proxy

package
v1.15.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 11, 2024 License: Apache-2.0 Imports: 39 Imported by: 25

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var Cell = cell.Module(
	"l7-proxy",
	"L7 Proxy provides support for L7 network policies",

	cell.Provide(func() ProxyConfig { return DefaultProxyConfig }),

	cell.Provide(newProxy),
	cell.Provide(newEnvoyProxyIntegration),
	cell.Provide(newDNSProxyIntegration),
	cell.ProvidePrivate(endpoint.NewEndpointInfoRegistry),
)

Cell provides the L7 Proxy which provides support for L7 network policies. It is manages the different L7 proxies (Envoy, CoreDNS, ...) and the traffic redirection to them.

View Source 
var (
	// DefaultDNSProxy is the global, shared, DNS Proxy singleton.
	DefaultDNSProxy proxy.DNSProxier
)
View Source 
var DefaultProxyConfig = ProxyConfig{
	MinPort: 10000,
	MaxPort: 20000,

	DNSProxyPort: 0,
}

Functions

func OpenLocalPorts added in v0.15.7 

func OpenLocalPorts() map[uint16]struct{}

OpenLocalPorts returns the set of L4 ports currently open locally.

Types

type CRDRedirect added in v0.15.7 

type CRDRedirect struct{}

Redirect type for custom Listeners, which are managed externally.

func (*CRDRedirect) Close added in v0.15.7 

func (r *CRDRedirect) Close(wg *completion.WaitGroup) (revert.FinalizeFunc, revert.RevertFunc)

func (*CRDRedirect) UpdateRules added in v0.15.7 

func (r *CRDRedirect) UpdateRules(wg *completion.WaitGroup) (revert.RevertFunc, error)

type DatapathUpdater added in v0.15.7 

type DatapathUpdater interface {
	InstallProxyRules(ctx context.Context, proxyPort uint16, ingress, localOnly bool, name string) error
	SupportsOriginalSourceAddr() bool
}

type IPCacheManager added in v0.15.7 

type IPCacheManager interface {
	// AddListener is required for envoy.StartXDSServer()
	AddListener(ipcache.IPIdentityMappingListener)

	LookupByIP(IP string) (ipcache.Identity, bool)
}

type Proxy 

type Proxy struct {
	envoy.XDSServer
	// contains filtered or unexported fields
}

Proxy maintains state about redirects

func (*Proxy) AckProxyPort added in v0.15.7 

func (p *Proxy) AckProxyPort(ctx context.Context, name string) error

AckProxyPort() marks the proxy of the given type as successfully created and creates or updates the datapath rules accordingly.

func (*Proxy) AllocateProxyPort added in v0.15.7 

func (p *Proxy) AllocateProxyPort(name string, ingress, localOnly bool) (uint16, error)

AllocateProxyPort() allocates a new port for listener 'name', or returns the current one if already allocated. Each call has to be paired with AckProxyPort(name) to update the datapath rules accordingly. Each allocated port must be eventually freed with ReleaseProxyPort().

func (*Proxy) ChangeLogLevel added in v0.15.7 

func (p *Proxy) ChangeLogLevel(level logrus.Level)

ChangeLogLevel changes proxy log level to correspond to the logrus log level 'level'.

func (*Proxy) CreateOrUpdateRedirect 

func (p *Proxy) CreateOrUpdateRedirect(
	ctx context.Context, l4 policy.ProxyPolicy, id string, localEndpoint endpoint.EndpointUpdater, wg *completion.WaitGroup,
) (
	uint16, error, revert.FinalizeFunc, revert.RevertFunc,
)

CreateOrUpdateRedirect creates or updates a L4 redirect with corresponding proxy configuration. This will allocate a proxy port as required and launch a proxy instance. If the redirect is already in place, only the rules will be updated. The proxy listening port is returned, but proxy configuration on that port may still be ongoing asynchronously. Caller should wait for successful completion on 'wg' before assuming the returned proxy port is listening. Caller must call exactly one of the returned functions: - finalizeFunc to make the changes stick, or - revertFunc to cancel the changes. Called with 'localEndpoint' locked!

func (*Proxy) GetProxyPort added in v0.15.7 

func (p *Proxy) GetProxyPort(name string) (uint16, error)

GetProxyPort() returns the fixed listen port for a proxy, if any.

func (*Proxy) GetStatusModel added in v0.15.7 

func (p *Proxy) GetStatusModel() *models.ProxyStatus

GetStatusModel returns the proxy status as API model

func (*Proxy) ReinstallIPTablesRules added in v0.15.7 

func (p *Proxy) ReinstallIPTablesRules(ctx context.Context) error

ReinstallIPTablesRules is called by daemon reconfiguration to reinstall proxy ports rules that were removed during the removal of all Cilium rules.

func (*Proxy) ReinstallRoutingRules added in v0.15.7 

func (p *Proxy) ReinstallRoutingRules() error

ReinstallRoutingRules ensures the presence of routing rules and tables needed to route packets to and from the L7 proxy.

func (*Proxy) ReleaseProxyPort added in v0.15.7 

func (p *Proxy) ReleaseProxyPort(name string) error

func (*Proxy) RemoveRedirect 

func (p *Proxy) RemoveRedirect(id string, wg *completion.WaitGroup) (error, revert.FinalizeFunc, revert.RevertFunc)

RemoveRedirect removes an existing redirect that has been successfully created earlier.

func (*Proxy) SetProxyPort added in v0.15.7 

func (p *Proxy) SetProxyPort(name string, proxyType types.ProxyType, port uint16, ingress bool) error

SetProxyPort() marks the proxy 'name' as successfully created with proxy port 'port'. Another call to AckProxyPort(name) is needed to update the datapath rules accordingly. This should only be called for proxies that have a static listener that is already listening on 'port'. May only be called once per proxy.

type ProxyConfig added in v1.15.0 

type ProxyConfig struct {
	MinPort, MaxPort uint16
	DNSProxyPort     uint16
}

type ProxyPort added in v0.15.7 

type ProxyPort struct {
	// contains filtered or unexported fields
}

type Redirect 

type Redirect struct {
	// contains filtered or unexported fields
}

type RedirectImplementation added in v0.15.7 

type RedirectImplementation interface {
	// UpdateRules updates the rules for the given proxy redirect.
	// The implementation should .Add to the WaitGroup if the update is
	// asynchronous and the update should not return until it is complete.
	// The returned RevertFunc must be non-nil.
	// Note: UpdateRules is not called when a redirect is created.
	UpdateRules(wg *completion.WaitGroup) (revert.RevertFunc, error)

	// Close closes and cleans up resources associated with the redirect
	// implementation. The implementation should .Add to the WaitGroup if the
	// update is asynchronous and the update should not return until it is
	// complete.
	Close(wg *completion.WaitGroup) (revert.FinalizeFunc, revert.RevertFunc)
}

RedirectImplementation is the generic proxy redirect interface that each proxy redirect type must implement

Source Files

View all Source files

Directories

Path Synopsis
test
Package logger provides the accesslog logging logic for all proxies
 Package logger provides the accesslog logging logic for all proxies
endpoint

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.