Documentation ¶
Index ¶
- Constants
- Variables
- type CompletedRule
- type Controller
- func (c *Controller) GetAddressGroupNum() int
- func (c *Controller) GetAddressGroups() []v1beta2.AddressGroup
- func (c *Controller) GetAppliedNetworkPolicies(pod, namespace string, npFilter *querier.NetworkPolicyQueryFilter) []v1beta2.NetworkPolicy
- func (c *Controller) GetAppliedToGroupNum() int
- func (c *Controller) GetAppliedToGroups() []v1beta2.AppliedToGroup
- func (c *Controller) GetControllerConnectionStatus() bool
- func (c *Controller) GetNetworkPolicies(npFilter *querier.NetworkPolicyQueryFilter) []v1beta2.NetworkPolicy
- func (c *Controller) GetNetworkPolicyByRuleFlowID(ruleFlowID uint32) *v1beta2.NetworkPolicyReference
- func (c *Controller) GetNetworkPolicyNum() int
- func (c *Controller) GetRuleByFlowID(ruleFlowID uint32) *types.PolicyRule
- func (c *Controller) HandlePacketIn(pktIn *ofctrl.PacketIn) error
- func (c *Controller) Run(stopCh <-chan struct{})
- type PriorityUpdate
- type Reconciler
- type StatusController
- type StatusManager
Constants ¶
const ( IPv4HdrLen uint16 = 20 IPv6HdrLen uint16 = 40 ICMPUnusedHdrLen uint16 = 4 TCPAck uint8 = 0b010000 TCPRst uint8 = 0b000100 ICMPDstUnreachableType uint8 = 3 ICMPDstHostAdminProhibitedCode uint8 = 10 ICMPv6DstUnreachableType uint8 = 1 ICMPv6DstAdminProhibitedCode uint8 = 1 )
const ( MaxUint16 = ^uint16(0) DefaultTierPriority = int32(250) BaselinePolicyBottomPriority = uint16(10) BaselinePolicyTopPriority = uint16(180) PolicyBottomPriority = uint16(100) PolicyTopPriority = uint16(65000) PriorityOffsetBaselineTier = float64(10) TierOffsetBaselineTier = uint16(0) PriorityOffsetMultiTier = float64(20) PriorityOffsetDefaultTier = float64(100) TierOffsetMultiTier = uint16(200) )
const (
RuleIDLength = 16
)
Variables ¶
var (
AntreaPolicyLogger *log.Logger
)
Functions ¶
This section is empty.
Types ¶
type CompletedRule ¶
type CompletedRule struct { // Source GroupMembers of this rule, can't coexist with ToAddresses. FromAddresses v1beta.GroupMemberSet // Destination GroupMembers of this rule, can't coexist with FromAddresses. ToAddresses v1beta.GroupMemberSet // Target GroupMembers of this rule. TargetMembers v1beta.GroupMemberSet // contains filtered or unexported fields }
CompletedRule contains IPAddresses and Pods flattened from AddressGroups and AppliedToGroups. It's the struct used by reconciler.
func (*CompletedRule) String ¶ added in v0.2.0
func (r *CompletedRule) String() string
String returns the string representation of the CompletedRule.
type Controller ¶
type Controller struct {
// contains filtered or unexported fields
}
Controller is responsible for watching Antrea AddressGroups, AppliedToGroups, and NetworkPolicies, feeding them to ruleCache, getting dirty rules from ruleCache, invoking reconciler to reconcile them.
a.Feed AddressGroups,AppliedToGroups and NetworkPolicies |-----------| <-------- |----------- | c. Reconcile dirty rules |----------- | | ruleCache | | Controller | ------------> | reconciler | | ----------| --------> |----------- | |----------- | b. Notify dirty rules
func NewNetworkPolicyController ¶
func NewNetworkPolicyController(antreaClientGetter agent.AntreaClientProvider, ofClient openflow.Client, ifaceStore interfacestore.InterfaceStore, nodeName string, entityUpdates <-chan types.EntityReference, antreaPolicyEnabled bool, statusManagerEnabled bool, loggingEnabled bool, asyncRuleDeleteInterval time.Duration) (*Controller, error)
NewNetworkPolicyController returns a new *Controller.
func (*Controller) GetAddressGroupNum ¶ added in v0.3.0
func (c *Controller) GetAddressGroupNum() int
func (*Controller) GetAddressGroups ¶ added in v0.5.0
func (c *Controller) GetAddressGroups() []v1beta2.AddressGroup
func (*Controller) GetAppliedNetworkPolicies ¶ added in v0.6.0
func (c *Controller) GetAppliedNetworkPolicies(pod, namespace string, npFilter *querier.NetworkPolicyQueryFilter) []v1beta2.NetworkPolicy
GetAppliedToNetworkPolicies returns the NetworkPolicies applied to the Pod and match the filter.
func (*Controller) GetAppliedToGroupNum ¶ added in v0.3.0
func (c *Controller) GetAppliedToGroupNum() int
func (*Controller) GetAppliedToGroups ¶ added in v0.5.0
func (c *Controller) GetAppliedToGroups() []v1beta2.AppliedToGroup
func (*Controller) GetControllerConnectionStatus ¶ added in v0.3.0
func (c *Controller) GetControllerConnectionStatus() bool
func (*Controller) GetNetworkPolicies ¶ added in v0.5.0
func (c *Controller) GetNetworkPolicies(npFilter *querier.NetworkPolicyQueryFilter) []v1beta2.NetworkPolicy
GetNetworkPolicies returns the requested NetworkPolicies. This func will return all NetworkPolicies that can match all provided attributes in NetworkPolicyQueryFilter. These not provided attributes in NetworkPolicyQueryFilter means match all.
func (*Controller) GetNetworkPolicyByRuleFlowID ¶ added in v0.11.0
func (c *Controller) GetNetworkPolicyByRuleFlowID(ruleFlowID uint32) *v1beta2.NetworkPolicyReference
func (*Controller) GetNetworkPolicyNum ¶ added in v0.3.0
func (c *Controller) GetNetworkPolicyNum() int
func (*Controller) GetRuleByFlowID ¶ added in v1.0.0
func (c *Controller) GetRuleByFlowID(ruleFlowID uint32) *types.PolicyRule
func (*Controller) HandlePacketIn ¶ added in v0.11.0
func (c *Controller) HandlePacketIn(pktIn *ofctrl.PacketIn) error
HandlePacketIn is the packetin handler registered to openflow by Antrea network policy agent controller. It performs the appropriate operations based on which bits are set in the "custom reasons" field of the packet received from OVS.
func (*Controller) Run ¶
func (c *Controller) Run(stopCh <-chan struct{})
Run begins watching and processing Antrea AddressGroups, AppliedToGroups and NetworkPolicies, and spawns workers that reconciles NetworkPolicy rules. Run will not return until stopCh is closed.
type PriorityUpdate ¶ added in v0.11.0
PriorityUpdate stores the original and updated ofPriority of a Priority.
type Reconciler ¶
type Reconciler interface { // Reconcile reconciles the desired state of the provided CompletedRule // with the actual state of Openflow entries. Reconcile(rule *CompletedRule) error // BatchReconcile reconciles the desired state of the provided CompletedRules // with the actual state of Openflow entries in batch. It should only be invoked // if all rules are newly added without last realized status. BatchReconcile(rules []*CompletedRule) error // Forget cleanups the actual state of Openflow entries of the specified ruleID. Forget(ruleID string) error // GetRuleByFlowID returns the rule from the async rule cache in idAllocator cache. GetRuleByFlowID(ruleID uint32) (*types.PolicyRule, bool, error) // RunIDAllocatorWorker runs the worker that deletes the rules from the cache // in idAllocator. RunIDAllocatorWorker(stopCh <-chan struct{}) }
Reconciler is an interface that knows how to reconcile the desired state of CompletedRule with the actual state of Openflow entries.
type StatusController ¶ added in v0.11.0
type StatusController struct {
// contains filtered or unexported fields
}
StatusController implements StatusManager.
func (*StatusController) DeleteRuleRealization ¶ added in v0.11.0
func (c *StatusController) DeleteRuleRealization(ruleID string)
func (*StatusController) Resync ¶ added in v0.11.0
func (c *StatusController) Resync(policyID types.UID)
func (*StatusController) Run ¶ added in v0.11.0
func (c *StatusController) Run(stopCh <-chan struct{})
func (*StatusController) SetRuleRealization ¶ added in v0.11.0
func (c *StatusController) SetRuleRealization(ruleID string, policyID types.UID)
type StatusManager ¶ added in v0.11.0
type StatusManager interface { // SetRuleRealization updates the actual status for the given NetworkPolicy rule. SetRuleRealization(ruleID string, policyID types.UID) // DeleteRuleRealization deletes the actual status for the given NetworkPolicy rule. DeleteRuleRealization(ruleID string) // Resync triggers syncing status with the antrea-controller for the given NetworkPolicy. Resync(policyID types.UID) // Start the status sync loop. Run(stopCh <-chan struct{}) }
StatusManager keeps track of the realized NetworkPolicy rules. It syncs the status of a NetworkPolicy to the antrea-controller once it is realized. A policy is considered realized when all of its desired rules have been realized and all of its undesired rules have been removed. For each new policy, SetRuleRealization is supposed to be called for each of its desired rules while DeleteRuleRealization is supposed to be called for the removed rules.