Webhook Fatigue? You're Not Alone: Introducing the CEL Expression Language Features Solving This Problem
Talkat KubeCon + CloudNativeCon North America 2022 · on Thursday, 2022-10-27· at 11:00· Portside Ballroom (Room 260)·
summary
Kubernetes ships CEL for CRD validation (available since 1.23; x-kubernetes-validations in beta by 1.25) to handle multi-field checks, immutability and type-checked rules without a webhook, using CRD validation with CEL and oldSelf for transitions. CEL is a single-expression language with comprehensions, a standard function library, static cost analysis plus runtime cost limits and context cancellation to prevent runaway rules. A proposed admission CAP adds ValidatingAdmissionPolicy & Bindings (params, cluster-scoped or per-namespace bindings), initial admit/deny actions, dry-run and planned secondary checks; cross-resource validation remains unsupported.
AI-written summary · about
chapters (7)
- 0:00Introduction and history
- 1:27Webhook challenges
- 5:53Introducing CEL
- 11:10CRD validation with CEL
- 17:00CEL for admission control
- 22:14Future outlook
- 27:07Q&A
related talks
23mCRD Validation in Kubernetes
33mA Field Guide To Integrating CEL in the Kubernetes Codebase
03mKubewarden: Leveraging and Extending CEL for your Cluster...
34mKyverno Gets Smarter: Writing Dynamic Policies with CEL
20mUsing, and mis-using K8s Dynamic Admission Control
11mFrom YAML to CEL: Understanding Kyverno’s New Policy Model
29mEVAPorating Kubernetes Security Risk: Adopting Validating Admission Policy at Scale
25mCreating and Debugging Kubernetes Admission Webhooks