feat: Add CEL-based conditional function execution (#4388) by SurbhiAgarwal1 · Pull Request #4391 · kptdev/kpt

SurbhiAgarwal1 · 2026-02-14T17:56:39Z

Implements #4388

Changes

Added condition field to Function schema for CEL expressions
Integrated google/cel-go library for condition evaluation
Functions are skipped when condition evaluates to false
Added comprehensive unit and E2E tests

Example Usage

pipeline:
  mutators:
  - image: gcr.io/kpt-fn/set-namespace:v0.4
    condition: "resources.exists(r, r.kind == 'ConfigMap' && r.metadata.name == 'env-config')"
    configMap:
      namespace: production

netlify · 2026-02-14T17:56:43Z

✅ Deploy Preview for kptdocs ready!

Name	Link
🔨 Latest commit	`5f1dce7`
🔍 Latest deploy log	https://app.netlify.com/projects/kptdocs/deploys/69943ba70873ec0008547494
😎 Deploy Preview	https://deploy-preview-4391--kptdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

liamfallon · 2026-02-16T07:48:54Z

.agent/github_comment_4382.md

Did you mean to post these files on the issue rather than on the PR? It looks like AI generated content.

nagygergo

Hey, good to see a new contributor.

Some general comments:

Clean up AI instructions.
Add e2e tests.
Add documentation.

Some specific comments are inline.

nagygergo · 2026-02-16T12:24:19Z

internal/fnruntime/celeval.go

+
+// NewCELEvaluator creates a new CEL evaluator with the standard environment
+func NewCELEvaluator() (*CELEvaluator, error) {
+	env, err := cel.NewEnv(


This is a totally unprotected cel executor. There should be limitations on the number of CPU cycles it can consume, the amount of characters it can output, the max complexity of the ast.

nagygergo · 2026-02-16T12:25:46Z

internal/fnruntime/runner.go

-	return NewFunctionRunner(ctx, fltr, pkgPath, fnResult, fnResults, opts)
+
+	// Initialize CEL evaluator if a condition is specified
+	var evaluator *CELEvaluator


Why do you need to create a new CEL env for each function evaluation? The env can be the same.

nagygergo · 2026-02-16T12:43:15Z

internal/fnruntime/runner.go

 	pr := printer.FromContextOrDie(fr.ctx)
+
+	// Check condition before executing function
+	if fr.condition != "" && fr.evaluator != nil {


Why check if fr.evaluator exists or not. If the function runner was created with a condition appearing for it's Runner, then must have an evaluator. It's ok to run to a panic if it doesn't exist at this point.

nagygergo · 2026-02-16T13:09:25Z

internal/fnruntime/celeval_test.go

+	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+


Add a testcase that makes sure that the cel functions can't mutate the resourcelist that is the input. The function signature can allow for it, as it hands over the *yaml.RNode list.

nagygergo · 2026-02-16T13:11:45Z

internal/fnruntime/conditional_e2e_test.go

+
+			// Create function runner with condition
+			fnResult := &fnresult.Result{}
+			fnResults := &fnresult.ResultList{}


Are these needed for testware when initialising it?

nagygergo · 2026-02-16T13:14:42Z

internal/fnruntime/celeval.go

+// NewCELEvaluator creates a new CEL evaluator with the standard environment
+func NewCELEvaluator() (*CELEvaluator, error) {
+	env, err := cel.NewEnv(
+		cel.Variable("resources", cel.ListType(cel.DynType)),


Probably advanced strings libraries would be good to include. https://pkg.go.dev/github.com/google/cel-go/ext#Strings

nagygergo · 2026-02-16T13:16:31Z

internal/fnruntime/celeval.go

+	}
+
+	// Evaluate the expression
+	out, _, err := prg.Eval(map[string]interface{}{


There should be a context passed to this to protect against long-hanging operations.

nagygergo · 2026-02-16T13:24:01Z

internal/fnruntime/celeval.go

+	}
+
+	// Convert resources to a format suitable for CEL
+	resourceList, err := e.resourcesToList(resources)


Is serialising all the yaml.RNode actually needed? As it's a map[string]any type anyways (with no strange subtypes), probably the CEL interpreter can deal with it directly. Serialising the whole package for the cel execution, then not reusing it can cause a significant memory footprint bloat.

- Remove AI-generated documentation files from .agent/ directory - Add CEL cost limits (100k operations) and AST complexity checks - Pre-compile CEL expressions at evaluator creation for better performance - Add context support to CEL evaluation for timeout protection - Remove redundant nil check for evaluator (panic is acceptable if misconfigured) - Add immutability test to ensure CEL cannot mutate input resources - Update all tests to match new evaluator API signature The CEL environment is now created once per function and reused, rather than being recreated on each evaluation. This improves performance and addresses memory concerns.

Remove CostLimit and CostTracking which may not be available in cel-go v0.22.1. Use standard Eval instead of ContextEval for compatibility. AST complexity check is still in place for protection.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

SurbhiAgarwal1 requested a review from liamfallon as a code owner February 14, 2026 17:56

Copilot AI review requested due to automatic review settings February 14, 2026 17:56

SurbhiAgarwal1 requested review from efiacor, kispaljr and mozesl-nokia as code owners February 14, 2026 17:56

Copilot started reviewing on behalf of SurbhiAgarwal1 February 14, 2026 17:57 View session

dosubot bot added the area/fn-runtime KRM function runtime label Feb 14, 2026

Copilot AI reviewed Feb 14, 2026

View reviewed changes

feat: Add CEL-based conditional function execution (kptdev#4388)

3d2bde5

Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

SurbhiAgarwal1 force-pushed the feat/cel-conditional-execution branch from 32fe3c0 to 3d2bde5 Compare February 15, 2026 09:54

liamfallon reviewed Feb 16, 2026

View reviewed changes

nagygergo suggested changes Feb 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 17, 2026 09:52

Copilot started reviewing on behalf of SurbhiAgarwal1 February 17, 2026 09:52 View session

fix: Use compatible CEL API for v0.22.1

5f1dce7

Remove CostLimit and CostTracking which may not be available in cel-go v0.22.1. Use standard Eval instead of ContextEval for compatibility. AST complexity check is still in place for protection.

Copilot AI reviewed Feb 17, 2026

View reviewed changes

Conversation

SurbhiAgarwal1 commented Feb 14, 2026

Changes

Example Usage

Uh oh!

netlify bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kptdocs ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

liamfallon Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

nagygergo left a comment

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

nagygergo Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Feb 14, 2026 •

edited

Loading

nagygergo Feb 16, 2026 •

edited

Loading

nagygergo Feb 16, 2026 •

edited

Loading

nagygergo Feb 16, 2026 •

edited

Loading

nagygergo Feb 16, 2026 •

edited

Loading