© 2020 Build > meshctl wasm init addheader-filter --language rust > meshctl wasm build rust -t webassemblyhub.io/yuval/addheader-rust:v1 ./addheader-filter ABI: Application Binary Interface 13 13 | Copyright © 2020 > meshctl wasm push webassemblyhub.io/yuval/addheader-rust:v1 Build Store 14 | Copyright © 2020 Build Store WASM Artifact Image Specification 15 | Copyright © 2020 Build --deployment-name ratings-add-header --namespace bookinfo --image webassemblyhub.io/yuval/addheader-rust:v1 --cluster mgmt-cluster --labels app=ratings Extension Config Discovery Service EXTERNAL AUTH

● wazero is the only zero dependency WebAssembly runtime written in Go. ● Contribute to Go/TinyGo/Rust ● Using WasmPlugin API to extend Istio ● GitHub: tetratelabs/wazero Istio Security Scanner ● Make

○ 敏捷性：过滤器可以动态加载到正在运行的Envoy进程中，而无需停止或重新编译。 ○ 可维护性：不必更改Envoy自身基础代码库即可扩展其功能。 ○ 多样性：可以将流行的编程语言（例如C/C++和Rust）编译为WASM，因此开发人员可 以选择实现过滤器的编程语言。 ○ 可靠性和隔离性：过滤器会被部署到VM沙箱中，因此与Envoy进程本身是隔离的；即使 当WASM Filter出现问题导致崩溃时，它也不会影响Envoy进程。

Monitor Enforce Verify Security Lifecycle Concepts Secure Monitor Enforce Verify Deploy comprehensive multi-layer security mechanisms. Enforce that the security mechanisms are not tampered.

differences are errors Challenge • Assertion creation/maintenance is effort intensive Solution • Comprehensive comparison of results • ML-driven identification of decision rules • Human review to accept

Group responds swi�ly to security disclosures. ● The documentation on the projectʼs security is comprehensive, well-written and up to date. ● Security vulnerability disclosures follow industry standards