$ show apache/shenyu
Apache ShenYu is a production-grade, plugin-based API gateway and microservices proxy platform written in Java. The runtime gateway (shenyu-bootstrap, a Spring WebFlux application) ingests HTTP/HTTPS/WebSocket traffic and processes each exchange through an ordered chain of ShenyuPlugin implementations covering protocol translation (HTTP, gRPC, Apache Dubbo, SOFA, Tars, MQTT, TCP), security (sign, JWT, OAuth2, key-auth, cryptor, WAF), traffic management (rate limiting, resilience4j), caching, logging (Kafka, Elasticsearch, RocketMQ, console), request rewriting, mocking, and AI proxy/token limiting. Routing, selector, rule, and plugin data is not hardcoded; it is synchronized dynamically from the admin plane. The management plane is shenyu-admin, a Spring MVC/MyBatis application exposing roughly 40 REST controllers for managing plugins, selectors, rules, metadata, namespaces, app auth, users/roles/permissions, discovery, and configuration import/export. Persistence supports H2, MySQL, PostgreSQL, OpenGauss, and Oracle via MyBatis mappers, with upgrade SQL scripts under db/upgrade. Configuration changes flow from admin to gateways through WebSocket, HTTP long polling, ZooKeeper, Nacos, etcd, or Apollo listeners, all built on shared abstract data-changed-listener templates. Client SDK modules (shenyu-client-*) auto-register Spring MVC, Dubbo, gRPC, SOFA, Tars, and WebSocket APIs using annotation-based extractors and a Disruptor-based async publish pipeline; a Kubernetes controller reconciles ingress/gateway-api resources. The repository demonstrates strong craftsmanship: a Dubbo-style SPI framework (@SPI/@Join/ExtensionLoader) drives pluggable match strategies, predicate judges, load balancers (Random, RoundRobin, LeastActive, P2C, ShortestResponse), cryptors, and rate limiter algorithms; shenyu-common contains a W-TinyLFU cache and memory-bounded queues that prevent OOM under burst; the admin uses domain events for audit logging and an observer pattern for Prometheus-driven auto-scaling. Testing is extensive (per-module unit tests, Spring Boot integration tests, Docker-Compose e2e suites, K8s examples). Main weaknesses are surface-area boilerplate across dozens of plugin modules, some experimental/placeholder code (WASM, AI, MCP), and a few disabled tests — typical for a large Apache project. Maintenance is active with recent commits, CodeQL scanning, and zero dependabot alerts; technical drift is low.
The LLM identified 5 files worth highlighting for reuse:
Dubbo-style SPI extension loader: interfaces marked @SPI are resolved to @Join-annotated implementations by name through a cached, classloader-aware lookup; supports singleton caching, ordering, and custom configuration loading. It is entirely self-contained (no imports from other ShenYu modules) and can be dropped into any JVM framework that needs pluggable strategies.
A memory-aware bounded blocking queue that caps not by element count but by an estimated heap limit (via MemoryLimitCalculator), with supplier-based max memory and configurable rejection handlers (DiscardPolicy, AbortPolicy, DiscardOldestPolicy). Solves a recurrent producer/consumer OOM problem in JVM gateways; standalone and reusable as a library class in any async Java project.
A ConcurrentHashMap-compatible cache implementing the W-TinyLFU admission policy — a frequency sketch plus a small window LRU feeding probation/protected segments — achieving better hit ratios than plain LRU under skewed access. Demonstrates non-trivial data-structure engineering and is reusable as a drop-in high-hit-rate cache for gateways, proxies, or any service needing bounded caching.
A generic facade over LMAX Disruptor used by the admin plane for asynchronous service-registration events. It exposes a producer API over a consumer executor model (DataEvent, OrderlyDataEvent, QueueConsumerExecutor) with ordered handling and thread-per-consumer semantics. Although used for client registration, the wrapper is protocol-agnostic and extractable for any high-throughput event pipeline.
SPI-marked load balancer contract with six pluggable implementations: Random, RoundRobin, Hash, LeastActive, P2C (power of two choices), and ShortestResponse, including weighted warm-up handling via a shared utility. Each strategy is a separate class behind the same interface, so the module can be extracted wholesale as a small load-balancing library for any RPC client, proxy, or gateway.