Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix bug where CEL listOfString.join() results in unexpected error #117593

Merged
merged 2 commits into from
Apr 26, 2023
Merged

Fix bug where CEL listOfString.join() results in unexpected error #117593

merged 2 commits into from
Apr 26, 2023

Conversation

jpbetz
Copy link
Contributor

@jpbetz jpbetz commented Apr 25, 2023

What type of PR is this?

/kind bug

What this PR does / why we need it:

Without string.join() it can be difficult to leverage the messageExpression field added to CRD validation rules and ValidatingAdmissionPolicy in 1.27.

Which issue(s) this PR fixes:

Fixes #117590

Special notes for your reviewer:

We may be able to simplify this in the future depending on the outcome of google/cel-go#688. For now, this introduces an isolated workaround.

Does this PR introduce a user-facing change?

Fix bug where `listOfStrings.join()` in CEL expressions resulted in an unexpected internal error.

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. kind/bug Categorizes issue or PR as related to a bug. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Apr 25, 2023
@k8s-ci-robot k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Apr 25, 2023
@jpbetz jpbetz mentioned this pull request Apr 25, 2023
Merged
liggitt
liggitt reviewed Apr 25, 2023
View reviewed changes
staging/src/k8s.io/apiextensions-apiserver/pkg/apiserver/schema/cel/validation_test.go
@@ -339,6 +339,17 @@ func TestValidationExpressions(t *testing.T) {
"self.val1 + [4, 5] == [1, 2, 3, 4, 5]",
},
},
{name: "string lists",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we need a negative test that obj: objs([]interface{}{"a", 1, "c"}), errors when join is attempted?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CEL compiler prevents mixed type lists via https://github.com/google/cel-go/blob/d39523c445fcf548ef6529b63c1a1045cc373d37/cel/options.go#L129, which we have enabled.

I could test that non-string lists are not eligible to be joined, but it seems excessive to test that all functions are only available on the receivers that they are defined for.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, if we guard against it and test for that guard, that's fine.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SG. I've added the tests for the guard (for both lists and maps).

@cici37
Copy link
Contributor

cici37 commented Apr 25, 2023

/lgtm
Might worth to backport?

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 25, 2023
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 28fc3035a7c6c8d8fffda29e464bc584f21652ae

@jpbetz
Copy link
Contributor Author

jpbetz commented Apr 25, 2023

/lgtm Might worth to backport?

#117596 backports to 1.27, which is where this is needed most, since it helps a lot for messageExpression. If anyone thinks this should go back further let me know.

@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 25, 2023
@cici37
Copy link
Contributor

cici37 commented Apr 25, 2023

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Apr 25, 2023
@cici37
Copy link
Contributor

cici37 commented Apr 25, 2023

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 25, 2023
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: b353f8a42d4be0335a16c19f1bba6716239b57a4

@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 25, 2023
@alvaroaleman
Copy link
Member

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 25, 2023
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 22f16fde1442cdddf86ac43ee02ae1e108309c0f

@jpbetz
Copy link
Contributor Author

jpbetz commented Apr 25, 2023

/retest

1 similar comment
@jpbetz
Copy link
Contributor Author

jpbetz commented Apr 26, 2023

/retest

@jpbetz
Copy link
Contributor Author

jpbetz commented Apr 26, 2023

/priority important-soon

@k8s-ci-robot k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Apr 26, 2023
@jpbetz
Copy link
Contributor Author

jpbetz commented Apr 26, 2023

/assign @deads2k @lavalamp

Would either of you be wiling to approve?

@lavalamp
Copy link
Member

/lgtm
/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jpbetz, lavalamp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 26, 2023
@jpbetz
Copy link
Contributor Author

jpbetz commented Apr 26, 2023

/retest

@k8s-ci-robot k8s-ci-robot merged commit 8ae8e77 into kubernetes:master Apr 26, 2023
12 checks passed
@k8s-ci-robot k8s-ci-robot added this to the v1.28 milestone Apr 26, 2023
k8s-ci-robot added a commit that referenced this pull request Apr 26, 2023
@k8s-ci-robot
Merge pull request #117596 from jpbetz/automated-cherry-pick-of-#1175…
6494bc6 
…93-origin-release-1.27

Automated cherry pick of #117593: Fix bug where CEL listOfString.join() results in unexpected
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt liggitt left review comments

@alvaroaleman alvaroaleman alvaroaleman left review comments

@cici37 cici37 Awaiting requested review from cici37

@deads2k deads2k Awaiting requested review from deads2k

Assignees

@lavalamp lavalamp

@alvaroaleman alvaroaleman

@deads2k deads2k

@cici37 cici37

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.28
Development

Successfully merging this pull request may close these issues.

CEL: listOfStrings.join() fails due to internal conversion error
7 participants
@jpbetz @cici37 @k8s-ci-robot @alvaroaleman @lavalamp @liggitt @deads2k