Skip to content

Releases: permitio/opal

v0.7.4

14 Sep 19:06
@roekatz roekatz
0.7.4
8c5c2c2
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.4

What's Changed

New Features

  • Add support for PATCH as save_method in data updates. by @thilak009 in #483

Bugfixes

Docs

New Contributors

Full Changelog: 0.7.3...0.7.4

Contributors

jasonmcintosh, obsd, and 5 other contributors
Assets 8
Loading

v0.7.3

27 Jun 11:40
@roekatz roekatz
0.7.3
3afcd1a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.3

What's Changed

  • Webhook: Fix not listening on webhook notifications when broadcaster isn't configured. by @roekatz in #480 - Thanks Jack Geek from our Slack community for reporting!
  • Fix multi arch support in docker build and push workflow. by @roekatz in #479

Full Changelog: 0.7.2...0.7.3

Contributors

roekatz
Assets 8
Loading

v0.7.2

20 Jun 16:40
@roekatz roekatz
0.7.2
d11bb2d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.2

What's Changed

New Features

  • Support OPA tls authentication. by @oskar-christensson in #457
  • Support disabling policy updates in OPAL client (data-only mode). by @thilak009 in #470
  • Support S3 buckets as bundle servers (aka api policy source) by @orweis in #472 & @cbat98 in #473
  • Upgraded broadcaster version to 0.2.3 (Includes new support for Kafka SSL by @david-hamilton-bah in permitio/broadcaster#5)
  • Policy store data updates: Support only pushing nested keys instead of overriding entire root path (eg /v1/data on OPA) by @orishavit in #448

Fixes

  • Fix memory leaks (Leaking tasks on publishing updates & executing webhook trigger) by @roekatz in #475 & #476

Docs & Examples

New Contributors

  • @oskar-christensson made their first contribution in #457
  • @thilak009 made their first contribution in #470
  • @cbat98 made their first contribution in #473

Full Changelog: 0.7.0...0.7.2

Contributors

orishavit, orweis, and 6 other contributors
Assets 8
Loading

v0.7.0

10 May 19:13
@asafc asafc
0.7.0
60796be
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.0

What's Changed

Supporting a new policy engine: Cedar Agent

Cedar Agent provides the ability to run Cedar as a standalone agent (Similar to how one would use OPA) which can then be powered by OPAL. OPAL manages the policies loaded into Cedar through git, same as for OPA, and can push data updates in real time from external data sources.
Example OPAL configuration for Cedar can be found here.

The Cedar policy language offers better readability, better performance for policy evaluation and is analyzable via automatic reasoning.

  • Add a Cedar policy engine plugin by @shaulk in #461
  • Shaul/per 5343 update cedar agent in opal by @shaulk in #463

Small fixes and improvements

  • Add platforms to build-push-action with amd64 and arm64 by @vivedo in #427
  • [Snyk] Security upgrade setuptools from 39.0.1 to 65.5.1 by @RazcoDev in #323
  • [Snyk] Security upgrade setuptools from 39.0.1 to 65.5.1 by @asafc in #324
  • Bump json5 from 2.2.1 to 2.2.3 in /documentation by @dependabot in #354
  • Bump webpack from 5.74.0 to 5.76.1 in /documentation by @dependabot in #410
  • Upgrade GitHub Action by @cclauss in #417
  • Docs: Add periodic_update_interval to data-sources.mdx by @roekatz in #458
  • Oded/small docs fixes by @obsd in #283
  • sort and add more questions by @orweis in #459
  • Merge pull request #347 from permitio/improve-cli-windows-support by @orweis in #349
  • Tests: Mark test_external_http_get flaky for retries by @roekatz in #460
  • bump version: 0.7.0 by @asafc in #462

New Contributors

Full Changelog: 0.6.1...0.7.0

Contributors

obsd, orweis, and 7 other contributors
Assets 8
Loading

v0.6.1

01 May 17:36
@roekatz roekatz
0.6.1
cfe2d07
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.6.1

What's Changed

Bug Fixes

  • Fix exception thrown on webhook for API policy source by @urspraveen2001 in #438
  • Fix restoring OPA from a local backup on offline mode by @roekatz in #450
  • Fix clients can't reconnect when broadcaster disconnects if statistics are enabled by @roekatz in #453

New Contributors

Full Changelog: 0.6.0...0.6.1

Contributors

roekatz and urspraveen2001
Assets 8
Loading

v0.6.0

21 Apr 08:02
@roekatz roekatz
0.6.0
001c8ae
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.6.0

What's Changed

New Features in Policy Store Control (Client)

  • Automatic resolution of ordering issues: Any failed policy store loading operation (file loading / deletion) would be re-attempted after completing other operations (instead of bailing out), thus eventually achieving the correct loading order via trial and error. by @roekatz in #425
    • Eliminates the need to explicitly define .manifest files on most cases (although having an explicit manifest might still be beneficial for performance).
    • Resolves the known issue of handling moved/renamed modules.
  • OAuth2 support for policy store authentication by @scarlier in #407
  • Add option to ignore specific policy files by @orweis in #414
    • Could be used to prevent opal-client from overriding policy files managed outside OPAL.
  • Optional offline mode, where policy store's data is restored from a local backup file on client startup (Thus being able to handle queries even when server connection can't be established) by @roekatz in #441

Server Multi Process Stability

Bug fixes in using opal-server with multiple workers (UVICORN_NUM_WORKERS) and/or multiple instances (e.g. pod replicas).

  • Fix leader worker sometimes not getting git webhook event (Bug in broadcaster subscription) by @roekatz in #398
  • Turn on BROADCAST_CONN_LOSS_BUGFIX_EXPERIMENT_ENABLED by default (Fixes silent connection losses to Postgres broadcaster) @roekatz in #443
  • Bump fastapi_websocket_pubsub ver to 0.3.3 by @roekatz in #423

Health Checks

  • Make client's health check always available (without requiring persisting health status in OPA by setting OPAL_OPA_HEALTH_CHECK_POLICY_ENABLED) by @roekatz in #420
  • Expose new /ready endpoint - would return 200 OK if OPA was loaded from either server or backup (on newly available offline mode) at least once. by @roekatz in #441

Scopes Stability

Introduce quite a few refactors & changes in scopes we've been working on and testing internally lately. by @roekatz in #436.

  • Bug fixes related to using multiple Uvicorn workers and / or multiple instances (e.g pod replicas).
  • Getting rid of Celery worker (a.k.a opal-server-worker) for periodically syncing scopes (Instead, using the leader process the same way it's used when scopes are disabled).
  • Bug fixes in detecting and notifying changes when multiple scopes use the same git repository (but possibly different branches).
  • Fix races in detecting and notifying changes during server setup time (cloning all scopes' repos).
  • Better logging when using scopes

Other Improvements & Fixes

  • Optionally allow to skip url matching in git webhook receiver by @asafc in #400
  • Rename OPAL_SERVER_PORT -> OPAL_SERVER_BIND_PORT to avoid configuration parsing error when k8s sets this envar to "tcp://..." if there's a service named "opal-server" (For backward compatibility old envar would still be used if has a valid port integer value). by @roekatz in #442

Docs & Examples

New Contributors

Full Changelog: 0.5.0...0.6.0

Contributors

scarlier, orweis, and 8 other contributors
Assets 8
Loading

v0.5.0

27 Feb 17:39
@asafc asafc
0.5.0
b8866bc
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.5.0

What's Changed

This release contains several small fixes and improvements.

New Feature: Bundle Ignore

Adds support for omitting files in the bundle produced by opal-server. Use the OPAL_BUNDLE_IGNORE environment variable to specify a list of comma separated glob paths which if matched will ignore a file from being included in the policy bundle.

Bug fix: bitbucket webhook

Fixes #381: When sending a webhook from Bitbucket to the OPAL server with an secret configured then the the response on the request is an 401, no secret was provided. This is unexpected as the configuration looks correct.

  • fix bug in parsing and make tests test secrets by @orweis in #384

Bug fix: confi default casting

  • improve error logging, and fix defualt casting by @orweis in #371

Improve usability of topics in data updates

  1. Have the default topic (policy_data) as a default value for DataSourceEntry.topics - To prevent users who have left this empty before from experiencing breaking changes as a result of related bug fixes in 0.4.0. Also fixes #375: Uncaught server exception when posting data update without topics
  2. Warn at realtime when published entry doesn't have topics, or when client processes data update with no matching entries (this would cover what isn't covered by 1).
  3. Fix documentation about topics in data updates.

Included PRs:

  • Improve usability of topics in data updates by @roekatz in #389

CI Fixes

Documentation Fixes

New Contributors

Full Changelog: 0.4.0...0.5.0

Contributors

orishavit, orweis, and 7 other contributors
Assets 8
Loading

v0.4.0

01 Feb 23:01
@asafc asafc
0.4.0
588871d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.4.0

What's Changed

This release contains several small fixes and improvements.

Support custom OPA versions / variants

  • Extract OPA executable from opa docker image by @tibotix in #316
  • Add opa_image Dockerfile build argument by @tibotix in #322

Improved OPAL client healthcheck

  • OPAL client healthcheck returns the value of the OPA healthcheck policy, based on sync status by @orishavit in #332

Fixed: Hanging redis lock issue

  • This fix by @roekatz solves the issue of the Redis lock (around the policy git clone) staying hanging forever (preventing new workers from cloning the repo). Probably because the app crashes with segfault before releasing the lock. link: #345

Fixed: Pulling policy from private repo only succeeds for newly cloned repos

More webhook formats supported

New configuration options

Small fixes and improvements

Documentation Fixes

New Contributors

Full Changelog: 0.3.1...0.4.0

Contributors

garnerp, orishavit, and 10 other contributors
Assets 8
Loading

v0.3.1

14 Oct 18:52
@asafc asafc
0.3.1
b04d2f9
Compare
Choose a tag to compare
v0.3.1

What's Changed

Minor bug fixes and improvements.

This release allows you to define periodic refetching on a data source, initiated by the server.
Simply define periodic_update_interval on the entry to desire to periodically refetch.

New Contributors

Full Changelog: 0.3.0...0.3.1

Contributors

jamielennox and DServy
Assets 8
Loading

v0.3.0

11 Oct 16:14
@asafc asafc
0.3.0
dd396ad
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.3.0

What's Changed

New Feature: Inline data updates

You can now push a data update via opal that already includes the data itself (inline) instead of including a reference url and incurring another network round trip. This is best for small incremental data updates.

Fixes: Performance and stability improvements to OPAL Scopes

OPAL Scopes is a new experimental feature that allows a single OPAL server to track multiple git repositories, and in essence enables true multi-tenancy by a single OPAL deployment. This release includes major improvements to the performance and stability of this feature.

  • Improve opal scopes performance by @asafc in #298

Minor bug fixes

  • Add redis dependency to OPAL by @orishavit in #296
  • Update OPAL Server from worker also after initial clone by @orishavit in #297
  • Fix OPAL server trying to use the broadcaster when it's not configured by @shaulk in #295

Documentation

New Contributors

Full Changelog: 0.2.1...0.3.0

Contributors

orishavit, shaulk, and 2 other contributors
Assets 8
Loading