# Common Expression Language Published articles for Common Expression Language. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Securing the agentic era: Introducing formal verification for CEL DevFeed: [Securing the agentic era: Introducing formal verification for CEL]() Original publisher: [Read original article]() Author: Google Open Source (noreply@blogger.com) Published: 2026-08-18T18:30:00Z Content type: release Language: en Sources: [Google Open Source Blog]() Topics: [Formal verification](), [Automated reasoning](), [Testing](), [Artificial Intelligence]() Tags: [agent](), [ai](), [ai-agent](), [automated-reasoning](), [cel](), [common-expression-language](), [formal-verification](), [open-source](), [security](), [testing](), [verification](), [z3]() ### AI overview Google's Common Expression Language (CEL) Formal Verification Framework is available for proving the correctness of CEL expressions and policies. Powered by the Z3 theorem prover, it complements heuristic testing by using mathematical proofs to identify logic flaws, equivalence issues, and potentially unsafe policy behavior. ### Source excerpt by Sean Huh, Common Expression Language Team We are rapidly entering an era where AI agents can autonomously draft, refactor, and deploy policies that protect our users and our systems. But this velocity introduces a vital question: How do we trust AI-generated policies? Unit tests may fail to cover the infinite set of possible inputs that occur in production; thus, an AI agent that overfits its policy to existing tests may fail spectacularly in production. To secure automated policy authoring, we must combine heuristic testing with mathematical proofs. We are thrilled to announce the Common Expression Language (CEL) Formal Verification Framework is now available. Powered by the Z3 theorem prover, this framework allows you to prove the correctness of your CEL expressions and policies, serving as the ultimate safety net for the agentic policy. Automated reasoning definitively answers questions like: "Is there any combination of inputs that allows an unapproved request into production?" "Are we absolutely certain this AI-refactored policy matches the original behavior?" "Can a bad actor manipulate this rule to force an evaluation error?" Formal verification establishes mathematical certainty across the infinite spectrum of inputs. Proven policies protect your users and system while giving auditors clear proof of compliance. To see these capabilities in action, watch our video demonstrating how the CEL Verifier REPL catches subtle logic flaws in seconds: Proving rules from the ground up Getting started with formal verification doesn't require learning complex architectures right away. You can evaluate simple standalone CEL expressions to catch edge cases that tests easily miss. (Note: The examples below use our interactive REPL syntax--check out the REPL documentation to follow along!) 1. Catching logic bugs in simple expressions (Equivalence) How do you guarantee a refactored rule behaves identically to the original? Suppose we have a policy that allows ports 80 or 443 ## How Kubernetes 1.34's Dynamic Resource Allocation improves GPU scheduling DevFeed: [How Kubernetes 1.34's Dynamic Resource Allocation improves GPU scheduling]() Original publisher: [Read original article]() Author: Dawood Abbas Published: 2026-08-06T16:00:00Z Content type: article Language: en Sources: [Kubernetes Overview, News and Trends | The New Stack]() Topics: [Kubernetes v1.34](), [GPU]() Tags: [ai-infrastructure](), [andela](), [common-expression-language](), [gpu](), [helm-charts](), [kubernetes](), [nvidia](), [platform-engineering](), [post-contributed](), [sponsor-andela](), [sponsored-post-contributed]() ### AI overview The article explains how Kubernetes 1.34's Dynamic Resource Allocation changes GPU scheduling. It describes limitations of treating GPUs as identical resources, including out-of-memory errors, rigid MIG resource types, pending jobs, and wasted capacity, then presents DRA as a way for workloads to express more explicit GPU requirements. ### Source excerpt Consider a platform team managing a shared GPU cluster with a mix of B200s, H100s, and recently added B300s. Every The post Say goodbye to K8s GPU pain: How DRA changes everything appeared first on The New Stack. ## Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL DevFeed: [Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL]() Original publisher: [Read original article]() Author: Koray Oksay Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Kubernetes](), [Platform Engineering](), [Security](), [developer velocity](), [Containers](), [supply-chain-security](), [YAML](), [opa](), [rego]() Tags: [common-expression-language](), [compliance](), [container-images](), [containers](), [cosign](), [deployment](), [developer-velocity](), [governance](), [hipaa](), [integration](), [kubernetes](), [kyverno](), [pci-dss](), [platform](), [policy](), [security](), [security-policies](), [sigstore](), [soc-2](), [supply-chain-security]() ### AI overview A guide to using Kyverno and its Common Expression Language support for Kubernetes governance. It explains how platform engineering teams can enforce policies, automate resource changes, generate resources, verify image signatures, and maintain security and compliance while preserving developer velocity. ### Source excerpt Kyverno with CEL support provides Policy-as-Code for Kubernetes governance. Enforce security, automate guardrails, and boost developer velocity for platform engineering teams. ## CEL repositories move to the dedicated cel-expr GitHub organization DevFeed: [CEL repositories move to the dedicated cel-expr GitHub organization]() Original publisher: [Read original article]() Author: Google Open Source (noreply@blogger.com) Published: 2026-06-16T18:30:00Z Content type: release Language: en Sources: [Google Open Source Blog]() Topics: [GitHub](), [Git]() Tags: [announce](), [brand-identity](), [c-plus-plus](), [cel](), [common-expression-language](), [consistency](), [dependencies](), [dependency-management](), [development](), [discoverability](), [github](), [go](), [java](), [pull-requests](), [python]() ### AI overview The official Common Expression Language (CEL) repositories have moved from the Google organization to the dedicated cel-expr GitHub organization. The move centralizes the language specification and implementations, while redirects preserve existing links and repository history. ### Source excerpt by Olena Huang, CEL (Common Expression Language) team We're excited to announce that the official Common Expression Language (CEL) repositories have moved to a dedicated GitHub organization. Visit the new cel-expr repository now! Why the move? This move is a key step in strengthening the CEL ecosystem. By centralizing our projects, including the language specification, Go, C++, C, Java, and Python implementations, under the cel-expr organization, we aim to: Enhance Branding: Create a clear and unified brand identity for CEL. Improve Discoverability: Make it easier for users and contributors to find all official CEL resources in one place. Ensure Consistency: Foster consistency across all CEL projects. Streamline Development: Simplify our development and release processes. What's Changing? The following repositories now reside in the cel-expr organization: google/cel-spec is now cel-expr/cel-spec google/cel-cpp is now cel-expr/cel-cpp google/cel-go is now cel-expr/cel-go google/cel-java is now cel-expr/cel-java cel-expr/cel-python and cel-expr/cel-c have already been in the cel-expr namespace All future development, issues, and pull requests for these projects will take place in their new homes within the cel-expr organization. This is a non-breaking change, due to automatic redirects, but you should update your URLs where possible. What Stays the Same? We've worked to make this transition as seamless as possible: Automatic Redirects: GitHub will automatically redirect all web traffic and git operations from the old google/cel-* URLs to the new cel-expr/cel-* locations. Your existing links and git remote configurations pointing to the old URLs should continue to work for cloning and fetching. Preserved History: The full commit history, issues, and pull requests for each repository have been migrated and are available in the new locations. Action Required: Update Your Dependencies While existing links and git remote configurations pointing to the old URLs should conti ## Are Kubernetes Validating Admission Policies the end of admission controllers? DevFeed: [Are Kubernetes Validating Admission Policies the end of admission controllers?]() Original publisher: [Read original article]() Published: 2023-03-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Kubernetes](), [supply-chain-security](), [API](), [Structured-data]() Tags: [admission-controller](), [api](), [api-server](), [blog-post](), [chainguard-enforce](), [common-expression-language](), [complexity](), [deployment](), [fragmentation](), [integration](), [kubernetes](), [kubernetes-admission-controller](), [performance](), [policy](), [security-policies](), [software-supply-chain](), [supply-chain](), [validation]() ### AI overview The article explains how Kubernetes Validating Admission Policies, introduced in alpha in Kubernetes 1.26, let users evaluate many admission checks natively in the API server using Google's Common Expression Language (CEL). It argues that these policies improve performance, reliability, and integration by reducing reliance on webhooks, while noting that admission controllers remain necessary for policies beyond CEL's deliberately restricted capabilities. ### Source excerpt Validating Admission Policies are here in Kubernetes 1.26. Read on to learn how they work and what they mean for admission controllers.