PApartialstate·Dec 11, 2020
The goal of CEL is fast, scalable, and portable expression evaluation.
Fast - CEL runs without the need for sandboxing, making it much faster than sandboxed solutions like WebAssembly, Lua, and embedded JavaScript.
Scalable - Features like variables and functions would make CEL more expressive, but also less scalable as it's easy to write a few lines of code with functions that consume exponential amounts of memory and compute. CEL is simply the expression and nothing more.
Portable - CEL is implemented in Go[0], C++[1], and Python[2] with Java open sourcing in development. There is a public codelab[3] available for Go if anyone is interested. There is also a conformance suite in CEL-Spec to ensure consistent behavior between runtimes and environments. Our objective is to make it possible to bring CEL to K8s, J2EE apps, and C++ proxies. E
Read the rest
valuate at line-rate everywhere. Personally, I hope someone tries to make CEL work on IoT devices some day too.
Where? - CEL is usually embedded into larger projects rather than being the one stop shop for solving a particular kind of problem. For example, CEL Policy Templates[4] has an opinionated way of using CEL to validate/evaluate YAML configs. Most of the time CEL is part of a service API.
In addition to being used in Firebase's Cloud Firestore / Cloud Storage security rules, it is also used in several other Google Cloud services:
- Cloud Armor[5]
- IAM Conditions[6]
- Cloud Healthcare Consents[7]
- Cloud Build Notifiers[8]
- Security Token Service[9]
- Access Levels[10], and more.
CEL is also used in some prominent open source projects like Envoy RBAC[11], Caddyserver[12], Krakend.io[13], and Cloud Custodian[14].
[0]: https://github.com/google/cel-go
[1]: https://github.com/google/cel-cpp
[2]: https://github.com/cloud-custodian/cel-python
[3]: https://codelabs.developers.google.com/codelabs/cel-go
[4]: https://github.com/google/cel-policy-templates-go
[5]: https://cloud.google.com/armor/docs/rules-language-reference
[6]: https://cloud.google.com/iam/docs/conditions-overview
[7]: https://cloud.google.com/healthcare/docs/concepts/consent-mo...
[8]: https://cloud.google.com/cloud-build/docs/filter-build-notif...
[9]: https://cloud.google.com/iam/docs/workload-identity-federati...
[10]: https://cloud.google.com/access-context-manager/docs/custom-...
[11]: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overv...
[12]: https://caddyserver.com/docs/caddyfile/matchers#expression
[13]: https://www.krakend.io/docs/endpoints/common-expression-lang...
[14]: https://github.com/cloud-custodian/cel-python