Envoy Wasm filters with Gloo Edge

You can use WebAssembly (Wasm) Envoy filters with Gloo Edge Enterprise. WebAssembly (Wasm) is an open standard, binary instruction format to enable high-performing web apps, for use cases such as customizing the endpoints and thresholds of your workloads.

Before you begin

1. Create your environment, such as a Kubernetes cluster in a cloud provider.
2. Install Gloo Edge Enterprise in your environment.
3. Install a test app such as Pet Store from the Hello World tutorial.

Prepare your Wasm filter

WebAssembly provides a safe, secure, and dynamic way of extending infrastructure with the programming language of your choice.

1. Get a Wasm image. Review the following resources to help.

   • WebAssembly Hub to use an existing Wasm image repository.
   • WebAssembly Developer’s Guide for more information on building your own Wasm image.
   • Solo’s wasme CLI tool with starter kits that makes it easy to build and push Wasm modules to WebAssembly Hub.

   Example steps with wasme CLI: For more information, see the Build tutorial.

   1. Start a C++ filter for Gloo.

      wasme init --language cpp --platform gloo --platform-version 1.13.x ./my-filter
      

   2. Build the filter into a Wasm image.

      cd my-filter
      wasme build cpp --store ./wasmstore . -t my-wasm-filter:v1.0
      

2. Prepare your Wasm image for use with Gloo Edge Enterprise. Review the following options.

   • Store in an image repository like WebAssembly Hub: Solo provides WebAssembly Hub as the simplest way to share and consume Wasm Envoy repositories. When you use the wasme CLI tool, you can push the image directly to your WebAssembly Hub repository. The resulting image repository is in a format similar to the following: webassemblyhub.io/<username>/<filter-name>:<tag>.
   • Load the Wasm file directly into the filter: If your filter is not hosted in an image repository such as WebAssembly Hub, you can refer to the filepath directly, such as <directory>/<filter-name>.wasm.
   • Use an init container: In some circumstances, you might not be able to use an image repository due to enterprise networking restrictions. Instead, you can use an initContainer on the Gloo Edge gatewayProxy deployment to load a .wasm file into a shared volume.

Configure Gloo Edge to use a Wasm filter

Now that Gloo Edge Enterprise is installed and you have your Wasm image, you are ready to configure Gloo Edge to use the Wasm filter. You add the filter to your gateway proxy configuration. For more information, check out the API docs .

Now that your gateway-proxy gateway is updated, the hard work has been done. All traffic on the HTTP gateway calls the Wasm filter.

Verify the Wasm filter

1. Enable port-forwarding for the gateway-proxy on the port for the Envoy Admin page, usually 19000.

   kubectl port-forward -n gloo-system pods/$(kubectl get pod -l gloo=gateway-proxy -n gloo-system -o jsonpath='{.items[0].metadata.name}') 19000:19000
   

2. Check the config_dump from the Envoy Admin page for the Wasm filter by opening this URL: localhost:19000/config_dump.

   • Example output in the filter_chains section:

   ...
   {
       "name": "envoy.filters.http.wasm",
       "typed_config": {
           "@type": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
           "config": {
               "name": "myfilter",
               "root_id": "add_header",
               "vm_config": {
                   "vm_id": "gloo-vm-id",
                   "runtime": "envoy.wasm.runtime.v8",
                   "code": {
                       "remote": {
                           "http_uri": {
                               "uri": "http://gloo/images/   8b3b05719379af3996d51bf6d5baed1103059fb908baec547f2136ed48aebd77"   ,
                               "cluster": "wasm-cache",
                               "timeout": "5s"
                           },
                           "sha256":    "8b3b05719379af3996d51bf6d5baed1103059fb908baec547f2136ed48aebd77"
                       }
                   },
                   "nack_on_code_cache_miss": true
               },
               "configuration": {
                   "@type": "type.googleapis.com/google.protobuf.StringValue",
                   "value": "my test config"
               }
           }
       }
   },
   ...
   

3. To check that the Wasm filter is applied, send a curl request to one of your endpoints.

   curl -v $(glooctl proxy url)/all-pets
   

   Example output: Notice the header that your Wasm filter adds.

      * TCP_NODELAY set
      * Connected to 34.30.251.229 (34.30.251.229) port 80 (#0)
      > GET /all-pets HTTP/1.1
      > Host: 34.30.251.229
      > User-Agent: curl/7.64.1
      > Accept: */*
      > 
      < HTTP/1.1 200 OK
      < content-type: text/xml
      < date: Thu, 02 Mar 2023 16:46:24 GMT
      < content-length: 86
      < x-envoy-upstream-service-time: 2
      < hello: world!
      < server: envoy
      < 
      [{"id":1,"name":"Dog","status":"available"},{"id":2,"name":"Cat","status":"pending"}]
      

References

• WebAssembly Hub for sharing and reusing Wasm filters.
• Solo’s wasme CLI tool for building and deploying Wasm filters for Gloo Edge Enterprise, Istio, and Envoy.
• Solo’s wasm GitHub repo for the wasme tool.