rebase: bump the k8s-dependencies group in /e2e with 3 updates

Bumps the k8s-dependencies group in /e2e with 3 updates: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery), [k8s.io/cloud-provider](https://github.com/kubernetes/cloud-provider) and [k8s.io/pod-security-admission](https://github.com/kubernetes/pod-security-admission).


Updates `k8s.io/apimachinery` from 0.32.3 to 0.33.0
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.32.3...v0.33.0)

Updates `k8s.io/cloud-provider` from 0.32.3 to 0.33.0
- [Commits](https://github.com/kubernetes/cloud-provider/compare/v0.32.3...v0.33.0)

Updates `k8s.io/pod-security-admission` from 0.32.3 to 0.33.0
- [Commits](https://github.com/kubernetes/pod-security-admission/compare/v0.32.3...v0.33.0)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: k8s-dependencies
- dependency-name: k8s.io/cloud-provider
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: k8s-dependencies
- dependency-name: k8s.io/pod-security-admission
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: k8s-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

e2e/vendor/github.com/google/cel-go/ext/BUILD.bazel

@@ -8,6 +8,7 @@ go_library(
     name = "go_default_library",
     srcs = [
         "bindings.go",
+        "comprehensions.go",
         "encoders.go",
         "formatting.go",
         "guards.go",
@@ -45,7 +46,9 @@ go_test(
     name = "go_default_test",
     size = "small",
     srcs = [
-        "encoders_test.go",
+        "bindings_test.go",
+        "comprehensions_test.go",
+        "encoders_test.go",        
         "lists_test.go",
         "math_test.go",
         "native_test.go",

e2e/vendor/github.com/google/cel-go/ext/README.md

@@ -11,7 +11,7 @@ in expressions.
 ### Cel.Bind
 
 Binds a simple identifier to an initialization expression which may be used
-in a subsequenct result expression. Bindings may also be nested within each
+in a subsequent result expression. Bindings may also be nested within each
 other.
 
     cel.bind(<varName>, <initExpr>, <resultExpr>)
@@ -29,7 +29,7 @@ Local bindings are not guaranteed to be evaluated before use.
 
 ## Encoders
 
-Encoding utilies for marshalling data into standardized representations.
+Encoding utilities for marshalling data into standardized representations.
 
 ### Base64.Decode
 
@@ -500,6 +500,36 @@ Examples:
 	].sortBy(e, e.score).map(e, e.name)
 	== ["bar", "foo", "baz"]
 
+### Last
+
+**Introduced in the OptionalTypes library version 2**
+
+Returns an optional with the last value from the list or `optional.None` if the
+list is empty.
+
+    <list(T)>.last() -> <Optional(T)>
+
+Examples:
+
+    [1, 2, 3].last().value() == 3
+    [].last().orValue('test') == 'test'
+
+This is syntactic sugar for list[list.size()-1].
+
+### First
+
+**Introduced in the OptionalTypes library version 2**
+
+Returns an optional with the first value from the list or `optional.None` if the
+list is empty.
+
+    <list(T)>.first() -> <Optional(T)>
+
+Examples:
+
+     [1, 2, 3].first().value() == 1
+     [].first().orValue('test') == 'test'
+
 ## Sets
 
 Sets provides set relationship tests.

e2e/vendor/github.com/google/cel-go/ext/comprehensions.go

@@ -16,6 +16,7 @@ package ext
 
 import (
 	"fmt"
+	"math"
 
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/common/ast"
@@ -159,19 +160,36 @@ const (
 //
 //	{'greeting': 'aloha', 'farewell': 'aloha'}
 //	  .transformMapEntry(keyVar, valueVar, {valueVar: keyVar}) // error, duplicate key
-func TwoVarComprehensions() cel.EnvOption {
-	return cel.Lib(compreV2Lib{})
+func TwoVarComprehensions(options ...TwoVarComprehensionsOption) cel.EnvOption {
+	l := &compreV2Lib{version: math.MaxUint32}
+	for _, o := range options {
+		l = o(l)
+	}
+	return cel.Lib(l)
 }
 
-type compreV2Lib struct{}
+// TwoVarComprehensionsOption declares a functional operator for configuring two-variable comprehensions.
+type TwoVarComprehensionsOption func(*compreV2Lib) *compreV2Lib
+
+// TwoVarComprehensionsVersion sets the library version for two-variable comprehensions.
+func TwoVarComprehensionsVersion(version uint32) TwoVarComprehensionsOption {
+	return func(lib *compreV2Lib) *compreV2Lib {
+		lib.version = version
+		return lib
+	}
+}
+
+type compreV2Lib struct {
+	version uint32
+}
 
 // LibraryName implements that SingletonLibrary interface method.
-func (compreV2Lib) LibraryName() string {
+func (*compreV2Lib) LibraryName() string {
 	return "cel.lib.ext.comprev2"
 }
 
 // CompileOptions implements the cel.Library interface method.
-func (compreV2Lib) CompileOptions() []cel.EnvOption {
+func (*compreV2Lib) CompileOptions() []cel.EnvOption {
 	kType := cel.TypeParamType("K")
 	vType := cel.TypeParamType("V")
 	mapKVType := cel.MapType(kType, vType)
@@ -217,7 +235,7 @@ func (compreV2Lib) CompileOptions() []cel.EnvOption {
 }
 
 // ProgramOptions implements the cel.Library interface method
-func (compreV2Lib) ProgramOptions() []cel.ProgramOption {
+func (*compreV2Lib) ProgramOptions() []cel.ProgramOption {
 	return []cel.ProgramOption{}
 }
 
@@ -231,7 +249,7 @@ func quantifierAll(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (
 		target,
 		iterVar1,
 		iterVar2,
-		parser.AccumulatorName,
+		mef.AccuIdentName(),
 		/*accuInit=*/ mef.NewLiteral(types.True),
 		/*condition=*/ mef.NewCall(operators.NotStrictlyFalse, mef.NewAccuIdent()),
 		/*step=*/ mef.NewCall(operators.LogicalAnd, mef.NewAccuIdent(), args[2]),
@@ -249,7 +267,7 @@ func quantifierExists(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr
 		target,
 		iterVar1,
 		iterVar2,
-		parser.AccumulatorName,
+		mef.AccuIdentName(),
 		/*accuInit=*/ mef.NewLiteral(types.False),
 		/*condition=*/ mef.NewCall(operators.NotStrictlyFalse, mef.NewCall(operators.LogicalNot, mef.NewAccuIdent())),
 		/*step=*/ mef.NewCall(operators.LogicalOr, mef.NewAccuIdent(), args[2]),
@@ -267,7 +285,7 @@ func quantifierExistsOne(mef cel.MacroExprFactory, target ast.Expr, args []ast.E
 		target,
 		iterVar1,
 		iterVar2,
-		parser.AccumulatorName,
+		mef.AccuIdentName(),
 		/*accuInit=*/ mef.NewLiteral(types.Int(0)),
 		/*condition=*/ mef.NewLiteral(types.True),
 		/*step=*/ mef.NewCall(operators.Conditional, args[2],
@@ -293,10 +311,10 @@ func transformList(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (
 		transform = args[2]
 	}
 
-	//  __result__ = __result__ + [transform]
+	//  accumulator = accumulator + [transform]
 	step := mef.NewCall(operators.Add, mef.NewAccuIdent(), mef.NewList(transform))
 	if filter != nil {
-		//  __result__ = (filter) ? __result__ + [transform] : __result__
+		//  accumulator = (filter) ? accumulator + [transform] : accumulator
 		step = mef.NewCall(operators.Conditional, filter, step, mef.NewAccuIdent())
 	}
 
@@ -304,7 +322,7 @@ func transformList(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (
 		target,
 		iterVar1,
 		iterVar2,
-		parser.AccumulatorName,
+		mef.AccuIdentName(),
 		/*accuInit=*/ mef.NewList(),
 		/*condition=*/ mef.NewLiteral(types.True),
 		step,
@@ -328,17 +346,17 @@ func transformMap(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (a
 		transform = args[2]
 	}
 
-	// __result__ = cel.@mapInsert(__result__, iterVar1, transform)
+	// accumulator = cel.@mapInsert(accumulator, iterVar1, transform)
 	step := mef.NewCall(mapInsert, mef.NewAccuIdent(), mef.NewIdent(iterVar1), transform)
 	if filter != nil {
-		// __result__ = (filter) ? cel.@mapInsert(__result__, iterVar1, transform) : __result__
+		// accumulator = (filter) ? cel.@mapInsert(accumulator, iterVar1, transform) : accumulator
 		step = mef.NewCall(operators.Conditional, filter, step, mef.NewAccuIdent())
 	}
 	return mef.NewComprehensionTwoVar(
 		target,
 		iterVar1,
 		iterVar2,
-		parser.AccumulatorName,
+		mef.AccuIdentName(),
 		/*accuInit=*/ mef.NewMap(),
 		/*condition=*/ mef.NewLiteral(types.True),
 		step,
@@ -362,17 +380,17 @@ func transformMapEntry(mef cel.MacroExprFactory, target ast.Expr, args []ast.Exp
 		transform = args[2]
 	}
 
-	// __result__ = cel.@mapInsert(__result__, transform)
+	// accumulator = cel.@mapInsert(accumulator, transform)
 	step := mef.NewCall(mapInsert, mef.NewAccuIdent(), transform)
 	if filter != nil {
-		// __result__ = (filter) ? cel.@mapInsert(__result__, transform) : __result__
+		// accumulator = (filter) ? cel.@mapInsert(accumulator, transform) : accumulator
 		step = mef.NewCall(operators.Conditional, filter, step, mef.NewAccuIdent())
 	}
 	return mef.NewComprehensionTwoVar(
 		target,
 		iterVar1,
 		iterVar2,
-		parser.AccumulatorName,
+		mef.AccuIdentName(),
 		/*accuInit=*/ mef.NewMap(),
 		/*condition=*/ mef.NewLiteral(types.True),
 		step,
@@ -392,10 +410,10 @@ func extractIterVars(mef cel.MacroExprFactory, arg0, arg1 ast.Expr) (string, str
 	if iterVar1 == iterVar2 {
 		return "", "", mef.NewError(arg1.ID(), fmt.Sprintf("duplicate variable name: %s", iterVar1))
 	}
-	if iterVar1 == parser.AccumulatorName {
+	if iterVar1 == mef.AccuIdentName() || iterVar1 == parser.AccumulatorName {
 		return "", "", mef.NewError(arg0.ID(), "iteration variable overwrites accumulator variable")
 	}
-	if iterVar2 == parser.AccumulatorName {
+	if iterVar2 == mef.AccuIdentName() || iterVar2 == parser.AccumulatorName {
 		return "", "", mef.NewError(arg1.ID(), "iteration variable overwrites accumulator variable")
 	}
 	return iterVar1, iterVar2, nil

e2e/vendor/github.com/google/cel-go/ext/encoders.go

@@ -16,6 +16,7 @@ package ext
 
 import (
 	"encoding/base64"
+	"math"
 
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/common/types"
@@ -47,17 +48,34 @@ import (
 // Examples:
 //
 //	base64.encode(b'hello') // return b'aGVsbG8='
-func Encoders() cel.EnvOption {
-	return cel.Lib(encoderLib{})
+func Encoders(options ...EncodersOption) cel.EnvOption {
+	l := &encoderLib{version: math.MaxUint32}
+	for _, o := range options {
+		l = o(l)
+	}
+	return cel.Lib(l)
 }
 
-type encoderLib struct{}
+// EncodersOption declares a functional operator for configuring encoder extensions.
+type EncodersOption func(*encoderLib) *encoderLib
 
-func (encoderLib) LibraryName() string {
+// EncodersVersion sets the library version for encoder extensions.
+func EncodersVersion(version uint32) EncodersOption {
+	return func(lib *encoderLib) *encoderLib {
+		lib.version = version
+		return lib
+	}
+}
+
+type encoderLib struct {
+	version uint32
+}
+
+func (*encoderLib) LibraryName() string {
 	return "cel.lib.ext.encoders"
 }
 
-func (encoderLib) CompileOptions() []cel.EnvOption {
+func (*encoderLib) CompileOptions() []cel.EnvOption {
 	return []cel.EnvOption{
 		cel.Function("base64.decode",
 			cel.Overload("base64_decode_string", []*cel.Type{cel.StringType}, cel.BytesType,
@@ -74,7 +92,7 @@ func (encoderLib) CompileOptions() []cel.EnvOption {
 	}
 }
 
-func (encoderLib) ProgramOptions() []cel.ProgramOption {
+func (*encoderLib) ProgramOptions() []cel.ProgramOption {
 	return []cel.ProgramOption{}
 }
 

e2e/vendor/github.com/google/cel-go/ext/formatting.go

@@ -434,7 +434,7 @@ func (stringFormatValidator) Validate(env *cel.Env, _ cel.ValidatorConfig, a *as
 		// use a placeholder locale, since locale doesn't affect syntax
 		_, err := parseFormatString(formatStr, formatCheck, formatCheck, "en_US")
 		if err != nil {
-			iss.ReportErrorAtID(getErrorExprID(e.ID(), err), err.Error())
+			iss.ReportErrorAtID(getErrorExprID(e.ID(), err), "%v", err)
 			continue
 		}
 		seenArgs := formatCheck.argsRequested

e2e/vendor/github.com/google/cel-go/ext/guards.go

@@ -24,28 +24,28 @@ import (
 
 func intOrError(i int64, err error) ref.Val {
 	if err != nil {
-		return types.NewErr(err.Error())
+		return types.NewErrFromString(err.Error())
 	}
 	return types.Int(i)
 }
 
 func bytesOrError(bytes []byte, err error) ref.Val {
 	if err != nil {
-		return types.NewErr(err.Error())
+		return types.NewErrFromString(err.Error())
 	}
 	return types.Bytes(bytes)
 }
 
 func stringOrError(str string, err error) ref.Val {
 	if err != nil {
-		return types.NewErr(err.Error())
+		return types.NewErrFromString(err.Error())
 	}
 	return types.String(str)
 }
 
 func listStringOrError(strs []string, err error) ref.Val {
 	if err != nil {
-		return types.NewErr(err.Error())
+		return types.NewErrFromString(err.Error())
 	}
 	return types.DefaultTypeAdapter.NativeToValue(strs)
 }

e2e/vendor/github.com/google/cel-go/ext/lists.go

@@ -145,13 +145,10 @@ var comparableTypes = []*cel.Type{
 //	== ["bar", "foo", "baz"]
 
 func Lists(options ...ListsOption) cel.EnvOption {
-	l := &listsLib{
-		version: math.MaxUint32,
-	}
+	l := &listsLib{version: math.MaxUint32}
 	for _, o := range options {
 		l = o(l)
 	}
-
 	return cel.Lib(l)
 }
 
@@ -211,9 +208,10 @@ func (lib listsLib) CompileOptions() []cel.EnvOption {
 				cel.MemberOverload("list_flatten",
 					[]*cel.Type{listListType}, listType,
 					cel.UnaryBinding(func(arg ref.Val) ref.Val {
+						// double-check as type-guards disabled
 						list, ok := arg.(traits.Lister)
 						if !ok {
-							return types.MaybeNoSuchOverloadErr(arg)
+							return types.ValOrErr(arg, "no such overload: %v.flatten()", arg.Type())
 						}
 						flatList, err := flatten(list, 1)
 						if err != nil {
@@ -226,13 +224,14 @@ func (lib listsLib) CompileOptions() []cel.EnvOption {
 				cel.MemberOverload("list_flatten_int",
 					[]*cel.Type{listDyn, types.IntType}, listDyn,
 					cel.BinaryBinding(func(arg1, arg2 ref.Val) ref.Val {
+						// double-check as type-guards disabled
 						list, ok := arg1.(traits.Lister)
 						if !ok {
-							return types.MaybeNoSuchOverloadErr(arg1)
+							return types.ValOrErr(arg1, "no such overload: %v.flatten(%v)", arg1.Type(), arg2.Type())
 						}
 						depth, ok := arg2.(types.Int)
 						if !ok {
-							return types.MaybeNoSuchOverloadErr(arg2)
+							return types.ValOrErr(arg1, "no such overload: %v.flatten(%v)", arg1.Type(), arg2.Type())
 						}
 						flatList, err := flatten(list, int64(depth))
 						if err != nil {
@@ -260,10 +259,8 @@ func (lib listsLib) CompileOptions() []cel.EnvOption {
 				}),
 				cel.SingletonUnaryBinding(
 					func(arg ref.Val) ref.Val {
-						list, ok := arg.(traits.Lister)
-						if !ok {
-							return types.MaybeNoSuchOverloadErr(arg)
-						}
+						// validated by type-guards
+						list := arg.(traits.Lister)
 						sorted, err := sortList(list)
 						if err != nil {
 							return types.WrapErr(err)
@@ -287,15 +284,10 @@ func (lib listsLib) CompileOptions() []cel.EnvOption {
 					)
 				}),
 				cel.SingletonBinaryBinding(
-					func(arg1 ref.Val, arg2 ref.Val) ref.Val {
-						list, ok := arg1.(traits.Lister)
-						if !ok {
-							return types.MaybeNoSuchOverloadErr(arg1)
-						}
-						keys, ok := arg2.(traits.Lister)
-						if !ok {
-							return types.MaybeNoSuchOverloadErr(arg2)
-						}
+					func(arg1, arg2 ref.Val) ref.Val {
+						// validated by type-guards
+						list := arg1.(traits.Lister)
+						keys := arg2.(traits.Lister)
 						sorted, err := sortListByAssociatedKeys(list, keys)
 						if err != nil {
 							return types.WrapErr(err)
@@ -498,8 +490,9 @@ func sortByMacro(meh cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (as
 	if targetKind != ast.ListKind &&
 		targetKind != ast.SelectKind &&
 		targetKind != ast.IdentKind &&
-		targetKind != ast.ComprehensionKind && targetKind != ast.CallKind {
-		return nil, meh.NewError(target.ID(), fmt.Sprintf("sortBy can only be applied to a list, identifier, comprehension, call or select expression"))
+		targetKind != ast.ComprehensionKind &&
+		targetKind != ast.CallKind {
+		return nil, meh.NewError(target.ID(), "sortBy can only be applied to a list, identifier, comprehension, call or select expression")
 	}
 
 	mapCompr, err := parser.MakeMap(meh, meh.Copy(varIdent), args)

e2e/vendor/github.com/google/cel-go/ext/native.go

@@ -17,6 +17,7 @@ package ext
 import (
 	"errors"
 	"fmt"
+	"math"
 	"reflect"
 	"strings"
 	"time"
@@ -98,7 +99,9 @@ var (
 func NativeTypes(args ...any) cel.EnvOption {
 	return func(env *cel.Env) (*cel.Env, error) {
 		nativeTypes := make([]any, 0, len(args))
-		tpOptions := nativeTypeOptions{}
+		tpOptions := nativeTypeOptions{
+			version: math.MaxUint32,
+		}
 
 		for _, v := range args {
 			switch v := v.(type) {
@@ -128,6 +131,14 @@ func NativeTypes(args ...any) cel.EnvOption {
 // NativeTypesOption is a functional interface for configuring handling of native types.
 type NativeTypesOption func(*nativeTypeOptions) error
 
+// NativeTypesVersion sets the native types version support for native extensions functions.
+func NativeTypesVersion(version uint32) NativeTypesOption {
+	return func(opts *nativeTypeOptions) error {
+		opts.version = version
+		return nil
+	}
+}
+
 // NativeTypesFieldNameHandler is a handler for mapping a reflect.StructField to a CEL field name.
 // This can be used to override the default Go struct field to CEL field name mapping.
 type NativeTypesFieldNameHandler = func(field reflect.StructField) string
@@ -158,6 +169,9 @@ type nativeTypeOptions struct {
 	// This is most commonly used for switching to parsing based off the struct field tag,
 	// such as "cel" or "json".
 	fieldNameHandler NativeTypesFieldNameHandler
+
+	// version is the native types library version.
+	version uint32
 }
 
 // ParseStructTags configures if native types field names should be overridable by CEL struct tags.
@@ -329,7 +343,7 @@ func (tp *nativeTypeProvider) NewValue(typeName string, fields map[string]ref.Va
 		}
 		fieldVal, err := val.ConvertToNative(refFieldDef.Type)
 		if err != nil {
-			return types.NewErr(err.Error())
+			return types.NewErrFromString(err.Error())
 		}
 		refField := refVal.FieldByIndex(refFieldDef.Index)
 		refFieldVal := reflect.ValueOf(fieldVal)
@@ -436,7 +450,7 @@ func convertToCelType(refType reflect.Type) (*cel.Type, bool) {
 func (tp *nativeTypeProvider) newNativeObject(val any, refValue reflect.Value) ref.Val {
 	valType, err := newNativeType(tp.options.fieldNameHandler, refValue.Type())
 	if err != nil {
-		return types.NewErr(err.Error())
+		return types.NewErrFromString(err.Error())
 	}
 	return &nativeObj{
 		Adapter:  tp,

e2e/vendor/github.com/google/cel-go/ext/protos.go

@@ -15,6 +15,8 @@
 package ext
 
 import (
+	"math"
+
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/common/ast"
 )
@@ -49,8 +51,23 @@ import (
 // Examples:
 //
 //	proto.hasExt(msg, google.expr.proto2.test.int32_ext) // returns true || false
-func Protos() cel.EnvOption {
-	return cel.Lib(protoLib{})
+func Protos(options ...ProtosOption) cel.EnvOption {
+	l := &protoLib{version: math.MaxUint32}
+	for _, o := range options {
+		l = o(l)
+	}
+	return cel.Lib(l)
+}
+
+// ProtosOption declares a functional operator for configuring protobuf utilities.
+type ProtosOption func(*protoLib) *protoLib
+
+// ProtosVersion sets the library version for extensions for protobuf utilities.
+func ProtosVersion(version uint32) ProtosOption {
+	return func(lib *protoLib) *protoLib {
+		lib.version = version
+		return lib
+	}
 }
 
 var (
@@ -59,7 +76,9 @@ var (
 	getExtension   = "getExt"
 )
 
-type protoLib struct{}
+type protoLib struct {
+	version uint32
+}
 
 // LibraryName implements the SingletonLibrary interface method.
 func (protoLib) LibraryName() string {

e2e/vendor/github.com/google/cel-go/ext/sets.go

@@ -77,11 +77,28 @@ import (
 //	sets.intersects([1], []) // false
 //	sets.intersects([1], [1, 2]) // true
 //	sets.intersects([[1], [2, 3]], [[1, 2], [2, 3.0]]) // true
-func Sets() cel.EnvOption {
-	return cel.Lib(setsLib{})
+func Sets(options ...SetsOption) cel.EnvOption {
+	l := &setsLib{}
+	for _, o := range options {
+		l = o(l)
+	}
+	return cel.Lib(l)
 }
 
-type setsLib struct{}
+// SetsOption declares a functional operator for configuring set extensions.
+type SetsOption func(*setsLib) *setsLib
+
+// SetsVersion sets the library version for set extensions.
+func SetsVersion(version uint32) SetsOption {
+	return func(lib *setsLib) *setsLib {
+		lib.version = version
+		return lib
+	}
+}
+
+type setsLib struct {
+	version uint32
+}
 
 // LibraryName implements the SingletonLibrary interface method.
 func (setsLib) LibraryName() string {