envoyproxy/envoy

Replace Envoy RBAC's CEL AST with human-readable expression

Open

#15,631 建立於 2021年3月23日

在 GitHub 查看
 (8 留言) (0 反應) (0 負責人)C++ (5,373 fork)batch import
apienhancementhelp wanted

倉庫指標

Star
 (27,997 star)
PR 合併指標
 (平均合併 8天) (30 天內合併 378 個 PR)

描述

Title: Replace CEL AST with human-readable expression

Description: The Envoy RBAC API exposes the google/api/expr/v1alpha1 abstract syntax tree for a parsed CEL expression, but if this AST were replaced with a human-readable CEL expression string this would provide key benefits for the API:

  • Improved readability and diffing of expressions in config files.
  • Greater flexibility in optimizations and alternative representations of CEL ASTs.
  • Improved signals of correctness.

Since the creation of the API, a CEL C++ parser has been created / fuzzed / hardened, and could easily be incorporated into the Envoy runtime. Over time, if/when a CEL C++ type-checker is created, the signals of correctness could be further improved.

As of this moment, it is easy to construct ASTs by hand which might be valid CEL programs. Given the sensitivity of using CEL in a security context, restricting ASTs to only those which are at least syntactically valid would be a worth-while security improvement as well.

The only downside of such a change is the CEL expressions would need to be parsed which would add some additional overhead to updating the configuration of an Envoy instance; however, since configuration changes are likely infrequent, the impact of the added parse overhead would likely be nominal.

Relevant Links: https://github.com/google/cel-cpp/tree/master/parser

貢獻者指南