6 comments

  • yegle8 minutes ago
    I think people commenting misunderstood what CEL offers.<p>Remember the famous <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Greenspun%27s_tenth_rule" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Greenspun%27s_tenth_rule</a>?<p>&gt; Any sufficiently complicated C or Fortran program contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Common Lisp.<p>CEL is a well specified, reasonably fast &quot;embeddable&quot; language with familiar syntax. I&#x27;m sure there are other languages that fits the description though.
  • d4mi3n5 hours ago
    I&#x27;ve seen but haven&#x27;t used CEL. Anybody with experience with competing tech have any strong opinions? I&#x27;ve used OPA, know CEL used by GCP and Kyverno, but otherwise haven&#x27;t seen anything compelling enough to move away from the OPA ecosystem.
    • erdii5 hours ago
      The kubernetes apiserver allows using CEL in CustomResourceDefinition validation rules: - <a href="https:&#x2F;&#x2F;kubernetes.io&#x2F;docs&#x2F;reference&#x2F;using-api&#x2F;cel&#x2F;" rel="nofollow">https:&#x2F;&#x2F;kubernetes.io&#x2F;docs&#x2F;reference&#x2F;using-api&#x2F;cel&#x2F;</a> - <a href="https:&#x2F;&#x2F;kubernetes.io&#x2F;docs&#x2F;tasks&#x2F;extend-kubernetes&#x2F;custom-resources&#x2F;custom-resource-definitions&#x2F;#validation-rules" rel="nofollow">https:&#x2F;&#x2F;kubernetes.io&#x2F;docs&#x2F;tasks&#x2F;extend-kubernetes&#x2F;custom-re...</a><p>It also allows using CEL in ValidatingAdmissionPolicies: - <a href="https:&#x2F;&#x2F;kubernetes.io&#x2F;docs&#x2F;reference&#x2F;access-authn-authz&#x2F;validating-admission-policy&#x2F;#validation-expression" rel="nofollow">https:&#x2F;&#x2F;kubernetes.io&#x2F;docs&#x2F;reference&#x2F;access-authn-authz&#x2F;vali...</a>
    • isacikgoz5 hours ago
      I think apples to apples comparison would be comparing against Rego. To me CEL is more appealing due to its simplicity.
      • talideon3 hours ago
        And even then, I&#x27;m not sure it&#x27;s apples to apples, at least if by Rego you&#x27;re thinking of OPA. CEL and Rego take very different approaches, with CEL being quite procedural, while Rego is about constraint satisfaction, not unlike Prolog. At $WORK, Rego (in the form of OPA) gets used quite a bit for complicated access control logic, while CEL gets used in places where we&#x27;ve simpler logic that needs to be broken out and made configurable, and a more procedural focus works there.
      • thayne3 hours ago
        Rego is much more powerful, and can do things cel can&#x27;t.
    • mtrimpe5 hours ago
      CEL is much more computationally limited as it aims to keep evaluations in the microsecond range.<p>With OPA you can easily create policies that take tens, hundreds or even thousands of millisecond.<p>That comes at the expense of a lot of power though, so much of the complex logic that you can write in OPA simply isn&#x27;t achievable in CEL.
  • hamandcheese5 hours ago
    Does CEL have any way to import other files? i.e. could it serve as a general purpose config language like jsonnet?
    • talideon3 hours ago
      It&#x27;s not really a configuration language like Jsonnet and CUE. It&#x27;s an expression language for specifying things like conditions and policies. You _could_ abuse it as a configuration language, but it&#x27;d be overkill.
      • progbits1 hour ago
        Yup, it&#x27;s really a good fit for simple constraints eg in IAM systems. Give user X permission to do Y, but subject to some CEL expression like date comparison (auto-expiring grants), resource path prefix or similar.
  • madduci4 hours ago
    CEL is used a lot in FHIR as Path Expressions
  • bossyTeacher4 hours ago
    I would love if languages like Scala, Swift or F# had something like Cel but running at compile time so your program was evaluated against those restrictions. I believe a language called Idris has something like this
    • yegle13 minutes ago
      Are you suggesting to compile CEL into native code and run the compiled code at runtime (i.e. as a predicate function)? I think this is doable and I vaguely remember this was how it&#x27;s implemented initially.<p>But most use cases are treating CEL as a user provided config, which requires runtime parsing and execution.
    • nivertech36 minutes ago
      A better solution would be first-class metaprogramming, like in Zig or LISP. Maybe with some subset which guarantees to halt (I.e. no unbounded loops, no recursion, no FFI, known input size, hard time limits, etc.)
  • IshKebab4 hours ago
    It seems weird to require an entirely new programming language for this tbh. They make the claim that it is special because it&#x27;s not Turing-complete, but that&#x27;s nonsense. Turing completeness is almost never a property that is important. I <i>think</i> in this case they&#x27;re equating Turing incompleteness with &quot;doesn&#x27;t take a long time to execute&quot; but that isn&#x27;t really the case at all.<p>The property you really want is &quot;can be cancelled after a certain amount of compute time - ideally a deterministic amount&quot;, and you can obviously do that with Turing complete languages.
    • nivertech35 minutes ago
      Say “halting problem” without saying “halting problem” ;)<p>There is a practical solution to it called “metering”, like gas mechanism in Ethereum’s EVM or cost calculation for complex GraphQL queries.
      • IshKebab27 minutes ago
        Yeah I think it&#x27;s typically called &quot;fuel&quot;.
    • nxobject2 hours ago
      It&#x27;s not fully applicable here, but industry standard DSLs also stick around because non-programmers find learning it a good investment.<p>I have a business analytics friend that knows SQL because it&#x27;s part of his workflows.<p>But Excel, Notion, Power BI, and other low&#x2F;no-code tools all have their own data filtering and transformation languages (or dialects). He&#x27;d rather spend his time learning more about his line of business, than an aspect of yet another cloud tool that gets forced on him.
    • aleksiy1233 hours ago
      Ease&#x2F;ability to embed in other language safely. Predictability of memory, execution. Known constraints like guaranteed to terminate is useful.<p>no Doom running on cel.<p>I recently wanted to expose some basic user auto tagging&#x2F;labeling based on the json data.<p>I chose cel, over python, SQL because I could just import the runtime in C++, or any language that implements it (python, js etc..)<p>Safely running a sandboxed python execution engine is significantly more effort and lower performance.<p>At this cel excels.<p>Where it didn&#x27;t was user familiarity and when the json data itself was complex.
      • IshKebab2 hours ago
        &gt; Known constraints like guaranteed to terminate is useful.<p>&quot;Guaranteed to terminate&quot; actually means &quot;guaranteed to terminate in finite <i>but possibly arbitrarily large</i> time&quot; which is really not a useful property.<p>There&#x27;s no practical difference between a filter that might take 1 billion years to run and one that might take more than a billion years.
    • talideon3 hours ago
      No, they&#x27;re equating _Turing completeness_ with _might not terminate_. CEL, Expr, Rego, and other languages like them are intended to guarantee to complete. You can&#x27;t do that cleanly with a Turing complete language.
      • IshKebab2 hours ago
        Right but &quot;guaranteed to terminate&quot; is not a useful property. You could write a program that terminates... after a billion years.
        • dilyevsky2 hours ago
          You can estimate cost of CEL program using static analysis before running it. &quot;estimate&quot; only because size of runtime data is generally unknown (but obv you could limit that).
    • joshuamorton4 hours ago
      What you really want is &quot;can be completed after a certain amount of time&quot;, not &quot;can be cancelled&quot;. You don&#x27;t want iam policy rules to be skipped because they took too long.
      • IshKebab2 hours ago
        Well CEL doesn&#x27;t offer that guarantee. For any given &quot;certain amount of time&quot; you can write a CEL filter that takes longer.
        • dilyevsky2 hours ago
          See my other comment - you can refuse to accept CEL filters that take too long to begin with.
        • joshuamorton15 minutes ago
          Correct, but you can also reject filters that will take longer statically. The point is not &quot;any arbitrary CEL program will run in less than 10us&quot;, it&#x27;s that I can encode &quot;do not allow filters that take more than 10us to evaluate&quot; an then have a very high degree of confidence that that will be true for any user provided filter that is accepted (and if I&#x27;m wrong it&#x27;ll be...11us, not 5s)<p>In the common use-cases for CEL that I&#x27;ve seen, you don&#x27;t want to skip evaluation and fail open or closed arbitrarily. That can mean things like &quot;abusive user gets access to data they should not be allowed to access because rule evaluation was skipped&quot;.<p>You also may have tons of rules and be evaluating them very often, so speed is important.