Notable Changes
- 💾 A new driver to export violations on disk.
- 🎓 VAP integration is beta and enabled by default, hence VAP/VAPB resources will be generated by default for CT/C with
K8sNativeValidationengine withCELcode. - 🔗 A new
ConnectionCRD replacedConfigMapin order to establish connections with export backends.
Features
- mapping dryrun to audit in vapb (#3915) #3915 (Jaydip Gabani)
- adding driver to export to disk (#3832) #3832 (Jaydip Gabani)
- Graduating VAP generation to beta (#3995) #3995 (Jaydip Gabani)
- Export Connection CR (#3999) #3999 (Noah Reisch)
Bug Fixes
- removing readinessprobe for webhook at start of the pod (#4059) (#4065) #4065 (Jaydip Gabani)
- only enabling CEL driver with flag value (#3900) #3900 (Jaydip Gabani)
- error on deleting GK resources when delete operation is enabled (#3921) #3921 (Jaydip Gabani)
- scope of webhook configurations (#3676) #3676 (plavy)
- making sure latest CT version is updated in CT controller to avoid writing errors (#3983) #3983 (Jaydip Gabani)
- add RBAC for finalizers when running with OwnerReferencesPermissionEnforcement admission plugin (#3961) #3961 (Jaydip Gabani)
- unreliable webhook behaviour on gatekeeper pod startup and shutdown (#3780) #3780 (Benjamin Ritter)
- removing connection from map before closing it to avoid locking on latest connection update (#3946) #3946 (Jaydip Gabani)
- making sure VAPB is only deleted for constraints if it was enabled (#4034) #4034 (Jaydip Gabani)
- disk export path to handle dir deletes (#4021) #4021 (Noah Reisch)
Documentation
- adding opa v1 docs and tests (#3908) #3908 (Jaydip Gabani)
- adding available variables and updating faq (#3927) #3927 (Jaydip Gabani)
- Add Flags Reference (#3782) #3782 (Ian Stanton)
Continuous Integration
- bumping k8s version in testing and crd.Dockerfile (#3925) #3925 (Jaydip Gabani)
- release checklist (#3990) #3990 (Sertaç Özercan)
Chores
- Prepare v3.20.0 release (#4067) #4067 (github-actions[bot])
- bump golang from
75e6700to00eccd4in /test/externaldata/dummy-provider (#3914) #3914 (dependabot[bot]) - bump golang from
75e6700to00eccd4in /test/image (#3913) #3913 (dependabot[bot]) - bump the all group with 2 updates (#3912) #3912 (dependabot[bot])
- bump golang from
75e6700to00eccd4(#3911) #3911 (dependabot[bot]) - bump golang from
75e6700to00eccd4in /build/tooling (#3910) #3910 (dependabot[bot]) - Add
pods/resizesubresource to mutating and validating webhooks (#3778) #3778 (Ian Stanton) - bump golang.org/x/net from 0.37.0 to 0.38.0 (#3920) #3920 (dependabot[bot])
- bump codecov/codecov-action from 5.4.0 to 5.4.2 in the all group (#3924) #3924 (dependabot[bot])
- bump http-proxy-middleware from 2.0.7 to 2.0.9 in /website (#3922) #3922 (dependabot[bot])
- adding helm variable for mutating subresources (#3916) #3916 (Jaydip Gabani)
- Patch docs for 3.19.1 release (#3937) #3937 (github-actions[bot])
- Patch docs for 3.18.3 release (#3938) #3938 (github-actions[bot])
- bump the all group with 2 updates (#3940) #3940 (dependabot[bot])
- bump the k8s group with 5 updates (#3939) #3939 (dependabot[bot])
- removing gator test alpha note from
gator test --help(#3943) #3943 (Martin Alexander) - bump the all group with 2 updates (#3951) #3951 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-reader (#3955) #3955 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm (#3957) #3957 (dependabot[bot])
- bump actions/upload-artifact from 4.6.0 to 4.6.2 in the all group (#3959) #3959 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/externaldata/dummy-provider (#3958) #3958 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-subscriber (#3956) #3956 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /build/tooling (#3954) #3954 (dependabot[bot])
- bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/image (#3953) #3953 (dependabot[bot])
- bump golang from 1.24.2-bookworm to 1.24.3-bookworm in /test/export/fake-reader (#3962) #3962 (dependabot[bot])
- bumping frameworks and k8s dep to 0.33 (#3942) #3942 (Jaydip Gabani)
- bump the all group across 1 directory with 3 updates (#3965) #3965 (dependabot[bot])
- bump distroless/static-debian12 from
3d0f463tod9f9472in /test/export/fake-subscriber (#3977) #3977 (dependabot[bot]) - bump distroless/static-debian12 from
3d0f463tod9f9472in /test/export/fake-reader (#3976) #3976 (dependabot[bot]) - bump distroless/static-debian12 from
3d0f463tod9f9472in /test/externaldata/dummy-provider (#3975) #3975 (dependabot[bot]) - bump github/codeql-action from 3.28.17 to 3.28.18 in the all group (#3974) #3974 (dependabot[bot])
- bump google.golang.org/grpc from 1.71.1 to 1.71.2 (#3973) #3973 (dependabot[bot])
- bump distroless/static-debian12 from
3d0f463tod9f9472(#3972) #3972 (dependabot[bot]) - bump the k8s group with 5 updates (#3971) #3971 (dependabot[bot])
- bump kubectl from v1.33.0 to v1.33.1 (#3970) #3970 (dependabot[bot])
- bumping cert-controller (#3980) #3980 (Jaydip Gabani)
- bumping frameworks and OPA (#3979) #3979 (Jaydip Gabani)
- bump ossf/scorecard-action from 2.4.1 to 2.4.2 in the all group (#3988) #3988 (dependabot[bot])
- bump google.golang.org/grpc from 1.71.2 to 1.71.3 (#3984) #3984 (dependabot[bot])
- bump github.com/go-logr/logr from 1.4.2 to 1.4.3 (#3989) #3989 (dependabot[bot])
- bump golang from
89a04ccto29d9726in /test/export/fake-subscriber (#3986) #3986 (dependabot[bot]) - bump golang from
89a04ccto29d9726in /test/export/fake-reader (#3985) #3985 (dependabot[bot]) - bump golang from
29d9726toc83619bin /test/export/fake-subscriber (#3994) #3994 (dependabot[bot]) - bump golang from 1.24.3-bookworm to 1.24.4-bookworm in /test/export/fake-reader (#3993) #3993 (dependabot[bot])
- bump the all group with 2 updates (#3992) #3992 (dependabot[bot])
- bump brace-expansion from 1.1.11 to 1.1.12 in /website (#3998) #3998 (dependabot[bot])
- bumping frameworks and cert-controller (#3997) #3997 (Jaydip Gabani)
- bump golang from
c83619btoee7ff13in /test/export/fake-subscriber (#4008) #4008 (dependabot[bot]) - bump distroless/static-debian12 from
d9f9472tob7b9a69in /test/export/fake-subscriber (#4009) #4009 (dependabot[bot]) - bump golang from
c83619btoee7ff13in /test/export/fake-reader (#4007) #4007 (dependabot[bot]) - bump distroless/static-debian12 from
d9f9472tob7b9a69in /test/export/fake-reader (#4006) #4006 (dependabot[bot]) - bumping go in dockerfiles (#4010) #4010 (Jaydip Gabani)
- bump distroless/static-debian12 from
d9f9472tob7b9a69in /test/externaldata/dummy-provider (#4005) #4005 (dependabot[bot]) - bump the all group with 2 updates (#4004) #4004 (dependabot[bot])
- Patch docs for 3.19.2 release (#4013) #4013 (github-actions[bot])
- bump distroless/static-debian12 from
d9f9472tob7b9a69(#4003) #4003 (dependabot[bot]) - bump google.golang.org/grpc from 1.72.0 to 1.72.2 (#4002) #4002 (dependabot[bot])
- bump github.com/go-chi/chi/v5 from 5.0.8 to 5.2.2 (#4018) #4018 (dependabot[bot])
- bump the k8s group with 5 updates (#4020) #4020 (dependabot[bot])
- bump kubectl from v1.33.1 to v1.33.2 (#4019) #4019 (dependabot[bot])
- bumping to latest cert-controller commit (#4027) #4027 (Jaydip Gabani)
- template controller manager operations (#3968) #3968 (Prahathess)
- bumping to latest frameworks commit (#4026) #4026 (Jaydip Gabani)
- exposing TTL in disk driver (#4028) #4028 (Jaydip Gabani)
- bump the all group with 2 updates (#4035) #4035 (dependabot[bot])
- Prepare v3.20.0-rc.0 release (#4038) #4038 (github-actions[bot])