emissary

emissary copied to clipboard

Please describe your use case / problem. I would like to use a built-in envoy http filter, but I see no way of enabling or configuring it with emissary-ingress.

Describe the solution you'd like Create a ConnectionManager CRD with an http_filters property for configuring any http_filter that's available through envoy. Or create something like the Filter CRD from EdgeStack in the base emissary-ingress and allow us to configure envoy filters through that.

Describe alternatives you've considered Export the generated envoy.json from a running stack, add the filters to that, then mount the file to the container in the base config folder.

Additional context

Hi @carlin-q-scott , filters are generally a feature of Edge Stack but we do have users who build their own features to work with Emissary. Could you tell us more about your use case for this Envoy http filter and point to the relevant link there?

We are investigating a similar use case is to load proxy wasm filter into envoy like below:

       - name: envoy.filters.http.wasm
        typed_config:
          "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
          value:
            config:
              name: "my_plugin"
              root_id: "my_root_id"
              configuration:
                "@type": "type.googleapis.com/google.protobuf.StringValue"
                value: |
                  {}
              vm_config:
                runtime: "envoy.wasm.runtime.v8"
                vm_id: "my_vm_id"
                code:
                  local:
                    filename: "/etc/envoy_filter_http_wasm_example.wasm"
                configuration: {}

Is there any plans to implement EnvoyFilter CRD or what alternative you can suggest?

Not exposing Envoy filters directly reduces the effective power from using Envoy in the first place.

In our case, we would like to be able to use Lua scripting to do some custom mitigations for certain types of attacks.

@chendo did you find a way by any chance?

Also looking a way to use a custom envoy filter in emissary installation

Are there any plans to include Filter & FilterPolicy CRD's from AES into Emissary? We are trying to add signal sciences agent as a sidecar to our emissary but it can't reroute traffic to the sidecar without these 2 CRD's. Please let me know.