Dynamic Modules in Envoy Gateway: API Design, Safety, and Operability
summary
Envoy Gateway exposes Kubernetes-native APIs that register shared libraries in an Envoy proxy CRD and let application teams attach them via Envoy extension policy, mapping directly to Envoy dynamic_modules HTTP filter and handling filter ordering, invalid references, lifecycle, and packaging. A comparative case study shows bundled shared libraries (recommended for Go: one runtime, embedded composer for production) versus runtime-loaded plugins. A community marketplace plus Build Own Way Bolt CLI pushes module manifests to an OCI registry; a demo WAF blocks SQL‑injection requests with 403 responses.
AI-written summary · about
chapters (14)
- 0:00Dynamic modules in Envoy Gateway
- 1:06What dynamic modules are
- 3:36API design for dynamic modules
- 6:28Operational roles for modules
- 7:11Configuring modules in policy
- 9:16Production challenges with modules
- 11:41Build on Way for modules
- 13:05Simplifying module distribution
- 14:35Go runtime issues in modules
- 16:58Customizing filters with Build on Way
- 17:20Integrating dynamic modules
- 18:03Demo: WAF dynamic module
- 23:11Summary and call to action
- 23:55Q&A on module upgrades
related talks
21mDeep Dive: Envoy
22mUnlock Kubernetes & Envoy: Master Your API Ecosystem!
26mTaking Envoy Beyond C++ with WebAssembly
32mExtending Envoy Using WebAssembly (Wasm)
05mKeynote: Envoy, the Engine for a Cloud Native Security Kernel
39mEnvoy Gateway: The API Gateway in the Cloud Native Era
28mExtending Envoy for Our Use: An End User Adoption Story from Fidelity
29mThe rise of Layer 7, microservices, and the proxy war...