From 346f288c32d95afbb4397989d9f2f6225f2bc8e7 Mon Sep 17 00:00:00 2001 From: Roshan Singh <35294369+lopster568@users.noreply.github.com> Date: Wed, 5 Aug 2026 19:05:18 +0530 Subject: [PATCH] docs: Clarify glob.match indexing requirements (#8935) ### Why the changes in this PR are needed? The rule indexing docs say the indexer recognizes the normal `*` operator, but two further conditions gate indexing and neither is documented: the `*` must form a complete delimiter-separated segment, and a `null` delimiter is never indexed. Policies that follow the documented rule can silently miss the index fast path. Fixes #8209 ### What are the changes in this PR? Docs only. Three sentences and three rows added to the "Glob statements" section of `docs/docs/policy-performance.md`. The other table rows are unchanged apart from pipe realignment, which markdownlint requires because the new row is wider than the column. ### Notes to assist PR review: Behavior confirmed against `globPatternToArray`, `globDelimiterToString`, and `splitStringEscaped` in `v1/ast/index.go`. ### Further comments: None. --------- Signed-off-by: Roshan --- docs/docs/policy-performance.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/docs/policy-performance.md b/docs/docs/policy-performance.md index 15a75cb7a3..04ced53c58 100644 --- a/docs/docs/policy-performance.md +++ b/docs/docs/policy-performance.md @@ -135,13 +135,16 @@ For simple equality statements (`=` and `==`) to be indexed one side must be a n #### Glob statements -For `glob.match(pattern, delimiter, match)` statements to be indexed the pattern must be recognized by the indexer and the match be a non-nested reference that does not contain any variables. The indexer recognizes patterns containing the normal glob (`*`) operator but not the super glob (`**`) or character pattern matching operators. +For `glob.match(pattern, delimiter, match)` statements to be indexed the pattern must be recognized by the indexer and the match be a non-nested reference that does not contain any variables. The indexer recognizes patterns containing the normal glob (`*`) operator but not the super glob (`**`) or character pattern matching operators. The `*` operator is only recognized when it forms a complete delimiter-separated segment of the pattern; for example, `"a*"` with delimiter `[":"]` is not indexed because the `*` is embedded in a larger segment. When several delimiters are given, any of them separates a segment. Statements that pass `null` as the delimiter are never indexed. -| Expression | Indexed | Notes | -| -------------------------------------------- | ------- | -------------------------- | -| `glob.match("foo:*:bar", [":"], input.x)` | yes | | -| `glob.match("foo:**:bar", [":"], input.x)` | no | pattern contains `**` | -| `glob.match("foo:*:bar", [":"], input.x[i])` | no | match contains variable(s) | +| Expression | Indexed | Notes | +| ---------------------------------------------- | ------- | -------------------------- | +| `glob.match("foo:*:bar", [":"], input.x)` | yes | | +| `glob.match("foo:**:bar", [":"], input.x)` | no | pattern contains `**` | +| `glob.match("foo:*:bar", [":"], input.x[i])` | no | match contains variable(s) | +| `glob.match("a*", [":"], input.x)` | no | `*` embedded in a segment | +| `glob.match("foo:*/bar", [":", "/"], input.x)` | yes | any delimiter separates | +| `glob.match("foo:*:bar", null, input.x)` | no | delimiter is `null` | #### Membership (`in`) statements