api: add vmID to EnvoyExtensionPolicy Wasm extensions

Envoy Gateway derives the Envoy Wasm `VmConfig.vm_id` from a name that is
unique per EnvoyExtensionPolicy Wasm entry, so two policies that configure the
exact same Wasm module still start two separate Wasm VMs. That is a safe
default, but it makes the memory cost of a module grow linearly with the number
of policies that attach it, which is the common shape when policies are managed
per service or per route.

Add an optional `vmID` field to the Wasm API that is passed through to
`VmConfig.vm_id`. Wasm extensions that set the same `vmID` and are backed by the
same Wasm code share a single Envoy Wasm VM. Leaving `vmID` unset keeps the
current per-extension VM ID, so existing policies are unaffected.

Fixes #9565

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: MohammadMahdi Ahmadi <mm.ahmadi0101@gmail.com>

Author: MohammadmahdiAhmadi

api/v1alpha1/wasm_types.go

@@ -38,6 +38,20 @@ type Wasm struct {
 	// Note: RootID must match the root_id parameter used to register the Context in the Wasm code.
 	RootID *string `json:"rootID,omitempty"`
 
+	// VMID is the ID of the Wasm VM that runs this extension. Extensions with the
+	// same VMID and the same Wasm code share a single VM, which saves the memory a
+	// separate VM per extension would use.
+	// If not specified, EG generates a VM ID that is unique to this extension, so
+	// extensions never share a VM.
+	//
+	// Note: extensions sharing a VM also share its global state, and the VM is started
+	// with the configuration of the first extension that initializes it.
+	//
+	// +optional
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	VMID *string `json:"vmID,omitempty"`
+
 	// Code is the Wasm code for the extension.
 	Code WasmCodeSource `json:"code"`
 

api/v1alpha1/zz_generated.deepcopy.go

@@ -2427,6 +2427,19 @@ spec:
 
                         Note: RootID must match the root_id parameter used to register the Context in the Wasm code.
                       type: string
+                    vmID:
+                      description: |-
+                        VMID is the ID of the Wasm VM that runs this extension. Extensions with the
+                        same VMID and the same Wasm code share a single VM, which saves the memory a
+                        separate VM per extension would use.
+                        If not specified, EG generates a VM ID that is unique to this extension, so
+                        extensions never share a VM.
+
+                        Note: extensions sharing a VM also share its global state, and the VM is started
+                        with the configuration of the first extension that initializes it.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
                   required:
                   - code
                   type: object

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml

@@ -2426,6 +2426,19 @@ spec:
 
                         Note: RootID must match the root_id parameter used to register the Context in the Wasm code.
                       type: string
+                    vmID:
+                      description: |-
+                        VMID is the ID of the Wasm VM that runs this extension. Extensions with the
+                        same VMID and the same Wasm code share a single VM, which saves the memory a
+                        separate VM per extension would use.
+                        If not specified, EG generates a VM ID that is unique to this extension, so
+                        extensions never share a VM.
+
+                        Note: extensions sharing a VM also share its global state, and the VM is started
+                        with the configuration of the first extension that initializes it.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
                   required:
                   - code
                   type: object

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml

@@ -1763,6 +1763,7 @@ func (t *Translator) buildWasm(
 	wasmIR := &ir.Wasm{
 		Name:     name,
 		RootID:   config.RootID,
+		VMID:     config.VMID,
 		WasmName: wasmName,
 		Config:   config.Config,
 		FailOpen: failOpen,

internal/gatewayapi/envoyextensionpolicy.go

@@ -0,0 +1,93 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+envoyextensionpolicies:
+# The two policies below configure the same Wasm extension for different routes
+# and opt into sharing a single Envoy Wasm VM by setting the same vmID.
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+    wasm:
+    - name: auth-filter
+      vmID: shared-auth-filter
+      code:
+        type: HTTP
+        http:
+          url: https://www.example.com/auth-filter.wasm
+          sha256: f5173e637a258751276b55f1f9ca6ec3b2f21ea8e6cc34216bba899cac96e9da
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+    wasm:
+    - name: auth-filter
+      vmID: shared-auth-filter
+      code:
+        type: HTTP
+        http:
+          url: https://www.example.com/auth-filter.wasm
+          sha256: f5173e637a258751276b55f1f9ca6ec3b2f21ea8e6cc34216bba899cac96e9da