envoyproxy/envoy

Replace Envoy RBAC's CEL AST with human-readable expression

Open

#15,631 opened on Mar 23, 2021

View on GitHub
 (8 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
apienhancementhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Title: Replace CEL AST with human-readable expression

Description: The Envoy RBAC API exposes the google/api/expr/v1alpha1 abstract syntax tree for a parsed CEL expression, but if this AST were replaced with a human-readable CEL expression string this would provide key benefits for the API:

  • Improved readability and diffing of expressions in config files.
  • Greater flexibility in optimizations and alternative representations of CEL ASTs.
  • Improved signals of correctness.

Since the creation of the API, a CEL C++ parser has been created / fuzzed / hardened, and could easily be incorporated into the Envoy runtime. Over time, if/when a CEL C++ type-checker is created, the signals of correctness could be further improved.

As of this moment, it is easy to construct ASTs by hand which might be valid CEL programs. Given the sensitivity of using CEL in a security context, restricting ASTs to only those which are at least syntactically valid would be a worth-while security improvement as well.

The only downside of such a change is the CEL expressions would need to be parsed which would add some additional overhead to updating the configuration of an Envoy instance; however, since configuration changes are likely infrequent, the impact of the added parse overhead would likely be nominal.

Relevant Links: https://github.com/google/cel-cpp/tree/master/parser

Contributor guide