types

package
v1.16.0-rc.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 28, 2024 License: Apache-2.0 Imports: 18 Imported by: 7

Documentation

Index

Constants

View Source 
const (
	EnableBandwidthManagerFlag = "enable-bandwidth-manager"
	EnableBBRFlag              = "enable-bbr"
)

Variables

View Source 
var DefaultBandwidthConfig = BandwidthConfig{
	EnableBandwidthManager: false,
	EnableBBR:              false,
}

Functions

func RemoteSNATDstAddrExclusionCIDRv4 

func RemoteSNATDstAddrExclusionCIDRv4() *cidr.CIDR

RemoteSNATDstAddrExclusionCIDRv4 returns a CIDR for SNAT exclusion. Any packet sent from a local endpoint to an IP address belonging to the CIDR should not be SNAT'd.

func RemoteSNATDstAddrExclusionCIDRv6 

func RemoteSNATDstAddrExclusionCIDRv6() *cidr.CIDR

RemoteSNATDstAddrExclusionCIDRv6 returns a IPv6 CIDR for SNAT exclusion. Any packet sent from a local endpoint to an IP address belonging to the CIDR should not be SNAT'd.

Types

type BackendIDByServiceIDSet 

type BackendIDByServiceIDSet map[uint16]map[loadbalancer.BackendID]struct{} // svc ID => backend ID

BackendIDByServiceIDSet is the type of a set for checking whether a backend belongs to a given service

type BandwidthConfig added in v1.16.0 

type BandwidthConfig struct {
	// EnableBandwidthManager enables EDT-based pacing
	EnableBandwidthManager bool

	// EnableBBR enables BBR TCP congestion control for the node including Pods
	EnableBBR bool
}

func (BandwidthConfig) Flags added in v1.16.0 

func (def BandwidthConfig) Flags(flags *pflag.FlagSet)

type BandwidthManager added in v1.15.8 

type BandwidthManager interface {
	BBREnabled() bool
	Enabled() bool

	UpdateBandwidthLimit(endpointID uint16, bytesPerSecond uint64)
	DeleteBandwidthLimit(endpointID uint16)
}

type CompilationLock added in v1.16.0 

type CompilationLock interface {
	Lock()
	Unlock()
	RLock()
	RUnlock()
}

CompilationLock is a interface over a mutex, it is used by both the loader, daemon and endpoint manager to lock the compilation process. This is a bit of a layer violation since certain methods on the loader such as CompileAndLoad and CompileOrLoad expect the lock to be taken before being called.

Once we have moved header file generation from the endpoint manager into the loader, we can remove this interface and have the loader manage the lock internally.

type CompileTimeConfiguration 

type CompileTimeConfiguration interface {
	DeviceConfiguration

	// TODO: Move this detail into the datapath
	ConntrackLocalLocked() bool

	// RequireARPPassthrough returns true if the datapath must implement
	// ARP passthrough for this endpoint
	RequireARPPassthrough() bool

	// RequireEgressProg returns true if the endpoint requires an egress
	// program attached to the InterfaceName() invoking the section
	// "to-container"
	RequireEgressProg() bool

	// RequireRouting returns true if the endpoint requires BPF routing to
	// be enabled, when disabled, routing is delegated to Linux routing
	RequireRouting() bool

	// RequireEndpointRoute returns true if the endpoint wishes to have a
	// per endpoint route installed in the host's routing table to point to
	// the endpoint's interface
	RequireEndpointRoute() bool

	// GetPolicyVerdictLogFilter returns the PolicyVerdictLogFilter for the endpoint
	GetPolicyVerdictLogFilter() uint32

	// IsHost returns true if the endpoint is the host endpoint.
	IsHost() bool
}

CompileTimeConfiguration provides datapath implementations a clean interface to access endpoint-specific configuration that can only be changed at compile time.

type ConfigWriter 

type ConfigWriter interface {
	// WriteNodeConfig writes the implementation-specific configuration of
	// node-wide options into the specified writer.
	WriteNodeConfig(io.Writer, *LocalNodeConfiguration) error

	// WriteNetdevConfig writes the implementation-specific configuration
	// of configurable options to the specified writer. Options specified
	// here will apply to base programs and not to endpoints, though
	// endpoints may have equivalent configurable options.
	WriteNetdevConfig(io.Writer, *option.IntOptions) error

	// WriteTemplateConfig writes the implementation-specific configuration
	// of configurable options for BPF templates to the specified writer.
	WriteTemplateConfig(w io.Writer, nodeCfg *LocalNodeConfiguration, cfg EndpointConfiguration) error

	// WriteEndpointConfig writes the implementation-specific configuration
	// of configurable options for the endpoint to the specified writer.
	WriteEndpointConfig(w io.Writer, nodeCfg *LocalNodeConfiguration, cfg EndpointConfiguration) error
}

ConfigWriter is anything which writes the configuration for various datapath program types.

type Datapath 

type Datapath interface {
	ConfigWriter
	IptablesManager

	// Node must return the handler for node events
	Node() NodeHandler

	NodeIDs() NodeIDHandler

	NodeNeighbors() NodeNeighbors

	// LocalNodeAddressing must return the node addressing implementation
	// of the local node
	LocalNodeAddressing() NodeAddressing

	// Loader must return the implementation of the loader, which is responsible
	// for loading, reloading, and compiling datapath programs.
	Loader() Loader

	// WireguardAgent returns the WireGuard agent for the local node
	WireguardAgent() WireguardAgent

	// LBMap returns the load-balancer map
	LBMap() LBMap

	BandwidthManager() BandwidthManager

	Orchestrator() Orchestrator
}

Datapath is the interface to abstract all datapath interactions. The abstraction allows to implement the datapath requirements with multiple implementations

type DeviceConfiguration 

type DeviceConfiguration interface {
	// GetOptions fetches the configurable datapath options from the owner.
	GetOptions() *option.IntOptions
}

DeviceConfiguration is an interface for injecting configuration of datapath options that affect lookups and logic applied at a per-device level, whether those are devices associated with the endpoint or associated with the host.

type Endpoint 

type Endpoint interface {
	EndpointConfiguration
	InterfaceName() string
	Logger(subsystem string) *logrus.Entry
	StateDir() string
}

Endpoint provides access endpoint configuration information that is necessary to compile and load the datapath.

type EndpointConfiguration 

type EndpointConfiguration interface {
	CompileTimeConfiguration
	LoadTimeConfiguration
}

EndpointConfiguration provides datapath implementations a clean interface to access endpoint-specific configuration when configuring the datapath.

type IPsecKeyCustodian added in v1.15.0 

type IPsecKeyCustodian interface {
	AuthKeySize() int
	SPI() uint8
	StartBackgroundJobs(NodeHandler) error
}

type IptablesManager 

type IptablesManager interface {
	// InstallProxyRules creates the necessary datapath config (e.g., iptables
	// rules for redirecting host proxy traffic on a specific ProxyPort)
	InstallProxyRules(proxyPort uint16, name string)

	// SupportsOriginalSourceAddr tells if the datapath supports
	// use of original source addresses in proxy upstream
	// connections.
	SupportsOriginalSourceAddr() bool

	// GetProxyPorts fetches the existing proxy ports configured in the
	// datapath. Used early in bootstrap to reopen proxy ports.
	GetProxyPorts() map[string]uint16

	// InstallNoTrackRules is explicitly called when a pod has valid
	// "policy.cilium.io/no-track-port" annotation.  When
	// InstallNoConntrackIptRules flag is set, a super set of v4 NOTRACK
	// rules will be automatically installed upon agent bootstrap (via
	// function addNoTrackPodTrafficRules) and this function will be
	// skipped.  When InstallNoConntrackIptRules is not set, this function
	// will be executed to install NOTRACK rules.  The rules installed by
	// this function is very specific, for now, the only user is
	// node-local-dns pods.
	InstallNoTrackRules(ip netip.Addr, port uint16)

	// See comments for InstallNoTrackRules.
	RemoveNoTrackRules(ip netip.Addr, port uint16)
}

IptablesManager manages iptables rules.

type LBMap 

type LBMap interface {
	UpsertService(*UpsertServiceParams) error
	UpsertMaglevLookupTable(uint16, map[string]*loadbalancer.Backend, bool) error
	IsMaglevLookupTableRecreated(bool) bool
	DeleteService(loadbalancer.L3n4AddrID, int, bool, loadbalancer.SVCNatPolicy) error
	AddBackend(*loadbalancer.Backend, bool) error
	UpdateBackendWithState(*loadbalancer.Backend) error
	DeleteBackendByID(loadbalancer.BackendID) error
	AddAffinityMatch(uint16, loadbalancer.BackendID) error
	DeleteAffinityMatch(uint16, loadbalancer.BackendID) error
	UpdateSourceRanges(uint16, []*cidr.CIDR, []*cidr.CIDR, bool) error
	DumpServiceMaps() ([]*loadbalancer.SVC, []error)
	DumpBackendMaps() ([]*loadbalancer.Backend, error)
	DumpAffinityMatches() (BackendIDByServiceIDSet, error)
	DumpSourceRanges(bool) (SourceRangeSetByServiceID, error)
	ExistsSockRevNat(cookie uint64, addr net.IP, port uint16) bool
}

LBMap is the interface describing methods for manipulating service maps.

type LoadTimeConfiguration 

type LoadTimeConfiguration interface {
	// GetID returns a locally-significant endpoint identification number.
	GetID() uint64
	// StringID returns the string-formatted version of the ID from GetID().
	StringID() string
	// GetIdentity returns a globally-significant numeric security identity.
	GetIdentity() identity.NumericIdentity

	// GetIdentityLocked returns a globally-significant numeric security
	// identity while assuming that the backing data structure is locked.
	// This function should be removed in favour of GetIdentity()
	GetIdentityLocked() identity.NumericIdentity

	IPv4Address() netip.Addr
	IPv6Address() netip.Addr
	GetNodeMAC() mac.MAC
	GetIfIndex() int
}

LoadTimeConfiguration provides datapath implementations a clean interface to access endpoint-specific configuration that can be changed at load time.

type Loader 

type Loader interface {
	CallsMapPath(id uint16) string
	CustomCallsMapPath(id uint16) string
	ReloadDatapath(ctx context.Context, ep Endpoint, stats *metrics.SpanStat) (string, error)
	ReinitializeXDP(ctx context.Context, extraCArgs []string) error
	EndpointHash(cfg EndpointConfiguration) (string, error)
	Unload(ep Endpoint)
	Reinitialize(ctx context.Context, cfg LocalNodeConfiguration, tunnelConfig tunnel.Config, iptMgr IptablesManager, p Proxy) error
	HostDatapathInitialized() <-chan struct{}
	DetachXDP(iface string, bpffsBase, progName string) error

	WriteEndpointConfig(w io.Writer, cfg EndpointConfiguration) error
}

Loader is an interface to abstract out loading of datapath programs.

type LocalNodeConfiguration 

type LocalNodeConfiguration struct {
	// NodeIPv4 is the primary IPv4 address of this node.
	// Mutable at runtime.
	NodeIPv4 net.IP

	// NodeIPv6 is the primary IPv6 address of this node.
	// Mutable at runtime.
	NodeIPv6 net.IP

	// CiliumInternalIPv4 is the internal IP address assigned to the cilium_host
	// interface.
	// Immutable at runtime.
	CiliumInternalIPv4 net.IP

	// CiliumInternalIPv6 is the internal IP address assigned to the cilium_host
	// interface.
	// Immutable at runtime.
	CiliumInternalIPv6 net.IP

	// AllocCIDRIPv4 is the IPv4 allocation CIDR from which IP addresses for
	// endpoints are allocated from.
	// Immutable at runtime.
	AllocCIDRIPv4 *cidr.CIDR

	// AllocCIDRIPv6 is the IPv6 allocation CIDR from which IP addresses for
	// endpoints are allocated from.
	// Immutable at runtime.
	AllocCIDRIPv6 *cidr.CIDR

	// LoopbackIPv4 is the IPv4 loopback address.
	// Immutable at runtime.
	LoopbackIPv4 net.IP

	// Devices is the native network devices selected for datapath use.
	// Mutable at runtime.
	Devices []*tables.Device

	// NodeAddresses are the IP addresses of the local node that are considered
	// as this node's addresses. From this set we pick the addresses that are
	// used as NodePort frontends and the addresses to use for BPF masquerading.
	// Mutable at runtime.
	NodeAddresses []tables.NodeAddress

	// HostEndpointID is the endpoint ID assigned to the host endpoint.
	// Immutable at runtime.
	HostEndpointID uint64

	// DeviceMTU is the MTU used on workload facing devices.
	// This field is immutable at runtime. The value will not change in
	// subsequent calls to NodeConfigurationChanged().
	DeviceMTU int

	// RouteMTU is the MTU used on the network.
	// This field is immutable at runtime. The value will not change in
	// subsequent calls to NodeConfigurationChanged().
	RouteMTU int

	// RoutePostEncryptMTU is the MTU without the encryption overhead
	// included.
	// This field is immutable at runtime. The value will not change in
	// subsequent calls to NodeConfigurationChanged().
	RoutePostEncryptMTU int

	// AuxiliaryPrefixes is the list of auxiliary prefixes that should be
	// configured in addition to the node PodCIDR
	//
	// This field is mutable. The implementation of
	// NodeConfigurationChanged() must adjust the routes accordingly.
	AuxiliaryPrefixes []*cidr.CIDR

	// EnableIPv4 enables use of IPv4. Routing to the IPv4 allocation CIDR
	// of other nodes must be enabled.
	//
	// This field is immutable at runtime. The value will not change in
	// subsequent calls to NodeConfigurationChanged().
	EnableIPv4 bool

	// EnableIPv6 enables use of IPv6. Routing to the IPv6 allocation CIDR
	// of other nodes must be enabled.
	//
	// This field is immutable at runtime. The value will not change in
	// subsequent calls to NodeConfigurationChanged().
	EnableIPv6 bool

	// EnableEncapsulation enables use of encapsulation in communication
	// between nodes.
	//
	// This field is immutable at runtime. The value will not change in
	// subsequent calls to NodeConfigurationChanged().
	EnableEncapsulation bool

	// EnableAutoDirectRouting enables the use of direct routes for
	// communication between nodes if two nodes have direct L2
	// connectivity.
	//
	// EnableAutoDirectRouting must be compatible with EnableEncapsulation
	// and must provide a fallback to use encapsulation if direct routing
	// is not feasible and encapsulation is enabled.
	//
	// This field is immutable at runtime. The value will not change in
	// subsequent calls to NodeConfigurationChanged().
	EnableAutoDirectRouting bool

	// DirectRoutingSkipUnreachable will skip any direct routes between
	// nodes if they have different L2 connectivity, only adding L2 routes
	// if the underlying L2 shares the same gateway.
	//
	// This field is immutable at runtime. The value will not change in
	// subsequent calls to NodeConfigurationChanged().
	DirectRoutingSkipUnreachable bool

	// EnableLocalNodeRoute enables installation of the route which points
	// the allocation prefix of the local node. Disabling this option is
	// useful when another component is responsible for the routing of the
	// allocation CIDR IPs into Cilium endpoints.
	EnableLocalNodeRoute bool

	// EnableIPSec enables IPSec routes
	EnableIPSec bool

	// EnableIPSecEncryptedOverlay enables IPSec routes for overlay traffic
	EnableIPSecEncryptedOverlay bool

	// EncryptNode enables encrypting NodeIP traffic requires EnableIPSec
	EncryptNode bool

	// IPv4PodSubnets is a list of IPv4 subnets that pod IPs are assigned from
	// these are then used when encryption is enabled to configure the node
	// for encryption over these subnets at node initialization.
	IPv4PodSubnets []*net.IPNet

	// IPv6PodSubnets is a list of IPv6 subnets that pod IPs are assigned from
	// these are then used when encryption is enabled to configure the node
	// for encryption over these subnets at node initialization.
	IPv6PodSubnets []*net.IPNet
}

LocalNodeConfiguration represents the configuration of the local node

This configuration struct is immutable even when passed by reference. When the configuration is changed at runtime a new instance is allocated and passed down.

func (*LocalNodeConfiguration) DeviceNames added in v1.16.0 

func (cfg *LocalNodeConfiguration) DeviceNames() []string

type MTUConfiguration added in v1.15.0 

type MTUConfiguration interface {
	GetDeviceMTU() int
	GetRouteMTU() int
	GetRoutePostEncryptMTU() int
}

type NodeAddressing 

type NodeAddressing interface {
	IPv6() NodeAddressingFamily
	IPv4() NodeAddressingFamily
}

NodeAddressing implements addressing of a node

type NodeAddressingFamily 

type NodeAddressingFamily interface {
	// Router is the address that will act as the router on each node where
	// an agent is running on. Endpoints have a default route that points
	// to this address.
	Router() net.IP

	// PrimaryExternal is the primary external address of the node. Nodes
	// must be able to reach each other via this address.
	PrimaryExternal() net.IP

	// AllocationCIDR is the CIDR used for IP allocation of all endpoints
	// on the node
	AllocationCIDR() *cidr.CIDR

	// DirectRouting returns the interface index and IP address for
	// direct routing.
	DirectRouting() (int, net.IP, bool)
}

NodeAddressingFamily is the node addressing information for a particular address family

type NodeHandler 

type NodeHandler interface {
	// Name identifies the handler, this is used in logging/reporting handler
	// reconciliation errors.
	Name() string

	// NodeAdd is called when a node is discovered for the first time.
	NodeAdd(newNode nodeTypes.Node) error

	// NodeUpdate is called when a node definition changes. Both the old
	// and new node definition is provided. NodeUpdate() is never called
	// before NodeAdd() is called for a particular node.
	NodeUpdate(oldNode, newNode nodeTypes.Node) error

	// NodeDelete is called after a node has been deleted
	NodeDelete(node nodeTypes.Node) error

	// AllNodeValidateImplementation is called to validate the implementation
	// of all nodes in the node cache.
	AllNodeValidateImplementation()

	// NodeValidateImplementation is called to validate the implementation of
	// the node in the datapath. This function is intended to be run on an
	// interval to ensure that the datapath is consistently converged.
	NodeValidateImplementation(node nodeTypes.Node) error

	// NodeConfigurationChanged is called when the local node configuration
	// has changed
	NodeConfigurationChanged(config LocalNodeConfiguration) error
}

NodeHandler handles node related events such as addition, update or deletion of nodes or changes to the local node configuration.

Node events apply to the local node as well as to remote nodes. The implementation can differ between the own local node and remote nodes by calling node.IsLocal().

type NodeIDHandler 

type NodeIDHandler interface {
	// GetNodeIP returns the string node IP that was previously registered as the given node ID.
	GetNodeIP(uint16) string

	// GetNodeID gets the node ID for the given node IP. If none is found, exists is false.
	GetNodeID(nodeIP net.IP) (nodeID uint16, exists bool)

	// DumpNodeIDs returns all node IDs and their associated IP addresses.
	DumpNodeIDs() []*models.NodeID

	// RestoreNodeIDs restores node IDs and their associated IP addresses from the
	// BPF map and into the node handler in-memory copy.
	RestoreNodeIDs()
}

type NodeNeighborEnqueuer added in v1.16.0 

type NodeNeighborEnqueuer interface {
	// Enqueue enqueues a node for processing node neighbors updates.
	Enqueue(*nodeTypes.Node, bool)
}

NodeNeighborEnqueuer provides an interface for clients to push node updates for further processing.

type NodeNeighbors 

type NodeNeighbors interface {
	// NodeNeighDiscoveryEnabled returns whether node neighbor discovery is enabled
	NodeNeighDiscoveryEnabled() bool

	// NodeNeighborRefresh is called to refresh node neighbor table
	NodeNeighborRefresh(ctx context.Context, node nodeTypes.Node, refresh bool) error

	// NodeCleanNeighbors cleans all neighbor entries for the direct routing device
	// and the encrypt interface.
	NodeCleanNeighbors(migrateOnly bool)

	// InsertMiscNeighbor inserts a neighbor entry for the address passed via newNode.
	// This is needed for in-agent users where neighbors outside the cluster need to
	// be added, for example, for external service backends.
	InsertMiscNeighbor(newNode *nodeTypes.Node)

	// DeleteMiscNeighbor delets a eighbor entry for the address passed via oldNode.
	// This is needed to delete the entries which have been inserted at an earlier
	// point in time through InsertMiscNeighbor.
	DeleteMiscNeighbor(oldNode *nodeTypes.Node)
}

type Orchestrator added in v1.16.0 

type Orchestrator interface {
	Reinitialize(ctx context.Context) error
}

type PreFilter 

type PreFilter interface {
	Enabled() bool
	WriteConfig(fw io.Writer)
	Dump(to []string) ([]string, int64)
	Insert(revision int64, cidrs []net.IPNet) error
	Delete(revision int64, cidrs []net.IPNet) error
}

PreFilter an interface for an XDP pre-filter.

type Proxy 

type Proxy interface {
	ReinstallRoutingRules() error
}

Proxy is any type which installs rules related to redirecting traffic to a proxy.

type SourceRangeSetByServiceID 

type SourceRangeSetByServiceID map[uint16][]*cidr.CIDR // svc ID => src range CIDRs

type UpsertServiceParams 

type UpsertServiceParams struct {
	ID   uint16
	IP   net.IP
	Port uint16

	// PreferredBackends is a subset of ActiveBackends
	// Note: this is only used in clustermesh with service affinity annotation.
	PreferredBackends         map[string]*loadbalancer.Backend
	ActiveBackends            map[string]*loadbalancer.Backend
	NonActiveBackends         []loadbalancer.BackendID
	PrevBackendsCount         int
	IPv6                      bool
	Type                      loadbalancer.SVCType
	NatPolicy                 loadbalancer.SVCNatPolicy
	ExtLocal                  bool
	IntLocal                  bool
	Scope                     uint8
	SessionAffinity           bool
	SessionAffinityTimeoutSec uint32
	CheckSourceRange          bool
	UseMaglev                 bool
	L7LBProxyPort             uint16                   // Non-zero for L7 LB services
	Name                      loadbalancer.ServiceName // Fully qualified name of the service
	LoopbackHostport          bool
}

func (*UpsertServiceParams) GetOrderedBackends 

func (p *UpsertServiceParams) GetOrderedBackends() []loadbalancer.BackendID

GetOrderedBackends returns an ordered list of backends with all the sorted preferred backend followed by active and non-active backends. Encapsulates logic to be also used in unit tests.

type WireguardAgent 

type WireguardAgent interface {
	UpdatePeer(nodeName, pubKeyHex string, nodeIPv4, nodeIPv6 net.IP) error
	DeletePeer(nodeName string) error
	Status(includePeers bool) (*models.WireguardStatus, error)
}

WireguardAgent manages the WireGuard peers

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.