Cerbos Cloud Support

We introduce the new bundle storage driver that allows you to connect your Cerbos instances to Cerbos Cloud, a cloud-hosted control plane and CI/CD pipeline for easily validating, testing and distributing optimized policy bundles to on-premise Cerbos instances. With Cerbos Cloud, you’re still in full control of your environment and data while delegating the toil of building and maintaining a Git-ops and observability pipeline to the cloud. Head over to https://cerbos.dev/next to learn more and register your interest in the public beta.

Kafka audit log sink

A new audit log sink for Kafka has been contributed by the Cerbos community member @rcrowe. With this new driver, Cerbos audit logs can be written to a Kafka topic and feed into your data processing pipeline for further processing and storage. See Kafka configuration for details. As part of this change, a new metric for monitoring audit publishing errors has been introduced as well.

Policy file archive support

It is now possible to point the disk storage driver to a gzip, zip or tar archive containing Cerbos policies and schemas. This is particularly useful for deploying Cerbos to Kubernetes with your policy archive stored under a key in a ConfigMap or a Secret. See disk driver configuration for details.

Test output improvements

This release includes a breaking change to the way policy test results are reported. Previously the results were grouped by principals but this led to some subtle issues and confusion for users who wanted to separate principals into separate test cases. In this release of Cerbos, the test results are grouped by the name of the test case first.

The Cerbos policy testing framework now supports outputting test results in the JUnit XML format. This enables integrating the Cerbos policy testing process into most of the popular CI and testing tools available in the market. Add --test-output=junit to the cerbos compile command to produce test results in JUnit format.