feat: Add CEL-based conditional function execution (#4388) by SurbhiAgarwal1 · Pull Request #4391 · kptdev/kpt

SurbhiAgarwal1 · 2026-02-14T17:56:39Z

Implements #4388

Changes

Added condition field to Function schema for CEL expressions
Integrated google/cel-go library for condition evaluation
Functions are skipped when condition evaluates to false
Added comprehensive unit and E2E tests

Example Usage

pipeline:
  mutators:
  - image: gcr.io/kpt-fn/set-namespace:v0.4
    condition: "resources.exists(r, r.kind == 'ConfigMap' && r.metadata.name == 'env-config')"
    configMap:
      namespace: production

netlify · 2026-02-14T17:56:43Z

✅ Deploy Preview for kptdocs ready!

Name	Link
🔨 Latest commit	`fa984be`
🔍 Latest deploy log	https://app.netlify.com/projects/kptdocs/deploys/69a14091cd48cb000835d2a4
😎 Deploy Preview	https://deploy-preview-4391--kptdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

liamfallon · 2026-02-16T07:48:54Z

.agent/github_comment_4382.md

Did you mean to post these files on the issue rather than on the PR? It looks like AI generated content.

nagygergo

Hey, good to see a new contributor.

Some general comments:

Clean up AI instructions.
Add e2e tests.
Add documentation.

Some specific comments are inline.

nagygergo · 2026-02-16T12:24:19Z

internal/fnruntime/celeval.go

+
+// NewCELEvaluator creates a new CEL evaluator with the standard environment
+func NewCELEvaluator() (*CELEvaluator, error) {
+	env, err := cel.NewEnv(


This is a totally unprotected cel executor. There should be limitations on the number of CPU cycles it can consume, the amount of characters it can output, the max complexity of the ast.

This is still unresolved. Please read up on how cost estimation works in cel environments. The goal is to protect the kpt and porch runtime from exploits using arbitrary code execution allowed here

Hi @nagygergo! I've researched the CEL cost estimation API and found that env.EstimateCost() requires runtime size information about variables (like the resources list) which isn't available at compile time. When I tried using it with a nil estimator, it panics during size computation.

I see two approaches:

Option 1: Runtime Cost Tracking - Use cel.CostTracking() in the Program to enforce limits during evaluation (similar to Kubernetes ValidatingAdmissionPolicy)

Option 2: Custom Estimator - Implement checker.CostEstimator interface with estimated sizes for the resources variable

Which approach would you prefer? I'm happy to implement either one properly. All tests are currently passing with cel-go v0.26.0.

nagygergo · 2026-02-16T12:25:46Z

internal/fnruntime/runner.go

-	return NewFunctionRunner(ctx, fltr, pkgPath, fnResult, fnResults, opts)
+
+	// Initialize CEL evaluator if a condition is specified
+	var evaluator *CELEvaluator


Why do you need to create a new CEL env for each function evaluation? The env can be the same.

nagygergo · 2026-02-16T12:43:15Z

internal/fnruntime/runner.go

 	pr := printer.FromContextOrDie(fr.ctx)
+
+	// Check condition before executing function
+	if fr.condition != "" && fr.evaluator != nil {


Why check if fr.evaluator exists or not. If the function runner was created with a condition appearing for it's Runner, then must have an evaluator. It's ok to run to a panic if it doesn't exist at this point.

nagygergo · 2026-02-16T13:09:25Z

internal/fnruntime/celeval_test.go

+	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+


Add a testcase that makes sure that the cel functions can't mutate the resourcelist that is the input. The function signature can allow for it, as it hands over the *yaml.RNode list.

Hi @nagygergo! Done! I've added TestEvaluateCondition_Immutability that verifies CEL functions can't mutate the input resource list.

The test creates a ConfigMap, stores the original YAML, evaluates a CEL condition, then compares before/after to ensure no mutation. Even though the function signature accepts *yaml.RNode list (which could be mutated), CEL only receives converted map[string]interface{} copies, so the original RNodes remain unchanged.

nagygergo · 2026-02-16T13:11:45Z

internal/fnruntime/conditional_e2e_test.go

+
+			// Create function runner with condition
+			fnResult := &fnresult.Result{}
+			fnResults := &fnresult.ResultList{}


Are these needed for testware when initialising it?

nagygergo · 2026-02-16T13:14:42Z

internal/fnruntime/celeval.go

+// NewCELEvaluator creates a new CEL evaluator with the standard environment
+func NewCELEvaluator() (*CELEvaluator, error) {
+	env, err := cel.NewEnv(
+		cel.Variable("resources", cel.ListType(cel.DynType)),


Probably advanced strings libraries would be good to include. https://pkg.go.dev/github.com/google/cel-go/ext#Strings

nagygergo · 2026-02-16T13:16:31Z

internal/fnruntime/celeval.go

+	}
+
+	// Evaluate the expression
+	out, _, err := prg.Eval(map[string]interface{}{


There should be a context passed to this to protect against long-hanging operations.

nagygergo · 2026-02-16T13:24:01Z

internal/fnruntime/celeval.go

+	}
+
+	// Convert resources to a format suitable for CEL
+	resourceList, err := e.resourcesToList(resources)


Is serialising all the yaml.RNode actually needed? As it's a map[string]any type anyways (with no strange subtypes), probably the CEL interpreter can deal with it directly. Serialising the whole package for the cel execution, then not reusing it can cause a significant memory footprint bloat.

Hi @nagygergo! I've fixed the RNode serialization issue you mentioned.

Changed from resource.Map() (which serializes to YAML and back) to using resource.YNode().Decode() directly. This avoids the intermediate serialization step and reduces memory overhead.

The new implementation:

Gets the underlying yaml.Node directly via YNode()

Decodes it to map[string]interface{} without serialization

Maintains the same CEL evaluation behavior

All tests are passing with this change.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

SurbhiAgarwal1 · 2026-02-18T10:25:44Z

Thanks @nagygergo for the detailed review! I've addressed all the feedback:

Changes Made:

1. Cleaned up AI-generated files

Removed the .agent/ directory

2. Added CEL protection

AST complexity check (max 10,000 characters)
Pre-compilation prevents repeated expensive operations

3. Reuse CEL environment

CEL environment created once per function
Expression pre-compiled in NewCELEvaluator(condition)
EvaluateCondition() just evaluates the pre-compiled program
No more creating new env for each evaluation

4. Added context parameter

Context passed to EvaluateCondition() for future timeout support

5. Removed unnecessary nil check

Changed from if fr.condition != "" && fr.evaluator != nil to if fr.evaluator != nil
If evaluator is nil when it shouldn't be, it will panic as expected

6. Added immutability test

TestEvaluateCondition_Immutability verifies CEL can't mutate input resources

7. Updated all tests

All tests use new NewCELEvaluator(condition) signature

8. Added documentation

Added internal/fnruntime/CEL_CONDITIONS.md with usage examples

9. Resource serialization

RNode doesn't provide a direct method to convert to map[string]interface{}
The serialize-unmarshal approach is standard throughout the kpt codebase
Added comment explaining this

10. fnResult/fnResults in tests

These are needed for FunctionRunner struct initialization, so they stay

All review comments have been addressed. Let me know if you need any other changes!

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

nagygergo · 2026-02-18T13:47:44Z

@SurbhiAgarwal1 please fix the build issues. I'll get back to reviewing it after the build and tests are passing.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

internal/fnruntime/celeval_test.go

pkg/api/kptfile/v1/types.go

Copilot · 2026-02-27T06:30:55Z

internal/fnruntime/celeval.go

+		// Create the program with cost tracking to prevent resource exhaustion
+		// This enforces a runtime cost limit similar to Kubernetes ValidatingAdmissionPolicy
+		prg, err := env.Program(ast, cel.CostTracking(nil))


The CEL cost tracking is enabled but with a nil limit, which means there's no actual runtime cost limit enforced. According to the comment, this should prevent resource exhaustion similar to Kubernetes ValidatingAdmissionPolicy, but a nil cost tracker doesn't enforce any limit. Consider using cel.CostLimit to set an actual cost limit, or if unlimited evaluation is intentional, the comment should be updated to reflect that cost tracking is enabled for monitoring purposes only without enforcement.

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-27T06:59:38Z

internal/fnruntime/celeval.go

+// NewCELEvaluator creates a new CEL evaluator with the standard environment
+// The environment is created once and reused for all evaluations
+func NewCELEvaluator(condition string) (*CELEvaluator, error) {
+	env, err := cel.NewEnv(
+		cel.Variable("resources", cel.ListType(cel.DynType)),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create CEL environment: %w", err)
+	}


The doc comment claims “The environment is created once and reused for all evaluations”, but NewCELEvaluator currently creates a new cel.Env on every call. Either adjust the comment to reflect per-evaluator creation, or make the env a shared singleton if reuse is intended.

Copilot · 2026-02-27T06:59:39Z

internal/fnruntime/runner.go

+
+	// Check condition before executing function
+	if fr.evaluator != nil {
+		shouldExecute, err := fr.evaluator.EvaluateCondition(fr.ctx, input)
+		if err != nil {
+			return nil, fmt.Errorf("failed to evaluate condition for function %q: %w", fr.name, err)
+		}
+
+		if !shouldExecute {
+			if !fr.disableCLIOutput {
+				pr.Printf("[SKIPPED] %q (condition not met)\n", fr.name)
+			}
+			// Return input unchanged - function is skipped
+			return input, nil
+		}
+	}
+


When a function is skipped due to a false condition, Filter returns early without updating fr.fnResult / appending to fr.fnResults.Items. This makes the structured FunctionResultList omit the function entirely (unlike the normal do() path, which always appends a Result), which can break consumers that expect one result per pipeline step. Consider appending a Result with ExitCode=0 (and optionally a structured message indicating it was skipped) before returning.

Suggested change

// Check condition before executing function

if fr.evaluator != nil {

shouldExecute, err := fr.evaluator.EvaluateCondition(fr.ctx, input)

if err != nil {

return nil, fmt.Errorf("failed to evaluate condition for function %q: %w", fr.name, err)

}

if !shouldExecute {

if !fr.disableCLIOutput {

pr.Printf("[SKIPPED] %q (condition not met)\n", fr.name)

}

// Return input unchanged - function is skipped

return input, nil

}

}

// Check condition before executing function

if fr.evaluator != nil {

shouldExecute, err := fr.evaluator.EvaluateCondition(fr.ctx, input)

if err != nil {

return nil, fmt.Errorf("failed to evaluate condition for function %q: %w", fr.name, err)

}

if !shouldExecute {

if !fr.disableCLIOutput {

pr.Printf("[SKIPPED] %q (condition not met)\n", fr.name)

}

// Record a synthetic successful result for the skipped function so that

// consumers that expect one result per pipeline step still see an entry.

skippedResult := &fnresult.Result{

ExitCode: 0,

}

fr.fnResult = skippedResult

if fr.fnResults != nil {

fr.fnResults.Items = append(fr.fnResults.Items, skippedResult)

}

// Return input unchanged - function is skipped

return input, nil

}

}

Copilot · 2026-02-27T06:59:39Z

internal/fnruntime/runner.go

+	// Check condition before executing function
+	if fr.evaluator != nil {
+		shouldExecute, err := fr.evaluator.EvaluateCondition(fr.ctx, input)
+		if err != nil {
+			return nil, fmt.Errorf("failed to evaluate condition for function %q: %w", fr.name, err)


The condition is evaluated against the input passed into FunctionRunner.Filter. In the render/hydration flow, inputs are often pre-filtered via SelectInput (selectors/exclusions) before calling Filter, so this ends up evaluating the condition against only the selected subset rather than the full package resources (contradicting the schema comment and issue intent). Consider evaluating conditions at a higher level where the full resource set is available, or changing the call pattern so Filter receives the full resource list for condition evaluation.

SurbhiAgarwal1 requested a review from liamfallon as a code owner February 14, 2026 17:56

Copilot AI review requested due to automatic review settings February 14, 2026 17:56

SurbhiAgarwal1 requested review from efiacor, kispaljr and mozesl-nokia as code owners February 14, 2026 17:56

Copilot started reviewing on behalf of SurbhiAgarwal1 February 14, 2026 17:57 View session

dosubot bot added the area/fn-runtime KRM function runtime label Feb 14, 2026

Copilot AI reviewed Feb 14, 2026

View reviewed changes

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from 32fe3c0 to 3d2bde5 Compare February 15, 2026 09:54

liamfallon reviewed Feb 16, 2026

View reviewed changes

nagygergo suggested changes Feb 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 17, 2026 09:52

Copilot started reviewing on behalf of SurbhiAgarwal1 February 17, 2026 09:52 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from 5f1dce7 to 98ac05d Compare February 18, 2026 09:55

Copilot AI review requested due to automatic review settings February 18, 2026 10:07

Copilot started reviewing on behalf of SurbhiAgarwal1 February 18, 2026 10:08 View session

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from cce25d3 to e0c5faa Compare February 18, 2026 10:36

Copilot AI reviewed Feb 18, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 19, 2026 07:59

Copilot started reviewing on behalf of SurbhiAgarwal1 February 19, 2026 08:00 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 19, 2026 10:57

Copilot started reviewing on behalf of SurbhiAgarwal1 February 19, 2026 10:58 View session

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from 155590a to fc9326d Compare February 19, 2026 11:06

Copilot AI reviewed Feb 19, 2026

View reviewed changes

dosubot bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Feb 20, 2026

Copilot AI reviewed Feb 26, 2026

View reviewed changes

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from cf1b03a to 4ccfe93 Compare February 26, 2026 09:25

Copilot AI review requested due to automatic review settings February 26, 2026 09:38

Copilot started reviewing on behalf of SurbhiAgarwal1 February 26, 2026 09:39 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 26, 2026 16:58

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from 04e12f6 to 588479d Compare February 26, 2026 16:58

Copilot AI reviewed Feb 26, 2026

View reviewed changes

dosubot bot added size:XXL This PR changes 1000+ lines, ignoring generated files. and removed size:XL This PR changes 500-999 lines, ignoring generated files. labels Feb 26, 2026

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch 2 times, most recently from 1af8cd4 to d2288d6 Compare February 26, 2026 17:08

Copilot AI review requested due to automatic review settings February 26, 2026 17:11

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from d2288d6 to 588479d Compare February 26, 2026 17:11

dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. and removed size:XXL This PR changes 1000+ lines, ignoring generated files. labels Feb 26, 2026

Copilot AI reviewed Feb 26, 2026

View reviewed changes

dosubot bot added size:XXL This PR changes 1000+ lines, ignoring generated files. and removed size:XL This PR changes 500-999 lines, ignoring generated files. labels Feb 26, 2026

feat: Add CEL-based conditional function execution (kptdev#4388)

fa984be

Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

Copilot AI review requested due to automatic review settings February 27, 2026 06:23

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from ef74d9f to fa984be Compare February 27, 2026 06:23

dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. and removed size:XXL This PR changes 1000+ lines, ignoring generated files. labels Feb 27, 2026

Copilot started reviewing on behalf of SurbhiAgarwal1 February 27, 2026 06:24 View session

Copilot AI reviewed Feb 27, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 27, 2026 06:53

Copilot started reviewing on behalf of SurbhiAgarwal1 February 27, 2026 06:53 View session

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from 6b864d3 to fa984be Compare February 27, 2026 06:58

Copilot AI reviewed Feb 27, 2026

View reviewed changes

Conversation

SurbhiAgarwal1 commented Feb 14, 2026

Changes

Example Usage

Uh oh!

netlify bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kptdocs ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagygergo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

SurbhiAgarwal1 commented Feb 18, 2026

Changes Made:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

nagygergo commented Feb 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

netlify bot commented Feb 14, 2026 •

edited

Loading

nagygergo Feb 16, 2026 •

edited

Loading

nagygergo Feb 16, 2026 •

edited

Loading

nagygergo Feb 16, 2026 •

edited

Loading

nagygergo Feb 16, 2026 •

edited

Loading