WebAssembly 在云原生中的应用：从浏览器到 K8s 数据面

# 下载 runwasi 发行版（包含各 runtime 的 shim）
RUNWASI_VERSION=0.5.0
curl -LO https://github.com/containerd/runwasi/releases/download/containerd-shim-wasmtime/v${RUNWASI_VERSION}/containerd-shim-wasmtime-v${RUNWASI_VERSION}-x86_64-linux.tar.gz
tar xzf containerd-shim-wasmtime-*.tar.gz
mv containerd-shim-wasmtime-v1 /usr/local/bin/
chmod +x /usr/local/bin/containerd-shim-wasmtime-v1

# 重启 containerd
systemctl restart containerd

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.wasmtime]
  runtime_type = "io.containerd.wasmtime.v1"

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: wasmtime
handler: wasmtime

# 用 Rust 编译一个简单的 Wasm HTTP 服务
# Cargo.toml 里 target = "wasm32-wasip1"
cargo build --target wasm32-wasip1 --release

# 打包成 OCI 镜像
# wasm-to-oci 或直接用 oci-spec-rs
docker buildx build --platform wasi/wasm \
  -t registry.example.com/my-wasm-app:latest \
  --push .

# Pod 使用 wasmtime RuntimeClass
apiVersion: v1
kind: Pod
metadata:
  name: wasm-hello
spec:
  runtimeClassName: wasmtime
  containers:
  - name: app
    image: registry.example.com/my-wasm-app:latest
    # Wasm 模块不需要 CMD，wasmtime 直接执行 _start 导出函数

# 安装 cert-manager（依赖）
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml

# 安装 SpinKube operator
helm install spin-operator \
  --namespace spin-operator \
  --create-namespace \
  --version 0.3.0 \
  --wait \
  oci://ghcr.io/spinkube/charts/spin-operator

# 安装 RuntimeClass 和 SpinAppExecutor
kubectl apply -f https://github.com/spinkube/spin-operator/releases/download/v0.3.0/spin-operator.runtime-class.yaml
kubectl apply -f https://github.com/spinkube/spin-operator/releases/download/v0.3.0/spin-operator.spin-app-executor.yaml

// src/lib.rs - 一个 Spin HTTP handler
use spin_sdk::http::{IntoResponse, Request, Response};
use spin_sdk::http_component;

#[http_component]
fn handle_request(req: Request) -> anyhow::Result<impl IntoResponse> {
    println!("收到请求: {:?}", req.headers());
    Ok(Response::builder()
        .status(200)
        .header("Content-Type", "application/json")
        .body(r#"{"status":"ok","runtime":"spin-wasm"}"#)
        .build())
}

# spin.toml
spin_manifest_version = 2

[application]
name = "my-service"
version = "0.1.0"

[[trigger.http]]
route = "/..."
component = "my-service"

[component.my-service]
source = "target/wasm32-wasip1/release/my_service.wasm"
[component.my-service.build]
command = "cargo build --target wasm32-wasip1 --release"
watch = ["src/**/*.rs", "Cargo.toml"]

apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: my-service
  namespace: production
spec:
  image: "registry.example.com/my-service:v1.0.0"
  replicas: 3
  executor: containerd-shim-spin
  resources:
    limits:
      cpu: 100m
      memory: 64Mi  # Wasm 应用内存占用极低
    requests:
      cpu: 10m
      memory: 16Mi

# Cargo.toml
[package]
name = "rate-limit-header"
version = "0.1.0"
edition = "2021"

[lib]
crate-type = ["cdylib"]

[dependencies]
proxy-wasm = "0.2"
serde = { version = "1", features = ["derive"] }
serde_json = "1"

// src/lib.rs - 给所有响应注入限流头
use proxy_wasm::traits::*;
use proxy_wasm::types::*;

proxy_wasm::main! {{
    proxy_wasm::set_log_level(LogLevel::Trace);
    proxy_wasm::set_root_context(|_| -> Box<dyn RootContext> {
        Box::new(RateLimitRoot)
    });
}}

struct RateLimitRoot;
impl Context for RateLimitRoot {}
impl RootContext for RateLimitRoot {
    fn create_http_context(&self, _: u32) -> Option<Box<dyn HttpContext>> {
        Some(Box::new(RateLimitFilter))
    }
    fn get_type(&self) -> Option<ContextType> {
        Some(ContextType::HttpContext)
    }
}

struct RateLimitFilter;
impl Context for RateLimitFilter {}
impl HttpContext for RateLimitFilter {
    fn on_http_response_headers(&mut self, _: usize, _: bool) -> Action {
        self.set_http_response_header("X-Ratelimit-Limit", Some("1000"));
        self.set_http_response_header("X-Powered-By", Some("envoy-wasm"));
        Action::Continue
    }
}

# 编译
cargo build --target wasm32-unknown-unknown --release
# 产物：target/wasm32-unknown-unknown/release/rate_limit_header.wasm

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: rate-limit-header
  namespace: my-app
spec:
  selector:
    matchLabels:
      app: backend  # 只注入到 backend Pod 的 sidecar
  url: oci://registry.example.com/wasm/rate-limit-header:v1.0.0
  phase: STATS  # 在 stats filter 之后执行
  pluginConfig:
    max_requests: 1000

# 把 Rego policy 编译成 wasm bundle
opa build -t wasm -e 'authz/allow' policy.rego

# 产物是一个 bundle.tar.gz，里面包含 policy.wasm
# 在应用里用 @open-policy-agent/opa-wasm（JS）或 wasmtime（Rust/Go）执行

// 注册一个 custom_jwt_verify built-in
// 让 Rego 可以调用：custom_jwt_verify(token, pubkey)
use opa_wasm_sdk::*;

#[no_mangle]
pub extern "C" fn custom_jwt_verify(token_ptr: i32, key_ptr: i32) -> i32 {
    // 自定义 JWT 验证逻辑（比如支持特殊算法）
    // 返回 1 表示有效，0 表示无效
    todo!()
}

# 用 OPA Gatekeeper + Wasm bundle 替代纯 Rego
# 把复杂的 Go 逻辑编译成 Wasm，在 Gatekeeper 中调用
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: customjwtpolicy
spec:
  crd:
    spec:
      names:
        kind: CustomJwtPolicy
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package customjwtpolicy
      # 调用 Wasm 编译的内置函数
      violation[{"msg": msg}] {
        token := input.review.object.metadata.annotations["auth-token"]
        not custom_jwt_verify(token, data.pubkey)
        msg := "invalid JWT token"
      }

// 用 wasmtime 嵌入式运行时执行用户代码
use wasmtime::*;

fn execute_user_code(wasm_bytes: &[u8], input: &str) -> Result<String> {
    let engine = Engine::default();
    let mut store = Store::new(&engine, ());

    // 限制资源：最多执行 1 亿条指令，最多 64MB 内存
    let mut limits = StoreLimitsBuilder::new()
        .fuel(100_000_000)
        .memory_size(64 * 1024 * 1024)
        .build();
    store.limiter(|_| &mut limits);
    store.add_fuel(100_000_000)?;

    // 不暴露任何 WASI 接口，完全沙箱
    let module = Module::new(&engine, wasm_bytes)?;
    let instance = Instance::new(&mut store, &module, &[])?;

    let run = instance.get_typed_func::<(), i32>(&mut store, "run")?;
    let result = run.call(&mut store, ())?;

    Ok(format!("exit code: {}", result))
}

# 用 SpinKube 部署代码执行沙箱服务
apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: code-executor
  namespace: ai-agents
spec:
  image: "registry.example.com/code-executor:v1.0.0"
  replicas: 5
  executor: containerd-shim-spin
  resources:
    limits:
      cpu: 500m
      memory: 512Mi  # Wasm 沙箱内的内存限制由代码控制，这里是节点级别限制