From c199f9d39241d62cbc1d485a000a899e6fb51233 Mon Sep 17 00:00:00 2001
From: Joe Betz <jpbetz@google.com>
Date: Wed, 30 Apr 2025 09:16:44 -0400
Subject: [PATCH] Fix CEL equality bug for structs will nil field not marked as
 omitempty

Kubernetes-commit: 66b8a8427cf0be6f6a87ea3384e7213696bdfd4c
---
 pkg/cel/common/values_test.go        | 10 ++++++++++
 pkg/cel/common/valuesunstructured.go | 12 ++++++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/pkg/cel/common/values_test.go b/pkg/cel/common/values_test.go
index 9610deced..7acfe6963 100644
--- a/pkg/cel/common/values_test.go
+++ b/pkg/cel/common/values_test.go
@@ -318,6 +318,16 @@ func TestToValue(t *testing.T) {
 				"s2": struct2,
 			},
 		},
+		{
+			name:       "compare: identical complex structs",
+			expression: "c1 == c2",
+			activation: map[string]typedValue{"c1": complex1, "c2": complex1Again},
+		},
+		{
+			name:       "compare: different complex structs",
+			expression: "c1 != c2",
+			activation: map[string]typedValue{"c1": complex1, "c2": complex2},
+		},
 		{
 			name:       "compare: struct and pointer to identical struct",
 			expression: "s1 == s1_ptr",
diff --git a/pkg/cel/common/valuesunstructured.go b/pkg/cel/common/valuesunstructured.go
index 0b8d52001..229916624 100644
--- a/pkg/cel/common/valuesunstructured.go
+++ b/pkg/cel/common/valuesunstructured.go
@@ -598,13 +598,17 @@ func (t *unstructuredMap) Equal(other ref.Val) ref.Val {
 	if t.Size() != oMap.Size() {
 		return types.False
 	}
+
 	for key, value := range t.value {
-		if propSchema, ok := t.propSchema(key); ok {
-			ov, found := oMap.Find(types.String(key))
-			if !found {
+		if _, ok := t.propSchema(key); ok {
+			v, found := t.Find(types.String(key))
+			ov, oFound := oMap.Find(types.String(key))
+			if found != oFound {
 				return types.False
 			}
-			v := UnstructuredToVal(value, propSchema)
+			if !found {
+				continue
+			}
 			vEq := v.Equal(ov)
 			if vEq != types.True {
 				return vEq // either false or error