policy

Mar 14, 2023

Changes in this version

+ const LabelAllowAnyEgress

+ const LabelAllowAnyIngress

+ const LabelAllowLocalHostIngress

+ const LabelAllowRemoteHostIngress

+ const LabelKeyPolicyDerivedFrom

+ const LabelVisibilityAnnotation

+ type AddOptions struct

+ Generated bool

+ ProcessingStartTime time.Time

+ Replace bool

+ ReplaceWithLabels labels.LabelArray

+ Source string

+ type AuthType uint8

+ const AuthTypeNone

+ const AuthTypeNull

+ func (a AuthType) String() string

+ func (a AuthType) Uint8() uint8

type CachedSelector

+ IsNone func() bool

type CachedSelectorSlice

+ func (s CachedSelectorSlice) MarshalJSON() ([]byte, error)

+ type DirectionalVisibilityPolicy map[string]*VisibilityMetadata

type Endpoint

+ GetK8sNamespace func() string

+ GetOpLabels func() []string

+ IsHost func() bool

type EndpointPolicy

+ func (p *EndpointPolicy) AllowsIdentity(identity identity.NumericIdentity) (ingress, egress bool)

+ func (p *EndpointPolicy) ConsumeMapChanges() (adds, deletes Keys)

+ type Identities interface

+ GetLabels func(identity.NumericIdentity) labels.LabelArray

type Key

+ func (k Key) PortProtoIsBroader(c Key) bool

+ func (k Key) PortProtoIsEqual(c Key) bool

+ func (k Key) String() string

+ func (owner Key) AddDependent(keys MapState, key Key)

+ type Keys map[Key]struct

type L4Filter

+ Listener string

+ PerSelectorPolicies L7DataMap

+ PortName string

+ func (l4 *L4Filter) CopyL7RulesPerEndpoint() L7DataMap

+ func (l4 *L4Filter) GetIngress() bool

+ func (l4 *L4Filter) GetL7Parser() L7ParserType

+ func (l4 *L4Filter) GetListener() string

+ func (l4 *L4Filter) GetPort() uint16

+ func (l4 *L4Filter) Marshal() string

+ func (l4 *L4Filter) SelectsAllEndpoints() bool

+ func (l4Filter *L4Filter) ToMapState(policyOwner PolicyOwner, direction trafficdirection.TrafficDirection, ...) MapState

type L7DataMap

+ func (l7 L7DataMap) ShallowCopy() L7DataMap

type L7ParserType

+ const ParserTypeCRD

+ const ParserTypeTLS

+ func (a L7ParserType) Merge(b L7ParserType) (L7ParserType, error)

+ type MapChange struct

+ Add bool

+ Key Key

+ Value MapStateEntry

type MapState

+ func (keys MapState) AddVisibilityKeys(e PolicyOwner, redirectPort uint16, visMeta *VisibilityMetadata, adds Keys, ...)

+ func (keys MapState) AllowsL4(policyOwner PolicyOwner, l4 *L4Filter) bool

+ func (keys MapState) DenyPreferredInsert(newKey Key, newEntry MapStateEntry, identities Identities)

+ func (keys MapState) RemoveDependent(owner Key, dependent Key)

+ func (pms MapState) GetDenyIdentities(log *logrus.Logger) (ingIdentities, egIdentities []int64)

+ func (pms MapState) GetIdentities(log *logrus.Logger) (ingIdentities, egIdentities []int64)

type MapStateEntry

+ AuthType AuthType

+ DerivedFromRules labels.LabelArrayList

+ IsDeny bool

+ func NewMapStateEntry(cs MapStateOwner, derivedFrom labels.LabelArrayList, redirect, deny bool, ...) MapStateEntry

+ func (e *MapStateEntry) AddDependent(key Key)

+ func (e *MapStateEntry) DatapathEqual(o *MapStateEntry) bool

+ func (e *MapStateEntry) HasDependent(key Key) bool

+ func (e *MapStateEntry) IsRedirectEntry() bool

+ func (e *MapStateEntry) MergeReferences(entry *MapStateEntry)

+ func (e *MapStateEntry) RemoveDependent(key Key)

+ func (e MapStateEntry) String() string

+ type MapStateOwner interface

+ type PerSelectorPolicy struct

+ Auth *api.Auth

+ CanShortCircuit bool

+ EnvoyHTTPRules *cilium.HttpNetworkPolicyRules

+ IsDeny bool

+ OriginatingTLS *TLSContext

+ ServerNames StringSet

+ TerminatingTLS *TLSContext

+ func (a *PerSelectorPolicy) Equal(b *PerSelectorPolicy) bool

+ func (a *PerSelectorPolicy) GetAuthType() AuthType

+ func (a *PerSelectorPolicy) HasL7Rules() bool

+ func (a *PerSelectorPolicy) IsRedirect() bool

+ type PolicyContext interface

+ GetEnvoyHTTPRules func(l7Rules *api.L7Rules) (*cilium.HttpNetworkPolicyRules, bool)

+ GetNamespace func() string

+ GetSelectorCache func() *SelectorCache

+ GetTLSContext func(tls *api.TLSContext) (ca, public, private string, err error)

+ IsDeny func() bool

+ SetDeny func(newValue bool) (oldValue bool)

type PolicyOwner

+ GetID func() uint64

+ GetNamedPort func(ingress bool, name string, proto uint8) uint16

+ GetNamedPortLocked func(ingress bool, name string, proto uint8) uint16

+ LookupRedirectPortLocked func(ingress bool, protocol string, port uint16) uint16

+ PolicyDebug func(fields logrus.Fields, msg string)

+ type ProxyPolicy interface

+ CopyL7RulesPerEndpoint func() L7DataMap

+ GetIngress func() bool

+ GetL7Parser func() L7ParserType

+ GetListener func() string

+ GetPort func() uint16

type Repository

+ func NewStoppedPolicyRepository(idAllocator cache.IdentityAllocator, idCache cache.IdentityCache, ...) *Repository

+ func (p *Repository) GetEnvoyHTTPRules(l7Rules *api.L7Rules, ns string) (*cilium.HttpNetworkPolicyRules, bool)

+ func (p *Repository) Iterate(f func(rule *api.Rule))

+ func (p *Repository) SetEnvoyRulesFunc(...)

+ func (p *Repository) Start()

type SelectorCache

+ func (sc *SelectorCache) GetLabels(id identity.NumericIdentity) labels.LabelArray

+ type StringSet map[string]struct

+ func NewStringSet(from []string) StringSet

+ func (a StringSet) Equal(b StringSet) bool

+ func (a StringSet) Merge(b StringSet) StringSet

+ type TLSContext struct

+ CertificateChain string

+ PrivateKey string

+ TrustedCA string

+ func (a *TLSContext) Equal(b *TLSContext) bool

+ func (t *TLSContext) MarshalJSON() ([]byte, error)

+ type TLSDirection string

+ const OriginatingTLS

+ const TerminatingTLS

type TranslationResult

+ PrefixesToAdd []netip.Prefix

+ PrefixesToRelease []netip.Prefix

+ type TriggerMetrics struct

+ func (p *TriggerMetrics) PostRun(duration, latency time.Duration, folds int)

+ func (p *TriggerMetrics) QueueEvent(reason string)

+ type Updater struct

+ func NewUpdater(r *Repository, regen regenerator) (*Updater, error)

+ func (u *Updater) TriggerPolicyUpdates(force bool, reason string)

+ type VisibilityMetadata struct

+ Ingress bool

+ L7Metadata L7DataMap

+ Parser L7ParserType

+ Port uint16

+ Proto u8proto.U8proto

+ func (l4 *VisibilityMetadata) GetListener() string

+ func (v *VisibilityMetadata) CopyL7RulesPerEndpoint() L7DataMap

+ func (v *VisibilityMetadata) GetIngress() bool

+ func (v *VisibilityMetadata) GetL7Parser() L7ParserType

+ func (v *VisibilityMetadata) GetPort() uint16

+ type VisibilityPolicy struct

+ Egress DirectionalVisibilityPolicy

+ Error error

+ Ingress DirectionalVisibilityPolicy

+ func NewVisibilityPolicy(anno string) (*VisibilityPolicy, error)

Nov 27, 2019

Changes in this version

type L4Filter

+ func (l4 *L4Filter) IsEnvoyRedirect() bool

+ func (l4 *L4Filter) IsProxylibRedirect() bool

type L4Policy

+ func (l4 *L4Policy) HasEnvoyRedirect() bool

+ func (l4 *L4Policy) HasProxylibRedirect() bool

type L4PolicyMap

+ func (l4 L4PolicyMap) HasEnvoyRedirect() bool

+ func (l4 L4PolicyMap) HasProxylibRedirect() bool

Aug 19, 2019

Changes in this version

+ func ProxyIDFromFilter(endpointID uint16, l4 *L4Filter) string

+ func ProxyIDFromKey(endpointID uint16, key Key) string

+ type CachedSelectionUser interface

+ IdentitySelectionUpdated func(selector CachedSelector, selections, added, deleted []identity.NumericIdentity)

+ type CachedSelector interface

+ GetSelections func() []identity.NumericIdentity

+ IsWildcard func() bool

+ Selects func(nid identity.NumericIdentity) bool

+ String func() string

+ type CachedSelectorSlice []CachedSelector

+ func (s *CachedSelectorSlice) Insert(cs CachedSelector) bool

+ func (s CachedSelectorSlice) Len() int

+ func (s CachedSelectorSlice) Less(i, j int) bool

+ func (s CachedSelectorSlice) SelectsAllEndpoints() bool

+ func (s CachedSelectorSlice) Swap(i, j int)

type EndpointPolicy

+ PolicyMapChanges MapChanges

+ func NewEndpointPolicy(repo *Repository) *EndpointPolicy

+ func (p EndpointPolicy) Attach()

+ func (p EndpointPolicy) Detach()

+ func (p EndpointPolicy) DistillPolicy(policyOwner PolicyOwner) *EndpointPolicy

type EndpointSet

+ func (e *EndpointSet) ForEachGo(wg *sync.WaitGroup, epFunc func(epp Endpoint))

type L4Filter

+ CachedSelectors CachedSelectorSlice

+ func (l4 *L4Filter) IdentitySelectionUpdated(selector CachedSelector, selections, added, deleted []identity.NumericIdentity)

type L4Policy

+ func (l4 *L4Policy) AccumulateMapChanges(adds, deletes []identity.NumericIdentity, port uint16, proto uint8, ...)

+ func (l4 *L4Policy) Attach()

+ func (l4 *L4Policy) Detach(selectorCache *SelectorCache)

type L4PolicyMap

+ func (l4 L4PolicyMap) Attach(l4Policy *L4Policy)

+ func (l4 L4PolicyMap) Detach(selectorCache *SelectorCache)

type L7DataMap

+ func (l7 L7DataMap) GetRelevantRulesForKafka(nid identity.NumericIdentity) []api.PortRuleKafka

+ type MapChanges struct

+ func (mc *MapChanges) AccumulateMapChanges(adds, deletes []identity.NumericIdentity, port uint16, proto uint8, ...)

+ func (mc *MapChanges) ConsumeMapChanges() (adds, deletes MapState)

type MapState

+ func (keys MapState) DetermineAllowLocalhostIngress(l4Policy *L4Policy)

+ type PolicyCache struct

+ func NewPolicyCache(repo *Repository, subscribe bool) *PolicyCache

+ func (cache *PolicyCache) GetSelectorCache() *SelectorCache

+ func (cache *PolicyCache) LocalEndpointIdentityAdded(identity *identityPkg.Identity)

+ func (cache *PolicyCache) LocalEndpointIdentityRemoved(identity *identityPkg.Identity)

+ func (cache *PolicyCache) Lookup(identity *identityPkg.Identity) SelectorPolicy

+ func (cache *PolicyCache) UpdatePolicy(identity *identityPkg.Identity) error

type PolicyOwner

+ GetSecurityIdentity func() *identity.Identity

type Repository

+ func (p *Repository) GetPolicyCache() *PolicyCache

+ func (p *Repository) GetSelectorCache() *SelectorCache

+ func (p *Repository) LocalEndpointIdentityAdded(*identity.Identity)

+ func (p *Repository) LocalEndpointIdentityRemoved(identity *identity.Identity)

type SearchContext

+ func (s *SearchContext) TraceEnabled() bool

+ func (s *SearchContext) WithLogger(log io.Writer) *SearchContext

+ type SelectorCache struct

+ func NewSelectorCache(ids cache.IdentityCache) *SelectorCache

+ func (sc *SelectorCache) AddFQDNSelector(user CachedSelectionUser, fqdnSelec api.FQDNSelector) (cachedSelector CachedSelector, added bool)

+ func (sc *SelectorCache) AddIdentitySelector(user CachedSelectionUser, selector api.EndpointSelector) (cachedSelector CachedSelector, added bool)

+ func (sc *SelectorCache) ChangeUser(selector CachedSelector, from, to CachedSelectionUser)

+ func (sc *SelectorCache) FindCachedIdentitySelector(selector api.EndpointSelector) CachedSelector

+ func (sc *SelectorCache) GetModel() models.SelectorCache

+ func (sc *SelectorCache) RemoveIdentitiesFQDNSelectors(fqdnSels []api.FQDNSelector)

+ func (sc *SelectorCache) RemoveSelector(selector CachedSelector, user CachedSelectionUser)

+ func (sc *SelectorCache) RemoveSelectors(selectors CachedSelectorSlice, user CachedSelectionUser)

+ func (sc *SelectorCache) SetLocalIdentityNotifier(pop identityNotifier)

+ func (sc *SelectorCache) UpdateFQDNSelector(fqdnSelec api.FQDNSelector, identities []identity.NumericIdentity)

+ func (sc *SelectorCache) UpdateIdentities(added, deleted cache.IdentityCache)

+ type SelectorPolicy interface

+ Consume func(owner PolicyOwner) *EndpointPolicy

May 9, 2019

Changes in this version

type Endpoint

+ RLockAlive func() error

+ RUnlock func()

Apr 26, 2019

Changes in this version

+ func GetCIDRPrefixes(rules api.Rules) []*net.IPNet

+ func GetDefaultPrefixLengths() (s6 []int, s4 []int)

+ func GetPolicyEnabled() string

+ func GetPrefixesFromCIDRSet(rules api.CIDRRuleSlice) []*net.IPNet

+ func ParseProxyID(proxyID string) (endpointID uint16, ingress bool, protocol string, port uint16, err error)

+ func ProxyID(endpointID uint16, ingress bool, protocol string, port uint16) string

+ func SetPolicyEnabled(val string)

+ type CIDRPolicy struct

+ Egress CIDRPolicyMap

+ Ingress CIDRPolicyMap

+ func NewCIDRPolicy() (policy *CIDRPolicy)

+ func (cp *CIDRPolicy) GetModel() *models.CIDRPolicy

+ func (cp *CIDRPolicy) ToBPFData() (s6, s4 []int)

+ func (cp *CIDRPolicy) Validate() error

+ type CIDRPolicyMap struct

+ IPv4PrefixCount map[int]int

+ IPv6PrefixCount map[int]int

+ Map map[string]*CIDRPolicyMapRule

+ func (m *CIDRPolicyMap) Insert(cidr string, ruleLabels labels.LabelArray) int

+ type CIDRPolicyMapRule struct

+ DerivedFromRules labels.LabelArrayList

+ Prefix net.IPNet

+ type Endpoint interface

+ GetID16 func() uint16

+ GetSecurityIdentity func() *identity.Identity

+ PolicyRevisionBumpEvent func(rev uint64)

+ type EndpointPolicy struct

+ CIDRPolicy *CIDRPolicy

+ DeniedEgressIdentities cache.IdentityCache

+ DeniedIngressIdentities cache.IdentityCache

+ EgressPolicyEnabled bool

+ ID uint16

+ IngressPolicyEnabled bool

+ L4Policy *L4Policy

+ PolicyMapState MapState

+ PolicyOwner PolicyOwner

+ func (p *EndpointPolicy) Realizes(desired *EndpointPolicy)

+ type EndpointSet struct

+ func NewEndpointSet(capacity int) *EndpointSet

+ func (e *EndpointSet) Delete(ep Endpoint)

+ func (e *EndpointSet) ForEach(wg *sync.WaitGroup, epFunc func(epp Endpoint))

+ func (e *EndpointSet) Insert(ep Endpoint)

+ func (e *EndpointSet) Len() int

+ type IDSet struct

+ IDs map[uint16]struct{}

+ Mutex lock.RWMutex

+ func NewIDSet() *IDSet

+ type Key struct

+ DestPort uint16

+ Identity uint32

+ Nexthdr uint8

+ TrafficDirection uint8

+ func (k Key) IsEgress() bool

+ func (k Key) IsIngress() bool

type L4Filter

+ DerivedFromRules labels.LabelArrayList

+ Endpoints api.EndpointSelectorSlice

+ L7RulesPerEp L7DataMap

+ U8Proto u8proto.U8proto

+ func CreateL4EgressFilter(toEndpoints api.EndpointSelectorSlice, rule api.PortRule, ...) L4Filter

+ func CreateL4IngressFilter(fromEndpoints api.EndpointSelectorSlice, ...) L4Filter

+ func (l4 *L4Filter) AllowsAllAtL3() bool

+ func (l4 *L4Filter) HasL3DependentL7Rules() bool

+ func (l4 *L4Filter) ToKeys(direction trafficdirection.TrafficDirection, identityCache cache.IdentityCache, ...) []Key

type L4Policy

+ Revision uint64

type L4PolicyMap

+ func (l4 *L4PolicyMap) EgressCoversContext(ctx *SearchContext) api.Decision

+ func (l4 *L4PolicyMap) IngressCoversContext(ctx *SearchContext) api.Decision

+ type L7DataMap map[api.EndpointSelector]api.L7Rules

+ func (l7 L7DataMap) GetRelevantRules(identity *identity.Identity) api.L7Rules

+ func (l7 L7DataMap) MarshalJSON() ([]byte, error)

+ type L7ParserType string

+ const ParserTypeDNS

+ const ParserTypeHTTP

+ const ParserTypeKafka

+ const ParserTypeNone

+ func (l7 L7ParserType) String() string

+ type MapState map[Key]MapStateEntry

+ func (keys MapState) AllowAllIdentities(identityCache cache.IdentityCache, direction trafficdirection.TrafficDirection)

+ func (keys MapState) DetermineAllowLocalhost(l4Policy *L4Policy)

+ type MapStateEntry struct

+ ProxyPort uint16

+ type PolicyOwner interface

+ LookupRedirectPort func(l4 *L4Filter) uint16

type Repository

+ RepositoryChangeQueue *eventqueue.EventQueue

+ RuleReactionQueue *eventqueue.EventQueue

+ func (p *Repository) AllowsEgressLabelAccess(egressCtx *SearchContext) api.Decision

+ func (p *Repository) AllowsEgressRLocked(egressCtx *SearchContext) api.Decision

+ func (p *Repository) AllowsIngressLabelAccess(ctx *SearchContext) api.Decision

+ func (p *Repository) AllowsIngressRLocked(ctx *SearchContext) api.Decision

+ func (p *Repository) BumpRevision()

+ func (p *Repository) CanReachEgressRLocked(egressCtx *SearchContext) api.Decision

+ func (p *Repository) CanReachIngressRLocked(ctx *SearchContext) api.Decision

+ func (p *Repository) ContainsAllRLocked(needed labels.LabelArrayList) bool

+ func (p *Repository) Empty() bool

+ func (p *Repository) GetRulesList() *models.Policy

+ func (p *Repository) RemoveEndpointIDFromRuleCaches(endpointID uint16) *sync.WaitGroup

+ func (p *Repository) ResolveCIDRPolicy(ctx *SearchContext) *CIDRPolicy

+ func (p *Repository) ResolveL4EgressPolicy(ctx *SearchContext) (*L4PolicyMap, error)

+ func (p *Repository) ResolveL4IngressPolicy(ctx *SearchContext) (*L4PolicyMap, error)

+ func (p *Repository) ResolvePolicy(id uint16, securityIdentity *identity.Identity, policyOwner PolicyOwner, ...) (*EndpointPolicy, error)

+ func (p *Repository) TranslateRules(translator Translator) (*TranslationResult, error)

+ func (p *Repository) UpdateLocalConsumers(eps []Endpoint) *sync.WaitGroup

+ type TranslationResult struct

+ NumToServicesRules int

+ type Translator interface

+ Translate func(*api.Rule, *TranslationResult) error

Jul 21, 2017

Changes in this version

+ func ConsumablesInANotInB(a, b map[NumericIdentity][]NumericIdentity) map[NumericIdentity][]NumericIdentity

type Consumable

+ LabelArray labels.LabelArray

type ConsumableCache

+ func (c *ConsumableCache) GetConsumables() map[NumericIdentity][]NumericIdentity

+ type L3Policy struct

+ Egress L3PolicyMap

+ Ingress L3PolicyMap

+ func NewL3Policy() *L3Policy

+ func (l3 *L3Policy) DeepCopy() *L3Policy

+ type L3PolicyMap struct

+ IPv4Changed bool

+ IPv4Count int

+ IPv6Changed bool

+ IPv6Count int

+ Map map[string]net.IPNet

+ func (m *L3PolicyMap) Insert(cidr string) int

+ func (m *L3PolicyMap) PopulateBPF(cidrmap *cidrmap.CIDRMap) error

+ func (m *L3PolicyMap) ToBPFData() (s6, s4 []string)

+ func (m L3PolicyMap) DeepCopy() L3PolicyMap

type L4Filter

+ Ingress bool

type Repository

+ func (p *Repository) GetRevision() uint64

+ func (p *Repository) ResolveL3Policy(ctx *SearchContext) *L3Policy

May 30, 2017

Changes in this version

+ func JSONMarshalRules(rules api.Rules) string

type Consumable

+ Mutex sync.RWMutex

+ func (c *Consumable) AllowConsumerAndReverseLocked(cache *ConsumableCache, id NumericIdentity)

+ func (c *Consumable) AllowConsumerLocked(cache *ConsumableCache, id NumericIdentity)

+ func (c *Consumable) BanConsumerLocked(id NumericIdentity)

type ConsumableCache

+ func (c *ConsumableCache) GetIteration() int

+ func (c *ConsumableCache) GetReservedIDs() []NumericIdentity

+ func (c *ConsumableCache) IncrementIteration()

type L4Filter

+ func CreateL4Filter(rule api.PortRule, port api.PortProtocol, protocol string) L4Filter

+ func (l4 *L4Filter) MarshalIndent() string

type L4Policy

+ func (l4 *L4Policy) EgressCoversDPorts(dPorts []*models.Port) api.Decision

+ func (l4 *L4Policy) IngressCoversDPorts(dPorts []*models.Port) api.Decision

+ type Repository struct

+ Mutex sync.RWMutex

+ func NewPolicyRepository() *Repository

+ func (p *Repository) Add(r api.Rule) error

+ func (p *Repository) AddList(rules api.Rules) error

+ func (p *Repository) AddListLocked(rules api.Rules) error

+ func (p *Repository) AllowsRLocked(ctx *SearchContext) api.Decision

+ func (p *Repository) CanReachRLocked(ctx *SearchContext) api.Decision

+ func (p *Repository) DeleteByLabels(labels labels.LabelArray) int

+ func (p *Repository) DeleteByLabelsLocked(labels labels.LabelArray) int

+ func (p *Repository) GetJSON() string

+ func (p *Repository) GetRulesMatching(labels labels.LabelArray) bool

+ func (p *Repository) NumRules() int

+ func (p *Repository) ResolveL4Policy(ctx *SearchContext) *L4Policy

+ func (p *Repository) SearchRLocked(labels labels.LabelArray) api.Rules

type SearchContext

+ DPorts []*models.Port

+ EgressL4Only bool

+ IngressL4Only bool

+ func (s *SearchContext) PolicyTrace(format string, a ...interface{})

+ func (s *SearchContext) PolicyTraceVerbose(format string, a ...interface{})

Apr 6, 2017

Changes in this version

type L4Filter

+ L7Parser string

+ L7RedirectPort int

+ L7Rules []AuxRule

Mar 28, 2017

Changes in this version

+ const InvalidIdentity

+ const MinimalNumericIdentity

+ const NodePathDelimiter

+ const RootNodeName

+ const RootPrefix

+ var CoverageSHASize = len(fmt.Sprintf("%x", sha512.New512_256().Sum(nil)))

+ var ReservedIdentities = map[string]NumericIdentity

+ var ReservedIdentityNames = map[NumericIdentity]string

+ func JoinPath(a, b string) string

+ func SplitNodePath(fullPath string) (string, string)

+ type AllowL4 struct

+ Egress []L4Filter

+ Ingress []L4Filter

+ func (l4 *AllowL4) Merge(result *L4Policy)

+ type AllowRule struct

+ Action ConsumableDecision

+ Label labels.Label

+ func (a *AllowRule) Allows(ctx *SearchContext) ConsumableDecision

+ func (a *AllowRule) IsMergeable() bool

+ func (a *AllowRule) String() string

+ func (a *AllowRule) UnmarshalJSON(data []byte) error

+ type AuxRule struct

+ Expr string

+ type Consumable struct

+ Consumers map[string]*Consumer

+ ID NumericIdentity

+ Iteration int

+ L4Policy *L4Policy

+ LabelList []labels.Label

+ Labels *Identity

+ Maps map[int]*policymap.PolicyMap

+ ReverseRules map[NumericIdentity]*Consumer

+ func NewConsumable(id NumericIdentity, lbls *Identity, cache *ConsumableCache) *Consumable

+ func (c *Consumable) AddMap(m *policymap.PolicyMap)

+ func (c *Consumable) AllowConsumer(cache *ConsumableCache, id NumericIdentity) *Consumer

+ func (c *Consumable) AllowConsumerAndReverse(cache *ConsumableCache, id NumericIdentity)

+ func (c *Consumable) Allows(id NumericIdentity) bool

+ func (c *Consumable) BanConsumer(id NumericIdentity)

+ func (c *Consumable) DeepCopy() *Consumable

+ func (c *Consumable) Delete()

+ func (c *Consumable) GetConsumer(id NumericIdentity) *Consumer

+ func (c *Consumable) GetModel() *models.EndpointPolicy

+ func (c *Consumable) RemoveMap(m *policymap.PolicyMap)

+ type ConsumableCache struct

+ Iteration int

+ Reserved []*Consumable

+ func NewConsumableCache() *ConsumableCache

+ func (c *ConsumableCache) AddReserved(elem *Consumable)

+ func (c *ConsumableCache) GetOrCreate(id NumericIdentity, lbls *Identity) *Consumable

+ func (c *ConsumableCache) Lookup(id NumericIdentity) *Consumable

+ func (c *ConsumableCache) Remove(elem *Consumable)

+ type ConsumableDecision byte

+ const ACCEPT

+ const ALWAYS_ACCEPT

+ const DENY

+ const UNDECIDED

+ func (d *ConsumableDecision) UnmarshalJSON(b []byte) error

+ func (d ConsumableDecision) MarshalJSON() ([]byte, error)

+ func (d ConsumableDecision) String() string

+ type Consumer struct

+ Decision ConsumableDecision

+ DeletionMark bool

+ ID NumericIdentity

+ Reverse *Consumer

+ func NewConsumer(id NumericIdentity) *Consumer

+ func (c *Consumer) DeepCopy() *Consumer

+ func (c *Consumer) StringID() string

+ type Identity struct

+ Endpoints map[string]time.Time

+ ID NumericIdentity

+ Labels labels.Labels

+ func NewIdentity() *Identity

+ func NewIdentityFromModel(base *models.Identity) *Identity

+ func (id *Identity) AssociateEndpoint(epID string)

+ func (id *Identity) DeepCopy() *Identity

+ func (id *Identity) DisassociateEndpoint(epID string) bool

+ func (id *Identity) GetModel() *models.Identity

+ func (id *Identity) RefCount() int

+ type L4Filter struct

+ Port int

+ Protocol string

+ Redirect string

+ RedirectPort int

+ Rules []AuxRule

+ func (l4 *L4Filter) IsRedirect() bool

+ func (l4 *L4Filter) Merge(result *L4Policy, m map[string]L4Filter, proto string)

+ func (l4 *L4Filter) String() string

+ func (l4 *L4Filter) UnmarshalJSON(data []byte) error

+ type L4Policy struct

+ Egress L4PolicyMap

+ Ingress L4PolicyMap

+ func NewL4Policy() *L4Policy

+ func (l4 *L4Policy) DeepCopy() *L4Policy

+ func (l4 *L4Policy) GetModel() *models.L4Policy

+ func (l4 *L4Policy) HasRedirect() bool

+ func (l4 *L4Policy) RequiresConntrack() bool

+ type L4PolicyMap map[string]L4Filter

+ func (l4 L4PolicyMap) HasRedirect() bool

+ type Node struct

+ Children map[string]*Node

+ Name string

+ Parent *Node

+ Rules []PolicyRule

+ func NewNode(name string, parent *Node) *Node

+ func (n *Node) AddChild(name string, child *Node) (bool, error)

+ func (n *Node) Allows(ctx *SearchContext) ConsumableDecision

+ func (n *Node) CanMerge(obj *Node) error

+ func (n *Node) Covers(ctx *SearchContext) bool

+ func (n *Node) DebugString(level int) string

+ func (n *Node) HasPolicyRule(pr PolicyRule) bool

+ func (n *Node) HasRules() bool

+ func (n *Node) IsMergeable() bool

+ func (n *Node) JSONMarshal() string

+ func (n *Node) Merge(obj *Node) (bool, error)

+ func (n *Node) NormalizeNames(path string) (string, error)

+ func (n *Node) Path() string

+ func (n *Node) ResolveL4Policy(ctx *SearchContext, result *L4Policy) *L4Policy

+ func (n *Node) ResolveName(name string) string

+ func (n *Node) ResolveTree() error

+ func (n *Node) UnmarshalJSON(data []byte) error

+ type NumericIdentity uint32

+ const ID_HOST

+ const ID_UNKNOWN

+ const ID_WORLD

+ func GetReservedID(name string) NumericIdentity

+ func ParseNumericIdentity(id string) (NumericIdentity, error)

+ func (id NumericIdentity) String() string

+ func (id NumericIdentity) StringID() string

+ func (id NumericIdentity) Uint32() uint32

+ type PolicyRule interface

+ CoverageSHA256Sum func() (string, error)

+ IsMergeable func() bool

+ Resolve func(node *Node) error

+ SHA256Sum func() (string, error)

+ type Privilege byte

+ const ALLOW

+ const ALWAYS_ALLOW

+ const L4

+ const REQUIRES

+ func (p *Privilege) UnmarshalJSON(b []byte) error

+ func (p Privilege) MarshalJSON() ([]byte, error)

+ func (p Privilege) String() string

+ type RuleConsumers struct

+ Allow []AllowRule

+ Coverage []labels.Label

+ func (prc *RuleConsumers) Allows(ctx *SearchContext) ConsumableDecision

+ func (prc *RuleConsumers) CoverageSHA256Sum() (string, error)

+ func (prc *RuleConsumers) IsMergeable() bool

+ func (prc *RuleConsumers) Resolve(node *Node) error

+ func (prc *RuleConsumers) SHA256Sum() (string, error)

+ func (prc *RuleConsumers) String() string

+ type RuleL4 struct

+ Allow []AllowL4

+ Coverage []labels.Label

+ func (l4 *RuleL4) CoverageSHA256Sum() (string, error)

+ func (l4 *RuleL4) GetL4Policy(ctx *SearchContext, result *L4Policy) *L4Policy

+ func (l4 *RuleL4) IsMergeable() bool

+ func (l4 *RuleL4) Resolve(node *Node) error

+ func (l4 *RuleL4) SHA256Sum() (string, error)

+ type RuleRequires struct

+ Coverage []labels.Label

+ Requires []labels.Label

+ func (prr *RuleRequires) Allows(ctx *SearchContext) ConsumableDecision

+ func (prr *RuleRequires) CoverageSHA256Sum() (string, error)

+ func (prr *RuleRequires) IsMergeable() bool

+ func (prr *RuleRequires) Resolve(node *Node) error

+ func (prr *RuleRequires) SHA256Sum() (string, error)

+ func (prr *RuleRequires) String() string

+ type SearchContext struct

+ Depth int

+ From []labels.Label

+ Logging *logging.LogBackend

+ To []labels.Label

+ Trace Tracing

+ func (s *SearchContext) CallDepth() string

+ func (s *SearchContext) String() string

+ func (s *SearchContext) TargetCoveredBy(coverage []labels.Label) bool

+ type SearchContextReply struct

+ Decision ConsumableDecision

+ Logging []byte

+ type Tracing int

+ const TRACE_DISABLED

+ const TRACE_ENABLED

+ const TRACE_VERBOSE

+ type Tree struct

+ Mutex sync.RWMutex

+ Root *Node

+ func (t *Tree) Add(parentPath string, node *Node) (bool, error)

+ func (t *Tree) Allows(ctx *SearchContext) ConsumableDecision

+ func (t *Tree) Delete(path string, coverage string) bool

+ func (t *Tree) Lookup(path string) (node, parent *Node)

+ func (t *Tree) ResolveL4Policy(ctx *SearchContext) *L4Policy