Fix CEL tests for v1.28+

[robscott]

What type of PR is this?
/kind cleanup
/kind failing-test

What this PR does / why we need it:
As @mlavacca discovered in #3316, our CEL tests were failing in v1.28+. Fortunately it was just a variety of changes to how error messages are presented to users. I've also tested these changes against v1.27 and v1.29.

Does this PR introduce a user-facing change?:

NONE

/cc @gauravkghildiyal @jpbetz

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: robscott

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [robscott]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[robscott]

@jpbetz do you know of any other changes on the horizon for CEL error messages? Any better ideas for how we can make tests like this both support multiple versions and ensure that we're returning useful error messages to users? As long as this set of workarounds remains small, I think this is ~OK, but would hate to turn this into a massive function.

[jpbetz]

I'm not aware of any on the horizon.. we're trying to apply a light touch to these things as we do understand Hyrum's law is in full effect. But we'll keep a close eye out.

cc @TristonianJones @cici37 for visibility

[TristonianJones]

Those errors don't look like they're from CEL itself, but perhaps would be from some layer up the stack within K8s maybe?

[robscott]

Thanks for the quick responses! Definitely get that this is Hyrum's law in practice, just wondering if there's anywhere we can easily track potential upstream changes.

[jpbetz]

I looked more closely.

I don't believe the enum error is from CEL specifically. Although it is from openapi so still under api-machinery. This might be more durably matched by checking the error type, which consistently be FieldValueNotSupported. We do sometimes change error strings, but the error types are fixed.

The removal of status and spec prefixes on path names is surprising, and does not look correct. @cici37 would you look more closely at this issue?

[robscott]

/retest

[gauravkghildiyal]

Thanks a lot @robscott for taking this on!

/lgtm

[mlavacca]

/cherrypick release-1.1

[k8s-infra-cherrypick-robot]

@mlavacca: #3325 failed to apply on top of branch "release-1.1":

Applying: Fix CEL tests for v1.28+
Using index info to reconstruct a base tree...
M	pkg/test/cel/backendtlspolicy_test.go
A	pkg/test/cel/gateway_experimental_test.go
M	pkg/test/cel/grpcroute_test.go
M	pkg/test/cel/httproute_test.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/test/cel/httproute_test.go
Auto-merging pkg/test/cel/grpcroute_test.go
CONFLICT (modify/delete): pkg/test/cel/gateway_experimental_test.go deleted in HEAD and modified in Fix CEL tests for v1.28+. Version Fix CEL tests for v1.28+ of pkg/test/cel/gateway_experimental_test.go left in tree.
Auto-merging pkg/test/cel/backendtlspolicy_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 Fix CEL tests for v1.28+

In response to this:

/cherrypick release-1.1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.