network

Documentation

Overview

Package network provides custom NetworkPolicy building for sandboxes with advanced network configurations (custom CIDRs or custom DNS).

Architecture

Most sandboxes use static Helm-installed NetworkPolicies based on pod labels:

• sandbox-default-deny: Denies all traffic for pods with isola.run/sandbox=true
• sandbox-allow-ipv4-internet-egress: Allows IPv4 internet egress for pods with isola.run/allow-ipv4-internet-egress=true
• sandbox-allow-ipv6-internet-egress: Allows IPv6 internet egress for pods with isola.run/allow-ipv6-internet-egress=true
• sandbox-allow-cluster-dns: Allows cluster DNS for pods with isola.run/allow-cluster-dns=true

This package builds custom NetworkPolicies only when needed (and allowInternetEgress is not true):

• Custom egress CIDRs are specified
• Custom nameservers are specified

Index

• Constants
• Variables
• func BuildCustomNetworkPolicy(sandboxName, namespace string, network *sandboxv1alpha1.Network) (*networkingv1.NetworkPolicy, error)
• func EffectiveEgressBurstBytes(rateBytesPerSecond int64) int64
• func EffectiveNameservers(network *sandboxv1alpha1.Network) []string

Constants

const (
	// some buffer over 64KiB if e.g. HOSTGSo is used by gVisor
	MinEgressBurstBytes = 128 * 1024

	MaxEgressBurstBytes = math.MaxUint32
)

Variables

var DefaultPublicNameservers = []string{"8.8.8.8", "1.1.1.1"}

Functions

func BuildCustomNetworkPolicy

func BuildCustomNetworkPolicy(sandboxName, namespace string, network *sandboxv1alpha1.Network) (*networkingv1.NetworkPolicy, error)

BuildCustomNetworkPolicy creates a K8s NetworkPolicy for a sandbox with custom network configuration (CIDRs or nameservers).

The policy selects the specific sandbox pod using app.kubernetes.io/instance={sandboxName}. Returns nil if no custom policy is needed (nil network or no custom rules).

Returns error if CIDRs are invalid or if egress CIDRs completely overlap with blocked ranges.

func EffectiveEgressBurstBytes

func EffectiveEgressBurstBytes(rateBytesPerSecond int64) int64

EffectiveEgressBurstBytes is a heuristic to calculate a reasonable burst size instead of exposing it as a configuration knob, to reduce complexity for users.

func EffectiveNameservers

func EffectiveNameservers(network *sandboxv1alpha1.Network) []string

EffectiveNameservers returns the nameservers to configure for a sandbox pod. Priority: user-provided > auto-default (when egress CIDRs are set and cluster DNS is off) > nil (sink).