Skip to content

Feat/beta prep ship - #92

Merged
chifu1234 merged 1 commit into
mainfrom
feat/beta-prep-ship
Aug 17, 2026
Merged

Feat/beta prep ship#92
chifu1234 merged 1 commit into
mainfrom
feat/beta-prep-ship

Conversation

@chifu1234

@chifu1234 chifu1234 commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Lands the beta-prep workstream on feat/beta-prep-ship:

  • Engines as git submodules under engines/ (modsecurity-proxy-wasm, pow-proxy-wasm)
  • API: remove WAFInstance; unified WAF with mode / status / printer columns; SecRuleIDPool
  • Operator: validating webhooks, allowedRules fix, finalizer cleanup, safe defaults, status rendering
  • Helm: chart 0.1.0-beta.1 with admission webhooks (self-signed CA)
  • Docs: product docs at kubewaf.io (separate website repo); monorepo root stubs only; Netlify monorepo stub removed
  • CI:
    • PR + main: Envoy Gateway smoke (test-e2e.yml)
    • PR + release gate: full matrix (test-e2e-release.yml — EG Path A/B FTW, Istio, Cilium)
    • Unit smoke installs envtest assets before controller Ginkgo suites
    • Helm chart install pins kindest/node:v1.32.2
    • CodeQL advanced setup: Go + Actions only (no c-cpp/python/JS from external trees)
  • Layout: drop in-tree website / headlamp-plugin / scaffold leftovers; engines remain gitlinks

Test plan

  • go test ./internal/... ./api/... (local)
  • make test-unit-smoke (envtest + critical packages)
  • EG smoke on CI (test-e2e.yml) for earlier HEAD
  • Full matrix on CI after push (test-e2e-release.yml)
  • Helm chart install CI (make helm-test / helm-test.yml)
  • Helm install quickstart with webhooks enabled (manual)

Notes

  • Breaking: WAFInstance removed in favor of unified WAF
  • Wasm for CI is pulled from public GHCR when engine sources are private
  • Disconnect the old Netlify site (kubewaf-doc) from this repo in the Netlify dashboard so deploy-preview checks stop failing
  • If default CodeQL setup is still enabled under Settings → Code security, switch it off (or to advanced) so only .github/workflows/codeql.yml runs
  • headlamp-plugin/ remains a dedicated-repo follow-up; path is gitignored for local side-by-side checkouts
  • Submodule worktrees may show dirty locally; pins are in .gitmodules / gitlinks

Commits

See git log main..feat/beta-prep-ship --oneline

@netlify

netlify Bot commented Jul 30, 2026

Copy link
Copy Markdown

Deploy Preview for kubewaf-doc failed.

Name Link
🔨 Latest commit 09ae90b
🔍 Latest deploy log https://app.netlify.com/projects/kubewaf-doc/deploys/6a6c4fa2159e3e00084baeed

Comment thread .github/workflows/test-e2e-release.yml Fixed
Comment thread .github/workflows/test-e2e-release.yml Fixed
Comment thread .github/workflows/test-e2e-release.yml Fixed
Comment thread .github/workflows/test-e2e-release.yml Fixed
Comment thread .github/workflows/test-e2e-release.yml Fixed
Comment thread .github/workflows/test-e2e-release.yml Fixed
Comment thread .github/workflows/test-e2e-release.yml Fixed
Comment thread .github/workflows/test-e2e.yml Fixed
@chifu1234
chifu1234 force-pushed the feat/beta-prep-ship branch from 74d7b43 to ee81722 Compare July 31, 2026 12:18
curl -Lo ./kind "https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-$(go env GOARCH)"
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
- uses: azure/setup-helm@v4
- uses: azure/setup-helm@v4
with:
version: v3.15.3
- uses: azure/setup-kubectl@v4
curl -Lo ./kind "https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-$(go env GOARCH)"
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
- uses: azure/setup-helm@v4
- uses: azure/setup-helm@v4
with:
version: v3.15.3
- uses: azure/setup-kubectl@v4
curl -Lo ./kind "https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-$(go env GOARCH)"
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
- uses: azure/setup-helm@v4
- uses: azure/setup-helm@v4
with:
version: v3.15.3
- uses: azure/setup-kubectl@v4
curl -Lo ./kind "https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-$(go env GOARCH)"
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
- uses: azure/setup-helm@v4
Comment thread .github/workflows/test-e2e-release.yml Fixed
- name: Verify helm installation
run: helm version
- name: Install kubectl
uses: azure/setup-kubectl@v4
- uses: azure/setup-helm@v4
with:
version: v3.15.3
- uses: azure/setup-kubectl@v4
First public beta-candidate packaging: shared build/publish pipeline,
PhraseList/IPList data-file inject, subresource probe API, Cilium remesh
without injecting an OTel access log into CEC, and fail-closed ECDS
publish when RuleSet or SecLang refs are unresolved.
@chifu1234
chifu1234 force-pushed the feat/beta-prep-ship branch from f827b16 to 0ffd5e6 Compare August 17, 2026 19:23
@chifu1234
chifu1234 merged commit 1dd7794 into main Aug 17, 2026
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants