optimize header parsing and add early return in ruleAppliesToContext

[YakirOren]

Summary by CodeRabbit

• Bug Fixes

  • Corrected AWS provider detection.
  • Improved rule context matching to avoid incorrect matches.
  • Stopped including pod labels in rule evaluation data.

• Performance / Refactor

  • More efficient HTTP request/response parsing to reduce memory usage and avoid full body reads.
  • Reduced allocations in rule evaluation and label parsing; adjusted map pooling for lower initial capacity.

• Chores

  • Bumped several dependencies to newer versions.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

HTTP parsing now detects header/body boundaries and assigns bodies by slicing raw data; CEL evaluation reuses a single prebuilt input map; rule context matching short-circuits on matching "context:" tags; maps are preallocated or pool sizes adjusted; dependency versions and a provider constant reference updated; podLabels assignment removed.

Changes

Cohort / File(s)	Summary
HTTP Parsing Optimization pkg/containerwatcher/v2/tracers/httpparse.go	ParseHttpRequest and ParseHttpResponse now locate the header/body boundary, parse headers only, and set the body by slicing the original data (avoiding full body reads and re-reads). ContentLength and related header handling updated accordingly; fallback to prior read paths retained on boundary parse failure.
CEL Evaluation Context pkg/rulemanager/cel/cel.go	EvaluateRule precomputes obj and eventType once, reuses a single input map for all expression evaluations, and increases evalContextPool new-capacity from 1 to 2 to reduce allocations.
Rule Context Matching pkg/rulemanager/rulepolicy.go	RuleAppliesToContext simplified: uses a flag and short-circuits to return true on first matching context: tag, defaults to Kubernetes when no context: tags exist, otherwise returns false when tags exist but none match.
Map Initialization Optimization pkg/utils/labels.go	Builds result map with preallocated capacity len(pairs)/2, inlines assignment and trimming for key/value, preserves malformed-pair skipping and logging.
Memory Pool Adjustment pkg/rulemanager/ruleadapters/adapters/pool.go	Reduced map pool preallocation size from 32 to 5, changing initial capacity for acquired maps.
Adapter Label Removal pkg/rulemanager/ruleadapters/adapters/common.go	Removed runtime assignment of podLabels to the k8s map; left a commented placeholder instead.
Provider Constant Reference pkg/cloudmetadata/metadata.go	AWS enrichment check now compares against apitypes.ProviderAws instead of k8sInterfaceCloudMetadata.ProviderAWS.
Dependency Updates go.mod	Bumped armosec/armoapi-go v0.0.663 → v0.0.667 and kubescape/k8s-interface v0.0.200 → v0.0.202.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A rabbit's ode to optimization bright,
Headers trimmed once, bodies set just right,
Contexts reused and maps prefilled,
Pools tuned small, and refs fulfilled,
A hop, a tweak — performance takes flight.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 22.22% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes two of the main optimizations in the changeset: header parsing improvements in httpparse.go and the early return logic change in RuleAppliesToContext.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pkg/rulemanager/ruleadapters/adapters/pool.go (1)

5-10: Update the comment to match the new map capacity.

Line 6–7 still mention pre-allocating 32 entries, but Line 10 now allocates capacity 5. Please align the comment (or introduce a named constant).

📝 Suggested tweak

-// We pre-allocate a capacity of 32, which should be a reasonable starting point
+// We pre-allocate a capacity of 5, which should be a reasonable starting point
 // for the number of keys in your event maps.
 var mapPool = sync.Pool{
 	New: func() interface{} {
 		return make(map[string]interface{}, 5)
 	},
 }

[matthyx]

nice improvement for the HTTP body

[matthyx]

ok, we'll anyway remove the ToMap

[matthyx]

@YakirOren can you rebase and "sign off" your commits to make the DCO happy?

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pkg/rulemanager/ruleadapters/adapters/pool.go (1)

5-10: Update the capacity comment to match the new value.

Line 6 says “pre-allocate 32,” but Line 10 now allocates 5. Please align the comment with the actual capacity to avoid misleading future tuning.

🧹 Nitpick comments (1)

pkg/utils/labels.go (1)

11-13: Capacity hint likely under-allocates.

len(pairs)/2 will under-allocate for valid input (each pair yields at most one entry), which can increase allocations. Consider using len(pairs) or counting non-empty pairs first.

♻️ Suggested adjustment

- result := make(map[string]string, len(pairs)/2)
+ result := make(map[string]string, len(pairs))