Gatekeeper v3.8.0 Release

[chewong]

This release includes numerous performance improvements, bug fixes, and features like external data mutation.

Features

• Prometheus metric for conflicting mutators (#1714) #1714 (Julian Katz)
• Implement tls checker for webhook (#1696) #1696 (Ethern Su)
• enable exempting additional labels in the webhooks (#1778) #1778 (Robin Opletal)
• helm: allow configuring the webhooks to be removed before gatekeeper itself is uninstalled (#1770) #1770 (Mitch Hulscher)
• Support suffix-based matching for resources (#1796) #1796 (Sunghoon Kang)
• Support setting custom rules in validating/mutatingwebhookconfigurations (#1806) #1806 (Mac Chaffee)
• Add gator test (formerly gator validate) (#1786) #1786 (Julian Katz)
• Reference gator verify in gator test --help (#1836) #1836 (Julian Katz)
• add health port to webhook service (#1839) #1839 (Max V)
• Add additional context to gator test --help (#1850) #1850 (Julian Katz)
• add reinvocationPolicy config to the MutatingWebhookConfiguration Chart Config (#1844) #1844 (Mitchell Maler)
• cache namespaces in targethandler (#1908) #1908 (davis-haba)
• external data mutation (#1891) #1891 (Ernest Wong)

Bug Fixes

• Set namespace field in request (#1757) #1757 (Will Beason (he/him))
• helm upgrade test (#1766) #1766 (Sertaç Özercan)
• Check resp before call resp.TraceDump to avoid panic (#1754) #1754 (Huang Huang)
• Update frameworks and fix test (#1802) #1802 (Will Beason)
• match helm mwh timeout default value (#1913) #1913 (Sertaç Özercan)
• fix race condition in mutator controller reconcile (#1942) #1942 (Huang Huang)
• chart: allow override securityContexts (#1938) #1938 (Loïc Stevens)
• define items.type for k8srequiredlabels (#1955) #1955 (Ernest Wong)
• re-add missing constraint race condition fix (#1951) #1951 (Max Smythe)
• update gatekeeper_mutators metrics when a mutator is deleted (#1950) #1950 (Ernest Wong)
• Update deployment to include mutation-status operation (#1966) #1966 (Rita Zhang)

Documentation

• Add workload resource documentation (#1749) #1749 (Jackson Reid)
• add wildcard matching for ns exclusion (#1771) #1771 (Sertaç Özercan)
• namespace exclusion differences (#1782) #1782 (Sertaç Özercan)
• gator test --> gator verify (#1800) #1800 (Julian Katz)
• Update link to point to new default branch (#1808) #1808 (Tim McFadden)
• Add additional Constraint fields to howto (#1805) #1805 (Rita Zhang)
• add documentations for various flags (#1824) #1824 (Ernest Wong)
• add instructions on how to use tilt for development (#1895) #1895 (Ernest Wong)
• add descriptions of the various Gatekeeper operations (#1937) #1937 (Max Smythe)
• add contributing guide (#1945) #1945 (Rita Zhang)
• remove developer doc from 3.6 (#1964) #1964 (Rita Zhang)

Code Refactoring

• Rename 'gktest' to 'gator' (#1751) #1751 (Will Beason (he/him))
• Remove client.Reset usage (#1762) #1762 (Will Beason (he/him))
• Change gator test to gator verify (#1799) #1799 (Julian Katz)

Performance Improvements

• improve --constraint-violations-limit scaling (#1971) (#1974) #1974 (Max Smythe)
• Add ToMatcher() to K8sValidationTarget (#1789) #1789 (Will Beason (he/him))
• Implement ToMatcher and Matcher.Match (#1791) (#1807) #1807 (Becky HD)
• Update frameworks to use compiler sharding (#1900) #1900 (Will Beason)
• Upgrade frameworks to speed up compilation (#1960) #1960 (Will Beason)

Tests

• Add test for gator test to CI (#1728) #1728 (Will Beason (he/him))
• Reduce gomega usage, fix test threading, and make GetGVK deterministic (#1790) #1790 (Will Beason (he/him))
• add tests for mutation annotations (#1846) #1846 (Ernest Wong)
• Fix BenchmarkValidationHandler was broken (#1896) #1896 (Huang Huang)
• Fix BenchmarkModifySetMutator_Mutate was broken (#1897) #1897 (Huang Huang)

Builds

• Upgrade frameworks to context change (#1743) #1743 (Will Beason (he/him))
• Update Gatekeeper with frameworks interface changes (#1845) #1845 (Will Beason)
• Update frameworks (#1857) #1857 (Will Beason)
• Upgrade golangci-lint (#1969) #1969 (Will Beason)
• Upgrade OPA to v0.39.0 (#1968) #1968 (Will Beason)

Continuous Integration

• update k8s and helm versions (#1739) #1739 (Sertaç Özercan)
• add vulnerability scan as part of GitHub Actions (#1817) #1817 (Ernest Wong)
• run benchmarks when running tests (#1898) #1898 (Huang Huang)

Chores

• remove package-lock.json (#1662) #1662 (Sertaç Özercan)
• semantic pr config (#1746) #1746 (Sertaç Özercan)
• Bump @docusaurus/core from 2.0.0-beta.9 to 2.0.0-beta.13 in /website (#1745) #1745 (dependabot[bot])
• Bump @docusaurus/preset-classic from 2.0.0-beta.9 to 2.0.0-beta.13 in /website (#1744) #1744 (dependabot[bot])
• update dependabot prefix with semantic commits (#1750) #1750 (Sertaç Özercan)
• bump @docusaurus/core in /website (#1777) #1777 (dependabot[bot])
• bump @docusaurus/preset-classic in /website (#1776) #1776 (dependabot[bot])
• bump actions/setup-node from 2.5.0 to 2.5.1 (#1780) #1780 (dependabot[bot])
• bump shelljs from 0.8.4 to 0.8.5 in /website (#1792) #1792 (dependabot[bot])
• bump follow-redirects from 1.14.5 to 1.14.7 in /website (#1793) #1793 (dependabot[bot])
• bump nanoid from 3.1.30 to 3.2.0 in /website (#1804) #1804 (dependabot[bot])
• bump @docusaurus/core from 2.0.0-beta.14 to 2.0.0-beta.15 in /website (#1821) #1821 (dependabot[bot])
• bump @docusaurus/preset-classic from 2.0.0-beta.14 to 2.0.0-beta.15 in /website (#1820) #1820 (dependabot[bot])
• add gomod to dependabot.yml (#1816) #1816 (Ernest Wong)
• bump github.com/google/go-cmp from 0.5.6 to 0.5.7 (#1831) #1831 (dependabot[bot])
• bump k8s.io/apiextensions-apiserver from 0.21.4 to 0.21.9 (#1829) #1829 (dependabot[bot])
• bump k8s.io/client-go from 0.21.4 to 0.21.9 (#1833) #1833 (dependabot[bot])
• bump stefanprodan/helm-gh-pages from 1.4.1 to 1.5.0 (#1847) #1847 (dependabot[bot])
• bump follow-redirects from 1.14.7 to 1.14.8 in /website (#1848) #1848 (dependabot[bot])
• bump github.com/prometheus/client_golang from 1.11.0 to 1.11.1 (#1861) #1861 (dependabot[bot])
• disable http.send by default (#1867) #1867 (Sertaç Özercan)
• bump actions/setup-node from 2.5.1 to 3 (#1872) #1872 (dependabot[bot])
• bump prismjs from 1.25.0 to 1.27.0 in /website (#1874) #1874 (dependabot[bot])
• bump k8s.io/apiextensions-apiserver from 0.23.3 to 0.23.4 (#1881) #1881 (dependabot[bot])
• bump github.com/go-logr/zapr from 1.2.0 to 1.2.3 (#1880) #1880 (dependabot[bot])
• bump github.com/prometheus/client_golang from 1.12.0 to 1.12.1 (#1879) #1879 (dependabot[bot])
• bump @docusaurus/preset-classic from 2.0.0-beta.15 to 2.0.0-beta.16 in /website (#1876) #1876 (dependabot[bot])
• bump actions/checkout from 2 to 3 (#1888) #1888 (dependabot[bot])
• Remove unneeded spaces in helm chart (#1885) #1885 (Manuel Rüger)
• bump @docusaurus/core from 2.0.0-beta.16 to 2.0.0-beta.17 in /website (#1892) #1892 (dependabot[bot])
• bump @docusaurus/preset-classic from 2.0.0-beta.16 to 2.0.0-beta.17 in /website (#1893) #1893 (dependabot[bot])
• update golang.org/x/crypto to resolve CVE-2021-43565 (#1911) #1911 (thomasmckay)
• bump @mdx-js/react from 1.6.22 to 2.1.0 in /website (#1914) #1914 (dependabot[bot])
• bump k8s.io/client-go from 0.23.4 to 0.23.5 (#1920) #1920 (dependabot[bot])
• bump contrib.go.opencensus.io/exporter/prometheus from 0.4.0 to 0.4.1 (#1919) #1919 (dependabot[bot])
• bump github.com/go-logr/logr from 1.2.2 to 1.2.3 (#1921) #1921 (dependabot[bot])
• bump node-forge from 1.2.1 to 1.3.0 in /website (#1930) #1930 (dependabot[bot])
• bump actions/cache from 2.1.7 to 3 (#1924) #1924 (dependabot[bot])
• bump minimist from 1.2.5 to 1.2.6 in /website (#1934) #1934 (dependabot[bot])
• bump @docusaurus/core from 2.0.0-beta.17 to 2.0.0-beta.18 in /website (#1946) #1946 (dependabot[bot])
• bump @docusaurus/preset-classic from 2.0.0-beta.17 to 2.0.0-beta.18 in /website (#1947) #1947 (dependabot[bot])
• bump k8s.io/apiextensions-apiserver from 0.23.4 to 0.23.5 (#1948) #1948 (dependabot[bot])
• Prepare v3.8.0-rc.1 release (#1962) #1962 (Ernest Wong)
• Prepare v3.8.0-rc.2 release (#1990) #1990 (Ernest Wong)
• Prepare v3.8.0 release (#2014) #2014 (github-actions[bot])

Reverts

• Revert "chore: bump @mdx-js/react from 1.6.22 to 2.1.0 in /website" (#1915) #1915 (Sertaç Özercan)