iptables

Documentation

Index

• type Deps
• type Renderer
  • func (r *Renderer) Init() error
  • func (r *Renderer) NewTxn(resync bool) renderer.Txn
• type RendererTxn
  • func (rt *RendererTxn) Commit() error
  • func (rt *RendererTxn) Render(pod podmodel.ID, podIP *net.IPNet, ingress []*renderer.ContivRule, ...) renderer.Txn

Types

type Deps

type Deps struct {
	Log        logging.Logger
	LogFactory logging.LoggerFactory /* optional */
	PodManager podmanager.API
	IPNet      ipnet.API
	IPAM       ipam.API
	UpdateTxn  func() (txn controller.UpdateOperations)
	ResyncTxn  func() (txn controller.ResyncOperations)
}

Deps lists dependencies of Renderer.

type Renderer

type Renderer struct {
	Deps
	// contains filtered or unexported fields
}

Renderer renders Contiv Rules into iptables rules. The configuration changes are transported into iptables plugin via localclient.

func (*Renderer) Init

func (r *Renderer) Init() error

Init initializes the ACL Renderer.

func (*Renderer) NewTxn

func (r *Renderer) NewTxn(resync bool) renderer.Txn

NewTxn starts a new transaction. The rendering executes only after Commit() is called. Rollback is not yet supported however. If <resync> is enabled, the supplied configuration will completely replace the existing one. Otherwise, the change is performed incrementally, i.e. interfaces not mentioned in the transaction are left unaffected.

type RendererTxn

type RendererTxn struct {
	Log logging.Logger
	// contains filtered or unexported fields
}

RendererTxn represents a single transaction of Renderer.

func (*RendererTxn) Commit

func (rt *RendererTxn) Commit() error

Commit is currently NOOP since the config was added into the event transaction in render phase, it will be committed as a part of the event transaction.

func (*RendererTxn) Render

func (rt *RendererTxn) Render(pod podmodel.ID, podIP *net.IPNet, ingress []*renderer.ContivRule, egress []*renderer.ContivRule, removed bool) renderer.Txn

Render applies the set of ingress & egress rules for a given pod. The existing rules are replaced. It adds rendered config for iptables into the current transaction.