# linux
$ wget https://github.com/tinygo-org/tinygo/releases/download/v0.30.0/tinygo0.30.0.linux-amd64.tar.gz
$ tar -xvf tinygo0.30.0.linux-amd64.tar.gz
$ export PATH=$PATH:~/tinygo/bin
$ tinygo version
tinygo version 0.30.0 linux/amd64 (using go version go1.17 and LLVM version 16.0.1)

$ mkdir wasm-go-demo && cd wasm-go-demo
$ go mod init github.com/cnych/wasm-go-demo
$ go get github.com/tetratelabs/proxy-wasm-go-sdk

package main

import (
 "regexp"

 "github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm"
 "github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm/types"
)

type vmContext struct {
 // 嵌入默認的 VM 上下文，這樣我們就不需要重新實現(xiàn)所有方法
 types.DefaultVMContext
}

func (ctx *vmContext) NewPluginContext(contextID uint32) types.PluginContext {
 return &pluginContext{}
}

type pluginContext struct {
 // 嵌入默認的插件上下文，這樣我們就不需要重新實現(xiàn)所有方法
 types.DefaultPluginContext

 pattern     string
 replaceWith string
 configData  string // 保存插件的一些配置信息
}

// 注入額外的 Header
var additionalHeaders = map[string]string{
 "who-am-i":    "go-wasm-demo",
 "injected-by": "istio-api!",
 "site":        "youdianzhishi.com",
 "author":      "陽明",
 // 定義自定義的header，每個返回中都添加以上header
}

// NewHttpContext 為每個 HTTP 請求創(chuàng)建一個新的上下文。
func (ctx *pluginContext) NewHttpContext(contextID uint32) types.HttpContext {
 return &httpRegex{
  contextID:     contextID,
  pluginContext: ctx,
 }
}

// OnPluginStart 在插件被加載時調(diào)用。
func (ctx *pluginContext) OnPluginStart(pluginCfgSize int) types.OnPluginStartStatus {
 proxywasm.LogWarnf("regex/main.go OnPluginStart()")
 // 獲取插件配置
 data, err := proxywasm.GetPluginConfiguration()
 if data == nil {
  return types.OnPluginStartStatusOK
 }
 if err != nil {
  proxywasm.LogWarnf("failed read plug-in config: %v", err)
  return types.OnPluginStartStatusFailed
 }

 proxywasm.LogWarnf("read plug-in config: %s\n", string(data))

 // 插件啟動的時候讀取配置
 ctx.configData = string(data)
 ctx.pattern = "banana/([0-9]*)"
 ctx.replaceWith = "status/$1"

 return types.OnPluginStartStatusOK
}

// OnPluginDone 在插件被卸載時調(diào)用。
func (ctx *pluginContext) OnPluginDone() bool {
 proxywasm.LogWarnf("regex/main.go OnPluginDone()")
 return true
}

type httpRegex struct {
 // 嵌入默認的 HTTP 上下文，這樣我們就不需要重新實現(xiàn)所有方法
 types.DefaultHttpContext
 // contextID 是插件上下文的 ID，它是唯一的。
 contextID     uint32
 pluginContext *pluginContext
}

// OnHttpResponseHeaders 在收到 HTTP 響應(yīng)頭時調(diào)用。
func (ctx *httpRegex) OnHttpResponseHeaders(numHeaders int, endOfStream bool) types.Action {
 proxywasm.LogWarnf("%d httpRegex.OnHttpResponseHeaders(%d, %t)", ctx.contextID, numHeaders, endOfStream)

 // 添加 Header
 for k, v := range additionalHeaders {
  if err := proxywasm.AddHttpResponseHeader(k, v); err != nil {
   proxywasm.LogWarnf("failed to add response header %s: %v", k, err)
  }
 }

 //為了便于演示觀察，將配置信息也加到返回頭里
 proxywasm.AddHttpResponseHeader("configData", ctx.pluginContext.configData)
 return types.ActionContinue
}

// OnHttpRequestHeaders 在收到 HTTP 請求頭時調(diào)用。
func (ctx *httpRegex) OnHttpRequestHeaders(numHeaders int, endOfStream bool) types.Action {
 proxywasm.LogWarnf("%d httpRegex.OnHttpRequestHeaders(%d, %t)", ctx.contextID, numHeaders, endOfStream)

 re := regexp.MustCompile(ctx.pluginContext.pattern)
 replaceWith := ctx.pluginContext.replaceWith

 s, err := proxywasm.GetHttpRequestHeader(":path")
 if err != nil {
  proxywasm.LogWarnf("Could not get request header: %v", err)
 } else {
  result := re.ReplaceAllString(s, replaceWith)
  proxywasm.LogWarnf("path: %s, result: %s", s, result)

  err = proxywasm.ReplaceHttpRequestHeader(":path", result)
  if err != nil {
   proxywasm.LogWarnf("Could not set request header to %q: %v", result, err)
  }
 }

 return types.ActionContinue
}

func (ctx *httpRegex) OnHttpStreamDone() {
 proxywasm.LogWarnf("%d OnHttpStreamDone", ctx.contextID)
}

func main() {
 proxywasm.LogWarnf("regex/main.go main() REACHED")
 // 設(shè)置 VM 上下文，這樣我們就可以在插件啟動時讀取配置。
 proxywasm.SetVMContext(&vmContext{})
}

tinygo build -o main.wasm -scheduler=none -target=wasi main.go

kubectl create configmap new-filter --from-file=new-filter.wasm=main.wasm

# httpbin.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: httpbin
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
    service: httpbin
spec:
  ports:
    - name: http
      port: 8000
      targetPort: 80
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
      annotations:
        # 不能在容器上使用 volume 掛載，因為它來自 injector。
        # NOTE: 我們這個示例始終掛在 "new-filter" ConfigMap 到 /var/local/wasm/new-filter.wasm
        sidecar.istio.io/userVolume: '[{"name":"new-filter","configMap":{"name":"new-filter"}}]'
        sidecar.istio.io/userVolumeMount: '[{"mountPath":"/var/local/wasm","name":"new-filter"}]'
    spec:
      serviceAccountName: httpbin
      containers:
        - image: docker.io/kennethreitz/httpbin
          imagePullPolicy: IfNotPresent
          name: httpbin
          ports:
            - containerPort: 80

kubectl apply -f httpbin.yaml
# 當(dāng)然要需要創(chuàng)建 VirtualService，在 Istio 根目錄下面
kubectl apply -f samples/httpbin/httpbin-gateway.yaml

$ export GATEWAY_URL=$(kubectl get po -l istio=ingressgateway -n istio-system -o 'jsnotallow={.items[0].status.hostIP}'):$(kubectl get svc istio-ingressgateway -n istio-system -o 'jsnotallow={.spec.ports[?(@.name=="http2")].nodePort}')
$ curl -v http://$GATEWAY_URL/status/418
> GET /status/418 HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 192.168.0.20:31896
> Accept: */*
>
< HTTP/1.1 418 Unknown
< server: istio-envoy
< date: Fri, 08 Dec 2023 07:28:57 GMT
< x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-origin: *
< access-control-allow-credentials: true
< content-length: 135
< x-envoy-upstream-service-time: 2
<

    -=[ teapot ]=-

       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/
        `"""`

$ curl -v http://$GATEWAY_URL/banana/418
> GET /banana/418 HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 192.168.0.20:31896
> Accept: */*
>
< HTTP/1.1 404 Not Found
< server: istio-envoy
< date: Fri, 08 Dec 2023 07:30:19 GMT
< content-type: text/html
< content-length: 233
< access-control-allow-origin: *
< access-control-allow-credentials: true
< x-envoy-upstream-service-time: 9
<
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>404 Not Found</title>
<h1>Not Found</h1>
<p>The requested URL was not found on the server.  If you entered the URL manually please check your spelling and try again.</p>

$ kubectl get pods -l app=httpbin
NAME                       READY   STATUS    RESTARTS   AGE
httpbin-55db5999b4-qtlcg   2/2     Running   0          8m23s
$ kubectl exec -it httpbin-55db5999b4-qtlcg -c istio-proxy -- ls /var/local/wasm
new-filter.wasm

# httpbin-wasm-filter.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: httpbin-wasm-filter
spec:
  workloadSelector:
    labels:
      app: httpbin
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND # 僅對入站流量進行過濾
        listener:
          filterChain:
            filter:
              name: envoy.filters.network.http_connection_manager
              subFilter:
                name: envoy.filters.http.router
      patch:
        operation: INSERT_BEFORE # 在 router 之前插入
        value:
          name: mydummy
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
            value:
              config:
                configuration:
                  "@type": type.googleapis.com/google.protobuf.StringValue
                  value: dummy
                root_id: "regex_replace"
                vm_config:
                  code:
                    local:
                      filename: /var/local/wasm/new-filter.wasm
                  runtime: envoy.wasm.runtime.v8
                  vm_id: myvmdummy

kubectl apply -f httpbin-wasm-filter.yaml

$ kubectl logs -f httpbin-55db5999b4-qtlcg -c istio-proxy
# ......
2023-12-08T07:48:03.605802Z     warning envoy wasm external/envoy/source/extensions/common/wasm/context.cc:1151 wasm log: regex/main.go main() REACHED  thread=25
2023-12-08T07:48:03.606902Z     warning envoy wasm external/envoy/source/extensions/common/wasm/context.cc:1151 wasm log regex_replace myvmdummy: read plug-in config: dummy
        thread=25
2023-12-08T07:48:03.729847Z     info    Readiness succeeded in 1.025422807s
2023-12-08T07:48:03.730148Z     info    Envoy proxy is ready

$ curl -v http://$GATEWAY_URL/banana/418
> GET /banana/418 HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 192.168.0.20:31896
> Accept: */*
>
< HTTP/1.1 418 Unknown
< server: istio-envoy
< date: Fri, 08 Dec 2023 08:11:17 GMT
< x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-origin: *
< access-control-allow-credentials: true
< content-length: 135
< x-envoy-upstream-service-time: 10
< who-am-i: go-wasm-demo
< injected-by: istio-api!
< site: youdianzhishi.com
< author: 陽明
< configdata: dummy
<

    -=[ teapot ]=-

       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: your-filter
spec:
  selector:
    matchLabels:
      app: server
  phase: AUTHN
  priority: 10
  pluginConfig:
    someSetting: true
    someOtherSetting: false
    youNameIt:
      - first
      - second
  url: docker.io/your-org/your-filter:1.0.0

# Dockerfile for building "compat" variant of Wasm Image Specification.
# https://github.com/solo-io/wasm/blob/master/spec/spec-compat.md

FROM scratch

COPY main.wasm ./plugin.wasm

FROM tinygo/tinygo as build
WORKDIR /src

COPY . .
RUN go env -w GOPROXY=https://goproxy.cn,direct
RUN tinygo build -o main.wasm -scheduler=none -target=wasi ./main.go

FROM scratch

COPY --from=build /src/main.wasm ./plugin.wasm

docker build -t cnych/wasm-go-demo:v0.1 .
docker.io/cnych/wasm-go-demo:v0.1

# httpbin-wasm-plugin.yaml
apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: httpbin-wasm-plugin
  namespace: default
spec:
  selector:
    matchLabels:
      app: httpbin
  url: oci://docker.io/cnych/wasm-go-demo:v0.1
  pluginConfig:
    testConfig: abcd
    website: youdianzhishi.com
    listconfig:
      - abc
      - def

$ kubectl delete cm new-filter
configmap "new-filter" deleted
$ kubectl delete envoyfilter httpbin-wasm-filter
envoyfilter.networking.istio.io "httpbin-wasm-filter" deleted

apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
      # annotations: # 去掉這里的注解
    spec:
      serviceAccountName: httpbin
      containers:
        - image: docker.io/kennethreitz/httpbin
          imagePullPolicy: IfNotPresent
          name: httpbin
          ports:
            - containerPort: 80

$ kubectl apply -f httpbin-wasm-plugin.yaml
$ kubectl get wasmplugins
NAME                  AGE
httpbin-wasm-plugin   5s

$ kubectl logs -f httpbin-86869bccff-6wqdc -c istio-proxy
# ......
2023-12-08T08:43:11.360127Z     warning envoy wasm external/envoy/source/extensions/common/wasm/context.cc:1151 wasm log: regex/main.go main() REACHED  thread=25
2023-12-08T08:43:11.360757Z     warning envoy wasm external/envoy/source/extensions/common/wasm/context.cc:1151 wasm log: regex/main.go OnPluginStart() thread=25
2023-12-08T08:43:11.360895Z     warning envoy wasm external/envoy/source/extensions/common/wasm/context.cc:1151 wasm log: read plug-in config: {"listconfig":["abc","def"],"testConfig":"abcd","website":"youdianzhishi.com"}
        thread=25
2023-12-08T08:43:12.692961Z     info    Readiness succeeded in 6.774251572s
2023-12-08T08:43:12.693263Z     info    Envoy proxy is ready

$ curl -v http://$GATEWAY_URL/banana/418
> GET /banana/418 HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 192.168.0.20:31896
> Accept: */*
>
< HTTP/1.1 418 Unknown
< server: istio-envoy
< date: Fri, 08 Dec 2023 08:45:29 GMT
< x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-origin: *
< access-control-allow-credentials: true
< content-length: 135
< x-envoy-upstream-service-time: 8
< who-am-i: go-wasm-demo
< injected-by: istio-api!
< site: youdianzhishi.com
< author: 陽明
< configdata: {"listconfig":["abc","def"],"testConfig":"abcd","website":"youdianzhishi.com"}
<

    -=[ teapot ]=-

       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/
        `"""`