Notable Changes

• 💾 A new driver to export violations on disk.
• 🎓 VAP integration is beta and enabled by default, hence VAP/VAPB resources will be generated by default for CT/C with K8sNativeValidation engine with CEL code.
• 🔗 A new Connection CRD replaced ConfigMap in order to establish connections with export backends.

Features

• mapping dryrun to audit in vapb (#3915) #3915 (Jaydip Gabani)
• adding driver to export to disk (#3832) #3832 (Jaydip Gabani)
• Graduating VAP generation to beta (#3995) #3995 (Jaydip Gabani)
• Export Connection CR (#3999) #3999 (Noah Reisch)

Bug Fixes

• removing readinessprobe for webhook at start of the pod (#4059) (#4065) #4065 (Jaydip Gabani)
• only enabling CEL driver with flag value (#3900) #3900 (Jaydip Gabani)
• error on deleting GK resources when delete operation is enabled (#3921) #3921 (Jaydip Gabani)
• scope of webhook configurations (#3676) #3676 (plavy)
• making sure latest CT version is updated in CT controller to avoid writing errors (#3983) #3983 (Jaydip Gabani)
• add RBAC for finalizers when running with OwnerReferencesPermissionEnforcement admission plugin (#3961) #3961 (Jaydip Gabani)
• unreliable webhook behaviour on gatekeeper pod startup and shutdown (#3780) #3780 (Benjamin Ritter)
• removing connection from map before closing it to avoid locking on latest connection update (#3946) #3946 (Jaydip Gabani)
• making sure VAPB is only deleted for constraints if it was enabled (#4034) #4034 (Jaydip Gabani)
• disk export path to handle dir deletes (#4021) #4021 (Noah Reisch)

Documentation

• adding opa v1 docs and tests (#3908) #3908 (Jaydip Gabani)
• adding available variables and updating faq (#3927) #3927 (Jaydip Gabani)
• Add Flags Reference (#3782) #3782 (Ian Stanton)

Continuous Integration

• bumping k8s version in testing and crd.Dockerfile (#3925) #3925 (Jaydip Gabani)
• release checklist (#3990) #3990 (Sertaç Özercan)

Chores

• Prepare v3.20.0 release (#4067) #4067 (github-actions[bot])
• bump golang from 75e6700 to 00eccd4 in /test/externaldata/dummy-provider (#3914) #3914 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 in /test/image (#3913) #3913 (dependabot[bot])
• bump the all group with 2 updates (#3912) #3912 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 (#3911) #3911 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 in /build/tooling (#3910) #3910 (dependabot[bot])
• Add pods/resize subresource to mutating and validating webhooks (#3778) #3778 (Ian Stanton)
• bump golang.org/x/net from 0.37.0 to 0.38.0 (#3920) #3920 (dependabot[bot])
• bump codecov/codecov-action from 5.4.0 to 5.4.2 in the all group (#3924) #3924 (dependabot[bot])
• bump http-proxy-middleware from 2.0.7 to 2.0.9 in /website (#3922) #3922 (dependabot[bot])
• adding helm variable for mutating subresources (#3916) #3916 (Jaydip Gabani)
• Patch docs for 3.19.1 release (#3937) #3937 (github-actions[bot])
• Patch docs for 3.18.3 release (#3938) #3938 (github-actions[bot])
• bump the all group with 2 updates (#3940) #3940 (dependabot[bot])
• bump the k8s group with 5 updates (#3939) #3939 (dependabot[bot])
• removing gator test alpha note from gator test --help (#3943) #3943 (Martin Alexander)
• bump the all group with 2 updates (#3951) #3951 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-reader (#3955) #3955 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm (#3957) #3957 (dependabot[bot])
• bump actions/upload-artifact from 4.6.0 to 4.6.2 in the all group (#3959) #3959 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/externaldata/dummy-provider (#3958) #3958 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-subscriber (#3956) #3956 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /build/tooling (#3954) #3954 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/image (#3953) #3953 (dependabot[bot])
• bump golang from 1.24.2-bookworm to 1.24.3-bookworm in /test/export/fake-reader (#3962) #3962 (dependabot[bot])
• bumping frameworks and k8s dep to 0.33 (#3942) #3942 (Jaydip Gabani)
• bump the all group across 1 directory with 3 updates (#3965) #3965 (dependabot[bot])
• bump distroless/static-debian12 from 3d0f463 to d9f9472 in /test/export/fake-subscriber (#3977) #3977 (dependabot[bot])
• bump distroless/static-debian12 from 3d0f463 to d9f9472 in /test/export/fake-reader (#3976) #3976 (dependabot[bot])
• bump distroless/static-debian12 from 3d0f463 to d9f9472 in /test/externaldata/dummy-provider (#3975) #3975 (dependabot[bot])
• bump github/codeql-action from 3.28.17 to 3.28.18 in the all group (#3974) #3974 (dependabot[bot])
• bump google.golang.org/grpc from 1.71.1 to 1.71.2 (#3973) #3973 (dependabot[bot])
• bump distroless/static-debian12 from 3d0f463 to d9f9472 (#3972) #3972 (dependabot[bot])
• bump the k8s group with 5 updates (#3971) #3971 (dependabot[bot])
• bump kubectl from v1.33.0 to v1.33.1 (#3970) #3970 (dependabot[bot])
• bumping cert-controller (#3980) #3980 (Jaydip Gabani)
• bumping frameworks and OPA (#3979) #3979 (Jaydip Gabani)
• bump ossf/scorecard-action from 2.4.1 to 2.4.2 in the all group (#3988) #3988 (dependabot[bot])
• bump google.golang.org/grpc from 1.71.2 to 1.71.3 (#3984) #3984 (dependabot[bot])
• bump github.com/go-logr/logr from 1.4.2 to 1.4.3 (#3989) #3989 (dependabot[bot])
• bump golang from 89a04cc to 29d9726 in /test/export/fake-subscriber (#3986) #3986 (dependabot[bot])
• bump golang from 89a04cc to 29d9726 in /test/export/fake-reader (#3985) #3985 (dependabot[bot])
• bump golang from 29d9726 to c83619b in /test/export/fake-subscriber (#3994) #3994 (dependabot[bot])
• bump golang from 1.24.3-bookworm to 1.24.4-bookworm in /test/export/fake-reader (#3993) #3993 (dependabot[bot])
• bump the all group with 2 updates (#3992) #3992 (dependabot[bot])
• bump brace-expansion from 1.1.11 to 1.1.12 in /website (#3998) #3998 (dependabot[bot])
• bumping frameworks and cert-controller (#3997) #3997 (Jaydip Gabani)
• bump golang from c83619b to ee7ff13 in /test/export/fake-subscriber (#4008) #4008 (dependabot[bot])
• bump distroless/static-debian12 from d9f9472 to b7b9a69 in /test/export/fake-subscriber (#4009) #4009 (dependabot[bot])
• bump golang from c83619b to ee7ff13 in /test/export/fake-reader (#4007) #4007 (dependabot[bot])
• bump distroless/static-debian12 from d9f9472 to b7b9a69 in /test/export/fake-reader (#4006) #4006 (dependabot[bot])
• bumping go in dockerfiles (#4010) #4010 (Jaydip Gabani)
• bump distroless/static-debian12 from d9f9472 to b7b9a69 in /test/externaldata/dummy-provider (#4005) #4005 (dependabot[bot])
• bump the all group with 2 updates (#4004) #4004 (dependabot[bot])
• Patch docs for 3.19.2 release (#4013) #4013 (github-actions[bot])
• bump distroless/static-debian12 from d9f9472 to b7b9a69 (#4003) #4003 (dependabot[bot])
• bump google.golang.org/grpc from 1.72.0 to 1.72.2 (#4002) #4002 (dependabot[bot])
• bump github.com/go-chi/chi/v5 from 5.0.8 to 5.2.2 (#4018) #4018 (dependabot[bot])
• bump the k8s group with 5 updates (#4020) #4020 (dependabot[bot])
• bump kubectl from v1.33.1 to v1.33.2 (#4019) #4019 (dependabot[bot])
• bumping to latest cert-controller commit (#4027) #4027 (Jaydip Gabani)
• template controller manager operations (#3968) #3968 (Prahathess)
• bumping to latest frameworks commit (#4026) #4026 (Jaydip Gabani)
• exposing TTL in disk driver (#4028) #4028 (Jaydip Gabani)
• bump the all group with 2 updates (#4035) #4035 (dependabot[bot])
• Prepare v3.20.0-rc.0 release (#4038) #4038 (github-actions[bot])