rebase: update kubernetes to 1.28.0 in main

updating kubernetes to 1.28.0
in the main repo.

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>

vendor/github.com/google/cel-go/checker/BUILD.bazel

@@ -30,7 +30,7 @@ go_library(
         "//common/types/pb:go_default_library",
         "//common/types/ref:go_default_library",
         "//parser:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//types/known/emptypb:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb:go_default_library",
@@ -54,7 +54,7 @@ go_test(
         "//test:go_default_library",
         "//test/proto2pb:go_default_library",
         "//test/proto3pb:go_default_library",
-        "@com_github_antlr_antlr4_runtime_go_antlr//:go_default_library",
+        "@com_github_antlr_antlr4_runtime_go_antlr_v4//:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
     ],
 )

vendor/github.com/google/cel-go/checker/checker.go

@@ -23,6 +23,7 @@ import (
 	"github.com/google/cel-go/checker/decls"
 	"github.com/google/cel-go/common"
 	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/operators"
 	"github.com/google/cel-go/common/types/ref"
 
 	"google.golang.org/protobuf/proto"
@@ -173,8 +174,8 @@ func (c *checker) checkSelect(e *exprpb.Expr) {
 
 			// Rewrite the node to be a variable reference to the resolved fully-qualified
 			// variable name.
-			c.setType(e, ident.GetIdent().Type)
-			c.setReference(e, newIdentReference(ident.GetName(), ident.GetIdent().Value))
+			c.setType(e, ident.GetIdent().GetType())
+			c.setReference(e, newIdentReference(ident.GetName(), ident.GetIdent().GetValue()))
 			identName := ident.GetName()
 			e.ExprKind = &exprpb.Expr_IdentExpr{
 				IdentExpr: &exprpb.Expr_Ident{
@@ -185,9 +186,37 @@ func (c *checker) checkSelect(e *exprpb.Expr) {
 		}
 	}
 
+	resultType := c.checkSelectField(e, sel.GetOperand(), sel.GetField(), false)
+	if sel.TestOnly {
+		resultType = decls.Bool
+	}
+	c.setType(e, substitute(c.mappings, resultType, false))
+}
+
+func (c *checker) checkOptSelect(e *exprpb.Expr) {
+	// Collect metadata related to the opt select call packaged by the parser.
+	call := e.GetCallExpr()
+	operand := call.GetArgs()[0]
+	field := call.GetArgs()[1]
+	fieldName, isString := maybeUnwrapString(field)
+	if !isString {
+		c.errors.ReportError(c.location(field), "unsupported optional field selection: %v", field)
+		return
+	}
+
+	// Perform type-checking using the field selection logic.
+	resultType := c.checkSelectField(e, operand, fieldName, true)
+	c.setType(e, substitute(c.mappings, resultType, false))
+}
+
+func (c *checker) checkSelectField(e, operand *exprpb.Expr, field string, optional bool) *exprpb.Type {
 	// Interpret as field selection, first traversing down the operand.
-	c.check(sel.GetOperand())
-	targetType := substitute(c.mappings, c.getType(sel.GetOperand()), false)
+	c.check(operand)
+	operandType := substitute(c.mappings, c.getType(operand), false)
+
+	// If the target type is 'optional', unwrap it for the sake of this check.
+	targetType, isOpt := maybeUnwrapOptional(operandType)
+
 	// Assume error type by default as most types do not support field selection.
 	resultType := decls.Error
 	switch kindOf(targetType) {
@@ -199,7 +228,7 @@ func (c *checker) checkSelect(e *exprpb.Expr) {
 		// Objects yield their field type declaration as the selection result type, but only if
 		// the field is defined.
 		messageType := targetType
-		if fieldType, found := c.lookupFieldType(c.location(e), messageType.GetMessageType(), sel.GetField()); found {
+		if fieldType, found := c.lookupFieldType(c.location(e), messageType.GetMessageType(), field); found {
 			resultType = fieldType.Type
 		}
 	case kindTypeParam:
@@ -212,16 +241,17 @@ func (c *checker) checkSelect(e *exprpb.Expr) {
 	default:
 		// Dynamic / error values are treated as DYN type. Errors are handled this way as well
 		// in order to allow forward progress on the check.
-		if isDynOrError(targetType) {
-			resultType = decls.Dyn
-		} else {
+		if !isDynOrError(targetType) {
 			c.errors.typeDoesNotSupportFieldSelection(c.location(e), targetType)
 		}
+		resultType = decls.Dyn
 	}
-	if sel.TestOnly {
-		resultType = decls.Bool
+
+	// If the target type was optional coming in, then the result must be optional going out.
+	if isOpt || optional {
+		return decls.NewOptionalType(resultType)
 	}
-	c.setType(e, substitute(c.mappings, resultType, false))
+	return resultType
 }
 
 func (c *checker) checkCall(e *exprpb.Expr) {
@@ -229,15 +259,19 @@ func (c *checker) checkCall(e *exprpb.Expr) {
 	// please consider the impact on planner.go and consolidate implementations or mirror code
 	// as appropriate.
 	call := e.GetCallExpr()
-	target := call.GetTarget()
-	args := call.GetArgs()
 	fnName := call.GetFunction()
+	if fnName == operators.OptSelect {
+		c.checkOptSelect(e)
+		return
+	}
 
+	args := call.GetArgs()
 	// Traverse arguments.
 	for _, arg := range args {
 		c.check(arg)
 	}
 
+	target := call.GetTarget()
 	// Regular static call with simple name.
 	if target == nil {
 		// Check for the existence of the function.
@@ -359,6 +393,9 @@ func (c *checker) resolveOverload(
 	}
 
 	if resultType == nil {
+		for i, arg := range argTypes {
+			argTypes[i] = substitute(c.mappings, arg, true)
+		}
 		c.errors.noMatchingOverload(loc, fn.GetName(), argTypes, target != nil)
 		resultType = decls.Error
 		return nil
@@ -369,16 +406,29 @@ func (c *checker) resolveOverload(
 
 func (c *checker) checkCreateList(e *exprpb.Expr) {
 	create := e.GetListExpr()
-	var elemType *exprpb.Type
-	for _, e := range create.GetElements() {
+	var elemsType *exprpb.Type
+	optionalIndices := create.GetOptionalIndices()
+	optionals := make(map[int32]bool, len(optionalIndices))
+	for _, optInd := range optionalIndices {
+		optionals[optInd] = true
+	}
+	for i, e := range create.GetElements() {
 		c.check(e)
-		elemType = c.joinTypes(c.location(e), elemType, c.getType(e))
+		elemType := c.getType(e)
+		if optionals[int32(i)] {
+			var isOptional bool
+			elemType, isOptional = maybeUnwrapOptional(elemType)
+			if !isOptional && !isDyn(elemType) {
+				c.errors.typeMismatch(c.location(e), decls.NewOptionalType(elemType), elemType)
+			}
+		}
+		elemsType = c.joinTypes(c.location(e), elemsType, elemType)
 	}
-	if elemType == nil {
+	if elemsType == nil {
 		// If the list is empty, assign free type var to elem type.
-		elemType = c.newTypeVar()
+		elemsType = c.newTypeVar()
 	}
-	c.setType(e, decls.NewListType(elemType))
+	c.setType(e, decls.NewListType(elemsType))
 }
 
 func (c *checker) checkCreateStruct(e *exprpb.Expr) {
@@ -392,22 +442,31 @@ func (c *checker) checkCreateStruct(e *exprpb.Expr) {
 
 func (c *checker) checkCreateMap(e *exprpb.Expr) {
 	mapVal := e.GetStructExpr()
-	var keyType *exprpb.Type
-	var valueType *exprpb.Type
+	var mapKeyType *exprpb.Type
+	var mapValueType *exprpb.Type
 	for _, ent := range mapVal.GetEntries() {
 		key := ent.GetMapKey()
 		c.check(key)
-		keyType = c.joinTypes(c.location(key), keyType, c.getType(key))
+		mapKeyType = c.joinTypes(c.location(key), mapKeyType, c.getType(key))
 
-		c.check(ent.Value)
-		valueType = c.joinTypes(c.location(ent.Value), valueType, c.getType(ent.Value))
+		val := ent.GetValue()
+		c.check(val)
+		valType := c.getType(val)
+		if ent.GetOptionalEntry() {
+			var isOptional bool
+			valType, isOptional = maybeUnwrapOptional(valType)
+			if !isOptional && !isDyn(valType) {
+				c.errors.typeMismatch(c.location(val), decls.NewOptionalType(valType), valType)
+			}
+		}
+		mapValueType = c.joinTypes(c.location(val), mapValueType, valType)
 	}
-	if keyType == nil {
+	if mapKeyType == nil {
 		// If the map is empty, assign free type variables to typeKey and value type.
-		keyType = c.newTypeVar()
-		valueType = c.newTypeVar()
+		mapKeyType = c.newTypeVar()
+		mapValueType = c.newTypeVar()
 	}
-	c.setType(e, decls.NewMapType(keyType, valueType))
+	c.setType(e, decls.NewMapType(mapKeyType, mapValueType))
 }
 
 func (c *checker) checkCreateMessage(e *exprpb.Expr) {
@@ -449,15 +508,21 @@ func (c *checker) checkCreateMessage(e *exprpb.Expr) {
 		c.check(value)
 
 		fieldType := decls.Error
-		if t, found := c.lookupFieldType(
-			c.locationByID(ent.GetId()),
-			messageType.GetMessageType(),
-			field); found {
-			fieldType = t.Type
+		ft, found := c.lookupFieldType(c.locationByID(ent.GetId()), messageType.GetMessageType(), field)
+		if found {
+			fieldType = ft.Type
 		}
-		if !c.isAssignable(fieldType, c.getType(value)) {
-			c.errors.fieldTypeMismatch(
-				c.locationByID(ent.Id), field, fieldType, c.getType(value))
+
+		valType := c.getType(value)
+		if ent.GetOptionalEntry() {
+			var isOptional bool
+			valType, isOptional = maybeUnwrapOptional(valType)
+			if !isOptional && !isDyn(valType) {
+				c.errors.typeMismatch(c.location(value), decls.NewOptionalType(valType), valType)
+			}
+		}
+		if !c.isAssignable(fieldType, valType) {
+			c.errors.fieldTypeMismatch(c.locationByID(ent.Id), field, fieldType, valType)
 		}
 	}
 }

vendor/github.com/google/cel-go/checker/cost.go

@@ -92,7 +92,10 @@ func (e astNode) ComputedSize() *SizeEstimate {
 	case *exprpb.Expr_ConstExpr:
 		switch ck := ek.ConstExpr.GetConstantKind().(type) {
 		case *exprpb.Constant_StringValue:
-			v = uint64(len(ck.StringValue))
+			// converting to runes here is an O(n) operation, but
+			// this is consistent with how size is computed at runtime,
+			// and how the language definition defines string size
+			v = uint64(len([]rune(ck.StringValue)))
 		case *exprpb.Constant_BytesValue:
 			v = uint64(len(ck.BytesValue))
 		case *exprpb.Constant_BoolValue, *exprpb.Constant_DoubleValue, *exprpb.Constant_DurationValue,
@@ -258,6 +261,8 @@ type coster struct {
 	computedSizes map[int64]SizeEstimate
 	checkedExpr   *exprpb.CheckedExpr
 	estimator     CostEstimator
+	// presenceTestCost will either be a zero or one based on whether has() macros count against cost computations.
+	presenceTestCost CostEstimate
 }
 
 // Use a stack of iterVar -> iterRange Expr Ids to handle shadowed variable names.
@@ -280,16 +285,39 @@ func (vs iterRangeScopes) peek(varName string) (int64, bool) {
 	return 0, false
 }
 
-// Cost estimates the cost of the parsed and type checked CEL expression.
-func Cost(checker *exprpb.CheckedExpr, estimator CostEstimator) CostEstimate {
-	c := coster{
-		checkedExpr:   checker,
-		estimator:     estimator,
-		exprPath:      map[int64][]string{},
-		iterRanges:    map[string][]int64{},
-		computedSizes: map[int64]SizeEstimate{},
+// CostOption configures flags which affect cost computations.
+type CostOption func(*coster) error
+
+// PresenceTestHasCost determines whether presence testing has a cost of one or zero.
+// Defaults to presence test has a cost of one.
+func PresenceTestHasCost(hasCost bool) CostOption {
+	return func(c *coster) error {
+		if hasCost {
+			c.presenceTestCost = selectAndIdentCost
+			return nil
+		}
+		c.presenceTestCost = CostEstimate{Min: 0, Max: 0}
+		return nil
 	}
-	return c.cost(checker.GetExpr())
+}
+
+// Cost estimates the cost of the parsed and type checked CEL expression.
+func Cost(checker *exprpb.CheckedExpr, estimator CostEstimator, opts ...CostOption) (CostEstimate, error) {
+	c := &coster{
+		checkedExpr:      checker,
+		estimator:        estimator,
+		exprPath:         map[int64][]string{},
+		iterRanges:       map[string][]int64{},
+		computedSizes:    map[int64]SizeEstimate{},
+		presenceTestCost: CostEstimate{Min: 1, Max: 1},
+	}
+	for _, opt := range opts {
+		err := opt(c)
+		if err != nil {
+			return CostEstimate{}, err
+		}
+	}
+	return c.cost(checker.GetExpr()), nil
 }
 
 func (c *coster) cost(e *exprpb.Expr) CostEstimate {
@@ -340,6 +368,12 @@ func (c *coster) costSelect(e *exprpb.Expr) CostEstimate {
 	sel := e.GetSelectExpr()
 	var sum CostEstimate
 	if sel.GetTestOnly() {
+		// recurse, but do not add any cost
+		// this is equivalent to how evalTestOnly increments the runtime cost counter
+		// but does not add any additional cost for the qualifier, except here we do
+		// the reverse (ident adds cost)
+		sum = sum.Add(c.presenceTestCost)
+		sum = sum.Add(c.cost(sel.GetOperand()))
 		return sum
 	}
 	sum = sum.Add(c.cost(sel.GetOperand()))
@@ -503,7 +537,10 @@ func (c *coster) functionCost(function, overloadID string, target *AstNode, args
 	}
 	switch overloadID {
 	// O(n) functions
-	case overloads.StartsWithString, overloads.EndsWithString, overloads.StringToBytes, overloads.BytesToString:
+	case overloads.StartsWithString, overloads.EndsWithString, overloads.StringToBytes, overloads.BytesToString, overloads.ExtQuoteString, overloads.ExtFormatString:
+		if overloadID == overloads.ExtFormatString {
+			return CallEstimate{CostEstimate: c.sizeEstimate(*target).MultiplyByCostFactor(common.StringTraversalCostFactor).Add(argCostSum())}
+		}
 		if len(args) == 1 {
 			return CallEstimate{CostEstimate: c.sizeEstimate(args[0]).MultiplyByCostFactor(common.StringTraversalCostFactor).Add(argCostSum())}
 		}

vendor/github.com/google/cel-go/checker/decls/BUILD.bazel

@@ -13,7 +13,7 @@ go_library(
     ],
     importpath = "github.com/google/cel-go/checker/decls",
     deps = [
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//types/known/emptypb:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb:go_default_library",
     ],

vendor/github.com/google/cel-go/checker/decls/decls.go

@@ -16,9 +16,9 @@
 package decls
 
 import (
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 	emptypb "google.golang.org/protobuf/types/known/emptypb"
 	structpb "google.golang.org/protobuf/types/known/structpb"
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 var (
@@ -64,6 +64,12 @@ func NewAbstractType(name string, paramTypes ...*exprpb.Type) *exprpb.Type {
 				ParameterTypes: paramTypes}}}
 }
 
+// NewOptionalType constructs an abstract type indicating that the parameterized type
+// may be contained within the object.
+func NewOptionalType(paramType *exprpb.Type) *exprpb.Type {
+	return NewAbstractType("optional", paramType)
+}
+
 // NewFunctionType creates a function invocation contract, typically only used
 // by type-checking steps after overload resolution.
 func NewFunctionType(resultType *exprpb.Type,

vendor/github.com/google/cel-go/checker/env.go

@@ -226,7 +226,7 @@ func (e *Env) setFunction(decl *exprpb.Decl) []errorMsg {
 		newOverloads := []*exprpb.Decl_FunctionDecl_Overload{}
 		for _, overload := range overloads {
 			existing, found := existingOverloads[overload.GetOverloadId()]
-			if !found || !proto.Equal(existing, overload) {
+			if !found || !overloadsEqual(existing, overload) {
 				newOverloads = append(newOverloads, overload)
 			}
 		}
@@ -264,6 +264,31 @@ func (e *Env) isOverloadDisabled(overloadID string) bool {
 	return found
 }
 
+// overloadsEqual returns whether two overloads have identical signatures.
+//
+// type parameter names are ignored as they may be specified in any order and have no bearing on overload
+// equivalence
+func overloadsEqual(o1, o2 *exprpb.Decl_FunctionDecl_Overload) bool {
+	return o1.GetOverloadId() == o2.GetOverloadId() &&
+		o1.GetIsInstanceFunction() == o2.GetIsInstanceFunction() &&
+		paramsEqual(o1.GetParams(), o2.GetParams()) &&
+		proto.Equal(o1.GetResultType(), o2.GetResultType())
+}
+
+// paramsEqual returns whether two lists have equal length and all types are equal
+func paramsEqual(p1, p2 []*exprpb.Type) bool {
+	if len(p1) != len(p2) {
+		return false
+	}
+	for i, a := range p1 {
+		b := p2[i]
+		if !proto.Equal(a, b) {
+			return false
+		}
+	}
+	return true
+}
+
 // sanitizeFunction replaces well-known types referenced by message name with their equivalent
 // CEL built-in type instances.
 func sanitizeFunction(decl *exprpb.Decl) *exprpb.Decl {

vendor/github.com/google/cel-go/checker/printer.go

@@ -26,7 +26,7 @@ type semanticAdorner struct {
 
 var _ debug.Adorner = &semanticAdorner{}
 
-func (a *semanticAdorner) GetMetadata(elem interface{}) string {
+func (a *semanticAdorner) GetMetadata(elem any) string {
 	result := ""
 	e, isExpr := elem.(*exprpb.Expr)
 	if !isExpr {

vendor/github.com/google/cel-go/checker/standard.go

@@ -287,6 +287,8 @@ func init() {
 			decls.NewInstanceOverload(overloads.EndsWithString,
 				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
 		decls.NewFunction(overloads.Matches,
+			decls.NewOverload(overloads.Matches,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
 			decls.NewInstanceOverload(overloads.MatchesString,
 				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
 		decls.NewFunction(overloads.StartsWith,

vendor/github.com/google/cel-go/checker/types.go

@@ -90,6 +90,14 @@ func FormatCheckedType(t *exprpb.Type) string {
 		return "!error!"
 	case kindTypeParam:
 		return t.GetTypeParam()
+	case kindAbstract:
+		at := t.GetAbstractType()
+		params := at.GetParameterTypes()
+		paramStrs := make([]string, len(params))
+		for i, p := range params {
+			paramStrs[i] = FormatCheckedType(p)
+		}
+		return fmt.Sprintf("%s(%s)", at.GetName(), strings.Join(paramStrs, ", "))
 	}
 	return t.String()
 }
@@ -110,12 +118,39 @@ func isDyn(t *exprpb.Type) bool {
 
 // isDynOrError returns true if the input is either an Error, DYN, or well-known ANY message.
 func isDynOrError(t *exprpb.Type) bool {
-	switch kindOf(t) {
-	case kindError:
-		return true
-	default:
-		return isDyn(t)
+	return isError(t) || isDyn(t)
+}
+
+func isError(t *exprpb.Type) bool {
+	return kindOf(t) == kindError
+}
+
+func isOptional(t *exprpb.Type) bool {
+	if kindOf(t) == kindAbstract {
+		at := t.GetAbstractType()
+		return at.GetName() == "optional"
 	}
+	return false
+}
+
+func maybeUnwrapOptional(t *exprpb.Type) (*exprpb.Type, bool) {
+	if isOptional(t) {
+		at := t.GetAbstractType()
+		return at.GetParameterTypes()[0], true
+	}
+	return t, false
+}
+
+func maybeUnwrapString(e *exprpb.Expr) (string, bool) {
+	switch e.GetExprKind().(type) {
+	case *exprpb.Expr_ConstExpr:
+		literal := e.GetConstExpr()
+		switch literal.GetConstantKind().(type) {
+		case *exprpb.Constant_StringValue:
+			return literal.GetStringValue(), true
+		}
+	}
+	return "", false
 }
 
 // isEqualOrLessSpecific checks whether one type is equal or less specific than the other one.
@@ -236,7 +271,7 @@ func internalIsAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) bool {
 // substitution for t1, and whether t2 has a type substitution in mapping m.
 //
 // The type t2 is a valid substitution for t1 if any of the following statements is true
-// - t2 has a type substitition (t2sub) equal to t1
+// - t2 has a type substitution (t2sub) equal to t1
 // - t2 has a type substitution (t2sub) assignable to t1
 // - t2 does not occur within t1.
 func isValidTypeSubstitution(m *mapping, t1, t2 *exprpb.Type) (valid, hasSub bool) {