Documentation
¶
Overview ¶
Package workerdv1 holds the workerd manager's control-plane protos: the EgressConfig service the backplane pushes compiled egress config through (APO-723/APO-726) and the DNSConfig service the manager's infra watch pushes the VPC name plane through. Generated code is checked in; regenerate with `go generate ./api/workerd/v1` (needs protoc, protoc-gen-go, protoc-gen-go-grpc on PATH).
Index ¶
- Constants
- Variables
- func RegisterDNSConfigServer(s grpc.ServiceRegistrar, srv DNSConfigServer)
- func RegisterEgressConfigServer(s grpc.ServiceRegistrar, srv EgressConfigServer)
- type ApplyDNSRequest
- func (*ApplyDNSRequest) Descriptor() ([]byte, []int)deprecated
- func (x *ApplyDNSRequest) GetAuthoritativeZones() []string
- func (x *ApplyDNSRequest) GetBindings() []*Binding
- func (x *ApplyDNSRequest) GetGeneration() uint64
- func (x *ApplyDNSRequest) GetSandboxId() string
- func (*ApplyDNSRequest) ProtoMessage()
- func (x *ApplyDNSRequest) ProtoReflect() protoreflect.Message
- func (x *ApplyDNSRequest) Reset()
- func (x *ApplyDNSRequest) String() string
- type ApplyDNSResponse
- func (*ApplyDNSResponse) Descriptor() ([]byte, []int)deprecated
- func (x *ApplyDNSResponse) GetAppliedGeneration() uint64
- func (*ApplyDNSResponse) ProtoMessage()
- func (x *ApplyDNSResponse) ProtoReflect() protoreflect.Message
- func (x *ApplyDNSResponse) Reset()
- func (x *ApplyDNSResponse) String() string
- type ApplyEgressRequest
- func (*ApplyEgressRequest) Descriptor() ([]byte, []int)deprecated
- func (x *ApplyEgressRequest) GetGeneration() uint64
- func (x *ApplyEgressRequest) GetInvocationId() string
- func (x *ApplyEgressRequest) GetSandboxId() string
- func (x *ApplyEgressRequest) GetServices() []*ServiceEgressConfig
- func (*ApplyEgressRequest) ProtoMessage()
- func (x *ApplyEgressRequest) ProtoReflect() protoreflect.Message
- func (x *ApplyEgressRequest) Reset()
- func (x *ApplyEgressRequest) String() string
- type ApplyEgressResponse
- func (*ApplyEgressResponse) Descriptor() ([]byte, []int)deprecated
- func (x *ApplyEgressResponse) GetAppliedGeneration() uint64
- func (*ApplyEgressResponse) ProtoMessage()
- func (x *ApplyEgressResponse) ProtoReflect() protoreflect.Message
- func (x *ApplyEgressResponse) Reset()
- func (x *ApplyEgressResponse) String() string
- type BackendListener
- func (*BackendListener) Descriptor() ([]byte, []int)deprecated
- func (x *BackendListener) GetAddr() string
- func (x *BackendListener) GetMatchPort() int32
- func (x *BackendListener) GetName() string
- func (x *BackendListener) GetPriority() int32
- func (x *BackendListener) GetShape() string
- func (*BackendListener) ProtoMessage()
- func (x *BackendListener) ProtoReflect() protoreflect.Message
- func (x *BackendListener) Reset()
- func (x *BackendListener) String() string
- type Binding
- func (*Binding) Descriptor() ([]byte, []int)deprecated
- func (x *Binding) GetAddrs() []string
- func (x *Binding) GetDelegateSubdomains() bool
- func (x *Binding) GetFqdn() string
- func (x *Binding) GetReachableCidrs() []string
- func (x *Binding) GetTtl() uint32
- func (*Binding) ProtoMessage()
- func (x *Binding) ProtoReflect() protoreflect.Message
- func (x *Binding) Reset()
- func (x *Binding) String() string
- type DNSConfigClient
- type DNSConfigServer
- type EgressConfigClient
- type EgressConfigServer
- type EgressPolicy
- func (*EgressPolicy) Descriptor() ([]byte, []int)deprecated
- func (x *EgressPolicy) GetDefaultDeny() bool
- func (x *EgressPolicy) GetRules() []*EgressRule
- func (*EgressPolicy) ProtoMessage()
- func (x *EgressPolicy) ProtoReflect() protoreflect.Message
- func (x *EgressPolicy) Reset()
- func (x *EgressPolicy) String() string
- type EgressRule
- func (*EgressRule) Descriptor() ([]byte, []int)deprecated
- func (x *EgressRule) GetDestinationCidrs() []string
- func (x *EgressRule) GetDestinationHostnames() []string
- func (x *EgressRule) GetListeners() []string
- func (x *EgressRule) GetPorts() []*PortRange
- func (x *EgressRule) GetProtocol() string
- func (*EgressRule) ProtoMessage()
- func (x *EgressRule) ProtoReflect() protoreflect.Message
- func (x *EgressRule) Reset()
- func (x *EgressRule) String() string
- type PortRange
- type ServiceEgressConfig
- func (*ServiceEgressConfig) Descriptor() ([]byte, []int)deprecated
- func (x *ServiceEgressConfig) GetBackends() []*BackendListener
- func (x *ServiceEgressConfig) GetPolicy() *EgressPolicy
- func (x *ServiceEgressConfig) GetService() string
- func (*ServiceEgressConfig) ProtoMessage()
- func (x *ServiceEgressConfig) ProtoReflect() protoreflect.Message
- func (x *ServiceEgressConfig) Reset()
- func (x *ServiceEgressConfig) String() string
- type UnimplementedDNSConfigServer
- type UnimplementedEgressConfigServer
- type UnsafeDNSConfigServer
- type UnsafeEgressConfigServer
Constants ¶
const (
DNSConfig_ApplyDNS_FullMethodName = "/apoxy.workerd.v1.DNSConfig/ApplyDNS"
)
const (
EgressConfig_ApplyEgress_FullMethodName = "/apoxy.workerd.v1.EgressConfig/ApplyEgress"
)
Variables ¶
var DNSConfig_ServiceDesc = grpc.ServiceDesc{ ServiceName: "apoxy.workerd.v1.DNSConfig", HandlerType: (*DNSConfigServer)(nil), Methods: []grpc.MethodDesc{ { MethodName: "ApplyDNS", Handler: _DNSConfig_ApplyDNS_Handler, }, }, Streams: []grpc.StreamDesc{}, Metadata: "vpcdns.proto", }
DNSConfig_ServiceDesc is the grpc.ServiceDesc for DNSConfig service. It's only intended for direct use with grpc.RegisterService, and not to be introspected or modified (even as a copy)
var EgressConfig_ServiceDesc = grpc.ServiceDesc{ ServiceName: "apoxy.workerd.v1.EgressConfig", HandlerType: (*EgressConfigServer)(nil), Methods: []grpc.MethodDesc{ { MethodName: "ApplyEgress", Handler: _EgressConfig_ApplyEgress_Handler, }, }, Streams: []grpc.StreamDesc{}, Metadata: "egress.proto", }
EgressConfig_ServiceDesc is the grpc.ServiceDesc for EgressConfig service. It's only intended for direct use with grpc.RegisterService, and not to be introspected or modified (even as a copy)
var File_egress_proto protoreflect.FileDescriptor
var File_vpcdns_proto protoreflect.FileDescriptor
Functions ¶
func RegisterDNSConfigServer ¶
func RegisterDNSConfigServer(s grpc.ServiceRegistrar, srv DNSConfigServer)
func RegisterEgressConfigServer ¶
func RegisterEgressConfigServer(s grpc.ServiceRegistrar, srv EgressConfigServer)
Types ¶
type ApplyDNSRequest ¶
type ApplyDNSRequest struct {
// SandboxID identifies the target sandbox. It must belong to the tenant
// whose socket this request arrived on; a foreign id is rejected.
SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
// Generation orders applies: the pusher's monotonically increasing config
// generation. A stale generation is not applied.
Generation uint64 `protobuf:"varint,2,opt,name=generation,proto3" json:"generation,omitempty"`
// AuthoritativeZones get an authoritative NXDOMAIN for unbound names
// within them ("tun.apoxy.net" today); names outside every zone fall
// through to the resolver's upstream chain.
AuthoritativeZones []string `protobuf:"bytes,3,rep,name=authoritative_zones,json=authoritativeZones,proto3" json:"authoritative_zones,omitempty"`
// Bindings is the full desired binding set for the resident; it replaces
// the prior set atomically.
Bindings []*Binding `protobuf:"bytes,4,rep,name=bindings,proto3" json:"bindings,omitempty"`
// contains filtered or unexported fields
}
func (*ApplyDNSRequest) Descriptor
deprecated
func (*ApplyDNSRequest) Descriptor() ([]byte, []int)
Deprecated: Use ApplyDNSRequest.ProtoReflect.Descriptor instead.
func (*ApplyDNSRequest) GetAuthoritativeZones ¶
func (x *ApplyDNSRequest) GetAuthoritativeZones() []string
func (*ApplyDNSRequest) GetBindings ¶
func (x *ApplyDNSRequest) GetBindings() []*Binding
func (*ApplyDNSRequest) GetGeneration ¶
func (x *ApplyDNSRequest) GetGeneration() uint64
func (*ApplyDNSRequest) GetSandboxId ¶
func (x *ApplyDNSRequest) GetSandboxId() string
func (*ApplyDNSRequest) ProtoMessage ¶
func (*ApplyDNSRequest) ProtoMessage()
func (*ApplyDNSRequest) ProtoReflect ¶
func (x *ApplyDNSRequest) ProtoReflect() protoreflect.Message
func (*ApplyDNSRequest) Reset ¶
func (x *ApplyDNSRequest) Reset()
func (*ApplyDNSRequest) String ¶
func (x *ApplyDNSRequest) String() string
type ApplyDNSResponse ¶
type ApplyDNSResponse struct {
// AppliedGeneration is the generation now in effect for the sandbox — the
// request's generation if it was applied, or the newer retained one if the
// request was stale.
AppliedGeneration uint64 `protobuf:"varint,1,opt,name=applied_generation,json=appliedGeneration,proto3" json:"applied_generation,omitempty"`
// contains filtered or unexported fields
}
func (*ApplyDNSResponse) Descriptor
deprecated
func (*ApplyDNSResponse) Descriptor() ([]byte, []int)
Deprecated: Use ApplyDNSResponse.ProtoReflect.Descriptor instead.
func (*ApplyDNSResponse) GetAppliedGeneration ¶
func (x *ApplyDNSResponse) GetAppliedGeneration() uint64
func (*ApplyDNSResponse) ProtoMessage ¶
func (*ApplyDNSResponse) ProtoMessage()
func (*ApplyDNSResponse) ProtoReflect ¶
func (x *ApplyDNSResponse) ProtoReflect() protoreflect.Message
func (*ApplyDNSResponse) Reset ¶
func (x *ApplyDNSResponse) Reset()
func (*ApplyDNSResponse) String ¶
func (x *ApplyDNSResponse) String() string
type ApplyEgressRequest ¶
type ApplyEgressRequest struct {
// SandboxID identifies the target sandbox. It must belong to the tenant
// whose socket this request arrived on; a foreign id is rejected.
SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
// InvocationID is stamped on egress connections (PROXY v2 TLV) dialed
// through this sandbox, for attribution.
InvocationId string `protobuf:"bytes,4,opt,name=invocation_id,json=invocationId,proto3" json:"invocation_id,omitempty"`
// Generation orders applies: the reconciler's monotonically increasing
// config generation. A stale generation is not applied.
Generation uint64 `protobuf:"varint,5,opt,name=generation,proto3" json:"generation,omitempty"`
// Services is the full desired set of per-Service egress planes for the
// resident; it replaces the prior set atomically.
Services []*ServiceEgressConfig `protobuf:"bytes,6,rep,name=services,proto3" json:"services,omitempty"`
// contains filtered or unexported fields
}
func (*ApplyEgressRequest) Descriptor
deprecated
func (*ApplyEgressRequest) Descriptor() ([]byte, []int)
Deprecated: Use ApplyEgressRequest.ProtoReflect.Descriptor instead.
func (*ApplyEgressRequest) GetGeneration ¶
func (x *ApplyEgressRequest) GetGeneration() uint64
func (*ApplyEgressRequest) GetInvocationId ¶
func (x *ApplyEgressRequest) GetInvocationId() string
func (*ApplyEgressRequest) GetSandboxId ¶
func (x *ApplyEgressRequest) GetSandboxId() string
func (*ApplyEgressRequest) GetServices ¶
func (x *ApplyEgressRequest) GetServices() []*ServiceEgressConfig
func (*ApplyEgressRequest) ProtoMessage ¶
func (*ApplyEgressRequest) ProtoMessage()
func (*ApplyEgressRequest) ProtoReflect ¶
func (x *ApplyEgressRequest) ProtoReflect() protoreflect.Message
func (*ApplyEgressRequest) Reset ¶
func (x *ApplyEgressRequest) Reset()
func (*ApplyEgressRequest) String ¶
func (x *ApplyEgressRequest) String() string
type ApplyEgressResponse ¶
type ApplyEgressResponse struct {
// AppliedGeneration is the generation now in effect for the sandbox — the
// request's generation if it was applied, or the newer retained one if the
// request was stale.
AppliedGeneration uint64 `protobuf:"varint,1,opt,name=applied_generation,json=appliedGeneration,proto3" json:"applied_generation,omitempty"`
// contains filtered or unexported fields
}
func (*ApplyEgressResponse) Descriptor
deprecated
func (*ApplyEgressResponse) Descriptor() ([]byte, []int)
Deprecated: Use ApplyEgressResponse.ProtoReflect.Descriptor instead.
func (*ApplyEgressResponse) GetAppliedGeneration ¶
func (x *ApplyEgressResponse) GetAppliedGeneration() uint64
func (*ApplyEgressResponse) ProtoMessage ¶
func (*ApplyEgressResponse) ProtoMessage()
func (*ApplyEgressResponse) ProtoReflect ¶
func (x *ApplyEgressResponse) ProtoReflect() protoreflect.Message
func (*ApplyEgressResponse) Reset ¶
func (x *ApplyEgressResponse) Reset()
func (*ApplyEgressResponse) String ¶
func (x *ApplyEgressResponse) String() string
type BackendListener ¶
type BackendListener struct {
// Name mirrors the EgressListener name from the CRD; used for logs and for
// EgressRoute parentRef.sectionName matching.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// Addr is the host:port the sandbox dials. Empty means "listener exists but
// its data plane isn't ready yet" — the dialer skips it.
Addr string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
// Shape is the on-the-wire protocol selector ("tls-terminate",
// "tls-passthrough", "tcp", "http", "https").
Shape string `protobuf:"bytes,3,opt,name=shape,proto3" json:"shape,omitempty"`
// MatchPort, when non-zero, narrows this listener to the sandbox's
// destination port. Zero = catch-all for this shape.
MatchPort int32 `protobuf:"varint,4,opt,name=match_port,json=matchPort,proto3" json:"match_port,omitempty"`
// Priority is the precomputed shape rank used as a tiebreaker when multiple
// listeners match the same dst port. Higher wins.
Priority int32 `protobuf:"varint,5,opt,name=priority,proto3" json:"priority,omitempty"`
// contains filtered or unexported fields
}
BackendListener mirrors the sandbox.BackendListener seam type: one EgressGateway listener the sandbox may dial.
func (*BackendListener) Descriptor
deprecated
func (*BackendListener) Descriptor() ([]byte, []int)
Deprecated: Use BackendListener.ProtoReflect.Descriptor instead.
func (*BackendListener) GetAddr ¶
func (x *BackendListener) GetAddr() string
func (*BackendListener) GetMatchPort ¶
func (x *BackendListener) GetMatchPort() int32
func (*BackendListener) GetName ¶
func (x *BackendListener) GetName() string
func (*BackendListener) GetPriority ¶
func (x *BackendListener) GetPriority() int32
func (*BackendListener) GetShape ¶
func (x *BackendListener) GetShape() string
func (*BackendListener) ProtoMessage ¶
func (*BackendListener) ProtoMessage()
func (*BackendListener) ProtoReflect ¶
func (x *BackendListener) ProtoReflect() protoreflect.Message
func (*BackendListener) Reset ¶
func (x *BackendListener) Reset()
func (*BackendListener) String ¶
func (x *BackendListener) String() string
type Binding ¶
type Binding struct {
// Fqdn is the name this binding answers for, authoritatively (no trailing
// dot, e.g. "my-tunnel.tun.apoxy.net").
Fqdn string `protobuf:"bytes,1,opt,name=fqdn,proto3" json:"fqdn,omitempty"`
// Addrs are the addresses the name resolves to (answered as A or AAAA by
// address family; VPC overlay ULAs today).
Addrs []string `protobuf:"bytes,2,rep,name=addrs,proto3" json:"addrs,omitempty"`
// DelegateSubdomains forwards sub-names (x.<fqdn>) to a resolver at this
// binding's addrs instead of answering locally. Tunnel endpoints set this
// (recursive tunnel resolution); Services won't.
DelegateSubdomains bool `protobuf:"varint,3,opt,name=delegate_subdomains,json=delegateSubdomains,proto3" json:"delegate_subdomains,omitempty"`
// Ttl for answers in seconds; 0 = resolver default.
Ttl uint32 `protobuf:"varint,4,opt,name=ttl,proto3" json:"ttl,omitempty"`
// ReachableCidrs are carved out of the egress SSRF backstop for this
// binding — explicit rather than derived from addrs, so a binding can
// expose a wider window (a tunnel endpoint's whole /96) or none at all (a
// Service resolving to a public IP contributes no carve-out).
ReachableCidrs []string `protobuf:"bytes,5,rep,name=reachable_cidrs,json=reachableCidrs,proto3" json:"reachable_cidrs,omitempty"`
// contains filtered or unexported fields
}
Binding is one name bound into the project VPC — a tunnel endpoint, a VPC-bound Service, or any future object exposing a name to workers.
func (*Binding) Descriptor
deprecated
func (*Binding) GetDelegateSubdomains ¶
func (*Binding) GetReachableCidrs ¶
func (*Binding) ProtoMessage ¶
func (*Binding) ProtoMessage()
func (*Binding) ProtoReflect ¶
func (x *Binding) ProtoReflect() protoreflect.Message
type DNSConfigClient ¶
type DNSConfigClient interface {
// ApplyDNS installs the resident's full VPC name plane: the bindings the
// project's workers can resolve and reach, plus the zones the resolver is
// authoritative for. The request carries the WHOLE desired state — a
// binding absent from the request is deleted, so the pusher stays
// level-triggered and deletions need no tombstones. Idempotent; a request
// whose generation is older than the last applied one is ignored (the
// response echoes the retained generation).
ApplyDNS(ctx context.Context, in *ApplyDNSRequest, opts ...grpc.CallOption) (*ApplyDNSResponse, error)
}
DNSConfigClient is the client API for DNSConfig service.
For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
DNSConfig applies the VPC name plane to a tenant's resident.
func NewDNSConfigClient ¶
func NewDNSConfigClient(cc grpc.ClientConnInterface) DNSConfigClient
type DNSConfigServer ¶
type DNSConfigServer interface {
// ApplyDNS installs the resident's full VPC name plane: the bindings the
// project's workers can resolve and reach, plus the zones the resolver is
// authoritative for. The request carries the WHOLE desired state — a
// binding absent from the request is deleted, so the pusher stays
// level-triggered and deletions need no tombstones. Idempotent; a request
// whose generation is older than the last applied one is ignored (the
// response echoes the retained generation).
ApplyDNS(context.Context, *ApplyDNSRequest) (*ApplyDNSResponse, error)
// contains filtered or unexported methods
}
DNSConfigServer is the server API for DNSConfig service. All implementations must embed UnimplementedDNSConfigServer for forward compatibility.
DNSConfig applies the VPC name plane to a tenant's resident.
type EgressConfigClient ¶
type EgressConfigClient interface {
// ApplyEgress installs the full egress config for one sandbox: the
// per-Service egress planes (each Service's dialable EgressGateway backend
// listeners and its authorization policy) plus the invocation id stamped on
// egress connections for attribution. The request carries the WHOLE desired
// state for the resident — a Service absent from the request has no egress
// plane (its config is dropped), so the reconciler stays level-triggered
// and deletions need no tombstones. Idempotent; a request whose generation
// is older than the last applied one is ignored (the response echoes the
// retained generation).
ApplyEgress(ctx context.Context, in *ApplyEgressRequest, opts ...grpc.CallOption) (*ApplyEgressResponse, error)
}
EgressConfigClient is the client API for EgressConfig service.
For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
EgressConfig applies compiled egress configuration to a tenant's resident.
func NewEgressConfigClient ¶
func NewEgressConfigClient(cc grpc.ClientConnInterface) EgressConfigClient
type EgressConfigServer ¶
type EgressConfigServer interface {
// ApplyEgress installs the full egress config for one sandbox: the
// per-Service egress planes (each Service's dialable EgressGateway backend
// listeners and its authorization policy) plus the invocation id stamped on
// egress connections for attribution. The request carries the WHOLE desired
// state for the resident — a Service absent from the request has no egress
// plane (its config is dropped), so the reconciler stays level-triggered
// and deletions need no tombstones. Idempotent; a request whose generation
// is older than the last applied one is ignored (the response echoes the
// retained generation).
ApplyEgress(context.Context, *ApplyEgressRequest) (*ApplyEgressResponse, error)
// contains filtered or unexported methods
}
EgressConfigServer is the server API for EgressConfig service. All implementations must embed UnimplementedEgressConfigServer for forward compatibility.
EgressConfig applies compiled egress configuration to a tenant's resident.
type EgressPolicy ¶
type EgressPolicy struct {
// DefaultDeny denies destinations not matched by any rule. False (with no
// rules) is allow-all.
DefaultDeny bool `protobuf:"varint,1,opt,name=default_deny,json=defaultDeny,proto3" json:"default_deny,omitempty"`
// Rules are the compiled per-destination allow rules. Dimensions within a
// rule are ANDed; rules are ORed (each rule is one compiled
// EgressRouteMatch).
Rules []*EgressRule `protobuf:"bytes,2,rep,name=rules,proto3" json:"rules,omitempty"`
// contains filtered or unexported fields
}
EgressPolicy is one Service's egress authorization plane: the EgressGateway defaultPolicy paired with the allow rules compiled from the EgressRoutes attached to that gateway. A destination matched by any rule is allowed; otherwise default_deny decides (mirroring clrk's SandboxPolicy.Allow).
func (*EgressPolicy) Descriptor
deprecated
func (*EgressPolicy) Descriptor() ([]byte, []int)
Deprecated: Use EgressPolicy.ProtoReflect.Descriptor instead.
func (*EgressPolicy) GetDefaultDeny ¶
func (x *EgressPolicy) GetDefaultDeny() bool
func (*EgressPolicy) GetRules ¶
func (x *EgressPolicy) GetRules() []*EgressRule
func (*EgressPolicy) ProtoMessage ¶
func (*EgressPolicy) ProtoMessage()
func (*EgressPolicy) ProtoReflect ¶
func (x *EgressPolicy) ProtoReflect() protoreflect.Message
func (*EgressPolicy) Reset ¶
func (x *EgressPolicy) Reset()
func (*EgressPolicy) String ¶
func (x *EgressPolicy) String() string
type EgressRule ¶
type EgressRule struct {
// DestinationCIDRs match the destination IP. Single IPs are /32 or /128.
DestinationCidrs []string `protobuf:"bytes,1,rep,name=destination_cidrs,json=destinationCidrs,proto3" json:"destination_cidrs,omitempty"`
// DestinationHostnames match the DNS-bound destination name; exact or
// single-label wildcard ("*.example.com").
DestinationHostnames []string `protobuf:"bytes,2,rep,name=destination_hostnames,json=destinationHostnames,proto3" json:"destination_hostnames,omitempty"`
// Ports match the destination port. Single ports have start == end.
Ports []*PortRange `protobuf:"bytes,3,rep,name=ports,proto3" json:"ports,omitempty"`
// Protocol is the L4 protocol ("TCP"); empty matches any. UDP is rejected
// at admission and never compiled.
Protocol string `protobuf:"bytes,4,opt,name=protocol,proto3" json:"protocol,omitempty"`
// Listeners are the BackendListener names this rule routes via, from the
// route's parentRef.sectionName. Empty = all of the gateway's listeners.
Listeners []string `protobuf:"bytes,5,rep,name=listeners,proto3" json:"listeners,omitempty"`
// contains filtered or unexported fields
}
EgressRule is one compiled EgressRouteMatch: an AND of destination dimensions (each present dimension must match; an absent dimension matches anything).
func (*EgressRule) Descriptor
deprecated
func (*EgressRule) Descriptor() ([]byte, []int)
Deprecated: Use EgressRule.ProtoReflect.Descriptor instead.
func (*EgressRule) GetDestinationCidrs ¶
func (x *EgressRule) GetDestinationCidrs() []string
func (*EgressRule) GetDestinationHostnames ¶
func (x *EgressRule) GetDestinationHostnames() []string
func (*EgressRule) GetListeners ¶
func (x *EgressRule) GetListeners() []string
func (*EgressRule) GetPorts ¶
func (x *EgressRule) GetPorts() []*PortRange
func (*EgressRule) GetProtocol ¶
func (x *EgressRule) GetProtocol() string
func (*EgressRule) ProtoMessage ¶
func (*EgressRule) ProtoMessage()
func (*EgressRule) ProtoReflect ¶
func (x *EgressRule) ProtoReflect() protoreflect.Message
func (*EgressRule) Reset ¶
func (x *EgressRule) Reset()
func (*EgressRule) String ¶
func (x *EgressRule) String() string
type PortRange ¶
type PortRange struct {
Start int32 `protobuf:"varint,1,opt,name=start,proto3" json:"start,omitempty"`
End int32 `protobuf:"varint,2,opt,name=end,proto3" json:"end,omitempty"`
// contains filtered or unexported fields
}
PortRange is an inclusive destination port range.
func (*PortRange) Descriptor
deprecated
func (*PortRange) ProtoMessage ¶
func (*PortRange) ProtoMessage()
func (*PortRange) ProtoReflect ¶
func (x *PortRange) ProtoReflect() protoreflect.Message
type ServiceEgressConfig ¶
type ServiceEgressConfig struct {
// Service is the compute Service name this plane belongs to.
Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
// Backends replaces the Service's dialable EgressGateway listener set.
Backends []*BackendListener `protobuf:"bytes,2,rep,name=backends,proto3" json:"backends,omitempty"`
// Policy replaces the Service's egress authorization plane. Absent means
// allow-all (no enforcement) — the implicit built-in "default" gateway.
Policy *EgressPolicy `protobuf:"bytes,3,opt,name=policy,proto3" json:"policy,omitempty"`
// contains filtered or unexported fields
}
ServiceEgressConfig is one compute Service's compiled egress plane within the resident: the gateway listeners its egress may dial and its policy. A resident hosts every Service of its project, and Services select egress gateways independently (spec.template.spec.egress.gatewayRef), so egress state is keyed per Service — this is a deliberate divergence from clrk, where one sandbox hosts exactly one agent workload.
func (*ServiceEgressConfig) Descriptor
deprecated
func (*ServiceEgressConfig) Descriptor() ([]byte, []int)
Deprecated: Use ServiceEgressConfig.ProtoReflect.Descriptor instead.
func (*ServiceEgressConfig) GetBackends ¶
func (x *ServiceEgressConfig) GetBackends() []*BackendListener
func (*ServiceEgressConfig) GetPolicy ¶
func (x *ServiceEgressConfig) GetPolicy() *EgressPolicy
func (*ServiceEgressConfig) GetService ¶
func (x *ServiceEgressConfig) GetService() string
func (*ServiceEgressConfig) ProtoMessage ¶
func (*ServiceEgressConfig) ProtoMessage()
func (*ServiceEgressConfig) ProtoReflect ¶
func (x *ServiceEgressConfig) ProtoReflect() protoreflect.Message
func (*ServiceEgressConfig) Reset ¶
func (x *ServiceEgressConfig) Reset()
func (*ServiceEgressConfig) String ¶
func (x *ServiceEgressConfig) String() string
type UnimplementedDNSConfigServer ¶
type UnimplementedDNSConfigServer struct{}
UnimplementedDNSConfigServer must be embedded to have forward compatible implementations.
NOTE: this should be embedded by value instead of pointer to avoid a nil pointer dereference when methods are called.
func (UnimplementedDNSConfigServer) ApplyDNS ¶
func (UnimplementedDNSConfigServer) ApplyDNS(context.Context, *ApplyDNSRequest) (*ApplyDNSResponse, error)
type UnimplementedEgressConfigServer ¶
type UnimplementedEgressConfigServer struct{}
UnimplementedEgressConfigServer must be embedded to have forward compatible implementations.
NOTE: this should be embedded by value instead of pointer to avoid a nil pointer dereference when methods are called.
func (UnimplementedEgressConfigServer) ApplyEgress ¶
func (UnimplementedEgressConfigServer) ApplyEgress(context.Context, *ApplyEgressRequest) (*ApplyEgressResponse, error)
type UnsafeDNSConfigServer ¶
type UnsafeDNSConfigServer interface {
// contains filtered or unexported methods
}
UnsafeDNSConfigServer may be embedded to opt out of forward compatibility for this service. Use of this interface is not recommended, as added methods to DNSConfigServer will result in compilation errors.
type UnsafeEgressConfigServer ¶
type UnsafeEgressConfigServer interface {
// contains filtered or unexported methods
}
UnsafeEgressConfigServer may be embedded to opt out of forward compatibility for this service. Use of this interface is not recommended, as added methods to EgressConfigServer will result in compilation errors.