Cerbos v0.26.0

We introduce the new bundle storage driver that allows you to connect your Cerbos instances to Cerbos Cloud, a cloud-hosted control plane and CI/CD pipeline for easily validating, testing and distributing optimized policy bundles to on-premise Cerbos instances. With Cerbos Cloud, you’re still in full control of your environment and data while delegating the toil of building and maintaining a Git-ops and observability pipeline to the cloud. Head over to https://cerbos.dev/next to learn more and register your interest in the public beta.

A new audit log sink for Kafka has been contributed by the Cerbos community member @rcrowe. With this new driver, Cerbos audit logs can be written to a Kafka topic and feed into your data processing pipeline for further processing and storage. See Kafka configuration for details. As part of this change, a new metric for monitoring audit publishing errors has been introduced as well.

It is now possible to point the disk storage driver to a gzip, zip or tar archive containing Cerbos policies and schemas. This is particularly useful for deploying Cerbos to Kubernetes with your policy archive stored under a key in a ConfigMap or a Secret. See disk driver configuration for details.

This release includes a breaking change to the way policy test results are reported. Previously the results were grouped by principals but this led to some subtle issues and confusion for users who wanted to separate principals into separate test cases. In this release of Cerbos, the test results are grouped by the name of the test case first.

The Cerbos policy testing framework now supports outputting test results in the JUnit XML format. This enables integrating the Cerbos policy testing process into most of the popular CI and testing tools available in the market. Add --test-output=junit to the cerbos compile command to produce test results in JUnit format.

The --config flag is now optional for starting a Cerbos server. If no configuration file is provided using either the --config flag or CERBOS_CONFIG environment variable, the default behaviour is to start the server with the policy directory configured to policies in the current working directory. This could be a breaking change for users who mount a custom configuration file into the Cerbos container at /conf.default.yaml because the CERBOS_CONFIG environment variable no longer points to that path. To work around this, manually set CERBOS_CONFIG=/conf.default.yaml in the environment of the container.

cerbosctl can now be used to enable disabled policies and delete schemas.