CFP: Cilium policy selector expression

[fristonio]

No description provided.

[squeed]

Should we set a cost limit for CEL expressions? It could be caught in the Sanitize function().

We can always increase the cost limit, but never decrease it :-/.

[joestringer]

Could you also draft some specific user stories about selections they would like to do? I think that would help to inform what the solution should look like in order to satisfy the intent of our users.

[squeed]

We should probably include some examples here, along with the expected CEL variables and functions we intend to expose.

[fristonio]

I was thinking of keeping the implementation details separate from the high level CFP. I am working on the implementation of CEL env here. Do you think it makes sense to keep this detailed documentation there(working on a package level README) or should I include everything here?

[squeed]

I would say that the CEL environment is probably worth briefly discussing, since it's essentially unchangeable once landed. We don't need to consider every possible function

[squeed]

So, I'm thinking about the existing source:key convention for embedding sources in to keys. It works, but I don't particularly like it. In particular, the source is not part of the key. It is metadata attached to the value. (Side note: we get very lucky that 1.1.1.1/32 is not a valid k8s label, since we rely on that for CIDR selectors. In the future, I could even see us allowing multiple values for a given key, though this may not be worth the pain.)

Anyways.

From your comments, it seems that looking up labels via function calls is expensive. What the environment had a single variable, labels:

map[string]struct{
  Value string `cel:"value"`
  Source string `cel:"source"`
}

	env, err := cel.NewEnv(
		ext.NativeTypes(
			ext.ParseStructTag("cel"),
			reflect.TypeFor[*Label](),
		),
		cel.Variable("labels",
			cel.MapType(cel.StringType, cel.ObjectType("main.Label"))),
	)

We could even add some useful macros, like label(key) expanding to labels[key].value