Open Policy Agent 1.21.3
~~
OPA v1.21.3 makes a signing block with no entries under its top-level keys a startup configuration error. Bundle.NewVerificationConfig now requires signatures by default, and embedders can opt out. The release notes say the change covers bundle and discovery configurations that previously did not verify signatures, including those with an empty signing block or no keyid.
What changes for platform teams
Platform teams with bundle or discovery signing blocks that lack a keyid, or with empty signing blocks, will need to add a keyid or fix the configuration before OPA starts. Teams whose configs have no signing block, or that run with --skip-verify, are not affected by the new default.
Changes
- A signing block with no entries under the top-level keys is now a startup configuration error, rather than achanged
- Bundle.NewVerificationConfig now requires signatures by default. Embedders can opt out withchanged
- OPA bundle/discovery service (including an artifact store it uses)other
- MitM between OPA and bundle/discovery serviceother
- Write access to a file:// bundle path or the bundle persistence directoryother
- Bundles[_].signing or discovery.signing configured without keyid: an empty block, or one with only scope orother
- Embedders (SDK, custom plugins, v1/loader, v1/compile) calling bundle.NewVerificationConfig(keys, "", ...) withother
- Configurations with an explicit bundles[_].signing.keyid or discovery.signing.keyid.other
- Opa run/opa eval/opa build with --verification-key, which defaults --verification-key-id to default.other
- Configurations with top-level keys but no signing block: not a verification opt-in before or after this fix.other
- Any bundle or discovery configuration with a signing block, with or without keyid.other
- Opa run/opa eval with --verification-key.other
1 more lines
- Configurations that don't verify signatures: no signing block, or --skip-verify. Nothing was verified to beginother
Full release notes ↗ · all Open Policy Agent releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules