destinationrules

Documentation

Index

• Constants
• type DisabledMeshWideMTLSChecker
  • func (c DisabledMeshWideMTLSChecker) Check() ([]*models.IstioCheck, bool)
• type DisabledNamespaceWideMTLSChecker
  • func (m DisabledNamespaceWideMTLSChecker) Check() ([]*models.IstioCheck, bool)
• type MeshWideMTLSChecker
  • func (m MeshWideMTLSChecker) Check() ([]*models.IstioCheck, bool)
• type MultiMatchChecker
  • func (m MultiMatchChecker) Check() models.IstioValidations
• type NamespaceWideMTLSChecker
  • func (m NamespaceWideMTLSChecker) Check() ([]*models.IstioCheck, bool)
• type NoDestinationChecker
  • func (n NoDestinationChecker) Check() ([]*models.IstioCheck, bool)
• type TrafficPolicyChecker
  • func (t TrafficPolicyChecker) Check() models.IstioValidations

Constants

const DestinationRulesCheckerType = "destinationrule"

Types

type DisabledMeshWideMTLSChecker

type DisabledMeshWideMTLSChecker struct {
	DestinationRule *networking_v1.DestinationRule
	MeshPeerAuthns  []*security_v1.PeerAuthentication
}

func (DisabledMeshWideMTLSChecker) Check

func (c DisabledMeshWideMTLSChecker) Check() ([]*models.IstioCheck, bool)

type DisabledNamespaceWideMTLSChecker

type DisabledNamespaceWideMTLSChecker struct {
	DestinationRule *networking_v1.DestinationRule
	MTLSDetails     kubernetes.MTLSDetails
}

func (DisabledNamespaceWideMTLSChecker) Check

func (m DisabledNamespaceWideMTLSChecker) Check() ([]*models.IstioCheck, bool)

Check if a the PeerAuthn is allows non-mtls traffic when DestinationRule explicitly disables mTLS ns-wide

type MeshWideMTLSChecker

type MeshWideMTLSChecker struct {
	DestinationRule *networking_v1.DestinationRule
	MTLSDetails     kubernetes.MTLSDetails
}

func (MeshWideMTLSChecker) Check

func (m MeshWideMTLSChecker) Check() ([]*models.IstioCheck, bool)

type MultiMatchChecker

type MultiMatchChecker struct {
	Cluster          string
	DestinationRules []*networking_v1.DestinationRule
	ServiceEntries   map[string][]string
	Namespaces       models.Namespaces
}

func (MultiMatchChecker) Check

func (m MultiMatchChecker) Check() models.IstioValidations

Check validates that no two destinationRules target the same host+subset combination

type NamespaceWideMTLSChecker

type NamespaceWideMTLSChecker struct {
	DestinationRule *networking_v1.DestinationRule
	MTLSDetails     kubernetes.MTLSDetails
}

func (NamespaceWideMTLSChecker) Check

func (m NamespaceWideMTLSChecker) Check() ([]*models.IstioCheck, bool)

type NoDestinationChecker

type NoDestinationChecker struct {
	Namespaces            models.Namespaces
	WorkloadsPerNamespace map[string]models.WorkloadList
	DestinationRule       *networking_v1.DestinationRule
	VirtualServices       []*networking_v1.VirtualService
	ServiceEntries        []*networking_v1.ServiceEntry
	RegistryServices      []*kubernetes.RegistryService
	PolicyAllowAny        bool
}

func (NoDestinationChecker) Check

func (n NoDestinationChecker) Check() ([]*models.IstioCheck, bool)

Check parses the DestinationRule definitions and verifies that they point to an existing service, including any subset definitions

type TrafficPolicyChecker

type TrafficPolicyChecker struct {
	Cluster          string
	DestinationRules []*networking_v1.DestinationRule
	MTLSDetails      kubernetes.MTLSDetails
}

func (TrafficPolicyChecker) Check

func (t TrafficPolicyChecker) Check() models.IstioValidations