Gatekeeper Policy Manager release v2.0.0

Welcome to the release of Gatekeeper Policy Manager v2.0.0, maintained with ❤️ by the team SIGHUP by ReeVo.

This version replaces the Python backend with a new one written in Go, rebuilds the web interface to render on the server instead of as a React single-page app, adds a home dashboard that summarizes policy status across your clusters, adds views for Gatekeeper mutations and events, adds support for Kubernetes 1.36 and updates all dependencies. The existing views work the same as before.

Because this is a large change, it is published first as a release candidate. Try it on a non-production cluster and tell us what breaks.

You do not need to change how you deploy GPM. The container image, the Kubernetes manifests and the Helm chart all work the same way. Read the breaking changes below before you upgrade.

New features 🌟

• The web interface is rendered on the server. GPM no longer ships a React single-page application. It renders each page as HTML, with a small amount of Alpine.js for the interactive parts, such as the searchable violations table. The views work the same as before. Because there is no JavaScript build any more, the image is smaller and has far fewer dependencies to keep patched.
• A home dashboard that summarizes policy status across your clusters. The start page now shows the total number of violations, the violations broken down by constraint, and how many clusters have violations. When your kubeconfig holds more than one cluster, the dashboard adds up all of them, and each violating constraint links straight to the cluster that reports it. With a single cluster it shows that one cluster.
• You can share a link to a single violation. Each row in a constraint's violations table has a button that copies a link to that exact violation. Open the link, and GPM expands the constraint, moves to the correct page of the table, and highlights the violation. The link stays valid across audits.
• Small usability improvements to the constraints and events views. The violations table shows its filter and pager only when a constraint has enough violations to need them. The events table sorts by column and shows the resource namespace. The constraint list in the sidebar scrolls on its own and highlights the section you are viewing.
• Mutations view. You can now see the Gatekeeper mutation policies in your cluster, with their details and the operations they apply.
• Events view. You can now see the admission and audit events that OPA Gatekeeper sends. This is an alpha feature, so Gatekeeper emits these events only when you enable its --emit-admission-events and --emit-audit-events flags. GPM needs permission to read events for this view to work. GPM_EVENTS_SOURCE sets which event source components to show, as a comma-separated list; the default is gatekeeper-webhook,gatekeeper-audit, which shows both.
• You can limit the events view to one namespace. By default GPM reads events from every namespace, which needs read access to events in the whole cluster. Set GPM_EVENTS_NAMESPACE to the namespace that OPA Gatekeeper runs in to make that access smaller. In the Helm chart, set config.eventsNamespace and the chart creates a Role in that namespace instead of a cluster-wide rule.
• Helm chart: RBAC for the mutations and events views. The chart grants GPM the read access that these two new views need. It also accepts config.eventsSource.
• The violations report says which cluster it comes from. Each report now shows the address of the Kubernetes API server and the time it was generated.
• You can change the address GPM listens on with the new GPM_LISTEN_ADDRESS variable. The default is :8080, the same port as before.
• You can connect to clusters with a certificate GPM does not trust. Set GPM_SKIP_TLS_VERIFY=true to skip the TLS certificate check against the Kubernetes API. This is needed on some clusters, for example on EKS, where the cluster certificate is missing information that Go requires. Only use it on a network you trust, because it removes a security check. When a connection fails because of a certificate, GPM now says so clearly and points you to this option.
• You can serve GPM from a subpath, for example example.com/gpm, instead of the domain root. Build the image with --build-arg PUBLIC_URL=/gpm. Then configure your reverse proxy to remove the subpath before it forwards the request. OIDC login works on a subpath too. The published image uses the root path. If you need a subpath, build your own image.
• The session cookie is encrypted. GPM signs the cookie and also encrypts it, with two keys that it derives from GPM_SECRET_KEY. In 1.x the cookie was signed only, so anyone who held it could read the user name out of it. Everyone has to log in again once. The same happens whenever you change GPM_SECRET_KEY, because the keys come from it. GPM sends those users to the login page. GPM does not keep sessions on the server, so a logout cannot cancel a copy of the cookie that someone took to another machine. Such a copy stays valid until GPM_SESSION_MAX_AGE expires it.
• OIDC login is still supported. Set GPM_AUTH_ENABLED=OIDC to require users to sign in, exactly as in 1.x — the same environment variables and the same /oidc-auth redirect URI, so an existing configuration keeps working. GPM reads your provider's settings from its issuer URL, or you can give it each endpoint by hand. Logging out of GPM also logs you out of the provider when it supports that. A session lasts 8 hours by default. Use GPM_SESSION_MAX_AGE to change this.
• The container image is smaller. It contains no shell and no package manager, which makes it easier to scan and to keep free of vulnerabilities.
• Helm chart: the liveness and readiness probes are now configurable. You can turn each one off and change its path, port and timings under livenessProbe and readinessProbe. They keep working as before if you change nothing.
• Helm chart: you no longer have to put the secret key in your values file. Set config.secretRef to the name of a secret you already manage, with the key in a secretKey field. config.secretKey still works if you prefer to set the value directly. The chart installs with neither set, which suits the default anonymous mode that needs no secret. OIDC still needs a strong GPM_SECRET_KEY (see the breaking changes).

Breaking changes 💔

• The JSON API at /api/v1/* is removed. GPM served this API only for its old React frontend, which is gone. The server-rendered interface reads the Kubernetes API directly and does not need it. If you called /api/v1/... from your own scripts, those calls now return 404; read the objects from the Kubernetes API instead. The violations report moved with this change: it is now at /constraints?report=html (or /constraints/<context>?report=html) instead of /api/v1/constraints?report=html.
• More of GPM now requires a login. When OIDC is on, the cluster list, the mutations view and the events view need a session, which was not the case in 1.x. Only a small set of paths stay open: the health check, the login and logout routes, /metrics, and the static assets.
• OIDC now needs a strong secret key. When GPM_AUTH_ENABLED=OIDC, GPM refuses to start if GPM_SECRET_KEY is still the published 1.x default or shorter than 16 characters. Set it to a long random string. GPM uses it to sign and encrypt the session cookie.
• The kubeconfig path inside the container changed from /home/gpm/.kube/config to /home/nonroot/.kube/config.
• Log levels changed. GPM_LOG_LEVEL accepts DEBUG, INFO, WARN and ERROR, in any case. GPM no longer accepts WARNING, CRITICAL, FATAL or NOTSET, which the Python backend took. An invalid value gives a warning and INFO.
• The Helm chart no longer creates a HorizontalPodAutoscaler. The autoscaling.* values were removed. The template used a Kubernetes API that was removed in Kubernetes 1.26, so it could not work on any recent cluster.
• The Helm chart is now published as an OCI artifact, not through the GitHub Pages repository. From this release the chart is pushed to oci://quay.io/sighup/charts/gatekeeper-policy-manager, next to the container image. helm repo add gpm https://sighupio.github.io/gatekeeper-policy-manager no longer finds new versions. Install with helm install ... oci://quay.io/sighup/charts/gatekeeper-policy-manager --version <chart version>. You need Helm 3.8 or later, which supports OCI registries.

Upgrade procedure

1. If you protect GPM with OIDC, set GPM_SECRET_KEY to a long random string, because GPM refuses to start with the 1.x default or a key shorter than 16 characters. Your other OIDC settings keep working. Check that <GPM_OIDC_REDIRECT_DOMAIN>/oidc-auth is registered with your provider, and set GPM_PREFERRED_URL_SCHEME=https if you serve GPM over TLS. Everyone will have to log in again once, because the session format changed.
2. If you mount a kubeconfig to reach more than one cluster, change the mount path to /home/nonroot/.kube/config, or set KUBECONFIG to the path you use.
3. If you set GPM_LOG_LEVEL, check that the value is DEBUG, INFO, WARN or ERROR.
4. If you enabled autoscaling in the Helm chart, remove the autoscaling.* values and create your own HorizontalPodAutoscaler that targets the GPM deployment.
5. If you install with Helm, change the chart source to the OCI registry. Remove the gpm Helm repository and install from oci://quay.io/sighup/charts/gatekeeper-policy-manager with a --version, as shown in the README. Make sure your Helm is version 3.8 or later.
6. Update the image tag, then apply the manifests or upgrade the Helm release as usual.