Implement Receiver resource filtering with CEL #948

bigkevmcd · 2024-10-10T05:37:38Z

This implementation allows filtering of wildcarded resources for receivers using CEL expressions.

Closes: #491

bigkevmcd · 2024-10-10T05:39:57Z

@stefanprodan @matheuscscp I reworked it to filter the resources using CEL.

I'm not quite sure that this is really that valuable, I suspect label filtering is also more efficient?

There's some optimisation of the CEL that could be done within requestReconciliation to reduce the creation of CEL values and I can do that but I thought I'd get this out for comment.

internal/server/receiver_handlers.go

matheuscscp

Thanks again for all the work here, @bigkevmcd! I'm very excited for this feature 😄

This is just a preliminary review. I will try to review this again soon.

internal/server/receiver_handlers.go

stefanprodan

LGTM

Thanks @bigkevmcd 🥇

matheuscscp

LGTM! Thanks @bigkevmcd! Pretty cool contribution 👍

internal/server/cel.go

internal/server/receiver_handlers.go

api/v1/receiver_types.go

stefanprodan · 2024-11-01T20:31:01Z

@bigkevmcd this is good to go, please signoff all your commits and force push.

bigkevmcd · 2024-11-18T19:40:35Z

@pjbgf

+1 on leaning on k8s' default limits as a starting point. It might be worth just confirming whether the payload and expression sizes for this use case are equivalent, so that those limits would not be too forgiving.

https://github.com/kubernetes/kubernetes/blob/cf480a3a1a9cb22f3439c0a7922822d9f67f31b5/staging/src/k8s.io/apiserver/pkg/apis/cel/config.go#L40

That's 3MiB, I've definitely seen GitHub hook notifications that were > 1.5MiB.

CEL for Receiver notification filtering This introduces CEL for filtering CEL resources in a Receiver. Users can define a CEL expression that is applied as a filter for resources that are identified for notification. A CEL expression that returns false means that a resource will not be annotated. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

This moves the JSON body to request.body from request to allow for future expansion with the headers. Add documentation for the CEL functionality to the receivers doc. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Refactor to reduce duplication. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

If the .spec.resourceFilter is provided, and can't be parsed by the CEL environment, the resource will not be ready, and an appropriate error indicated. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

In the event of a CEL expresion error, this doesn't return the error to the controller-runtime reconciler mechanism. This means that the reconciliation will not be retried until there's a change to the resource. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

* Don't pass log through - get it from the context * Use ContextEval - need to set a timeout on the context that's passed Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

This adds more testing for the CEL evaluation mechanism for resource filtering. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

matheuscscp

New batch of comments ❤️

matheuscscp · 2025-01-27T10:06:30Z

api/v1/receiver_types.go

@@ -67,6 +67,11 @@ type ReceiverSpec struct {
 	// +required
 	Resources []CrossNamespaceObjectReference `json:"resources"`

+	// ResourceFilter is a CEL expression that is applied to each Resource
+	// referenced in the Resources. If the expression returns false then the


Suggested change

// referenced in the Resources. If the expression returns false then the

// referenced in the Resources field. If the expression returns false then the

api/v1/receiver_types.go

matheuscscp · 2025-01-27T11:01:28Z

docs/spec/v1/receivers.md

+
+To filter the resources that are reconciled you can use [Common Expression Language (CEL)](https://cel.dev/).
+
+For example to trigger `ImageRepositories` on notifications from [Google Artifact Registry](https://cloud.google.com/artifact-registry/docs/configure-notifications#examples) you can define a receiver.


Suggested change

For example to trigger `ImageRepositories` on notifications from [Google Artifact Registry](https://cloud.google.com/artifact-registry/docs/configure-notifications#examples) you can define a receiver.

For example, to trigger `ImageRepositories` on notifications from [Google Artifact Registry](https://cloud.google.com/artifact-registry/docs/configure-notifications#examples) you can define the following receiver:

docs/spec/v1/receivers.md

api/v1/condition_types.go

matheuscscp

Still need to go over internal/server/receiver_handlers.go once again

matheuscscp · 2025-01-29T11:49:54Z

docs/spec/v1/receivers.md

+There are a number of functions available to the CEL expressions beyond the basic CEL functionality.
+
+The [Strings extension](https://github.com/google/cel-go/tree/master/ext#strings) is available.
+
+In addition the notifications-controller CEL implementation provides the following functions:
+
+#### first
+
+Returns the first element of a CEL array expression.
+
+```
+<list<any>>.first() -> <any>
+```
+
+This is syntactic sugar for `['hello', 'mellow'][0]`
+
+Examples:
+
+```
+['hello', 'mellow'].first() // returns 'hello'
+[].first() // returns nil
+'this/test'.split('/').first() // returns 'this'
+```
+
+#### last
+
+Returns the last element of a CEL array expression.
+
+```
+<list<any>>.last() -> <any>
+```
+
+Examples:
+
+```
+['hello', 'mellow'].last() // returns 'mellow'
+[].last() // returns nil
+'this/test'.split('/').last() // returns 'test'
+```
+
+This is syntactic sugar for `['hello', 'mellow'][size(['hello, 'mellow'])-1]`
+
+For zero-length array values, these will both return `nil`.
+


I think we can remove all of this since now these functions are in the upstream CEL library.

matheuscscp · 2025-01-29T13:56:07Z

internal/controller/receiver_controller.go

+	if filter := obj.Spec.ResourceFilter; filter != "" {
+		err := server.ValidateCELExpression(filter)
+		if err != nil {
+			conditions.MarkFalse(obj, meta.ReadyCondition, apiv1.InvalidCELExpressionReason, "%s", err)


internal/server/cel.go

internal/controller/receiver_controller.go

matheuscscp · 2025-01-29T14:03:18Z

internal/server/cel.go

+// ValidateCELEXpression accepts a CEL expression and will parse and check that
+// it's valid, if it's not valid an error is returned.
+func ValidateCELExpression(s string) error {
+	_, err := newCELProgram(s)


Let's use the library as discussed (still needs to be merged/released, will happen soon):

fluxcd/pkg#858

matheuscscp · 2025-01-29T14:03:40Z

internal/server/cel.go

@@ -0,0 +1,194 @@
+/*


Most of this file can be removed in favor of fluxcd/pkg#858

matheuscscp · 2025-01-29T14:03:57Z

internal/server/cel_test.go

@@ -0,0 +1,131 @@
+package server


This test file can be removed in favor of fluxcd/pkg#858

matheuscscp · 2025-01-31T14:48:49Z

@bigkevmcd we have released the fluxcd/pkg packages, please pull them in with:

go get github.com/fluxcd/pkg/apis/meta@v1.10.0 for InvalidCELExpressionReason
go get github.com/fluxcd/pkg/runtime@v0.53.0 for the runtime/cel library

🙏

Edit: Like Stefan said below, just need to rebase.

stefanprodan · 2025-02-01T07:20:13Z

@bigkevmcd if you rebase with main, you'll find runtime/cel and the InvalidCELExpressionReason.

Co-authored-by: Matheus Pimenta <matheuscscp@gmail.com> Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Co-authored-by: Matheus Pimenta <matheuscscp@gmail.com> Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com> Strip out unnecessary documentation.

bigkevmcd force-pushed the cel-resource-filtering branch from 4969c46 to 1fe996b Compare October 10, 2024 05:40

github-advanced-security bot found potential problems Oct 10, 2024

View reviewed changes

internal/server/receiver_handlers.go Fixed Show fixed Hide fixed

bigkevmcd force-pushed the cel-resource-filtering branch 3 times, most recently from d87dbfd to b1c4e7e Compare October 10, 2024 19:03

stefanprodan changed the title ~~CEL Resource Filtering~~ Implement Receiver resource filtering with CEL Oct 11, 2024

bigkevmcd force-pushed the cel-resource-filtering branch from 45bd724 to 1e6929c Compare October 13, 2024 14:57

bigkevmcd marked this pull request as ready for review October 13, 2024 15:18

bigkevmcd marked this pull request as draft October 16, 2024 07:30

bigkevmcd force-pushed the cel-resource-filtering branch from 1e6929c to d658d4a Compare October 17, 2024 08:46

bigkevmcd marked this pull request as ready for review October 17, 2024 08:54

matheuscscp reviewed Oct 17, 2024

View reviewed changes

internal/server/receiver_handlers.go Show resolved Hide resolved

github-advanced-security bot found potential problems Oct 17, 2024

View reviewed changes

internal/server/receiver_handlers.go Fixed Show fixed Hide fixed

bigkevmcd force-pushed the cel-resource-filtering branch 4 times, most recently from 5a22c4f to bddfd56 Compare October 18, 2024 13:06

stefanprodan approved these changes Oct 28, 2024

View reviewed changes

matheuscscp approved these changes Oct 28, 2024

View reviewed changes

darkowlzz reviewed Oct 31, 2024

View reviewed changes

internal/server/cel.go Show resolved Hide resolved

internal/server/receiver_handlers.go Outdated Show resolved Hide resolved

api/v1/receiver_types.go Show resolved Hide resolved

bigkevmcd force-pushed the cel-resource-filtering branch 6 times, most recently from 8e892ef to 18c1f31 Compare November 1, 2024 14:34

stefanprodan reviewed Nov 1, 2024

View reviewed changes

api/v1/receiver_types.go Outdated Show resolved Hide resolved

bigkevmcd force-pushed the cel-resource-filtering branch from 8a9e435 to 57c36b0 Compare November 1, 2024 20:58

bigkevmcd force-pushed the cel-resource-filtering branch from 757f96d to 1645796 Compare December 12, 2024 20:03

bigkevmcd force-pushed the cel-resource-filtering branch from 1645796 to f79599e Compare January 12, 2025 17:55

This was referenced Jan 28, 2025

[RFC-0009] Add InvalidCELExpressionReason to apis/meta fluxcd/pkg#859

Merged

[RFC-0009] Add healthcheck expressions to kustomize types fluxcd/pkg#857

Merged

[RFC-0009] Add CEL library with custom healthchecks to runtime fluxcd/pkg#858

Merged

bigkevmcd added 13 commits January 28, 2025 13:44

Add request.body in CEL notification filtering

a7a2bcd

This moves the JSON body to request.body from request to allow for future expansion with the headers. Add documentation for the CEL functionality to the receivers doc. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Failing test for Receiver CEL with GitHub.

eba1e2e

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Rework the body reading for handling.

2d84111

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Refactor the receiver handler.

18b36a7

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Fix the remaining handlers to allow CEL to read the body.

d38e2cc

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Add license header.

c2b369d

Refactor to reduce duplication. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Validate the CEL expression on reconciliation.

4c50cd7

If the .spec.resourceFilter is provided, and can't be parsed by the CEL environment, the resource will not be ready, and an appropriate error indicated. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Improve the API documentation.

baada0a

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Address review comments

f986ccf

* Don't pass log through - get it from the context * Use ContextEval - need to set a timeout on the context that's passed Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

More tests.

bae8794

This adds more testing for the CEL evaluation mechanism for resource filtering. Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

Rework log messages.

e438ca1

Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

bigkevmcd force-pushed the cel-resource-filtering branch from f79599e to e438ca1 Compare January 28, 2025 13:45

matheuscscp self-requested a review January 28, 2025 17:12

matheuscscp reviewed Jan 28, 2025

View reviewed changes

matheuscscp reviewed Jan 29, 2025

View reviewed changes

Update api/v1/receiver_types.go

0a09f46

Co-authored-by: Matheus Pimenta <matheuscscp@gmail.com> Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com>

bigkevmcd force-pushed the cel-resource-filtering branch from 15d0f16 to eb6f1ce Compare February 3, 2025 08:32

matheuscscp mentioned this pull request Feb 3, 2025

runtime: downgrade github.com/google/cel-go and cel.dev/expr fluxcd/pkg#865

Closed

Rework to pull in upstream changes.

fc59218

Co-authored-by: Matheus Pimenta <matheuscscp@gmail.com> Signed-off-by: Kevin McDermott <bigkevmcd@gmail.com> Strip out unnecessary documentation.

bigkevmcd force-pushed the cel-resource-filtering branch from 7183c3c to fc59218 Compare February 3, 2025 19:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement Receiver resource filtering with CEL #948

Implement Receiver resource filtering with CEL #948

bigkevmcd commented Oct 10, 2024 •

edited by stefanprodan

Loading

bigkevmcd commented Oct 10, 2024 •

edited

Loading

matheuscscp left a comment •

edited

Loading

stefanprodan left a comment

matheuscscp left a comment

stefanprodan commented Nov 1, 2024

bigkevmcd commented Nov 18, 2024

matheuscscp left a comment

matheuscscp Jan 27, 2025

matheuscscp Jan 27, 2025

matheuscscp left a comment

matheuscscp Jan 29, 2025

matheuscscp Jan 29, 2025

matheuscscp Jan 29, 2025

matheuscscp Jan 29, 2025

matheuscscp Jan 29, 2025 •

edited

Loading

matheuscscp commented Jan 31, 2025 •

edited

Loading

stefanprodan commented Feb 1, 2025

	// referenced in the Resources. If the expression returns false then the
	// referenced in the Resources field. If the expression returns false then the


		To filter the resources that are reconciled you can use [Common Expression Language (CEL)](https://cel.dev/).

		For example to trigger `ImageRepositories` on notifications from [Google Artifact Registry](https://cloud.google.com/artifact-registry/docs/configure-notifications#examples) you can define a receiver.

	For example to trigger `ImageRepositories` on notifications from [Google Artifact Registry](https://cloud.google.com/artifact-registry/docs/configure-notifications#examples) you can define a receiver.
	For example, to trigger `ImageRepositories` on notifications from [Google Artifact Registry](https://cloud.google.com/artifact-registry/docs/configure-notifications#examples) you can define the following receiver:

Implement Receiver resource filtering with CEL #948

Are you sure you want to change the base?

Implement Receiver resource filtering with CEL #948

Conversation

bigkevmcd commented Oct 10, 2024 • edited by stefanprodan Loading

bigkevmcd commented Oct 10, 2024 • edited Loading

matheuscscp left a comment • edited Loading

Choose a reason for hiding this comment

stefanprodan left a comment

Choose a reason for hiding this comment

matheuscscp left a comment

Choose a reason for hiding this comment

stefanprodan commented Nov 1, 2024

bigkevmcd commented Nov 18, 2024

matheuscscp left a comment

Choose a reason for hiding this comment

matheuscscp Jan 27, 2025

Choose a reason for hiding this comment

matheuscscp Jan 27, 2025

Choose a reason for hiding this comment

matheuscscp left a comment

Choose a reason for hiding this comment

matheuscscp Jan 29, 2025

Choose a reason for hiding this comment

matheuscscp Jan 29, 2025

Choose a reason for hiding this comment

matheuscscp Jan 29, 2025

Choose a reason for hiding this comment

matheuscscp Jan 29, 2025

Choose a reason for hiding this comment

matheuscscp Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

matheuscscp commented Jan 31, 2025 • edited Loading

stefanprodan commented Feb 1, 2025

bigkevmcd commented Oct 10, 2024 •

edited by stefanprodan

Loading

bigkevmcd commented Oct 10, 2024 •

edited

Loading

matheuscscp left a comment •

edited

Loading

matheuscscp Jan 29, 2025 •

edited

Loading

matheuscscp commented Jan 31, 2025 •

edited

Loading