adding strictCost const

Signed-off-by: Jaydip Gabani <[email protected]>
open-policy-agent · Aug 2, 2024 · e736423 · e736423
1 parent e35a7e5
commit e736423
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 7 deletions.
diff --git a/constraint/pkg/client/drivers/k8scel/driver.go b/constraint/pkg/client/drivers/k8scel/driver.go
@@ -85,7 +85,7 @@ func (d *Driver) AddTemplate(_ context.Context, ct *templates.ConstraintTemplate
 	}
 	vapVars = append(vapVars, vapVarsSuffix...)
 	// Defaulting to true in MustBaseEnvSet to enforce strict cost calculation for CEL, following k8s.
-	filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), true))
+	filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), transform.StrictCost))
 	if err != nil {
 		return err
 	}

diff --git a/constraint/pkg/client/drivers/k8scel/transform/cel_snippets.go b/constraint/pkg/client/drivers/k8scel/transform/cel_snippets.go
@@ -84,6 +84,8 @@ const (
 	`
 )
 
+const StrictCost = true
+
 func MatchExcludedNamespacesGlobV1Beta1() admissionregistrationv1beta1.MatchCondition {
 	return admissionregistrationv1beta1.MatchCondition{
 		Name:       "gatekeeper_internal_match_excluded_namespaces",

diff --git a/constraint/pkg/client/drivers/k8scel/transform/cel_snippets_test.go b/constraint/pkg/client/drivers/k8scel/transform/cel_snippets_test.go
@@ -253,7 +253,7 @@ func TestMatchKinds(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), true))
+			filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), StrictCost))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -458,7 +458,7 @@ func TestMatchNameGlob(t *testing.T) {
 
 		for _, subTest := range expandedTests {
 			t.Run(subTest.name, func(t *testing.T) {
-				filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), true))
+				filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), StrictCost))
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -628,7 +628,7 @@ func TestMatchNamespacesGlob(t *testing.T) {
 
 		for _, subTest := range expandedTests {
 			t.Run(subTest.name, func(t *testing.T) {
-				filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), true))
+				filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), StrictCost))
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -802,7 +802,7 @@ func TestMatchExcludedNamespacesGlob(t *testing.T) {
 
 		for _, subTest := range expandedTests {
 			t.Run(subTest.name, func(t *testing.T) {
-				filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), true))
+				filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), StrictCost))
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -866,7 +866,7 @@ func TestParamsBinding(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), true))
+			filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), StrictCost))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -947,7 +947,7 @@ func TestObjectBinding(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), true))
+			filterCompiler, err := cel.NewCompositedCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), StrictCost))
 			if err != nil {
 				t.Fatal(err)
 			}