v0.14 Release

We're excited to announce the v0.14.0 release of OPA. This release includes 147 commits from 17 authors across 9 organizations! For a detailed list of changes see the GitHub releases page. In this latest release we focused on the getting started experience for new users.

Community Updates

• The KubeCon San Diego 2019 schedule was posted last week. There will be a number of excellent talks featuring OPA throughout the week.
• The CFP for the OPA Summit @ KubeCon San Diego 2019 was posted last month and we received a number of excellent submissions. The event will held on Monday, November 18th from 12–5PM with games, drinks, and socializing to follow at Nason's Beer Hall. The CFP is open until September 15th at 14:00 UTC.
• GSoC 2019 finished a couple weeks ago. GSoC student Urvil Patel completed a project that integrates OPA with IPTables. Check it out in the open-policy-agent/contrib repository.
• The OPA Gatekeeper project is developing steadily. This blog post in August on kubernetes.io talks about the motivations and evolution of the project. The 3.0.4-beta.1 release includes a dry-run feature, PSP constraints, and more.
• The conftest project (which builds on OPA) continues to gain traction. The project recently added support for Dockerfile validation as well as integrations for Tekton Pipelines, Helm, and GitHub Actions.

Docs, Docs, Docs

Earlier this year we launched The Rego Playground. The playground provides a way to evaluate and test policies from the browser. Based on positive feedback on the playground we decided to take it further. In the latest version of the docs, policy examples are interactive!

In addition to "live docs", we have also re-organized and improved the core content. The docs had grown organically since the project launched and it was time for a rethink. The new structure and content aims to get users started with Rego as quickly as possible. We have also begun carving out dedicated sections for popular integrations like Kubernetes admission control. Finally, we added a search integration powered by Algolia.

Performance Optimizations

This release includes a number of optimizations to the AST and other packages. The optimizations focused on heap allocations during evaluation. With the new optimizations we see about ~25% faster evaluation across-the-board for end-to-end benchmarks in OPA:

Test Case              Old         New         Delta
-----------------------------------------------------------
AuthzForbidAuthn-8     32.3µs±1%   30.5µs±1%   −5.53%
AuthzForbidPath-8      109µs±1%    85µs±1%     −22.14%
AuthzForbidMethod-8    115µs±2%    89µs±1%     −22.44%
AuthzAllow10Paths-8    112µs±2%    87µs±0%     −22.95%
AuthzAllow100Paths-8   725µs±3%    529µs±3%    −27.09%
AuthzAllow1000Paths-8  6.27ms±1%   4.55ms±1%   −27.40%

OPA benchmarks are run automatically on a regular basis and compared against the last stable release using the benchstat tool. The results are posted on the benchmark results page.

Improved File Loading in VS Code

The VS Code extension has been updated to use the new -b or --bundle flag on opa eval to avoid loading all JSON and YAML files inside the workspace. While the old file loading approach was acceptable for Rego-specific workspaces it fell over in larger or mixed workspaces (which most people have!)

With the new -b flag and the latest version of the Open Policy Agent extension for VS Code, file loading is much better.