Measured: 2026-10-13
Latest measured source: HEAD 3c76e89 plus the working-tree changes in
ya-libinjection-rs/src/xss.rs, ya-libinjection-rs/src/bytes.rs,
ya-libinjection-rs/src/html5.rs, ya-libinjection-rs/src/sqli.rs,
ya-libinjection-rs/src/sqli/lexer.rs, and its Cargo.toml. The final YA
column includes the HTML and SQLi local fast paths.
The operator writes each renewed service account token into WasmPlugin.spec.pluginConfig.cache_token (coraza-kubernetes-operator/internal/controller/engine_controller_wasm_driver.go). Envoy includes the plugin configuration in the plugin key (envoy/source/extensions/common/wasm/plugin.cc), so a new token creates a new plugin root. Istio 1.30.3 strips its changing resource-version VM variable before forwarding the configuration, and Envoy keys the VM by its VM configuration and WASM bytes. With unchanged code and VM settings, successive roots share one worker VM.
The Coraza guest fixes are already deployed. The remaining fixes must release root-owned state without destroying state still used by another root on that VM. This plan is based on source inspection only; no process was run or measured.
| func BenchmarkFilterOnHttpRequestHeaders(b *testing.B) { | |
| shouldIntervene := true | |
| shouldLog := true | |
| config := fmt.Sprintf(`{ | |
| "directives_map": { | |
| "rs1": [ | |
| "SecRuleEngine On", | |
| "Include @demo-conf", | |
| "Include @crs-setup-conf", |
Add Envoy Dynamic Modules (.so shared libraries loaded via dlopen) as a third filter type in TrafficExtension, alongside WASM and Lua. Dynamic modules offer near-native performance with zero-copy data access but run unsandboxed in Envoy's process.
Go-control-plane v1.37.1 already includes DynamicModuleFilter, DynamicModuleNetworkFilter, DynamicModuleFilterPerRoute, and DynamicModuleConfig protos.
This code should not be merged as-is. There is one critical correctness bug in TimeoutConfig.UnmarshalJSON that will cause silent data loss for valid YAML inputs, a behavioral regression for programmatic ConformanceOptions callers around Mode defaults, and several less severe issues around flag-append semantics, global test state mutation, and missing test coverage. The architectural direction is sound — separating configurable options from infrastructure options and supporting YAML configuration is a good move — but the implementation has gaps that need to be closed before merge.
| FROM fedora:43 | |
| ARG USER_UID=1001 | |
| RUN dnf -y install unzip git \ | |
| && curl -fsSL https://cli.coderabbit.ai/install.sh > /tmp/coderabbit.sh \ | |
| && /bin/sh /tmp/coderabbit.sh \ | |
| && mv $HOME/.local/bin/coderabbit /bin/coderabbit \ | |
| && git config --system --add safe.directory /workdir \ | |
| && useradd -u ${USER_UID} -m coderabbit \ |
| diff --git a/pilot/docker/Dockerfile.pilot b/pilot/docker/Dockerfile.pilot | |
| index e5d6bca10c..62bdf954bc 100644 | |
| --- a/pilot/docker/Dockerfile.pilot | |
| +++ b/pilot/docker/Dockerfile.pilot | |
| @@ -8,6 +8,9 @@ ARG ISTIO_BASE_REGISTRY=gcr.io/istio-release | |
| # The following section is used as base image if BASE_DISTRIBUTION=debug | |
| FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION} AS debug | |
| +FROM golang:1.25 AS dlv | |
| +RUN go install github.com/go-delve/delve/cmd/dlv@latest |
Simple script to create a KinD cluster ready for Gateway API conformance test
Remember to:
Call it with: ./gwapi.sh BACKEND
being backend:
| package main | |
| import ( | |
| "encoding/json" | |
| "fmt" | |
| crossplane "github.com/nginxinc/nginx-go-crossplane" | |
| ) | |
| func main() { |
| For the default backend, apparently it is using proxy_protocol. Proxy is not implemented yet, as NGINX does not support setting proxy using a variable. | |
| Probably need to create 2 segregated internal listeners, one with proxy and one without it. | |
| Maybe, if I can already pass inside what backend should be used (a dynamic variable with the script loaded globally? otherwise will have to query the shared map twice) |