Deploy Wasm Plugins

APISIX supports WebAssembly (Wasm) plugins developed following the Proxy-Wasm specification, a specification that extends Wasm capabilities to proxies.

This guide explains how to load WebAssembly (Wasm) plugins into gateways on Kubernetes and use APISIX Ingress Controller to enable the plugin on a route.

note

This workflow applies to APISIX. API7 Dashboard's custom plugin upload workflow supports Lua plugins and does not provide the Wasm deployment workflow used in this guide.

Prerequisites

1. Complete Set Up Ingress Controller and Gateway.
2. Follow the Write Plugin Logic in Go and Compile the Code into Wasm sections to prepare the log.go.wasm example plugin.

Load Wasm Plugin

Create a ConfigMap from the log.go.wasm file:

kubectl create configmap wasm-log -n aic --from-file=log.go.wasm

To mount the ConfigMap, first export all values (including defaults):

helm get values -n aic apisix --all > values.yaml

In the exported values file, append the shown entries to the existing extraVolumes and extraVolumeMounts lists, then update the existing apisix.wasm mapping. Preserve the other values and do not create duplicate top-level keys:

values.yaml

extraVolumes:
  - name: wasm-log
    configMap:
      name: wasm-log
extraVolumeMounts:
  - name: wasm-log
    mountPath: /usr/local/bin/log.go.wasm
    subPath: log.go.wasm
apisix:
  wasm:
    enabled: true
    plugins:
      - name: wasm_log
        priority: 7999
        file: /usr/local/bin/log.go.wasm

Upgrade the release:

helm upgrade -n aic apisix apisix/apisix --version 2.18.0 -f values.yaml

Test Wasm Plugin

Create a route with the wasm_log plugin:

Gateway API

wasm-route.yaml

apiVersion: v1
kind: Service
metadata:
  namespace: aic
  name: httpbin-external-domain
spec:
  type: ExternalName
  externalName: httpbin.org
---
apiVersion: apisix.apache.org/v1alpha1
kind: PluginConfig
metadata:
  namespace: aic
  name: wasm-log-plugin-config
spec:
  plugins:
    - name: wasm_log
      config:
        conf: hello apisix
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  namespace: aic
  name: wasm-log-plugin
spec:
  parentRefs:
  - name: apisix
  rules:
  - matches: 
    - path:
        type: Exact
        value: /anything
    filters:
    - type: ExtensionRef
      extensionRef:
        group: apisix.apache.org
        kind: PluginConfig
        name: wasm-log-plugin-config
    backendRefs:
    - name: httpbin-external-domain
      port: 80

APISIX CRD

wasm-route.yaml

apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
  namespace: aic
  name: httpbin-external-domain
spec:
  externalNodes:
  - type: Domain
    name: httpbin.org
---
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  namespace: aic
  name: wasm-log-plugin
spec:
  ingressClassName: apisix
  http:
    - name: wasm-log-plugin
      match:
        paths:
          - /anything
      plugins:
      - name: wasm_log
        enable: true
        config:
          conf: hello apisix
      upstreams:
      - name: httpbin-external-domain

Apply the configuration to your cluster:

kubectl apply -f wasm-route.yaml

Send a request to the route:

curl -i "http://127.0.0.1:9080/anything"

You should receive an HTTP/1.1 200 OK response.

In the gateway log, you should see the following log entry created by the wasm_log plugin:

2025/09/04 09:58:54 [warn] 53#53: *3331 run plugin ctx 1 with conf hello apisix in http ctx 2, client: 127.0.0.1, server: _, request: "GET /anything HTTP/1.1", host: "127.0.0.1:9080"