examples.yaml

# Copyright 2023 Undistro Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

examples:
  - name: "default"
    cel: |
      // Welcome to the CEL Playground!
      // CEL Playground is an interactive WebAssembly powered environment to explore and experiment with the Common Expression Language (CEL).
      //
      // - Write your CEL expression here
      // - Use the area on the side for input data, in YAML or JSON format
      // - Press 'Run' to evaluate your CEL expression against the input data
      // - Explore our collection of examples for inspiration

      account.balance >= transaction.withdrawal
          || (account.overdraftProtection
          && account.overdraftLimit >= transaction.withdrawal  - account.balance)

    dataInput: |
      # Here is the input data in YAML or JSON format.

      account:
        balance: 500
        overdraftProtection: true
        overdraftLimit: 1000
      transaction:
        withdrawal: 700
    category: "default"

  - name: "Check image registry"
    cel: |
      object.spec.template.spec.containers.all(container,
        params.allowedRegistries.exists(registry,
          ((registry in ['docker.io', 'docker.io/library']) && !container.image.contains('/')) ||
          container.image.startsWith(registry)
        )
      )
    dataInput: |
      params:
        allowedRegistries: 
          - myregistry.com
          - docker.io # use 'docker.io' for Docker Hub
      object:
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: nginx
        spec:
          template:
            metadata:
              name: nginx
              labels:
                app: nginx
            spec:
              containers:
                - name: nginx
                  image: nginx # the expression looks for this field
          selector:
            matchLabels:
              app: nginx
    category: "Kubernetes"

  - name: "Disallow HostPorts"
    cel: |
      // According the Pod Security Standards, HostPorts should be disallowed entirely.
      // https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline

      object.spec.template.spec.containers.all(container,
        !has(container.ports) ||
        container.ports.all(port,
          !has(port.hostPort) ||
          port.hostPort == 0
        )
      )
    dataInput: |
      object:
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: nginx
        spec:
          template:
            metadata:
              name: nginx
              labels:
                app: nginx
            spec:
              containers:
                - name: nginx
                  image: nginx
                  ports:
                    - containerPort: 80
                      hostPort: 80 # the expression looks for this field
          selector:
            matchLabels:
              app: nginx
    category: "Kubernetes"

  - name: "Require non-root containers"
    cel: |
      // According the Pod Security Standards, Containers must be required to run as non-root users.
      // https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted

      // Pod or Containers must set `securityContext.runAsNonRoot`
      (
        (has(object.spec.template.spec.securityContext) && has(object.spec.template.spec.securityContext.runAsNonRoot)) ||
        object.spec.template.spec.containers.all(container,
          has(container.securityContext) && has(container.securityContext.runAsNonRoot)
        )
      )
      &&

      // Neither Pod nor Containers should set `securityContext.runAsNonRoot` to false
      (
        (!has(object.spec.template.spec.securityContext) || !has(object.spec.template.spec.securityContext.runAsNonRoot) || object.spec.template.spec.securityContext.runAsNonRoot != false)
        &&
        object.spec.template.spec.containers.all(container,
          !has(container.securityContext) || !has(container.securityContext.runAsNonRoot) || container.securityContext.runAsNonRoot != false
        )
      )
    dataInput: |
      object:
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: nginx
        spec:
          template:
            metadata:
              name: nginx
              labels:
                app: nginx
            spec:
              securityContext:
                runAsNonRoot: true # the expression looks for this field
              containers:
                - name: nginx
                  image: nginx
                  securityContext:
                    runAsNonRoot: false # and this one
          selector:
            matchLabels:
              app: nginx
    category: "Kubernetes"

  - name: "Drop ALL capabilities"
    cel: |
      // According the Pod Security Standards, Containers must drop `ALL` capabilities, and are only permitted to add back the `NET_BIND_SERVICE` capability.
      // https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted

      // Containers must drop `ALL` capabilities,
      object.spec.template.spec.containers.all(container,
        has(container.securityContext) &&
        has(container.securityContext.capabilities) &&
        has(container.securityContext.capabilities.drop) &&
        size(container.securityContext.capabilities.drop) >= 1 &&
        container.securityContext.capabilities.drop.exists(c, c == 'ALL')
      )
      &&
      // and are only permitted to add back the `NET_BIND_SERVICE` capability
      object.spec.template.spec.containers.all(container,
        !has(container.securityContext) ||
        !has(container.securityContext.capabilities) ||
        !has(container.securityContext.capabilities.add) ||
        container.securityContext.capabilities.add.all(cap, cap in params.allowedCapabilities)
      )
    dataInput: |
      params:
        allowedCapabilities: [NET_BIND_SERVICE]
      object:
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: nginx
        spec:
          template:
            metadata:
              name: nginx
              labels:
                app: nginx
            spec:
              containers:
                - name: nginx
                  image: nginx
                  securityContext:
                    capabilities: # the expression looks for this object
                      drop: [ALL]
                      add: [NET_BIND_SERVICE]
          selector:
            matchLabels:
              app: nginx
    category: "Kubernetes"

  - name: "Semantic version check for image tags (Regex)"
    cel: |
      // Checks if the container images are tagged following the semantic version.

      object.spec.containers.all(container,
        container.image.contains("@sha256") || // allow digest
        container.image.lastIndexOf(":") > -1 &&
        container.image.substring(container.image.lastIndexOf(":") + 1)
          .matches('^v?(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$')
        // the regex above is suggested by semver.org: https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
        // allowing the "v" prefix
      )
    dataInput: |
      object:
        apiVersion: v1
        kind: Pod
        metadata:
          name: nginx
          labels:
            app: nginx
        spec:
          containers:
            - name: ok1
              image: registry.com:80/nginx:v1.2.3-rc.1
            - name: ok2
              image: registry.com:80/nginx@sha256:asdf
            - name: wrong
              image: registry.com:80/nginx:latest  # comment the wrong container to test a success scenario
    category: "Kubernetes"

  - name: "URLs"
    cel: |
      // Examples of Kubernetes URL CEL library that is available in the playground.
      // https://kubernetes.io/docs/reference/using-api/cel/#kubernetes-url-library

      isURL(object.href) 
      && url(object.href).getScheme() == 'https' 
      && url(object.href).getHost() == 'example.com:80'
      && url(object.href).getHostname() == 'example.com'
      && url(object.href).getPort() == '80'
      && url(object.href).getEscapedPath() == '/path'
      && url(object.href).getQuery().size() == 1
    dataInput: |
      {
        "object": {
          "href": "https://user:pass@example.com:80/path?query=val#fragment"
        }
      }
    category: "General"

  - name: "Check JWT custom claims"
    cel: |
      // Exercise provided in CEL-Go Google Codelab.
      // https://codelabs.developers.google.com/codelabs/cel-go/index.html#10
      // 
      // Determine whether the jwt.extra_claims has at least one key that starts
      // with the group prefix, and ensure that all group-like keys have list
      // values containing only strings that end with '@acme.co'.

      jwt.extra_claims.exists(c, c.startsWith('group'))
      && jwt.extra_claims
        .filter(c, c.startsWith('group'))
            .all(c, jwt.extra_claims[c]
                .all(g, g.endsWith('@acme.co')))
    dataInput: |
      jwt: {
        "iss": "auth.acme.com:12350",
        "sub": "serviceAccount:delegate@acme.co",
        "aud": "my-project",
        "extra_claims": {
          "group1": [
            "admin@acme.co",
            "analyst@acme.co"
          ],
          "groupN": [
            "forever@acme.co"
          ],
          "labels": [ "metadata", "prod", "pii" ]
        }
      }
    category: "General"

  - name: "Optional"
    cel: 'object.?foo.orValue("fallback")'
    dataInput: "object: {}"
    category: "General"

  - name: "Duration and timestamp"
    cel: |
      // Validate that 'expired' date is after a 'created' date plus a 'ttl' duration
      has(object.expired) && 
      timestamp(object.created) + duration(object.ttl) < timestamp(object.expired)
    dataInput: |
      object:
        created: "2023-06-14T02:00:14+00:00"
        ttl: "5m"
        expired: "2023-06-14T02:06:14+00:00"
    category: "General"

  - name: "Quantity"
    cel: |
      // Quantity library introduced in Kubernetes 1.28

      isQuantity(object.memory) && 
      quantity(object.memory)
        .add(quantity("700M"))
        .sub(1) // test without this subtraction
        .isLessThan(quantity(object.limit))
    dataInput: |
      object:
        memory: 1.3G
        limit: 2G
    category: "General"

  - name: "Access Log Filtering"
    cel: |
      // Use CEL to filter access logs in Istio by response code or target cluster.
      // https://istio.io/latest/docs/tasks/observability/logs/telemetry-api/#get-started-with-telemetry-api
      //
      // apiVersion: telemetry.istio.io/v1alpha1
      // kind: Telemetry
      // metadata:
      //   name: default-exception-logging
      //   namespace: istio-system
      // spec:
      //   accessLogging:
      //     - providers:
      //         - name: otel
      //       filter:
      //         expression: "response.code >= 400 || xds.cluster_name == 'BlackHoleCluster' ||  xds.cluster_name == 'PassthroughCluster' "
      
      response.code >= 400 || (xds.cluster_name == 'BlackHoleCluster' || xds.cluster_name == 'PassthroughCluster')
    dataInput: |
      # The following configuration is true access logs only when the response code is greater or equal to 400
      # or the request went to the BlackHoleCluster or the PassthroughCluster
      request:
        duration: "173.403244ms"
        headers:
          x-request-id: "e8e687ab-fbbd-4662-8416-11761a29de36"
        host: "httpbin.org"
        id: "e8e687ab-fbbd-4662-8416-11761a29de36"
        method: "GET"
        path: "/get"
        protocol: "HTTP/1.1"
        query: ""
        referer: null
        scheme: "http"
        size: 0
        time: "2023-10-13T20:32:04.7006+00:00"
        total_size: 1000
        url_path: "/get"
        useragent: "curl/8.2.1"
      response:
        code: 200
        code_details: "via_upstream"
        flags: 0
        grpc_status: 2
        headers:
          content-type: "application/json"
        size: 1181
        total_size: 1377
      connection:
        id: 269
        mtls: false
        requested_server_name: ""
      upstream:
        address: "54.80.46.162:80"
        local_address: "10.244.0.37:51128"
        port: 80
        transport_failure_reason: ""
      xds:
        cluster_metadata: ""
        cluster_name: "PassthroughCluster"
        filter_chain_name: ""
        route_metadata: ""
        route_name: "allow_any"
        upstream_host_metadata: "NULL"
    category: "Istio"

  - name: "Custom Metrics"
    cel: |
      // Use CEL to customize the metrics that Istio generates
      // https://istio.io/latest/docs/tasks/observability/metrics/customize-metrics/#use-expressions-for-values
      // 
      // apiVersion: telemetry.istio.io/v1alpha1
      // kind: Telemetry
      // metadata:
      //   name: namespace-metrics
      // spec:
      //   metrics:
      //   - providers:
      //     - name: prometheus
      //     overrides:
      //     - match:
      //         metric: REQUEST_COUNT
      //       tagOverrides:
      //         destination_port:
      //           value: "string(destination.port)"   # <--- CEL
      //         request_host:
      //           value: "request.host"               # <--- CEL
      
      has(request.host) ? request.host : "unknown"
    dataInput: |
      request:
        duration: "4.144461ms"
        headers:
          x-request-id: "7a61a297-e508-43b7-94e8-b3919367e2d2"
        host: "echo"
        id: "7a61a297-e508-43b7-94e8-b3919367e2d2"
        method: "GET"
        path: "/"
        protocol: "HTTP/1.1"
        query: ""
        referer: null
        scheme: "http"
        size: 0
        time: "2023-10-13T20:30:38.106932+00:00"
        total_size: 478
        url_path: "/"
        useragent: "curl/8.2.1"
      response:
        code: "200"
        code_details: "via_upstream"
        flags: "0"
        grpc_status: "2"
        headers:
          content-type: "application/json"
        size: 714
        total_size: 1594
      connection:
        id: 36
        mtls: true
        dns_san_local_certificate: null
        dns_san_peer_certificate: null
        requested_server_name: "outbound_.80_._.echo.default.svc.cluster.local"
        sha256_peer_certificate_digest: "1386a353d125910412d0ecfa7abb2f3fbee9ff3c77dd4d5c19312a8d51e27557"
        subject_local_certificate: ""
        subject_peer_certificate: ""
        termination_details: null
        tls_version: "TLSv1.3"
        uri_san_local_certificate: "spiffe://cluster.local/ns/default/sa/default"
        uri_san_peer_certificate: "spiffe://cluster.local/ns/default/sa/default"
      upstream:
        address: "10.244.0.38:80"
        dns_san_local_certificate: null
        dns_san_peer_certificate: null
        local_address: "127.0.0.6:58023"
        port: 80
        sha256_peer_certificate_digest: null
        subject_local_certificate: null
        subject_peer_certificate: null
        tls_version: null
        transport_failure_reason: ""
        uri_san_local_certificate: null
        uri_san_peer_certificate: null
      xds:
        cluster_metadata:
          filter_metadata:
            istio:
              services:
                - host: "echo.default.svc.cluster.local"
                  name: "echo"
                  namespace: "default"
        cluster_name: "inbound|80||"
        filter_chain_name: "0.0.0.0_80"
        route_metadata: ""
        route_name: "default"
        upstream_host_metadata: "NULL"
    category: "Istio"

  - name: "Blank"
    cel: ""
    dataInput: ""
    category: "Blank"