Cerbos v0.14.0

This release includes many improvements that enhance policy authoring and testing along with updates that make deployment, management, and monitoring of Cerbos easier.

The policy testing framework is updated to support writing matrix tests and to treat invalid test files as failures. You can now define a set of principals, resources, and actions in a test case and the test runner automatically runs tests against all combinations of principal, resource, and action tuples. Only the tuples that are expected to produce an ALLOW response needs to be defined in the expectations list. Every other tuple is assumed to produce a DENY response and the tests fail if they don’t. This is one of the rare cases where a breaking change was necessary to make the developer experience better. Existing test suites must be updated to work with this version of Cerbos. See upgrade documentation for more information.

Deploying Cerbos to environments that utilise the Docker HEALTHCHECK directive (AWS Elastic Container Service, for example) is now easier using the built-in cerbos healthcheck command. The Cerbos container image ships with a default HEALTHCHECK configured using this command and it can be tuned using environment variables or command-line flags. See cerbos healthcheck documentation for details.

The cerbosctl management tool now supports adding or updating policies and schemas to a running Cerbos instance using the new put subcommand. The Admin API must be enabled on the Cerbos instance and it must be configured to use one of the database storage backends such as Postgres or MySQL in order for this command to work. For more information see cerbosctl put documentation.

You can write policy conditions that make use of the current time using the newly introduced now function. It’s designed to provide a stable timestamp value that returns the time that particular policy started executing. The semantics of the timeSince function has changed to use this stable definition of now as well.

The size of the in-memory caches that hold compiled policies and schemas have a significant impact on the performance of Cerbos PDPs. This release introduces two new configuration options to tune the sizes of these caches. If you are running Cerbos on Kubernetes or other orchestration system that imposes memory resource limits on containers, make sure to consider the cache sizes when configuring those limits. By default Cerbos holds 1024 compiled policies and 1024 schemas in its cache. The size and usage metrics of caches are available through the metrics endpoint (/_cerbos/metrics).