TelemetryPolicy does not parse CEL and fails on Authorino

[yv-miggo]

Describe the bug
TelemetryPolicy does not work when added. JWT auth works, able to then rate limit on custom filters, but TelemetryPolicy is broken.
local kind cluster v1.35.0

AuthPolicy

apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: jwt
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: test
  rules:
    authentication:
      descope:
        metrics: true
        jwt:
          issuerUrl: https://auth.example.com/longalphanum
          ttl: 3600
    authorization:
      descope:
        metrics: true
        patternMatching:
          patterns:
            - selector: auth.identity.dpr
              operator: eq
              value: longalphanum
    response:
      success:
        filters:
          descope:
            key: descope
            metrics: true
            json:
              properties:
                tenantId:
                  expression: auth.identity.dct
                rateLimitPlan:
                  expression: auth.identity.tenants[auth.identity.dct].roles[0]
        headers:
          x-auth:
            plain:
              expression: auth
          x-request:
            plain:
              expression: request
          x-auth-access-key-id:
            plain:
              expression: auth.identity.sub
          x-auth-descope-project-id:
            plain:
              expression: auth.identity.dpr
          x-auth-tenant-id:
            plain:
              expression: auth.identity.dct
          x-auth-tenant-rate-limit-plan:
            plain:
              expression: auth.identity.tenants[auth.identity.dct].roles[0]

TelemetryPolicy

apiVersion: extensions.kuadrant.io/v1alpha1
kind: TelemetryPolicy
metadata:
  name: descope
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: app
  metrics:
    default:
      labels:
        descope_project_id: auth.identity.dpr
        tenant_id: auth.identity.dct
        rate_limit_plan: auth.identity.tenants[auth.identity.dct].roles[0]

Envoy Proxy

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: kind
spec:
  # With mergeGateways: true, EnvoyPatchPolicy must target GatewayClass (see
  # kuadrant-authorino-cluster-patch.yaml). Per-Gateway EPP (e.g. from Kuadrant)
  # does not apply to the merged xDS snapshot.
  mergeGateways: true
  bootstrap:
    # Admin UI/API: curl http://127.0.0.1:9901/config_dump (hostNetwork binds to the node)
    type: JSONPatch
    jsonPatches:
      - op: replace
        path: /admin/address/socket_address/address
        value: 0.0.0.0
      - op: replace
        path: /admin/address/socket_address/port_value
        value: 9901
  provider:
    type: Kubernetes
    kubernetes:
      useListenerPortAsContainerPort: true
      envoyService:
        name: envoy-gateway-proxy
        type: ClusterIP
      envoyDeployment:
        name: envoy-proxy
        strategy:
          type: Recreate
        patch:
          value:
            spec:
              template:
                spec:
                  hostNetwork: true
                  dnsPolicy: ClusterFirstWithHostNet
                  affinity:
                    nodeAffinity:
                      requiredDuringSchedulingIgnoredDuringExecution:
                        nodeSelectorTerms:
                          - matchExpressions:
                              - key: node-role.cluster.local/control-plane
                                operator: Exists
                  containers:
                    - name: envoy
                      ports:
                        - name: admin
                          containerPort: 9901
                          protocol: TCP

Error

2026-05-06T14:34:08Z    ERROR    authorino.service.auth.authpipeline    failed to parse CEL expression    {"request id": "6f609584-77c2-42b8-b398-7832a8af74ae", "expression": "Expression { expression: IdedExpr { i
d: 3, expr: Select(SelectExpr { operand: IdedExpr { id: 2, expr: Select(SelectExpr { operand: IdedExpr { id: 1, expr: Ident(\"auth\") }, field: \"identity\", test: false }) }, field: \"dct\", test: false }) }, att
ributes: [Attribute { path: [\"auth\", \"identity\", \"dct\"] }], extended: false }", "error": "ERROR: <input>:1:12: undeclared reference to 'Expression' (in container '')\n | Expression { expression: IdedExpr { i
d: 3, expr: Select(SelectExpr { operand: IdedExpr { id: 2, expr: Select(SelectExpr { operand: IdedExpr { id: 1, expr: Ident(\"auth\") }, field: \"identity\", test: false }) }, field: \"dct\", test: false }) }, att
ributes: [Attribute { path: [\"auth\", \"identity\", \"dct\"] }], extended: false }\n | ...........^"}
github.com/kuadrant/authorino/pkg/service.(*AuthPipeline).metricLabels
    /usr/src/authorino/pkg/service/auth_pipeline.go:542
github.com/kuadrant/authorino/pkg/service.(*AuthPipeline).reportStatusMetric
    /usr/src/authorino/pkg/service/auth_pipeline.go:512
github.com/kuadrant/authorino/pkg/service.(*AuthPipeline).Evaluate.func1.1
    /usr/src/authorino/pkg/service/auth_pipeline.go:501
github.com/kuadrant/authorino/pkg/metrics.ReportTimedMetric
    /usr/src/authorino/pkg/metrics/metrics.go:202
github.com/kuadrant/authorino/pkg/service.(*AuthPipeline).Evaluate.func1
    /usr/src/authorino/pkg/service/auth_pipeline.go:505

[guicassolato]

I'm not entirely sure, but this smells like a bug in the kuadrant/wasm-shim and how it injects the metric label defs into the io.kuadrant.metrics.labels filter metadata for the ext_authz request.

I've seen this in the past where the stringified AST is injected instead of the CEL expression to compile and evaluate against the Authorization JSON.

cc @adam-cattermole @alexsnaps

[alexsnaps]

I'll make sure we look into this asap! Thanks for the report 🙏

[alexsnaps]

See this thread #Extensibility > BUG: TelemetryPolicy labels null too probably

[betterthanbot]

Hitting the same class of bug on a different (non-JWT) setup — Red Hat OpenShift AI 3.4's Models-as-a-Service feature, which generates a TelemetryPolicy targeting auth.identity.* fields (userid, selected_subscription, group, subscription_info.costCenter, subscription_info.organizationId) via API-key auth rather than JWT claims. Same metricLabels code path, same "no such key" failure mode, just different field names/

Versions: Authorino 1.4.2, via rhcl-operator.v1.4.2 (Red Hat Connectivity Link / downstream Kuadrant build), OpenShift AI 3.4.2.