Documentation
¶
Overview ¶
Package cel implements a loader and evaluator for user-supplied custom rules written as YAML files with a CEL expression body. CEL is the K8s-native expression language (used by ValidatingAdmissionPolicy and CRD x-kubernetes-validations), so users do not have to learn a new DSL to write internal-policy rules. See examples/custom-rules/ for the wire format.
The loader (LoadDir) reads *.cel.yaml files and compiles each rule's expression once at startup; the evaluator (Evaluate) iterates the snapshot's matched resources and emits a models.Finding whenever the expression returns true. Two top-level variables are bound in the CEL environment: "resource" holds the per-instance Kubernetes object (as a generic map) and "snapshot" holds the full collected Snapshot (also as a generic map), so cross-resource rules ("any pod that mounts secret X") remain expressible.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Evaluate ¶
Evaluate runs every loaded Rule against snapshot and returns one Finding per (rule, matched resource). Empty rules → empty findings, nil error.
The evaluator does the iteration so each rule's CEL Program just answers "true / false for this resource"; this keeps rule files small and means expressions cannot accidentally access state from previous evaluations.
Snapshot is serialized to a map[string]any exactly once and reused as the `snapshot` CEL variable across every rule × resource pair so the JSON round trip is paid once, not once per evaluation.
Types ¶
type Match ¶
Match is the loader's parsed view of matchConfig: an Allow-list-style filter the evaluator consults before evaluating a rule against a resource.
type Rule ¶
type Rule struct {
ID string
Title string
Severity models.Severity
Description string
Remediation string
Category models.RiskCategory
Match Match
Program celgo.Program
Source string
Path string
}
Rule is a loaded, compiled custom rule ready for evaluation. The compiled CEL program is cached on the Rule so the evaluator can fan out across resources without recompiling. Path is the source file the rule was loaded from, preserved for error messages and dedupe.
func LoadDir ¶
LoadDir walks dir (non-recursively) and loads every *.cel.yaml file into a compiled Rule. Returns an empty slice (and nil error) when dir == "" so callers can disable custom rules by leaving the flag unset. Returns an error for any unreadable file, malformed YAML, missing required field, unsupported severity, or CEL compilation failure: a single bad rule fails the whole load so operators get an immediate signal rather than a silently-skipped rule.
File order is deterministic (sorted by filename) so two runs against the same directory produce findings in the same order.
Source Files