Skip to content

CEL Predicates

Using CEL as filters in CLI commands with --include and --exclude.

Syntax

hydra gitops diff <appId> --include '<CEL expression>'
hydra gitops diff <appId> --exclude '<CEL expression>'

Multiple filters can be combined:

hydra gitops diff prod.** --include 'kind == "Deployment"' --exclude 'ns == "kube-system"'

Semantics

  • --include — Only show resources matching the expression (whitelist)
  • --exclude — Hide resources matching the expression (blacklist)
  • When both are used: include is applied first, then exclude filters the result

Common Predicates

Filter by Kind

kind == "Deployment"
kind == "Secret"
kind == "ConfigMap" || kind == "Secret"

Filter by Namespace

ns == "default"
ns == "kube-system"
ns != "kube-system"
ns == ""                    // Cluster-scoped resources

Filter by Name

name == "my-deployment"
name.startsWith("coredns")
name.matches("^service-.*")

Filter by GVK

gvk == "apps/v1/Deployment"
gvk == "cert-manager.io/v1/Certificate"
gvk.startsWith("apps/")

Filter by Ownership

appOwned                    // Only app-owned resources
!appOwned                   // Only non-app resources
builtIn                     // Only cluster builtins

Combine Conditions

kind == "Deployment" && ns == "default"
(kind == "Secret" || kind == "ConfigMap") && ns != "kube-system"
namespaced && !appOwned && !builtIn

Negation

!(kind == "Event")
!(ns == "kube-system" || ns == "kube-public")

Commands Supporting CEL Filters

Command Flag
hydra gitops diff --include, --exclude
hydra gitops apply --include, --exclude
hydra local find CEL filter argument
hydra gitops untracked --include, --exclude

In Ref-Parsers

In ref-parser yaml files, the predicate field is a CEL expression:

predicate: 'gvk == "apps/v1/Deployment"'

In Values

CEL predicates appear in several global.hydra configurations:

templatePatches:
  my-patch:
    predicate: 'kind == "Deployment" && ns == "default"'

diff:
  ignore-events:
    predicate: 'kind == "Event"'

clones:
  my-clone:
    predicate: 'kind == "Secret" && name == "pull-secret"'

See Also