FASTEST Low-Impact Envoy WASM Filter for API Audits

[jfbaro]

Hello!!

I'm working on integrating an Envoy Filter with WASM for audit logging purposes within my organization. Our goal is to selectively collect request and response data from certain API endpoints, without impacting the performance of the ISTIO Gateway. We have a couple of specific requirements and challenges:

• Selective Data Collection: We need the WASM filter to target only predefined APIs. Is there a way for the filter to access a persistent store or list specifying which endpoints to monitor, ensuring it only activates for these selected paths?
• Efficient Data Routing: The collected data needs to be sent to a separate local process for analysis, outside ISTIO’s critical path. It’s crucial that this data transfer is asynchronous to prevent any blocking or performance degradation on the ISTIO Gateway. What would be the best approach to achieve minimal overhead and ensure non-blocking behavior?
• Monitoring of the WASM filter: Have some basic metrics and application logs, so that we can troubleshoot problems. if they happen.

Our key goal is to deploy this feature for comprehensive audit logging, ensuring negligible to no impact on ISTIO Gateway performance. We acknowledge the potential for minimal data loss and are interested in strategies that balance reliability with efficiency. Insights, recommendations, or best practices on configuring the Envoy WASM filter and data routing with these priorities in mind would be immensely valuable.

Thanks for sharing your expertise!