envoyproxy / envoyproxy/envoy

Replace Envoy RBAC's CEL AST with human-readable expression

Open
#15,631 8 comments 0 reactions 0 assignees View on GitHub
api enhancement help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 22h
Merged PRs (30d)
430

Description

*Title*: *Replace CEL AST with human-readable expression*

*Description*:
The Envoy RBAC API exposes the `google/api/expr/v1alpha1` abstract syntax tree for a parsed CEL expression, but if this AST were replaced with a human-readable CEL expression string this would provide key benefits for the API:

* Improved readability and diffing of expressions in config files.
* Greater flexibility in optimizations and alternative representations of CEL ASTs.
* Improved signals of correctness.

Since the creation of the API, a CEL C++ parser has been created / fuzzed / hardened, and could easily be incorporated into the Envoy runtime. Over time, if/when a CEL C++ type-checker is created, the signals of correctness could be further improved.

As of this moment, it is easy to construct ASTs by hand which might be valid CEL programs. Given the sensitivity of using CEL in a security context, restricting ASTs to only those which are at least syntactically valid would be a worth-while security improvement as well.

The only downside of such a change is the CEL expressions would need to be parsed which would add some additional overhead to updating the configuration of an Envoy instance; however, since configuration changes are likely infrequent, the impact of the added parse overhead would likely be nominal.

*Relevant Links*:
https://github.com/google/cel-cpp/tree/master/parser

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.