Investigate integration w/ envoy-wasm filters

[tsandall]

With OPA and Envoy support for Wasm reaching maturity, it's time we try to integrate them! We should aim to create a minimal example that shows how to compile HTTP API authorization policies into Wasm and have them enforced in Envoy.

• Configuration: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/wasm_filter#
• Example: https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/wasm-cc.html?highlight=wasm

[srenatus]

ℹ️ This is an interesting capability: https://github.com/tetratelabs/proxy-wasm-go-sdk/blob/main/proxywasm/hostcall.go#L263-L278 wasm instances can share data using a KV host api.

[srenatus]

WebAssembly/binaryen#2767 👈 This would allow for a pretty clean separation: we'd use the proxy-wasm-cpp-sdk (or even the rust one) to compile a shim that uses opa's wasm's exported functions, and use a tool like that to link wasm modules together.

[tsandall]

Moving this back to TODO because it's lower priority than other issues/features. One thing we know we need is better linking support for wasm modules (e.g., dynamically inside Envoy or statically within OPA or opa-envoy...)

[guyromb]

I would go for OPA if this was supported! @tsandall

[stale]

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.