example-filter.yaml

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: example-filter
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: example-filter-config
        config_discovery:
          config_source:
            ads: {}
            initial_fetch_timeout: 0s
          type_urls: [ "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm"]
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: example-filter-config
spec:
  configPatches:
  - applyTo: EXTENSION_CONFIG
    match:
      context: SIDECAR_INBOUND
    patch:
      operation: ADD
      value:
        name: example-filter-config
        typed_config:
          '@type': type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
          value:
            config:
              vm_config:
                code:
                  remote:
                    http_uri:
                      uri: https://storage.googleapis.com/istio-ecosystem/wasm-extensions/example/1.9.0.wasm
                    # Optional: specifying checksum will let istio agent
                    # verify the checksum of download artifacts. Missing
                    # checksum will cause the Wasm module to be downloaded
                    # repeatedly
                    sha256: d53a7f59658b0e154338fc50a4a1545e763ca01b5cc5e013f09c99865ee57aad
                runtime: envoy.wasm.runtime.v8