This is unreleased documentation for Admission Controller 1.39-dev.

Using cel-policy

This page describes cel-policy, the Admission Controller policy that runs CEL expressions as an interpreter. You write the CEL code in the policy settings, and cel-policy evaluates it. No build step is necessary.

CEL in Kubewarden Admission Controller: cel-policy

Admission Controller provides cel-policy. This is a policy that builds and bundles the upstream cel-go interpreter, and also the different libraries available for CEL in Kubernetes from apiextensions-apiserver. See Kubernetes function libraries for the list.

In addition, cel-policy bundles an Admission Controller CEL extension library that exposes Admission Controller’s host capabilities as native CEL:

  • Sigstore verification

  • OCI interaction

  • Cryptographic functions

  • Network operations

  • Access to Kubernetes resources

This means that cel-policy is a superset of Kubernetes CEL, and backwards-compatible. One can reuse CEL written for vanilla Kubernetes, and/or make use of the features added by Admission Controller.

The cel-policy is shipped compiled and behaves as a CEL interpreter. Users of the policy pass the desired CEL expressions in the spec.settings of the (Cluster)AdmissionPolicy, and thanks to CEL features, the expression gets compiled and typed-checked for correctness when creating or updating the (Cluster)AdmissionPolicy. This means there’s no need for custom builds of the cel-policy.

Benefits of Admission Controller’s cel-policy in comparison with ValidatingAdmissionPolicies

The Admission Controller cel-policy:

  • It’s CEL code is backwards-compatible with ValidatingAdmissionPolicies.

  • Contrary to ValidatingAdmissionPolicies, it doesn’t need a binding such as ValidatingAdmissionPolicyBinding, as this is included in Admission Controller’s (Cluster)Admissionpolicies definitions.

  • Can be deployed to clusters that lack ValidatingAdmissionPolicies support.

  • Is context-aware, and makes use of Admission Controller’s fine-grained permissions for context awareness.

  • Is deployed as (Cluster)AdmissionPolicy.

  • Benefits from Admission Controller’s tracing and telemetry on policies.

  • It will be taken into account by the Audit Scanner.

  • Can be developed and tested out-of-cluster thanks to kwctl.

Next steps

The tutorials that follow show cel-policy in use: