nftables

Documentation

Index

• type FQDNCache
• type Firewall
  • func NewDefaultFirewall() *Firewall
  • func NewFirewall(firewall firewallv1.Firewall, cwnps *firewallv1.ClusterwideNetworkPolicyList, ...) *Firewall
  • func (f *Firewall) Flush() error
  • func (f *Firewall) Reconcile() (updated bool, err error)
  • func (f *Firewall) ReconcileNetconfTables() error

Types

type FQDNCache

type FQDNCache interface {
	GetSetsForRendering(fqdns []firewallv1.FQDNSelector) (result []dns.RenderIPSet)
	GetSetsForFQDN(fqdn firewallv1.FQDNSelector, fqdnSets []firewallv1.IPSet) (result []firewallv1.IPSet)
	IsInitialized() bool
}

type Firewall

type Firewall struct {
	// contains filtered or unexported fields
}

Firewall assembles nftable rules based on k8s entities

func NewDefaultFirewall

func NewDefaultFirewall() *Firewall

NewDefaultFirewall creates a new default nftables firewall.

func NewFirewall

func NewFirewall(
	firewall firewallv1.Firewall,
	cwnps *firewallv1.ClusterwideNetworkPolicyList,
	svcs *corev1.ServiceList,
	cache FQDNCache,
	log logr.Logger,
) *Firewall

NewFirewall creates a new nftables firewall object based on k8s entities

func (*Firewall) Flush

func (f *Firewall) Flush() error

Flush flushes the nftables rules that were deduced from a k8s resources after that the firewall is a "plain metal firewall" with default policy accept in the forward chain.

func (*Firewall) Reconcile

func (f *Firewall) Reconcile() (updated bool, err error)

Reconcile drives the nftables firewall against the desired state by comparison with the current rule file.

func (*Firewall) ReconcileNetconfTables

func (f *Firewall) ReconcileNetconfTables() error