Hands-on WASM filters and singletons
summary
Practical how‑to for building a WASM authz/authn: a C++ filter and a singleton stack that polls and refreshes a global policy every 10 seconds, shares it via shared memory and hidden headers, and runs in the V8 runtime. Development uses docker‑compose and k8s, ytt for YAML templating, Bazel to build wasm cc artifacts, Fortio for load testing. Measured results: external authz calls are ~20x faster when in‑process WASM and V8 filters reach about 40% of native filter throughput.
AI-written summary · about
chapters (14)
- 0:00Custom filter in 2018
- 3:03First contact with WASM
- 4:10WASM filter in envoy.yaml
- 5:17Docker-compose + static conf
- 7:44YTT, the YAML Templating Tool YTT is part of the Carvel toolbox
- 9:07Programming Language for WASM envoy
- 11:30Application Binary Interface (ABI) envoy
- 14:56Importing external dependencies envoy in your Bazel WORKSPACE
- 15:31Referencing libraries in your Bazel BUILD
- 16:05Filter vs Singleton
- 17:07Zoom-in on istio-envoy
- 17:57WASM singleton stack
- 19:15WASM filter chain
- 20:14What's next?
related talks
33mDeveloping & Debugging WebAssembly Filters for Envoy
42mAdventures in Making Wasm Fast and More Secure
30mA WASM Runtime for FaaS Protected by TEE
31mHow We Can Create a Thriving Wasm Ecosystem
45mWasmer Things: An Upside-Down Guide to WebAssembly
01h 17mChoose Your Own Adventure: Wasm Edition
29mWASM in the Kernel: evolving threat detection at runtime
36mBringing honest computing to the WASM world