Documentation ¶
Overview ¶
Package datapath defines the interfaces to abstract all platform specific datapath components.
Current datapath implementations:
pkg/datapath/linux pkg/datapath/fake
Index ¶
- func RemoteSNATDstAddrExclusionCIDRv4() *cidr.CIDR
- func RemoteSNATDstAddrExclusionCIDRv6() *cidr.CIDR
- type BaseProgramOwner
- type CompileTimeConfiguration
- type ConfigWriter
- type Datapath
- type DeviceConfiguration
- type Endpoint
- type EndpointConfiguration
- type IptablesManager
- type LoadTimeConfiguration
- type Loader
- type LocalNodeConfiguration
- type NodeAddressing
- type NodeAddressingFamily
- type NodeHandler
- type PreFilter
- type Proxy
- type WireguardAgent
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RemoteSNATDstAddrExclusionCIDRv4 ¶ added in v1.10.0
RemoteSNATDstAddrExclusionCIDRv4 returns a CIDR for SNAT exclusion. Any packet sent from a local endpoint to an IP address belonging to the CIDR should not be SNAT'd.
func RemoteSNATDstAddrExclusionCIDRv6 ¶ added in v1.10.0
RemoteSNATDstAddrExclusionCIDRv6 returns a IPv6 CIDR for SNAT exclusion. Any packet sent from a local endpoint to an IP address belonging to the CIDR should not be SNAT'd.
Types ¶
type BaseProgramOwner ¶ added in v1.7.0
type BaseProgramOwner interface { DeviceConfiguration GetCompilationLock() *lock.RWMutex Datapath() Datapath LocalConfig() *LocalNodeConfiguration SetPrefilter(pf PreFilter) }
BaseProgramOwner is any type for which a loader is building base programs.
type CompileTimeConfiguration ¶ added in v1.8.0
type CompileTimeConfiguration interface { DeviceConfiguration // TODO: Move this detail into the datapath HasIpvlanDataPath() bool ConntrackLocalLocked() bool // RequireARPPassthrough returns true if the datapath must implement // ARP passthrough for this endpoint RequireARPPassthrough() bool // RequireEgressProg returns true if the endpoint requires an egress // program attached to the InterfaceName() invoking the section // "to-container" RequireEgressProg() bool // RequireRouting returns true if the endpoint requires BPF routing to // be enabled, when disabled, routing is delegated to Linux routing RequireRouting() bool // RequireEndpointRoute returns true if the endpoint wishes to have a // per endpoint route installed in the host's routing table to point to // the endpoint's interface RequireEndpointRoute() bool // GetPolicyVerdictLogFilter returns the PolicyVerdictLogFilter for the endpoint GetPolicyVerdictLogFilter() uint32 // IsHost returns true if the endpoint is the host endpoint. IsHost() bool // DisableSIPVerification returns true if the endpoint wishes to skip // source IP verification DisableSIPVerification() bool }
CompileTimeConfiguration provides datapath implementations a clean interface to access endpoint-specific configuration that can only be changed at compile time.
type ConfigWriter ¶ added in v1.7.0
type ConfigWriter interface { // WriteNodeConfig writes the implementation-specific configuration of // node-wide options into the specified writer. WriteNodeConfig(io.Writer, *LocalNodeConfiguration) error // WriteNetdevConfig writes the implementation-specific configuration // of configurable options to the specified writer. Options specified // here will apply to base programs and not to endpoints, though // endpoints may have equivalent configurable options. WriteNetdevConfig(io.Writer, DeviceConfiguration) error // WriteTemplateConfig writes the implementation-specific configuration // of configurable options for BPF templates to the specified writer. WriteTemplateConfig(w io.Writer, cfg EndpointConfiguration) error // WriteEndpointConfig writes the implementation-specific configuration // of configurable options for the endpoint to the specified writer. WriteEndpointConfig(w io.Writer, cfg EndpointConfiguration) error }
ConfigWriter is anything which writes the configuration for various datapath program types.
type Datapath ¶ added in v1.5.0
type Datapath interface { ConfigWriter IptablesManager // Node must return the handler for node events Node() NodeHandler // LocalNodeAddressing must return the node addressing implementation // of the local node LocalNodeAddressing() NodeAddressing // Loader must return the implementation of the loader, which is responsible // for loading, reloading, and compiling datapath programs. Loader() Loader // WireguardAgent returns the Wireguard agent for the local node WireguardAgent() WireguardAgent }
Datapath is the interface to abstract all datapath interactions. The abstraction allows to implement the datapath requirements with multiple implementations
type DeviceConfiguration ¶ added in v1.5.0
type DeviceConfiguration interface { // GetCIDRPrefixLengths fetches the lists of unique IPv6 and IPv4 // prefix lengths used for datapath lookups, each of which is sorted // from longest prefix to shortest prefix. It must return more than // one element in each returned array. GetCIDRPrefixLengths() (s6, s4 []int) // GetOptions fetches the configurable datapath options from the owner. GetOptions() *option.IntOptions }
DeviceConfiguration is an interface for injecting configuration of datapath options that affect lookups and logic applied at a per-device level, whether those are devices associated with the endpoint or associated with the host.
type Endpoint ¶ added in v1.7.0
type Endpoint interface { EndpointConfiguration InterfaceName() string Logger(subsystem string) *logrus.Entry StateDir() string MapPath() string }
Endpoint provides access endpoint configuration information that is necessary to compile and load the datapath.
type EndpointConfiguration ¶ added in v1.5.0
type EndpointConfiguration interface { CompileTimeConfiguration LoadTimeConfiguration }
EndpointConfiguration provides datapath implementations a clean interface to access endpoint-specific configuration when configuring the datapath.
type IptablesManager ¶ added in v1.7.0
type IptablesManager interface { // InstallProxyRules creates the necessary datapath config (e.g., iptables // rules for redirecting host proxy traffic on a specific ProxyPort) InstallProxyRules(proxyPort uint16, ingress bool, name string) error // SupportsOriginalSourceAddr tells if the datapath supports // use of original source addresses in proxy upstream // connections. SupportsOriginalSourceAddr() bool InstallRules(ifName string, quiet, install bool) error // GetProxyPort fetches the existing proxy port configured for the // specified listener. Used early in bootstrap to reopen proxy ports. GetProxyPort(listener string) uint16 // InstallNoTrackRules is explicitly called when a pod has valid // "io.cilium.no-track-port" annotation. When // InstallNoConntrackIptRules flag is set, a super set of v4 NOTRACK // rules will be automatically installed upon agent bootstrap (via // function addNoTrackPodTrafficRules) and this function will be // skipped. When InstallNoConntrackIptRules is not set, this function // will be executed to install NOTRACK rules. The rules installed by // this function is very specific, for now, the only user is // node-local-dns pods. InstallNoTrackRules(IP string, port uint16, ipv6 bool) error // See comments for InstallNoTrackRules. RemoveNoTrackRules(IP string, port uint16, ipv6 bool) error }
IptablesManager manages iptables rules.
type LoadTimeConfiguration ¶ added in v1.8.0
type LoadTimeConfiguration interface { // GetID returns a locally-significant endpoint identification number. GetID() uint64 // StringID returns the string-formatted version of the ID from GetID(). StringID() string // GetIdentity returns a globally-significant numeric security identity. GetIdentity() identity.NumericIdentity // GetIdentityLocked returns a globally-significant numeric security // identity while assuming that the backing data structure is locked. // This function should be removed in favour of GetIdentity() GetIdentityLocked() identity.NumericIdentity IPv4Address() addressing.CiliumIPv4 IPv6Address() addressing.CiliumIPv6 GetNodeMAC() mac.MAC }
LoadTimeConfiguration provides datapath implementations a clean interface to access endpoint-specific configuration that can be changed at load time.
type Loader ¶ added in v1.7.0
type Loader interface { CallsMapPath(id uint16) string CustomCallsMapPath(id uint16) string CompileAndLoad(ctx context.Context, ep Endpoint, stats *metrics.SpanStat) error CompileOrLoad(ctx context.Context, ep Endpoint, stats *metrics.SpanStat) error ReloadDatapath(ctx context.Context, ep Endpoint, stats *metrics.SpanStat) error EndpointHash(cfg EndpointConfiguration) (string, error) Unload(ep Endpoint) Reinitialize(ctx context.Context, o BaseProgramOwner, deviceMTU int, iptMgr IptablesManager, p Proxy) error }
Loader is an interface to abstract out loading of datapath programs.
type LocalNodeConfiguration ¶ added in v1.5.0
type LocalNodeConfiguration struct { // MtuConfig is the MTU configuration of the node. // // This field is immutable at runtime. The value will not change in // subsequent calls to NodeConfigurationChanged(). MtuConfig mtu.Configuration // AuxiliaryPrefixes is the list of auxiliary prefixes that should be // configured in addition to the node PodCIDR // // This field is mutable. The implementation of // NodeConfigurationChanged() must adjust the routes accordingly. AuxiliaryPrefixes []*cidr.CIDR // EnableIPv4 enables use of IPv4. Routing to the IPv4 allocation CIDR // of other nodes must be enabled. // // This field is immutable at runtime. The value will not change in // subsequent calls to NodeConfigurationChanged(). EnableIPv4 bool // EnableIPv6 enables use of IPv6. Routing to the IPv6 allocation CIDR // of other nodes must be enabled. // // This field is immutable at runtime. The value will not change in // subsequent calls to NodeConfigurationChanged(). EnableIPv6 bool // UseSingleClusterRoute enables the use of a single cluster-wide route // to direct traffic from the host into the Cilium datapath. This // avoids the requirement to install a separate route for each node // CIDR and can thus improve the overhead when operating large clusters // with significant node event churn due to auto-scaling. // // Use of UseSingleClusterRoute must be compatible with // EnableAutoDirectRouting. When both are enabled, any direct node // route must take precedence over the cluster-wide route as per LPM // routing definition. // // This field is mutable. The implementation of // NodeConfigurationChanged() must adjust the routes accordingly. UseSingleClusterRoute bool // EnableEncapsulation enables use of encapsulation in communication // between nodes. // // This field is immutable at runtime. The value will not change in // subsequent calls to NodeConfigurationChanged(). EnableEncapsulation bool // EnableAutoDirectRouting enables the use of direct routes for // communication between nodes if two nodes have direct L2 // connectivity. // // EnableAutoDirectRouting must be compatible with EnableEncapsulation // and must provide a fallback to use encapsulation if direct routing // is not feasible and encapsulation is enabled. // // This field is immutable at runtime. The value will not change in // subsequent calls to NodeConfigurationChanged(). EnableAutoDirectRouting bool // EnableLocalNodeRoute enables installation of the route which points // the allocation prefix of the local node. Disabling this option is // useful when another component is responsible for the routing of the // allocation CIDR IPs into Cilium endpoints. EnableLocalNodeRoute bool // EnableIPSec enables IPSec routes EnableIPSec bool // EncryptNode enables encrypting NodeIP traffic requires EnableIPSec EncryptNode bool // IPv4PodSubnets is a list of IPv4 subnets that pod IPs are assigned from // these are then used when encryption is enabled to configure the node // for encryption over these subnets at node initialization. IPv4PodSubnets []*net.IPNet // IPv6PodSubnets is a list of IPv6 subnets that pod IPs are assigned from // these are then used when encryption is enabled to configure the node // for encryption over these subnets at node initialization. IPv6PodSubnets []*net.IPNet }
LocalNodeConfiguration represents the configuration of the local node
type NodeAddressing ¶ added in v1.5.0
type NodeAddressing interface { IPv6() NodeAddressingFamily IPv4() NodeAddressingFamily }
NodeAddressing implements addressing of a node
type NodeAddressingFamily ¶ added in v1.5.0
type NodeAddressingFamily interface { // Router is the address that will act as the router on each node where // an agent is running on. Endpoints have a default route that points // to this address. Router() net.IP // PrimaryExternal is the primary external address of the node. Nodes // must be able to reach each other via this address. PrimaryExternal() net.IP // AllocationCIDR is the CIDR used for IP allocation of all endpoints // on the node AllocationCIDR() *cidr.CIDR // LocalAddresses lists all local addresses LocalAddresses() ([]net.IP, error) // LoadBalancerNodeAddresses lists all addresses on which HostPort and // NodePort services should be responded to LoadBalancerNodeAddresses() []net.IP }
NodeAddressingFamily is the node addressing information for a particular address family
type NodeHandler ¶ added in v1.5.0
type NodeHandler interface { // NodeAdd is called when a node is discovered for the first time. NodeAdd(newNode nodeTypes.Node) error // NodeUpdate is called when a node definition changes. Both the old // and new node definition is provided. NodeUpdate() is never called // before NodeAdd() is called for a particular node. NodeUpdate(oldNode, newNode nodeTypes.Node) error // NodeDelete is called after a node has been deleted NodeDelete(node nodeTypes.Node) error // NodeValidateImplementation is called to validate the implementation of // the node in the datapath. This function is intended to be run on an // interval to ensure that the datapath is consistently converged. NodeValidateImplementation(node nodeTypes.Node) error // NodeConfigurationChanged is called when the local node configuration // has changed NodeConfigurationChanged(config LocalNodeConfiguration) error // NodeNeighDiscoveryEnabled returns whether node neighbor discovery is enabled NodeNeighDiscoveryEnabled() bool // NodeNeighborRefresh is called to refresh node neighbor table NodeNeighborRefresh(ctx context.Context, node nodeTypes.Node) // NodeCleanNeighbors cleans all neighbor entries for the direct routing device // and the encrypt interface. NodeCleanNeighbors(migrateOnly bool) }
NodeHandler handles node related events such as addition, update or deletion of nodes or changes to the local node configuration.
Node events apply to the local node as well as to remote nodes. The implementation can differ between the own local node and remote nodes by calling node.IsLocal().
type PreFilter ¶ added in v1.8.0
type PreFilter interface { WriteConfig(fw io.Writer) Dump(to []string) ([]string, int64) Insert(revision int64, cidrs []net.IPNet) error Delete(revision int64, cidrs []net.IPNet) error }
PreFilter an interface for an XDP pre-filter.
type Proxy ¶ added in v1.7.0
type Proxy interface {
ReinstallRules()
}
Proxy is any type which installs rules related to redirecting traffic to a proxy.
type WireguardAgent ¶ added in v1.10.0
type WireguardAgent interface { Init(mtuConfig mtu.Configuration) error UpdatePeer(nodeName, pubKeyHex string, nodeIPv4, nodeIPv6 net.IP) error DeletePeer(nodeName string) error Status(includePeers bool) (*models.WireguardStatus, error) }
WireguardAgent manages the Wireguard peers
Source Files ¶
Directories ¶
Path | Synopsis |
---|---|
Package alignchecker is a thin wrapper around pkg/alignchecker to validate datapath object alignment.
|
Package alignchecker is a thin wrapper around pkg/alignchecker to validate datapath object alignment. |
Package connector is responsible for the datapath specific plumbing to connect an endpoint to the network
|
Package connector is responsible for the datapath specific plumbing to connect an endpoint to the network |
Package fake is a fake datapath implementation.
|
Package fake is a fake datapath implementation. |
Package ipcache provides a BPF datapath implementation of the IPCache store.
|
Package ipcache provides a BPF datapath implementation of the IPCache store. |
Package iptables manages iptables-related configuration for Cilium.
|
Package iptables manages iptables-related configuration for Cilium. |
Package link provides the Cilium specific abstraction and useful helpers to manage network interfaces
|
Package link provides the Cilium specific abstraction and useful helpers to manage network interfaces |
Package linux implements the Linux specific datapath implementation
|
Package linux implements the Linux specific datapath implementation |
ipsec
Package ipsec provides the Linux datpaath specific abstraction and useful helpers to manage IPSec via Linux xfrm.
|
Package ipsec provides the Linux datpaath specific abstraction and useful helpers to manage IPSec via Linux xfrm. |
linux_defaults
Package linux_defaults provides the Linux datapath defaults
|
Package linux_defaults provides the Linux datapath defaults |
probes
Package probes provides BPF features checks based on bpftool.
|
Package probes provides BPF features checks based on bpftool. |
route
Package route provides the Cilium specific abstraction and useful helpers to manage network routes
|
Package route provides the Cilium specific abstraction and useful helpers to manage network routes |
Package loader provides accessors to compilation and BPF load routines necessary for creating datapath objects and attaching them to links.
|
Package loader provides accessors to compilation and BPF load routines necessary for creating datapath objects and attaching them to links. |
Package maps performs various lifecycle operations related to maps in the datapath.
|
Package maps performs various lifecycle operations related to maps in the datapath. |
Package prefilter provides a means of configuring XDP pre-filters for DDoS-mitigation.
|
Package prefilter provides a means of configuring XDP pre-filters for DDoS-mitigation. |