Merge pull request #109122 from jpbetz/runtime-limit-tightening

Reduce CEL runtime cost limits by 1/2 based on latency goals

Kubernetes-commit: cbc341575a09f0991c5c6ad9dbc3f9ce004d06da

go.mod

@@ -23,8 +23,8 @@ require (
 	google.golang.org/protobuf v1.27.1
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.0.0-20220330051021-b754a94214be
-	k8s.io/apimachinery v0.0.0-20220330050810-00f071187c12
-	k8s.io/apiserver v0.0.0-20220330052355-ee1ac0ffde9d
+	k8s.io/apimachinery v0.0.0-20220330050810-6550efdb7444
+	k8s.io/apiserver v0.0.0-20220330052403-4079840d728e
 	k8s.io/client-go v0.0.0-20220330051330-b1e85f6f0092
 	k8s.io/code-generator v0.0.0-20220330050606-8f17de063761
 	k8s.io/component-base v0.0.0-20220330051900-ffc9c87ab39a
@@ -38,8 +38,8 @@ require (
 
 replace (
 	k8s.io/api => k8s.io/api v0.0.0-20220330051021-b754a94214be
-	k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20220330050810-00f071187c12
-	k8s.io/apiserver => k8s.io/apiserver v0.0.0-20220330052355-ee1ac0ffde9d
+	k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20220330050810-6550efdb7444
+	k8s.io/apiserver => k8s.io/apiserver v0.0.0-20220330052403-4079840d728e
 	k8s.io/client-go => k8s.io/client-go v0.0.0-20220330051330-b1e85f6f0092
 	k8s.io/code-generator => k8s.io/code-generator v0.0.0-20220330050606-8f17de063761
 	k8s.io/component-base => k8s.io/component-base v0.0.0-20220330051900-ffc9c87ab39a

go.sum

@@ -968,10 +968,10 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/api v0.0.0-20220330051021-b754a94214be h1:UnXBdsSVy3e2Y6cyf9rVmzn0wPXyoUuGIZAM43vdTj0=
 k8s.io/api v0.0.0-20220330051021-b754a94214be/go.mod h1:gL+2VXubbVTH6gK18uLau2gxoDmu43bdiQmz5TTa3zw=
-k8s.io/apimachinery v0.0.0-20220330050810-00f071187c12 h1:+Cp1h0ojFtOluw7Bgiju2A/LqoWzeYyaB+sY/YSflwE=
-k8s.io/apimachinery v0.0.0-20220330050810-00f071187c12/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
-k8s.io/apiserver v0.0.0-20220330052355-ee1ac0ffde9d h1:bj0BDs7fZ9LffbUn9hDu5cRXMISDy3yVv/PLd2Qh91Q=
-k8s.io/apiserver v0.0.0-20220330052355-ee1ac0ffde9d/go.mod h1:K97VTp2pnULhrW7Pai+yEhEpBlgy7RVJ10IQiToqTL0=
+k8s.io/apimachinery v0.0.0-20220330050810-6550efdb7444 h1:whQmS3GtF822OUer+LPJnMFKn6kPfuJOCM/3xUuATIY=
+k8s.io/apimachinery v0.0.0-20220330050810-6550efdb7444/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
+k8s.io/apiserver v0.0.0-20220330052403-4079840d728e h1:jrT69vUsUADOQQQGl4EA6TzdcSId8sNWj+H6VHmUMfU=
+k8s.io/apiserver v0.0.0-20220330052403-4079840d728e/go.mod h1:yF43Szo1Xh6zL9fTL255A/ArzjRmnJt3iZVbbCfO/O8=
 k8s.io/client-go v0.0.0-20220330051330-b1e85f6f0092 h1:juuWgiTcvrIkUVtF+C5CYsVA0YK7eNA6M/uD1J4WxNU=
 k8s.io/client-go v0.0.0-20220330051330-b1e85f6f0092/go.mod h1:891OlZJw6BK4fpxlZNVtaoFv0uIX9BfbxEsmMJBv1xM=
 k8s.io/code-generator v0.0.0-20220330050606-8f17de063761 h1:tABEWZQG7Phwx5j724T82VnoN9VsE8XN2FVYbYI6lmg=

pkg/apiserver/schema/cel/compilation.go

@@ -44,11 +44,11 @@ const (
 
 	// PerCallLimit specify the actual cost limit per CEL validation call
 	// current PerCallLimit gives roughly 0.1 second for each expression validation call
-	PerCallLimit = 2000000
+	PerCallLimit = 1000000
 
 	// RuntimeCELCostBudget is the overall cost budget for runtime CEL validation cost per CustomResource
 	// current RuntimeCELCostBudget gives roughly 1 seconds for CR validation
-	RuntimeCELCostBudget = 20000000
+	RuntimeCELCostBudget = 10000000
 
 	// checkFrequency configures the number of iterations within a comprehension to evaluate
 	// before checking whether the function evaluation has been interrupted