►
From YouTube: State of WebAssembly in Service Mesh and Future of Wasm
Description
SoloCon 2022:
State of WebAssembly in Service Mesh and Future of Wasm
Track:
Community and Open Source
Session Abstract:
WebAssembly (Wasm) has evolved into a high-performance, cross-platform, and polyglot software sandbox environment for cloud native workloads. Straightforward Wasm extension to workloads is mandatory for many organizations we work with. In this talk, we will first dive into the state of the WebAssembly in Istio service mesh with the new WasmPlugin resource and support for OCI compliant images. Then, we will discuss the future of Wasm and its support in Gloo Mesh, how we improve developers’ Wasm experience among teams, and when you should use proper APIs vs. building your own Wasm extensions.
Speakers:
Lin Sun
Director of Open-Source, Solo.io
Shane O'Donnell
Team Lead - Gloo Mesh, Solo.io
A
A
A
A
A
Is
your
project
in
the
very
early
days
started
with
the
mixer
component
and
we
got
a
lot
of
complaints
from
our
customer.
The
main
reason
is,
the
mix
of
components
is
in
the
requested
flow.
So,
if
you
are
doing
any
policy
enforcement,
every
single
customer
request
needs
to
go
through
the
mixer
component.
A
A
The
next
thing
in
the
istio
community
is
solo,
starts
to
talk
about
a
declarative
model
to
allow
users
to
declare
their
some
deployment
resource
in
service
mesh,
and
that
was
prior
to
me
joining
solo.
So
it
generated
a
lot
of
excitement
in
the
community
which
really
laid
a
solid
foundation
to
the
wasm
plug-in
resource
in
istio.
Today,.
A
The
wireless
unplugging
resource
was
introduced
as
a
alpha
resource
in
issue
1.12
from
a
wasm
plug-in
resource
you,
as
a
user,
can
define
which
workload
you
want
the
wasan
plugin
resource
to
apply
to.
If
you
don't
specify
a
selector,
it's
going
to
apply
to
all
the
workload
within
the
scope
of
this
particular
customer
resource.
A
The
solar
team
worked
with
the
upstream
team
to
support
not
only
the
standard
oci
image,
but
also
a
oci
compatible
image.
What
this
compatible
image
means
it
means
you
can
wrap
up
the
image
wrap
up
the
was
on
binary
in
a
darker
image.
So
how
does
the
resource
works
as
a
user?
You
come
into
your
kubernetes,
you
craft,
that
was
on
plug-in
resource,
and
then
you
use
cubecardo
commands
to
deploy
that
resource
to
your
kubernetes.
A
A
A
A
So
let's
go
ahead
and
run
this
to
do
that.
What
I'm
going
to
do
first,
is
using
docker
compose
so
specify
the
compose
file.
We
just
review
together
and
up
command,
so
that
allows
me
to
run
the
the
the
onboard
container
right
and,
let's
see
if,
when
I
hit
the
10000
port,
let's
see
if
you
know
my
wasm
plugin
gets
executed
to
do
that,
I'm
going
to
go
ahead
and
curve.
A
A
Under
the
istio
folder,
I
created
a
wise
plugin
customer
resource
in
this
resource.
I
give
a
name
and
I'm
deployed
to
the
default
namespace,
I'm
also
specify
to
apply.
This
was
on
plug-in
resource
only
to
the
http
bing
app,
and
you
know
I'm
specifying
my
web
assembly
hub
and
my
hello
solo
car
image,
which
is
the
image
build
using
the
same
binary
that
we
run
through
our
envoy
proxy
earlier
and
the
plugin
name
is
add
header.
A
In
my
kubernetes
cluster,
I
have
http
and
sleep
already
deployed
in
the
default
name
namespace.
They
already
have
a
cycle
proxy
running
with
the
app
container.
What
I'm
doing
next
is,
I
want
to
see
if
I
have
any
was
unplugging
resource
in
my
istio
environment,
which
I
don't
and
let's
go
ahead,
deploy.
This
was
unplugging
resources.
We
just
reviewed
together,
as
you
can
see,
it's
just
applied
so
now.
If
we
do
what's
unplugging
resource,
we
should
be
able
to
see
hollow
solo
car
right.
A
So
if
we
do
a
name
of
hello
solo
car,
we
will
be
able
to
see
the
contents
right
here.
So
this
is
exactly
the
same
as
all
the
other
issue
resources
pretty
easy
to
use
right.
So,
let's
see
if
this
thing
actually
works
right,
so
the
next
thing
we're
going
to
do
is
remember.
We
have
sleep
and
http
beam
so
from
the
sleep
pod
we're
going
to
call
the
http
beam
and
you
know
see
if
the
response
header
have
hello
solo
account
added
yay.
It
is
added
excellent.
A
So,
let's
see
how
this
works.
If
we
go
to
the
sdod
part,
we
would
see
some
information
around
our
what's
unplugging.
Hopefully
so,
if
we
go
to
here,
you
can
see
the
was
unplugging
configuration
is
being
pushed.
Remember.
We
talked
about
that
right
from
control
plan.
Push
to
is
your
proxy
through
the
issue
through
the
is
your
agent
and
also
there's
a
extension
config
discovery
service
that
pushes
the
configuration
the
extension
config
to
http
bing.
A
Let's
see
how
the
logs
works
on
the
http
inside,
so
you
can
see
or
why
them
was
executed
right
and
the
context
would
return
successfully
if
you
go
to
the
http
container
and
if
you
check
the
wash
leave
slash
is
your
data
you
can
see.
This
wasn't
binary
was
downloaded.
Remember
in
the
diagram
we
talked
about.
The
issue
agent
would
check
if
the
image
is
local,
if
it's
not
local,
it's
going
to
go
to
the
oci
registry
to
try
to
download
that
right.
So
that's
interesting!
A
A
So
what
this
is
going
to
put
pull
the
image
from
the
web
assembly
hub
does
match
right.
So
that's
exactly
the
same
image.
We
asked
the
issue
to
use
and
you
know
magically
this
image
showed
up
in
our
is
your
proxy
container
and
the
always
smart
to
pick
it
up
and
use
it
right.
So
that's
way
more
easier
than
you
know,
using
the
onway
configuration
yourself
and
figure
out
how
to
write
yourself.
A
A
One
thing
I
want
you
to
do
is
if
you
search
for
like
the
the
wasn't
binary
you
actually
not
going
to
find
it.
Well,
that's
too
much
matches,
but
what's
interesting
here
I
want
to
show
is:
if
we
search
for
hello
solo
car,
remember,
we
had
the
hdb
filter
in
our
own
way
configuration
right.
So
this
is
the
under
actually
connection
manager
right.
So
this
is
exactly
what
you
can
fix
manually
without
this
steel
right.
So
it's
your
configs
all
this
automatically.
A
For
you,
one
thing
I
would
highlight
here
is
right:
the
config
discovery,
it's
interesting
right.
The
data,
the
ads
data
is
empty
right
because
always
support
extension,
config
discovery
service,
so
that
allows
the
control
plane
to
push
extension
configuration
from
the
control
plane
to
the
proxy
dynamically
at
runtime,
and
this
initial
fetch
timeout
really
says
you
know,
I'm
not
going
to
time
out
and-
and
here
that
configuration
is
in
place
before
I
execute
so
folks
that
is,
is
your
wh
was
unplugging
resource.
A
B
So
let's
talk
about
the
current
state
of
webassembly:
where
are
we
at
today?
What
can
you
do
with
webassembly?
What
should
you
do,
and
maybe
let's
talk
about
some
things
that
you
shouldn't
do
with
webassembly,
because
it's
important
to
understand
some
of
the
limitations.
So
let's
kick
right
off
with
that.
B
B
Maybe
the
turnaround
time
just
isn't
acceptable,
especially
if
it's
a
high
severity
thing
if
you've
got
something
that
could
potentially
cause
remote
code,
execution
in
your
environment
and
you're.
Looking
at
a
multi-day
turnaround
time
that
might
not
be
acceptable,
so
webassembly
can
be
a
good
patch
to
mitigate
those
kinds
of
things
in
the
short
term
until
you
can
get
a
more
longer
term
fix
in
place.
B
It's
really
good
for
processing,
small
amounts
of
data,
and
the
emphasis
here
is
on
small
because
remember
all
of
the
data
that
we
process,
whether
it's
headers
or
maybe
even
the
full
body
of
a
request
or
a
response
message.
Anything
we're
handling
in
a
webassembly
filter
needs
to
cross
that
virtual
machine
boundary
and
there
is
a
little
bit
of
a
performance
hit
when
we
do
that,
and
the
last
thing
that
I
really
like
using
webassembly
filters
for
is,
if
you
want
to
start
emitting
custom
metrics
based
on
again
small
amounts
of
data.
B
B
You
know
out
of
the
box,
you
get
some
really
good
features
and
various
different
vendors,
including
solo,
have
have
built
in
native
filters
into
envoy
that
let
you
do
things
like
enterprise
upgrade
off
rate,
limiting
large
transformations
things
like
xslt
and
ninja
transformations,
and
all
of
these
things
have
been
battle
tested
in
production.
We
know
they
work.
They're
well
documented
they've
been
used
by
thousands
of
users
across
millions
and
millions
of
requests.
So
you
know,
let's
just
make
sure
we're
not
reinventing
the
wheel
with
these
webassembly
filters.
B
One
of
the
most
powerful
things
about
webassembly
is
that
it
can
do
almost
anything.
An
envoy
filter
can
do
natively
or
anything
a
native
envoy
filter
can
do,
but
the
problem
is
because
it
can
do
almost
anything.
A
native
envelope
filter
can
do,
there's
a
really
strong
temptation
once
you've
figured
out
and
you've
gotten
good
at
webassembly.
To
use
it
to
do
anything.
A
native
envoy
filter
can
do,
but
really
we
need
to
kind
of
show
a
little
bit
of
constraint
and
anything
that
already
works.
We
shouldn't
be
reinventing
and
doing
again
with
webassembly.
B
So
how
do
webassembly
filters
work
in
blue
mesh?
Typically
you'll
have
a
setup
like
this,
and
this
is
just
three
clusters,
but
you
know
you
can
imagine
that
this
scaling
to
dozens
or
hundreds
of
clusters,
we'll
typically
have
a
management
plane
that
has
a
management
server.
That
kind
of
is
the
brains
of
the
whole
blue
mesh
program
and
when,
when
it
runs
its
transformation,
loop,
it'll
figure
out
which
resources
need
to
go
where
and
start
distributing
all
the
configuration
to
all
of
the
clusters
in
your
mesh.
B
B
So
this
this
first
use
case
I
have
in
mind,
is
an
interesting
one.
So
for
those
of
you
who
aren't
familiar,
this
is
the
istio
book
info
application
or
it's
a
slightly
modified
version
of
it
actually
to
be
specific,
but
it's
basically
an
application
that
kind
of
ties
together
a
bunch
of
different
microservices
and
the
scenario
that
we're
playing
out
here
is:
you
can
imagine,
we've
got
a,
maybe
a
very
overzealous
product
owner
who
saw
all
of
the
tables
in
our
database
and
said
hey
some
of
these
things.
B
It
would
be
really
cool
if
we
could
show
these
on
the
front
end
to
the
user.
So
maybe,
let's
just
dump
everything
we
got
it
there,
and
so
we've
added
this
new
field.
That's
not
typically
in
book
info
called
word
count,
which
is
great
because
you
know
yay,
it's
a
new
feature,
more
stats,
users
love
it,
but
if
you'll
notice
well,
we've
also
accidentally
exposed
the
author's
social
security
number.
B
So
poor,
william
shakespeare's
social
security
number
here,
has
been
exposed,
and
you
know
this
may
seem
like
a
little
bit
of
a
far-fetched
scenario,
but
something
very
similar
to
this
was
in
the
news
recently
what
a
bunch
of
school
teachers,
social
security
numbers
got
exposed
in
plain
html
on
a
public-facing
website.
So
this
kind
of
stuff
really
does
happen
and
again
that
you
could
be
in
one
of
the
situations
where
redeploying
this
app
or
rolling
back,
isn't
an
option
or
isn't
an
option
in
a
timely
manner
for
for
a
ver
variety
of
reasons.
B
So
let's
look
at
some
of
the
things
we
might
be
able
to
do
to
mitigate
this.
So
I'm
opening
up
a
console
here-
and
I
know
we
showed
that
three
cluster
multi-cluster
environment
before,
but
just
to
keep
this
demo
a
little
simple.
I'm
going
to
keep
this
one
to
a
a
single
cluster.
That's
running
double
duty,
both
as
the
glue
mesh
management
cluster,
as
well
as
the
agent
so
you'll
see
here.
We've
got
our
enterprise
networking
pod
running
here,
that's
the
brains
of
the
operation
as
well
as
the
enterprise
agent.
That's
running!
B
That's
going
to
handle!
Writing
everything
that
istio
needs
to
take
care
of,
so
what
I'm
going
to
do
is
I'm
going
to
apply
a
filter
that
I
created
earlier.
So
I'm
just
going
to
do
a
coupe
ctl
apply
here
and
what
this
filter
is
is
a
data
loss
prevention
and
social
security
number
filter,
and
this
is
a
filter
I
created.
I
actually
have
the
source
here,
so
I'll
just
go
to
the
source,
real,
quick
and,
as
you
can
see
it's,
it's
really
quick.
B
B
Number,
so
if
we
go
back
to
our
browser,
I'm
just
going
to
refresh
this
page
here,
you
can
see
our
our
social
security
number
has
been
updated
to
be
all
stars
or
asterisks
instead
of
the
original
social
security
number.
So
we
haven't
made
any
changes
to
our
application.
We
haven't
done
a
redeploy.
We
haven't
even
done
a
restart
and
we've
gotten
this.
B
You
know
more
secure
functionality,
that's
prevented
something
or
at
least
mitigated
something
that
could
have
been
a
really
really
big
deal,
especially
if
the
you
know
original
application
team
wasn't
able
to
roll
out
a
fix
for
this
for
like
a
few
days,
and
this
is
really
where
the
power
of
webassembly
kind
of
shines
one
other
scenario
I'd
like
to
get
into
so
that
was
scenario.
One
scenario
two
another
part
of
our
new
and
improved
book
info
service
is:
if
we
look
at
our
review
service,
we've
actually
made
some
changes
here.
B
B
The
ingress
is
set
up
to
write,
requests
that
go
to
slash
reviews
to
the
review
service
and
ultimately,
it's
going
to
hit
that
review
surface,
obviously
via
the
istio
or
the
envoy,
sidecar
and
ultimately,
in
this
service
up
here
you
can
see
in
the
logs.
If
I
send
a
few
more
curls
you'll
see
each
time
it
logs
out
received
a
request
from
a
new
user's
chain.
B
So
that's
interesting,
but
if
you're
kind
of
putting
on
a
black
hat
or
an
attacker's
security
mindset
here,
you're
saying
hey
thanks
for
your
review,
shane,
that's
the
three
string
I
provide
it.
I
wonder
is
that
something
we
can
exploit
and,
as
you
can
see
here,
you
know
they
are
logging
it
out
and
if
the
word
log
isn't
setting
off
any
alarm
bells
for
you
yet,
and
it's
probably
worth
mentioning
that
the
review
service
is
a
java
application
and
as
a
java
application,
there's
a
pretty
good
chance.
B
B
If
you're
using
the
log4j
logging
library
in
java
and
a
particular
string
gets
logged,
there's
a
vulnerability
where
it'll
accidentally,
dial,
a
or
unintentionally
dial
an
external
address,
which
is
essentially
a
way
to
enable
you
to
run
a
remote
code
execution
on
anyone
who's
using
this.
So
it's
an
incredibly
high
threat
and
it's,
I
think
it
was
like
a
10
out
of
10
or
very
close
to
it.
It's
it
allows
anyone
with
very
low
effort
to
do
a
lot
of
damage.
So
here's
an
example
of
exactly
what
you
don't
want
to
happen
happening
here.
B
So
I'm
going
to
copy
paste
the
same
curl
except
instead
of
shane.
I'm
going
to
say
that
my
username
is
actually
a
gender
string
that
connects
to
an
ldap
server
and
that's
on
an
evil
server
and
other
than
that.
The
request
is
completely
the
same.
So
once
I
make
this
request
thanks
for
review,
this
is
awful
and
you
can
see
it
gets
logged
out
here,
which
is-
and
thankfully
this
particular
instance
I
made
sure
we
don't
actually
use
log4j
on
this.
B
This
is
just
a
basic
one.
It's
probably
not
even
going
to
look
for
the
the
full
exploit
string,
but
just
as
an
example
we're
looking
for
anything
that
has
that
jindy
with
the
curly
braces
in
it,
and
if
we
detect
it
not
only
are
we
going
to
log
it
we're
going
to
reject
the
requests
with
a
403
forbidden
and
we're
also
going
to
increment
a
custom
metric.
B
If
I
send
a
request
now,
instead
of
success,
you're
seeing
requests
rejected
due
to
invalid
attempts,
and
if
I
send
that
a
few
more
times
you
see
it
still
says
all
of
that,
and
it's
also
important
to
notice
that
you
know
we
can
still
send
our
good
request.
If
I
go
up
to
the
one
that
has
shane
in
it,
we
still
get
a
success
and
we're
still
seeing
log
lines.
But
if
I
send
the
bad
one
again,
you
see
it's
not
getting
logged.
B
So
we
basically
mitigated
this
because
again
this
filter's
running
at
the
sidecar,
so
it
never
gets
to
the
java
service.
So
we
don't
have
to
worry
about
log4j
and
that
vulnerability
anymore,
because
we've
caught
up
we've
intercepted
it
before
it's
even
reached
the
application.
That
has
the
vulnerability,
and
I
did
mention
that
we
had
metrics
as
well.
So
this
is
the
prometheus
stats
of
the
site
car
so
for
anyone
who's
familiar
with
the
envoy
stats
page.
This
is
just
that
I've
got
a
port
forwarded
locally
to
15
000
here,
but
essentially.
B
I've
I've
logged
out
a
log4j
cve.
I
think
I
called
it
cve
attempts-
and
here
you
here
you
see
here-
we've
got
four
attempts
and
if
I
just
go,
send
another
one,
real,
quick
and
refresh
this
page,
you
can
see
it's
gone
up
to
five.
So
this
is
a
metric.
That's
you
know
in
prometheus
format,
which
means
you
can.
You
know
point
a
grafana
at
this.
You
can
alert
on
it.
B
You
can
send
slack
notifications
emails,
whatever
your
alerting
system
is
and
as
soon
as
someone
starts
hammering
you
with
this
you
can
you
can
have
your
security
team
notified
immediately
and
make
sure
that
you
know
you're
not
in
too
much
trouble
here.
So
super
super
powerful
again.
You
know
this
was
deployed
in
seconds.
If
not,
you
know
minutes
the
worst
case
scenario.
The
code
was
50
lines
of
code
and
we've
mitigated
against
something
that
could
be
a
really
really
big
deal.
B
So
now
I
want
to
talk
about
webassembly
hub
and
webassembly.
Hub
is
a
a
tool
that
solo
has
put
out
there
and
it
kind
of
pairs
really
well
with
a
cli
tool
that
we
released
called
was
me
which
really
gives
developers
best
in
class
tooling,
which
they
can
use
in
order
to
build
and
publish,
as
well
as
discover
and
deploy
wasm
filters,
but
specifically
wasn't
filters
that
are
wrapped
in
oci
images.
B
So
oci
layers
are
the
same
kind
of
technology
that
docker
uses
to
make
docker
images
we're
doing
something
similar
here,
and
it
makes
it
really
easy
to
ship
around
the
the
actual
filter
byte
code,
as
well
as
a
bunch
of
configuration
that
kind
of
lets
the
host
know
what
version
that's
running,
and
you
know
what
kind
of
config
it
should
accept
that
kind
of
stuff-
and
this
is
something
that
we're
really
proud
of
at
solo-
and
you
know
the
community
has
really
embraced
it.
We
see
so
many
filters
that
are
are
pushed
up
here.
B
Do
I
have
a
tab
open
here
that
we
can
look
at
so,
for
example,
these
are
all
the
the
filters
that
are
just
you
know
published
under
my
account.
You
can
see
the
the
dlp
one
here
or
from
our
first
demo.
You
can
see
it's
it's
published
here.
You
can
see
it's
been
used
179
times,
we've
practiced
that
this
demo
more
than
once.
I
can
tell
you
that,
but
you
know
again,
you
can
kind
of
look
it's
all
in
the
same
kind
of
idea
of
not
reinventing
the
wheel.
B
You
can
see
what
other
folks
have
published
up
there
as
well
as
actually
you
know
getting
this
stuff
into
an
ultimate
envoy
site
car
is
actually
quite
challenging,
so
it's
really
good
to
have
that
that
powerful
capability
and
make
it
as
simple
as
using
a
docker
image.
That's
really
what
we
were
going
for
here.
B
So
now
that
we've
talked
about
the
kind
of
current
state
of
webassembly,
we
wanted
it
and
talk
real,
quick
about
the
future
of
web
assembly,
and
you
know
specifically
with
that
solo
in
mind
and
one
of
the
big
things
that
we
talk
about
in
the
future,
specifically
around
blue
mesh.
Is
this
idea
of
workspaces
and
we've
kind
of
re-released
blue
mesh
as
a
glue
mesh
2.0
release
built
around
this
core
concept
of
workspaces
and,
ultimately,
what
it
really
is.
B
Is
it's
a
really
strong
guarantee
on
multi-tenancy,
so
it
lets
you
logically
partition
your
configuration
between
pretty
much
any
way
you
want,
because
all
the
workspaces
at
the
end
of
the
day
is
it's
a
list
of
clusters
and
namespaces
within
those
clusters,
and
you
can
use
that
to
divide
up
your
your
service
mesh.
Whatever
way
makes
sense
for
your
organization.
B
We've
seen
folks
use
this
to
give,
for
example,
a
workspace
to
a
specific
team
or
a
workspace
to
a
specific
application,
especially
if
it's
an
application
that
has
a
number
of
smaller
microservices
associated
with
it,
and
we've
also
seen
you
know-
or
we
anticipate
folks
to
use
this
for
things
like
infrastructure.
So
you
can
imagine
a
gateway
might
have
its
own
workspace
that
maybe
has
more
stricter
security
posture.
B
It's
a
little
bit
more
locked
down
than
stuff,
that's
deeper
into
your
stack
that
isn't
as
publicly
exposed
and
some
examples
of
what
this
might
look
like.
So
we've
got
our
here
an
example
of
two
clusters
you
can
see.
Like
I
mentioned,
you've
got,
maybe
gateway
is
in
its
own
cluster
and
then
the
book
info
workspace
has
its
own.
B
So
you
can
export
services
that
are
reusable
things
like
notification,
services
or
things
of
that
nature,
but
you
can
also
share
configuration.
So
in
this
context,
you
might
have
a
security
team
that
has
all
of
these
various
different
web
assembly
policies.
Webassembly
filters
so
like
the
two
we
just
walked
through
with
the
dlp
stuff
and
the
lag4j
mitigation.
B
I've
also
added
an
authmatrix
one
and
an
ipv
block
list
here
to
this
diagram,
but
you
can
imagine
the
security
team
writes
all
of
these
once
and
then
any
other
teams
that
says,
like
hey,
I've
got
a
java
application.
I
should
probably
pull
down
this
log4j1
just
in
case,
and
you
know
you
can
start
using
these
throughout
all
of
your
clusters
throughout
all
of
your
workspaces,
even
though
you've
kind
of
only
written
them
in
one
place
by
the
team.
That's
the
expert
in
the
technology,
so
really
really
powerful
stuff.
B
So
we
want
to
talk
about
the
future
of
web
assembly
at
solo.
You
know
I
just
kind
of
talked
a
little
bit
about
the
multi-tenant
workspaces,
which
is
obviously
a
huge
part
of
it.
You
know
we
want
to
get
blue
mesh
running
at.
You
know,
scales
that
we
never
imagined
before
and
we're
already
seeing
customers
pushing
this
to
absolutely
incredible
scales,
but
in
terms
of
webassembly
we're
going
to
make
sure
that
we
definitely
keep
on
supporting
the
latest
versions
of
istio
of
envoy.
B
We
want
to
make
sure
we've
got
the
latest
of
everything
running
at
any
given
time,
and
we
are
excited
to
announce
today
that
that
was
me
tool.
We
talked
about
that
cli,
tooling,
that's
been
so
accepted
and
so
welcomed
and
so
used
by
the
community.
We
are
donating
that
to
the
cncf
and
you
know
we
just
feel
like
it's
really
good
to
be
working
on
the
stuff
in
the
open,
and
you
know
we'd
like
to
welcome
even
more
contributions
and
even
more
feedback
on
some
of
the
designs.
B
Some
of
the
work
folks
have
done
in
the
spec.
You
know
it's
just
been
tremendous
progress
and,
in
the
same
vein
we're
also
announcing
that
we're
going
to
be
donating
webassemblyhub.io
to
the
cncf.
So
you
know
we've
just
seen
so
much
usage
here,
it's
been
so
valuable
both
to
us
and
to
the
community.
We
wanted
to
be
able
to
give
it
back,
and
you
know
we're
really
proud
to
be
able
to
announce
that
today.