Cerbos v0.18.0

The cerbosctl utility is now available as a container. It makes it easier to provision Cerbos on container orchestration systems using native constructs (for example, init containers on Kubernetes).

Cerbos now caches the verification state of JWTs in memory to avoid repeating the expensive cryptographic operations on each and every request. The tokens are still validated each time to ensure that they haven’t expired and are valid for use. See AuxData configuration for information on how to configure the cache.

There are several improvements to the PlanResources API. An optimisation pass has been introduced to simplify some of the logical expressions in the query plan and eliminate redundant conditions. For example, NOT true automatically gets simplified to just false and true AND x == y gets simplified to x == y. All aliases, such as R for request.resource, are expanded to their long form in the plan output to help make the API response predictable. The output of the filterDebug field in the query plan response is standardised to use S-expression format to ensure that it is easily verifiable by automated tools.

Calls to the PlanResources API are now captured by the audit logger and written to the decision log with the full serialized request and response. Previously, only access logs were produced for this API call. This involves a rare — but, necessary — breaking change to the decision log format where the data previously available in the inputs and outputs fields are now available as checkResources.inputs and checkResources.outputs.

Cerbos now reports metrics about store synchronization attempts and any failures encountered. They can be used to create alerts to detect when the policy store is drifting from the remote source due to network issues or credential expiry.

Hidden directories are now ignored by the disk-based storage backends like disk, git and blob in order to ignore system metadata directories and other control files.

cerbosctl put schema --recursive now generates schema IDs from the path of the schema file relative to the starting directory, instead of just using the file basename.

Distributed traces received in any of W3C trace context, B3 or Baggage propagation formats are now automatically detected and handled by the Cerbos server. The propagationFormat configuration option is now deprecated in favour of auto propagation.