tl;dr:CEL成本非常受限，尤其是在数组方面，尽管从逻辑上讲并不比原生OpenAPI表达式更昂贵

发生了什么？

1. 我将一个非常复杂的、N^2的原生OpenAPI验证迁移到了一个简单的O(1)CEL表达式
2. CRD现在因为超出最大成本而被拒绝

你期望发生什么？

我可以从复杂的表达式迁移到简单的CEL表达式

我们如何尽可能精确地重现它？

我试图做的是在CRD中表示protobuf。特别是，protobuf的 oneOf 方面。请注意，proto中的 "oneOf" 与OpenAPI不同：它允许无设置，也一样。
这在OpenAPI中很难表示，尤其是如果您有一个消息或嵌套消息中有多个oneOf时。在这种情况下，我找到的最佳实现最终是N^2:

oneOf:
- not:
    anyOf:
    - required:
      - simple
    - properties:
        consistentHash:
          allOf:
          - oneOf:
            - not:
                anyOf:
                - required:
                  - httpHeaderName
                - required:
                  - httpCookie
                - required:
                  - useSourceIp
                - required:
                  - httpQueryParameterName
            - required:
              - httpHeaderName
            - required:
              - httpCookie
            - required:
              - useSourceIp
            - required:
              - httpQueryParameterName
          - oneOf:
            - not:
                anyOf:
                - required:
                  - ringHash
                - required:
                  - maglev
            - required:
              - ringHash
            - required:
              - maglev
          properties:
            minimumRingSize: {}
      required:
      - consistentHash
- required:
  - simple
- properties:
    consistentHash:
      allOf:
      - oneOf:
        - not:
            anyOf:
            - required:
              - httpHeaderName
            - required:
              - httpCookie
            - required:
              - useSourceIp
            - required:
              - httpQueryParameterName
        - required:
          - httpHeaderName
        - required:
          - httpCookie
        - required:
          - useSourceIp
        - required:
          - httpQueryParameterName
      - oneOf:
        - not:
            anyOf:
            - required:
              - ringHash
            - required:
              - maglev
        - required:
          - ringHash
        - required:
          - maglev
      properties:
        minimumRingSize: {}
  required:
  - consistentHash
properties:
  consistentHash:
    properties:
      httpCookie:
        description: Hash based on HTTP cookie.
        properties:
          name:
            description: Name of the cookie.
            type: string
          path:
            description: Path to set for the cookie.
            type: string
          ttl:
            description: Lifetime of the cookie.
            type: string
        type: object
      httpHeaderName:
        description: Hash based on a specific HTTP header.
        type: string
      httpQueryParameterName:
        description: Hash based on a specific HTTP query
          parameter.
        type: string
      maglev:
        description: The Maglev load balancer implements
          consistent hashing to backend hosts.
        properties:
          tableSize:
            description: The table size for Maglev hashing.
            type: integer
        type: object
      minimumRingSize:
        description: Deprecated.
        type: integer
      ringHash:
        description: The ring/modulo hash load balancer
          implements consistent hashing to backend hosts.
        properties:
          minimumRingSize:
            description: The minimum number of virtual nodes
              to use for the hash ring.
            type: integer
        type: object
      useSourceIp:
        description: Hash based on the source IP address.
        type: boolean
    type: object

由于认知复杂性和成本(它的数量巨大——对我们API的少量更改很容易进一步膨胀),我想用CEL替换它。这可以通过一个简单的O(1)CEL表达式来实现。 (切换到另一个更简单的消息，所以它不是巨大的):

allowOrigins:
  description: String patterns that match allowed origins.
  items:
    properties:
      exact:
        type: string
      prefix:
        type: string
      regex:
        description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
        type: string
    type: object
    x-kubernetes-validations:
    - message: At most one of [exact prefix regex] should
        be set
      reason: FieldValueDuplicate
      rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
  type: array

这里的问题是 array 。也许我们应该有一个 maxItems ,但我们没有，而且这样做对于我们的用户来说是一个向后不兼容的破坏性更改。
我理解理论上的成本是 unbounded list size * really small number (我认为“非常小的数字”是 6 ,如果我正确计算了成本)。但同样的道理也适用于原生OpenAPI!如果我理解正确的话，这个限制本质上意味着在任何 array API中，我们不能使用CEL并被迫坚持使用原生OpenAPI验证。它在简单的情况下有效，但我们没有简单的情况下。这将有效地阻止我们在一些简单的用例之外采用任何CEL;我们大量的API都是复杂对象嵌套在无限制的 arrays 下。请注意，即使对于我们的使用情况，maxItems边界也需要相当极端；我在某些情况下直到将其降低到100才得到错误信息。
以下显示了一个最小的复现器。在现实世界中，显然相同的规则不会被重复--这只是个简单的例子。

# Generated with `kubectl kustomize "https://github.com/kubernetes-sigs/gateway-api/config/crd/experimental?ref=v0.8.0"`
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: gatewayclasses.example.io
spec:
  group: example.io
  names:
    categories:
    - gateway-api
    kind: GatewayClass
    listKind: GatewayClassList
    plural: gatewayclasses
    singular: gatewayclass
  scope: Cluster
  versions:
  - name: v1alpha2
    schema:
      openAPIV3Schema:
        properties:
          allowOrigins:
            items:
              properties:
                exact:
                  type: string
                prefix:
                  type: string
                regex:
                  type: string
              type: object
              x-kubernetes-validations:
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
                - rule: (has(self.exact)?1:0)+(has(self.prefix)?1:0)+(has(self.regex)?1:0)<=1
            type: array
        type: object
    served: true
    storage: true

我们需要了解其他什么吗？

有人告诉我要报告这样的bug并标记@TristonianJones@cici37和@zielenski关于CEL可用性的问题，所以我正在这样做