apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: {{ .WasmPluginName }}
  {{- if .WasmPluginVersion }}
  annotations:
    wasmPluginVersion: {{ .WasmPluginVersion }}
  {{- end }}
spec:
  phase: STATS
  targetRef:
    kind: {{ .TargetKind }}
    group: {{ .TargetGroup }}
    name: {{ .TargetName }}
  {{- if .TestWasmModuleURL }}
  url: {{ .TestWasmModuleURL }}
  {{- end }}
  imagePullSecret: reg-cred

)

var _ analysis.Analyzer = &SelectorAnalyzer{}

type SelectorAnalyzer struct{}

var policyGVKs = []config.GroupVersionKind{
	gvk.AuthorizationPolicy,
	gvk.RequestAuthentication,
	gvk.Telemetry,
	gvk.WasmPlugin,
}

type policy interface {
	GetSelector() *typev1beta1.WorkloadSelector
	GetTargetRef() *typev1beta1.PolicyTargetReference
}

func (w *SelectorAnalyzer) Metadata() analysis.Metadata {

apiVersion: release-notes/v2
kind: feature
area: extensibility
issue: []
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: feature
area: extensibility
issue: []
releaseNotes:
  - |
    **Improved** WasmPlugin images (docker and OCI standard image) to support more than one layer as per spec changes.

CustomResourceDefini metadata: annotations: "helm.sh/resource-policy": keep labels: app: istio-pilot chart: istio heritage: Tiller release: istio name: wasmplugins.extensions.istio.io spec: group: extensions.istio.io names: categories: - istio-io - extensions-istio-io kind: WasmPlugin listKind: WasmPluginList plural: wasmplugins singular: wasmplugin scope: Namespaced versions: - additionalPrinterCol: - description: 'CreationTimestamp is a timestamp representing the server time when this object was...

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: {{ .WasmPluginName }}
  {{- if .WasmPluginVersion }}
  annotations:
    wasmPluginVersion: {{ .WasmPluginVersion }}
  {{- end }}
spec:
  phase: STATS
  targetRef:
    kind: Gateway
    group: gateway.networking.k8s.io
    name: {{ .TargetGatewayName}}
  {{- if .TestWasmModuleURL }}
  url: {{ .TestWasmModuleURL }}
  {{- end }}
  imagePullSecret: reg-cred

					Spec: &extensions.WasmPlugin{
						Phase: extensions.PluginPhase_AUTHZ,
						Type:  extensions.PluginType_NETWORK,
					},
				},
				{
					Meta: config.Meta{Name: "wasm-authn", Namespace: "istio-system", GroupVersionKind: gvk.WasmPlugin},
					Spec: &extensions.WasmPlugin{
						Phase: extensions.PluginPhase_AUTHN,

      operations:  ["CREATE", "UPDATE"]
      resources:   ["*"]
  variables:
    - name: isEnvoyFilter
      expression: "object.kind == 'EnvoyFilter'"
    - name: isWasmPlugin
      expression: "object.kind == 'WasmPlugin'"
    - name: isProxyConfig
      expression: "object.kind == 'ProxyConfig'"
    - name: isTelemetry
      expression: "object.kind == 'Telemetry'"
  validations:
    - expression: "!variables.isEnvoyFilter"

	// name of environment variable at Wasm VM, which will carry the Wasm image pull policy.
	WasmPolicyEnv = "ISTIO_META_WASM_IMAGE_PULL_POLICY"
	// name of environment variable at Wasm VM, which will carry the resource version of WasmPlugin.
	WasmResourceVersionEnv = "ISTIO_META_WASM_PLUGIN_RESOURCE_VERSION"

	WasmHTTPFilterType    = APITypePrefix + wellknown.HTTPWasm
	WasmNetworkFilterType = APITypePrefix + "envoy.extensions.filters.network.wasm.v3.Wasm"

      operations:  ["CREATE", "UPDATE"]
      resources:   ["*"]
  variables:
    - name: isEnvoyFilter
      expression: "object.kind == 'EnvoyFilter'"
    - name: isWasmPlugin
      expression: "object.kind == 'WasmPlugin'"
    - name: isProxyConfig
      expression: "object.kind == 'ProxyConfig'"
    - name: isTelemetry
      expression: "object.kind == 'Telemetry'"
  validations:
    - expression: "!variables.isEnvoyFilter"