Release Notes for Styra DAS On-Premises 0.4.0
The Styra DAS On-premises 0.4.0 was released on April 28, 2020.
Styra DAS On-premises 0.4.0 delivers the binaries, new features and enhancements, list of issues fixed, known issues and solutions.
The following shows the location for Styra DAS On-premises 0.4.0.
- Location: s3://styra-release/releases/0.4.0/on-premises.tar.gz.
- AWS Link: aws s3 presign s3://styra-release/releases/0.4.0/on-premises.tar.gz --expires-in 600000.
New Features and Enhancements
This section describes the New Features and Enhancements that focus on Integration, Storage, Stacks and Systems components in Styra DAS On-premises 0.4.0.
- Stream decision logs to Amazon Simple Storage Service (AWS S3): Styra offers the ability to stream decision logs to AWS S3, providing unlimited historical record of decisions. This streaming occurs when decisions are received from Open Policy Agent (OPA). The decisions are stored as gzip JSON, with filenames prefixed with a timestamp (in nanoseconds) as a running identifier that is guaranteed to be unique.
Support out-of-band credential configuration for Elasticsearch: This feature allows you to configure Elasticsearch using a secret map similar to
Extend the query OpenID Connect (OIDC) user information endpoint when email information is not available in identifier (id) token: Most OIDC providers return the necessary user attributes as a part of the initial exchange with the provider in the id token. However, some OIDC providers require additional user information query to obtain the necessary user details. For such providers, Styra extends the OIDC procedure to execute the user information endpoint query when the email information is not available in the id token.
Upgrade OPA to include new functionality for
http.sendresponse: This release enhances the response headers to be part of the response object. Therefore, headers are included in
http.sendresponse. Now, you can use OPA for policies on REST API endpoints and ensure that they conform to certain guidelines, like allowing Cross-Origin Resource Sharing (CORS) requests.
Inject custom CA certificates for backend pods: This release enhances the installation of custom CA certificates by configuring the corresponding CA certificate to the Styra CLI client.
- Introduce Kubernetes mutating webhook: Kubernetes provides multiple pluggable points for the review of authenticated API requests where a request can be inspected or even modified. This is achieved through admission control plugins. This feature allows you to use OPA policies to govern the behavior of mutation and validation phases. A Styra Kubernetes system installs two webhooks, one each for mutating and validating phase. You can use either one of them individually or both in combination. Each webhook is configured to query a specific data document on the OPA service present in the cluster.
This section describes the Issues Fixed in Styra DAS On-premises 0.4.0.
- Prior to Styra DAS On-premises 0.4.0, users created a new SSO provider configuration with the same identifier with
HTTP POSTcall, only if
HTTP If-None-Matchheader was defined earlier. Starting from Styra DAS On-premises 0.4.0, the
HTTP If-None-Matchheader is not required and the
HTTP POSTcall checks for a conflict, by default. Therefore, multiple SSO providers with the same identifier was created.
- The deployment kind version
extensions/v1beta1used by the "on-premises.yaml" was deprecated, and moved to the new
Known Issues and Solutions
This section describes the Known Issues and Solutions in Styra DAS On-premises 0.4.0.
- Using IAM roles for S3 streaming and a local ES is not working: STY-4572
When you write a test and run the test by Previewing or Validating the test itself, you might receive “function not defined” error, because the function you are testing is defined in the draft version of a policy under test.
Workaround: Run the test by Validating the draft policy itself instead of the test module.