policy

Documentation

Overview

Package policy implements Kubernetes Network policies [1] for Contiv/VPP.

A detailed description of the plugin can be found in the developer's guide for policies [2].

[1]: https://kubernetes.io/docs/concepts/services-networking/network-policies/ [2]: docs/dev-guide/POLICIES.md (from the repo's top directory)

Index

• type Deps
• type Option
  • func UseDeps(cb func(*Deps)) Option
• type Plugin
  • func NewPlugin(opts ...Option) *Plugin
  • func (p *Plugin) AfterInit() error
  • func (p *Plugin) Close() error
  • func (p *Plugin) Init() error

Types

type Deps

type Deps struct {
	infra.PluginDeps
	Resync  resync.Subscriber
	Watcher datasync.KeyValProtoWatcher /* prefixed for KSR-published K8s state data */
	Contiv  contiv.API                  /* for GetIfName() */
	VPP     vpp.API                     /* for DumpACLs() */
	GoVPP   govppmux.API                /* for VPPTCP Renderer */
}

Deps defines dependencies of policy plugin.

type Option

type Option func(*Plugin)

Option is a function that acts on a Plugin to inject Dependencies or configuration

func UseDeps

func UseDeps(cb func(*Deps)) Option

UseDeps returns Option that can inject custom dependencies.

type Plugin

type Plugin struct {
	Deps
	// contains filtered or unexported fields
}

Plugin watches configuration of K8s resources (as reflected by KSR into ETCD) for changes in policies, pods and namespaces and applies rules into extendable set of network stacks.

func NewPlugin

func NewPlugin(opts ...Option) *Plugin

NewPlugin creates a new Plugin with the provides Options

func (*Plugin) AfterInit

func (p *Plugin) AfterInit() error

AfterInit registers to the ResyncOrchestrator. The registration is done in this phase in order to ensure that the resync for this plugin is triggered only after resync of the Contiv plugin has finished.

func (*Plugin) Close

func (p *Plugin) Close() error

Close stops the processor and watching.

func (*Plugin) Init

func (p *Plugin) Init() error

Init initializes policy layers and caches and starts watching ETCD for K8s configuration.