refactor: migrate gorilla/mux to net/http ServeMux

[shivansh-gohem]

This migrates the operator HTTP API from gorilla/mux to the standard library http.ServeMux with Go 1.22 routing features. This eliminates the deprecated dependency github.com/gorilla/mux and replaces otelmux with otelhttp as requested in kubescape/kubescape#3620.

Summary by CodeRabbit

• Refactor
  • Updated HTTP request handling to use the standard library, supporting more consistent endpoint behavior.
  • Preserved request tracing for the /v1/triggerAction endpoint.
  • Continued supporting the OpenAPI documentation interface for GET requests.
  • Existing API routes and documentation access remain available without changes to their public interfaces.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d9fd4d13-dd5a-4532-8482-a78cd7512450

📥 Commits

Reviewing files that changed from the base of the PR and between f7e57f8 and bf4d343.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• go.mod
• restapihandler/restapi.go

💤 Files with no reviewable changes (1)

• restapihandler/restapi.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The REST API handler migrated from Gorilla mux to http.ServeMux. The triggerAction route now uses otelhttp.NewHandler, and the OpenAPI route uses an explicit GET pattern.

Changes

HTTP routing migration

Layer / File(s)	Summary
ServeMux routing and instrumentation restapihandler/restapi.go, go.mod	The handler replaces Gorilla mux with http.ServeMux. The triggerAction route uses otelhttp.NewHandler with the triggerAction span name. The OpenAPI route uses an explicit GET pattern. Module dependencies now directly include otelhttp; Gorilla mux remains indirect.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🔵 Low · up to bf4d3

The routing migration is otherwise localized, but removing the gorilla/mux module entry while it remains transitively required could cause dependency-resolution or downstream build failures. Retain it as an indirect dependency before merging.

Suggested reviewers: matthyx

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: migrating routing from gorilla/mux to the standard library net/http ServeMux.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[matthyx]

The routing migration itself looks correct: docs.OpenAPIV2Prefix is "/openapi/v2/" (trailing slash), so rtr.Handle("GET "+docs.OpenAPIV2Prefix, ...) still gets Go 1.22 subtree matching, preserving the old PathPrefix(...).Methods("GET") behavior for the swagger/redoc/rapidoc sub-paths. /v1/triggerAction stays an exact-match, all-methods route, matching the previous mux.HandleFunc semantics.

One blocker before this can merge though: go.mod wasn't updated. This PR removes the only usages of github.com/gorilla/mux and go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux in the repo, but both are still listed as direct requires in go.mod. Meanwhile go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp, which is newly imported directly in restapihandler/restapi.go, is still marked // indirect. Please run go mod tidy and commit the resulting go.mod/go.sum — as written, the PR doesn't actually "eliminate the deprecated dependency" it claims to (gorilla/mux stays in the module graph as an explicit dependency), and this will likely fail a go mod tidy --check style CI gate.

Minor nit: there's a stray blank line with trailing whitespace right after rtr := http.NewServeMux() — gofmt/whitespace linters will flag it.

Also worth a note (not blocking, per CodeRabbit): tracing used to wrap the whole router via rtr.Use(otelmux.Middleware(...)), so unmatched/404 requests were traced too. Now otelhttp.NewHandler is only applied per-registered-route, so unmatched paths lose tracing coverage. Bounded risk, but flagging in case that telemetry gap matters for this service.

[shivansh-gohem]

@matthyx ptal at this too

[matthyx]

Confirmed the fix: go.mod/go.sum are now properly tidied — gorilla/mux moved to indirect, otelmux removed entirely, otelhttp promoted to direct. The stray whitespace nit is gone too. Routing behavior is unchanged from the previous review (still correct). LGTM, approving.

[shivansh-gohem]

thanks @matthyx !!