Documentation
¶
Index ¶
Constants ¶
const ( // DefaultFirewallName is the name to use for firewall rules created // by an L7 controller when --firewall-rule is not used. DefaultFirewallName = "" )
Variables ¶
var (
ErrNoILBIngress = errors.New("no ILB Ingress found")
)
Functions ¶
func NewFakeFirewallsProvider ¶
NewFakeFirewallsProvider creates a fake for firewall rules.
Types ¶
type Firewall ¶
type Firewall interface { CreateFirewall(f *compute.Firewall) error GetFirewall(name string) (*compute.Firewall, error) DeleteFirewall(name string) error UpdateFirewall(f *compute.Firewall) error GetNodeTags(nodeNames []string) ([]string, error) NetworkProjectID() string NetworkURL() string // OnXPN returns true if the GCE NetworkProjectID != ProjectID. OnXPN() bool }
Firewall interfaces with the GCE firewall api. This interface is a little different from the rest because it dovetails into the same firewall methods used by the TCPLoadBalancer.
type FirewallController ¶ added in v1.3.0
type FirewallController struct {
// contains filtered or unexported fields
}
FirewallController synchronizes the firewall rule for all ingresses.
func NewFirewallController ¶ added in v1.3.0
func NewFirewallController( ctx *context.ControllerContext, portRanges []string) *FirewallController
NewFirewallController returns a new firewall controller.
func (*FirewallController) Run ¶ added in v1.3.0
func (fwc *FirewallController) Run()
func (*FirewallController) ToSvcPorts ¶ added in v1.3.0
func (fwc *FirewallController) ToSvcPorts(ings []*v1beta1.Ingress) []utils.ServicePort
ToSvcPorts is a helper method over translator.TranslateIngress to process a list of ingresses. TODO(rramkumar): This is a copy of code in controller.go. Extract this into something shared.
type FirewallRules ¶
type FirewallRules struct {
// contains filtered or unexported fields
}
FirewallRules manages firewall rules.
func (*FirewallRules) GC ¶ added in v1.3.0
func (fr *FirewallRules) GC() error
GC deletes the firewall rule.
func (*FirewallRules) GetFirewall ¶
func (fr *FirewallRules) GetFirewall(name string) (*compute.Firewall, error)
GetFirewall just returns the firewall object corresponding to the given name. TODO: Currently only used in testing. Modify so we don't leak compute objects out of this interface by returning just the (src, ports, error).
func (*FirewallRules) Sync ¶
func (fr *FirewallRules) Sync(nodeNames, additionalPorts, additionalRanges []string) error
Sync firewall rules with the cloud.
type FirewallXPNError ¶ added in v1.0.1
func (*FirewallXPNError) Error ¶ added in v1.0.1
func (f *FirewallXPNError) Error() string
type SingleFirewallPool ¶
type SingleFirewallPool interface { // Sync syncs firewall rules with the cloud Sync(nodeNames, additionalPorts, additionalRanges []string) error GC() error }
SingleFirewallPool syncs the firewall rule for L7 traffic.
func NewFirewallPool ¶
func NewFirewallPool(cloud Firewall, namer *utils.Namer, l7SrcRanges []string, nodePortRanges []string) SingleFirewallPool
NewFirewallPool creates a new firewall rule manager. cloud: the cloud object implementing Firewall. namer: cluster namer.