egress

Documentation

Overview

Package egress provides the PreCreatePod plugin that injects the sandbox egress filter (an init container that installs the iptables redirect and a native sidecar that runs the proxy) into Pods of Pools whose Spec.NetworkPolicy is set. Enforcement lives entirely in the Pod network namespace + the sidecar, so it is independent of the sandbox container's image (survives in-place image swap) and of the cluster CNI (works on Calico / Aliyun ENI alike).

Index

• type Config
• type Plugin
  • func New(cfg Config) *Plugin
  • func (p *Plugin) Name() string
  • func (p *Plugin) PreCreatePod(_ context.Context, pod *corev1.Pod, pool *agentsv1alpha1.SandboxPool) (bool, *domain.AppError)

Types

type Config

type Config struct {
	// Image is the container image that carries the egress-proxy binary. Both
	// the init container and the sidecar run it (different subcommands). Defaults
	// to the operator's idle image, which is guaranteed present on pool nodes.
	Image string
}

Config parameterizes the injected containers.

type Plugin

type Plugin struct {
	plugins.BasePlugin
	// contains filtered or unexported fields
}

Plugin injects the egress filter sidecar. It self-gates on pool.Spec.NetworkPolicy — Pools without a policy are untouched.

func New

func New(cfg Config) *Plugin

New returns an egress injection Plugin.

func (*Plugin) Name

func (p *Plugin) Name() string

func (*Plugin) PreCreatePod

func (p *Plugin) PreCreatePod(_ context.Context, pod *corev1.Pod, pool *agentsv1alpha1.SandboxPool) (bool, *domain.AppError)

PreCreatePod injects the init container + native sidecar + policy volume when the owning Pool has a NetworkPolicy, and hardens the sandbox containers (strip NET_ADMIN, reject a uid collision with the proxy). Idempotent.