Remove unwanted configs

[thivindu]

This pull request introduces important improvements to configuration defaults and security for the gateway, focusing on safer out-of-the-box settings, improved config handling, and better test coverage. The main changes include setting secure and sensible defaults for analytics and header masking, seeding config values even when not specified, and adding tests to ensure these behaviors.

• Resolves: [Task]: Remove unnecessary configs from gateway config.toml #2889

Configuration and Security Improvements:

• The default value for insecure_skip_verify is now set to true in both config-template.toml and the Go code, which means TLS certificate verification is skipped by default for control plane connections. This is typically for development or non-production use and should be reviewed for production deployments. [1] [2]
• Analytics are now enabled by default (enabled = true), and a placeholder Moesif application ID is set in the template to prompt operators to supply their real value. [1] [2]
• The default masked headers for traffic logging now include authorization, x-api-key, and x-jwt-assertion, providing better security by redacting sensitive information unless explicitly overridden.
• Default values for config keys referenced by policy definitions (such as policy_configurations.llm_cost_v1.pricing_file) are now seeded automatically, ensuring policies load correctly even if not specified in the config files. [1] [2]

Testing and Validation:

• Added a new test file, resolvable_defaults_test.go, to verify that the new config defaults are correctly applied and that operator-supplied overrides take precedence.

These changes help ensure more secure and reliable default behavior, reduce misconfiguration risk, and improve the maintainability of the gateway’s configuration system.

[coderabbitai]

📝 Walkthrough

Walkthrough

Gateway configuration defaults were updated for control-plane verification, analytics, Moesif application identification, traffic-log masking, and LLM pricing resolution. Runtime tests verify seeded defaults and operator overrides, while the sample configuration removes obsolete sections.

Changes

Gateway configuration defaults

Layer / File(s)	Summary
Configuration templates and controller defaults gateway/configs/config-template.toml, gateway/configs/config.toml, gateway/gateway-controller/pkg/config/config.go	Control-plane verification defaults to enabled, analytics is enabled in the template, Moesif uses an application-ID placeholder, and obsolete configuration blocks are removed.
Runtime resolvable defaults gateway/gateway-runtime/policy-engine/internal/config/config.go	Policy-engine loading seeds the LLM pricing path and default traffic-log masked headers, while preserving explicit operator values.
Default resolution tests gateway/gateway-runtime/policy-engine/internal/config/resolvable_defaults_test.go	Tests verify seeded pricing and masking defaults and explicit configuration overrides.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• wso2/api-platform#2761: Related configuration interpolation and default application changes in the same gateway config-loading paths.
• wso2/api-platform#2877: Related changes to policy-engine Load behavior and layered configuration handling.

Suggested reviewers: renuka-fernando, krishanx92, virajsalaka, tgtshanika, malinthaprasan

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the main changes, but it does not follow the required template and is missing most mandated sections.	Add the template sections: Purpose, Goals, Approach, User stories, Documentation, Automation tests, Security checks, Samples, Related PRs, and Test environment.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and related to the config cleanup aspect of the change, though it omits the broader defaults and test updates.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thivindu]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@gateway/configs/config-template.toml`:
- Line 392: Update the analytics publisher defaults at the referenced enabled
settings to disabled, so fresh deployments do not activate Moesif without
explicit operator opt-in and a valid application ID. Apply the same change to
the additional analytics setting noted in the comment.
- Line 57: Set the control-plane TLS verification fallback to false in
gateway/configs/config-template.toml at lines 57-57, and update the
corresponding runtime default in gateway/gateway-controller/pkg/config/config.go
at lines 880-880 to false. Preserve true only when explicitly configured for
development or testing.

In `@gateway/gateway-runtime/policy-engine/internal/config/config.go`:
- Around line 465-474: Update defaultMaskedHeaders in
gateway/gateway-runtime/policy-engine/internal/config/config.go (lines 465-474)
to preserve an immutable denylist containing authorization, x-api-key,
x-jwt-assertion, cookie, and set-cookie while unioning operator-configured
headers rather than replacing mandatory entries. In
gateway/gateway-runtime/policy-engine/internal/config/resolvable_defaults_test.go
(lines 41-44), assert the required header names explicitly; in lines 63-79,
verify operator values are additive and cannot remove mandatory masking.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f12d9a92-558f-4999-b0c7-9c06850923cb

📥 Commits

Reviewing files that changed from the base of the PR and between f4de02b and a0260b0.

📒 Files selected for processing (5)

• gateway/configs/config-template.toml
• gateway/configs/config.toml
• gateway/gateway-controller/pkg/config/config.go
• gateway/gateway-runtime/policy-engine/internal/config/config.go
• gateway/gateway-runtime/policy-engine/internal/config/resolvable_defaults_test.go

💤 Files with no reviewable changes (1)

• gateway/configs/config.toml