feat: Add various CEL to label conversions

[seungsoo-lee]

Description

Fixes # (issue)

Does this PR introduce a breaking change?

Checklist

• PR title follows the <type>: <description> convention
• I use conventional commits in my commit messages
• I have updated the documentation accordingly
• I Keep It Small and Simple: The smaller the PR is, the easier it is to review and have it merged
• I have performed a self-review of my code
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Additional information for reviewer

Mention if this PR is part of any design or a continuation of previous PRs

[nam-jaehyun]

LGTM

[anurag-rajawat]

I'm not sure why but when I applied the cel-multi-si-sib-namespaced.yaml file then no nimbuspolicy was generated.

2024-03-12T15:25:51+05:30       INFO    SecurityIntent found    {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-exec-multiple-nsscoped"}, "namespace": "", "name": "pkg-mgr-exec-multiple-nsscoped", "reconcileID": "ba331bbf-8941-4d0b-8ccc-d39f9378850e", "SecurityIntent.Name": "pkg-mgr-exec-multiple-nsscoped"}
2024-03-12T15:25:51+05:30       INFO    SecurityIntent found    {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"unauthorized-sa-token-access-multiple-nsscoped"}, "namespace": "", "name": "unauthorized-sa-token-access-multiple-nsscoped", "reconcileID": "d59b6189-d1e5-491a-a7c2-3517b8ec129c", "SecurityIntent.Name": "unauthorized-sa-token-access-multiple-nsscoped"}
2024-03-12T15:25:51+05:30       INFO    SecurityIntent found    {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"dns-manipulation-multiple-nsscoped"}, "namespace": "", "name": "dns-manipulation-multiple-nsscoped", "reconcileID": "b1f45411-7a3a-4803-a9a7-dd041eddf0a4", "SecurityIntent.Name": "dns-manipulation-multiple-nsscoped"}
2024-03-12T15:25:51+05:30       INFO    SecurityIntentBinding found     {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "b08afa03-566f-4e89-8128-7d2f78a0d195", "SecurityIntentBinding.Name": "multiple-sis-nsscoped-binding", "SecurityIntentBinding.Namespace": "default"}
2024-03-12T15:25:51+05:30       INFO    Building NimbusPolicy   {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "b08afa03-566f-4e89-8128-7d2f78a0d195"}
2024-03-12T15:25:51+05:30       INFO    Processing CEL expressions      {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "b08afa03-566f-4e89-8128-7d2f78a0d195", "Namespace": "default"}
2024-03-12T15:25:51+05:30       INFO    Error evaluating CEL expression for pod {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "b08afa03-566f-4e89-8128-7d2f78a0d195", "PodName": "loki-0", "error": "no such key: app"}
2024-03-12T15:25:51+05:30       INFO    Abort NimbusPolicy creation as no labels matched the CEL expressions    {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "b08afa03-566f-4e89-8128-7d2f78a0d195"}

I've following workloads on my k8s default namespace:

NAME                        READY   STATUS    RESTARTS         AGE     LABELS
nginx-7854ff8877-lrt2k      2/2     Running   10 (5m33s ago)   5h33m   app=nginx,pod-template-hash=7854ff8877,security.istio.io/tlsMode=istio,service.istio.io/canonical-name=nginx,service.istio.io/canonical-revision=latest
sleep-7656cf8794-j55cw      2/2     Running   12 (5m33s ago)   22h     app=sleep,pod-template-hash=7656cf8794,security.istio.io/tlsMode=istio,service.istio.io/canonical-name=sleep,service.istio.io/canonical-revision=latest
httpbin-65975d4c6f-8g47x    2/2     Running   12 (5m33s ago)   22h     app=httpbin,pod-template-hash=65975d4c6f,security.istio.io/tlsMode=istio,service.istio.io/canonical-name=httpbin,service.istio.io/canonical-revision=v1,version=v1
httpd-5c98f79dfc-nb767      2/2     Running   10 (5m33s ago)   5h33m   app=httpd,pod-template-hash=5c98f79dfc,security.istio.io/tlsMode=istio,service.istio.io/canonical-name=httpd,service.istio.io/canonical-revision=latest
notsleep-5c785bc478-b8zpr   2/2     Running   12 (5m33s ago)   22h     app=notsleep,pod-template-hash=5c785bc478,security.istio.io/tlsMode=istio,service.istio.io/canonical-name=notsleep,service.istio.io/canonical-revision=latest
loki-0                      2/2     Running   18 (5m33s ago)   25h     app.kubernetes.io/component=single-binary,app.kubernetes.io/instance=loki,app.kubernetes.io/name=loki,app.kubernetes.io/part-of=memberlist,apps.kubernetes.io/pod-index=0,controller-revision-hash=loki-86c5868897,security.istio.io/tlsMode=istio,service.istio.io/canonical-name=loki,service.istio.io/canonical-revision=latest,statefulset.kubernetes.io/pod-name=loki-0

Why did it try to match with loki pod instead of the nginx one?

[anurag-rajawat]

@seungsoo-lee I think here instead of using break we should use continue to match labels.

[seungsoo-lee]

@seungsoo-lee I think here instead of using break we should use continue to match labels.

updated

[anurag-rajawat]

I'm approving it now but we also need tests to verify the handling of CEL.