Skip to content

feat: [cel] add CEL-based assertions and offline VAP evaluation#562

Closed
crandles wants to merge 2 commits into
kubernetes-sigs:mainfrom
crandles:cel
Closed

feat: [cel] add CEL-based assertions and offline VAP evaluation#562
crandles wants to merge 2 commits into
kubernetes-sigs:mainfrom
crandles:cel

Conversation

@crandles

@crandles crandles commented Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What type of PR is this?

/kind feature

What this PR does / why we need it:

Adds a cel package for writing CEL-based assertions against Kubernetes objects in tests. Same expression language the API server uses for CRD validation and admission policies, so tests don't drift from the policies they exercise.

Design doc: docs/cel-assertions.md.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Happy to split by sub-package if that's easier to review -- cel, policy, feature, wait, decoder each stand alone.

Does this PR introduce a user-facing change?

Added a `cel` package for writing CEL-based assertions against Kubernetes objects in tests, including offline ValidatingAdmissionPolicy evaluation.

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/feature Categorizes issue or PR as related to a new feature. labels Apr 18, 2026
@k8s-ci-robot

k8s-ci-robot commented Apr 18, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: crandles
Once this PR has been reviewed and has the lgtm label, please assign shwethakumbla for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot
k8s-ci-robot requested a review from cpanato April 18, 2026 14:49
@k8s-ci-robot k8s-ci-robot added the sig/testing Categorizes an issue or PR as relevant to SIG Testing. label Apr 18, 2026
@k8s-ci-robot

k8s-ci-robot commented Apr 18, 2026

Copy link
Copy Markdown
Contributor

Hi @crandles. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Apr 18, 2026
@crandles
crandles marked this pull request as ready for review April 18, 2026 14:57
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 18, 2026
@k8s-triage-robot

k8s-triage-robot commented Apr 18, 2026

Copy link
Copy Markdown

Unknown CLA label state. Rechecking for CLA labels.

Send feedback to sig-contributor-experience at kubernetes/community.

/check-cla
/easycla

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Apr 18, 2026
@vladimirvivien

vladimirvivien commented Apr 21, 2026

Copy link
Copy Markdown
Contributor

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 21, 2026
@crandles

crandles commented Apr 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Thanks! I'll dig into the failures

vladimirvivien
vladimirvivien reviewed Apr 21, 2026
View reviewed changes

@vladimirvivien vladimirvivien left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi @crandles - this is an awesome submission (as were all of your contributions). Because of its size, it will take me some time to digest everything.

Quick feed back: consider making cel a top root package instead of klient/cel.

@crandles

crandles commented Apr 21, 2026

Copy link
Copy Markdown
Contributor Author

Happy to move it, naming is hard.

Open to scoping down, or splitting over multiple PRs. It seemed like CEL would be nice throughout the project.

On another note:

Should I consider joining the org?

@crandles

crandles commented Apr 21, 2026

Copy link
Copy Markdown
Contributor Author

golangci-lint version mismatch, seems I'm ahead and getting different results locally.

@crandles

crandles commented Apr 21, 2026

Copy link
Copy Markdown
Contributor Author

I will be proposing this here, shortly, but in the meantime: I've added a Github Workflow that runs on forked-repository pull requests. It would be nice to catch simple errors sooner.

Work in progress: crandles#1

crandles
crandles commented Apr 21, 2026
View reviewed changes
Comment thread cel/wait/wait.go
@crandles crandles changed the title feat: [klient/cel] add CEL-based assertions and conformance profiles feat: [cel] add CEL-based assertions and offline VAP evaluation Apr 21, 2026
@vladimirvivien

vladimirvivien commented Apr 27, 2026

Copy link
Copy Markdown
Contributor

@crandles yes, you should definitely consider joining the project as you've landed some great contributions in the past. We had golangci-lint version issues a few weeks back and were forced to update, so you may have to update your env.

@vladimirvivien

vladimirvivien commented Apr 27, 2026

Copy link
Copy Markdown
Contributor

@crandles Let's split the PR into functional packages as you suggested. cel and policy first (including design docs, tests, examples, etc). Then another PR for the remainder packages..

@crandles crandles mentioned this pull request May 3, 2026
Open
@crandles

crandles commented May 3, 2026

Copy link
Copy Markdown
Contributor Author

splitting per #562 (comment) -- #569 has the cel + cel/policy core (with an offline example). a follow-up PR will layer on cel/decoder, cel/feature, cel/wait + the live-cluster example.

closing this in favor of the split.

@crandles crandles closed this May 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vladimirvivien vladimirvivien vladimirvivien left review comments
@cpanato cpanato Awaiting requested review from cpanato
@ShwethaKumbla ShwethaKumbla Awaiting requested review from ShwethaKumbla
@harshanarayana harshanarayana Awaiting requested review from harshanarayana

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@crandles @k8s-ci-robot @k8s-triage-robot @vladimirvivien