https://cybertoolchain.io/tools/gatekeeper New releases and features in Gatekeeper, tracked by The Cyber Toolchain. en Thu, 09 Jul 2026 03:05:48 GMT https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.23.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.23.0 Thu, 09 Jul 2026 03:05:48 GMT Gatekeeper v3.23.0 adds structured log fields, remote cluster status routing, and operation-scoped mutation rules. • Adds structured field markers to semantic log lines for easier machine-parseable log filtering and SIEM ingestion. • Implements status resource routing for remote cluster mode, enabling multi-cluster Gatekeeper deployments to correctly surface constraint status from remote clusters. • Adds `operations` field to mutation `ApplyTo` spec, allowing mutations to be scoped to specific admission operations (e.g., CREATE, UPDATE, DELETE). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.22.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.22.0 Tue, 10 Mar 2026 00:05:58 GMT Gatekeeper v3.22.0 adds gator bench/policy commands, namespace-aware CEL/Rego, remote cluster support, and VAP scope sync on by default. • New `gator bench` command benchmarks Rego and CEL policy engines with latency percentiles, throughput metrics, memory profiling, concurrent load testing, and baseline comparison for CI/CD regression detection. • New `gator policy` command enables brew-style discovery, installation, upgrading, and uninstallation of policies from gatekeeper-library, with bundle support (e.g., `pod-security-baseline`), enforcement overrides, and dry-run previews. • CEL expressions can now access `namespaceObject` and Rego policies can access `input.namespace` for namespace-scoped policy decisions during admission and audit. • New `--enable-remote-cluster` flag allows Gatekeeper to run outside the target cluster, supporting nested or hosted control plane topologies. • Supports disabling the forced `fake-reader` audit sidecar for users who supply their own log monitoring (e.g., an OTel collector). • Adds metrics backend configuration options to the Helm chart. • Supports `print` statements in `gator` for policy debugging. Breaking changes: • The `sync-vap-enforcement-scope` flag now defaults to `true`, meaning VAP resources will automatically reflect constraint enforcement actions on upgrade — existing setups that relied on the previous `false` default may see changed ValidatingAdmissionPolicy behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.21.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.21.0 Wed, 19 Nov 2025 22:15:48 GMT Gatekeeper v3.21.0 adds VAP enforcement scope unification, per-operation ConstraintTemplate controls, dual-stack webhook support, and richer external data metrics. • New `sync-vap-enforcement-scope` flag unifies ValidatingAdmissionPolicy enforcement surface with Gatekeeper's webhook config, `Config` resource exclusions, and exempt-namespace exemptions for consistent policy coverage. • ConstraintTemplates now support granular operation-level controls, allowing templates to be enforced on specific operations (CREATE, UPDATE, DELETE) including DELETE in VAP generation. • Adds new metrics and status reporting for the External Data / Provider API, improving observability when integrating external data sources into policy evaluation. • Supports dual-stack networking for the webhook service. • `gator verify` supports multiple expansions per test case. • Adds `extraEnvs` support to the Helm chart. • Makes automount service account token, deployment annotations, extra volumes, and volumeMounts configurable via Helm. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.20.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.20.0 Thu, 24 Jul 2025 19:22:21 GMT Gatekeeper v3.20.0 adds disk-based violation export, a new Connection CRD, and promotes VAP generation to beta-on-by-default. • New disk export driver lets Gatekeeper write audit violations directly to disk as an export backend. • New `Connection` CRD replaces `ConfigMap` for configuring connections to export backends. • VAP/VAPB generation graduates to beta and is now enabled by default for ConstraintTemplates/Constraints using the `K8sNativeValidation` engine with `CEL` code. • Adds `dryrun` enforcement action mapping to audit in ValidatingAdmissionPolicyBinding (VAPB). Breaking changes: • The `Connection` CRD replaces `ConfigMap` for establishing connections with export backends; existing ConfigMap-based export backend configurations will need to be migrated to `Connection` resources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.19.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.19.0 Wed, 09 Apr 2025 19:21:43 GMT Gatekeeper v3.19.0 adds OPA Rego v1 syntax support, a generalized export mechanism for violations, and a new `--deny-only` flag for `gator test`. • Supports OPA Rego v1 syntax in ConstraintTemplates, enabling use of the modern `rego.v1` import and stricter policy authoring. • Generalizes the Pub/Sub violation export mechanism to support additional backends (e.g., disk), enabling flexible violation data pipelines beyond message queues. • Adds `--deny-only` flag to `gator test`, allowing practitioners to filter test output to only failing/denying results. Breaking changes: • The `generate` operation is now required to guard CRD and VAP/VAPB generation; singleton deployments (e.g., gatekeeper-audit) must be updated to include `--operation=generate`, or it must be added to the controller manager deployment, otherwise CRD and VAP/VAPB generation will stop working. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.18.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.18.0 Thu, 12 Dec 2024 00:28:04 GMT Gatekeeper v3.18.0 promotes CEL-based policies to GA, adds Config pod status, gator sync/expansion test support, and admission/audit stats logging. • CEL-based policies enforced through Gatekeeper (Validating Admission Policy) are now generally available. • Adds `logStatsAdmission` and `logStatsAudit` options to the Helm chart for admission and audit statistics logging. • Implements Config pod status reporting for visibility into Config resource health. • Adds `generate` operation to guard CRD and VAP/VAPB generation, enabling explicit control over resource generation. • Supports expansion testing in `gator verify`, allowing policy expansion scenarios to be validated offline. • Adds sync resource support to `gator` test commands via gator sync test. • Adds `commonLabels` support for Gatekeeper Deployments in the Helm chart. • Container images are now also published to ghcr.io in addition to existing registries. Breaking changes: • The `generate` operation is now required to guard CRD and VAP/VAPB generation; existing singleton deployments (e.g. gatekeeper-audit) must add `--operation=generate` or CRD/VAP/VAPB resources will not be generated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.18.0-rc.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.18.0-rc.0 Fri, 22 Nov 2024 21:37:12 GMT Gatekeeper v3.18.0-rc.0 promotes CEL engine to GA, adds config pod status, gator sync/expansion test support, and new Helm observability options. • Promotes the CEL constraint engine to General Availability (GA), removing its experimental status. • Adds `logStatsAdmission` and `logStatsAudit` configuration options to the Helm chart for per-webhook stats logging. • Implements Config pod status reporting, surfacing sync configuration health in the cluster. • Adds a `generate` operation and wait-for-VAPB-generation support for ValidatingAdmissionPolicyBinding workflows. • Adds sync resource testing support to `gator` (`gator sync test`). • Adds expansion template testing support to `gator verify`. • Adds `commonLabels` support for Gatekeeper Deployments via Helm chart. • Container images are now also published to `ghcr.io` in addition to existing registries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.17.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.17.0 Wed, 21 Aug 2024 23:21:11 GMT Gatekeeper v3.17.0 promotes CEL-based VAP enforcement to beta, adds scoped enforcement actions, and supports CONNECT operations. • Promotes CEL-based policies enforced through Validating Admission Policy (VAP) to beta status. • Adds `scopedEnforcementActions` field under `spec` in Constraints, enabling distinct enforcement actions (warn, deny, dryrun) per enforcement point (webhook, audit, gator, VAP) within a single constraint. • Transitions VAP generation configuration from annotations to explicit `generateVAP` fields in ConstraintTemplate and Constraint resources. • Adds support for intercepting and enforcing CONNECT operations via the Gatekeeper webhook. • Enables separate pod labels for controller-manager and audit deployments for finer-grained pod selection and monitoring. • Makes the Gatekeeper service account configurable and adds an option to opt out of automatic service account creation. Breaking changes: • VAP generation configuration has moved from annotations to fields in ConstraintTemplate and Constraint — existing annotation-based VAP configurations must be migrated to the new `generateVAP` field to continue generating Validating Admission Policy and binding resources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.17.0-rc.1 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.17.0-rc.1 Wed, 14 Aug 2024 22:05:26 GMT Gatekeeper v3.17.0-rc.1 adds CONNECT operation support, scoped enforcement actions, generateVAP field, and promotes k8s-native validation to beta. • Supports CONNECT operations in webhook admission rules, enabling policy enforcement on proxy-style requests. • Adds scoped enforcement actions (`scopedenforcementactions`), allowing different enforcement behaviors to be applied at a more granular scope. • Promotes the `k8s-native-validation` feature to beta, making CEL-based native Kubernetes validation more production-ready. • Adds a `generateVAP` field to ConstraintTemplates for explicit control over ValidatingAdmissionPolicy generation, replacing the previous annotation-based approach. • Checks for ConstraintTemplate `generateVap` intent before generating a VAPBinding, preventing unintended binding creation. • Separates pod labels configuration between controller-manager and audit deployments for independent labeling control. • Makes the Gatekeeper service account configurable and adds an option to opt out of automatic service account creation. Breaking changes: • VAP generation control is now driven by the `generateVAP` field on ConstraintTemplates instead of annotations; existing annotation-based VAP configuration will no longer take effect. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.16.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.16.0 Thu, 09 May 2024 19:21:33 GMT Gatekeeper v3.16.0 adds alpha VAP integration and `disableAudit` helm option • `disableAudit` helm option added to disable audit operations • Alpha integration with Kubernetes Validating Admission Policy (VAP) enabled Breaking changes: • The `validate-template-rego` flag is removed; use Gator to validate constraint templates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.14.1 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.14.1 Tue, 12 Mar 2024 23:47:17 GMT Gatekeeper v3.14.1 adds pod labels to audit and controller manager logs • Update audit and controller manager with pod labels (#3240) (cherry pick) (#3284) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.15.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.15.0 Mon, 05 Feb 2024 18:15:40 GMT Gatekeeper v3.15.0 adds Alpha SyncSets controller for replicating data • Introduces the `syncset` controller to support replicating data with SyncSets (Alpha feature) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.14.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.14.0 Wed, 01 Nov 2023 23:57:28 GMT Gatekeeper v3.14.0 adds recommended Helm/K8s labels, configurable revisionHistoryLimit, multi-source sync, and exposes --external-data-provider-response-cache-ttl via Helm. • Add Recommended Helm/K8s labels to chart resources • Allow changing the default `revisionHistoryLimit` in the Helm chart • Support multiple sync sources for constraint controllers • Expose `--external-data-provider-response-cache-ttl` flag via Helm chart values Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.13.2 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.13.2 Tue, 10 Oct 2023 01:34:42 GMT Gatekeeper v3.13.2 releases with a Helm chart • Includes a Helm chart for deployment Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.13.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.13.0 Tue, 08 Aug 2023 23:37:14 GMT Gatekeeper v3.13.0 adds PubSub audit exports, `ValidatingAdmissionPolicy` driver, stats CLI flag, syncset CRD, and ExpansionTemplate beta • `--auditPubsubURL` and `--auditPubsubTopicName` flags enable exporting audit events to Google Cloud Pub/Sub. • `expansionTemplates` CRD graduated to _beta_ status for validating workload resources. • New `SyncSet` Custom Resource Definition (CRD) simplifies policy synchronization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.12.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.12.0 Fri, 14 Apr 2023 17:50:53 GMT Gatekeeper v3.12.0 adds AssignImage mutator, --exempt-namespace-suffix flag, and events in involved object namespace • Adds `--exempt-namespace-suffix` flag to exempt namespaces from the admission webhook • Implements `AssignImage` mutator for container image mutations • Emits events in the involved objects namespace instead of Gatekeeper's Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.10.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.10.0 Wed, 19 Oct 2022 23:38:33 GMT Gatekeeper v3.10.0 adds alpha workload resource validation, stable mutations, and new Helm/CLI config options • Introduces `alpha` stage Validation of Workload Resources as a new capability for constraint authors targeting workload-specific objects. • Promotes the Mutation feature to `stable`, enabling reliable runtime object modification via constraints. • Adds `controllerManager.tlsMinVersion` Helm chart value to configure TLS minimum version for the controller manager webhook. • Exposes Helm chart options to allow injection of external certificates into the Gatekeeper deployment. • Adds `--host` CLI flag to the `gatekeeper-controller-manager` command line to control the bind address. Breaking changes: • Removal of Pod Security Policies (PSP) support; users on Kubernetes v1.25+ must migrate to Pod Security Admission (PSA). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.9.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.9.0 Fri, 15 Jul 2022 18:14:39 GMT Gatekeeper v3.9.0 adds TLS for external data, subresource validation, Stackdriver exporter, and gator test skip flags • Enables `tls` and `mtls` modes on the `externalDataProviders` config to encrypt traffic to external data sources. • Adds `objectSelector` field to the Helm chart's webhook configuration to scope validation webhooks to specific objects. • Enables validation of Kubernetes subresources (e.g., Status) in addition to normal spec/object validation. • Adds `gator` Dockerfile allowing the CLI tool to be built and run directly from source. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.8.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.8.0 Thu, 21 Apr 2022 23:40:58 GMT Gatekeeper v3.8.0 adds external data mutation, gator test command, suffix matching, and config hooks • External Data now supports mutation, enabling policy-driven resource modification based on external lookups • Support suffix-based matching for resources to target objects by name ending rather than exact match • Allow configuring webhook removal order before gatekeeper uninstalled via Helm values • Set custom rules in validating/mutatingwebhookconfigurations for granular control over admission requests • Add `reinvocationPolicy` config to the MutatingWebhookConfiguration Chart Config to control retry behavior • Expose Prometheus metric for conflicting mutators to detect and alert on policy collisions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.7.0 https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.7.0 Mon, 15 Nov 2021 21:13:54 GMT Gatekeeper v3.7 adds ModifySet mutator, External Data validation alpha, Gator CLI, audit-to-disk, and webhook TLS min version config • Introducing `ModifySet` mutator for complex mutation patterns • Adds alpha support for External Data in validation policies • Configures webhook TLS minimum version via the `--tls-min-version` flag • Enables audit cache to write to disk instead of RAM to reduce memory usage Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gatekeeper