Kuadrant/wasm-shim

Wasm-shim is a Proxy-Wasm module that acts as a shim between Envoy and external authorization and rate-limiting services.

The tool solves the problem of integrating rate limiting and external authorization into Envoy proxies by providing a configurable middleware layer. It works by accepting a declarative configuration that defines services, action sets, and request/response pipelines. Requests flow through ordered action sets where each action can invoke gRPC calls to external services, branch on responses, modify headers, deny requests, or store data for later evaluation using CEL expressions. Actions support predicates to conditionally execute, terminal flags to stop processing, and execution modes for parallel or sequential evaluation.

The project suits teams running Envoy who need to integrate Authorino for authorization decisions and Limitador for rate limiting without building custom filters. It is particularly relevant for those using Kuadrant, which appears to be the broader ecosystem context. The tool's strength lies in its declarative action pipeline model, which allows complex request processing logic without writing code. The configuration schema supports dynamic gRPC services for extensibility, tracing integration via OpenTelemetry, and fine-grained control over action execution order and blocking behavior.

The project shows consistent maintenance with regular commits addressing bug fixes and feature additions. Pull requests receive timely reviews and are merged promptly. Issues are actively triaged and responded to by maintainers. The codebase demonstrates attention to test coverage and documentation updates accompanying new features. Development activity indicates a stable, actively supported project rather than experimental or dormant work.