iptables

Documentation

Overview

Package iptables manages iptables-related configuration for Cilium.

Index

• func KernelHasNetfilter() bool
• type IptablesManager
  • func (m *IptablesManager) GetProxyPort(name string) uint16
  • func (m *IptablesManager) Init()
  • func (m *IptablesManager) InstallProxyRules(proxyPort uint16, ingress bool, name string) error
  • func (m *IptablesManager) InstallRules(ifName string, firstInitialization, install bool) (err error)
  • func (m *IptablesManager) SupportsOriginalSourceAddr() bool

Functions

func KernelHasNetfilter

func KernelHasNetfilter() bool

KernelHasNetfilter probes whether iptables related modules are present in the kernel and returns true if indeed the case, else false.

Types

type IptablesManager

type IptablesManager struct {
	// contains filtered or unexported fields
}

IptablesManager manages the iptables-related configuration for Cilium.

func (*IptablesManager) GetProxyPort

func (m *IptablesManager) GetProxyPort(name string) uint16

GetProxyPort finds a proxy port used for redirect 'name' installed earlier with InstallProxyRules. By convention "ingress" or "egress" is part of 'name' so it does not need to be specified explicitly. Returns 0 a TPROXY entry with 'name' can not be found.

func (*IptablesManager) Init

func (m *IptablesManager) Init()

Init initializes the iptables manager and checks for iptables kernel modules availability.

func (*IptablesManager) InstallProxyRules

func (m *IptablesManager) InstallProxyRules(proxyPort uint16, ingress bool, name string) error

func (*IptablesManager) InstallRules

func (m *IptablesManager) InstallRules(ifName string, firstInitialization, install bool) (err error)

InstallRules installs iptables rules for Cilium in specific use-cases (most specifically, interaction with kube-proxy).

func (*IptablesManager) SupportsOriginalSourceAddr

func (m *IptablesManager) SupportsOriginalSourceAddr() bool

SupportsOriginalSourceAddr tells if an L7 proxy can use POD's original source address and port in the upstream connection to allow the destination to properly derive the source security ID from the source IP address.