network

Documentation

Index

• func AgentAllow(ctx context.Context, rt container.Runtime, sidecar, statePath string, ...) error
• func AgentBlock(ctx context.Context, rt container.Runtime, sidecar, statePath string, ...) error
• func AgentReset(ctx context.Context, rt container.Runtime, sidecar, statePath string) error
• func BuildAgentFirewall(ctx context.Context, rt container.Runtime, sidecar string, policy string, ...) error
• func BuildPodFirewall(ctx context.Context, rt container.Runtime, sidecar string, policy string) error
• func InitState(path string) error
• func ListRules(statePath string) error
• func PodAllow(ctx context.Context, rt container.Runtime, sidecar, statePath string, ...) error
• func PodBlock(ctx context.Context, rt container.Runtime, sidecar, statePath string, ...) error
• func PodReset(ctx context.Context, rt container.Runtime, sidecar, statePath string) error
• func SaveState(path string, state *FirewallState) error
• type AllowEntry
  • func ResolveAllowEntries(raw []string) []AllowEntry
• type FirewallEntry
• type FirewallState
  • func LoadState(path string) (*FirewallState, error)

Functions

func AgentAllow

func AgentAllow(ctx context.Context, rt container.Runtime, sidecar, statePath string, targets []string) error

AgentAllow sets hosts to ACCEPT in the agent firewall. Each target is "host[:port]"; port defaults to 443, and port 0 means all ports.

func AgentBlock

func AgentBlock(ctx context.Context, rt container.Runtime, sidecar, statePath string, targets []string) error

AgentBlock sets hosts to REJECT in the agent firewall. Target syntax matches AgentAllow; use "host:0" to block all ports.

func AgentReset

func AgentReset(ctx context.Context, rt container.Runtime, sidecar, statePath string) error

AgentReset clears all dynamic agent rules.

func BuildAgentFirewall

func BuildAgentFirewall(
	ctx context.Context,
	rt container.Runtime,
	sidecar string,
	policy string,
	allow []AllowEntry,
) error

BuildAgentFirewall creates the full agent OUTPUT chain structure via iptables-restore.

deny mode: loopback -> established -> DNS (rate-limited) -> per-entry

TCP port ACCEPT -> private CIDRs REJECT -> AGENT_ALLOW -> terminal REJECT

allow mode: loopback -> established -> AGENT_ALLOW -> private CIDRs REJECT ->

AGENT_BLOCK -> terminal ACCEPT

func BuildPodFirewall

func BuildPodFirewall(ctx context.Context, rt container.Runtime, sidecar string, policy string) error

BuildPodFirewall creates the full pod FORWARD chain structure via iptables-restore. Applied atomically in 2 calls (IPv4 + IPv6).

allow mode: established -> loopback -> POD_ALLOW -> DNS ACCEPT ->

private CIDRs DROP -> POD_BLOCK -> ACCEPT

deny mode: established -> loopback -> DNS ACCEPT -> POD_ALLOW -> DROP.

func InitState

func InitState(path string) error

InitState creates an empty firewall state file if it does not exist.

func ListRules

func ListRules(statePath string) error

ListRules prints dynamic rules from the state file.

func PodAllow

func PodAllow(ctx context.Context, rt container.Runtime, sidecar, statePath string, targets []string) error

PodAllow sets hosts to ACCEPT in the pod firewall. Target syntax matches AgentAllow.

func PodBlock

func PodBlock(ctx context.Context, rt container.Runtime, sidecar, statePath string, targets []string) error

PodBlock sets hosts to DROP in the pod firewall. Target syntax matches AgentAllow; use "host:0" to block all ports.

func PodReset

func PodReset(ctx context.Context, rt container.Runtime, sidecar, statePath string) error

PodReset clears all dynamic pod rules.

func SaveState

func SaveState(path string, state *FirewallState) error

SaveState writes the firewall state file atomically.

Types

type AllowEntry

type AllowEntry struct {
	Target string
	Port   int
}

AllowEntry pairs a resolved allowlist target with its TCP destination port. Target is an IP or CIDR.

func ResolveAllowEntries

func ResolveAllowEntries(raw []string) []AllowEntry

ResolveAllowEntries parses each entry as "host[:port]" and resolves hostnames to IPs in parallel per entry. Literals pass through with their parsed port.

type FirewallEntry

type FirewallEntry struct {
	Host   string   `json:"host"`
	IPs    []string `json:"ips"`
	Port   int      `json:"port"`
	Action string   `json:"action"`
}

FirewallEntry is a single dynamic rule (allow or block) for a host.

type FirewallState

type FirewallState struct {
	Agent []FirewallEntry `json:"agent"`
	Pod   []FirewallEntry `json:"pod"`
}

FirewallState holds all dynamic firewall rules, persisted to disk.

func LoadState

func LoadState(path string) (*FirewallState, error)

LoadState reads the firewall state file. Returns empty state if the file does not exist.