Cerbos v0.12.0 :: Cerbos Authorization Management Platform // Documentation

Cerbos v0.12.0

Highlights

We are excited to introduce the new experimental query planner API to address a common use case in access control scenarios: filtering a list to retain only those items that a particular user has access to. You can now send a principal, action and resource kind to /api/x/plan/resources and obtain a tree representation of conditions that must be satisfied in order for that principal to be allowed to perform the action on that resource kind. This API addresses a long-standing request from our users and the underlying algorithms and the representation format will be further refined in upcoming releases based on user feedback. See Resources Query Plan for details about the new API.

Another exciting change in this release is the freshly revamped cerbosctl utility. In addition to being able to list and filter policies, you can now also list the schemas stored on the PDP. We have streamlined the user experience to reflect the common CLI patterns provided by other, highly popular infrastructure management tools and thereby reduce the time required to become familiar with Cerbos. This is one of the rare cases where we felt that a breaking change was necessary to improve PDP resource usage and to make the user experience better. The cerbosctl list command has been replaced with cerbosctl get and the underlying Admin API endpoints have changed to provide policy listing and retrieval with much more predictable and constrained resource usage regardless of how many policies are stored in the policy repository. See Admin API documentation and Cerbosctl documentation for more details.

You can now use auxData in policy test suites to verify that the policies behave as you expect given various permutations of JWT data. When tests fail, you can inspect the evaluation graph of the request using the verbose flag to the test runner. See Validating and testing policies for details.

Schema validation can now be disabled for particular actions to support special cases such as resource creation where most of the necessary attributes might not be available to pass the validation step.

In addition to the headline features outlined above, a variety of security, usability, reliability and documentation improvements are included in this release as well. Those include: switching the container base image to scratch, stricter JSON parsing for REST endpoints, automated documentation generation for configuration from source code analysis and, a new end-to-end test suite to exercise all supported storage drivers.

Changelog

Bug Fixes

Features

Enhancements

Documentation

Chores

Other