Uploaded August 2026 | Updated September 2026, 2 weeks ago
Don't miss out! Join us at our next KubeCon + CloudNativeCon events in Shanghai, China (8-9 September, 2026) and Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io
Beyond Wasm: How Dynamic Modules Let You Extend Envoy Proxy in Go, Rust, or Any Language - Rohit Agrawal, Databricks, Inc. & Takeshi Yoneda, Netflix
Envoy powers Istio, Cilium Proxy, Envoy Gateway, and thousands of production deployments. But extending it is hard today. C++ filters mean maintaining a fork. WASM delivered sandbox overhead, limited extension points, and a stalling ecosystem.
We built Dynamic Modules to fix this and are now using it at Databricks and Netflix. They let you write Envoy extensions as shared libraries in Go, Rust, or any language with a C ABI. Near-native performance, no sandbox, no rebuild. Both companies are replacing C++ forks and Wasm with native Rust, cutting tail latency and memory use while shipping features faster.
As Envoy maintainers and co-authors, we cover how Go/Rust SDKs work across 12+ extension points including network filters, LB policies, and custom clusters. We'll have a live demo of a Rust TLS Transport Socket enabling kernel TLS (kTLS) which is impossible today with BoringSSL and what this means for Istio, Cilium, and Envoy Gateway users who need extensibility without C++ or WASM.
Don't miss out! Join us at our next KubeCon + CloudNativeCon events in Shanghai, China (8-9 September, 2026) and Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io
Beyond Wasm: How Dynamic Modules Let You Extend Envoy Proxy in Go, Rust, or Any Language - Rohit Agrawal, Databricks, Inc. & Takeshi Yoneda, Netflix
Envoy powers Istio, Cilium Proxy, Envoy Gateway, and thousands of production deployments. But extending it is hard today. C++ filters mean maintaining a fork. WASM delivered sandbox overhead, limited extension points, and a stalling ecosystem.
We built Dynamic Modules to fix this and are now using it at Databricks and Netflix. They let you write Envoy extensions as shared libraries in Go, Rust, or any language with a C ABI. Near-native performance, no sandbox, no rebuild. Both companies are replacing C++ forks and Wasm with native Rust, cutting tail latency and memory use while shipping features faster.
As Envoy maintainers and co-authors, we cover how Go/Rust SDKs work across 12+ extension points including network filters, LB policies, and custom clusters. We'll have a live demo of a Rust TLS Transport Socket enabling kernel TLS (kTLS) which is impossible today with BoringSSL and what this means for Istio, Cilium, and Envoy Gateway users who need extensibility without C++ or WASM.
