Cerbos v0.22.0

Highlights

The query planner is now smarter and able to produce simpler, optimized plans for some of the commonly seen filter patterns. For example, checking for membership in a single-item list can be converted to a comparison operation and checking for membership in an empty list can be reduced to simply return false. This should help you build better database queries for building lists of resources filtered using access control logic.

There are several more improvements and fixes to the query planner in this release:

• Query plan requests are now validated using schemas if they are available. This should help catch invalid requests and schema drifts early.
• All the custom CEL functions provided by Cerbos are now supported for query plan generation.
• A few more edge cases and bugs found by production users have been addressed.

The Cerbos engine now coordinates all parallel requests to changed policies while they’re being compiled. This should help reduce latency spikes in busy servers during policy recompilation.

To aid with debugging, if the Cerbos process receives a USR1 signal, it will now temporarily switch the log level to debug level for 10 minutes.

Validation rules for scopes have been relaxed. Scope components no longer need to be at least two characters long.

Changelog

Bug Fixes

• Derived role condition is optional ( #1301)
• Handle other data types while optimizing IN expression ( #1334)
• Handling of null value by the query planner ( #1317)
• Missing setters in policy builders ( #1325)
• Treat non-boolean expression results as false ( #1256)
• Update hasIntersection function to support partial eval ( #1278)
• Validate required fields in PlanResourcesRequest ( #1262)

Features

• Optimise a query plan of a membership test in a single-item list ( #1299)
• Optimise query plan for index into struct ( #1327)
• Temporary log level change with USR1 signal ( #1255)
• Update list functions to support partial eval ( #1281)

Enhancements

• Group compile requests ( #1235)
• Relax validation rule for scopes ( #1254)

Documentation

• Add tip about using cerbosctl to load policies ( #1332)
• Added Engineering section with post on single process usage ( #1264)
• Fix formatting of table in tutorial ( #1329)
• Fix usage of CEL matches operator ( #1245)
• Make optionality of Scoped Policies more explicit ( #1251)
• README key concepts ( #1274)
• Updated the user logos on the README ( #1321)
• Updating the logos ( #1313)

Chores

• Allow configuring a custom nodePort in helm chart values ( #1250)
• Bump amannn/action-semantic-pull-request from 4.5.0 to 4.6.0 ( #1239)
• Bump github.com/denisenkom/go-mssqldb from 0.12.2 to 0.12.3 ( #1285)
• Bump github.com/minio/minio-go/v7 from 7.0.37 to 7.0.38 ( #1244)
• Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.35.0 to 0.36.0 ( #1242)
• Bump version to 0.22.0
• Use latest Go version in builds ( #1275)