Kaspersky Container Security (KCS) developers evaluated two policy engines, Rego and CEL, for Kubernetes security checks. The team prioritized speed and security, as the engine operates on the critical path of cluster operations. While Rego offers high expressiveness, it requires a separate virtual machine and can introduce latency in the tens of milliseconds during complex evaluations.
Benchmarks showed that CEL outperforms Rego in evaluation speed. In a scenario involving large objects, CEL processed rules in 24 microseconds compared to 3.84 milliseconds for Rego. CEL also proved to be more memory-efficient. The team concluded that CEL's C-like syntax and integration with the Kubernetes API make it better suited for the KCS workload, which requires simple true or false responses.
The choice of CEL was also driven by security considerations regarding the threat model. Rego is Turing-complete, which could allow an internal attacker to extract sensitive data from worker nodes. CEL is not Turing-complete, limiting the potential for malicious logic. To further mitigate risks like secret extraction, KCS blocks specific functions like matches, startsWith, and endsWith when checking file contents.
KCS implements additional safeguards to prevent secret harvesting. For the contains function, the system appends a newline character to the target value, forcing the rule to match the entire line rather than partial strings. Furthermore, the system logs repeated rule applications to a SIEM, enabling the detection of suspicious activity by internal users who might attempt to probe for sensitive information.
