Open Policy Agent (OPA) is an open source, general-purpose policy engine.
This is a bug fix release addressing the following issues:
macos-latest
was changed from amd64
to arm64
and as a result darwin/amd64
binary wasn't released (#6720) authored by @suzuki-shunsukeNOTES:
- The minimum version of Go required to build the OPA module is 1.21
This release contains a mix of features, a new builtin function (json.marshal_with_options()
), performance improvements, and bugfixes.
Previously if Discovery was enabled, other features like bundle downloading and status reporting could not be configured manually. The reason for this was to prevent OPAs being deployed that could not be controlled through discovery. It's possible that the system serving the discovered config is unaware of all options locally available in OPA. Hence, we relax the configuration check when discovery is enabled so that the bootstrap configuration can contain plugin configurations. In case of conflicts, the bootstrap configuration for plugins wins. These local configuration overrides from the bootstrap configuration are included in the Status API messages so that management systems can get visibility into the local overrides.
In general, the bootstrap configuration overrides the discovered configuration. Previously this was not the case for all
configuration fields. For example, if the discovered configuration changes the labels
section, only labels that are
additional compared to the bootstrap configuration are used, all other changes are ignored. This implies labels in the
bootstrap configuration override those in the discovered configuration. But for fields such as default_decision
, default_authorization_decision
,
nd_builtin_cache
, the discovered configuration would override the bootstrap configuration. Now the behavior is more consistent
for the entire configuration and helps to avoid accidental configuration errors. (#5722) authored by @ashutosh-narkar
rego_version
attribute to the bundle manifestA new global rego_version
attribute is added to the bundle manifest, to inform the OPA runtime about what Rego version (v0
/v1
) to
use while parsing/compiling contained Rego files. There is also a new file_rego_versions
attribute which allows individual
files to override the global Rego version specified by rego_version
.
When the version of the contained Rego is advertised by the bundle through this attribute, it is not required to run OPA with the
--v1-compatible
(or future --v0-compatible
) flag in order to correctly parse, compile and evaluate the bundle's modules.
A bundle's rego_version
attribute takes precedence over any applied --v1-compatible
/--v0-compatible
flag. (#6578) authored by @johanfylling
opa build
was provided an entrypoint from both a CLI flag, and via entrypoint metadata annotation. (#6661) authored by @philipaconraddeps
command for policies with high dependency connectivity (#6685) authored by @johanfyllingv1
syntax (#6689) authored by @xico42rego.v1
in v0
support modules when applicable (#6450) authored by @johanfyllingjson.marshal_with_options()
builtin for indented/"pretty-printed" and/or line-prefixed JSON (#6630) authored by @sean-r-williamsgo
stanza of OPA's go.mod
to go 1.21
. OPA, used as Go dependency, requires at least go 1.21
, and thus works with all officially supported Go versions (1.21.x
and 1.22.x
) (#6678) authored by @srenatusupload-artifact
and download-artifact
Github actions to the latest version (v4) (#6670) authored by @philipaconradThis release contains a mix of features, performance improvements, and bugfixes.
--timeout
flag to opa exec
to prevent infinite hangs. (#6613) authored by @philipaconradcrypto.x509.parse_and_verify_certificates_with_options
built-in function. (#5882) authored by @yogisinha reported by @IxDayDebugging OPA
(#6637) authored by @setchyThis is a security fix release for the fixes published in Go 1.22.1.
OPA servers using --authentication=tls
would be affected: crafted malicious client certificates could cause a panic in the server.
Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin, status and decision logs; and http.send
calls that verify TLS.
This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).
Note that there are other security fixes in this Golang release, but whether or not OPA is affected is harder to assess. An update is advised.
NOTES:
- The minimum version of Go required to build the OPA module is 1.20
This release contains a mix of improvements and bugfixes.
WithBundleParserOpts
method to OCI downloader (#6571) authored by @slonka%!F(MISSING)
in logs by skipping calls to the {Debug,Info,Warn,Error}f
functions when there are no arguments (#6555) authored by @srenatusraise_error
flag during input validation (#6553) authored by @ashutosh-narkarapplication/yaml
instead of application/x-yaml
as the former is now a recognized content type (#6565) authored by @anderseknertThis release contains a mix of new features and bugfixes.
--v1-compatible
flag to all previously unsupported command line commands (#6520) authored by @johanfyllingsize_limit_bytes
(#6514) authored by @anderseknert reported by @dolevfhttp.send
cache entries periodically (#5320) authored by @rudrakhp reported by @lukyerv0.60.0
--v1-compatible
flag. When this mode is enabled, the current release of OPA will behave as OPA v1.0
will eventually behave by default. This flag is currently supported on the build
, check
, fmt
, eval
and test
commands (#6478) authored by @johanfyllingopa fmt
where the assignment operator and term in the rule head of chain rules are removed from the re-written rule head (#6467) authored by @anderseknertdiff
tool with an external golang library function (#6284) authored by @colinjlacyproviders.aws.sign_req
builtin command (#6456) authored by @c2zwdjnlcgsprintf
builtin command when used with the %T
marker (#6487) authored by @lcarvaMakefile
to allow custom GOFLAGS
to be provided to the golang executable (#6458) authored by @cova-fev0.59.0
This release adds tooling to help prepare existing policies for the upcoming OPA 1.0 release. It also contains a mix of improvements, bugfixes and security fixes for third-party libraries.
NOTES:
- All published OPA images now run with a non-root uid/gid. The
uid:gid
is set to1000:1000
for all images. As a result there is no longer a need for the-rootless
image variant and hence it will not be published as part of future releases. This change is in line with container security best practices. OPA can still be run with root privileges by explicitly setting the user, either with the--user
argument fordocker run
, or by specifying thesecurityContext
in the Kubernetes Pod specification.
The upcoming release of OPA 1.0, which will be released at a future date, will introduce breaking changes to the Rego language. Most notably:
import future.keywords
into a module before use will be part of the Rego language by default, without the need to first import them.if
keyword will be required before the body of a rule.contains
keyword will be required when declaring a multi-value rule (partial set rule).This current release (0.59.0
) introduces a new --rego-v1
flag to the opa fmt
and opa check
commands to facilitate the transition of existing policies to be compatible with the 1.0 syntax.
When used with opa fmt
, the --rego-v1
flag will format the module(s) according to the new Rego syntax in OPA 1.0.
Formatted modules are compatible with both the current version of OPA and 1.0.
Modules using deprecated built-ins will terminate formatting with an error. Future versions of OPA will support rewriting applicable function calls with equivalent Rego compatible with 1.0.
When used with opa check
, the --rego-v1
flag will check that the modules are compatible with both the current version of OPA and 1.0.
--rego-v1
flag to check
cmd (#6429) authored by @johanfyllingopa fmt
(#6297) authored by @johanfyllingrego.v1
import (#6375) (authored by @johanfylling)rego.v1
) (#6356) authored by @ashutosh-narkarrego.v1
import (#6247) introduced in OPA 0.58.0, authored by @johanfyllingrule_head_refs
capabilities feature flag (#6334) authored by @johanfyllingstrings.render_template
to render templated strings (#6371) authored by @RDVasavadaNOTES:
- All published OPA images now run with a non-root uid/gid. The
uid:gid
is set to1000:1000
for all images. As a result there is no longer a need for the-rootless
image variant and hence it will not be published as part of future releases. This change is in line with container security best practices. OPA can still be run with root privileges by explicitly setting the user, either with the--user
argument fordocker run
, or by specifying thesecurityContext
in the Kubernetes Pod specification.
This release contains a mix of performance improvements, bugfixes and security fixes for third-party libraries.
= true
as it is implied (#6323) authored by @anderseknertv0.23.0
(#2266) authored by @ashutosh-narkarhttp_request_duration_seconds
metric (#6238) authored by @AdrianArnautuwalk
-ing (#6267) authored by @anderseknert/
) or other special characters (#6264) authored by @dennisghub
tool in GitHub workflows in favor of GitHub CLI tool (#6326) authored by @ashutosh-narkarThis is a bug fix release addressing the following security issues:
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.
Denial of service in otelhttp due to unbound cardinality metrics.