►
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Extending Envoy Using WebAssembly (Wasm) - Daneyon Hansen, Tetrate
If you’ve ever wondered what WebAssembly (Wasm) is and how it works with Envoy, this session is for you. At the heart of Envoy lies a variety of filters that provide features such as network routing, observability, and security. Did you know that you can also write your own filters to extend Envoy functionality? In this session, you will learn about Envoy extensibility and the details of extending Envoy with Wasm.
A
A
I've
been
involved
with
various
cncf
projects,
contributor
maintainer
since
the
early
days
of
kubernetes
and
cncf,
but
today
I'm
here
to
talk
to
you
about
envoy
and
specifically
envoy
extensibility,
using
webassembly
or
wasm.
For
short,
you
know,
one
of
the
powerful
aspects
of
envoy
is
its
extensibility
and
envoy
provides
several
different
ways
to
be
extended.
A
If
you
know
c,
plus,
plus
that's
great,
if
the
filter
is
generalized
enough,
you
may
even
be
able
to
add
that
filter
to
the
native
envoy
filters.
But
if
it's
not,
then
you
have
to
maintain
that
filter
on
your
own,
and
you
have
to
maintain
that
envoy
binary
on
your
own,
because
you'd
have
to
go
ahead
and
you
would
take
the
envoy
source
code.
Add
your
filter
to
it
and
compile
it
with
your
filter
and
maintain
your
own
envoy
binary.
A
So
it's
a
binary
instruction
format
right.
So
it's
a
format
to
group
a
bunch
of
ones
and
zeroes
together
into
fields
that
can
be
interpreted
by
a
stack
based
virtual
machine
right,
so
stack
based
virtual
machine
will,
will
pull
and
put
values
onto
a
stack
and
wasm
says
that
it's
designed
to
be
poor.
A
portable
compilation
target
right,
so
you
could
go
ahead
and
you
can
write
a
wasm
module
in
the
language
of
your
choice
and
then
you
compile
it
into
the
swaza
module.
A
A
It's
safe,
so
the
wasm
module
actually
runs
inside
of
a
sandbox
called
a
wasm
vm
which
we'll
talk
about
in
more
detail,
and
so
the
the
wasm
vm
has
no
direct
access
to
the
host.
Any
type
of
access
is
done
through
apis
and
we'll
talk
about
those
apis
in
more
detail
in
future.
Slides
also-
and
I
mentioned
that
it
is
portable.
A
A
The
default
for
for
envoy
and,
as
we
know,
envoy,
has
a
multi-threading
model
architecture,
and
so
each
worker
thread
would
have
one
or
more
of
these
wasm
vms,
and
these
vms
would
be
created
if
you
create
an
a
filter
like
an
http
filter
or
a
network
filter
that
you
want
to
provide
this
additional
customized
logic
using
wasm,
but
there's
also
a
vm
that
can
run
in
the
main
thread,
and
this
is
called
a
singleton
vm.
So
one
of
these
vms
that
runs
in
the
main
thread-
that's
responsible
for
more.
A
A
And
instead
of
using
this
low-level
standard,
abi
proxy
wasm
also
supports
several
different
sdks
language.
Specific
sdks
like
rust,
go
and
the
go.
Sdk
is
what
I'm
gonna
go
ahead
and
demonstrate
later
on.
In
today's
talk
and
those
sdks
provide
the
functions,
the
callbacks
that
you
would
use
for.
Writing
your
wasm
modules.
A
A
They
can
be
collecting
metrics
and
then
storing
those
metrics
in
this
using
the
shared
data
api
and
the
wasm
service
extension
that
singleton
vm
can
periodically
go
ahead
and
pull
those
metrics
from
the
shared
data
and
then
again
export
those
or
vice
versa.
Right.
The
the
wasm
service
could
periodically
use
the
http
or
grpc
apis
to
make
external,
grpc
or
http
calls
and
then
store
that
data
in
shared
data
or
again,
with
a
message
queue.
A
And
so
this
wasm
capability
is,
is
managed
through
the
envoy
configuration
right
and
so
depending
on
whether
you're
creating
a
http
filter
or
a
network
filter
or
you're
using
the
wasm
singleton
service.
All
of
this
is
configured
through
the
envoy
configuration
and
one
of
the
key
aspects
of
that
configuration
you
tell
envoy.
Where
does
this
wasm
module
exist?
A
Now?
Just
like
you
know,
other
services
and
configuration
of
envoy,
you
could
have
a
control
plane
like
istio
and
use
xds
to
go
ahead
and
grab
that
configuration
extension,
configuration
or
ecds
is
a
service
that
can
be
used
to
to
manage
the
extension
configuration
and
instead
of
just
having
this
module
locally,
the
module
can
exist
remotely
and
and
again
part
of
this
configuration.
A
Well
and
here's
a
configuration
of
the
wasm
service
again,
there's
only
one
wasm
service
within
envoy.
That
runs
on
the
main
thread
and,
as
I
mentioned
right,
you
could
go
ahead
and
have
a
local
file
name
or
store
your
wasm
module
remotely
and
the
wasm
extension
right.
This
is
our
our
byte
code
that
the
webassembly
byte
code
that
was
compiled.
A
And
here's
one
of
the
key
parameters
is
a
singleton
true,
and
you
see
that
all
of
the
wasm
service
configuration
is
done
in
inside
the
bootstrap
extensions
and
there's
really
two
key
areas
of
this
configuration
right.
There's
configuration
of
the
vm
itself
and
you
see
here
where
we're
specifying
the
v8
runtime
and
again
the
v8
runtime
is
the
default
run
runtime
for
for
envoy,
and
we
specify
where
that
module
exists
along
with
this
other
configuration.
A
A
A
A
Pull
this
up,
so
here
is
the
repo
where
I
am.
I
am
hosting
the
demo
and
instead
of
I
thought,
maybe
I'd
be
short
on
time.
So,
instead
of
going
through
each
step
of
the
demo,
I
went
ahead
and
kind
of
jumped
through
set
some
things
up
have
already
created
the
wasm
module,
we'll
talk
through
what
that
looks
like,
and
I
use
the
the
go
sdk,
because
that's
what
I
program
in,
but
in
the
proxy
wasm
repo
there's
links
to
all
the
other
sdks
language,
specific
sdks,
if
you
prefer
a
different
language.
A
A
So
what
we
define
here
is,
you
know,
main
is
function
main.
Is
the
entry
point
into
a
go
program
and
it
calls
it
makes
a
call?
Oh
here
we
can
do
this.
Does
that
zoom
in
for
you
guys
as
well?
Okay,
cool
all
right
here
we
go
coming
up
with
solutions,
so
it
makes
a
call
to
the
the
proxy
wasm
set
vm
context.
A
A
So
the
vm
contacts,
as
I
men
mentioned
it's
responsible
for
creating
and
managing
plug-in
context,
and
you
have
a
plug-in
that
then
manages
your
filters
either
your
http
or
network
filters
which
are
represented
as
context
in
their
own,
and
so
we
have
a
context
id
and
in
the
demo,
we're
going
to
go
ahead
and
add
headers
for
for
responses
and
we're
also
going
to
take
advantage
of
the
the
counters,
the
the
counter
api
and
add
a
header
counter.
Every
time
we
we
see
a.
A
A
request:
not
only
are
we
going
to
add
the
headers,
but
we're
also
going
to
go
ahead
and
manage
a
counter.
Here's
our
plugin
context,
where
we
again
plumb
through
the
additional
headers
the
context
and
the
hello
header
counter,
and
so
this
this
hello
header
counter
what
it
will
do.
Is
it's
going
to
look
for
a
specific
header
key
and
based
on
that
key.
It
will
increment
the
counter
and
we'll
see
this
in
the
http
context.
A
We
go
ahead
and
log
a
critical
error.
If
there's
any
issues
loading
the
configuration
when
I
say
the
configuration
in
this
example,
I'm
going
to
run
envoy
locally
and
pass
through
this
envoy
config,
and
in
the
slide
that
I
showed
you
earlier,
there
was
no
configuration
that
was
being
added,
but
in
my
http
filter
you're,
going
to
see
that
I
actually
have
some
configuration
here
and
the
values
that
I'm
passing
in.
A
A
A
And
we
will
go
ahead
and
skip
any
any
configuration
that
has
a
comment
in
front
of
it,
but
what
we're
doing
is
is
we're
going
to
go
ahead
and
we're
going
to
we're
going
to
look
for
any
configuration
that
has
this
equals
value
separator
and
again.
If
we
go
back
to
the
envoy
yaml,
that's
exactly
what
our
configuration
does
so,
instead
of
actually
creating
any
of
these
values
within
the
code,
I'm
going
to
go
ahead
and
just
read
them
from
the
configuration.
A
If
the
request
header
includes
hello,
we
don't
care
about
the
value.
We
just
go
ahead
and
ignore
the
value
here.
If,
if
the,
if
the
request
header
right
so
we're
operating
on
a
request
header
here
for
this
http
context,
and
if
we
don't
find
the
the
hello
key,
we
don't
care
about
the
value.
But
if
we
don't
find
it
we'll
just
continue
right.
We
don't
want
to.
You,
know,
drop
the
connection
or
or
drop
the
request.
Anything
like
that.
A
We'll
just
continue,
but
if
we
do
find
it
we're
going
to
go
ahead
and
increment
that
hello
header
counter
we're
going
to
also
log
that
we
have
incremented
the
counter
and
then
we
also
have
an
on
http
response.
Headers
right.
So
we,
whenever
this
method
is
called
we'll
log
and
we'll
see
that
in
the
envoy
logs
and
we
add
additional
headers
right.
So
the
additional
headers
are
those
headers
that
we
go
ahead
and
pass
into
the
configuration.
We'll
see
that
as
we
go
ahead
and
and
test
this
out.
A
A
A
So
here
we
go
so
in
the
left-hand
side
of
the
screen.
Here
we've
got
envoy
running,
we
specified
where
the
config
file
is
and
on
the
right
hand,
side
and
again,
I've
got
envoy
running
locally
here.
On
my
laptop
and
the
right
hand,
side
represents
a
client
that
is,
you
know,
hitting
envoy
and
a
couple
things
that
I'm
doing
with
curl
here
is
I'm
specifying
a
header.
A
A
A
A
A
A
So,
let's
see
here
that's
running:
how
are
we
doing
with
time?
Two
minutes
all
right.
Let
me
I
should
have
time
to
to
show
you
this
as
well.
So
I
mentioned
right.
So
this
example
is
just
envoy
running
locally,
but
I
also
showed
you
that
envoy
that
you
know
wasm
that
the
extension
config
can
be
managed
through
an
xds
server
and
so
I've
got.
Let's
see,
I've
got
istio
running.
A
A
That
it
is
to
use
this
wasm
module
the
same
waza
model
module
that
I
showed
locally.
I'm
now
storing
that,
instead
of
locally
I'm
still
storing
it
remotely,
and
so
the
istio
agent
that
runs
with
the
envoy
sidecar
will
go
ahead
and
pull
this
wasm
module
validated
against
the
wasm.
Spec
spec
make
sure
it's
safe
to
run
and
then
go
ahead
and
run
it
in
a
wasm
vm.
A
A
You
see
that
I
received
a
200
response
from
my
app
through
the
istio
gateway
and
virtual
service
right,
and
so
now,
let's
go
ahead
and
and
and
those
those
headers
that
response
headers
that
I'm
setting
with
with
my
wasa
module.
They
don't
exist
right.
We
don't
see
any
of
these.
These
response
headers,
but
let
me
go
ahead
really
quickly,
because
I
know
I'm
running
out
of
time
here.
A
When
I
curl
now,
you
see
the
two
headers
that
are
being
added
to
the
http
response,
so
so
yeah,
that's
it.
I
hope
I
hope
you
found
the
this
time
in.
You
know
informational,
and
it
gives
you
a
little
insight
into
wasm
modules
being
able
to
extend
envoy
through
wasm
and
I'll
be
around.
So
if
you
have
any
additional
questions,
feel
free
to
to
reach
out
to
me.