Changelog

See our buildlog for relationships between specific docker hashes and version tags. The most recent releases are at the bottom of the file. There will only ever be multiple hashes for a single version tag if the underlying image was rebuilt to fix a security vulnerability.

v2.10.1

• Fixed an issue where Authorization headers were not correctly being forwarded when hitting _cloaked_search/health.
• Dependency updates.

v2.10.0

• Added support for pattern replacement on protected fields. Note that the supported regex syntax is this one, which has small differences from the Java regex that Elastic/Opensearch use.

v2.9.0

• Added support for arrays on protected fields. We added support for numbers, strings or booleans in arrays.

v2.8.3

• Fixed a bug where documents with no protected fields would not be returned if the query contained protected fields. This was caused by the _icl_search_key_id changes which were introduced in 2.8.0.

v2.8.2

• Fixed a bug where Cloaked Search would return with 4xx when it should have been 5xx.
• Added support for POST /<target>/_doc/<_id>, which is not a part of the current Elasticsearch documentation, but is used by some SDKs.

v2.8.1

• Fixed an issue introduced in 2.8.0 that caused queries with no protected fields to return no results.
• Dependency updates.

v2.8.0

• Added query support for key rotation use cases. Note that this causes _icl_search_key_id to be added to all queries, so be sure your Elastic/OpenSearch indices are configured correctly.
• Dependency updates.

v2.7.0

• Added /_cloaked_search/metrics endpoint that can be scraped by Prometheus. These metrics aim to give insight into the load Cloaked Search is under, and more metrics may be added in the future. See here for more information about the available metrics.

v2.6.1

• Fixed issue where prefix query would not correctly include all tokens in the resulting search service query. This fix should increase search accuracy for prefix queries.

v2.6.0

• Added mappings._encrypted_source index configuration option. When set to { "enabled": false }, the source JSON document will not be encrypted on index and encrypted fields will not be decrypted when queried. See here for more information.

v2.5.0

We’ve updated the minor because the logging format changed slightly, so we thought it better to bump minor in case someone was depending on the exact format of the log messages.

Changed

• Dependency updates
• Change logging frameworks, which significantly increases throughput.

v2.4.3

Changed

• Dependency updates
• Allow PUT for _bulk endpoint.
• Update logging of requests as we send them to be at trace. This log message also includes the method and body being sent.

v2.4.1

Changed

• Dependency updates
• Fixed error in _icl_encrypted_source being written with an incorrect format when using TSP integration. This change is backward compatible, but data written with this version is not compatible with previous 2.x versions.

v2.4.0

Changed

• Dependency updates
• Improve tenant ID detection error message. It should now have better messages for query string and json payloads.
• Update base image to be built on scratch instead of alpine.

v2.3.0

Added

• Add use_compact_search_key_id as an index group configuration. Documented here.

v2.2.1

Changed

• Update the base alpine image to 3.17

v2.2.0

Added

• Add _cloaked_search/version endpoint to report the running version of CS.

v2.1.2

Changed

• Improve error message when failing to parse the TSP response.

v2.1.1

Changed

• Moved log messages for unsupported parameters from warn to trace.
• Update dependencies.

v2.1.0

Added

• Added field mapping option index_phrases to provide phrase search functionality.

Changed

• Improved compatibility with Java High Level Rest Client.
• Fixed a bug that caused some protected fields to contain an extra token.

v2.0.0

This release marks a major overhaul to the functionality of Cloaked Search.

Added

• Bulk index API
• JSON query syntax
  • Includes explicit support for bool, dis_max, function_score, match, match_phrase, multi_match, prefix, query_string, and term. Other queries types may be supported implicitly.
• Index groups - multiple indices that share a search salt and can be queried together
• Index/search of derived multi-fields
• Index/search of JSON objects in documents

Changed

• Redesigned the configuration file to more closely match Elasticsearch structures
  • File format changed from YAML to JSON.
  • Index configurations should now be located in indices folder adjacent to the global configuration file.
  • Various analyzers, filters, and tokenizers have been reworked/renamed. See our documentation for details.
  • Added field mapping option index_prefixes to provide prefix search functionality.
• Changes to Query String search
  • Returns an exception on suffix searches. This can be accomplished with prefix searches on a field with the reverse filter.

v1.1.3

• Removed ability to search over multiple indices to avoid exposing blind index tokens

v1.1.2

• Relaxed top level search object parsing to support _type deprecation

v1.1.1

• added multi arch builds. amd64 and arm64 docker containers are both published to gcr.

v1.1.0

• Added support for PUT endpoints on the index api.
• Dependency updates.

v1.0.0

• _icl_ prefix for protected fields instead of protected_
• _encrypted_source only contains protected fields
• Disallow directly querying protected fields
• Reduce likelihood of collision on trigrams
• Allow tenant_id to be fixed per index

v0.6.1

• Few miscellaneous bug fixes.

v0.6.0

• Fix issue with wildcard parsing
• Add extra validation for standalone keys
• Support Bool, Number, and String fields on index
• Fix multi-language detection on substring search
• Only try to replace hits source on successful requests
• Error when given an unexpected body type
• Error for substring queries that do not include enough characters
• Require tenant ID for search and index
• Improve error messages for queries using disabled filters

v0.5.0

• Add accept_invalid_certs configuration
• Update es_url to search_service_url.
• Add _cloaked_search/health and _cloaked_search/live endpoints to aid in real deployments.
• Make tenant_id_field configurable per index.
• TSC integration.
• Add link to 5M wikipedia set from tantivy.
• Allow tenant ids to be String, Number or Boolean instead of just String.
• Improve tenant detection.

v0.4.0

• Moved standalone secrets to files, config points to them.
• Add support for +/- substring, phrase and term queries.

v0.3.0

• Sign over the edek protobuf when we create it and verify it on deserialization.
• Add prefix/suffix substring (trigram) support.

v0.2.0

• Automatically select the best filter on query
• Add a check to make sure the requesting tenant matches resulting document
• Add phonetic filter to analyzer
• Allow changing analyzers in config file
• Upgrade to alpine-3.14, and rust-1.54
• Dependency updates

v0.1.48

• Initial version of CSP

Versioning Policy

See our container versioning policy documentation.