-
Notifications
You must be signed in to change notification settings - Fork 5.3k
Replace Envoy RBAC's CEL AST with human-readable expression #15631
Description
Title: Replace CEL AST with human-readable expression
Description:
The Envoy RBAC API exposes the google/api/expr/v1alpha1 abstract syntax tree for a parsed CEL expression, but if this AST were replaced with a human-readable CEL expression string this would provide key benefits for the API:
- Improved readability and diffing of expressions in config files.
- Greater flexibility in optimizations and alternative representations of CEL ASTs.
- Improved signals of correctness.
Since the creation of the API, a CEL C++ parser has been created / fuzzed / hardened, and could easily be incorporated into the Envoy runtime. Over time, if/when a CEL C++ type-checker is created, the signals of correctness could be further improved.
As of this moment, it is easy to construct ASTs by hand which might be valid CEL programs. Given the sensitivity of using CEL in a security context, restricting ASTs to only those which are at least syntactically valid would be a worth-while security improvement as well.
The only downside of such a change is the CEL expressions would need to be parsed which would add some additional overhead to updating the configuration of an Envoy instance; however, since configuration changes are likely infrequent, the impact of the added parse overhead would likely be nominal.
Relevant Links:
https://github.com/google/cel-cpp/tree/master/parser