gabani)
• Support metrics backend configuration options to helm chart (#4282) #4282 (Jorge Turrado Ferrero)
• set sync-vap-enforcement-scope flag to true (#4332) #4332 (abhisheksheth28)
• support print statement in gator (#2949) (#3872) #3872 (Julian)
• add gator bench command for policy performance benchmarking (#4287) #4287 (Sertaç Özercan)
• gator policy (#4331) #4331 (Sertaç Özercan)

Bug Fixes

• Refactor retries for disk driver failed connection removal to be exponential. (#4257) #4257 (devivasudevan)
• remove deprecated spec.preserveUnknownFields (#4276) #4276 (Mohamed Meskine)
• updating expansion templates to add owner ref in expanded resources (#4262) #4262 (Jaydip Gabani)
• chart: Merge namespace exemption labels to fix GKE recommendation (#4348) #4348 (Oliver Karstoft)
• enforce timeout on external data provider requests (#4351) #4351 (Jaydip Gabani)
• run gatekeeper out of bounds (#4368) #4368 (abhisheksheth28)
• thread webhook context through external data mutation requests (#4378) #4378 (Edvin N)
• add missing flags as helm values (#4385) #4385 (abhisheksheth28)

Documentation

• add field precedence documentation for ConstraintTemplate (#4246) #4246 (Copilot)
• adding jfrog provide to external data (#4357) #4357 (carmit hershman)

Continuous Integration

• add Slack meeting reminder workflow for OPA Gatekeeper weekly meetings (#4277) #4277 (Copilot)

Chores

• bumping kubectl to resolve CVEs (#4248) #4248 (Jaydip Gabani)
• bump go.uber.org/zap from 1.27.0 to 1.27.1 (#4263) #4263 (dependabot[bot])
• bump golang from 728cbef to a02d35e in /test/export/fake-reader (#4264) #4264 (dependabot[bot])
• bump golang from 728cbef to a02d35e in /test/externaldata/dummy-provider (#4265) #4265 (dependabot[bot])
• bump golang from 27e1c92 to a02d35e in /test/image (#4266) #4266 (dependabot[bot])
• bump the all group with 4 updates (#4269) #4269 (dependabot[bot])
• bump golang from 27e1c92 to a02d35e (#4270) #4270 (dependabot[bot])
• bump node-forge from 1.3.1 to 1.3.2 in /website (#4274) #4274 (dependabot[bot])
• bump golang from 27e1c92 to a02d35e in /test/export/fake-subscriber (#4267) #4267 (dependabot[bot])
• bump the all group with 2 updates (#4275) #4275 (dependabot[bot])
• migrate from deprecated stale bot app to GitHub Actions stale action (#4245) #4245 (Copilot)
• bump express from 4.21.0 to 4.22.1 in /website (#4278) #4278 (dependabot[bot])
• bump golang from 27e1c92 to a02d35e in /build/tooling (#4268) #4268 (dependabot[bot])
• bump golang from a02d35e to 4f9d98e i

…(truncated)

Bug Fixes

• enforce timeout on external data provider requests cherry-pick (#4351) (#4359) #4359 (Jaydip Gabani)

Chores

• bump github.com/containerd/containerd from 1.7.28 to 1.7.29 cp #4223 (#4360) #4360 (Jaydip Gabani)
• bump golang.org/x/crypto from 0.43.0 to 0.45.0 CP(#4254) (#4364) #4364 (Jaydip Gabani)
• bump golang from 7534a62 to 04741b0 CP(#4341) (#4365) #4365 (Jaydip Gabani)
• bumping kubectl to resolve CVE CP(#4248) (#4366) #4366 (Jaydip Gabani)
• Prepare v3.21.1 release (#4367) #4367 (github-actions[bot])