🏴‍☠️ Hook

Sample configuration using wasm_filters for Consul to configure Envoy sidecar proxies with the /tmp/filters/replace_response.wasm WASM filter, assuming this binary file is appropriatley compiled and is avaiable on the local filesystem of the sidecar host.

service {
  name = "web"
  port = 8080
  connect {
      sidecar_service {
          proxy {
              config {
                  protocol = "http"
                  wasm_filters = [
                      {
                          name       = "replace_response"
                          local_file = "/tmp/filters/replace_response.wasm"
                      }
                  ]
              }
          }
      }
}

👩🏽‍💻 Learn more about Consul here.

• github.com/picatz/hook/pkg/call/http provides functions to interact with HTTP requests and responses.
  • http.OnRequestHeaders is a function to hook into the proxy. From here you can inspect, set, delete, read, and further handle header-based authn/authz tasks.
    • You can optionally use the two arguments provided to the function including the maxSize (int type) and endOfStream (bool type). You do not need to name these types at all if you do not plan to use them. That is a subtle, often unused, feature of the Go language.
    • To continue processing the request after your logic, return the action.Continue type to signal the HTTP stream is ready to be handled again by the proxy.
  • http.OnResponseHeaders is a function to hook into the the response headers, very similiar to http.OnRequestHeaders, but for the response side of the upstream service. You can do essentially the exact same things, but applying the logic to the "other side" of the proxy connection.
  • http.SetRequestHeader is a function to set an HTTP request header using a given key and value.
  • http.SetResponseHeader is a function to set an HTTP response header using a given key and value.
• github.com/picatz/hook/pkg/types/action provides types to signal the proxy to continue/stop processing the next steps of the request/response stream.
  • action.Continue is a common type used to signal to the proxy to continue handling the connection.

static_resources:
listeners:
  - name: main
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 18000
    filter_chains:
      - filters:
          - name: envoy.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: ingress_http
              codec_type: auto
              route_config:
                name: local_route
                virtual_hosts:
                  - name: local_service
                    domains:
                      - "*"
                    routes:
                      - match:
                          prefix: "/"
                        route:
                          cluster: web_service
              http_filters:
                - name: envoy.filters.http.wasm
                  typed_config:
                    "@type": type.googleapis.com/udpa.type.v1.TypedStruct
                    type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
                    value:
                      config:
                        name: "req_body_replace"
                        root_id: "req_body_replace"
                        vm_config:
                          vm_id: "req_body_replace"
                          runtime: "envoy.wasm.runtime.v8"
                          code:
                            local:
                              filename: "./examples/header/header.wasm"
                          allow_precompiled: true
                - name: envoy.filters.http.router
                  typed_config: {}

  - name: staticreply
    address:
      socket_address:
        address: 127.0.0.1
        port_value: 8099
    filter_chains:
      - filters:
          - name: envoy.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: ingress_http
              codec_type: auto
              route_config:
                name: local_route
                virtual_hosts:
                  - name: local_service
                    domains:
                      - "*"
                    routes:
                      - match:
                          prefix: "/"
                        direct_response:
                          status: 200
                          body:
                            inline_string: "example body\n"
              http_filters:
                - name: envoy.filters.http.router
                  typed_config: {}

clusters:
  - name: web_service
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: mock_service
      endpoints:
        - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: 127.0.0.1
                    port_value: 8099

admin:
  access_log_path: "/dev/null"
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 8001