Update CEL documentation to capture type checking errors. (#2984)

* Update CEL documentation to capture type checking errors. Signed-off-by: Whitney Griffith <[email protected]> * address comments Signed-off-by: Whitney Griffith <[email protected]> * accept rewording Signed-off-by: Whitney Griffith <[email protected]> Co-authored-by: Craig Box <[email protected]> * make gen Signed-off-by: Whitney Griffith <[email protected]> --------- Signed-off-by: Whitney Griffith <[email protected]> Co-authored-by: Craig Box <[email protected]>
istio · Nov 15, 2023 · 648947e · 648947e
1 parent 446e4a5
commit 648947e
Show file tree

Hide file tree

Showing 5 changed files with 31 additions and 2 deletions.
diff --git a/envoy/extensions/stackdriver/config/v1alpha1/config.pb.go b/envoy/extensions/stackdriver/config/v1alpha1/config.pb.go
diff --git a/envoy/extensions/stackdriver/config/v1alpha1/config.proto b/envoy/extensions/stackdriver/config/v1alpha1/config.proto
@@ -127,7 +127,20 @@ message PluginConfig {
 
   // CEL expression for filtering access logging. If the expression evaluates
   // to true, an access log entry will be generated. Otherwise, no access log
-  // entry will be generated.
+  // entry will be generated. If there are any type errors, the CEL expression
+  // is evaluated as false. More details on type checking can be found 
+  // at https://kubernetes.io/docs/reference/using-api/cel/#type-checking.
+  // A common error is referring to a non-existent field in the log entry.
+  // It's crucial to note that in Envoy, the fields that appear in access log
+  // entries can vary. This variation is influenced by several factors,
+  // including the protocol in use (such as HTTP or TCP), the applied filters,
+  // and the specific configuration of the Envoy instance. Therefore, when 
+  // using CEL expressions for filtering access logs, it's essential to ensure
+  // that the expressions accurately refer to existing fields in the log entry.
+  // The has() macro in CEL may be used in CEL expressions to check if a field 
+  // is accessible before attempting to access the field's value. 
+  // You can also quickly test CEL expressions at the CEL Playground 
+  // at https://playcel.undistro.io/.
   // NOTE: Audit logs ignore configured filters.
   string access_logging_filter_expression = 17;
 

diff --git a/telemetry/v1alpha1/telemetry.pb.go b/telemetry/v1alpha1/telemetry.pb.go
diff --git a/telemetry/v1alpha1/telemetry.pb.html b/telemetry/v1alpha1/telemetry.pb.html
diff --git a/telemetry/v1alpha1/telemetry.proto b/telemetry/v1alpha1/telemetry.proto
@@ -670,6 +670,7 @@ message AccessLogging {
     //
     // - `response.code >= 400`
     // - `connection.mtls && request.url_path.contains('v1beta3')`
+    // - `!has(request.useragent) || !(request.useragent.startsWith("Amazon-Route53-Health-Check-Service"))`
     string expression = 1;
   }