UNCLASSIFIED - NO CUI

chore(deps): update gatekeeper

RENOVATE_TOKENrequested to merge
renovate/gatekeeper into main

This MR contains the following updates:

Package Update Change
bb-common patch 0.14.0 -> 0.14.1
gatekeeper minor 3.21.1 -> 3.22.0
gluon patch 0.9.7 -> 0.9.8
registry1.dso.mil/ironbank/opensource/openpolicyagent/gatekeeper (source) minor v3.21.1 -> v3.22.0

Complete MR checklist

Assignee

  • Followed upgrade instructions outlined in docs/DEVELOPMENT_MAINTENANCE.md
  • Update Docs with new/updated steps as needed
  • Tested and Validated Changes made with supporting info like logs or screenshots from test pipelines

Add supporting info below

Reviewer only

  • Tested and Validated changes

Release Notes

open-policy-agent/gatekeeper (gatekeeper)

v3.22.0

Compare Source

🚀 Notable Changes

  • ✅ sync-vap-enforcement-scope now enabled by default: The flag for syncing ValidatingAdmissionPolicy enforcement scope is now true by default, ensuring VAP resources reflect constraint enforcement actions out of the box (#​4332).
  • 🏷️ Namespace support for CEL and Rego engines: CEL expressions can now access namespaceObject and Rego policies can access input.namespace for namespace-scoped policy decisions during both admission and audit (#​4285)
  • ⚡ gator bench — policy performance benchmarking: New CLI command to benchmark Rego and CEL engines with latency percentiles, throughput metrics, memory profiling, concurrent load testing, and baseline comparison for CI/CD regression detection (#​4287)
  • 📋 gator policy — brew-inspired policy management: New CLI for discovering, installing, upgrading, and uninstalling policies from the gatekeeper-library with support for bundles (e.g., pod-security-baseline), enforcement overrides, and dry-run previews (#​4331)
  • 🔇 Disable audit sidecar support: Users who have their own log monitoring (e.g., OTel collector) can now disable the forced fake-reader sidecar when audit file-based logging is enabled (#​4280)
  • 🌐 Out-of-cluster / remote cluster support: New --enable-remote-cluster flag allows Gatekeeper to run outside the target cluster (e.g., nested/hosted control planes), fixing a crash when the Gatekeeper pod doesn't exist in the managed cluster (#​4368)
  • ⏱️ External data provider timeout enforcement: Mutation-path requests to external data providers now enforce the provider's configured timeout (default 5s), preventing unbounded requests that could outlive the webhook timeout and cause resource exhaustion (#​4351)

Features

Bug Fixes

Documentation

Continuous Integration

Chores

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this MR, check this box

This MR was automatically generated by Renovate Bot.

Upgrade Notices

(Include any relevant notes about upgrades here or write "N/A" if there are none)

Edited by Daniel Pritchett

Merge request reports

UNCLASSIFIED - NO CUI