github.com/open-policy-agent/opa

Features

• Add opa bench and opa test --bench sub commands for benchmarking policy evaluation. (#1424)
• Permit verifying JWT's with a public key
• http.send improvements:
  • Allow for skipping TLS verification via tls_insecure_skip_verify option
  • Add Host header support

New Built-in Functions

• Bitwise operators (#1919)
  • bits.or
  • bits.and
  • bits.negate
  • bits.xor
  • bits.lsh
  • bits.rsh
• json.remove which works similar to object.remove but supports a JSON pointer path.

Fixes

• docs: Render tutorials as list (#2071)
• ast: Fix type check for objects with non-json keys (#2183)
• ast: Return an error when parsing an empty module (#2054)
• docs: Fix broken PAM module link (#2113)
• docs: Fix code fence in kubernetes-primer.md (#2177)
• topdown: Invoke iterator when evaluating negation (#2142)
• Correct checkptr errors found with Go 1.14
• opa parse: fix panic when parsing invalid JSON

Compatibility Notes

• The ast.ParseModule helper will now return an error if an empty module is provided. Previously it would return a nil error and nil module. (#2054)
• The cmd and tester packages in OPA will now require Go 1.13+ to compile. Most library users should be unaffected.

Miscellaneous

• bundle: Dedicate policy.wasm for the compiled policy.

Fixes

• vendor: Update xxhash to workaround checkptr errors with Go 1.14
• cmd/parse: Fix panic when parsing encounters an error

Fixes

• Add location information into pretty printed trace output. (#2070)
• Add timeout for http.send builtin (#2099)
• build: Force module mode and using only the vendor directory (#2063)
• cover: Exclude some expressions in coverage report (#1972)
• docs: How to say "ray-go" (#2106)
• topdown: Make http.send() caching use full request (#1980)
• topdown: Wrap all builtin functions for errors normalization (#2101)
• topdown: http.send use provided CA without client certs (#1976)

Miscellaneous

• Add object manipulation built-ins
• docs: Add link to Rego Playground in table of contents
• docs: Update tutorial with note about consistency
• topdown: Export builtin implementations outside the package

Fixes

• ast: Fix rewriting vars in rule args (#2080)

Major Features

• This release improves partial evaluation to avoid saving statements when they do not depend on unknowns (e.g., comprehensions, references that require materializing the full extent of partial sets/objects, etc.) Also, expressions containing with statements are partially evaluated now.

• This release lets policy authors to de-reference calls (and other terms) without assigning the result to an intermediate variable. For example, instead of writing a := f(x); a.foo == 1 users can now write f(x).a == 1 directly. Thanks @jaspervdj-luminal!

New Built-in Functions

This release includes the following new built-in functions:

• object.get built-in function to lookup object keys with a fallback.
• crypto.md5, crypto.sha1, crypto.sha256 built-in functions to hash strings.

Compatibility Notes

• The glob.match built-in function was not defaulting the delimiter to "." like the documentation described. This was fixed in #2061 however the fix is not backwards compatible. If you are using the glob.match built-in function, you should ensure that a delimiter is being supplied. A search of .rego files on GitHub only revealed a few instances of the glob.match in-use so we decided to err towards fixing the broken behaviour rather than preserving buggy behaviour going forward.

• Related to the fix for #2031 and the changes with OPA v0.16.0 to use / separated path's with the decision log plugin API. The decision logger will no longer modify the server.Info#Path field. Older versions would substitute . for / but this was causing incorrect results. As of v0.16.0 the server has been updated to provide the correct paths so REST API users are unaffected. Golang API users of the plugins.log.Logger#Log interface may be impacted if passing ast.Ref style strings as a path as it will no longer be changed to / separated. Callers need to do any transformation beforehand.

Fixes

• docs: Update Kubernetes apiVersions to use apps/v1 instead of extensions/v1 (#1977)
• plugins/logs: Leave the path unchanged for decisions (#2031)
• plugins/bundle: Include last successful request timestamp in status (#2009)
• plugins/bundle: Pass copy of status to bulk listeners (#1962)
• rego: Fix panic when partial evaluating with tracers (#2007)
• rego: Propagate custom builtins to PartialResult (#1792)
• server: Update health check to use plugin status (#2010)
• topdown: Correct glob default delimeter (#2039)

Miscellaneous

• ast: Do not index expressions containing with statements
• ast: Fix panic in module parsing
• ast: Improve visitor performance by avoiding heap allocations
• cmd/build: return error if there is more than one positional argument
• docs: Fix live docs button size
• docs: Fix token validation example in Envoy tutorial

This release includes an important bugfix for users that enable tracing and use the "pretty" trace formatter.

• topdown: Fix bug in var rewriting during trace formatting (#2022)

Fixes

• Fix for *-rootless Docker images USER being set incorrectly (#1982)

New Built-in Functions

• Add json.filter to mask/filter nested fields (#1617)
• Add net.cidr_expand to generate CIDR hosts

Fixes

• Reduce server latency for indexed policies by ~30-40% by caching prepared queries across requests (#1958)
• Improve type checker error and trace output readability (#1430 and #1208)
• Re-create service clients to pickup certificate changes (#1898)
• Report full system path for bundle file locations (#1796)
• Add status.console option to log Status messages to console (#1937)
• Fix io.jwt.decode_verify to support multiple keys in JWKS (#1901)
• Fix path decision log field for queries against "/data" (1532)

This release also includes:

• Documentation improvements on how to use the io.jwt.* built-in functions for token verification
• Metrics for bundle processing and activation (e.g., read, parse, and compile times)
• Better parse metric reporting in the server

Compatibility Notes

• The fix for #1532 required a backwards incompatible change for v0 and v1 queries against "/data". This only affects queries against the exact path "/data", not paths prefixed with "/data/", e.g., "/data/example/allow". Since queries against "/data" are rare and normally only seen in development environments, this is a low-impact change. As part of this change, the server.Info#Path field has been changed to use slash-separated paths instead of the string representation of Rego references (i.e., a dotted path rooted at "data"). If you are registering a logging callback directly against the server (e.g., by calling server.Server#WithDecisionLoggerWithErr) you will have to update your logging callback to deal with the new path format. Decision log consumers should treat a missing/empty path field as a query against "/data".