nftables

Documentation

Index

• type Firewall
  • func NewDefaultFirewall(vrfID int64) *Firewall
  • func NewFirewall(nps *firewallv1.ClusterwideNetworkPolicyList, svcs *corev1.ServiceList, ...) *Firewall
  • func (f *Firewall) Flush() error
  • func (f *Firewall) Reconcile() error

Types

type Firewall

type Firewall struct {
	Ingress          []string
	Egress           []string
	RateLimits       []firewallv1.RateLimit
	Ipv4RuleFile     string
	DryRun           bool
	InternalPrefixes string

	PrivateVrfID int64
	// contains filtered or unexported fields
}

Firewall assembles nftable rules based on k8s entities

func NewDefaultFirewall

func NewDefaultFirewall(vrfID int64) *Firewall

NewDefaultFirewall creates a new default nftables firewall.

func NewFirewall

func NewFirewall(nps *firewallv1.ClusterwideNetworkPolicyList, svcs *corev1.ServiceList, spec firewallv1.FirewallSpec, vrfID int64) *Firewall

NewFirewall creates a new nftables firewall object based on k8s entities

func (*Firewall) Flush

func (f *Firewall) Flush() error

Flush flushes the nftables rules that were deduced from a k8s resources after that the firewall is a "plain metal firewall" with default policy accept in the forward chain.

func (*Firewall) Reconcile

func (f *Firewall) Reconcile() error

Reconcile drives the nftables firewall against the desired state by comparison with the current rule file.