calicoselector

Overview ¶

Package calicoselector evaluates Calico's label-selector expression language (e.g. `app == 'api' && has(tier)`), used by projectcalico.org/v3 NetworkPolicy and GlobalNetworkPolicy spec.selector/spec.namespaceSelector. Unlike upstream NetworkPolicy's podSelector, this is not a Kubernetes LabelSelector -- it's a small boolean expression language with its own operators (==, !=, in, not in, has(), !has(), contains, starts with, ends with, all(), &&, ||, !, parens).

This is adapted from Calico's own parser/AST at github.com/projectcalico/calico/libcalico-go/lib/selector (parser and tokenizer sub-packages), commit 69a90ed878d5c1f617214977593b9b85d89bfdbd, rather than re-implemented from scratch, so that kubectl-status's notion of "this selector matches these labels" agrees with Calico's own evaluation -- getting Calico's operator precedence/negation semantics subtly wrong (e.g. what `!=` and `not in` mean when the label is entirely absent) would silently misreport which policies select a Pod.

It is a straight port, not a `go get`-able dependency: libcalico-go is not independently module-versioned inside the github.com/projectcalico/calico monorepo (no nested go.mod), so importing it would pin this whole project to Calico's module graph just to reuse a few hundred lines of parsing logic. Compared to the upstream source, this port drops:

• the uniquestr/hash-based string interning and Selector.UniqueID/Equal -- those exist upstream to make repeated evaluation of many long-lived selectors cheap inside Calico's Felix dataplane; kubectl-status parses a handful of selectors once per render, so plain strings are simpler and just as correct.
• the Visitor/PrefixVisitor and LabelRestrictions machinery -- used upstream for policy-program optimization, unused by a Parse+Evaluate caller.
• all logrus debug logging -- gated upstream behind compile-time-false `parserDebug`/`tokenizerDebug` consts, i.e. already dead code there.

The tokenizing/parsing/evaluation logic itself (operator semantics, error cases) is preserved as-is. Each file below carries Calico's original Apache-2.0 copyright header.