Release candidate. Docker :latest and a plain pip install stay on 0.9.9 until 0.10.0 ships, so nothing moves unless you opt in. 0.10.0-rc.6 is 0.10.0-rc.5 plus the changes below. See the 0.10.0-rc.5 notes for the SSH host keys and the Python 3.12 images, and the earlier RC notes linked from there.
Breaking changes
- Python 3.10 is no longer supported (#999). opal-server needs Python 3.11 or 3.12, and opal-client and opal-common 3.11 to 3.13. On Python 3.10,
pip installkeeps installing 0.9. - Two command-line flags are removed (#999):
--log-show-code-lineand--opa-health-check-transaction-log-path, with their config attributes. Their env vars never did anything. OpalServerConfig.DATA_UPDATE_TRIGGER_ROUTEis removed (#999). It read another setting's env var, and nothing used it. Data updates are triggered with a POST toOPAL_DATA_CONFIG_ROUTE.PUT /scopesanswers 422 for a branch that cannot be a git ref (#999), such as an empty one orx~1. A scope already stored with one keeps being served.
Scope git: fetches that end on timeout, fewer fetches, smaller clones (#999)
These apply to servers with OPAL_SCOPES=true.
- Optional git CLI fetch. With
OPAL_SCOPES_GIT_FETCH_WITH_CLI=true(defaultfalse), scope fetches and clones run the git command line in a process group of their own. AtOPAL_SCOPES_GIT_FETCH_TIMEOUTthe group is stopped (SIGTERM, then SIGKILL afterOPAL_SCOPES_GIT_CLI_KILL_GRACE), and the next sync of the clone runs normally. A libgit2 fetch, the default, can't be stopped once it hangs.- git runs with protocol v2, no system or user git config, no hooks and a protocol allowlist.
- Credentials are passed through a credential helper scoped to the source's host, never on a command line, and git's errors are redacted.
- New setting
OPAL_SCOPES_GIT_SSH_KNOWN_HOSTS, which ssh checks host keys against when the CLI fetch is on. - Read the setting's documentation before turning it on: with it on, git ignores the server's git config except
safe.directory, and ssh refusesssh-rsa(SHA-1) signatures.
- One fetch per missing branch per pass. A scope whose branch is not in its clone no longer fetches the whole clone again in every sync pass. Phase 2 gives each clone one worker slot, so one slow clone no longer holds every slot.
- Packed refs in scope clones. The repack also packs refs and drops reflogs. On a clone of a repository with 63k branches, that took it from 546 MB in 126,427 files to 40 MB in 11. With the libgit2 fetch and
OPAL_SCOPES_GIT_FETCH_PRUNEon, refs stay loose, because pruning packed refs is slow. - The pre-fork preload closes its Redis client. The gunicorn master and every worker it forks no longer keep the preload's Redis connections for life.
- Note: phase 2 can read up to 8 ×
OPAL_SCOPES_GIT_MAX_WORKERSscopes from Redis at once, so the leader worker's Redis pool can grow to about 80 connections at the default of 10.
Logging
- Intercepted log records keep their caller (#1000). Records from the standard library's
loggingthat OPAL routes into its logger now show the module, function and line that logged them, notlogging/callHandlers.
Docs
- The configuration reference documents every setting (#999) and gives values that load at startup. A test now checks every documented default, option and example, and that each documented setting is read by the code. Ten documented settings that nothing read are removed.
How to opt in
Docker: every image is published under the 0.10.0-rc.6 tag, plus -alpine:
permitio/opal-server:0.10.0-rc.6
permitio/opal-client:0.10.0-rc.6
permitio/opal-client-standalone:0.10.0-rc.6
permitio/opal-client-cedar:0.10.0-rc.6
permitio/opal-client-eopa:0.10.0-rc.6
pip: pre-releases are skipped unless you ask for them:
pip install --pre opal-client # or: opal-client==0.10.0rc6
pip install --pre opal-server