api

package
v1.8.0-rc1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 21, 2020 License: Apache-2.0 Imports: 24 Imported by: 110

Documentation

Overview

Package api defines the API of the Cilium network policy interface +groupName=policy

Index

Constants

View Source 
const (
	ProduceKey              = 0
	FetchKey                = 1
	OffsetsKey              = 2
	MetadataKey             = 3
	LeaderAndIsr            = 4
	StopReplica             = 5
	UpdateMetadata          = 6
	OffsetCommitKey         = 8
	OffsetFetchKey          = 9
	FindCoordinatorKey      = 10
	JoinGroupKey            = 11
	CreateTopicsKey         = 19
	DeleteTopicsKey         = 20
	DeleteRecordsKey        = 21
	OffsetForLeaderEpochKey = 23
	AddPartitionsToTxnKey   = 24
	WriteTxnMarkersKey      = 27
	TxnOffsetCommitKey      = 28
	AlterReplicaLogDirsKey  = 34
	DescribeLogDirsKey      = 35
	CreatePartitionsKey     = 37
)

List of Kafka apiKeys which have a topic in their request

View Source 
const (
	HeartbeatKey   = 12
	LeaveGroupKey  = 13
	SyncgroupKey   = 14
	APIVersionsKey = 18
)

List of Kafka apiKey which are not associated with any topic

View Source 
const (
	ProduceRole = "produce"
	ConsumeRole = "consume"
)

List of Kafka Roles

View Source 
const (
	AWSProvider = "AWS" // AWS provider key
)
View Source 
const (
	KafkaMaxTopicLen = 255
)

KafkaMaxTopicLen is the maximum character len of a topic. Older Kafka versions had longer topic lengths of 255, in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255

Variables

View Source 
var (
	EndpointSelectorNone = NewESFromLabels(labels.NewLabel(labels.IDNameNone, "", labels.LabelSourceReserved))

	// EntitySelectorMapping maps special entity names that come in
	// policies to selectors
	EntitySelectorMapping = map[Entity]EndpointSelectorSlice{
		EntityAll:        {WildcardEndpointSelector},
		EntityWorld:      {endpointSelectorWorld},
		EntityHost:       {endpointSelectorHost},
		EntityInit:       {endpointSelectorInit},
		EntityRemoteNode: {endpointSelectorRemoteNode},
		EntityNone:       {EndpointSelectorNone},

		EntityCluster: {},
	}
)
View Source 
var (
	// WildcardEndpointSelector is a wildcard endpoint selector matching
	// all endpoints that can be described with labels.
	WildcardEndpointSelector = NewESFromLabels()

	// ReservedEndpointSelectors map reserved labels to EndpointSelectors
	// that will match those endpoints.
	ReservedEndpointSelectors = map[string]EndpointSelector{
		labels.IDNameHost:       newReservedEndpointSelector(labels.IDNameHost),
		labels.IDNameRemoteNode: newReservedEndpointSelector(labels.IDNameRemoteNode),
		labels.IDNameWorld:      newReservedEndpointSelector(labels.IDNameWorld),
	}
)
View Source 
var CIDRMatchAll = []CIDR{CIDR("0.0.0.0/0"), CIDR("::/0")}

CIDRMatchAll is a []CIDR that matches everything

View Source 
var KafkaAPIKeyMap = map[string]int16{
	"produce":              0,
	"fetch":                1,
	"offsets":              2,
	"metadata":             3,
	"leaderandisr":         4,
	"stopreplica":          5,
	"updatemetadata":       6,
	"controlledshutdown":   7,
	"offsetcommit":         8,
	"offsetfetch":          9,
	"findcoordinator":      10,
	"joingroup":            11,
	"heartbeat":            12,
	"leavegroup":           13,
	"syncgroup":            14,
	"describegroups":       15,
	"listgroups":           16,
	"saslhandshake":        17,
	"apiversions":          18,
	"createtopics":         19,
	"deletetopics":         20,
	"deleterecords":        21,
	"initproducerid":       22,
	"offsetforleaderepoch": 23,
	"addpartitionstotxn":   24,
	"addoffsetstotxn":      25,
	"endtxn":               26,
	"writetxnmarkers":      27,
	"txnoffsetcommit":      28,
	"describeacls":         29,
	"createacls":           30,
	"deleteacls":           31,
	"describeconfigs":      32,
	"alterconfigs":         33,
}

KafkaAPIKeyMap is the map of all allowed kafka API keys with the key values. Reference: https://kafka.apache.org/protocol#protocol_api_keys

View Source 
var KafkaReverseAPIKeyMap = map[int16]string{
	0:  "produce",
	1:  "fetch",
	2:  "offsets",
	3:  "metadata",
	4:  "leaderandisr",
	5:  "stopreplica",
	6:  "updatemetadata",
	7:  "controlledshutdown",
	8:  "offsetcommit",
	9:  "offsetfetch",
	10: "findcoordinator",
	11: "joingroup",
	12: "heartbeat",
	13: "leavegroup",
	14: "syncgroup",
	15: "describegroups",
	16: "listgroups",
	17: "saslhandshake",
	18: "apiversions",
	19: "createtopics",
	20: "deletetopics",
	21: "deleterecords",
	22: "initproducerid",
	23: "offsetforleaderepoch",
	24: "addpartitionstotxn",
	25: "addoffsetstotxn",
	26: "endtxn",
	27: "writetxnmarkers",
	28: "txnoffsetcommit",
	29: "describeacls",
	30: "createacls",
	31: "deleteacls",
	32: "describeconfigs",
	33: "alterconfigs",
}

KafkaReverseApiKeyMap is the map of all allowed kafka API keys with the key values. Reference: https://kafka.apache.org/protocol#protocol_api_keys

View Source 
var KafkaTopicValidChar = regexp.MustCompile(`^[a-zA-Z0-9\\._\\-]+$`)

KafkaTopicValidChar is a one-time regex generation of all allowed characters in kafka topic name.

Functions

func InitEntities added in v0.15.7 

func InitEntities(clusterName string, treatRemoteNodeAsHost bool)

InitEntities is called to initialize the policy API layer

func RegisterToGroupsProvider added in v0.15.7 

func RegisterToGroupsProvider(providerName string, callback GroupProviderFunc)

RegisterToGroupsProvider it will register a new callback that will be used when a new ToGroups rule is added.

Types

type AWSGroup added in v0.15.7 

type AWSGroup struct {
	Labels              map[string]string `json:"labels,omitempty"`
	SecurityGroupsIds   []string          `json:"securityGroupsIds,omitempty"`
	SecurityGroupsNames []string          `json:"securityGroupsNames,omitempty"`
	Region              string            `json:"region,omitempty"`
}

AWSGroup is an structure that can be used to whitelisting information from AWS integration

func (*AWSGroup) DeepCopy added in v0.15.7 

func (in *AWSGroup) DeepCopy() *AWSGroup

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSGroup.

func (*AWSGroup) DeepCopyInto added in v0.15.7 

func (in *AWSGroup) DeepCopyInto(out *AWSGroup)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AWSGroup) DeepEqual added in v0.15.7 

func (in *AWSGroup) DeepEqual(other *AWSGroup) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type CIDR 

type CIDR string

CIDR specifies a block of IP addresses. Example: 192.0.2.1/32

func (*CIDR) MatchesAll added in v1.5.0 

func (c *CIDR) MatchesAll() bool

MatchesAll determines whether the CIDR matches all traffic.

type CIDRRule added in v0.15.7 

type CIDRRule struct {
	// CIDR is a CIDR prefix / IP Block.
	//
	Cidr CIDR `json:"cidr"`

	// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
	// is not allowed to initiate connections to. These CIDR prefixes should be
	// contained within Cidr. These exceptions are only applied to the Cidr in
	// this CIDRRule, and do not apply to any other CIDR prefixes in any other
	// CIDRRules.
	//
	// +optional
	ExceptCIDRs []CIDR `json:"except,omitempty"`

	// Generated indicates whether the rule was generated based on other rules
	// or provided by user
	Generated bool `json:"-"`
}

CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.

func IPsToCIDRRules added in v1.5.0 

func IPsToCIDRRules(ips []net.IP) (cidrRules []CIDRRule)

IPsToCIDRRules generates CIDRRules for the IPs passed in./ This function will mark the rule to Generated true by default.

func (*CIDRRule) DeepCopy added in v0.15.7 

func (in *CIDRRule) DeepCopy() *CIDRRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CIDRRule.

func (*CIDRRule) DeepCopyInto added in v0.15.7 

func (in *CIDRRule) DeepCopyInto(out *CIDRRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CIDRRule) DeepEqual added in v0.15.7 

func (in *CIDRRule) DeepEqual(other *CIDRRule) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type CIDRRuleSlice added in v0.15.7 

type CIDRRuleSlice []CIDRRule

CIDRRuleSlice is a slice of CIDRRules. It allows receiver methods to be defined for transforming the slice into other convenient forms such as EndpointSelectorSlice.

func (CIDRRuleSlice) DeepCopy added in v0.15.7 

func (in CIDRRuleSlice) DeepCopy() CIDRRuleSlice

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CIDRRuleSlice.

func (CIDRRuleSlice) DeepCopyInto added in v0.15.7 

func (in CIDRRuleSlice) DeepCopyInto(out *CIDRRuleSlice)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CIDRRuleSlice) DeepEqual added in v0.15.7 

func (in *CIDRRuleSlice) DeepEqual(other *CIDRRuleSlice) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (CIDRRuleSlice) GetAsEndpointSelectors added in v0.15.7 

func (s CIDRRuleSlice) GetAsEndpointSelectors() EndpointSelectorSlice

GetAsEndpointSelectors returns the provided CIDRRule slice as a slice of endpoint selectors

type CIDRSlice added in v0.15.7 

type CIDRSlice []CIDR

CIDRSlice is a slice of CIDRs. It allows receiver methods to be defined for transforming the slice into other convenient forms such as EndpointSelectorSlice.

func ComputeResultantCIDRSet added in v0.15.7 

func ComputeResultantCIDRSet(cidrs CIDRRuleSlice) CIDRSlice

ComputeResultantCIDRSet converts a slice of CIDRRules into a slice of individual CIDRs. This expands the cidr defined by each CIDRRule, applies the CIDR exceptions defined in "ExceptCIDRs", and forms a minimal set of CIDRs that cover all of the CIDRRules.

Assumes no error checking is necessary as CIDRRule.Sanitize already does this.

func (CIDRSlice) DeepCopy added in v0.15.7 

func (in CIDRSlice) DeepCopy() CIDRSlice

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CIDRSlice.

func (CIDRSlice) DeepCopyInto added in v0.15.7 

func (in CIDRSlice) DeepCopyInto(out *CIDRSlice)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CIDRSlice) DeepEqual added in v0.15.7 

func (in *CIDRSlice) DeepEqual(other *CIDRSlice) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (CIDRSlice) GetAsEndpointSelectors added in v0.15.7 

func (s CIDRSlice) GetAsEndpointSelectors() EndpointSelectorSlice

GetAsEndpointSelectors returns the provided CIDR slice as a slice of endpoint selectors

func (CIDRSlice) StringSlice added in v0.15.7 

func (s CIDRSlice) StringSlice() []string

StringSlice returns the CIDR slice as a slice of strings.

type Decision 

type Decision byte

Decision is a reachability policy decision 

const (
	// Undecided means that we have not come to a decision yet
	Undecided Decision = iota
	// Allowed means that reachability is allowed
	Allowed
	// Denied means that reachability is denied
	Denied
)

func (Decision) MarshalJSON 

func (d Decision) MarshalJSON() ([]byte, error)

MarshalJSON returns the decision as JSON formatted buffer

func (Decision) String 

func (d Decision) String() string

String returns the decision in human readable format

func (*Decision) UnmarshalJSON 

func (d *Decision) UnmarshalJSON(b []byte) error

UnmarshalJSON parses a JSON formatted buffer and returns a decision

type EgressRule 

type EgressRule struct {
	// ToEndpoints is a list of endpoints identified by an EndpointSelector to
	// which the endpoints subject to the rule are allowed to communicate.
	//
	// Example:
	// Any endpoint with the label "role=frontend" can communicate with any
	// endpoint carrying the label "role=backend".
	//
	// +optional
	ToEndpoints []EndpointSelector `json:"toEndpoints,omitempty"`

	// ToRequires is a list of additional constraints which must be met
	// in order for the selected endpoints to be able to connect to other
	// endpoints. These additional constraints do no by itself grant access
	// privileges and must always be accompanied with at least one matching
	// ToEndpoints.
	//
	// Example:
	// Any Endpoint with the label "team=A" requires any endpoint to which it
	// communicates to also carry the label "team=A".
	//
	// +optional
	ToRequires []EndpointSelector `json:"toRequires,omitempty"`

	// ToPorts is a list of destination ports identified by port number and
	// protocol which the endpoint subject to the rule is allowed to
	// connect to.
	//
	// Example:
	// Any endpoint with the label "role=frontend" is allowed to initiate
	// connections to destination port 8080/tcp
	//
	// +optional
	ToPorts []PortRule `json:"toPorts,omitempty"`

	// ToCIDR is a list of IP blocks which the endpoint subject to the rule
	// is allowed to initiate connections. Only connections destined for
	// outside of the cluster and not targeting the host will be subject
	// to CIDR rules.  This will match on the destination IP address of
	// outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
	// with no ExcludeCIDRs is equivalent. Overlaps are allowed between
	// ToCIDR and ToCIDRSet.
	//
	// Example:
	// Any endpoint with the label "app=database-proxy" is allowed to
	// initiate connections to 10.2.3.0/24
	//
	// +optional
	ToCIDR CIDRSlice `json:"toCIDR,omitempty"`

	// ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
	// is allowed to initiate connections to in addition to connections
	// which are allowed via ToEndpoints, along with a list of subnets contained
	// within their corresponding IP block to which traffic should not be
	// allowed. This will match on the destination IP address of outgoing
	// connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
	// ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
	// ToCIDRSet.
	//
	// Example:
	// Any endpoint with the label "app=database-proxy" is allowed to
	// initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
	//
	// +optional
	ToCIDRSet CIDRRuleSlice `json:"toCIDRSet,omitempty"`

	// ToEntities is a list of special entities to which the endpoint subject
	// to the rule is allowed to initiate connections. Supported entities are
	// `world`, `cluster` and `host`
	//
	// +optional
	ToEntities EntitySlice `json:"toEntities,omitempty"`

	// ToServices is a list of services to which the endpoint subject
	// to the rule is allowed to initiate connections.
	//
	// Example:
	// Any endpoint with the label "app=backend-app" is allowed to
	// initiate connections to all cidrs backing the "external-service" service
	// + optional
	ToServices []Service `json:"toServices,omitempty"`

	// ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
	// from DNS resolution of `ToFQDN.MatchName`s are added to the same
	// EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
	// L7 rules within this EgressRule will also apply to these IPs.
	// The DNS -> IP mapping is re-resolved periodically from within the
	// cilium-agent, and the IPs in the DNS response are effected in the policy
	// for selected pods as-is (i.e. the list of IPs is not modified in any way).
	// Note: An explicit rule to allow for DNS traffic is needed for the pods, as
	// ToFQDN counts as an egress rule and will enforce egress policy when
	// PolicyEnforcment=default.
	// Note: If the resolved IPs are IPs within the kubernetes cluster, the
	// ToFQDN rule will not apply to that IP.
	// Note: ToFQDN cannot occur in the same policy as other To* rules.
	//
	// The current implementation has a number of limitations:
	// - The DNS resolution originates from cilium-agent, and not from the pods.
	// Differences between the responses seen by cilium agent and a particular
	// pod will whitelist the incorrect IP.
	// - DNS TTLs are ignored, and cilium-agent will repoll on a short interval
	// (5 seconds). Each change to the DNS data will trigger a policy
	// regeneration. This may result in delayed updates to the policy for an
	// endpoint when the data changes often or the system is under load.
	//
	// +optional
	ToFQDNs FQDNSelectorSlice `json:"toFQDNs,omitempty"`

	// ToGroups is a directive that allows the integration with multiple outside
	// providers. Currently, only AWS is supported, and the rule can select by
	// multiple sub directives:
	//
	// Example:
	// toGroups:
	// - aws:
	//     securityGroupsIds:
	//     - 'sg-XXXXXXXXXXXXX'
	// +optional
	ToGroups []ToGroups `json:"toGroups,omitempty"`
	// contains filtered or unexported fields
}

EgressRule contains all rule types which can be applied at egress, i.e. network traffic that originates inside the endpoint and exits the endpoint selected by the endpointSelector.

  • All members of this structure are optional. If omitted or empty, the member will have no effect on the rule.
  • For now, combining ToPorts and ToCIDR in the same rule is not supported and such rules will be rejected. In the future, this will be supported and if if multiple members of the structure are specified, then all members must match in order for the rule to take effect.

func (*EgressRule) AllowsWildcarding added in v0.15.7 

func (e *EgressRule) AllowsWildcarding() bool

AllowsWildcarding returns true if wildcarding should be performed upon // policy evaluation for the given rule.

func (*EgressRule) CreateDerivative added in v0.15.7 

func (e *EgressRule) CreateDerivative(ctx context.Context) (*EgressRule, error)

CreateDerivative will return a new rule based on the data gathered by the rules that creates a new derivative policy. In the case of ToGroups will call outside using the groups callback and this function can take a bit of time.

func (*EgressRule) DeepCopy added in v0.15.7 

func (in *EgressRule) DeepCopy() *EgressRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressRule.

func (*EgressRule) DeepCopyInto added in v0.15.7 

func (in *EgressRule) DeepCopyInto(out *EgressRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressRule) DeepEqual added in v0.15.7 

func (in *EgressRule) DeepEqual(other *EgressRule) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*EgressRule) GetDestinationEndpointSelectorsWithRequirements added in v0.15.7 

func (e *EgressRule) GetDestinationEndpointSelectorsWithRequirements(requirements []slim_metav1.LabelSelectorRequirement) EndpointSelectorSlice

GetDestinationEndpointSelectorsWithRequirements returns a slice of endpoints selectors covering all L3 source selectors of the ingress rule

func (*EgressRule) RequiresDerivative added in v1.5.0 

func (e *EgressRule) RequiresDerivative() bool

RequiresDerivative returns true when the EgressRule contains sections that need a derivative policy created in order to be enforced (e.g. ToGroups).

func (*EgressRule) SetAggregatedSelectors added in v0.15.7 

func (e *EgressRule) SetAggregatedSelectors()

SetAggregatedSelectors creates a single slice containing all of the following fields within the EgressRule, converted to EndpointSelector, to be stored within the EgressRule for easy lookup while performing policy evaluation for the rule: * ToEntities * ToCIDR * ToCIDRSet * ToFQDNs

ToEndpoints is not aggregated due to requirement folding in GetDestinationEndpointSelectorsWithRequirements()

type EndpointSelector 

type EndpointSelector struct {
	*slim_metav1.LabelSelector
	// contains filtered or unexported fields
}

EndpointSelector is a wrapper for k8s LabelSelector.

func NewESFromK8sLabelSelector 

func NewESFromK8sLabelSelector(srcPrefix string, lss ...*slim_metav1.LabelSelector) EndpointSelector

NewESFromK8sLabelSelector returns a new endpoint selector from the label where it the given srcPrefix will be encoded in the label's keys.

func NewESFromLabels 

func NewESFromLabels(lbls ...labels.Label) EndpointSelector

NewESFromLabels creates a new endpoint selector from the given labels.

func NewESFromMatchRequirements added in v0.15.7 

func NewESFromMatchRequirements(matchLabels map[string]string, reqs []slim_metav1.LabelSelectorRequirement) EndpointSelector

NewESFromMatchRequirements creates a new endpoint selector from the given match specifications: An optional set of labels that must match, and an optional slice of LabelSelectorRequirements.

If the caller intends to reuse 'matchLabels' or 'reqs' after creating the EndpointSelector, they must make a copy of the parameter.

func (*EndpointSelector) AddMatch added in v0.15.7 

func (n *EndpointSelector) AddMatch(key, value string)

AddMatch adds a match for 'key' == 'value' to the endpoint selector.

func (EndpointSelector) CachedString added in v0.15.7 

func (n EndpointSelector) CachedString() string

CachedString returns the cached string representation of the LabelSelector for this EndpointSelector.

func (*EndpointSelector) ConvertToLabelSelectorRequirementSlice added in v0.15.7 

func (n *EndpointSelector) ConvertToLabelSelectorRequirementSlice() []slim_metav1.LabelSelectorRequirement

ConvertToLabelSelectorRequirementSlice converts the MatchLabels and MatchExpressions within the specified EndpointSelector into a list of LabelSelectorRequirements.

func (*EndpointSelector) DeepCopy added in v0.15.7 

func (in *EndpointSelector) DeepCopy() *EndpointSelector

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointSelector.

func (*EndpointSelector) DeepCopyInto added in v0.15.7 

func (in *EndpointSelector) DeepCopyInto(out *EndpointSelector)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EndpointSelector) DeepEqual added in v0.15.7 

func (in *EndpointSelector) DeepEqual(other *EndpointSelector) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (EndpointSelector) GetMatch added in v0.15.7 

func (n EndpointSelector) GetMatch(key string) ([]string, bool)

GetMatch checks for a match on the specified key, and returns the value that the key must match, and true. If a match cannot be found, returns nil, false.

func (EndpointSelector) HasKey added in v0.15.7 

func (n EndpointSelector) HasKey(key string) bool

HasKey checks if the endpoint selector contains the given key in its MatchLabels map or in its MatchExpressions slice.

func (EndpointSelector) HasKeyPrefix 

func (n EndpointSelector) HasKeyPrefix(prefix string) bool

HasKeyPrefix checks if the endpoint selector contains the given key prefix in its MatchLabels map and MatchExpressions slice.

func (*EndpointSelector) IsWildcard added in v0.15.7 

func (n *EndpointSelector) IsWildcard() bool

IsWildcard returns true if the endpoint selector selects all endpoints.

func (*EndpointSelector) LabelSelectorString added in v0.15.7 

func (n *EndpointSelector) LabelSelectorString() string

LabelSelectorString returns a user-friendly string representation of EndpointSelector.

func (EndpointSelector) MarshalJSON 

func (n EndpointSelector) MarshalJSON() ([]byte, error)

MarshalJSON returns a JSON representation of the byte array.

func (*EndpointSelector) Matches 

func (n *EndpointSelector) Matches(lblsToMatch k8sLbls.Labels) bool

Matches returns true if the endpoint selector Matches the `lblsToMatch`. Returns always true if the endpoint selector contains the reserved label for "all".

func (EndpointSelector) String 

func (n EndpointSelector) String() string

String returns a string representation of EndpointSelector.

func (*EndpointSelector) SyncRequirementsWithLabelSelector added in v0.15.7 

func (n *EndpointSelector) SyncRequirementsWithLabelSelector()

SyncRequirementsWithLabelSelector ensures that the requirements within the specified EndpointSelector are in sync with the LabelSelector. This is because the LabelSelector has publicly accessible fields, which can be updated without concurrently updating the requirements, so the two fields can become out of sync.

func (*EndpointSelector) UnmarshalJSON 

func (n *EndpointSelector) UnmarshalJSON(b []byte) error

UnmarshalJSON unmarshals the endpoint selector from the byte array.

type EndpointSelectorSlice added in v0.15.7 

type EndpointSelectorSlice []EndpointSelector

EndpointSelectorSlice is a slice of EndpointSelectors that can be sorted.

func (EndpointSelectorSlice) DeepCopy added in v0.15.7 

func (in EndpointSelectorSlice) DeepCopy() EndpointSelectorSlice

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointSelectorSlice.

func (EndpointSelectorSlice) DeepCopyInto added in v0.15.7 

func (in EndpointSelectorSlice) DeepCopyInto(out *EndpointSelectorSlice)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EndpointSelectorSlice) DeepEqual added in v0.15.7 

func (in *EndpointSelectorSlice) DeepEqual(other *EndpointSelectorSlice) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (EndpointSelectorSlice) Len added in v0.15.7 

func (s EndpointSelectorSlice) Len() int

func (EndpointSelectorSlice) Less added in v0.15.7 

func (s EndpointSelectorSlice) Less(i, j int) bool

func (EndpointSelectorSlice) Matches added in v0.15.7 

func (s EndpointSelectorSlice) Matches(ctx labels.LabelArray) bool

Matches returns true if any of the EndpointSelectors in the slice match the provided labels

func (EndpointSelectorSlice) SelectsAllEndpoints added in v0.15.7 

func (s EndpointSelectorSlice) SelectsAllEndpoints() bool

SelectsAllEndpoints returns whether the EndpointSelectorSlice selects all endpoints, which is true if the wildcard endpoint selector is present in the slice.

func (EndpointSelectorSlice) Swap added in v0.15.7 

func (s EndpointSelectorSlice) Swap(i, j int)

type Entity added in v0.15.7 

type Entity string

Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe "outside of cluster", "host", etc. 

const (
	// EntityAll is an entity that represents all traffic
	EntityAll Entity = "all"

	// EntityWorld is an entity that represents traffic external to
	// endpoint's cluster
	EntityWorld Entity = "world"

	// EntityCluster is an entity that represents traffic within the
	// endpoint's cluster, to endpoints not managed by cilium
	EntityCluster Entity = "cluster"

	// EntityHost is an entity that represents traffic within endpoint host
	EntityHost Entity = "host"

	// EntityInit is an entity that represents an initializing endpoint
	EntityInit Entity = "init"

	// EntityRemoteNode is an entity that represents all remote nodes
	EntityRemoteNode Entity = "remote-node"

	// EntityNone is an entity that can be selected but never exist
	EntityNone Entity = "none"
)

type EntitySlice added in v0.15.7 

type EntitySlice []Entity

EntitySlice is a slice of entities

func (EntitySlice) DeepCopy added in v0.15.7 

func (in EntitySlice) DeepCopy() EntitySlice

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EntitySlice.

func (EntitySlice) DeepCopyInto added in v0.15.7 

func (in EntitySlice) DeepCopyInto(out *EntitySlice)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EntitySlice) DeepEqual added in v0.15.7 

func (in *EntitySlice) DeepEqual(other *EntitySlice) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (EntitySlice) GetAsEndpointSelectors added in v0.15.7 

func (s EntitySlice) GetAsEndpointSelectors() EndpointSelectorSlice

GetAsEndpointSelectors returns the provided entity slice as a slice of endpoint selectors

type FQDNSelector added in v0.15.7 

type FQDNSelector struct {
	// MatchName matches literal DNS names. A trailing "." is automatically added
	// when missing.
	MatchName string `json:"matchName,omitempty"`

	// MatchPattern allows using wildcards to match DNS names. All wildcards are
	// case insensitive. The wildcards are:
	// - "*" matches 0 or more DNS valid characters, and may occur anywhere in
	// the pattern. As a special case a "*" as the leftmost character, without a
	// following "." matches all subdomains as well as the name to the right.
	// A trailing "." is automatically added when missing.
	//
	// Examples:
	// `*.cilium.io` matches subomains of cilium at that level
	//   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
	// `*cilium.io` matches cilium.io and all subdomains 1 level below
	//   www.cilium.io, blog.cilium.io and cilium.io match, google.com does not
	// sub*.cilium.io matches subdomains of cilium where the subdomain component
	// begins with "sub"
	//   sub.cilium.io and subdomain.cilium.io match, www.cilium.io,
	//   blog.cilium.io, cilium.io and google.com do not
	MatchPattern string `json:"matchPattern,omitempty"`
}

func (*FQDNSelector) DeepCopy added in v0.15.7 

func (in *FQDNSelector) DeepCopy() *FQDNSelector

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FQDNSelector.

func (*FQDNSelector) DeepCopyInto added in v0.15.7 

func (in *FQDNSelector) DeepCopyInto(out *FQDNSelector)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*FQDNSelector) DeepEqual added in v0.15.7 

func (in *FQDNSelector) DeepEqual(other *FQDNSelector) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*FQDNSelector) GetAsEndpointSelectors added in v0.15.7 

func (s *FQDNSelector) GetAsEndpointSelectors() EndpointSelectorSlice

GetAsEndpointSelectors returns a FQDNSelector as a single EntityNone EndpointSelector slice. Note that toFQDNs behaves differently than most other rules. The presence of any toFQDNs rules means the endpoint must enforce policy, but the IPs are later added as toCIDRSet entries and processed as such.

func (*FQDNSelector) String added in v0.15.7 

func (s *FQDNSelector) String() string

func (*FQDNSelector) ToRegex added in v0.15.7 

func (s *FQDNSelector) ToRegex() (*regexp.Regexp, error)

ToRegex converts the given FQDNSelector to its corresponding regular expression. If the MatchName field is set in the selector, it performs all needed formatting to ensure that the field is a valid regular expression.

type FQDNSelectorSlice added in v0.15.7 

type FQDNSelectorSlice []FQDNSelector

FQDNSelectorSlice is a wrapper type for []FQDNSelector to make is simpler to bind methods.

func (FQDNSelectorSlice) DeepCopy added in v0.15.7 

func (in FQDNSelectorSlice) DeepCopy() FQDNSelectorSlice

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FQDNSelectorSlice.

func (FQDNSelectorSlice) DeepCopyInto added in v0.15.7 

func (in FQDNSelectorSlice) DeepCopyInto(out *FQDNSelectorSlice)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*FQDNSelectorSlice) DeepEqual added in v0.15.7 

func (in *FQDNSelectorSlice) DeepEqual(other *FQDNSelectorSlice) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (FQDNSelectorSlice) GetAsEndpointSelectors added in v0.15.7 

func (s FQDNSelectorSlice) GetAsEndpointSelectors() EndpointSelectorSlice

GetAsEndpointSelectors will return a single EntityNone if any toFQDNs rules exist, and a nil slice otherwise.

type GroupProviderFunc added in v0.15.7 

type GroupProviderFunc func(context.Context, *ToGroups) ([]net.IP, error)

GroupProviderFunc is a func that need to be register to be able to register a new provider in the platform.

type HeaderMatch added in v0.15.7 

type HeaderMatch struct {
	// Mismatch identifies what to do in case there is no match. The
	// default is to drop the request. Otherwise the overall rule is still
	// considered as matching, but the mismatches
	// are logged in the access log.
	Mismatch MismatchAction `json:"mismatch,omitempty"`

	// Name identifies the header
	Name string `json:"name"`

	// Secret refers to a secret that contains the value to be matched against.
	// The secret must only contain one entry.
	// If the referred secret does not exist, and there is no "Value" specified, the match will fail.
	//
	// +optional
	Secret *Secret `json:"secret,omitempty"`

	// Value matches the exact value of the header.
	// Can be specified either alone or together with "Secret"; will be used as the header value if
	// the secret can not be found in the latter case.
	// +optional
	Value string `json:"value,omitempty"`
}

HeaderMatch extends the HeaderValue for matching requirement of a named header field against an immediate string, a secret value, or a regex. If none of the optional fields is present, then the header value is not matched, only presence of the header is enough.

func (*HeaderMatch) DeepCopy added in v0.15.7 

func (in *HeaderMatch) DeepCopy() *HeaderMatch

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderMatch.

func (*HeaderMatch) DeepCopyInto added in v0.15.7 

func (in *HeaderMatch) DeepCopyInto(out *HeaderMatch)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*HeaderMatch) DeepEqual added in v0.15.7 

func (in *HeaderMatch) DeepEqual(other *HeaderMatch) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*HeaderMatch) Equal added in v0.15.7 

func (h *HeaderMatch) Equal(o *HeaderMatch) bool

Equal returns true if both HeaderMatches are equal

type IngressRule 

type IngressRule struct {
	// FromEndpoints is a list of endpoints identified by an
	// EndpointSelector which are allowed to communicate with the endpoint
	// subject to the rule.
	//
	// Example:
	// Any endpoint with the label "role=backend" can be consumed by any
	// endpoint carrying the label "role=frontend".
	//
	// +optional
	FromEndpoints []EndpointSelector `json:"fromEndpoints,omitempty"`

	// FromRequires is a list of additional constraints which must be met
	// in order for the selected endpoints to be reachable. These
	// additional constraints do no by itself grant access privileges and
	// must always be accompanied with at least one matching FromEndpoints.
	//
	// Example:
	// Any Endpoint with the label "team=A" requires consuming endpoint
	// to also carry the label "team=A".
	//
	// +optional
	FromRequires []EndpointSelector `json:"fromRequires,omitempty"`

	// ToPorts is a list of destination ports identified by port number and
	// protocol which the endpoint subject to the rule is allowed to
	// receive connections on.
	//
	// Example:
	// Any endpoint with the label "app=httpd" can only accept incoming
	// connections on port 80/tcp.
	//
	// +optional
	ToPorts []PortRule `json:"toPorts,omitempty"`

	// FromCIDR is a list of IP blocks which the endpoint subject to the
	// rule is allowed to receive connections from. Only connections which
	// do *not* originate from the cluster or from the local host are subject
	// to CIDR rules. In order to allow in-cluster connectivity, use the
	// FromEndpoints field.  This will match on the source IP address of
	// incoming connections. Adding  a prefix into FromCIDR or into
	// FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
	// allowed between FromCIDR and FromCIDRSet.
	//
	// Example:
	// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
	// connections from 10.3.9.1
	//
	// +optional
	FromCIDR CIDRSlice `json:"fromCIDR,omitempty"`

	// FromCIDRSet is a list of IP blocks which the endpoint subject to the
	// rule is allowed to receive connections from in addition to FromEndpoints,
	// along with a list of subnets contained within their corresponding IP block
	// from which traffic should not be allowed.
	// This will match on the source IP address of incoming connections. Adding
	// a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
	// equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
	//
	// Example:
	// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
	// connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
	//
	// +optional
	FromCIDRSet CIDRRuleSlice `json:"fromCIDRSet,omitempty"`

	// FromEntities is a list of special entities which the endpoint subject
	// to the rule is allowed to receive connections from. Supported entities are
	// `world`, `cluster` and `host`
	//
	// +optional
	FromEntities EntitySlice `json:"fromEntities,omitempty"`
	// contains filtered or unexported fields
}

IngressRule contains all rule types which can be applied at ingress, i.e. network traffic that originates outside of the endpoint and is entering the endpoint selected by the endpointSelector.

  • All members of this structure are optional. If omitted or empty, the member will have no effect on the rule.
  • If multiple members are set, all of them need to match in order for the rule to take effect. The exception to this rule is FromRequires field; the effects of any Requires field in any rule will apply to all other rules as well.
  • For now, combining ToPorts, FromCIDR, and FromEndpoints in the same rule is not supported and any such rules will be rejected. In the future, this will be supported and if multiple members of this structure are specified, then all members must match in order for the rule to take effect. The exception to this rule is the Requires field, the effects of any Requires field in any rule will apply to all other rules as well.

func (*IngressRule) AllowsWildcarding added in v1.7.0 

func (i *IngressRule) AllowsWildcarding() bool

AllowsWildcarding returns true if wildcarding should be performed upon policy evaluation for the given rule.

func (*IngressRule) DeepCopy added in v0.15.7 

func (in *IngressRule) DeepCopy() *IngressRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressRule.

func (*IngressRule) DeepCopyInto added in v0.15.7 

func (in *IngressRule) DeepCopyInto(out *IngressRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IngressRule) DeepEqual added in v0.15.7 

func (in *IngressRule) DeepEqual(other *IngressRule) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*IngressRule) GetSourceEndpointSelectorsWithRequirements added in v1.6.0 

func (i *IngressRule) GetSourceEndpointSelectorsWithRequirements(requirements []slim_metav1.LabelSelectorRequirement) EndpointSelectorSlice

GetSourceEndpointSelectorsWithRequirements returns a slice of endpoints selectors covering all L3 source selectors of the ingress rule

func (*IngressRule) SetAggregatedSelectors added in v1.5.0 

func (i *IngressRule) SetAggregatedSelectors()

SetAggregatedSelectors creates a single slice containing all of the following fields within the IngressRule, converted to EndpointSelector, to be stored within the IngressRule for easy lookup while performing policy evaluation for the rule: * FromEntities * FromCIDR * FromCIDRSet

FromEndpoints is not aggregated due to requirement folding in GetSourceEndpointSelectorsWithRequirements()

type K8sServiceNamespace added in v0.15.7 

type K8sServiceNamespace struct {
	ServiceName string `json:"serviceName,omitempty"`
	Namespace   string `json:"namespace,omitempty"`
}

K8sServiceNamespace is an abstraction for the k8s service + namespace types.

func (*K8sServiceNamespace) DeepCopy added in v0.15.7 

func (in *K8sServiceNamespace) DeepCopy() *K8sServiceNamespace

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8sServiceNamespace.

func (*K8sServiceNamespace) DeepCopyInto added in v0.15.7 

func (in *K8sServiceNamespace) DeepCopyInto(out *K8sServiceNamespace)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*K8sServiceNamespace) DeepEqual added in v0.15.7 

func (in *K8sServiceNamespace) DeepEqual(other *K8sServiceNamespace) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type K8sServiceSelectorNamespace added in v0.15.7 

type K8sServiceSelectorNamespace struct {
	Selector  ServiceSelector `json:"selector"`
	Namespace string          `json:"namespace,omitempty"`
}

K8sServiceSelectorNamespace wraps service selector with namespace

func (*K8sServiceSelectorNamespace) DeepCopy added in v0.15.7 

func (in *K8sServiceSelectorNamespace) DeepCopy() *K8sServiceSelectorNamespace

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8sServiceSelectorNamespace.

func (*K8sServiceSelectorNamespace) DeepCopyInto added in v0.15.7 

func (in *K8sServiceSelectorNamespace) DeepCopyInto(out *K8sServiceSelectorNamespace)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*K8sServiceSelectorNamespace) DeepEqual added in v0.15.7 

func (in *K8sServiceSelectorNamespace) DeepEqual(other *K8sServiceSelectorNamespace) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type KafkaRole added in v1.5.0 

type KafkaRole []int16

KafkaRole is the list of all low-level apiKeys to be expanded as per the value of Role

func (KafkaRole) DeepCopy added in v1.5.0 

func (in KafkaRole) DeepCopy() KafkaRole

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KafkaRole.

func (KafkaRole) DeepCopyInto added in v1.5.0 

func (in KafkaRole) DeepCopyInto(out *KafkaRole)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*KafkaRole) DeepEqual added in v1.8.0 

func (in *KafkaRole) DeepEqual(other *KafkaRole) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type L4Proto added in v0.15.7 

type L4Proto string

L4Proto is a layer 4 protocol name 

const (
	ProtoTCP L4Proto = "TCP"
	ProtoUDP L4Proto = "UDP"
	ProtoAny L4Proto = "ANY"

	PortProtocolAny = "0/ANY"
)

func ParseL4Proto added in v0.15.7 

func ParseL4Proto(proto string) (L4Proto, error)

ParseL4Proto parses a string as layer 4 protocol

func (L4Proto) Validate added in v0.15.7 

func (l4 L4Proto) Validate() error

Validate returns an error if the layer 4 protocol is not valid

type L7Rules 

type L7Rules struct {
	// HTTP specific rules.
	//
	// +optional
	HTTP []PortRuleHTTP `json:"http,omitempty"`

	// Kafka-specific rules.
	//
	// +optional
	Kafka []PortRuleKafka `json:"kafka,omitempty"`

	// DNS-specific rules.
	//
	// +optional
	DNS []PortRuleDNS `json:"dns,omitempty"`

	// Name of the L7 protocol for which the Key-value pair rules apply
	//
	// +optional
	L7Proto string `json:"l7proto,omitempty"`

	// Key-value pair rules
	//
	// +optional
	L7 []PortRuleL7 `json:"l7,omitempty"`
}

L7Rules is a union of port level rule types. Mixing of different port level rule types is disallowed, so exactly one of the following must be set. If none are specified, then no additional port level rules are applied.

func (*L7Rules) DeepCopy added in v0.15.7 

func (in *L7Rules) DeepCopy() *L7Rules

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new L7Rules.

func (*L7Rules) DeepCopyInto added in v0.15.7 

func (in *L7Rules) DeepCopyInto(out *L7Rules)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*L7Rules) DeepEqual added in v0.15.7 

func (in *L7Rules) DeepEqual(other *L7Rules) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*L7Rules) IsEmpty added in v0.15.7 

func (rules *L7Rules) IsEmpty() bool

IsEmpty returns whether the `L7Rules` is nil or contains nil rules.

func (*L7Rules) Len added in v0.15.7 

func (rules *L7Rules) Len() int

Len returns the total number of rules inside `L7Rules`. Returns 0 if nil.

type MismatchAction added in v0.15.7 

type MismatchAction string

MismatchAction specifies what to do when there is no header match Empty string is the default for making the rule to fail the match. Otherwise the rule is still considered as matching, but the mismatches are logged in the access log. 

const (
	MismatchActionLog     MismatchAction = "LOG"     // Keep checking other matches
	MismatchActionAdd     MismatchAction = "ADD"     // Add the missing value to a possibly multi-valued header
	MismatchActionDelete  MismatchAction = "DELETE"  // Remove the whole mismatching header
	MismatchActionReplace MismatchAction = "REPLACE" // Replace (of add if missing) the header
)

type PortProtocol 

type PortProtocol struct {
	// Port is an L4 port number. For now the string will be strictly
	// parsed as a single uint16. In the future, this field may support
	// ranges in the form "1024-2048
	// Port can also be a port name, which must contain at least one [a-z],
	// and may also contain [0-9] and '-' anywhere exept adjacent to another
	// '-' or in the beginning or the end.
	Port string `json:"port"`

	// Protocol is the L4 protocol. If omitted or empty, any protocol
	// matches. Accepted values: "TCP", "UDP", ""/"ANY"
	//
	// Matching on ICMP is not supported.
	//
	// Named port specified for a container may narrow this down, but may not
	// contradict this.
	// +optional
	Protocol L4Proto `json:"protocol,omitempty"`
}

PortProtocol specifies an L4 port with an optional transport protocol

func (PortProtocol) Covers added in v0.15.7 

func (p PortProtocol) Covers(other PortProtocol) bool

Covers returns true if the ports and protocol specified in the received PortProtocol are equal to or a superset of the ports and protocol in 'other'. Named ports only cover other named ports with exactly the same name.

func (*PortProtocol) DeepCopy added in v0.15.7 

func (in *PortProtocol) DeepCopy() *PortProtocol

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PortProtocol.

func (*PortProtocol) DeepCopyInto added in v0.15.7 

func (in *PortProtocol) DeepCopyInto(out *PortProtocol)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PortProtocol) DeepEqual added in v0.15.7 

func (in *PortProtocol) DeepEqual(other *PortProtocol) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type PortRule 

type PortRule struct {
	// Ports is a list of L4 port/protocol
	//
	// +optional
	Ports []PortProtocol `json:"ports,omitempty"`

	// TerminatingTLS is the TLS context for the connection terminated by
	// the L7 proxy.  For egress policy this specifies the server-side TLS
	// parameters to be applied on the connections originated from the local
	// endpoint and terminated by the L7 proxy. For ingress policy this specifies
	// the server-side TLS parameters to be applied on the connections
	// originated from a remote source and terminated by the L7 proxy.
	//
	// +optional
	TerminatingTLS *TLSContext `json:"terminatingTLS,omitempty"`

	// OriginatingTLS is the TLS context for the connections originated by
	// the L7 proxy.  For egress policy this specifies the client-side TLS
	// parameters for the upstream connection originating from the L7 proxy
	// to the remote destination. For ingress policy this specifies the
	// client-side TLS parameters for the connection from the L7 proxy to
	// the local endpoint.
	//
	// +optional
	OriginatingTLS *TLSContext `json:"originatingTLS,omitempty"`

	// Rules is a list of additional port level rules which must be met in
	// order for the PortRule to allow the traffic. If omitted or empty,
	// no layer 7 rules are enforced.
	//
	// +optional
	Rules *L7Rules `json:"rules,omitempty"`
}

PortRule is a list of ports/protocol combinations with optional Layer 7 rules which must be met.

func (*PortRule) DeepCopy added in v0.15.7 

func (in *PortRule) DeepCopy() *PortRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PortRule.

func (*PortRule) DeepCopyInto added in v0.15.7 

func (in *PortRule) DeepCopyInto(out *PortRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PortRule) DeepEqual added in v0.15.7 

func (in *PortRule) DeepEqual(other *PortRule) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type PortRuleDNS added in v0.15.7 

type PortRuleDNS FQDNSelector

PortRuleDNS is a list of allowed DNS lookups.

func (*PortRuleDNS) DeepCopy added in v0.15.7 

func (in *PortRuleDNS) DeepCopy() *PortRuleDNS

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PortRuleDNS.

func (*PortRuleDNS) DeepCopyInto added in v0.15.7 

func (in *PortRuleDNS) DeepCopyInto(out *PortRuleDNS)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PortRuleDNS) DeepEqual added in v0.15.7 

func (in *PortRuleDNS) DeepEqual(other *PortRuleDNS) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*PortRuleDNS) Equal added in v0.15.7 

func (d *PortRuleDNS) Equal(o PortRuleDNS) bool

Equal returns true if both rules are equal

func (*PortRuleDNS) Exists added in v0.15.7 

func (d *PortRuleDNS) Exists(rules L7Rules) bool

Exists returns true if the DNS rule already exists in the list of rules

func (*PortRuleDNS) Sanitize added in v0.15.7 

func (r *PortRuleDNS) Sanitize() error

Sanitize checks that the matchName in the portRule can be compiled as a regex. It does not check that a DNS name is a valid DNS name.

type PortRuleHTTP 

type PortRuleHTTP struct {
	// Path is an extended POSIX regex matched against the path of a
	// request. Currently it can contain characters disallowed from the
	// conventional "path" part of a URL as defined by RFC 3986.
	//
	// If omitted or empty, all paths are all allowed.
	//
	// +optional
	Path string `json:"path,omitempty"`

	// Method is an extended POSIX regex matched against the method of a
	// request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
	//
	// If omitted or empty, all methods are allowed.
	//
	// +optional
	Method string `json:"method,omitempty"`

	// Host is an extended POSIX regex matched against the host header of a
	// request, e.g. "foo.com"
	//
	// If omitted or empty, the value of the host header is ignored.
	//
	// +optional
	Host string `json:"host,omitempty"`

	// Headers is a list of HTTP headers which must be present in the
	// request. If omitted or empty, requests are allowed regardless of
	// headers present.
	//
	// +optional
	Headers []string `json:"headers,omitempty"`

	// HeaderMatches is a list of HTTP headers which must be
	// present and match against the given values. Mismatch field can be used
	// to specify what to do when there is no match.
	//
	// +optional
	HeaderMatches []*HeaderMatch `json:"headerMatches,omitempty"`
}

PortRuleHTTP is a list of HTTP protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect.

All fields of this type are extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986.

func (*PortRuleHTTP) DeepCopy added in v0.15.7 

func (in *PortRuleHTTP) DeepCopy() *PortRuleHTTP

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PortRuleHTTP.

func (*PortRuleHTTP) DeepCopyInto added in v0.15.7 

func (in *PortRuleHTTP) DeepCopyInto(out *PortRuleHTTP)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PortRuleHTTP) DeepEqual added in v0.15.7 

func (in *PortRuleHTTP) DeepEqual(other *PortRuleHTTP) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*PortRuleHTTP) Equal added in v0.15.7 

func (h *PortRuleHTTP) Equal(o PortRuleHTTP) bool

Equal returns true if both HTTP rules are equal

func (*PortRuleHTTP) Exists added in v0.15.7 

func (h *PortRuleHTTP) Exists(rules L7Rules) bool

Exists returns true if the HTTP rule already exists in the list of rules

func (*PortRuleHTTP) Sanitize added in v0.15.7 

func (h *PortRuleHTTP) Sanitize() error

Sanitize sanitizes HTTP rules. It ensures that the path and method fields are valid regular expressions. Note that the proxy may support a wider-range of regular expressions (e.g. that specified by ECMAScript), so this function may return some false positives. If the rule is invalid, returns an error.

type PortRuleKafka added in v1.5.0 

type PortRuleKafka struct {

	// +optional
	Role string `json:"role,omitempty"`

	// APIKey is a case-insensitive string matched against the key of a
	// request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al
	// Reference: https://kafka.apache.org/protocol#protocol_api_keys
	//
	// If omitted or empty, and if Role is not specified, then all keys are allowed.
	//
	// +optional
	APIKey string `json:"apiKey,omitempty"`

	// APIVersion is the version matched against the api version of the
	// Kafka message. If set, it has to be a string representing a positive
	// integer.
	//
	// If omitted or empty, all versions are allowed.
	//
	// +optional
	APIVersion string `json:"apiVersion,omitempty"`

	// ClientID is the client identifier as provided in the request.
	//
	// From Kafka protocol documentation:
	// This is a user supplied identifier for the client application. The
	// user can use any identifier they like and it will be used when
	// logging errors, monitoring aggregates, etc. For example, one might
	// want to monitor not just the requests per second overall, but the
	// number coming from each client application (each of which could
	// reside on multiple servers). This id acts as a logical grouping
	// across all requests from a particular client.
	//
	// If omitted or empty, all client identifiers are allowed.
	//
	// +optional
	ClientID string `json:"clientID,omitempty"`

	// Topic is the topic name contained in the message. If a Kafka request
	// contains multiple topics, then all topics must be allowed or the
	// message will be rejected.
	//
	// This constraint is ignored if the matched request message type
	// doesn't contain any topic. Maximum size of Topic can be 249
	// characters as per recent Kafka spec and allowed characters are
	// a-z, A-Z, 0-9, -, . and _
	// Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10
	// version the length was changed from 255 to 249. For compatibility
	// reasons we are using 255
	//
	// If omitted or empty, all topics are allowed.
	//
	// +optional
	Topic string `json:"topic,omitempty"`
	// contains filtered or unexported fields
}

PortRuleKafka is a list of Kafka protocol constraints. All fields are optional, if all fields are empty or missing, the rule will match all Kafka messages.

func (*PortRuleKafka) CheckAPIKeyRole added in v1.5.0 

func (kr *PortRuleKafka) CheckAPIKeyRole(kind int16) bool

CheckAPIKeyRole checks the apiKey value in the request, and returns true if it is allowed else false

func (*PortRuleKafka) DeepCopy added in v1.5.0 

func (in *PortRuleKafka) DeepCopy() *PortRuleKafka

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PortRuleKafka.

func (*PortRuleKafka) DeepCopyInto added in v1.5.0 

func (in *PortRuleKafka) DeepCopyInto(out *PortRuleKafka)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PortRuleKafka) DeepEqual added in v1.8.0 

func (in *PortRuleKafka) DeepEqual(other *PortRuleKafka) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*PortRuleKafka) Equal added in v1.5.0 

func (k *PortRuleKafka) Equal(o PortRuleKafka) bool

Equal returns true if both rules are equal

func (*PortRuleKafka) Exists added in v1.5.0 

func (k *PortRuleKafka) Exists(rules L7Rules) bool

Exists returns true if the HTTP rule already exists in the list of rules

func (*PortRuleKafka) GetAPIVersion added in v1.5.0 

func (kr *PortRuleKafka) GetAPIVersion() (int16, bool)

GetAPIVersion returns the APIVersion as integer or the bool set to true if any API version is allowed

func (*PortRuleKafka) MapRoleToAPIKey added in v1.5.0 

func (kr *PortRuleKafka) MapRoleToAPIKey() error

MapRoleToAPIKey maps the Role to the low level set of APIKeys for that role

func (*PortRuleKafka) Sanitize added in v1.5.0 

func (kr *PortRuleKafka) Sanitize() error

Sanitize sanitizes Kafka rules TODO we need to add support to check wildcard and prefix/suffix later on.

type PortRuleL7 added in v0.15.7 

type PortRuleL7 map[string]string

PortRuleL7 is a list of key-value pairs interpreted by a L7 protocol as protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect.

func (PortRuleL7) DeepCopy added in v0.15.7 

func (in PortRuleL7) DeepCopy() PortRuleL7

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PortRuleL7.

func (PortRuleL7) DeepCopyInto added in v0.15.7 

func (in PortRuleL7) DeepCopyInto(out *PortRuleL7)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PortRuleL7) DeepEqual added in v0.15.7 

func (in *PortRuleL7) DeepEqual(other *PortRuleL7) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*PortRuleL7) Equal added in v0.15.7 

func (h *PortRuleL7) Equal(o PortRuleL7) bool

Equal returns true if both L7 rules are equal

func (*PortRuleL7) Exists added in v0.15.7 

func (h *PortRuleL7) Exists(rules L7Rules) bool

Exists returns true if the L7 rule already exists in the list of rules

func (*PortRuleL7) Sanitize added in v0.15.7 

func (rule *PortRuleL7) Sanitize() error

Sanitize sanitizes key-value pair rules. It makes sure keys are present.

type Rule 

type Rule struct {
	// EndpointSelector selects all endpoints which should be subject to
	// this rule. EndpointSelector and NodeSelector cannot be both empty and
	// are mutually exclusive.
	//
	// +optional
	EndpointSelector EndpointSelector `json:"endpointSelector,omitempty"`

	// NodeSelector selects all nodes which should be subject to this rule.
	// EndpointSelector and NodeSelector cannot be both empty and are mutually
	// exclusive.
	//
	// +optional
	NodeSelector EndpointSelector `json:"nodeSelector,omitempty"`

	// Ingress is a list of IngressRule which are enforced at ingress.
	// If omitted or empty, this rule does not apply at ingress.
	//
	// +optional
	Ingress []IngressRule `json:"ingress,omitempty"`

	// Egress is a list of EgressRule which are enforced at egress.
	// If omitted or empty, this rule does not apply at egress.
	//
	// +optional
	Egress []EgressRule `json:"egress,omitempty"`

	// Labels is a list of optional strings which can be used to
	// re-identify the rule or to store metadata. It is possible to lookup
	// or delete strings based on labels. Labels are not required to be
	// unique, multiple rules can have overlapping or identical labels.
	//
	// +optional
	Labels labels.LabelArray `json:"labels,omitempty"`

	// Description is a free form string, it can be used by the creator of
	// the rule to store human readable explanation of the purpose of this
	// rule. Rules cannot be identified by comment.
	//
	// +optional
	Description string `json:"description,omitempty"`
}

Rule is a policy rule which must be applied to all endpoints which match the labels contained in the endpointSelector

Each rule is split into an ingress section which contains all rules applicable at ingress, and an egress section applicable at egress. For rule types such as `L4Rule` and `CIDR` which can be applied at both ingress and egress, both ingress and egress side have to either specifically allow the connection or one side has to be omitted.

Either ingress, egress, or both can be provided. If both ingress and egress are omitted, the rule has no effect. +deepequal-gen:private-method=true

func NewRule added in v0.15.7 

func NewRule() *Rule

NewRule builds a new rule with no selector and no policy.

func (*Rule) CreateDerivative added in v0.15.7 

func (r *Rule) CreateDerivative(ctx context.Context) (*Rule, error)

CreateDerivative will return a new Rule with the new data based gather by the rules that autogenerated new Rule

func (*Rule) DeepCopy added in v0.15.7 

func (in *Rule) DeepCopy() *Rule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rule.

func (*Rule) DeepCopyInto added in v0.15.7 

func (in *Rule) DeepCopyInto(out *Rule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Rule) DeepEqual added in v0.15.7 

func (r *Rule) DeepEqual(o *Rule) bool

func (*Rule) MarshalJSON added in v0.15.7 

func (r *Rule) MarshalJSON() ([]byte, error)

MarshalJSON returns the JSON encoding of Rule r. We need to overwrite it to enforce omitempty on the EndpointSelector nested structures.

func (*Rule) RequiresDerivative added in v0.15.7 

func (r *Rule) RequiresDerivative() bool

RequiresDerivative it return true if the rule has a derivative rule.

func (Rule) Sanitize added in v0.15.7 

func (r Rule) Sanitize() error

Sanitize validates and sanitizes a policy rule. Minor edits such as capitalization of the protocol name are automatically fixed up. More fundamental violations will cause an error to be returned.

func (*Rule) WithDescription added in v0.15.7 

func (r *Rule) WithDescription(desc string) *Rule

WithDescription configures the Rule with the specified description metadata.

func (*Rule) WithEgressRules added in v0.15.7 

func (r *Rule) WithEgressRules(rules []EgressRule) *Rule

WithEgressRules configures the Rule with the specified rules.

func (*Rule) WithEndpointSelector added in v0.15.7 

func (r *Rule) WithEndpointSelector(es EndpointSelector) *Rule

WithEndpointSelector configures the Rule with the specified selector.

func (*Rule) WithIngressRules added in v0.15.7 

func (r *Rule) WithIngressRules(rules []IngressRule) *Rule

WithIngressRules configures the Rule with the specified rules.

func (*Rule) WithLabels added in v0.15.7 

func (r *Rule) WithLabels(labels labels.LabelArray) *Rule

WithLabels configures the Rule with the specified labels metadata.

type Rules 

type Rules []*Rule

Rules is a collection of api.Rule.

All rules must be evaluated in order to come to a conclusion. While it is sufficient to have a single fromEndpoints rule match, none of the fromRequires may be violated at the same time. +deepequal-gen:private-method=true

func (Rules) DeepCopy added in v0.15.7 

func (in Rules) DeepCopy() Rules

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rules.

func (Rules) DeepCopyInto added in v0.15.7 

func (in Rules) DeepCopyInto(out *Rules)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Rules) DeepEqual added in v0.15.7 

func (rs *Rules) DeepEqual(other *Rules) bool

DeepEqual is a deepequal function, deeply comparing the receiver with other. the receiver must be non-nil.

func (Rules) String added in v0.15.7 

func (rs Rules) String() string

type Secret added in v0.15.7 

type Secret struct {
	// Namespace is the namespace in which the secret exists.
	// Context of use determines the default value if left out (e.g., "default")
	//
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Name is the name of the secret.
	Name string `json:"name"`
}

Secret is a reference to a secret, backed by k8s or local file system.

func (*Secret) DeepCopy added in v0.15.7 

func (in *Secret) DeepCopy() *Secret

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Secret.

func (*Secret) DeepCopyInto added in v0.15.7 

func (in *Secret) DeepCopyInto(out *Secret)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Secret) DeepEqual added in v0.15.7 

func (in *Secret) DeepEqual(other *Secret) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*Secret) Equal added in v0.15.7 

func (a *Secret) Equal(b *Secret) bool

Equal returns true if both Secrets are equal

type Service added in v0.15.7 

type Service struct {
	// K8sServiceSelector selects services by k8s labels and namespace
	K8sServiceSelector *K8sServiceSelectorNamespace `json:"k8sServiceSelector,omitempty"`
	// K8sService selects service by name and namespace pair
	K8sService *K8sServiceNamespace `json:"k8sService,omitempty"`
}

Service wraps around selectors for services

func (*Service) DeepCopy added in v0.15.7 

func (in *Service) DeepCopy() *Service

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Service.

func (*Service) DeepCopyInto added in v0.15.7 

func (in *Service) DeepCopyInto(out *Service)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Service) DeepEqual added in v0.15.7 

func (in *Service) DeepEqual(other *Service) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type ServiceSelector added in v0.15.7 

type ServiceSelector EndpointSelector

ServiceSelector is a label selector for k8s services

func (*ServiceSelector) DeepCopy added in v0.15.7 

func (in *ServiceSelector) DeepCopy() *ServiceSelector

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceSelector.

func (*ServiceSelector) DeepCopyInto added in v0.15.7 

func (in *ServiceSelector) DeepCopyInto(out *ServiceSelector)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ServiceSelector) DeepEqual added in v0.15.7 

func (in *ServiceSelector) DeepEqual(other *ServiceSelector) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type TLSContext added in v0.15.7 

type TLSContext struct {
	// Secret is the secret that contains the certificates and private key for the TLS context.
	// By default, Cilium will search in this secret for the following items:
	//  - 'ca.crt' - Which represents the trusted CA to verify remote source.
	//  - 'tls.crt' - Which represents the public key certificate.
	//  - 'tls.key' - Which represents the private key matching the public key certificate.
	Secret *Secret `json:"secret,omitempty"`

	// TrustedCA is the file name or k8s secret item name for the trusted CA.
	// If omitted, 'ca.crt' is assumed, if it exists.
	// If given, the item must exist.
	TrustedCA string `json:"trustedCA,omitempty"`

	// Certificate is the file name or k8s secret item name for the certificate chain.
	// If omitted, 'tls.crt' is assumed, if it exists.
	// If given, the item must exist.
	Certificate string `json:"certificate,omitempty"`

	// PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain.
	// If omitted, 'tls.key' is assumed, if it exists.
	// If given, the item must exist.
	PrivateKey string `json:"privateKey,omitempty"`
}

TLSContext provides TLS configuration via reference to either k8s secrets or via filepath. If both are set, directory is given priority over k8sSecrets.

func (*TLSContext) DeepCopy added in v0.15.7 

func (in *TLSContext) DeepCopy() *TLSContext

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSContext.

func (*TLSContext) DeepCopyInto added in v0.15.7 

func (in *TLSContext) DeepCopyInto(out *TLSContext)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*TLSContext) DeepEqual added in v0.15.7 

func (in *TLSContext) DeepEqual(other *TLSContext) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

type ToGroups added in v0.15.7 

type ToGroups struct {
	AWS *AWSGroup `json:"aws,omitempty"`
}

ToGroups structure to store all kinds of new integrations that needs a new derivative policy.

func (*ToGroups) DeepCopy added in v0.15.7 

func (in *ToGroups) DeepCopy() *ToGroups

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ToGroups.

func (*ToGroups) DeepCopyInto added in v0.15.7 

func (in *ToGroups) DeepCopyInto(out *ToGroups)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ToGroups) DeepEqual added in v0.15.7 

func (in *ToGroups) DeepEqual(other *ToGroups) bool

DeepEqual is an autogenerated deepequal function, deeply comparing the receiver with other. in must be non-nil.

func (*ToGroups) GetCidrSet added in v0.15.7 

func (group *ToGroups) GetCidrSet(ctx context.Context) ([]CIDRRule, error)

GetCidrSet will return the CIDRRule for the rule using the callbacks that are register in the platform.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.