1.21.3. WasmPlugin API reference

spec.selector

WorkloadSelector

Criteria used to select the specific set of pods/VMs on which this plugin configuration should be applied. If omitted, this configuration will be applied to all workload instances in the same namespace. If the WasmPlugin field is present in the config root namespace, it will be applied to all applicable workloads in any namespace.

No

spec.url

string

URL of a Wasm module or OCI container. If no scheme is present, defaults to oci://, referencing an OCI image. Other valid schemes are file:// for referencing .wasm module files present locally within the proxy container, and http[s]:// for .wasm module files hosted remotely.

No

spec.sha256

string

SHA256 checksum that will be used to verify the Wasm module or OCI container. If the url field already references a SHA256 (using the @sha256: notation), it must match the value of this field. If an OCI image is referenced by tag and this field is set, its checksum will be verified against the contents of this field after pulling.

No

spec.imagePullPolicy

PullPolicy

The pull behavior to be applied when fetching an OCI image. Only relevant when images are referenced by tag instead of SHA. Defaults to the value IfNotPresent, except when an OCI image is referenced in the url field and the latest tag is used, in which case the value Always is the default, mirroring K8s behavior. Setting is ignored if the url field is referencing a Wasm module directly using file:// or http[s]://.

No

spec.imagePullSecret

string

Credentials to use for OCI image pulling. The name of a secret in the same namespace as the WasmPlugin object that contains a pull secret for authenticating against the registry when pulling the image.

No

spec.phase

PluginPhase

Determines where in the filter chain this WasmPlugin object is injected.

No

spec.priority

int64

Determines the ordering of WasmPlugins objects that have the same phase value. When multiple WasmPlugins objects are applied to the same workload in the same phase, they will be applied by priority and in descending order. If the priority field is not set, or two WasmPlugins objects with the same value, the ordering will be determined from the name and namespace of the WasmPlugins objects. Defaults to the value 0.

No

spec.pluginName

string

The plugin name used in the Envoy configuration. Some Wasm modules might require this value to select the Wasm plugin to execute.

No

spec.pluginConfig

Struct

The configuration that will be passed on to the plugin.

No

spec.pluginConfig.verificationKey

string

The public key used to verify signatures of signed OCI images or Wasm modules. Must be supplied in PEM format.

No

matchLabels

map<string, string>

One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. The scope of label search is restricted to the configuration namespace in which the resource is present.

Yes