How to go about accessing a file from a WASM filter?

Config
1

Description:
I’m running minikube with Istio, and am using Rust to code the filter. My current goal is to be able to access a JSON file to configure certain aspects of the filter. Where and how would one go about placing this file, and is there accessing it?

I understand that a WASM VM is used, and that Istio handles its configuration as shown below in the vmConfig section. Would there be someway to insert my JSON file there?

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: imagehub-filter
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND # will match inbound listeners in all sidecars
      proxy:
        proxyVersion: '^1\.9.*'
      listener:
        portNumber: 9091
        filterChain:
          filter:
            name: envoy.http_connection_manager
            subFilter:
              name: envoy.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filter.http.wasm
        typed_config:
          "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
          value:
            config:
              configuration:
                '@type': type.googleapis.com/google.protobuf.StringValue
                value: "rate_limit_filter"
              root_id: "rate_limit_filter"
              vmConfig:
                code:
                  local:
                    filename: "/var/lib/imagehub/filter.wasm"
                runtime: envoy.wasm.runtime.v8
                vmId: rate_limit_filter
                allow_precompiled: true
  workloadSelector:
    labels:
      app: api
      version: v1

Currently my code in Rust is pretty standard:

let file_path = Path::new("filter.json");
let file = File::open(file_path).unwrap();
let reader = BufReader::new(file);

Resources:

2

You can pass configuration using the configuration field, which you already use:

And you can read it inside the Proxy-Wasm plugin in the on_configure callback:

The limited read-only access to files will be added in Istio 1.10, but currently there is no way to access files from within Proxy-Wasm sandbox.

3

Can you consider fetching file over an http endpoint? That is already supported.

4

@Piotr_Sikora @mandarjog Thank you for your responses!

@Piotr_Sikora I apologize for not giving the correct details. My actual configuration looks like so:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: imagehub-filter
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND # will match inbound listeners in all sidecars
      proxy:
        proxyVersion: '^1\.9.*'
      listener:
        portNumber: 9091
        filterChain:
          filter:
            name: envoy.http_connection_manager
            subFilter:
              name: envoy.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filter.http.wasm
        typed_config:
          "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
          value:
            config:
              configuration:
                '@type': type.googleapis.com/google.protobuf.StringValue
                value: "rate_limit_filter"
              root_id: "rate_limit_filter"
              vmConfig:
                code:
                  local:
                    filename: "/var/lib/imagehub/filter.wasm"
                runtime: envoy.wasm.runtime.v8
                vmId: rate_limit_filter
                allow_precompiled: true
  workloadSelector:
    labels:
      app: api
      version: v1

In this case, how would I go about inserting the JSON contents here?

@mandarjog is there a specific function call I would need to make?

5

Or