CEL Context Injection#

CEL context injection is the mechanism by which Kyverno resolves Kubernetes admission data — namespaceObject, object, oldObject, request, and variables — and makes them available as named variables inside CEL expression evaluation environments. This applies uniformly to ValidatingPolicy, MutatingPolicy, and DeletingPolicy policy types.

The canonical string keys for all context variables are defined in pkg/cel/compiler/keys.go:

These constants are shared across all policy type compilers, making the CEL activation map consistent regardless of policy kind.

Injection Pipeline Per Policy Type#

Each policy engine follows the same three-stage pattern: resolve → convert → inject.

ValidatingPolicy#

The engine resolves the namespace object from a NamespaceResolver if the request's namespace is non-empty, then builds a k8s.io/apiserver/pkg/admission.Attributes record 1. The Attributes record, the raw AdmissionRequest, and the namespace are passed to prepareK8sData, which:

1. Calls utils.ObjectToResolveVal(namespace) → CEL-compatible value for namespaceObject
2. Calls utils.ObjectToResolveVal(attr.GetObject()) → value for object
3. Calls utils.ObjectToResolveVal(attr.GetOldObject()) → value for oldObject
4. Calls utils.ConvertObjectToUnstructured(request) → map[string]any for request

The resulting evaluationData struct is then spread into the CEL activation dataNew map in evaluateWithData.

userInfo is embedded in the request variable (as a field on the admission request map). Prior to PR #15619, vpol and mpol engines passed nil for the user context; the fix wires in admissionpolicy.NewUser(request.Request.UserInfo) when constructing admission.Attributes 2.

MutatingPolicy#

pkg/cel/policies/mpol/compiler/eval.go:prepareData mirrors prepareK8sData but accepts a typed *corev1.Namespace rather than runtime.Object. It also re-extracts object/oldObject from the raw AdmissionRequest and merges them back into the request map at the "object" and "oldObject" keys 3, ensuring the request body is self-consistent. The final activation map is returned directly 4.

namespaceObject support was added in PR #15625; before that fix the variable was absent from the MutatingPolicy CEL context.

DeletingPolicy#

DeletingPolicy's compiled Policy.Evaluate takes unstructured.Unstructured directly (no admission.Attributes). It calls utils.ObjectToResolveVal(namespace) and sets NamespaceObjectKey alongside ObjectKey and ResourceKey in the activation map 5. The engine resolves the namespace in Handle — namespaced resources use the NamespaceResolver, while cluster-scoped Namespace resources build a synthetic corev1.Namespace from the resource's own labels and then optionally override with the resolver's copy 6.

namespaceObject support was added in PR #14422.

CEL Environment Declaration#

Before any expression can reference a variable, it must be declared in the CEL environment at compile time. For ValidatingPolicy, this is done in createBaseVpolEnv, which registers all context variables 7. NamespaceType and RequestType are typed CEL objects (not dyn) so that field access is validated at compile time; object and oldObject use cel.DynType because they represent arbitrary Kubernetes resources.

DeletingPolicy 8 and MutatingPolicy 9 follow the same pattern in their respective compiler.go files. A missing variable declaration at compile time will cause expression compilation errors rather than runtime panics.

Nil Value Handling#

utils.ObjectToResolveVal (from github.com/kyverno/sdk/extensions/cel/utils) handles nil inputs — if the namespace resolver returns nil (e.g., for cluster-scoped resources or cache misses), the resulting CEL value is a null/null-like value rather than a panic. This is critical for namespaceObject, which is nil for cluster-scoped resources (except Namespace kind in DeletingPolicy, which has special synthetic-object logic).

For request, utils.ConvertObjectToUnstructured returns nil when passed a nil pointer; the mpol prepareData guards against this with an explicit if request != nil check 10 before writing to the activation map.

For DELETE operations, attr.GetObject() returns nil and attr.GetOldObject() holds the deleted resource; ObjectToResolveVal(nil) correctly produces a null CEL value in those cases.

Bug Fix History#

Context injection was added incrementally per policy type. Several missing-variable bugs were fixed:

The pattern across fixes is consistent: the engine layer resolves the namespace object; the compiler/eval layer converts and injects it; missing variables cause silent nil or evaluation failures at runtime, not compile time.

Key Source Files#