Release Notes

Releases

Release

Date

Notes

Limitations

We are constantly working on resolving the limitations listed here and adding enhanced functionality.

Let us know via the open-appsec GitHub or our Website Chat if you identified a potential issue/limitation or via our Website Chat as well if you have any ideas/requirements for additional features.

Declarative Management:

Kubernetes:

Kong Declarative configuration for open-appsec for Kong requires Ingress Resource which the open-appsec Annotation can be added to. Currently doesn't work if there are no ingress resources available and traffic is sent to Kong Gateway directly. (Workaround if there are no ingress resources: Use central management)
Only ingress resource rules that specify both keys are supported: host and path. Specifying just the path is not supported. In that case either add the host key as a temporary fix to your ingress rules if currently missing, or switch to WebUI (SaaS) management instead of local declarative management. This will be fixed soon. (Note: This does not impact the optional specific rules as defined in the open-appsec policy CRD.)
Only one exception can be added in a declarative mode in K8s

All environments:

Snort signature, API schema, and Anti Bot: defining Snort signatures and API schema is not supported yet (this is supported when using central Management via WebUI (SaaS))
Custom Response: "Redirect" action in CustomResponse CRD/config is not supported (use "block-page" or "response-code-only" options until this is available.

General:

Log Trigger Response body: In the log trigger setting "Response body" to true can affect traffic.
SELinux: open-appsec Linux servers: SELinux in “Enforced” mode is not supported. When SELinux is used in “Enforced” mode on the machine running the reverse proxy server and the agent, deployment of the agent might fail during registration. SELinux in “Enforced” mode, blocks the registration attempt.
Country-based Exception rules: When configuring exceptions in Asset edit->Exceptions Tab, an exception rule using the keys Country Name or Country Code cannot be defined with additional conditions based on other keys in the same exception. There’s an implicit OR logic between different exception rules, so it is possible to define different exception rules, some using country code/name, and others using other keys.
Country-based Exception rules: are only supported in managed tenants (Declarative / Management)

SaaS Management (WebUI):

Creating a second tenant using the same email address is not supported (the user can be added to another tenant with another main email address as an additional user)
WildCard asset: you can only have a single asset using wildcard resource for each HTTP as well as HTTPS (e.g.: http://* and https://* ) per tenant. This will be resolved soon.
Social log-in: Adding Google or GitHub users as additional users to a tenant is not supported (use regular users with email addresses instead)

Tools:

CLI tools for macOS are not available yet

Platform support:

Temporarily Fedora is not supported for Linux-embedded installations (consider using Docker-based deployment instead)
Envoy and Ambassador support is not available yet

Previousopen-appsec Video Tutorials NextGetting Started

Last updated 10 days ago

Release

Date

Notes

Limitations

We are constantly working on resolving the limitations listed here and adding enhanced functionality.

Let us know via the open-appsec GitHub or our Website Chat if you identified a potential issue/limitation or via our Website Chat as well if you have any ideas/requirements for additional features.

Declarative Management:

Kubernetes:

Kong Declarative configuration for open-appsec for Kong requires Ingress Resource which the open-appsec Annotation can be added to. Currently doesn't work if there are no ingress resources available and traffic is sent to Kong Gateway directly. (Workaround if there are no ingress resources: Use central management)

Only ingress resource rules that specify both keys are supported: host and path. Specifying just the path is not supported. In that case either add the host key as a temporary fix to your ingress rules if currently missing, or switch to WebUI (SaaS) management instead of local declarative management. This will be fixed soon. (Note: This does not impact the optional specific rules as defined in the open-appsec policy CRD.)

Only one exception can be added in a declarative mode in K8s

All environments:

Snort signature, API schema, and Anti Bot: defining Snort signatures and API schema is not supported yet (this is supported when using central Management via WebUI (SaaS))

Custom Response: "Redirect" action in CustomResponse CRD/config is not supported (use "block-page" or "response-code-only" options until this is available.

General:

Log Trigger Response body: In the log trigger setting "Response body" to true can affect traffic.

SELinux: open-appsec Linux servers: SELinux in “Enforced” mode is not supported. When SELinux is used in “Enforced” mode on the machine running the reverse proxy server and the agent, deployment of the agent might fail during registration. SELinux in “Enforced” mode, blocks the registration attempt.

Country-based Exception rules: When configuring exceptions in Asset edit->Exceptions Tab, an exception rule using the keys Country Name or Country Code cannot be defined with additional conditions based on other keys in the same exception. There’s an implicit OR logic between different exception rules, so it is possible to define different exception rules, some using country code/name, and others using other keys.

Country-based Exception rules: are only supported in managed tenants (Declarative / Management)

SaaS Management (WebUI):

Creating a second tenant using the same email address is not supported (the user can be added to another tenant with another main email address as an additional user)

WildCard asset: you can only have a single asset using wildcard resource for each HTTP as well as HTTPS (e.g.: http://* and https://* ) per tenant. This will be resolved soon.

Social log-in: Adding Google or GitHub users as additional users to a tenant is not supported (use regular users with email addresses instead)

Tools:

CLI tools for macOS are not available yet

Platform support:

Temporarily Fedora is not supported for Linux-embedded installations (consider using Docker-based deployment instead)

Envoy and Ambassador support is not available yet