►
Description
Taking Service Mesh a Step Further with WebAssembly - Christian Posta, Solo.io
WebAssembly (WASM) is a binary instruction format for a stack-based virtual machine. Wasm is designed as a portable target for compilation of high-level languages like C/C++/Rust, enabling deployment on the web for client and server applications. Wasm support in Envoy means that that opens up new possibilities in customizing service meshes built on Envoy with modules that modify the behavior of the sidecar proxy in any language. The possibilities are endless and in this talk we will explain: - The state of Wasm in Envoy and how it works - Demonstrate the developer experience in building, sharing, and deploying modules - Demonstrate a range of modules types and the kind of behavior it can customize in the sidecar proxy
A
A
How
do
they
get
those
systems
to
communicate
with
each
other
and
the
organizations
that
we
typically
deal
with
are
trying
to
deploy
redundant,
highly
available
systems
that
are
capable
of
experiencing
degradation
and
failover
in
a
seamless
way
and
at
solo?
What
we
do
is
we
help
build
api
infrastructure
on
technology
like
envoy
and
service
mesh
to
be
able
to
span
multiple
clusters,
multiple
zones,
multiple
geographies
and
and
use
things
like
mesh
and
gateways
to
be
able
to
get
this
transparent,
routing
and
secure
communication
observable
network
and
and
these
types
of
things.
A
A
There
are
needs
around
customizing,
the
behavior
of
the
network
or
customizing,
the
behavior
of
the
proxies.
So
typical
customizations
look
like
supporting
existing
wire
protocols.
Maybe
some
of
them
are
industry
or
vertical
specific
you'll
see
the
need
to
add
more
specific,
customizations
and
telemetry
that
the
proxy
captures,
especially
things
like
implementing
security
protocols,
things
that
might
not
be
very
industry
standard
but
have
existed
in
these
organizations
and
if
the
mesh
or
this
technology
is
going
to
be
adopted,
then
it
needs
to
be
backward
compatible
with
these
existing.
A
You
know
brownfield
applications,
and
you
know
the
way
they
communicate
on
the
network.
There's
also
going
to
be
things
like
light
transformations.
How
do
we
take
this
header
mangle?
It
up
a
little
bit
put
it
over
here
in
this
header,
because
that's
what
that's,
what
the
upstream
applications
expect
and
and
so
on.
So
there's
a
really
large,
almost
never-ending
list
of
what
customizations
you
might
need
to
actually
productionize
and
get
a
system
like
a
service
mesh
into
into
an
organization
now
so
at
solo.
A
A
A
So
an
important
part
of
webassembly
and
running
it.
In
any
of
these,
these
hosts
is
that
you're
kind
of
taking
untrusted
code
and
embedding
it
into
an
existing
system.
Now
webassembly
is
built
to
be
secure.
I
mean,
if
it's
running
in
the
browsers,
just
like
a
javascript
engine,
it
needs
to
be
secure
and
one
of
the
things
webassembly
does
is
it.
It
enforces
a
very
tight
memory
boundary
around
that
module.
A
The
module
can
only
use
whatever
memory
and
and
functions
and
variables
that
the
host
gives
it,
so
it
can't
just
start
calling
out
to
either
any
other
host
functions
or
outside
of
that
sandbox,
so
it's
very
safe
and
and
secure.
It's
also
extremely
fast,
at
least
compared
to
alternatives
right.
So,
if
we
look
at
in
the
browser,
we
see
that
it's
it's
faster
than
a
javascript
implementation,
if
we
look
at
maybe
envoy
specifically,
is
faster
than
some
of
the
alternatives.
A
So
some
of
the
alternatives
to
extending
the
capabilities
of
envoy
include
things
like
calling
out
to
an
external
service
and
having
it
process
some
logic,
like
I
don't
know.
For
example,
we
have
customers
that
do
funky
things
with
hmac
on
the
request
come
in.
They
have
to
do
some
hmac
validation
or
they
might
reach
out
to
an
external
auth
service
to
do
that
out
of
out
of
the
process
of
the
proxy.
A
If
we
could
do
something
like
that
inside
the
proxy
now
we
don't
have
to
take
that
additional
hop
and
you
know,
and
that
speed
stinks
up
it's
not
as
fast
as
writing
the
code
directly
into
the
onboard
proxy
itself.
So
if
you
wrote
it
as
a
c
plus
plus
extension
to
to
enboy
web
assembly's,
not
gonna
be
as
fast
as
that,
but
the
downsides
to
baking
it
directly
into
the
proxy
itself,
is
first
of
all,
you
have
to
write
it
in
c
plus,
plus
you
have
to
compile
it
and
statically
link
it
into
envoy
itself.
A
So
now
the
binary
that
you're
running
isn't
upstream
envoy
anymore.
It's
your
own
distribution
that
you
just
created,
and
so
that's
a
very
important
consideration,
especially
when
you
start
talking
about
all
the
different
types
of
customizations
that
you
might
want.
So
will
you
have
one
build
of
envoy
that
has
all
of
the
customizations
or
will
you
have?
You
know
10
20
different
distributions
that
you're
going
to
try
to
support
it'd,
be
nice
if
you
just
had
the
one
single
distribution
and
dynamically
load,
those
customizations
in
as
needed.
A
So,
as
I
said
earlier,
with
webassembly
we
can.
We
can
use
ideally
any
language
now
in
practice.
We'll
see
some
are
better
suited
today
than
than
others,
but
we
can
use
any
language
which
then
gets
compiled
down
into
an
intermediate
representation
of
the
of
the
code
and
then
eventually
executed
into
the
into
the
vm.
A
So
here's
where
it
gets
interesting
because
for
frameworks
like
like
service
mesh,
especially
those
built
on
envoy,
we
have
this
opportunity
now
to
not
only
so
the
service
mesh
itself
kind
of
organizes
and
programs,
the
network
at
the
l7
or
the
application
layer.
Now
we
can
have
very
fine-grained
customizations
that
are
tailored
toward
the
way
you've
written
applications
already,
and
especially
that
might
be
organizational
specific.
A
So
if
we
take
a
look
at
envoy
today
and
the
mechanisms
and
how
a
request
would
flow
through
the
filter
chains
in
envoy,
so
it
envoy
is
built
on
this
pipes
and
filtered
type
architecture
and
request
comes
in
goes
through.
One
of
these
first
steps
continues
on
to
the
next
to
the
next
and
eventually
gets
routed
either
either
sent
back
or
or
routed
to
an
upstream
service
envoy
is
a
proxy
right.
So
it's
proxying
the
request.
It's
adding
some
additional
capabilities
to
the
request
once
it
gets
on
the
wire.
A
Now
you
can
see
the
fourth
box
here
going
down
as
you
flow
through
this
this
chain
of
filters,
you
can
add
you
can.
First
of
all,
you
can
configure
any
of
the
out-of-the-box
filters
that
exist
in
envoy
to
live
in
this
chain,
but
you
can
also
add
your
own
custom
filters,
and
so
that's
something
that
we've
done
in
the
past.
A
So
web
assembly
becomes
this
mechanism
of
extending
the
capabilities
of
an
existing
envoy
proxy
with
you
know
the
code
of
your
choice
in
the
language
of
your
choice.
Now
how
that
happens
is
the
the
filter
in
envoy.
So
the
filtering
envoy
has
an
api
right
and
how
we
translate
that
into
code
that
the
webassembly
module
will
be
able
to
understand.
A
Is
we
have
so?
First
of
all,
we
need
a
an
execution
engine
to
be
able
to
run
webassembly,
and
then
we
need
a
interface
between
the
envoy
filter
and
what
envoy
understands
natively
and
the
sandboxed
webassembly
vm
right,
and
so
that's
called
the
the
application
binary
interface.
So
you
might
see
this
term,
and
so
I'm
covering
it.
A
You
might
see
this
term
when
you
start
looking
at
building
webassembly
modules
for
for
envoy
and
all
the
abi
does
is
specifies
a
set
of
functions
that
can
be
imported
into
your
webassembly
module
and
functions
that
are
exported,
so
in
other
words,
you're
only
allowed
to
use
and
see
a
certain
handful
of
functions,
for
example,
to
make
external
calls
or
something
that
envoy
will
allow
you
to
use.
And
then
your
application
can
implement
these
callbacks
that,
on
the
you
know,
the
abi
and
the
filters
will
actually
call
into
now.
A
All
this
stuff
sounds
a
little
bit
complicated,
but
you
shouldn't
worry
too
much
about
that,
because
this
is.
This
is
what's
happening
in
the
envoy
side.
What
you
are
more
interested
in
as
a
developer-
let's
say
you're
interested
in
the
sdks
to
kind
of
wrap
this
api
and
abstract
some
of
these
details
away
from
you.
So
there
are
sdks
for
c
plus
assembly
script,
rust
and
tinygo
to
be
able
to
write
your
applications
in
these
languages,
compile
them
down
into
a
webassembly
module
and
inject
that
and
run
that
in
in
existing
existing
envoy.
A
A
A
A
The
tires
on
you
can
come
over
here
to
the
docks
and
get
started
so
install
the
wisely
tool
tutorials
for
for
getting
started
and
and
starting
to
build
your
your
own
project
and
and
so
forth,
and
what
we're
going
to
take
a
look
at
is
a
demo
here
of
of
of
us
building
out
a
webassembly
module
and
going
through
this
developer,
workflow
and
figuring
out.
How
do
you
deploy
this
to
a
running
envoy
based
framework?
A
A
So,
if
you
come
to
the
docs
here,
you
can
look
in
the
installation
and
getting
started
tutorials
building
our
different
webassembly
modules,
just
a
little
bit
outdated.
We
have
more
languages
that
we
support
here.
So
let's
take
a
look
at
the
at
the
demo,
so
the
cli
that
we
would
use
to
start
get
started
with
our
webassembly
experience
here,
for
especially
for
building
for
envoy.
Is
this
wise
me
tool
and
with
what
what
was
me?
What
we
can
do
is
create
new
projects.
A
A
Let's
take
a
look
at
our
existing
deployment,
we're
going
to
be
using
istio
for
this.
We
have
the
seo
control
plan
deployed.
We
also
have
the
book
info
application
running
now.
If
we
make
a
call
between
the
product
page
and
the
details
service,
we
see
the
call
completes
it's
a
it's.
An
http
call,
we've
also
dumped
some
of
the
headers.
What
we're
going
to
do
in
this
demo
is
just
create
a
webassembly
module
that
extends
the
capability
of
either
transforming
headers
or
or
adding
new
headers
to
the
request
or
the
response.
A
So
the
first
thing
we're
going
to
do
is
we're
going
to
build
we're
going
to
bootstrap
a
new
project
and
we're
going
to
use
wisely
init
and
then
we're
going
to
put
it
in
a
new
directory
and
we're
going
to
pick
a
language
that
we
want
to.
We
want
to
use
for
this
webassembly
module.
So
if
I
click
on
tiny
go,
which
is
what
we're
going
to
use
a
subset
of
the
golang
language,
we
will
pick
the
platform
that
we
want
to
target
in
this
case
it's
istio
1.7,
and
then
it
creates
it.
Now.
A
A
A
A
Now
it's
still
going
almost
there
apologies.
I
should
have
downloaded
this
ahead
of
time
and
there
we
go
now.
We've
downloaded
the
builder
and
and
now
we're
going
to
build
it.
We
shouldn't
take
too
long
we're
going
to
tag
it
using
the
the
tag
that
we
specified
here
and
now
we
built
the
image.
If
we
take
a
look
and
and
list
it
locally,
we
can
see
that
0.14
of
this
ad
header
demo
was
built
and
is
packaged
as
a
oci
style
container
and
then
from
there.
A
What
we
can
do
is
we
can
push
that
to
a
registry,
so
in
this
case
we're
going
to
push
this
to
the
webassemblyhub.io
registry.
If
we
go
take
a
look,
if
we
log
in
under
my
name,
you
can
see
our
demo
ad
header,
repo,
that's
been
added
here.
0.14
is
the
one
we
just
created.
If
I
click
on
tags,
we
should
see
that
indeed,
0.14
is
is
available
as
of
21
seconds
ago.
A
So
that's
awesome
right
now.
We
just
built
a
extension
to
envoy
using
go
or
or
tinyco
subset
of
go.
We
packaged
it
as
a
webassembly
module.
We
pushed
it
to
a
registry.
Now
that
other
other
folks
can
can
come
to
this
this
repo
and
explore
the
various
different
webassembly
modules
that
that
are,
you
know,
other
folks
have
been
have
been
working
on
and
you
know
experimenting
with
and
so
on
and
we're
not
limited
to
just
c
plus,
which
is
what
envoy's
written
and
we're
not
statically,
building
this
into
the
proxy.
A
This
is
dynamically
loaded
or
will
be
when
I
show
you
that
part,
let's,
let's
do
it
again,
let's,
as
we
set
this,
let's
pick
a
different
language:
let's
do
assembly
script
all
right,
so
we
have
the
same
thing.
We
have
this
deal
running.
We
have
our
book
info
demo
running
and
when
we
make
a
call,
what
we're
going
to
do
is
we're
going
to
insert
one
of
these
webassembly
modules
into
the
envoy
proxy.
A
So
we
see
headers
here
we
don't
see
any
additional
headers
yet
so
what
we're
going
to
do
is
we're
going
to
do.
Osmo
init
do
the
same
workflow,
but
now
we're
going
to
do
it
with
assemblyscript,
which
is
a
variant
of
typescript
and
we're
going
to
pick
the
platform
we're
targeting
and
now.
If
we
open
our
project,
we
see
something
like
this.
A
A
A
A
A
Give
that
a
second
here,
I'm
going
to
pause
the
the
output.
This
is
a
live
demo
so
and
it
is
typing,
but
in
the
output's
still
going,
I
just
pause
the
output.
Whilst
we
deploy
istio
the
specific
tag
that
we
want
and
then
any
configuration
that
we
that
we
want
to
give
to
it
now,
sometimes
there
is
take
it
there's
still
a
race
condition
that
we
are
aware
of
here.
A
A
So
in
the
bookinfo
namespace
we
should
see
the
output
of
our
webassembly
module,
which
in
this
case
really
didn't
do
too
much.
We
just
added
a
a
new
header
when,
when
we
get
the
response,
so
if
that's
the
case
now
that
my
demo
is
not
automated
anymore,
let's,
let's
first
take
a
look
at
what
what
we
created
under
the
covers
for
istio.
So
if
I
do
get
envoy
filter
book
info,
what
we
see
is
we've
created
these
booking
or
these
envelope
filters
to
patch
the
envoy
proxies
to
load
the
wasa
module.
A
We
can
see
that
we
are
adding
a
the
wasm
filter
and
that
is
calling
out
to
a
was
a
module.
So,
if
that's
the
case,
then
what
we
should
see
is
when
we
call
between
product
page
and
details.
What
we
should
see
across
our
fingers
is
this
new
header
that
we
that
we
added.
So
let's
run
this,
and
indeed
we
do
see
the
the
new
header
that
we've
added
with
the
with
the
specific
configuration.
A
Let's
come
back
here,
we're
using
hello
instead
of
world
we're
saying
hello
tomorrow
and
that's
what
we
see
in
the
request
pathway.
So
that's
the
extent
of
my
my
demo
here.
I
do
encourage
you
to
take
a
look
at
the
webassembly
hub,
tooling,
go
ahead
and
take
a
look
at
istio
and
some
of
the
service
meshes
that
are
supporting
webassembly.
A
The
caveat
that
I
should
point
out
is
that
webassembly
in
envoy
was
just
recently
merged
into
upstream.
Up
until
now
it's
been
on
its
own
fork,
but
it's
recently
merged
into
upstream
it
it's
in
a
state
of,
let's
just
say
it's
still
settling
out
a
little
bit.
It
will,
I
believe,
it'll
be
available
in
in
envoy
1.17.
A
Even
then,
I
still
caution
that
this
is
still
kind
of
new
technology
that
will
need
some
soak
time.
So
definitely
experiment
with
it
push
the
boundaries
of
it
and
the
limits
of
it,
and
you
know,
jump
in
and
contribute
in
the
community
in
terms
of
issues,
and
you
know
whatever
experience
that
you
have
with
webassembly
and
definitely
feel
free
to
reach
out
to
us
or
the
the
broader
web
assembly
community
for
any
thoughts
or
questions.
So,
thanks
again
for
stopping
by
my
talk.