Envoy is a lightweight modern network proxy written in C++. It has quickly become the base component in most existing service mesh implementations. With such popularity - a new, safer, more scalable extensibility model was needed. Much to our excitement - now one can extend Envoy network filtering with WebAssembly modules written (among other languages) in Rust. We'll see a live demo of building and deploying such a filter.

1. @antweiss
Envoy, WASM and Rust -
the Mighty Trio
Ant Weiss
Otomato Software Delivery : https://otomato.io
@antweiss

2. @antweiss
Envoy, WASM and Rust - the Mighty Trio

3. @antweiss
● L4/L7 Proxy
● Modern C++
● Performant
● Configurable
● Extensible

4. @antweiss
● Service Meshes

5. @antweiss
● Service Meshes
○ AWS App Mesh

6. @antweiss
● Service Meshes
○ AWS App Mesh
○ Consul Connect

7. @antweiss
● Service Meshes
○ AWS App Mesh
○ Consul Connect
○ VMWare NSX

8. @antweiss
● Service Meshes
○ AWS App Mesh
○ Consul Connect
○ VMWare NSX
○ Kuma

9. @antweiss
● Service Meshes
○ AWS App Mesh
○ Consul Connect
○ VMWare NSX
○ Kuma
○ Istio

10. @antweiss
WebAssembly!
Call me
WASM
● Binary Code Format
○ Sandboxed
○ Safe
○ Fast
○ Polyglot
○ Portable

11. @antweiss
Rust!
● Expressive
● Performant
● Memory-safe
● FP
● Metaprogramming
● Loveable
Put your
Trust in
Rust!

12. @antweiss
Istio pre-1.5

13. @antweiss
Istio pre-1.5

14. @antweiss
Istio pre-1.5
Adapter
Adapter
Adapter
Adapter

15. @antweiss
Istio 1.5+
No Mixer!!!

16. @antweiss
High Level Plan
● Build:
○ Create a Rust WASM module for Envoy
● Deploy:
○ Load the module into an Envoy container
● Test:
○ Proxy the traffic to hashicorp/http-echo

17. @antweiss
Build Plan
● Create a Rust WASM module for Envoy
○ Based on ‘proxy-wasm’ crate.
○ Implement base Context trait.
○ Implement HttpContext trait:
■ Filter HTTP headers to create a Pandemic Authorizer:
● Only allow requests when
○ a “temperature” header is present
○ and has value below 37.0

18. @antweiss
Sum It Up
● Envoy is proxying the cloud native world

19. @antweiss
Sum It Up
● Envoy is proxying the cloud native world
● WASM is a scalable, dynamic extension mechanism

20. @antweiss
Sum It Up
● Envoy is proxying the cloud native world
● WASM is a scalable, dynamic extension mechanism
● Writing WASM in Rust is serious fun !

21. @antweiss
Sum It Up
● Envoy is proxying the cloud native world
● WASM is a scalable, dynamic extension mechanism
● Writing WASM in Rust is serious fun !
If running Envoy with Consul - look at https://github.com/layer5io/image-hub