acl

Documentation

Index

• type Deps
• type Renderer
  • func (r *Renderer) Init() error
  • func (r *Renderer) NewTxn(resync bool) renderer.Txn
• type RendererTxn
  • func (art *RendererTxn) Commit() error
  • func (art *RendererTxn) Render(pod podmodel.ID, podIP *net.IPNet, ingress []*renderer.ContivRule, ...) renderer.Txn

Types

type Deps

type Deps struct {
	Log                 logging.Logger
	LogFactory          logging.LogFactory /* optional */
	Contiv              contiv.API         /* for GetIfName() */
	ACLTxnFactory       func() (dsl linux.DataChangeDSL)
	ACLResyncTxnFactory func() (dsl linux.DataResyncDSL)
}

Deps lists dependencies of Renderer.

type Renderer

type Renderer struct {
	Deps
	// contains filtered or unexported fields
}

Renderer renders Contiv Rules into VPP ACLs. ACLs are installed into VPP by the aclplugin from vpp-agent. The configuration changes are transported into aclplugin via localclient.

func (*Renderer) Init

func (r *Renderer) Init() error

Init initializes the ACL Renderer.

func (*Renderer) NewTxn

func (r *Renderer) NewTxn(resync bool) renderer.Txn

NewTxn starts a new transaction. The rendering executes only after Commit() is called. Rollback is not yet supported however. If <resync> is enabled, the supplied configuration will completely replace the existing one. Otherwise, the change is performed incrementally, i.e. interfaces not mentioned in the transaction are left unaffected.

type RendererTxn

type RendererTxn struct {
	// contains filtered or unexported fields
}

RendererTxn represents a single transaction of Renderer.

func (*RendererTxn) Commit

func (art *RendererTxn) Commit() error

Commit proceeds with the rendering. A minimalistic set of changes is calculated using ContivRuleCache and applied as one transaction via the localclient.

func (*RendererTxn) Render

func (art *RendererTxn) Render(pod podmodel.ID, podIP *net.IPNet, ingress []*renderer.ContivRule, egress []*renderer.ContivRule) renderer.Txn

Render applies the set of ingress & egress rules for a given VPP interface. The existing rules are replaced. Te actual change is performed only after the commit.