Skip to content

Releases: open-policy-agent/opa

v0.62.1

06 Mar 10:37
@github-actions github-actions
v0.62.1
a4d77da
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.62.1

This is a security fix release for the fixes published in Go 1.22.1.

OPA servers using --authentication=tls would be affected: crafted malicious client certificates could cause a panic in the server.

Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin, status and decision logs; and http.send calls that verify TLS.

This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).

Note that there are other security fixes in this Golang release, but whether or not OPA is affected is harder to assess. An update is advised.

Miscellaneous

Contributors

mosabua and fredmaggiowski
Assets 14
Loading

v0.62.0

29 Feb 17:24
@github-actions github-actions
v0.62.0
1d0ab93
Compare
Choose a tag to compare
v0.62.0

NOTES:

  • The minimum version of Go required to build the OPA module is 1.20

This release contains a mix of improvements and bugfixes.

Runtime, Tooling, SDK

  • cmd: Add environment variable backups for command-line flags (#6508) authored by @colinjlacy
  • download/oci: Add missing WithBundleParserOpts method to OCI downloader (#6571) authored by @slonka
  • logging: avoid %!F(MISSING) in logs by skipping calls to the {Debug,Info,Warn,Error}f functions when there are no arguments (#6555) authored by @srenatus

Topdown and Rego

  • ast+cmd: Allow bundle to contain calls to unknown Rego functions when inspected (#6591) authored by @johanfylling
  • topdown/http: Respect raise_error flag during input validation (#6553) authored by @ashutosh-narkar

Docs + Website + Ecosystem

  • Add OpaDotNet to ecosystem projects (#6554) authored by @me-viper
  • Add updated logos for Permit.io and OPAL (#6562) authored by @danielbass37
  • docs: Update description of the url path usage when accessing values inside object and array documents for v1/data GET and POST (#6567) authored by @ashutosh-narkar
  • docs: Use application/yaml instead of application/x-yaml as the former is now a recognized content type (#6565) authored by @anderseknert

Miscellaneous

  • Add Elastic to ADOPTERS.md (#6568) authored by @orouz
  • Dependency updates; notably:
    • bump golang 1.21.5 -> 1.22 (#6595) authored by @srenatus
    • bump google.golang.org/grpc from 1.61.0 to 1.62.0
    • bump golang.org/x/net from 0.19.0 to 0.21.0
    • bump github.com/containerd/containerd from 1.7.12 to 1.7.13
    • bump aquasecurity/trivy-action from 0.16.1 to 0.17.0
    • bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0
    • bump github.com/opencontainers/image-spec from 1.1.0-rc5 to 1.1.0-rc6

Contributors

me-viper, anderseknert, and 7 other contributors
Assets 14
Loading

v0.61.0

25 Jan 13:34
@github-actions github-actions
v0.61.0
ea7a3e1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.61.0

This release contains a mix of new features and bugfixes.

Runtime, SDK

  • Adding --v1-compatible flag to all previously unsupported command line commands (#6520) authored by @johanfylling
  • Don't load files in tarball exceeding size_limit_bytes (#6514) authored by @anderseknert reported by @dolevf
  • Allow TLS cipher suites to be set for the OPA server (#6537) authored by @ashutosh-narkar
  • Removing deprecated fields and functions related to rego-v1 compatibility (#6542) authored by @johanfylling
  • bundle: Make func newDescriptor and withCloser public (#6517) authored by @antgubarev
  • runtime/logging: Do not panic when rctx is missing (#6506) authored by @srenatus

Topdown

  • topdown: Clean expired http.send cache entries periodically (#5320) authored by @rudrakhp reported by @lukyer

Docs

Miscellaneous

  • linters+testdata: Reformat all yaml testcases for linting. (#6511) authored by @philipaconrad
  • Dependency updates, notably:
    • bump github.com/containerd/containerd from 1.7.11 to 1.7.12
    • bump github.com/go-logr/logr from 1.3.0 to 1.4.1
    • bump github.com/google/uuid from 1.5.0 to 1.6.0
    • bump github.com/prometheus/client_golang from v1.16.0 to v1.18.0
    • bump google.golang.org/grpc from 1.60.1 to 1.61.0

Contributors

trungnguyen, anderseknert, and 12 other contributors
Assets 14
Loading

v0.60.0

21 Dec 10:41
@github-actions github-actions
v0.60.0
a1a2ae3
Compare
Choose a tag to compare
v0.60.0

v0.60.0

Runtime, Tooling, SDK

  • OPA can be run in 1.0 compatibility mode by using the new --v1-compatible flag. When this mode is enabled, the current release of OPA will behave as OPA v1.0 will eventually behave by default. This flag is currently supported on the build, check, fmt, eval and test commands (#6478) authored by @johanfylling
  • Extend the telemetry report to include the minimum compatible version of policies loaded into OPA (#6361) co-authored by @srenatus and @ashutosh-narkar
  • server: Support fsnotify based reloading of certificate, key and CA cert pool when they change on disk (#5788) authored by @charlieegan3
  • Add option on the unit test runner to surface builtin errors. This should help with debugging errors generated while running unit tests (#6489) authored by @jalseth
  • Fix issue in opa fmt where the assignment operator and term in the rule head of chain rules are removed from the re-written rule head (#6467) authored by @anderseknert
  • cmd/fmt: Replace dependency on diff tool with an external golang library function (#6284) authored by @colinjlacy

Topdown and Rego

  • topdown/providers: Preserve user provided http headers in the providers.aws.sign_req builtin command (#6456) authored by @c2zwdjnlcg
  • rego: Allow custom builtin function registration to provide a description for the builtin (#6449) authored by @lcarva
  • ast+cmd: Allow bundle to contain calls to unknown functions when inspected (#6457) authored by @johanfylling

Docs

  • Add section on the changes proposed for a future OPA v1.0 and update Rego examples to be OPA v1.0 compliant(#6453) authored by @johanfylling
  • Clarify behavior of the sprintf builtin command when used with the %T marker (#6487) authored by @lcarva

Website + Ecosystem

Miscellaneous

  • Update Makefile to allow custom GOFLAGS to be provided to the golang executable (#6458) authored by @cova-fe
  • Dependency updates; notably:
    • bump golang 1.21.4 -> 1.21.5 (#6460) authored by @srenatus
    • bump aquasecurity/trivy-action from 0.14.0 to 0.16.0
    • bump github.com/containerd/containerd from 1.7.9 to 1.7.11
    • bump google.golang.org/grpc from 1.59.0 to 1.60.1
    • bump github.com/google/uuid from 1.4.0 to 1.5.0

Contributors

cova-fe, anderseknert, and 8 other contributors
Assets 14
Loading

v0.59.0

30 Nov 15:49
@github-actions github-actions
v0.59.0
c8e7863
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.59.0

v0.59.0

This release adds tooling to help prepare existing policies for the upcoming OPA 1.0 release.
It also contains a mix of improvements, bugfixes and security fixes for third-party libraries.

NOTES:

  • All published OPA images now run with a non-root uid/gid. The uid:gid is set to 1000:1000 for all images. As a result
    there is no longer a need for the -rootless image variant and hence it will not be published as part of future releases.
    This change is in line with container security best practices. OPA can still be run with root privileges by explicitly setting the user,
    either with the --user argument for docker run, or by specifying the securityContext in the Kubernetes Pod specification.

Rego v1

The upcoming release of OPA 1.0, which will be released at a future date, will introduce breaking changes to the Rego language. Most notably:

  • the keywords that currently must be imported through import future.keywords into a module before use will be part of the Rego language by default, without the need to first import them.
  • the if keyword will be required before the body of a rule.
  • the contains keyword will be required when declaring a multi-value rule (partial set rule).
  • deprecated built-in functions will be removed.

This current release (0.59.0) introduces a new --rego-v1 flag to the opa fmt and opa check commands to facilitate the transition of existing policies to be compatible with the 1.0 syntax.

When used with opa fmt, the --rego-v1 flag will format the module(s) according to the new Rego syntax in OPA 1.0.
Formatted modules are compatible with both the current version of OPA and 1.0.
Modules using deprecated built-ins will terminate formatting with an error. Future versions of OPA will support rewriting applicable function calls with equivalent Rego compatible with 1.0.

When used with opa check, the --rego-v1 flag will check that the modules are compatible with both the current version of OPA and 1.0.

Relevant Changes

Runtime, Tooling, SDK

Topdown and Rego

  • ast: Allowing packages to be declared within the dynamic extent of a rule (#6387) authored by @johanfylling
  • ast: Disallow root document shadowing in leading term of rule refs (#6291) authored by @johanfylling
  • topdown: Add a new builtin function strings.render_template to render templated strings (#6371) authored by @RDVasavada
  • topdown/crypto: Add URIStrings field to JSON certs (#6416) authored by @charlieegan3 reported by @kenjenkins
  • ast: change ident token string (#6435) authored by @tsandall

Miscellaneous

  • chore: Fix IDE warnings and remove usage of several deprecated fields. (#6397) authored by @willbeason
  • chore: Disable verbose output in wasm-sdk-e2e-test (#6434) authored by @tsandall
  • deps: group otel deps (#6407) authored by @srenatus
  • test: add environment variable tests (#6420) authored by @robhafner
  • Docs & Website:
  • Dependency updates; notably:
    • golang from 1.21.3 to 1.21.4
    • OpenTelemetry (contrib) 1.21.0/0.46.1

Contributors

tsandall, jwineinger, and 15 other contributors
Assets 14
Loading

v0.58.0

26 Oct 22:37
@github-actions github-actions
v0.58.0
69a381c
Compare
Choose a tag to compare
v0.58.0

NOTES:

  • All published OPA images now run with a non-root uid/gid. The uid:gid is set to 1000:1000 for all images. As a result
    there is no longer a need for the -rootless image variant and hence it will not be published as part of future releases.
    This change is in line with container security best practices. OPA can still be run with root privileges by explicitly setting the user,
    either with the --user argument for docker run, or by specifying the securityContext in the Kubernetes Pod specification.

This release contains a mix of performance improvements, bugfixes and security fixes for third-party libraries.

Runtime, Tooling, SDK

  • cmd/test: Display lines not covered if code coverage threshold not met in verbose reporting mode (#2562) authored by @johanfylling
  • cmd/test: Don't round up test coverage calculation as it could lead to inaccurate code coverage results (#6307) authored by @anderseknert
  • cmd/fmt: Don't format functions without a value to include = true as it is implied (#6323) authored by @anderseknert
  • server: Remove deprecated partial query parameter from REST API. This option has been deprecated since v0.23.0 (#2266) authored by @ashutosh-narkar
  • Add support for configurable prometheus buckets for the http_request_duration_seconds metric (#6238) authored by @AdrianArnautu
  • plugins/bundle: Update bundle plugin state on a reconfigure operation when existing bundle is not modified (#6311) authored by @asadk12
  • internal/pathwatcher: Fix how paths to watch by a fsnotify watcher are determined to avoid monitoring unintended directories and files (#6277) authored by @ashutosh-narkar

Topdown and Rego

  • topdown: Fix issue with build optimization producing support modules with forbidden characters in first var of rule ref (#6338) authored by @johanfylling
  • topdown: Fix panic in build optimization when policy contains rules with a general ref in the head (#6339) authored by @johanfylling
  • topdown: Avoid unnecessary conversion of small numbers by caching them and thereby helping to speed up some arithmetic operations (#6021) authored by @ashutosh-narkar
  • ast+rego: Disable compiler stages for IR-based eval paths (#6335) authored by @srenatus
  • built-in/walk: Skip path creation if path is assigned a wildcard to achieve faster walk-ing (#6267) authored by @anderseknert
  • ast: Add regression test for edge case where partial rule hides recursion cycle (#6318) authored by @johanfylling

Docs

  • Drop EXPERIMENTAL status of reported prom metrics (#6298) authored by @ashutosh-narkar
  • Update documentation on GCS bundles for case where the resource (the object in the GCS bucket) contains slashes (/) or other special characters (#6264) authored by @dennisg
  • Provide a more clear description of negation in the policy language section (#6275) authored by @gusega

Website + Ecosystem

  • Fix un-versioned built-in docs issue so that only the built-ins for a given doc version are displayed (#6269) authored by @charlieegan3

Miscellaneous

  • ci: Remove hub tool in GitHub workflows in favor of GitHub CLI tool (#6326) authored by @ashutosh-narkar
  • Dependency updates; notably:
    • bump go.opentelemetry.io modules (#6292) authored by @cksidharthan
    • aquasecurity/trivy-action from 0.12.0 to 0.13.0
    • github.com/containerd/containerd from 1.7.6 to 1.7.7
    • github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0
    • golang.org/x/net from 0.15.0 to 0.17.0
    • google.golang.org/grpc from 1.58.2 to 1.59.0 (addresses vulnerability GHSA-m425-mq94-257g)
    • oras.land/oras-go/v2 from 2.3.0 to 2.3.1
    • sigs.k8s.io/yaml from 1.3.0 to 1.4.0

Contributors

dennisg, gusega, and 8 other contributors
Assets 14
Loading

v0.57.1

18 Oct 12:27
@johanfylling johanfylling
v0.57.1
fc26bd1
Compare
Choose a tag to compare
v0.57.1

This is a bug fix release addressing the following security issues:

Golang security fix GO-2023-2102

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

OpenTelemetry-Go Contrib security fix CVE-2023-45142

Denial of service in otelhttp due to unbound cardinality metrics.

Assets 14
Loading

v0.57.0

28 Sep 14:54
@github-actions github-actions
v0.57.0
c2f42aa
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.57.0

This release contains an updated Rego syntax to allow general references in rule heads, and a mix of new features and bugfixes.

Support for General References in Rule Heads

In OPA 0.56.0, we introduced support for general references in rule heads as an experimental feature.
It has now graduated to a fully supported feature, and is no longer experimental.

A general reference is a reference with variables at arbitrary locations.
In Rego, partial rules are used for generating sets and objects.
In previous versions of OPA, variables were only allowed in the very last position in the rule's reference.
Now, Rego has been expanded to allow rules to be declared with general references in their head, with variables at arbitrary locations.
This allows for generating nested dynamic object structures:

package example

import future.keywords

# Converting a flat list of users to a mapping by "role" and then "id".
users_by_role[role][id] := user if {
    some user in data.users
    id := user.id
    role := user.role
}

# Explicit "admin" key override to the above mapping.
users_by_role.admin[id] := user if {
    some user in data.admins
    id := user.id
}

# Leaf entries can be multi-value.
users_by_country[country] contains user.id if {
    some user in data.users
    country := user.country
}

See the documentation for more information.

Authored by @johanfylling.

Runtime, Tooling, SDK

Topdown and Rego

Miscellaneous

  • ast: Add location to single entry rule head ref (#6199) authored by @Ronnie-personal
  • ast: Add option to marshal location text (#6213) authored by @charlieegan3
  • types: New algorithm for (Any).Union + new benchmarks (#6228) authored by @philipaconrad
  • Updates to documentation and website authored by @charlieegan3
  • Dependency updates; notably:
    • golang from 1.21 to 1.21.1
    • golang.org/x/net from 0.14.0 to 0.15.0
    • google.golang.org/grpc from 1.57.0 to 1.58.2
    • github.com/containerd/containerd from 1.7.4 to 1.7.6

Breaking Changes

GO SDK: the ast.JSONOptions struct has changed location to ast.json.Options.

Contributors

charlieegan3, philipaconrad, and 4 other contributors
Assets 14
Loading

v0.56.0

31 Aug 14:40
@github-actions github-actions
v0.56.0
016cb07
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.56.0

This release contains a mix of new features, bugfixes and a new builtin function.

Support for General References in Rule Heads (Experimental)

A new experimental feature in OPA is support for general refs in rule heads. Where a general ref is a reference with variables at arbitrary locations.

package example

import future.keywords

# Converting a flat list of users to a mapping by "role" and then "id".
users_by_role[role][id] := user if {
    some user in data.users
    id := user.id
    role := user.role
}

# Explicit "admin" key override to the above mapping.
users_by_role.admin[id] := user if {
    some user in data.admins
    id := user.id
}

# Leaf entries can be multi-value.
users_by_country[country] contains user.id if {
    some user in data.users
    country := user.country
}

General refs are currently not supported by the OPA planner, making this feature unsupported for Wasm and IR.

Note: this feature is disabled by default, and needs to be enabled by setting the EXPERIMENTAL_GENERAL_RULE_REFS environment variable (once the feature is complete - supports Wasm and IR - this requirement will be dropped).

Authored by @johanfylling.

New Built-In Function: numbers.range_step

Similar to the numbers.range built-in function, numbers.range_step returns an array of numbers in a given range. The new built-in function also allows you to control the step between each entry.

See the documentation on the new built-in
for all the details.

Authored by @sspaink.

New Ecosystem page on The Website

The OPA Ecosystem of related integrations has been refreshed and moved to a more prominent location on the website.

If you're interested to add any new integrations you've been working on, please see the docs here (updates to existing integrations are very welcome too!).

Runtime, Tooling, SDK

  • ast: Update strict error check message for unused args (#6125) authored by @ashutosh-narkar
  • ast: Remove unnecessary nil check (#6155) authored by @Juneezee
  • cmd: Make opa test -z fail with failing tests (#6126) authored by @fdaguin
  • cmd: Fix opa test --ignore when used together with --bundle (#6185) authored by @joaobrandt
  • cmd: Adding --fail-non-empty flag to opa exec (#6153) authored by @Ronnie-personal
  • download: Add opa_no_oci flag to build without containerd (#6159) authored by @slonka
  • download: Remove not required basedir for oci bundles & add test to verify signature verification (#6145) authored by @gitu
  • fmt: Trim trailing whitespace in comments (#6161) authored by @anderseknert
  • fmt: Remove dedup comment function in opa fmt (#6165) authored by @anderseknert
  • runtime: Always read .tar.gz file provided in argument as a bundle (#5879) authored by @yogisinha
  • server/authorizer: Inline readBody (#6156) authored by @srenatus
  • test: Bind test server to localhost interface (#6162) authored by @anderseknert

Topdown and Rego

  • ast: Including "child" rules when fetching rules by ref (#6182) authored by @johanfylling
  • ast: Making partial object key rules contribute to dynamic portion of object type (#6138) authored by @johanfylling
  • rego: Expose PrepareOption, add BuiltinFuncs (#6188) authored by @srenatus
  • topdown: Support force cache even when server doesn't set the Date header (#6175) authored by @c2zwdjnlcg
  • topdown: Partial-eval for partial object/set ref head rules (#6094) authored by @johanfylling

Miscellaneous

Breaking changes

Since its introduction in 0.34.0, the --exit-zero-on-skipped option always made the opa test command return an exit code 0. When used, it now returns the exit code 0 only if no failed tests were found.

Test runs on existing projects using --exit-zero-on-skipped will fail if any failed tests were inhibited by this behavior.

Contributors

atkrad, mrueg, and 18 other contributors
Assets 14
Loading

v0.55.0

27 Jul 18:10
@github-actions github-actions
v0.55.0
4c21ddd
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.55.0

NOTES:

  • All published OPA images now run with a non-root uid/gid. The uid:gid is set to 1000:1000 for all images. As a result
    there is no longer a need for the -rootless image variant and hence it will be not be published as part of future releases.
    This change is in line with container security best practices. OPA can still be run with root privileges by explicitly setting the user,
    either with the --user argument for docker run, or by specifying the securityContext in the Kubernetes Pod specification.

  • The minimum version of Go required to build the OPA module is 1.19

This release contains a mix of new features, bugfixes and a new builtin function.

Honor default keyword on functions

Previously if a function was defined with a default value, OPA would ignore it. Now the default function is honored
if all functions with the same name are undefined. For example,

package example

default clamp_positive(_) := 0

clamp_positive(x) = x {
    x > 0
}
$ opa eval -d example.rego 'data.example.clamp_positive(1)' -f pretty
1

$ opa eval -d example.rego 'data.example.clamp_positive(-1)' -f pretty
0

The value of a default function follows the same conditions as that of a default rule. In addition, a default
function satisfies the following properties:

  • same arity as other functions with the same name
  • arguments should only be plain variables ie. no composite values
  • argument names should not be repeated

NOTE:

default functions used to be previously ignored. If existing policies contain default functions, ensure that they conform
to the properties mentioned above. Otherwise, those policies will fail to evaluate.

Authored by @ashutosh-narkar.

New Built-In Function: crypto.parse_private_keys

crypto.parse_private_keys returns zero or more private keys from the given encoded string containing DER certificate data.
If the input contains a list of one or more concatenated PEM blocks, then the built-in will output the parsed private keys
represented as objects.

See the documentation on the new built-in
for all the details.

Authored by @volck.

Runtime, Tooling, SDK

  • plugins/rest: Add AWS KMS support for OAuth2 Client Credentials JWT authentication (#5942) authored by @prasanthu
  • sdk: Update input object to conform to the format expected by decision log masking (#6090) authored by @epaulson10
  • sdk: Add option for specifying decision ID to SDK. Users can use this to control the ID that gets included in the decision logs (#6101) authored by @brianchhun-chime
  • cmd: Add discard output format to opa eval which discards the result while still showing the output of eval flags like --profile (#6103) authored by @26tanishabanik
  • Make rootless deprecation messages more explicit as all published OPA images now run with non-root uid/gid (#6091) authored by @charlieegan3
  • download/oci: Add support for Docker Registry v2 authentication scheme (#6045) authored by @gitu and @DerGut
  • plugins/discovery: Ensure discovery plugin doesn't erase its own config on the plugin manager (#6070) authored by @blacksails

Topdown and Rego

  • ast: Add WithRoots compiler option that allows callers to set the roots to include in the output bundle manifest (#6088) authored by @kubaj
  • rego: Parse store modules iff modules set on the Rego object. This change assumes that while using the Rego package, the compiler and store are kept in-sync, and thereby attempts to avoid a race during the compilation process (#6081) authored by @ashutosh-narkar

Docs

  • docs/envoy: Update the standalone Envoy tutorial to use kind, updated Envoy version etc. (#6105) authored by @charlieegan3

Website + Ecosystem

  • Ecosystem:

  • Website:

    • Reorganize relevant doc sections and OPA Ecosystem projects to have a closer integration between them (#6064) authored by @charlieegan3

Miscellaneous

  • chore: Update comments on some exported functions and clean up instances where the same package was imported multiple times (authored by @testwill)
  • Fix issue in the OPA release patch scripts related to CRLF line terminations in the patch output (#6069) authored by @johanfylling
  • Dependency bumps, notably:
    • golang from 1.20.5 to 1.20.6
    • oras.land/oras-go/v2 from 2.2.0 to 2.2.1
    • google.golang.org/grpc from 1.56.1 to 1.56.2
    • github.com/containerd/containerd from 1.6.19 to 1.7.2
    • golang.org/x/net from 0.11.0 to 0.12.0
    • go.uber.org/automaxprocs from 1.5.2 to 1.5.3
    • go.opentelemetry.io/otel from v1.14.0 to v1.16.0 (#6062) authored by @srenatus with feedback from @ghaskins and @zregvart

Contributors

ghaskins, prasanthu, and 15 other contributors
Assets 14
Loading