feat: mvp

[fabriziosestito]

Description

This is the MVP of a policy that can run CEL expression.
It accepts variables and validations with the same syntax as the ValidatingAdmissionPolicy Kubernetes resource.
It acts as a DSL, meaning that creating new policies is possible by configuring new settings and it does not need compilation or wasm toolkit.
The policy requires context-aware capabilities since it needs to get the namespace object of the request to populate the namespaceObject variable.

Test

Settings validation unit tests are adapted from the Kubernetes codebase.
Furthermore, Validation unit tests and e2e tests are added.

Additional Information

Tradeoff

At the moment the policy does not support:

• authz extension: we need to implement this extension by using context-aware capabilities
• typed namespace object and request variables: waiting for this PR to be merged: ext.NativeTypes: Recursively add sub-types google/cel-go#892 so we can bind our k8s-objects to the CEL environment as types
• third-party package: cherry-picking cel extensions from the Kubewarden codebase was needed to reduce the wasm binary size, this could be changed to a fork and automated.

[flavio]

Congrats, that quite an achievement! 👏

I left some minor notes, but I think this is good to be merged and released

[viccuad]

This is great, congrats :).

[flavio]

LGTM, thanks for having implemented also Quantity

Ship it! 🚀