© 2020 Build > meshctl wasm init addheader-filter --language rust > meshctl wasm build rust -t webassemblyhub.io/yuval/addheader-rust:v1 ./addheader-filter ABI: Application Binary Interface 13 13 | Copyright © 2020 > meshctl wasm push webassemblyhub.io/yuval/addheader-rust:v1 Build Store 14 | Copyright © 2020 Build Store WASM Artifact Image Specification 15 | Copyright © 2020 Build --deployment-name ratings-add-header --namespace bookinfo --image webassemblyhub.io/yuval/addheader-rust:v1 --cluster mgmt-cluster --labels app=ratings Extension Config Discovery Service EXTERNAL AUTH

○ 敏捷性：过滤器可以动态加载到正在运行的Envoy进程中，而无需停止或重新编译。 ○ 可维护性：不必更改Envoy自身基础代码库即可扩展其功能。 ○ 多样性：可以将流行的编程语言（例如C/C++和Rust）编译为WASM，因此开发人员可 以选择实现过滤器的编程语言。 ○ 可靠性和隔离性：过滤器会被部署到VM沙箱中，因此与Envoy进程本身是隔离的；即使 当WASM Filter出现问题导致崩溃时，它也不会影响Envoy进程。 oxy-wasm/spec ● 内置的Wasm runtime ○ ~20MB for WAVM ○ ~10MB for V8 ● 事件驱动模型 ● 兼容native filter调用 方式 8 Example Wasm filter configuration ● 下发到Envoy Proxy侧的配置 9 OCI Registry As Storage ● OCI Artifacts项目的参考实现 com/asm/asm- test:v0.1 --manifest-config runtime- config.json:application/vnd.module.wasm.config.v1+json example- filter.wasm:application/vnd.module.wasm.content.layer.v1+wasm ○ Wasm Artifact镜像规范参考 ■ https://github

● wazero is the only zero dependency WebAssembly runtime written in Go. ● Contribute to Go/TinyGo/Rust ● Using WasmPlugin API to extend Istio ● GitHub: tetratelabs/wazero Istio Security Scanner ● Make

octl simply describe the features enabled or disabled but none of the security implications. As an example of security documentation that could not easily be found, throughout the assessment, NCC Group could created first. For example, in the event that an earlier-created Gateway includes a host declaration of "*", and an later-created Gateway includes host declarations of "*.com" and "example.com", requests for for exampl e.com and example2.com would be handled by the latter-created Gateway, while requests for example.net would be handled by the earlier-created Gateway. Due to this behavior, it is possible for

which we can apply a “patch” to the Envoy configuration generated by Pilot. #IstioCon EnvoyFilter Example - Dubbo Traffic Splitting Replace TCP proxy in the outbound listener Replace TCP proxy in the inbound Istio, protocols are identified by service port prefix in this pattern: tcp-protocol-xxxx. For example, a Thrift service port is named as "tcp-thrift-service". Please keep "tcp" at the beginning of the com/aeraki-framework/aeraki #IstioCon Aeraki Configuration Example: Dubbo Service definition Traffic rules #IstioCon Aeraki Configuration Example: Redis RedisServie RedisDestination #IstioCon Aeraki

of services. #IstioCon Abstracting to proto files Annotations API definition Greeting service example #IstioCon Please Build System ● https://github.com/thought-machine/please ● Uses BUILD and allows allows for creation of miscellaneous rules Misc please rule for autogeneration K8s Greeter service example #IstioCon Building the new rule #IstioCon Deploying to a cluster #IstioCon ● Easy way to manage

that combines all the themes that are addressed during the conference. ● Sponsored by Google (Example from the Royal Society of the Arts (London) “Animate” series, “Re-imagining work”) Artist for IstioCon incorporated during the Roadmap session. It is used to explain a process. ● Sponsored by Google (Example from Wikimedia movement 2030 strategy) Graphic recording Process and implementation Coordination

andle) #IstioCon Who and where to reroute ? #IstioCon The contract GET / HTTP/1.1 Host: example.com User-Agent: curl/7.64.1 X-devroute: { “foo”:”192.168.1.12:8001” } Accept: */* #IstioCon

8% of attendees were either evaluating Istio for production use, or have tried at least one example but haven’t used it seriously #IstioCon Most popular sessions in English Session Welcome Keynote

of attendees were either evaluating Istio for production use, or have tried at least one example but haven’t used it seriously 19% of attendees are using Istio in production. #IstioCon