environment

Documentation

Index

• Variables
• func AuthzSelectorsLibraryEnabled() (enabled, constructed bool)
• func DefaultCompatibilityVersion() *version.Version
• type EnvSet
  • func MustBaseEnvSet(ver *version.Version, strictCost bool) *EnvSet
  • func (e *EnvSet) Env(envType Type) (*cel.Env, error)
  • func (e *EnvSet) Extend(options ...VersionedOptions) (*EnvSet, error)
  • func (e *EnvSet) NewExpressionsEnv() *cel.Env
  • func (e *EnvSet) StoredExpressionsEnv() *cel.Env
• type Type
• type VersionedOptions

Variables

var StrictCostOpt = VersionedOptions{

	IntroducedVersion: version.MajorMinor(1, 0),
	ProgramOptions: []cel.ProgramOption{
		cel.CostTracking(&library.CostEstimator{}),
	},
}

Functions

func AuthzSelectorsLibraryEnabled

func AuthzSelectorsLibraryEnabled() (enabled, constructed bool)

AuthzSelectorsLibraryEnabled returns whether the AuthzSelectors library was enabled when it was constructed. If it has not been contructed yet, this returns `false, false`. This is solely for the benefit of the integration tests making sure feature gates get correctly parsed before AuthzSelector ever has to check for enablement.

func DefaultCompatibilityVersion

func DefaultCompatibilityVersion() *version.Version

DefaultCompatibilityVersion returns a default compatibility version for use with EnvSet that guarantees compatibility with CEL features/libraries/parameters understood by the api server min compatibility version

This default will be set to no more than the current Kubernetes major.minor version.

Note that a default version number less than n-1 the current Kubernetes major.minor version indicates a wider range of version compatibility than strictly required for rollback. A wide range of compatibility is desirable because it means that CEL expressions are portable across a wider range of Kubernetes versions. A default version number equal to the current Kubernetes major.minor version indicates fast forward CEL features that can be used when rollback is no longer needed.

Types

type EnvSet

type EnvSet struct {
	// contains filtered or unexported fields
}

EnvSet manages the creation and extension of CEL environments. Each EnvSet contains both an NewExpressions and StoredExpressions environment. EnvSets are created and extended using VersionedOptions so that the EnvSet can prepare environments according to what options were introduced at which versions.

Each EnvSet is given a compatibility version when it is created, and prepares the NewExpressions environment to be compatible with that version. The EnvSet also prepares StoredExpressions to be compatible with all known versions of Kubernetes.

func MustBaseEnvSet

func MustBaseEnvSet(ver *version.Version, strictCost bool) *EnvSet

MustBaseEnvSet returns the common CEL base environments for Kubernetes for Version, or panics if the version is nil, or does not have major and minor components.

The returned environment contains function libraries, language settings, optimizations and runtime cost limits appropriate CEL as it is used in Kubernetes.

The returned environment contains no CEL variable definitions or custom type declarations and should be extended to construct environments with the appropriate variable definitions, type declarations and any other needed configuration. strictCost is used to determine whether to enforce strict cost calculation for CEL expressions.

func (*EnvSet) Env

func (e *EnvSet) Env(envType Type) (*cel.Env, error)

Env returns the CEL environment for the given Type.

func (*EnvSet) Extend

func (e *EnvSet) Extend(options ...VersionedOptions) (*EnvSet, error)

Extend returns an EnvSet based on this EnvSet but extended with given VersionedOptions. This EnvSet is not mutated. The returned EnvSet has the same compatibility version as the EnvSet that was extended.

Extend is an expensive operation and each call to Extend that adds DeclTypes increases the depth of a chain of resolvers. For these reasons, calls to Extend should be kept to a minimum.

Some best practices:

• Minimize calls Extend when handling API requests. Where possible, call Extend when initializing components.
• If an EnvSets returned by Extend can be used to compile multiple CEL programs, call Extend once and reuse the returned EnvSets.
• Prefer a single call to Extend with a full list of VersionedOptions over making multiple calls to Extend.

func (*EnvSet) NewExpressionsEnv

func (e *EnvSet) NewExpressionsEnv() *cel.Env

NewExpressionsEnv returns the NewExpressions environment Type for this EnvSet. See NewExpressions for details.

func (*EnvSet) StoredExpressionsEnv

func (e *EnvSet) StoredExpressionsEnv() *cel.Env

StoredExpressionsEnv returns the StoredExpressions environment Type for this EnvSet. See StoredExpressions for details.

type Type

type Type string

Type defines the different types of CEL environments used in Kubernetes. CEL environments are used to compile and evaluate CEL expressions. Environments include:

• Function libraries
• Variables
• Types (both core CEL types and Kubernetes types)
• Other CEL environment and program options

const (
	// NewExpressions is used to validate new or modified expressions in
	// requests that write expressions to API resources.
	//
	// This environment type is compatible with a specific Kubernetes
	// major/minor version. To ensure safe rollback, this environment type
	// may not include all the function libraries, variables, type declarations, and CEL
	// language settings available in the StoredExpressions environment type.
	//
	// NewExpressions must be used to validate (parse, compile, type check)
	// all new or modified CEL expressions before they are written to storage.
	NewExpressions Type = "NewExpressions"

	// StoredExpressions is used to compile and run CEL expressions that have been
	// persisted to storage.
	//
	// This environment type is compatible with CEL expressions that have been
	// persisted to storage by all known versions of Kubernetes. This is the most
	// permissive environment available.
	//
	// StoredExpressions is appropriate for use with CEL expressions in
	// configuration files.
	StoredExpressions Type = "StoredExpressions"
)

type VersionedOptions

type VersionedOptions struct {
	// IntroducedVersion is the version at which these options were introduced.
	// The NewExpressions environment will only include options introduced at or before the
	// compatibility version of the EnvSet.
	//
	// For example, to configure a CEL environment with an "object" variable bound to a
	// resource kind, first create a DeclType from the groupVersionKind of the resource and then
	// populate a VersionedOptions with the variable and the type:
	//
	//    schema := schemaResolver.ResolveSchema(groupVersionKind)
	//    objectType := apiservercel.SchemaDeclType(schema, true)
	//    ...
	//    VersionOptions{
	//      IntroducedVersion: version.MajorMinor(1, 26),
	//      DeclTypes: []*apiservercel.DeclType{ objectType },
	//      EnvOptions: []cel.EnvOption{ cel.Variable("object", objectType.CelType()) },
	//    },
	//
	// To create an DeclType from a CRD, use a structural schema. For example:
	//
	//    schema := structuralschema.NewStructural(crdJSONProps)
	//    objectType := apiservercel.SchemaDeclType(schema, true)
	//
	// Required.
	IntroducedVersion *version.Version
	// RemovedVersion is the version at which these options were removed.
	// The NewExpressions environment will not include options removed at or before the
	// compatibility version of the EnvSet.
	//
	// All option removals must be backward compatible; the removal must either be paired
	// with a compatible replacement introduced at the same version, or the removal must be non-breaking.
	// The StoredExpressions environment will not include removed options.
	//
	// A function library may be upgraded by setting the RemovedVersion of the old library
	// to the same value as the IntroducedVersion of the new library. The new library must
	// be backward compatible with the old library.
	//
	// For example:
	//
	//    VersionOptions{
	//      IntroducedVersion: version.MajorMinor(1, 26), RemovedVersion: version.MajorMinor(1, 27),
	//      EnvOptions: []cel.EnvOption{ libraries.Example(libraries.ExampleVersion(1)) },
	//    },
	//    VersionOptions{
	//      IntroducedVersion: version.MajorMinor(1, 27),
	//      EnvOptions: []EnvOptions{ libraries.Example(libraries.ExampleVersion(2)) },
	//    },
	//
	// Optional.
	RemovedVersion *version.Version
	// FeatureEnabled returns true if these options are enabled by feature gates,
	// and returns false if these options are not enabled due to feature gates.
	//
	// This takes priority over IntroducedVersion / RemovedVersion for the NewExpressions environment.
	//
	// The StoredExpressions environment ignores this function.
	//
	// Optional.
	FeatureEnabled func() bool
	// EnvOptions provides CEL EnvOptions. This may be used to add a cel.Variable, a
	// cel.Library, or to enable other CEL EnvOptions such as language settings.
	//
	// If an added cel.Variable has an OpenAPI type, the type must be included in DeclTypes.
	EnvOptions []cel.EnvOption
	// ProgramOptions provides CEL ProgramOptions. This may be used to set a cel.CostLimit,
	// enable optimizations, and set other program level options that should be enabled
	// for all programs using this environment.
	ProgramOptions []cel.ProgramOption
	// DeclTypes provides OpenAPI type declarations to register with the environment.
	//
	// If cel.Variables added to EnvOptions refer to a OpenAPI type, the type must be included in
	// DeclTypes.
	DeclTypes []*apiservercel.DeclType
}

VersionedOptions provides a set of CEL configuration options as well as the version the options were introduced and, optionally, the version the options were removed.