This is unreleased documentation for Admission Controller 1.39-dev.

Introduction to CEL

The Common Expression Language (CEL) is a general-purpose expression language designed to be fast, portable, and safe to execute. CEL as a language is memory-safe, side-effect free, terminating (programs cannot loop forever), and strong & dynamically typed. You can learn more about CEL at cel.dev, and practice it in the CEL playground.

CEL in Kubernetes

CEL was chosen as the language for Kubernetes validation rules as CEL expressions can be easily inlined into CRD schemas, and compiled and type-checked "ahead-of-time" (when CRDs are created and updated). For these reasons and its general characteristics, it’s a perfect candidate for extending the Kubernetes API.

Marked as stable with Kubernetes 1.30, one can use CEL on ValidatingAdmissionPolicies and other validation rules. For more info, see the Kubernetes docs here.

Kubernetes function libraries

Kubernetes CEL validation rules have access to several function libraries:

CEL in Kubewarden Admission Controller

Admission Controller gives you two ways to run a CEL policy. Both ways run the CEL expressions in the PolicyServer, and both give the expressions the same function libraries:

  • The CEL standard functions and macros

  • The cel-go extension libraries

  • The Kubernetes CEL extension libraries

  • The Admission Controller CEL extension library, which exposes the Admission Controller host capabilities as native CEL functions

The two ways differ in how the CEL expressions get to the PolicyServer.

Interpreted: cel-policy

cel-policy is a ready-made policy that bundles the cel-go interpreter. You put the CEL expressions in the spec.settings of a (Cluster)AdmissionPolicy, and the policy evaluates them at admission time. There is no build step.

This is the option for a fast start and for prototyping.

Compiled: CEL to WebAssembly

From Admission Controller v1.39.0, kwctl can compile a Kubernetes ValidatingAdmissionPolicy into a dedicated WebAssembly module. The module is specialized for the CEL code of your policy. It does not bundle the full CEL runtime.

The compiled module is smaller and faster than cel-policy. You can publish the module to an OCI registry and reuse it across clusters, like any other Admission Controller policy.

This is the option for policies that you distribute, and for clusters where the evaluation time matters. This feature is experimental.

Choose an option

cel-policy Compiled to WebAssembly

Build step

None

kwctl scaffold vap --compile-to-wasm

Where the CEL code lives

In the policy manifest

In the WebAssembly module

Admission Controller CEL extension library

Yes

Yes

Module size

Around 14 MiB

Around 1.5 MiB

The next pages describe each option: