rikatz

FROM fedora:43

ARG USER_UID=1001

RUN dnf -y install unzip git \
    && curl -fsSL https://cli.coderabbit.ai/install.sh > /tmp/coderabbit.sh \
    && /bin/sh  /tmp/coderabbit.sh \
    && mv $HOME/.local/bin/coderabbit /bin/coderabbit \
    && git config --system --add safe.directory /workdir \
    && useradd -u ${USER_UID} -m coderabbit \

rikatz

Dynamic Modules Support for Istio TrafficExtension

Context

Add Envoy Dynamic Modules (.so shared libraries loaded via dlopen) as a third filter type in TrafficExtension, alongside WASM and Lua. Dynamic modules offer near-native performance with zero-copy data access but run unsandboxed in Envoy's process.

Go-control-plane v1.37.1 already includes DynamicModuleFilter, DynamicModuleNetworkFilter, DynamicModuleFilterPerRoute, and DynamicModuleConfig protos.

Design Decisions

rikatz

Simple script to create a KinD cluster ready for Gateway API conformance test

Remember to:

• Change the address on metallb IPAddressPool to the right range
• Bump versions as required

Call it with: ./gwapi.sh BACKEND

being backend:

rikatz

Adversarial Review: yaml-conformance-options Branch

Summary Verdict

This code should not be merged as-is. There is one critical correctness bug in TimeoutConfig.UnmarshalJSON that will cause silent data loss for valid YAML inputs, a behavioral regression for programmatic ConformanceOptions callers around Mode defaults, and several less severe issues around flag-append semantics, global test state mutation, and missing test coverage. The architectural direction is sound — separating configurable options from infrastructure options and supporting YAML configuration is a good move — but the implementation has gaps that need to be closed before merge.

---

Critical Findings

rikatz

diff --git a/pilot/docker/Dockerfile.pilot b/pilot/docker/Dockerfile.pilot
index e5d6bca10c..62bdf954bc 100644
--- a/pilot/docker/Dockerfile.pilot
+++ b/pilot/docker/Dockerfile.pilot
@@ -8,6 +8,9 @@ ARG ISTIO_BASE_REGISTRY=gcr.io/istio-release
 # The following section is used as base image if BASE_DISTRIBUTION=debug
 FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION} AS debug
 
+FROM golang:1.25 AS dlv
+RUN go install github.com/go-delve/delve/cmd/dlv@latest

rikatz

package main

import (
	"encoding/json"
	"fmt"

	crossplane "github.com/nginxinc/nginx-go-crossplane"
)

func main() {

rikatz

{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",

rikatz

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: metricbeat-config
  namespace: kube-system
  labels:
    k8s-app: metricbeat
data:
  metricbeat.yml: |-

rikatz

For the default backend, apparently it is using proxy_protocol. Proxy is not implemented yet, as NGINX does not support setting proxy using a variable.

Probably need to create 2 segregated internal listeners, one with proxy and one without it.

Maybe, if I can already pass inside what backend should be used (a dynamic variable with the script loaded globally? otherwise will have to query the shared map twice)

rikatz

package main

import (
	"flag"
	"log"
	"net"

	"github.com/davecgh/go-spew/spew"
	"github.com/insomniacslk/dhcp/dhcpv4"
	client4 "github.com/insomniacslk/dhcp/dhcpv4/client4"