►
From YouTube: Hands-on WASM filters and singletons - Emmanuel Mayssat
Description
Hands-on WASM filters and singletons - Emmanuel Mayssat
In this presentation, Emmanuel will start by introducing the basics of WASM extensions, but will quickly move on to his project of developing a custom authz/authn with WASM. He will talk about his decision making process and introduce his development environments on k8s and docker-compose. He will be covering his software architecture, such as the use of a singleton stack and chained WASM filters. Covered topics also includes WASM bytecode download (LDS), policy download, prometheus metrics, library integration, data sharing, hidden headers, code testing, debugging technics, performance measurements for a real project! This presentation will also touch on practical issues such as programming languages choice (C++, rust, assembly script, tinyGo), learning curves, build pipelines, and development velocity (carvel/ytt)
A
A
A
A
He
was
a
c
plus
plus
expert
and
as
a
devops
I
thought
there
was
no
way
I
could
write
a
custom
filter,
but
you
know
what
you
can
do.
He
said
now
that
I'm
done
you
can
package
my
code
in
the
docker
image,
distribute
the
image
in
all
of
our
environment,
update
the
version
of
envoy
in
all
of
our
dev
staging
and
port
clusters,
and,
of
course,
as
a
devsecops
emanuel
do
not
forget
to
incorporate
patches
and
other
improvements
thanks.
A
A
A
A
A
I
got
started
with
web
assembly
simply
by
going
through
their
web
assembly
hub
tutorial
during
this
tutorial.
You
will
just
add
a
header
to
your
request,
but
also
you
will
be
introduced
to
the
wasm.
Cli
was
me
in
it
to
create
a
scaffold
or
bullet
plate
code
was
maybe
to
compile
your
code.
To
was
to
wasn't
file
was
me,
push
to
push
it
to
a
public
registry
called
webassembly
hub,
very
similar
to
docker
hub,
but
for
reason,
filter
and
finally,
once
you're
done
publishing
your
filter
to
deploy
it,
you
can
simply
use
usb
deploy.
A
A
Now,
if,
like
me,
you
are
curious
and
you
want
to
find
out
how
the
configuration
of
your
android
has
changed
during
the
deployment
of
your
filter.
You
can
simply
connect
to
the
device
admin
ui
to
do
so.
Keep
control
part
forward
to
the
pod
with
the
proxy.
You
won't
transrospect,
select
the
android
container
and
map
the
port
of
its
admin
interface
to
a
port
on
your
localhost.
A
The
configuration
snippet
on
this
slide
is
what
is
added
for
resin
filter.
This
ml
blob
may
seem
a
little
bit
complicated
to
those
of
you
who
are
new
to
android,
but
essentially
to
configure
and
filter.
You
need
to
provide
a
runtime
here,
it's
runtime
v8
and
the
location
of
usm
by
code
here,
a
local
file.
A
Now,
as
described
earlier,
to
use
your
filter
on
kubernetes.
You
need
to
compile
your
filter
locally
package.
It
push
it
webassembly
here,
deploy
it
with
the
crd
and
wait
for
the
deployment
to
complete.
This
workflow
is
awesome,
but
is
way
too
slow
for
development
purpose
for
the
development
of
your
filter.
You
need
a
much
faster
turnaround.
A
A
To
find
the
answer
to
that
question
and
develop
my
authorization
filter,
I
started
iterating,
I
iterated
I
experimented.
I
read
the
available
the
available
but
limited
documentation.
I
went
online
trying
to
find
examples.
I
looked
at
the
source
code
and
occasionally
reached
out
on
slack
to
select
people.
A
A
A
A
A
A
A
Now,
instead
of
having
to
deal
with
lengthy
unending,
confusing
ml
files,
you
can
work
at
the
level
of
components
such
as
individual
filters
or
even
group
of
components
such
as
group
of
filters.
By
far
in
this
project,
ytt
is
a
common
line
utility
that
gave
me
the
most
productivity
boost
check
it
out
a
word
about
programming
language.
You
can
use
with
proxy
with
them.
One
of
the
promise
of
proxy
wasm
is
to
allow
the
programming
of
android
extension
with
non-c
plus
plus
programming
languages.
A
A
A
After
experimenting
with
it,
I
was
immediately
confronted
with
a
limited
number
of
library.
Therefore
it
is
my
opinion
that
I
assembly
script
is
not
yet
made
for
proxy
wizard
just
yet,
then
you
have
rust
like
assembly
script.
Rust
itself
is
relatively
new
programming
language
and
I
thought
rust
has
very
strong
potential.
A
A
A
Regardless
of
the
primary
language
you
choose,
you
will
have
to
understand
the
application
binary
interface,
your
compile
code,
usm
extension,
is
running
in
a
wasm
sandbox,
an
interface
with
android.
Using
this
api,
you
can
find
the
description
of
the
api
in
the
software
development
kit
of
your
chosen
programming
language.
A
You
can
think
of
your
wealth
extension
as
a
library
that
needs
to
implement
a
given
set
of
functions
or
methods
that
android
thread
recall.
For
example,
when
you
bootstrap
envoy,
the
wasm
sandbox
also
starts
the
onstart
method
is
called
likewise
when
request
is
processed
by
the
listener
to
which
your
filter
is
attached.
A
A
If
you
want
to
introspect
the
request,
headers
read,
write
in
memory,
execute
an
external
http
call.
You
will
need
to
call
foreign
functions
to
illustrate
with
my
authorization
project.
I
use
the
get
request.
Header
function
on
the
authorization
header
to
extract
the
authorization
header
to
find
out
its
content.
A
A
I
am
sure
several
of
you
have
had
some
exposure
to
bezel,
because
better,
as
it
turns
out,
is
also
used
to
build
and
compile
envoy
for
those
of
you
who
are
new
to
bazel.
There
are
two
concepts
or
files
that
are
important.
First,
the
workspace
file.
This
is
where
you
define
all
of
your
external
dependencies
and
how
to
import
them
in
the
workspace
file
for
uc,
plus
plus
resume
extension,
you
will
need
at
the
minimum
to
import
the
unscripted
compiler
and
to
chain
require
to
compile
c
plus
plus,
to
run
in
the
v8
and
two.
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
So
what's
next,
the
end
of
this
presentation
is
still
to
be
written,
but
besides
some
new
additional
requirement,
I
was
given
last
week,
solo
released
a
new
version
of
the
api
gateway
with
better
resume
support.
Additionally,
I
just
found
out
that
tetrads
as
you've
graded
that
gear
their
get
invoice
eli
to
build
in
rust,
a
filter
scaffold.
A
B
A
A
A
A
Envoys,
you
can
specify
some
command
line
parameters
such
as
component
logs,
so
this
is
really
on
the
command
line
of
invoice.
So
if
you
use
the
containers,
you
will
have
to
pass
this
as
as
the
common
parameters
to
the
android
process
itself,
and
you
can
specify
the
log
level
of
components
and
in
particular
there
is
a
component
for
always
and
filter,
which
is
called
wasm,
and
you
can
set
this.
This
android
component
called
wasm
to
the
level
debug
and
then
you
will.
A
A
Scaffold
to
develop
filters,
I'm
really
getting
started
with
this,
I'm
very
pleased
by
what
rust
provides
in
terms
of
the
developer
experience
and
I'm
really
looking
forward
to
it.
So
there
are
some,
you
don't
have
to
deal
with
bezel
anymore,
because
there
is
no.
There
is
cargo.
There
is
a
concept
of
traits.
You
have
also
tests
that
are
integrated
in
language
and
I'm
kind
of
experimenting
again
with
this.
A
Another
things
I
I
want
to
talk
about
is
about
performance,
and
it
turns
out
that
over
an
external
authorization
filter
such
as
opal
and
compared
to
a
wasm
filter
which
is
completely
compiled,
you
know
running
inside
envoy.
I
think
you
can
have
about
20
times
unpromoting
performance,
which
is
significant.
A
That
being
said
with
resume,
you
have
also
the
concept
of
runtime
and
I
talked
about
the
runtime.
The
whole
time
that
I've
been
using
was
mostly
the
v8
sandbox,
which
I
think
is
the
most
mature
to
date,
but
there
are
other
sandbox
that
are
coming
with
the
v8
sandbox
really
compared
to
native
filters.
You
can
get.
You
can
reach
approximately
40
of
the
performance
of
native
filters,
which
is
quite
significant,
but
some
new
type
of
runtime
are
on
the
way
where
you
will
be
able
to
get
even
closer
to
native
performance.
A
There
is
a
the
webvm
which,
with
with
which,
with
which
you
are,
you
will
be
expected
to
reach
about
ninety
percent,
ninety
percent,
the
performance
of
native
filters
and
new
vmware.
Basically,
you
are
using
the
wasa
sdk,
but
it's
actually
almost
compiling
into
into
one
board,
so
it's
quite
possible
in
the
future.
That
native
features
will
be
built
into
wasm
to
benefit
from
the
fact
that
you
can
bring
them
in
and
out,
based
on
the
configuration
of
the
filter
itself.
A
I
looked
at
at
performance
of
you
know
from
aurora
quest
performance.
As
I
said,
filters
was
on
the
request
path.
In
my
particular
case
right,
I
I
want
to
make
sure
I'm
getting
as
much
performance
as
possible,
as
you
have
seen
in
the
architecture
I
have
right
now.
I
have
several
features.
I
don't
know
if
it's
the
right
strategy
on
the
request
path,
at
least,
but
that's
something
I
will
have
to
to
to
find
out
and
the
way
I
I
do
it
or
anytime
to
do
it
is
by
using
fortune.
A
I
briefly
talked
about
this
and
to
try
to
to
experiment
with
the
architecture
of
the
system.
It
turns
out
that,
right
now,
instead
of
trying
to
improve
the
performance,
I've
been
trying
to
saturate
my
creator
filter.
That
slows
down
the
request
to
see
what
would
be
the
behavior
of
envoy
when
it's
being
saturated
and
that's
something
that
is
very
interesting
to
me
to
see
what
what
is
the
expected
behavior
of
envoy
itself,
with
wasm
with
wasanthi
working
on
on
getting
the
highest
performance
as
possible.
A
A
A
I
have
not
completed
the
work,
but
I
was
thinking.
Oh,
you
know
that
would
allow
us
to
migrate
from
our
custom
policies
to
something
that
is
more
open,
which
would
be
the
open
policy,
agent
or
rego
policies,
and
to
try
to
see
that's
a
way
to
do
the
transition.
But
if
you
work
also
with
a
function
as
a
service,
you
can
see
that
actually,
what
android
is
it's
really
invoking
functions
and
those
functions
are
actually
the
function.
That's
here
that
are
in
my
in
my
wasm
filter
and
in
the
space
of
functional.
B
A
Lots
of
work
is
being
done
there.
I
encourage
you
to
have
a
look
at
it
and
finally,
the
last
notes.
I
think
there
is,
as
I
said
envoy,
the
wasm
extension
has
been
merged
into
the
stream
on
envoy.
Even
so,
the
code
has
been
merged.
There
is
still
a
lot
of
work
in
terms
of
the
documentation
that
needs
to
happen.
There
is
no
documentation
there.