Service Extensions inserts custom code directly into the network data path of Cloud Load Balancing, Media CDN, and Secure Web Proxy, either as a Wasm plugin or as a gRPC callout.
What is Service Extensions?
Service Extensions enables users of Google Cloud products such as Cloud Load Balancing, Media CDN, and Secure Web Proxy to insert custom code directly into the data path. This lets you customize the behavior of these products to meet your business needs.
The data path in these networking products can be visualized as a pipeline of data processing stages. Service Extensions lets you insert custom logic into one or more of these stages, through plugins or through callouts.
Core Features
- Plugins: Custom code inline in the data path, built with WebAssembly (Wasm) and the Proxy-Wasm ABI, running as Wasm modules on Google-managed sandbox infrastructure
- Callouts: Envoy gRPC calls from Cloud Load Balancing to Google services or user-managed services, running as general-purpose gRPC servers
- Extension types: Callout, authorization, route, and traffic extensions
- Cloud Load Balancing extensions: Customization of request and response processing paths for supported Application Load Balancers
- CEL matchers: Selecting which requests an extension applies to, using the CEL matcher language documented in the reference
Typical Use Cases
Custom error pages
Redirecting clients to a custom error page for certain response classes, without changing the backend application.
Custom logging
Logging user-defined headers or custom data into Cloud Logging directly from the data path.
Header addition
Creating new headers relevant for your applications or for specific customers, on requests and responses.
Header manipulation
Rewriting existing request and response headers, for example to normalize them or to strip internal information.
Benefits
- Two execution models: Plugins with no infrastructure of your own, callouts with full freedom over runtime and language
- Free entry allowance: Up to 2,000,000 plugin invocations per month per account at no charge
- Close to the data plane: Plugins run on Google-managed infrastructure with latency optimization handled by Google
- Reuse of existing software: Callouts can integrate existing services instead of reimplementing logic
Integration with innFactory
As a certified Google Cloud partner, innFactory supports you with Service Extensions: choosing between plugins and callouts, developing the extensions, and integrating them into your existing load balancing architecture.
Contact us for a consultation on Service Extensions.
Available Tiers & Options
Plugins
- Custom code inline in the data path
- Run as Wasm modules on Google-managed sandbox infrastructure
- Run close to the data plane, with latency optimization managed by Google
- Free allowance of 2,000,000 invocations per month per account
- Restricted capability and strict runtime requirements
- Require WebAssembly (Wasm) and the Proxy-Wasm ABI
Callouts
- No runtime restrictions, existing software can be reused
- Run on your own compute VMs, GKE Pods on GKE Multi-Cloud, or on-premises
- Envoy gRPC calls made from Cloud Load Balancing
- You confirm the scalability and availability of your callout service
- Additional data transfer charges may apply for cross-region traffic and for the compute at the other end
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Service Extensions?
Service Extensions enables users of Google Cloud products such as Cloud Load Balancing, Media CDN, and Secure Web Proxy to insert custom code directly into the data path, so they can customize the behavior of these products to meet their business needs.
What is the difference between plugins and callouts?
Plugins let you insert custom code inline in the networking data path. You build them using WebAssembly and the Proxy-Wasm ABI, and they run as Wasm modules on Google-managed sandbox infrastructure with restricted capability and strict runtime requirements. Callouts let Cloud Load Balancing make Envoy gRPC calls to Google services and user-managed services during data processing; they have no runtime restrictions but run on your own infrastructure.
Which types of extensions exist?
The documentation lists callout extensions, authorization extensions, route extensions, and traffic extensions, as well as plugins.
What does Service Extensions cost?
For plugins on Cloud Load Balancing, the official pricing page lists 0 to 2,000,000 invocations per month per account as free, and USD 0.10 per 1,000,000 invocations above that. Callouts on Cloud Load Balancing cost USD 0.10 per 1,000,000 invocations. An invocation is an individual callback or callout; a single HTTP request may trigger several invocations depending on the configuration.
What are plugins typically used for?
The documentation gives sample scenarios including exception handling with a redirect to a custom error page, custom logging of user-defined headers or data into Cloud Logging, adding new request and response headers, and rewriting existing headers.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
