Cerbos v0.39.0 :: Cerbos Authorization Management Platform // Documentation

Cerbos v0.39.0

Highlights

This release introduces a new, experimental policy type for defining access matrices for roles. Role policies enable policy authors to further refine the permissions by defining a set of resources and actions that a principal with a particular role is allowed to perform on them. Any action not explicitly allowed by the set of role policies that apply to a given principal are automatically denied. Everything else falls through to the familiar Cerbos policy evaluation flow to determine whether they are actually allowed or not. Please note that role policies are not fully production ready yet. More updates — including query planner support — will be added in upcoming Cerbos releases.

The blob storage driver has been re-worked to handle store updates more efficiently and robustly. If a user accidentally pushes an invalid set of files to the remote storage bucket, the PDPs will continue to use the last-known good version of the policy repository until the remote storage bucket is fixed. When the blob driver is configured with a persistent work directory, PDPs will now only download changed policy files, reducing the overall network usage while making the PDP start faster as well. New metrics have been added to report on refresh errors and the timestamp of the last successful refresh.

Thanks to a community contribution from @jinrenjie, the Cerbos API explorer now uses the correct protocol when behind a TLS-terminating proxy.

Thanks to another community discovery, a performance issue affecting schema validation has been rectified. Users with schema validation enabled on their PDPs should see much improved response times after installing this update.

The Cerbos server and the cerbosctl utility can now be installed on Nix environments using the flake available at https://github.com/cerbos/cerbos-flake.

Go developers are now able to run Cerbos in-process using the new cerbos.Serve function. This is useful for cases where running an external process is impossible or for running tests without using the Docker helpers provided by the Cerbos Go SDK.

Changelog

Bug Fixes

Features

Enhancements

Documentation

Chores