$ show cerbos/cerbos
Cerbos is an open-source, cloud-native authorization engine (Policy Decision Point) that evaluates access policies at runtime. It processes authorization requests via gRPC and HTTP APIs, enforcing policies defined in YAML using RBAC, ABAC, and derived roles. The system ingests policies from multiple storage backends (disk, Git, SQL databases, cloud blob storage, Cerbos Hub) and compiles them into an optimized rule table with a bitmap-based index for low-latency evaluation. The rule table uses CEL (Common Expression Language) for condition evaluation, with partial evaluation for query planning. Architecturally, Cerbos is a Go monorepo producing two main binaries: `cerbos` (server + CLI tools) and `cerbosctl` (admin CLI). The server exposes gRPC/HTTP endpoints for CheckResources and PlanResources, along with admin, playground, and AuthZEN-compliant APIs. It includes built-in observability with OpenTelemetry metrics/tracing, structured logging, audit logging (local, Kafka, Hub), and telemetry. The evaluation engine is highly optimized with lazy dimension materialization, program caching, and functional core sharing to minimize memory and latency. External dependencies include protobuf, gRPC, CEL, OpenTelemetry, and various storage drivers (PostgreSQL, MySQL, SQLite, Kafka, BadgerDB, cloud SDKs). The project is designed for Kubernetes deployment (sidecar, service, daemonset), AWS Lambda, and systemd. It also provides a CLI for policy management, testing, and debugging, including a REPL for interactive condition evaluation.
The LLM identified 5 files worth highlighting for reuse:
Implements a two-level bitmap (Roaring bitmap) with meta-level skipping for fast intersections and unions. Uses an arena pool (sync.Pool) to reuse bitmaps and provides marshal/unmarshal for persistence. This is a self-contained, high-performance data structure that can be extracted for any application requiring efficient set operations on large dimensions.
Compiles policy variables by building a dependency graph using gonum/graph, performing topological sort, and detecting cycles. This is a clean, reusable pattern for any system that needs to resolve interdependent expressions or configurations with validation.
Defines a custom CEL library with functions for set membership (in, allOf, anyOf, noneOf), IP address ranges, SPIFFE identity matching, hierarchical scope operations, and path manipulation. This is a well-structured, reusable CEL extension that can be integrated into any CEL-based system requiring domain-specific operations.
Implements a configurable audit log filter that can mask or remove fields from decision logs using JSONPath-like expressions. It uses protobuf reflection and structpb manipulation to selectively scrub sensitive data. This is a self-contained, reusable pattern for any system needing dynamic field-level redaction in audit trails.
A directory watcher that uses polling (fsnotify fallback) with a configurable cooldown period to batch file system events and trigger reloads. It handles debouncing, restart, and error recovery. This is a reusable pattern for any application that needs to detect file changes and trigger actions without overwhelming the system.