rikatz

Coraza WASM memory growth: fix plan

Scope and source finding

The operator writes each renewed service account token into WasmPlugin.spec.pluginConfig.cache_token (coraza-kubernetes-operator/internal/controller/engine_controller_wasm_driver.go). Envoy includes the plugin configuration in the plugin key (envoy/source/extensions/common/wasm/plugin.cc), so a new token creates a new plugin root. Istio 1.30.3 strips its changing resource-version VM variable before forwarding the configuration, and Envoy keys the VM by its VM configuration and WASM bytes. With unchanged code and VM settings, successive roots share one worker VM.

The Coraza guest fixes are already deployed. The remaining fixes must release root-owned state without destroying state still used by another root on that VM. This plan is based on source inspection only; no process was run or measured.

1. Release Envoy timers when a root is deleted

rikatz

func BenchmarkFilterOnHttpRequestHeaders(b *testing.B) {
	shouldIntervene := true
	shouldLog := true

	config := fmt.Sprintf(`{
     "directives_map": {
         "rs1": [
		   "SecRuleEngine On",
           "Include @demo-conf",
           "Include @crs-setup-conf",

rikatz

Dynamic Modules Support for Istio TrafficExtension

Context

Add Envoy Dynamic Modules (.so shared libraries loaded via dlopen) as a third filter type in TrafficExtension, alongside WASM and Lua. Dynamic modules offer near-native performance with zero-copy data access but run unsandboxed in Envoy's process.

Go-control-plane v1.37.1 already includes DynamicModuleFilter, DynamicModuleNetworkFilter, DynamicModuleFilterPerRoute, and DynamicModuleConfig protos.

Design Decisions

rikatz

Adversarial Review: yaml-conformance-options Branch

Summary Verdict

This code should not be merged as-is. There is one critical correctness bug in TimeoutConfig.UnmarshalJSON that will cause silent data loss for valid YAML inputs, a behavioral regression for programmatic ConformanceOptions callers around Mode defaults, and several less severe issues around flag-append semantics, global test state mutation, and missing test coverage. The architectural direction is sound — separating configurable options from infrastructure options and supporting YAML configuration is a good move — but the implementation has gaps that need to be closed before merge.

---

Critical Findings

rikatz

FROM fedora:43

ARG USER_UID=1001

RUN dnf -y install unzip git \
    && curl -fsSL https://cli.coderabbit.ai/install.sh > /tmp/coderabbit.sh \
    && /bin/sh  /tmp/coderabbit.sh \
    && mv $HOME/.local/bin/coderabbit /bin/coderabbit \
    && git config --system --add safe.directory /workdir \
    && useradd -u ${USER_UID} -m coderabbit \

rikatz

diff --git a/pilot/docker/Dockerfile.pilot b/pilot/docker/Dockerfile.pilot
index e5d6bca10c..62bdf954bc 100644
--- a/pilot/docker/Dockerfile.pilot
+++ b/pilot/docker/Dockerfile.pilot
@@ -8,6 +8,9 @@ ARG ISTIO_BASE_REGISTRY=gcr.io/istio-release
 # The following section is used as base image if BASE_DISTRIBUTION=debug
 FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION} AS debug
 
+FROM golang:1.25 AS dlv
+RUN go install github.com/go-delve/delve/cmd/dlv@latest

rikatz

Simple script to create a KinD cluster ready for Gateway API conformance test

Remember to:

• Change the address on metallb IPAddressPool to the right range
• Bump versions as required

Call it with: ./gwapi.sh BACKEND

being backend:

rikatz

package main

import (
	"encoding/json"
	"fmt"

	crossplane "github.com/nginxinc/nginx-go-crossplane"
)

func main() {

rikatz

For the default backend, apparently it is using proxy_protocol. Proxy is not implemented yet, as NGINX does not support setting proxy using a variable.

Probably need to create 2 segregated internal listeners, one with proxy and one without it.

Maybe, if I can already pass inside what backend should be used (a dynamic variable with the script loaded globally? otherwise will have to query the shared map twice)

rikatz

package main

import (
	"flag"
	"log"
	"net"

	"github.com/davecgh/go-spew/spew"
	"github.com/insomniacslk/dhcp/dhcpv4"
	client4 "github.com/insomniacslk/dhcp/dhcpv4/client4"