Istio Envoy Filter BOOTSTRAP EXTENSION is not executing the WASM

Policies and Telemetry
1

istio/proxyv2:1.12.2

I’m trying to add a WASM file to the EnvoyFilter patching under the bootstrap_extensions. The Envoyfilter successfully is pushed but I couldn’t see my WASM getting executed (checked the logs & same WASM file worked on HTTP_FILTER). Below is my Envoyfilter configuration.
I currently ran out of options to debug. Is there any other way I can debug if WASM is being executed? Thanks.
NOTE: I’m running this on envoy-ingressgateway, not on the service side car proxy.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: wasm-service
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: istio-ingressgateway
  configPatches:
    - applyTo: BOOTSTRAP
      patch:
        operation: ADD
        value:
          bootstrap_extensions:
          - name: envoy.bootstrap.wasm
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.wasm.v3.WasmService
              singleton: true
              config:
                name: test_config
                configuration:
                  "@type": type.googleapis.com/google.protobuf.StringValue
                  value: |
                      {
                        "my_config_value": "my_value"
                      }
                vm_config:
                  vm_id: basic-wasm-service
                  runtime: "envoy.wasm.runtime.v8"
                  code:
                    remote:
                      http_uri:
                        uri: https://github.com/srikarrao/test-resources-access/raw/main/wasm/golang/singleton-example/main.wasm

EnvoyFilter Info after kube-apply.

$ kubectl describe envoyfilter wasm-service -n istio-system

Name:         wasm-service
Namespace:    istio-system
Labels:       <none>
Annotations:  <none>
API Version:  networking.istio.io/v1alpha3
Kind:         EnvoyFilter
Metadata:
  Creation Timestamp:  2022-02-17T17:48:42Z
  Generation:          1
  Managed Fields:
    API Version:  networking.istio.io/v1alpha3
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:kubectl.kubernetes.io/last-applied-configuration:
      f:spec:
        .:
        f:configPatches:
        f:workloadSelector:
          .:
          f:labels:
            .:
            f:app:
    Manager:         kubectl-client-side-apply
    Operation:       Update
    Time:            2022-02-17T17:48:42Z
  Resource Version:  2264688
  UID:               3c3318dd-8671-45ef-a840-764910db7348
Spec:
  Config Patches:
    Apply To:  BOOTSTRAP
    Patch:
      Operation:  ADD
      Value:
        bootstrap_extensions:
          Name:  envoy.bootstrap.wasm
          typed_config:
            @type:  type.googleapis.com/envoy.extensions.wasm.v3.WasmService
            Config:
              Configuration:
                @type:  type.googleapis.com/google.protobuf.StringValue
                Value:  {
  "my_config_value": "my_value"
}

              Name:  test_config
              vm_config:
                Code:
                  Remote:
                    http_uri:
                      Uri:  https://github.com/srikarrao/test-resources-access/raw/main/wasm/golang/singleton-example/main.wasm
                Runtime:    envoy.wasm.runtime.v8
                vm_id:      basic-wasm-service
            Singleton:      true
  Workload Selector:
    Labels:
      App:  istio-ingressgateway
Events:     <none>

kubectl get envoyfilter -A
NAMESPACE      NAME                    AGE
istio-system   stats-filter-1.10       85m
istio-system   stats-filter-1.11       85m
istio-system   stats-filter-1.12       85m
istio-system   tcp-stats-filter-1.10   85m
istio-system   tcp-stats-filter-1.11   85m
istio-system   tcp-stats-filter-1.12   85m
istio-system   wasm-service            15m
2

I am facing same issue. Were you able to resolve this? how?

3

Instead of EnvoyFilter patch on bootstrap, maybe you should use a custom bootstrap