hasParamKind:             false,
			exceedBudget:             false,
			testRuntimeCELCostBudget: 6,
			expectRemainingBudget:    pointer.Int64(0),
		},
		{
			name: "With StrictCostEnforcementForVAP enabled: expression exceed RuntimeCELCostBudget at fist expression",
			validations: []ExpressionAccessor{
				&condition{
					Expression: "!authorizer.group('').resource('endpoints').check('create').allowed()",

	// The strict cost is specific for the extended libraries whose cost defined under k8s/apiserver/pkg/cel/library.
	StrictCostEnforcementForVAP featuregate.Feature = "StrictCostEnforcementForVAP"

	// owner: @cici37
	// alpha: v1.30
	//
	// StrictCostEnforcementForWebhooks is used to apply strict CEL cost validation for matchConditions in Webhooks.

}

func compilePolicy(policy *Policy) Validator {
	hasParam := false
	if policy.Spec.ParamKind != nil {
		hasParam = true
	}
	strictCost := utilfeature.DefaultFeatureGate.Enabled(features.StrictCostEnforcementForVAP)
	optionalVars := cel.OptionalVariableDeclarations{HasParams: hasParam, HasAuthorizer: true, StrictCost: strictCost}

			continue
		}
		options := plugincel.OptionalVariableDeclarations{
			HasParams:     ctx.paramDeclType != nil,
			HasAuthorizer: true,
			StrictCost:    utilfeature.DefaultFeatureGate.Enabled(features.StrictCostEnforcementForVAP),
		}
		compiler.CompileAndStoreVariables(convertv1beta1Variables(ctx.variables), options, environment.StoredExpressions)

	return validateValidatingAdmissionPolicy(p, validationOptions{ignoreMatchConditions: false, strictCostEnforcement: utilfeature.DefaultFeatureGate.Enabled(features.StrictCostEnforcementForVAP)})
}

func validateValidatingAdmissionPolicy(p *admissionregistration.ValidatingAdmissionPolicy, opts validationOptions) field.ErrorList {

	genericfeatures.StorageVersionAPI: {Default: false, PreRelease: featuregate.Alpha},

	genericfeatures.StorageVersionHash: {Default: true, PreRelease: featuregate.Beta},

	genericfeatures.StrictCostEnforcementForVAP: {Default: false, PreRelease: featuregate.Beta},

	genericfeatures.StrictCostEnforcementForWebhooks: {Default: false, PreRelease: featuregate.Beta},

### API Change

			expectedError: `undeclared reference to 'test'`,
		},
		// TODO: CustomAuditAnnotations: string valueExpression with {oldObject} is allowed
	}
	strictCost := utilfeature.DefaultFeatureGate.Enabled(features.StrictCostEnforcementForVAP)
	// Include the test library, which includes the test() function in the storage environment during test
	base := environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), strictCost)

## Changelog since v1.30.1

## Changes by Kind

### API Change