cache

Documentation

Index

• Variables
• type CachingIdentityAllocator
  • func NewCachingIdentityAllocator(owner IdentityAllocatorOwner) *CachingIdentityAllocator
  • func (m *CachingIdentityAllocator) AllocateIdentity(ctx context.Context, lbls labels.Labels, notifyOwner bool, ...) (id *identity.Identity, allocated bool, err error)
  • func (m *CachingIdentityAllocator) Close()
  • func (m *CachingIdentityAllocator) GetIdentities() IdentitiesModel
  • func (m *CachingIdentityAllocator) GetIdentityCache() IdentityCache
  • func (m *CachingIdentityAllocator) InitIdentityAllocator(client clientset.Interface) <-chan struct{}
  • func (m *CachingIdentityAllocator) LookupIdentity(ctx context.Context, lbls labels.Labels) *identity.Identity
  • func (m *CachingIdentityAllocator) LookupIdentityByID(ctx context.Context, id identity.NumericIdentity) *identity.Identity
  • func (m *CachingIdentityAllocator) Observe(ctx context.Context, next func(IdentityChange), complete func(error))
  • func (m *CachingIdentityAllocator) Release(ctx context.Context, id *identity.Identity, notifyOwner bool) (released bool, err error)
  • func (m *CachingIdentityAllocator) ReleaseSlice(ctx context.Context, identities []*identity.Identity) error
  • func (m *CachingIdentityAllocator) RemoveRemoteIdentities(name string)
  • func (m *CachingIdentityAllocator) WaitForInitialGlobalIdentities(ctx context.Context) error
  • func (m *CachingIdentityAllocator) WatchRemoteIdentities(remoteName string, backend kvstore.BackendOperations, cachedPrefix bool) (*allocator.RemoteCache, error)
• type IdentitiesModel
  • func (s IdentitiesModel) FromIdentityCache(cache IdentityCache) IdentitiesModel
  • func (s IdentitiesModel) Less(i, j int) bool
• type IdentityAllocator
• type IdentityAllocatorOwner
• type IdentityCache
• type IdentityChange
• type IdentityChangeKind

Variables

var (
	// IdentitiesPath is the path to where identities are stored in the
	// key-value store.
	IdentitiesPath = path.Join(kvstore.BaseKeyPrefix, "state", "identities", "v1")
)

Types

type CachingIdentityAllocator

type CachingIdentityAllocator struct {
	// IdentityAllocator is an allocator for security identities from the
	// kvstore.
	IdentityAllocator *allocator.Allocator
	// contains filtered or unexported fields
}

CachingIdentityAllocator manages the allocation of identities for both global and local identities.

func NewCachingIdentityAllocator

func NewCachingIdentityAllocator(owner IdentityAllocatorOwner) *CachingIdentityAllocator

NewCachingIdentityAllocator creates a new instance of an CachingIdentityAllocator.

func (*CachingIdentityAllocator) AllocateIdentity

func (m *CachingIdentityAllocator) AllocateIdentity(ctx context.Context, lbls labels.Labels, notifyOwner bool, oldNID identity.NumericIdentity) (id *identity.Identity, allocated bool, err error)

AllocateIdentity allocates an identity described by the specified labels. If an identity for the specified set of labels already exist, the identity is re-used and reference counting is performed, otherwise a new identity is allocated via the kvstore or via the local identity allocator. A possible previously used numeric identity for these labels can be passed in as the 'oldNID' parameter; identity.InvalidIdentity must be passed if no previous numeric identity exists.

func (*CachingIdentityAllocator) Close

func (m *CachingIdentityAllocator) Close()

Close closes the identity allocator

func (*CachingIdentityAllocator) GetIdentities

func (m *CachingIdentityAllocator) GetIdentities() IdentitiesModel

GetIdentities returns all known identities

func (*CachingIdentityAllocator) GetIdentityCache

func (m *CachingIdentityAllocator) GetIdentityCache() IdentityCache

GetIdentityCache returns a cache of all known identities

func (*CachingIdentityAllocator) InitIdentityAllocator

func (m *CachingIdentityAllocator) InitIdentityAllocator(client clientset.Interface) <-chan struct{}

InitIdentityAllocator creates the global identity allocator. Only the first invocation of this function will have an effect. The Caller must have initialized well known identities before calling this (by calling identity.InitWellKnownIdentities()). The client is only used by the CRD identity allocator currently. Returns a channel which is closed when initialization of the allocator is completed. TODO: identity backends are initialized directly in this function, pulling in dependencies on kvstore and k8s. It would be better to decouple this, since the backends are an interface.

func (*CachingIdentityAllocator) LookupIdentity

func (m *CachingIdentityAllocator) LookupIdentity(ctx context.Context, lbls labels.Labels) *identity.Identity

LookupIdentity looks up the identity by its labels but does not create it. This function will first search through the local cache, then the caches for remote kvstores and finally fall back to the main kvstore. May return nil for lookups if the allocator has not yet been synchronized.

func (*CachingIdentityAllocator) LookupIdentityByID

func (m *CachingIdentityAllocator) LookupIdentityByID(ctx context.Context, id identity.NumericIdentity) *identity.Identity

LookupIdentityByID returns the identity by ID. This function will first search through the local cache, then the caches for remote kvstores and finally fall back to the main kvstore May return nil for lookups if the allocator has not yet been synchronized.

func (*CachingIdentityAllocator) Observe

func (m *CachingIdentityAllocator) Observe(ctx context.Context, next func(IdentityChange), complete func(error))

Observe the identity changes. Conforms to stream.Observable. Replays the current state of the cache when subscribing.

func (*CachingIdentityAllocator) Release

func (m *CachingIdentityAllocator) Release(ctx context.Context, id *identity.Identity, notifyOwner bool) (released bool, err error)

Release is the reverse operation of AllocateIdentity() and releases the identity again. This function may result in kvstore operations. After the last user has released the ID, the returned lastUse value is true.

func (*CachingIdentityAllocator) ReleaseSlice

func (m *CachingIdentityAllocator) ReleaseSlice(ctx context.Context, identities []*identity.Identity) error

ReleaseSlice attempts to release a set of identities. It is a helper function that may be useful for cleaning up multiple identities in paths where several identities may be allocated and another error means that they should all be released.

func (*CachingIdentityAllocator) RemoveRemoteIdentities

func (m *CachingIdentityAllocator) RemoveRemoteIdentities(name string)

func (*CachingIdentityAllocator) WaitForInitialGlobalIdentities

func (m *CachingIdentityAllocator) WaitForInitialGlobalIdentities(ctx context.Context) error

WaitForInitialGlobalIdentities waits for the initial set of global security identities to have been received and populated into the allocator cache.

func (*CachingIdentityAllocator) WatchRemoteIdentities

func (m *CachingIdentityAllocator) WatchRemoteIdentities(remoteName string, backend kvstore.BackendOperations, cachedPrefix bool) (*allocator.RemoteCache, error)

WatchRemoteIdentities returns a RemoteCache instance which can be later started to watch identities in another kvstore and sync them to the local identity cache. remoteName should be unique unless replacing an existing remote's backend. When cachedPrefix is set, identities are assumed to be stored under the "cilium/cache" prefix, and the watcher is adapted accordingly.

type IdentitiesModel

type IdentitiesModel []*models.Identity

IdentitiesModel is a wrapper so that we can implement the sort.Interface to sort the slice by ID

func (IdentitiesModel) FromIdentityCache

func (s IdentitiesModel) FromIdentityCache(cache IdentityCache) IdentitiesModel

FromIdentityCache populates the provided model from an identity cache.

func (IdentitiesModel) Less

func (s IdentitiesModel) Less(i, j int) bool

Less returns true if the element in index `i` is lower than the element in index `j`

type IdentityAllocator

type IdentityAllocator interface {
	// Identity changes are observable.
	stream.Observable[IdentityChange]

	// WaitForInitialGlobalIdentities waits for the initial set of global
	// security identities to have been received.
	WaitForInitialGlobalIdentities(context.Context) error

	// AllocateIdentity allocates an identity described by the specified labels.
	// A possible previously used numeric identity for these labels can be passed
	// in as the last parameter; identity.InvalidIdentity must be passed if no
	// previous numeric identity exists.
	AllocateIdentity(context.Context, labels.Labels, bool, identity.NumericIdentity) (*identity.Identity, bool, error)

	// Release is the reverse operation of AllocateIdentity() and releases the
	// specified identity.
	Release(context.Context, *identity.Identity, bool) (released bool, err error)

	// ReleaseSlice is the slice variant of Release().
	ReleaseSlice(context.Context, []*identity.Identity) error

	// LookupIdentityByID returns the identity that corresponds to the given
	// labels.
	LookupIdentity(ctx context.Context, lbls labels.Labels) *identity.Identity

	// LookupIdentityByID returns the identity that corresponds to the given
	// numeric identity.
	LookupIdentityByID(ctx context.Context, id identity.NumericIdentity) *identity.Identity

	// GetIdentityCache returns the current cache of identities that the
	// allocator has allocated. The caller should not modify the resulting
	// identities by pointer.
	GetIdentityCache() IdentityCache

	// GetIdentities returns a copy of the current cache of identities.
	GetIdentities() IdentitiesModel

	// AllocateCIDRsForIPs attempts to allocate identities for a list of
	// CIDRs. If any allocation fails, all allocations are rolled back and
	// the error is returned. When an identity is freshly allocated for a
	// CIDR, it is added to the ipcache if 'newlyAllocatedIdentities' is
	// 'nil', otherwise the newly allocated identities are placed in
	// 'newlyAllocatedIdentities' and it is the caller's responsibility to
	// upsert them into ipcache by calling UpsertGeneratedIdentities().
	//
	// Upon success, the caller must also arrange for the resulting identities to
	// be released via a subsequent call to ReleaseCIDRIdentitiesByID().
	//
	// The implementation for this function currently lives in pkg/ipcache.
	AllocateCIDRsForIPs(ips []net.IP, newlyAllocatedIdentities map[netip.Prefix]*identity.Identity) ([]*identity.Identity, error)

	// ReleaseCIDRIdentitiesByID() is a wrapper for ReleaseSlice() that
	// also handles ipcache entries.
	ReleaseCIDRIdentitiesByID(context.Context, []identity.NumericIdentity)
}

IdentityAllocator is any type which is responsible for allocating security identities based of sets of labels, and caching information about identities locally.

type IdentityAllocatorOwner

type IdentityAllocatorOwner interface {
	// UpdateIdentities will be called when identities have changed
	//
	// The caller is responsible for making sure the same identity
	// is not present in both 'added' and 'deleted', so that they
	// can be processed in either order.
	UpdateIdentities(added, deleted IdentityCache)

	// GetSuffix must return the node specific suffix to use
	GetNodeSuffix() string
}

IdentityAllocatorOwner is the interface the owner of an identity allocator must implement

type IdentityCache

type IdentityCache map[identity.NumericIdentity]labels.LabelArray

IdentityCache is a cache of identity to labels mapping

type IdentityChange

type IdentityChange struct {
	Kind   IdentityChangeKind
	ID     identity.NumericIdentity
	Labels labels.Labels
}

type IdentityChangeKind

type IdentityChangeKind string

const (
	IdentityChangeSync   IdentityChangeKind = IdentityChangeKind(allocator.AllocatorChangeSync)
	IdentityChangeUpsert IdentityChangeKind = IdentityChangeKind(allocator.AllocatorChangeUpsert)
	IdentityChangeDelete IdentityChangeKind = IdentityChangeKind(allocator.AllocatorChangeDelete)
)