This repository has been archived by the owner on Dec 10, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 1
build: update module github.com/open-policy-agent/opa to v0.70.0 #47
Open
renovate
wants to merge
1
commit into
main
Choose a base branch
from
renovate/github.com-open-policy-agent-opa-0.x
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+114
−119
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
from
April 3, 2024 15:41
c73b41c
to
0a791f7
Compare
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.63.0
build: update module github.com/open-policy-agent/opa to v0.64.0
Apr 25, 2024
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
2 times, most recently
from
April 26, 2024 19:41
69a0085
to
76480ca
Compare
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.64.0
build: update module github.com/open-policy-agent/opa to v0.64.1
Apr 26, 2024
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.64.1
build: update module github.com/open-policy-agent/opa to v0.65.0
May 30, 2024
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
from
May 30, 2024 16:10
76480ca
to
f640ad3
Compare
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
from
June 27, 2024 16:42
f640ad3
to
916b755
Compare
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.65.0
build: update module github.com/open-policy-agent/opa to v0.66.0
Jun 27, 2024
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.66.0
build: update module github.com/open-policy-agent/opa to v0.66.0 - autoclosed
Jul 17, 2024
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.66.0 - autoclosed
build: update module github.com/open-policy-agent/opa to v0.66.0
Jul 17, 2024
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
from
July 25, 2024 22:09
916b755
to
76cdbfc
Compare
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.66.0
build: update module github.com/open-policy-agent/opa to v0.67.0
Jul 25, 2024
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
from
August 5, 2024 20:37
76cdbfc
to
11c39ef
Compare
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.67.0
build: update module github.com/open-policy-agent/opa to v0.67.1
Aug 5, 2024
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
from
August 29, 2024 19:00
11c39ef
to
e2e81ce
Compare
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.67.1
build: update module github.com/open-policy-agent/opa to v0.68.0
Aug 29, 2024
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
from
September 30, 2024 15:14
e2e81ce
to
82bbf70
Compare
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.68.0
build: update module github.com/open-policy-agent/opa to v0.69.0
Sep 30, 2024
renovate
bot
force-pushed
the
renovate/github.com-open-policy-agent-opa-0.x
branch
from
October 31, 2024 21:19
82bbf70
to
0ec233c
Compare
renovate
bot
changed the title
build: update module github.com/open-policy-agent/opa to v0.69.0
build: update module github.com/open-policy-agent/opa to v0.70.0
Oct 31, 2024
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.62.1
->v0.70.0
Release Notes
open-policy-agent/opa (github.com/open-policy-agent/opa)
v0.70.0
Compare Source
This release contains a mix of features, performance improvements, and bugfixes.
Optimized read mode for OPA's in-memory store (#7125)
A new optimized read mode has been added to the default in-memory store, where data written to the store is eagerly converted
to AST values (the data format used during evaluation). This removes the time spent converting raw data values to AST
during policy evaluation, thereby improving performance.
The memory footprint of the store will increase, as processed AST values generally take up more space in memory than the
corresponding raw data values, but overall memory usage of OPA might remain more stable over time, as pre-converted data
is shared across evaluations and isn't recomputed for each evaluation, which can cause spikes in memory usage.
This mode can be enabled for
opa run
,opa eval
, andopa bench
by setting the--optimize-store-for-read-speed
flag.More information about this feature can be found here.
Co-authored by @johanfylling and @ashutosh-narkar.
Topdown and Rego
json.match_schema
built-in function (#7011) authored by @anderseknert reported by @lcarvaopa check
where a file that referenced non-provided schemas failed validation (#7124) authored by @tjonsyes
/no
values as boolean. The usage of yaml.v2 in the parser was unintentional and now has been updated to yaml.v3 (#7090) authored by @anderseknertRuntime, Tooling, SDK
opa check
respect--ignore
when--bundle
flag is set (#7136) authored by @anderseknertsuperfluous call to WriteHeader()
while still returning200
HTTP status code. Now, errors encoding the payload properly lead to500
HTTP status code, without extra logs. Also use Header().Set() not Header().Add() to avoid duplicate content-type headers (#7114) authored by @srenatusfile://
format for TLS key material file flags inopa run
(#7094) authored by @alexrohozneanuDocs, Website, Ecosystem
Miscellaneous
v0.69.0
Compare Source
This release contains a mix of features, bugfixes and necessary tooling and test changes required to support the upcoming OPA
1.0
release.Inter-Query Value Cache (#6908)
OPA now has a new inter-query value cache added to the SDK. It is intended to be used for values that are expensive to
compute and can be reused across multiple queries. The cache can be leveraged by built-in functions to store values
that otherwise aren't appropriate for the existing inter-query cache; for instance when the entry size isn't an
appropriate or primary limiting factor for cache eviction.
The default size of the inter-query value cache is unbounded, but can be configured via the
caching.inter_query_builtin_value_cache.max_num_entries
configuration field. OPA will drop random items from the cacheif this limit is exceeded.
The cache is used by the
regex
andglob
built-in functions, which previously had individual, non-configurablecaches with a max entry size of
100
each.Currently, the cache is only exercised when running OPA in server mode (ie.
opa run -s
). Also this feature is unsupportedfor WASM.
Authored by @ashutosh-narkar, reported by @amirsalarsafaei
Topdown and Rego
ast
,topdown
,rego
etc. packages to be1.0
compatible (authored by @johanfylling)Module.String()
includeif
/contains
for v1 modules (#6973) authored by @johanfylling reported by @nikpivkinhttp.send
latency timer when an error is encountered (#7007) authored by @lukyerwith
's target (#6979) authored by @srenatus reported by @bluebrownRuntime, Tooling, SDK
sdk
,downlaod
,server
,cmd
etc. packages to be1.0
compatible (authored by @johanfylling)--v0-compatible
flag to make OPA behave asv0.x
postv1.0
release (#7065) authored by @johanfyllingRegoOption
launch option to debugger for setting custom Rego options (#7045) authored by @johanfyllingInput
andData
variable scopes to ease discoverability of the scopes (#7074) authored by @johanfyllingDocs, Website, Ecosystem
1.0
compatible (#7033) authored by @charlieegan3Miscellaneous
v0.68.0
Compare Source
This release contains a mix of features and bugfixes.
Breaking Changes
entrypoint
annotation impliesdocument
scope (#6798)The entrypoint annotation's scope requirement has changed from
rule
todocument
(https://github.com/open-policy-agent/opa/issues/6798). Furthermore, if noscope
annotation is declared for a METADATA block preceding a rule, the presence of anentrypoint
annotation with atrue
value will assign the block adocument
scope, where therule
scope is otherwise the default.In practice, a rule entrypoint always point to the entire document and not a particular rule definition. The previous behavior was a bug, and one we've now addressed.
Authored by @anderseknert
Topdown and Rego
Runtime, Tooling, SDK
copy
method copy all values (#6949) authored by @anderseknertopa exec
: This command never supported "pretty" formatting (--format=pretty
or-f pretty
), onlyjson
. Passingpretty
is now invalid. (#6923) authored by @srenatusNote that the flag is now unnecessary, but it's kept so existing calls like
opa exec -fjson ...
remain valid.Security Fix: CVE-2024-8260 (#6933)
This release includes a fix where OPA would accept UNC locations on Windows. Reading those could leak NTLM hashes.
The attack vector would include an adversary tricking the user in passing an UNC path to OPA, e.g.
opa eval -d $FILE
.UNC paths are now forbidden. If this is an issue for you, please reach out on Slack or GitHub issues.
Reported by Shelly Raban
Authored by @ashutosh-narkar
Docs, Website, Ecosystem
opa-config.yaml
as name for config file (#6966) (#6959) authored by @anderseknerthttp.send
in inter-query cache config docs (#6953) authored by @anderseknertMiscellaneous
v0.67.1
Compare Source
This is a bug fix release addressing the following issue:
v0.67.0
Compare Source
This release contains a mix of features, a new builtin function (
strings.count
), performance improvements, and bugfixes.Breaking Change
Request Body Size Limits
OPA now automatically rejects very large requests (#6868) authored by @philipaconrad.
Requests with a
Content-Length
larger than 128 MB uncompressed, and gzipped requests with payloads that decompress tolarger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large
enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from
attempting to read the request body into memory.
These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.
For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration
keys are available:
server.decoding.max_length
andserver.decoding.gzip.max_length
. These control the max size inbytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.
Here's an example OPA configuration using the new keys:
Topdown and Rego
strings.count
builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @Manish-Giri--rego-v1
formatted module has rule name conflicting with keyword (#6833) authored by @johanfyllingRuntime, Tooling, SDK
--follow-symlinks
flag to theopa build
command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @tjonsexplain=fails
query value (#6886) authored by @acamatciscoDocs, Website, Ecosystem
rego_version
andfile_rego_versions
attributes (#6885) authored by @ashutosh-narkarMiscellaneous
v0.66.0
Compare Source
v0.66.0
This release contains a mix of features, performance improvements, and bugfixes.
Improved Test Reports (2546)
The
opa test
command now includes a new--var-values
flag that enriches reporting of failed tests with the values and locations for variables in the failing expression.E.g.:
Authored by @johanfylling, reported by @grosser.
Reading stdin in
opa exec
(#6538)The
opa exec
command now supports readinginput
documents from stdin with the--stdin-input
(-I
) flag.E.g.:
Authored by @colinjlacy, reported by @humbertoc-silva.
Topdown and Rego
every
domain (#6790) authored by @johanfylling reported by @anakrishRuntime, Tooling, SDK
Docs, Website, Ecosystem
go_memstats_gc_cpu_fraction
(#6783) authored by @philipaconradan HTTP
(#6786) authored by @jdbaldryMiscellaneous
v0.65.0
Compare Source
This release contains a mix of features and bugfixes.
Runtime, Tooling, SDK
Topdown and Rego
every
domain is a collection type before evaluation (#6762) authored by @johanfylling reported by @anderseknertMiscellaneous
Breaking changes
A new IsSetStmt statement has been added to the intermediate representation (IR).
This is a breaking change for custom IR evaluators, which must interpret this statement in IR plans generated by this OPA version and later.
No actions are required for Wasm users, as long as Wasm modules are built by this OPA version or later.
v0.64.1
Compare Source
This is a bug fix release addressing the following issues:
macos-latest
was changed fromamd64
toarm64
and as a resultdarwin/amd64
binary wasn't released (#6720) authored by @suzuki-shunsukev0.64.0
Compare Source
This release contains a mix of features, a new builtin function (
json.marshal_with_options()
), performance improvements, and bugfixes.Breaking Change
Bootstrap configuration overrides Discovered configuration
Previously if Discovery was enabled, other features like bundle downloading and status reporting could not be configured manually.
The reason for this was to prevent OPAs being deployed that could not be controlled through discovery. It's possible that
the system serving the discovered config is unaware of all options locally available in OPA. Hence, we relax the configuration
check when discovery is enabled so that the bootstrap configuration can contain plugin configurations. In case of conflicts,
the bootstrap configuration for plugins wins. These local configuration overrides from the bootstrap configuration are included
in the Status API messages so that management systems can get visibility into the local overrides.
In general, the bootstrap configuration overrides the discovered configuration. Previously this was not the case for all
configuration fields. For example, if the discovered configuration changes the
labels
section, only labels that areadditional compared to the bootstrap configuration are used, all other changes are ignored. This implies labels in the
bootstrap configuration override those in the discovered configuration. But for fields such as
default_decision
,default_authorization_decision
,nd_builtin_cache
, the discovered configuration would override the bootstrap configuration. Now the behavior is more consistentfor the entire configuration and helps to avoid accidental configuration errors. (#5722) authored by @ashutosh-narkar
Add
rego_version
attribute to the bundle manifestA new global
rego_version
attribute is added to the bundle manifest, to inform the OPA runtime about what Rego version (v0
/v1
) touse while parsing/compiling contained Rego files. There is also a new
file_rego_versions
attribute which allows individualfiles to override the global Rego version specified by
rego_version
.When the version of the contained Rego is advertised by the bundle through this attribute, it is not required to run OPA with the
--v1-compatible
(or future--v0-compatible
) flag in order to correctly parse, compile and evaluate the bundle's modules.A bundle's
rego_version
attribute takes precedence over any applied--v1-compatible
/--v0-compatible
flag. (#6578) authored by @johanfyllingRuntime, Tooling, SDK
opa build
was provided an entrypoint from both a CLI flag, and via entrypoint metadata annotation. (#6661) authored by @philipaconraddeps
command for policies with high dependency connectivity (#6685) authored by @johanfyllingv1
syntax (#6689) authored by @xico42Topdown and Rego
rego.v1
inv0
support modules when applicable (#6450) authored by @johanfyllingjson.marshal_with_options()
builtin for indented/"pretty-printed" and/or line-prefixed JSON (#6630) authored by @sean-r-williamsDocs, Website, Ecosystem
Miscellaneous
go
stanza of OPA'sgo.mod
togo 1.21
. OPA, used as Go dependency, requires at leastgo 1.21
, and thus works with all officially supported Go versions (1.21.x
and1.22.x
) (#6678) authored by @srenatusupload-artifact
anddownload-artifact
Github actions to the latest version (v4) (#6670) authored by @philipaconradv0.63.0
Compare Source
This release contains a mix of features, performance improvements, and bugfixes.
Runtime, Tooling, SDK
--timeout
flag toopa exec
to prevent infinite hangs. (#6613) authored by @philipaconradTopdown and Rego
crypto.x509.parse_and_verify_certificates_with_options
built-in function. (#5882) authored by @yogisinha reported by @IxDayDocs + Website + Ecosystem
Debugging OPA
(#6637) authored by @setchyMiscellaneous
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.