---
title: "Modify an existing WasmExtension. When modifying the details of an extension in use, such as the image property, enabled flag, phase, or default configuration, a redeploy or reconfiguration of the extension may be triggered, affecting live traffic in all those places that reference the extension. Similarly, changes to the allowed_in property may trigger the removal of the extension from all places where the extension was in use that are not allowed to use it anymore, affecting live traffic on the relevant namespaces as well."
method: PUT
path: "/v2/organizations/{organization}/extensions/{extension}"
tags: ["WasmExtensions"]
---

# Modify an existing WasmExtension. When modifying the details of an extension in use, such as the image property, enabled flag, phase, or default configuration, a redeploy or reconfiguration of the extension may be triggered, affecting live traffic in all those places that reference the extension. Similarly, changes to the allowed_in property may trigger the removal of the extension from all places where the extension was in use that are not allowed to use it anymore, affecting live traffic on the relevant namespaces as well.

`PUT /v2/organizations/{organization}/extensions/{extension}`

## Request

- Base URL: `https://docs.tetrate.io` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.tetrate.io/v2/organizations/{organization}/extensions/{extension}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/docs/v2/organizations/:organization/extensions/:extension/put.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `organization` string, required
- `extension` string, required

## Request body

- object
  - `allowedIn` string[]: List of fqns where this extension is allowed to run. If it is empty, the extension can be used across the entire organization. Currently only Tenant resources are considered.
  - `config` object: Configuration parameters sent to the WASM plugin execution The configuration can be overwritten when instantiating the extensions in IngressGateways or Security groups. The config is serialized using proto3 JSON marshaling and passed to proxy_on_configure when the host environment starts the plugin.
  - `description` string
  - `displayName` string
  - `etag` string
  - `image` string: Deprecated. Use the `url` field instead. Repository and tag of the OCI image containing the WASM extension.
  - `imagePullPolicy` 'UNSPECIFIED_POLICY' | 'IfNotPresent' | 'Always': The pull behaviour to be applied when fetching a WASM module, mirroring K8s behaviour. - UNSPECIFIED_POLICY: Defaults to IfNotPresent, except for OCI images with tag `latest`, for which the default will be Always. - IfNotPresent: If an existing version of the image has been pulled before, that will be used. If no version of the image is present locally, we will pull the latest version. - Always: We will always pull the latest version of an image when changing this plugin. Note that the change includes `metadata` field as well.
  - `imagePullSecret` string: Credentials to use for OCI image pulling. Name of a K8s Secret that contains a docker pull secret which is to be used to authenticate against the registry when pulling the image. If TSB is configured to use the WASM download proxy, this secret must exist in the `istio-system` namespace of each cluster that has applications that use the extension. If the downlaod proxy is disabled, the secret must exist in each application namespace that is using the extension.
  - `match` V2GlobalTrafficSelector: GlobalTrafficSelector provides a mechanism to select a specific traffic flow for which this Wasm Extension will be enabled. This setting applies to all WASM Extension attachments. These selectors can be overridden at attachments. When all the sub conditions in the TrafficSelector are satisfied, the traffic will be selected.
    - `mode` 'UNDEFINED' | 'CLIENT' | 'SERVER' | 'CLIENT_AND_SERVER': WorkloadMode allows selection of the role of the underlying workload in network traffic. A workload is considered as acting as a SERVER if it is the destination of the traffic (that is, traffic direction, from the perspective of the workload is *inbound*). If the workload is the source of the network traffic, it is considered to be in CLIENT mode (traffic is *outbound* from the workload). - UNDEFINED: Default value, which will be interpreted by its own usage. - CLIENT: Selects for scenarios when the workload is the source of the network traffic. In addition, if the workload is a gateway, selects this. - SERVER: Selects for scenarios when the workload is the destination of the network traffic. - CLIENT_AND_SERVER: Selects for scenarios when the workload is either the source or destination of the network traffic.
  - `phase` 'UNSPECIFIED_PHASE' | 'AUTHN' | 'AUTHZ' | 'STATS': - UNSPECIFIED_PHASE: Control plane decides where to insert the plugin. This will generally be at the end of the filter chain, right before the Router. Do not specify PluginPhase if the plugin is independent of others. - AUTHN: Insert plugin before Istio authentication filters. - AUTHZ: Insert plugin before Istio authorization filters and after Istio authentication filters. - STATS: Insert plugin before Istio stats filters and after Istio authorization filters.
  - `priority` integer: Determines the ordering of WasmExtensions in the same phase. When multiple WasmExtensions are applied to the same workload in the same phase, they will be applied by priority, in descending order. If no priority is assigned it will use the default 0 value. In case of several extensions having the same priority in the same phase, the fqn will be used to sort them.
  - `source` string
  - `url` string, required: URL of a Wasm module or OCI container. If no scheme is present, defaults to oci://, referencing an OCI image. Other valid schemes are file:// for referencing .wasm module files present locally within the proxy container, and http[s]:// for .wasm module files hosted remotely.
  - `vmConfig` V2VmConfig: Configuration for a Wasm VM. more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
    - `env` V2EnvVar[]: Specifies environment variables to be injected to this VM. Note that if a key does not exist, it will be ignored.
      - `name` string, required
      - `valueFrom` 'INLINE' | 'HOST', required: - INLINE: Explicitly given key-value pairs to be injected to this VM. - HOST: *Istio-proxy's* environment variables exposed to this VM.
      - `value` string: Value for the environment variable. Note that if `value_from` is `HOST`, it will be ignored. Defaults to "".

## Response `200`

A successful response.

- V2WasmExtension
  - `fqn` string
  - `displayName` string
  - `etag` string
  - `description` string
  - `allowedIn` string[]: List of fqns where this extension is allowed to run. If it is empty, the extension can be used across the entire organization. Currently only Tenant resources are considered.
  - `image` string: Deprecated. Use the `url` field instead. Repository and tag of the OCI image containing the WASM extension.
  - `source` string
  - `phase` 'UNSPECIFIED_PHASE' | 'AUTHN' | 'AUTHZ' | 'STATS': - UNSPECIFIED_PHASE: Control plane decides where to insert the plugin. This will generally be at the end of the filter chain, right before the Router. Do not specify PluginPhase if the plugin is independent of others. - AUTHN: Insert plugin before Istio authentication filters. - AUTHZ: Insert plugin before Istio authorization filters and after Istio authentication filters. - STATS: Insert plugin before Istio stats filters and after Istio authorization filters.
  - `priority` integer: Determines the ordering of WasmExtensions in the same phase. When multiple WasmExtensions are applied to the same workload in the same phase, they will be applied by priority, in descending order. If no priority is assigned it will use the default 0 value. In case of several extensions having the same priority in the same phase, the fqn will be used to sort them.
  - `config` object: Configuration parameters sent to the WASM plugin execution The configuration can be overwritten when instantiating the extensions in IngressGateways or Security groups. The config is serialized using proto3 JSON marshaling and passed to proxy_on_configure when the host environment starts the plugin.
  - `imagePullPolicy` 'UNSPECIFIED_POLICY' | 'IfNotPresent' | 'Always': The pull behaviour to be applied when fetching a WASM module, mirroring K8s behaviour. - UNSPECIFIED_POLICY: Defaults to IfNotPresent, except for OCI images with tag `latest`, for which the default will be Always. - IfNotPresent: If an existing version of the image has been pulled before, that will be used. If no version of the image is present locally, we will pull the latest version. - Always: We will always pull the latest version of an image when changing this plugin. Note that the change includes `metadata` field as well.
  - `imagePullSecret` string: Credentials to use for OCI image pulling. Name of a K8s Secret that contains a docker pull secret which is to be used to authenticate against the registry when pulling the image. If TSB is configured to use the WASM download proxy, this secret must exist in the `istio-system` namespace of each cluster that has applications that use the extension. If the downlaod proxy is disabled, the secret must exist in each application namespace that is using the extension.
  - `vmConfig` V2VmConfig: Configuration for a Wasm VM. more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
    - `env` V2EnvVar[]: Specifies environment variables to be injected to this VM. Note that if a key does not exist, it will be ignored.
      - `name` string, required
      - `valueFrom` 'INLINE' | 'HOST', required: - INLINE: Explicitly given key-value pairs to be injected to this VM. - HOST: *Istio-proxy's* environment variables exposed to this VM.
      - `value` string: Value for the environment variable. Note that if `value_from` is `HOST`, it will be ignored. Defaults to "".
  - `url` string, required: URL of a Wasm module or OCI container. If no scheme is present, defaults to oci://, referencing an OCI image. Other valid schemes are file:// for referencing .wasm module files present locally within the proxy container, and http[s]:// for .wasm module files hosted remotely.
  - `match` V2GlobalTrafficSelector: GlobalTrafficSelector provides a mechanism to select a specific traffic flow for which this Wasm Extension will be enabled. This setting applies to all WASM Extension attachments. These selectors can be overridden at attachments. When all the sub conditions in the TrafficSelector are satisfied, the traffic will be selected.
    - `mode` 'UNDEFINED' | 'CLIENT' | 'SERVER' | 'CLIENT_AND_SERVER': WorkloadMode allows selection of the role of the underlying workload in network traffic. A workload is considered as acting as a SERVER if it is the destination of the traffic (that is, traffic direction, from the perspective of the workload is *inbound*). If the workload is the source of the network traffic, it is considered to be in CLIENT mode (traffic is *outbound* from the workload). - UNDEFINED: Default value, which will be interpreted by its own usage. - CLIENT: Selects for scenarios when the workload is the source of the network traffic. In addition, if the workload is a gateway, selects this. - SERVER: Selects for scenarios when the workload is the destination of the network traffic. - CLIENT_AND_SERVER: Selects for scenarios when the workload is either the source or destination of the network traffic.

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api.md) - [All operations](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/revisions/2f19c3a1ae57?raw)