rikatz

Adversarial Review: yaml-conformance-options Branch

Summary Verdict

This code should not be merged as-is. There is one critical correctness bug in TimeoutConfig.UnmarshalJSON that will cause silent data loss for valid YAML inputs, a behavioral regression for programmatic ConformanceOptions callers around Mode defaults, and several less severe issues around flag-append semantics, global test state mutation, and missing test coverage. The architectural direction is sound — separating configurable options from infrastructure options and supporting YAML configuration is a good move — but the implementation has gaps that need to be closed before merge.

---

Critical Findings

rikatz

FROM fedora:43

ARG USER_UID=1001

RUN dnf -y install unzip git \
    && curl -fsSL https://cli.coderabbit.ai/install.sh > /tmp/coderabbit.sh \
    && /bin/sh  /tmp/coderabbit.sh \
    && mv $HOME/.local/bin/coderabbit /bin/coderabbit \
    && git config --system --add safe.directory /workdir \
    && useradd -u ${USER_UID} -m coderabbit \

rikatz

diff --git a/pilot/docker/Dockerfile.pilot b/pilot/docker/Dockerfile.pilot
index e5d6bca10c..62bdf954bc 100644
--- a/pilot/docker/Dockerfile.pilot
+++ b/pilot/docker/Dockerfile.pilot
@@ -8,6 +8,9 @@ ARG ISTIO_BASE_REGISTRY=gcr.io/istio-release
 # The following section is used as base image if BASE_DISTRIBUTION=debug
 FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION} AS debug
 
+FROM golang:1.25 AS dlv
+RUN go install github.com/go-delve/delve/cmd/dlv@latest

rikatz

Simple script to create a KinD cluster ready for Gateway API conformance test

Remember to:

• Change the address on metallb IPAddressPool to the right range
• Bump versions as required

Call it with: ./gwapi.sh BACKEND

being backend:

rikatz

package main

import (
	"encoding/json"
	"fmt"

	crossplane "github.com/nginxinc/nginx-go-crossplane"
)

func main() {

rikatz

For the default backend, apparently it is using proxy_protocol. Proxy is not implemented yet, as NGINX does not support setting proxy using a variable.

Probably need to create 2 segregated internal listeners, one with proxy and one without it.

Maybe, if I can already pass inside what backend should be used (a dynamic variable with the script loaded globally? otherwise will have to query the shared map twice)

rikatz

package main

import (
	"flag"
	"log"
	"net"

	"github.com/davecgh/go-spew/spew"
	"github.com/insomniacslk/dhcp/dhcpv4"
	client4 "github.com/insomniacslk/dhcp/dhcpv4/client4"

rikatz

package main

import (
	"context"
	"encoding/base64"
	"flag"
	"fmt"
	"log"
	"math/rand"
	"time"

rikatz

iptables-xml
ldd /usr/bin/iptables-xml
	linux-vdso.so.1 (0x00007fff2c394000)
	libip4tc.so.2 => /usr/lib/x86_64-linux-gnu/libip4tc.so.2 (0x00007f5f0316c000)
	libip6tc.so.2 => /usr/lib/x86_64-linux-gnu/libip6tc.so.2 (0x00007f5f03162000)
	libxtables.so.12 => /usr/lib/x86_64-linux-gnu/libxtables.so.12 (0x00007f5f0314f000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5f02f8a000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f5f02f84000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f5f031fb000)
  

rikatz

{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",