Cerbos v0.9.0

Written from the ground up to handle the specialised use cases Cerbos is designed for, the brand new policy decision engine is significantly faster and more efficient than the previous version. This new engine is fully backward compatible with all existing policies while being much faster: during benchmarking we have seen speed-ups of up to 17x in some cases. With this new engine we are much better placed to handle even the most demanding use cases and build exciting new features in the future.

Many applications these days make use of JSON Web Tokens (JWT) for carrying signed authentication claims between services. Now with native support for JWT, the Cerbos PDP is able to verify the tokens and use the claims directly when evaluating policies. This is a great way to ensure attributes about the principal are accurate and verified while reducing the burden on developers to correctly extract and transmit the claims over to Cerbos. See 0.9.0@cerbos:configuration:auxdata.adoc for more information.

The new blob storage driver supports reading policies from cloud blob stores such as AWS S3, Google Cloud Storage, or any S3-compatible storage implementation like Minio. This enables you to host your policy repository on highly available, versioned and encrypted storage services offered by major cloud providers and run Cerbos on serverless environments like AWS Lambda, Google Cloud Functions, Google Cloud Run or Knative. See Blob driver for more information.

Hierarchical relationships are a common occurrence in software development. Whether you use directory services like Active Directory/LDAP or whether your data model naturally imposes hierarchical relationships on objects, Cerbos policy rules can be written to deal with tree-like data using the new hierarchy functions introduced in this release. See the hierarchy function documentation for more details.

Validating and testing policies in your GitHub workflows is now much easier using the official Cerbos Actions. See Validating and testing policies in CI environments for details on how to integrate them into your workflow.