Upstreaming network.IP/CIDR to CEL-go from kubernetes by tdesrosi · Pull Request #1238 · google/cel-go

tdesrosi · 2025-11-20T16:34:35Z

Upstream CIDR and IP-related functions from kubernetes into cel-go

This is part of a broader effort to bring network functions from the kubernetes
project into CEL specifications upstream. This is related directly to
issues/1237.

These are currently locked inside k8s.io/apiserver, but they are generally
useful for any policy engine dealing with network logic (firewalls, access lists, etc.).

tdesrosi · 2025-11-20T16:35:06Z

/gcbrun

TristonianJones · 2025-11-20T16:43:21Z

/gcbrun

TristonianJones · 2025-11-20T16:43:55Z

FYI @cici37 @jpbetz

ext/network.go

…server implementation

TristonianJones · 2025-11-24T16:47:20Z

/gcbrun

ext/network.go

…P and CIDR

TristonianJones · 2025-12-01T16:58:05Z

/gcbrun

ext/network.go

…ant with k8s implementation

tdesrosi · 2025-12-08T23:12:28Z

A note about these changes: To maintain strict AST-level compatibility with k8s, I'm going with a split registration pattern (declaring signatures in CompileOptions and bindings in ProgramOptions), rather than bundling them in CompileOptions via cel.Function.

When using the modern cel-go helper cel.Function() to register both the global overload (ip(string)) and the member overload (cidr.ip()) simultaneously, the internal dispatcher validation incorrectly flags the self-referencing overload ID "ip" as a collision (overload already exists).

To resolve this collision with the modern helper, we would be forced to rename the overload ID to something distinct like "ip_string". While functionally equivalent, this breaks strict parity with the Kubernetes AST reference data. If requested, we can go this route (and maintain parity minus the "ip" --> "ip_string" difference in overload IDs).

TristonianJones · 2025-12-10T01:52:32Z

/gcbrun

TristonianJones · 2025-12-10T03:37:48Z

A note about these changes: To maintain strict AST-level compatibility with k8s, I'm going with a split registration pattern (declaring signatures in CompileOptions and bindings in ProgramOptions), rather than bundling them in CompileOptions via cel.Function.

Actually, there really isn't any difference here between how the bindings are configured. K8s stages it a little differently, but it's materially identical between the two approaches.

When using the modern cel-go helper cel.Function() to register both the global overload (ip(string)) and the member overload (cidr.ip()) simultaneously, the internal dispatcher validation incorrectly flags the self-referencing overload ID "ip" as a collision (overload already exists).

It looks like the function ip overloads aren't properly configured as the overload_id values don't match those in K8s. Take another look as the two overloads in K8s are cidr_ip and string_to_ip.

It's worth looking at the other overloads as well.

tdesrosi · 2025-12-10T20:13:31Z

Thanks Tristan, here's one more pass rechecking overloads and member overloads.

ext/network.go

TristonianJones

I've raised google/cel-spec#507 to cel-spec, so shortly after both artifacts are checked in and a new cel-spec release cut, let's enable the conformance tests

TristonianJones · 2026-01-13T20:54:44Z

ext/network.go

+//	cidr('192.168.1.5/24').ip() == ip('192.168.1.5')
+//	cidr('192.168.1.5/24').masked() == cidr('192.168.1.0/24')
+//	cidr('192.168.1.0/24').prefixLength() == 24
+func Network(version uint32) cel.EnvOption {


Instead of passing version directly, prefer a functional NetworkOption that indicates the NetworkVersion(int), similar to how the BindingsOption is configured:

cel-go/ext/bindings.go

Lines 69 to 78 in e9f15ea

// BindingsOption declares a functional operator for configuring the Bindings library behavior.

type BindingsOption func(*celBindings) *celBindings

// BindingsVersion sets the version of the bindings library to an explicit version.

func BindingsVersion(version uint32) BindingsOption {

return func(lib *celBindings) *celBindings {

lib.version = version

return lib

}

}

cel-go/ext/bindings.go

Lines 54 to 56 in e9f15ea

func Bindings(options ...BindingsOption) cel.EnvOption {

b := &celBindings{version: math.MaxUint32}

for _, o := range options {

TristonianJones · 2026-01-13T20:56:11Z

ext/network.go

+type networkLib struct {
+	version uint32
+}
+


Please add comments to all exported (UpperCase) functions

TristonianJones · 2026-01-13T20:57:48Z

ext/network.go

+		),
+
+		// 2. Register Functions
+		cel.Function(isIPFunc,


minor nit, but could you order these functions by name alphabetically? The K8s files do this and it makes the review diff a bit easier to reason about. Perhaps group by CIDR first, then IP?

TristonianJones · 2026-01-13T23:28:42Z

ext/network.go

+	netip.Prefix
+}
+
+func (c CIDR) ConvertToNative(typeDesc reflect.Type) (any, error) {


Please add unit tests for conversion functions.

TristonianJones · 2026-01-13T23:29:17Z

ext/network.go

+func (c CIDR) Equal(other ref.Val) ref.Val {
+	o, ok := other.(CIDR)
+	if !ok {
+		return types.ValOrErr(other, "no such overload")


CEL types no longer error when the type is not the same. The current semantic is to treat the runtime equality check as 'false'

TristonianJones · 2026-01-13T23:30:13Z

ext/network.go

+func (i IP) Equal(other ref.Val) ref.Val {
+	o, ok := other.(IP)
+	if !ok {
+		return types.ValOrErr(other, "no such overload")


CEL types should return false if the types aren't the same. This is a shift in behavior from how CEL originally started.

TristonianJones · 2026-01-13T23:34:21Z

ext/network.go

+		cel.Function(prefixLengthFunc,
+			cel.MemberOverload("cidr_prefix_length", []*cel.Type{CIDRType}, cel.IntType,
+				cel.UnaryBinding(netCIDRPrefixLength)),
+		),


Optional, but consider introducing static validators for ip and cidr conversions from string literals as this will save people a lot of trouble with runtime errors which could have been caught at compile time.

cel-go/cel/validator.go

Lines 261 to 279 in e9f15ea

// Validate searches the AST for uses of a given function name with a constant argument and performs a check

// on whether the argument is a valid literal value.

func (v formatValidator) Validate(e *Env, _ ValidatorConfig, a *ast.AST, iss *Issues) {

root := ast.NavigateAST(a)

funcCalls := ast.MatchDescendants(root, ast.FunctionMatcher(v.funcName))

for _, call := range funcCalls {

callArgs := call.AsCall().Args()

if len(callArgs) <= v.argNum {

continue

}

litArg := callArgs[v.argNum]

if litArg.Kind() != ast.LiteralKind {

continue

}

if err := v.check(e, call, litArg); err != nil {

iss.ReportErrorAtID(litArg.ID(), "invalid %s argument", v.funcName)

}

}

}

jpbetz · 2026-01-13T23:40:08Z

ext/network.go

+}
+
+const (
+	// Function names matching Kubernetes implementation


Suggested change

// Function names matching Kubernetes implementation

// Function names matching the original Kubernetes implementation of this networking library

?

jpbetz · 2026-01-13T23:42:19Z

@lalitc375

jpbetz · 2026-01-13T23:44:31Z

ext/network.go

@@ -0,0 +1,526 @@
+// Copyright 2025 Google LLC


The cost calculations for this library exist in https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/cel/library/cost.go in the Kuberhetes code. Is it possible to also upstream the cost calculations?

Yep, I'll tackle this after the initial implementation is in

tdesrosi added 2 commits November 19, 2025 18:37

upstreaming CIDR and IP support to cel-go

f994121

adding type adapter and exporting types IP and CIDR

008905d

TristonianJones reviewed Nov 20, 2025

View reviewed changes

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Show resolved Hide resolved

ext/network.go Show resolved Hide resolved

upgrade network to use net/netip to more appropriately mirror k8s/api…

7976e9f

…server implementation

TristonianJones reviewed Nov 24, 2025

View reviewed changes

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Show resolved Hide resolved

ext/network.go Show resolved Hide resolved

ext/network.go Show resolved Hide resolved

preserve chain of type adapters with wrapping, use opaque types for I…

8544fd5

…P and CIDR

TristonianJones reviewed Dec 3, 2025

View reviewed changes

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

tdesrosi added 2 commits December 8, 2025 16:18

Update overloads, types, error messages, functions consistent with k8s.

5727a86

updating to split declaration and implementation to remain AST-compli…

26439f0

…ant with k8s implementation

check overloads and memberoverloads for parity with k8s

2c9fae4

TristonianJones reviewed Dec 15, 2025

View reviewed changes

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Outdated Show resolved Hide resolved

ext/network.go Show resolved Hide resolved

add mandatory version, add cidr/ip_to_string missing from k8s

f8791a1

TristonianJones reviewed Jan 13, 2026

View reviewed changes

jpbetz reviewed Jan 13, 2026

View reviewed changes

l46kok mentioned this pull request Jan 30, 2026

Networking extension conformance tests google/cel-spec#507

Merged

	// BindingsOption declares a functional operator for configuring the Bindings library behavior.
	type BindingsOption func(celBindings) celBindings

	// BindingsVersion sets the version of the bindings library to an explicit version.
	func BindingsVersion(version uint32) BindingsOption {
	return func(lib celBindings) celBindings {
	lib.version = version
	return lib
	}
	}

	func Bindings(options ...BindingsOption) cel.EnvOption {
	b := &celBindings{version: math.MaxUint32}
	for _, o := range options {

	// Validate searches the AST for uses of a given function name with a constant argument and performs a check
	// on whether the argument is a valid literal value.
	func (v formatValidator) Validate(e Env, _ ValidatorConfig, a ast.AST, iss *Issues) {
	root := ast.NavigateAST(a)
	funcCalls := ast.MatchDescendants(root, ast.FunctionMatcher(v.funcName))
	for _, call := range funcCalls {
	callArgs := call.AsCall().Args()
	if len(callArgs) <= v.argNum {
	continue
	}
	litArg := callArgs[v.argNum]
	if litArg.Kind() != ast.LiteralKind {
	continue
	}
	if err := v.check(e, call, litArg); err != nil {
	iss.ReportErrorAtID(litArg.ID(), "invalid %s argument", v.funcName)
	}
	}
	}

	// Function names matching Kubernetes implementation
	// Function names matching the original Kubernetes implementation of this networking library

Conversation

tdesrosi commented Nov 20, 2025

Upstream CIDR and IP-related functions from kubernetes into cel-go

Uh oh!

tdesrosi commented Nov 20, 2025

Uh oh!

TristonianJones commented Nov 20, 2025

Uh oh!

TristonianJones commented Nov 20, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TristonianJones commented Nov 24, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TristonianJones commented Dec 1, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tdesrosi commented Dec 8, 2025

Uh oh!

TristonianJones commented Dec 10, 2025

Uh oh!

TristonianJones commented Dec 10, 2025

Uh oh!

tdesrosi commented Dec 10, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TristonianJones left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jpbetz commented Jan 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments