Distributing WebAssembly Modules

    Before you begin this task, please deploy the sample application.

    Configure Wasm Modules

    In this example, you will add a HTTP Basic auth extension to your mesh. You will configure Istio to pull the from a remote image registry and load it. It will be configured to run on calls to .

    To configure a WebAssembly filter with a remote Wasm module, create a WasmPlugin resource:

    If a WasmPlugin is created in a specific namespace besides istio-system, the pods in that namespace will be configured. If the resource is created in the namespace, all namespaces will be affected.

    1. Test /productpage without credentials
    1. Test /productpage with credentials

    For more example usage of the WasmPlugin API, please take a look at the .

    Clean up Wasm modules

    There are several stats which track the distribution status of remote Wasm modules.

    • istio_agent_wasm_cache_lookup_count: number of Wasm remote fetch cache lookups.
    • : number of Wasm config conversions and results, including success, no remote load, marshal failure, remote fetch failure, and miss remote fetch hint.
    • istio_agent_wasm_remote_fetch_count: number of Wasm remote fetches and results, including success, download failure, and checksum mismatch.

    If a Wasm filter configuration is rejected, either due to download failure or other reasons, istiod will also emit pilot_total_xds_rejects with the type label type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig.

    Develop a Wasm Extension

    To learn more about Wasm module development, please refer to the guides provided in the , which is maintained by the Istio community and used to develop Istio’s Telemetry Wasm extension:

    There are known limitations with this module distribution mechanism, which will be addressed in future releases: