cache

package
v0.0.0-...-c46dd35 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 9, 2026 License: Apache-2.0 Imports: 49 Imported by: 0

Documentation

Overview

Package cache manages Envoy xDS snapshot resources for the agent.

It wraps go-control-plane's SnapshotCache and maintains a map-based cache of Envoy resources (listeners, clusters, endpoints, virtual hosts) with per-resource-type locking for thread-safe incremental updates. When the cache is modified, snapshots are regenerated and pushed to the xDS server.

The cache organizes listeners by pod container network namespace and clusters by service name. Each listener entry holds inbound and outbound listeners for a pod. Each cluster entry holds the cluster definition, pre-built load assignment (with endpoints keyed by IP for granular add/remove), and virtual host for routing.

Snapshot generation is incremental: listeners and clusters maintain separate snapshot versions. The version string format is "timestamp.counter.label" (e.g., "1704067200000.42.listener"), where timestamp is Unix milliseconds, counter is an atomic increment, and label identifies the resource type.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type EdgeGatewayEntry 

type EdgeGatewayEntry struct {
	// Namespace is the Gateway's Kubernetes namespace.
	Namespace string
	// Name is the Gateway's name.
	Name string
	// Listeners is the per-listener port allocations and TLS config.
	Listeners []EdgeGatewayListenerEntry
	// VirtualHosts are the HTTPRoute virtual hosts attached to this Gateway.
	VirtualHosts []VirtualHost
	// EdgeConfig is the effective edge-hardening/HTTP3 config for THIS Gateway
	// (proposal 029): GatewayClass.parametersRef default ⊕ Gateway
	// infrastructure.parametersRef override, resolved by the reconciler. Nil = the
	// compiled best-practice defaults (ApplyEdgeHardening handles nil).
	EdgeConfig *configv1.EdgeConfigSpec
}

EdgeGatewayEntry is the cache's per-Gateway routing data for proposal 021 Phase 2. Each entry maps to one per-Gateway LoadBalancer Service and a set of per-listener Envoy listeners bound on InternalPorts.

type EdgeGatewayListenerEntry 

type EdgeGatewayListenerEntry struct {
	// ExternalPort is the Gateway listener's declared external port (e.g. 80, 443).
	ExternalPort uint32
	// InternalPort is the unique container port allocated for this (Gateway, listener).
	InternalPort uint32
	// TLSSecretNames are the SDS cert names for downstream TLS (empty = plain HTTP).
	TLSSecretNames []string
	// HTTPRedirect when true means this listener emits an HTTP→HTTPS 301 redirect
	// instead of serving routes directly.
	HTTPRedirect bool
}

EdgeGatewayListenerEntry describes one listener port within a per-Gateway entry. ExternalPort is the Gateway listener's declared port (e.g. 80 or 443). InternalPort is the container port allocated by the port allocator that the per-Gateway LoadBalancer Service maps ExternalPort → InternalPort.

type EdgeTLSCert 

type EdgeTLSCert struct {
	Cert []byte
	Key  []byte
}

EdgeTLSCert is raw certificate material for an edge downstream TLS secret, keyed by its provider-prefixed SDS name.

type Route 

type Route struct {
	Prefix           string
	Exact            string
	Service          string
	Port             uint32
	BackendNamespace string
	// DialPort is the cleartext STRICT_DNS dial port for the legacy single-backend
	// path (mirrors RouteBackend.DialPort). Zero = dial Port. See RouteBackend.DialPort.
	DialPort uint32
	// Backends is the weighted backend list for this rule. A single-element list
	// is equivalent to the legacy Service/Port/BackendNamespace fields. An empty
	// Backends with a non-empty Service falls back to the legacy single-backend
	// path so old callers remain compatible.
	Backends       []RouteBackend
	HeaderMutation *proxy.GammaHeaderMutation
	Redirect       *proxy.GammaRedirect
	URLRewrite     *proxy.GammaURLRewrite

	// Headers are the per-header exact/regex predicates for this match.
	// All entries must match (AND semantics within one HTTPRouteMatch).
	Headers []proxy.RouteHeaderMatch
	// Method is the HTTP method that must match (e.g. "GET"). Empty = any method.
	Method string
	// QueryParams are the per-parameter exact/regex predicates for this match.
	QueryParams []proxy.RouteQueryParamMatch

	// DirectResponseStatus, when non-zero, causes the route to emit a fixed
	// HTTP direct_response with this status (no backend routing). Set to 500
	// for rules whose backendRef(s) cannot be resolved (BackendNotFound /
	// InvalidKind / RefNotPermitted per Gateway API).
	DirectResponseStatus uint32

	// Timeout is the per-route request timeout from the HTTPRoute rule's
	// timeouts.request field (GEP-2257 duration). Nil means no timeout is applied
	// on this route (Envoy inherits the listener/cluster default). When set it is
	// applied as RouteAction.timeout on the forwarding route.
	Timeout *durationpb.Duration
}

Route is one path-match -> backend rule within a VirtualHost. Exactly one of Prefix/Exact is set. HeaderMutation carries the merged request/response header modifier filters for this rule (nil = no header mutations). When Redirect is non-nil the route returns a redirect response (no backend). When URLRewrite is non-nil the route rewrites the request URL before forwarding.

Backends holds the weighted backend list for this rule. When populated, BuildEdgeRoute emits a weighted_clusters action (multiple backends) or a plain single-cluster action (one backend). Backends supersedes the legacy Service/Port/BackendNamespace fields; all three are populated for backward compatibility when there is exactly one backend so existing single-backend code paths continue to work.

BackendNamespace is the namespace of the (first) backendRef (defaults to the route's own namespace when not set by the reconciler). Used to build the k8s- Service FQDN for non-mesh (cleartext) backends when Backends is not set.

Headers, Method, QueryParams carry the additional match predicates from Gateway API HTTPRouteMatch: within one Match all predicates are ANDed. Headers maps to Envoy RouteMatch.headers; Method maps to a :method header matcher; QueryParams maps to RouteMatch.query_parameters.

DirectResponseStatus, when non-zero, causes the route to emit a fixed direct_response with that HTTP status code (no backend). Used to implement Gateway API semantics for rules whose all backends are unresolvable (ResolvedRefs=False): the data plane must return 500.

type RouteBackend 

type RouteBackend struct {
	Service          string
	BackendNamespace string
	Port             uint32
	// Weight is the Gateway API backendRef weight. Defaults to 1 when unset.
	// The Envoy weighted_clusters total_weight is the sum of all backend weights
	// within the rule. Weight 0 = backend receives no traffic.
	Weight uint32
	// DialPort is the TCP port a non-mesh (cleartext STRICT_DNS) cluster actually
	// connects to. It differs from Port for a HEADLESS Service: the Service FQDN
	// resolves directly to pod IPs (no kube-proxy in the path to remap the port), so
	// the edge must dial the Service's numeric targetPort, not its service port.
	// For a ClusterIP Service the FQDN resolves to the ClusterIP and kube-proxy
	// DNATs port->targetPort, so DialPort == Port. Zero means "same as Port" (the
	// reconciler leaves it 0 when no Service-type-specific remap is needed); the
	// cluster builder falls back to Port. The cluster NAME stays keyed by Port so
	// route->cluster names remain stable regardless of the resolved dial port.
	DialPort uint32
}

RouteBackend is one weighted backend within an HTTPRoute rule. It corresponds to one element of backendRefs with its resolved service name, namespace, port, and weight. Weight 0 means the backend receives no traffic but is still a valid entry (per Gateway API — a zero-weight backend is not an error).

type SnapshotCache 

type SnapshotCache struct {
	cachev3.SnapshotCache
	// contains filtered or unexported fields
}

SnapshotCache wraps go-control-plane's SnapshotCache and manages Envoy xDS resources for a single node agent. It maintains separate maps of listeners (keyed by pod container network namespace) and clusters (keyed by service name) with per-resource-type RWMutex locks for thread-safe incremental updates.

Listeners and clusters are cached separately to allow independent snapshot generation. Snapshots are versioned using timestamps and atomic counters to track changes. SnapshotCache is safe for concurrent use.

func NewSnapshotCache 

func NewSnapshotCache(nodeName string, log *slog.Logger) *SnapshotCache

NewSnapshotCache creates and returns a new SnapshotCache for the given node. The nodeName is used as the xDS node identifier when updating snapshots.

func (*SnapshotCache) AddPod 

func (c *SnapshotCache) AddPod(ctx context.Context, cniPod *cniv1.CNIPod, trustDomain string) error

func (*SnapshotCache) DependencyChanges 

func (c *SnapshotCache) DependencyChanges() <-chan struct{}

DependencyChanges returns a channel receiving a (coalesced) signal whenever the node dependency set changes — a pod was added or removed, or its declared upstreams differ. Consumers treat each receive as "the dependency set changed, rebuild the scoped snapshot".

func (*SnapshotCache) DependencySet 

func (c *SnapshotCache) DependencySet() map[string]struct{}

DependencySet returns the node dependency set: the union of all local pods' declared upstreams, their own services, and live (non-expired) observed dependencies. LoadClustersFromRegistry scopes the cluster/endpoint/route snapshot to this set (demand-scoped distribution, proposal 004).

func (*SnapshotCache) Endpoints 

func (c *SnapshotCache) Endpoints(clusterName string) []types.Resource

Endpoints returns the pre-built load assignment (cluster endpoints) for the given cluster name as a resource slice. Returns nil if the cluster does not exist or has no load assignment. Thread-safe.

func (*SnapshotCache) HasRegistryService 

func (c *SnapshotCache) HasRegistryService(name string) bool

HasRegistryService reports whether the named service is currently known to the mesh registry. It delegates to the registry's ServiceCatalog.HasService when available; returns false if the registry does not implement ServiceCatalog or no registry has been set (safe default = treat as not a registry service). Used by the edge reconciler's backend-existence check to distinguish mesh services (namespace-blind, registry-resolved) from k8s Services.

func (*SnapshotCache) Listeners 

func (c *SnapshotCache) Listeners() []types.Resource

Listeners returns all cached inbound and outbound listener resources plus the health gateway listener (per-pod health_check filters over the health_<pod> clusters, probed by the liveness loop) as a flat slice. Thread-safe.

func (*SnapshotCache) LoadClustersFromRegistry 

func (c *SnapshotCache) LoadClustersFromRegistry(ctx context.Context, clusterName string, nodeName string, reg registry.Registry) error

LoadClustersFromRegistry fetches the HTTP service endpoints from the registry for the node dependency set (local pods' declared upstreams + their own services — demand-scoped distribution, proposal 004), generates Envoy clusters and load assignments for each in-scope service, and populates the cache. The outbound RDS virtual-host set shrinks identically (vhosts are derived from the cluster entries). After populating the cache, it generates and sets a new cluster snapshot. Returns an error if registry listing fails or snapshot generation fails.

func (*SnapshotCache) LoadListenersFromStorage 

func (c *SnapshotCache) LoadListenersFromStorage(ctx context.Context, store storage.Storage[*cniv1.CNIPod], trustDomain string) error

LoadListenersFromStorage retrieves all pods from the given storage backend, generates the inbound and outbound Envoy listeners and per-pod clusters for each pod, and populates the cache keyed by container network namespace. After populating the cache, it generates and sets a new listener snapshot.

The trustDomain is the SPIFFE trust domain used for SDS secret naming.

If listener generation fails for any pod, it logs the error and continues processing other pods. Returns an error with all accumulated errors if at least one pod failed, or if snapshot generation fails.

func (*SnapshotCache) MeshDomain 

func (c *SnapshotCache) MeshDomain() string

MeshDomain returns the configured mesh domain.

func (*SnapshotCache) ObserveDependency 

func (c *SnapshotCache) ObserveDependency(ctx context.Context, service string) bool

ObserveDependency records an on-demand (ODCDS) request for a service that is not in the node dependency set: the observed cold path. The service joins the set with a TTL'd membership (refreshed on re-request) and a change signal triggers the scoped reload that delivers the cluster, resuming the paused request. A request for an already-known service only refreshes its observation timestamp. Returns true when the dependency is new (a miss).

func (*SnapshotCache) PruneObservedDependencies 

func (c *SnapshotCache) PruneObservedDependencies()

PruneObservedDependencies drops observed dependencies idle past the TTL and signals a dependency change when any were dropped. The refresher calls it periodically; the subsequent scoped reload removes the expired clusters (after the retention grace), and Envoy re-fetches via ODCDS on next use.

func (*SnapshotCache) RemoveCluster 

func (c *SnapshotCache) RemoveCluster(ctx context.Context, clusterName string) error

RemoveCluster removes the cluster, its endpoints, and its virtual host associated with the given name, then regenerates the snapshot.

func (*SnapshotCache) RemoveEndpoint 

func (c *SnapshotCache) RemoveEndpoint(ctx context.Context, clusterName string, ip string) error

RemoveEndpoint removes a single endpoint by IP from the given cluster's load assignment and regenerates the cluster snapshot. If the cluster does not exist or the IP is not found in the endpoint map, it returns nil without regenerating the snapshot. The cluster itself is kept even if the endpoint map becomes empty.

func (*SnapshotCache) RemovePod 

func (c *SnapshotCache) RemovePod(ctx context.Context, netns string) error

RemovePod removes the inbound and outbound listeners for the pod with the given container network namespace, then regenerates the listener snapshot. If the pod does not exist in the cache, it returns nil without error. Returns an error if snapshot generation fails.

func (*SnapshotCache) RewriteMeshDNSSnapshot 

func (c *SnapshotCache) RewriteMeshDNSSnapshot()

RewriteMeshDNSSnapshot re-persists the last projected record table with a fresh writtenAt stamp and an UNCHANGED generation. It backs the periodic freshness heartbeat (see capture.MeshDNSHeartbeat): the capture reconciler is event-driven with no short resync, so on a quiet cluster the snapshot would otherwise look stale to the resolver daemon and its snapshot-age gauge could not distinguish "nothing changed" from "the agent is wedged".

No-op when mesh DNS is off, and — importantly — before the first projection: writing an empty table would flip the daemon ready and NXDOMAIN the whole mesh.

func (*SnapshotCache) SetAuthzSidecar 

func (c *SnapshotCache) SetAuthzSidecar(timeout time.Duration, failureModeAllow bool)

SetAuthzSidecar configures the node-local authz sidecar ext_authz entry (proposal 027). Called once at startup, before listener generation.

func (*SnapshotCache) SetCaptureAuthorities 

func (c *SnapshotCache) SetCaptureAuthorities(authorities map[string]string)

SetCaptureAuthorities replaces the mesh service -> cluster.local FQDN map (fed by the agent's capture reconciler from the generated mesh Services) and signals a snapshot rebuild on change so cap_http re-derives.

func (*SnapshotCache) SetCaptureEnabled 

func (c *SnapshotCache) SetCaptureEnabled(v bool)

SetCaptureEnabled turns transparent capture (proposal 018, Phase 3a) on. Call once before the manager starts: it gates per-pod capture listener generation and the cap_http route table.

func (*SnapshotCache) SetCaptureRedirectAll 

func (c *SnapshotCache) SetCaptureRedirectAll(v bool)

SetCaptureRedirectAll enables the redirect-all + ORIGINAL_DST passthrough mode (proposal 022, M2a spike). Must be called after SetCaptureEnabled(true): redirect-all only makes sense when the capture listener is being generated. Call once before the manager starts; read without locking.

func (*SnapshotCache) SetCaptureTCPServices 

func (c *SnapshotCache) SetCaptureTCPServices(services []capture.CaptureTCPService)

SetCaptureTCPServices implements capture.AuthoritySink: it replaces the list of non-HTTP mesh services that need per-ClusterIP TCP floor chains on the capture listener. A change rebuilds all per-pod capture listeners (they embed the TCP chains) and regenerates the xDS snapshot so Envoy picks up the new filter chains.

func (*SnapshotCache) SetEdgeGateways 

func (c *SnapshotCache) SetEdgeGateways(gateways []EdgeGatewayEntry)

SetEdgeGateways replaces the per-Gateway routing set (proposal 021 Phase 2). When non-empty the snapshot generates per-Gateway listeners (bound on InternalPorts) and per-Gateway route tables instead of the shared edge_http/edge_https listeners. When empty, the cache falls back to Phase 1 (shared-listener) behavior. Thread-safe; triggers a dependency rebuild and snapshot push on change.

func (*SnapshotCache) SetEdgeGeoip 

func (c *SnapshotCache) SetEdgeGeoip(gc proxy.GeoipConfig, xffTrustedHops uint32)

SetEdgeGeoip configures the edge geo pipeline (proposal 028): the reserved x-geo-* strip always (spoof protection), plus the geoip filter when a database is configured. Boot-time, before listener generation.

func (*SnapshotCache) SetEdgeHTTPRedirect 

func (c *SnapshotCache) SetEdgeHTTPRedirect(enabled bool)

SetEdgeHTTPRedirect controls whether the edge's plain-HTTP port listener emits a 301 HTTP→HTTPS redirect (true) or serves routes directly (false, the default). Called by the Gateway API reconciler on every reconcile based on whether any Gateway in the current aether GatewayClass set carries the gateway.aether.io/http-redirect: "true" annotation. Safe for concurrent use.

func (*SnapshotCache) SetEdgeIdentity 

func (c *SnapshotCache) SetEdgeIdentity(spiffeID, trustDomain string)

SetEdgeIdentity records the edge proxy's single SVID name and trust domain so the edge service clusters' upstream mTLS presents that identity and validates the trust-domain bundle (served by SPIRE over the spire_agent SDS cluster). The node proxy sets these via the SPIRE bridge instead. Must be called before the manager starts.

func (*SnapshotCache) SetEdgeMode 

func (c *SnapshotCache) SetEdgeMode(httpPort uint32)

SetEdgeMode switches the cache to edge (north-south ingress) snapshot composition and binds the edge listener to httpPort. Must be called before the manager starts; the mode is read without locking on every snapshot build.

func (*SnapshotCache) SetEdgeReadinessPort 

func (c *SnapshotCache) SetEdgeReadinessPort(port uint32)

SetEdgeReadinessPort sets the port the dedicated always-bound readiness listener binds (the kubelet probe target). Must be called before the manager starts. A zero value leaves the default (proxy.DefaultEdgeReadinessPort) in effect.

func (*SnapshotCache) SetEdgeTCPRoutes 

func (c *SnapshotCache) SetEdgeTCPRoutes(routes []proxy.EdgeL4TCPRoute)

SetEdgeTCPRoutes replaces the edge's TCP listener routes (one per Gateway TCP listener port). On change it updates the dependency set and signals a rebuild so the new tcp_proxy listeners appear in the snapshot.

func (*SnapshotCache) SetEdgeTLSMode 

func (c *SnapshotCache) SetEdgeTLSMode(httpsPort uint32)

SetEdgeTLSMode enables downstream TLS termination: the edge serves a TLS listener on httpsPort (certs per VirtualHost via SDS). Must be called before the manager starts. The HTTP→HTTPS redirect is separately controlled per-Gateway via SetEdgeHTTPRedirect (driven by the gateway.aether.io/http-redirect annotation).

func (*SnapshotCache) SetEdgeTLSRoutes 

func (c *SnapshotCache) SetEdgeTLSRoutes(routes []proxy.EdgeL4TLSRoute)

SetEdgeTLSRoutes replaces the edge's TLS passthrough listener routes (one per Gateway TLS listener port). On change it updates the dependency set and signals a rebuild.

func (*SnapshotCache) SetEdgeTLSSecrets 

func (c *SnapshotCache) SetEdgeTLSSecrets(ctx context.Context, certs map[string]EdgeTLSCert) error

SetEdgeTLSSecrets replaces the edge's downstream TLS certs (keyed by SDS name) and serves them over the ADS SecretType channel for Envoy to select by SNI.

func (*SnapshotCache) SetEmitStatsPod 

func (c *SnapshotCache) SetEmitStatsPod(enabled bool)

SetEmitStatsPod enables per-pod labels on the aether_stats request counter (--stats-emit-pod flag). Must be called before the manager starts; the flag is read without locking on every listener build.

func (*SnapshotCache) SetImportedServiceChainFilters 

func (c *SnapshotCache) SetImportedServiceChainFilters(filters map[string]proxy.ExtensionFilter)

SetImportedServiceChainFilters replaces the peer-cluster-imported service chain filters (proposal 026). Local wins on a per-service collision, like routes.

func (*SnapshotCache) SetImportedServiceRoutes 

func (c *SnapshotCache) SetImportedServiceRoutes(routes map[string][]proxy.GammaRoute)

SetImportedServiceRoutes replaces the GAMMA rules IMPORTED from peer clusters (proposal 026): config a remote cluster authored for a service, fetched from the registrar (ConfigImporter) and materialized read-only. Merged with local routes at read time — a LOCAL HTTPRoute for the same service wins (a cluster's own config is authoritative for itself). Signals a scoped-snapshot rebuild on change.

func (*SnapshotCache) SetKubeletPodsDir 

func (c *SnapshotCache) SetKubeletPodsDir(dir string)

SetKubeletPodsDir sets kubelet's pod-volumes directory (--kubelet-pods-dir), the host bridge to a workload's Unix socket (proposal 034). An empty dir is the operator's off switch: annotated pods then get TCP delivery. Must be called before the manager starts; read without locking on every listener build.

func (*SnapshotCache) SetMeshDNSRecords 

func (c *SnapshotCache) SetMeshDNSRecords(records map[string]string)

SetMeshDNSRecords persists the mesh service -> IP table (from the mesh-Service reconciler) to the snapshot file the standalone resolver daemon watches. No-op when mesh DNS is off (empty path). A persist error is logged, never fatal.

The write always happens (it re-stamps the envelope's writtenAt, which is the daemon's freshness signal), but the generation only advances when the record CONTENT changed, so a heartbeat rewrite is distinguishable from a real update.

func (*SnapshotCache) SetMeshDNSSnapshotPath 

func (c *SnapshotCache) SetMeshDNSSnapshotPath(path string)

SetMeshDNSSnapshotPath sets the host-persistent file the mesh service->IP record table is written to (proposal 018, mesh-global FQDN; issue #578), or empty when mesh DNS is off. The agent no longer serves DNS: the standalone aether-mesh-dns DaemonSet watches this file and serves :18054, and the CNI DNATs each pod's :53 straight to it. The cache only persists records here.

func (*SnapshotCache) SetMeshDomain 

func (c *SnapshotCache) SetMeshDomain(domain string)

SetMeshDomain overrides the default mesh domain (--mesh-domain flag). Must be called before the manager starts; the domain is read without locking on every snapshot build.

func (*SnapshotCache) SetNodeIdentity 

func (c *SnapshotCache) SetNodeIdentity(ctx context.Context, nodeSpiffeID string) error

SetNodeIdentity records the agent's node SPIFFE ID (served by the SPIRE bridge as the node SVID) and regenerates the snapshot. Outbound clusters reference it as the no-match client-certificate secret for upstream mTLS (used by active health-check probes and other node-originated connections); until it is set, upstream mTLS injection is skipped. Idempotent: a no-op when the value is unchanged.

func (*SnapshotCache) SetNodeLocality 

func (c *SnapshotCache) SetNodeLocality(region, zone string)

SetNodeLocality records the node's topology labels once resolved (CNI server PreListen) and signals a dependency change so the scoped snapshot is rebuilt with locality-aware EDS priorities — the initial snapshot may have been generated before the labels were known.

func (*SnapshotCache) SetRegistry 

func (c *SnapshotCache) SetRegistry(reg registry.Registry)

SetRegistry stores the service registry for use in HasRegistryService. Called once from NewAgentXdsServer before the manager starts; safe for concurrent use after that point (registry is only read, never replaced).

func (*SnapshotCache) SetRouteTargetPorts 

func (c *SnapshotCache) SetRouteTargetPorts(ports map[string][]uint32)

SetRouteTargetPorts replaces the per-route-target real Service port map (proposal 023 M2). Keyed by the same "<ns>/<svc>" route-target key as SetServiceRoutes; fed by the gamma reconciler from each route's parentRef port. captureVhosts emits a "<svc>.<ns>.svc.cluster.local:<port>" domain per listed port so a client dialing the route target's REAL port host-matches its vhost. Signals a scoped-snapshot rebuild on change. A separate side-map (not folded into GammaRoute) keeps the rule-equality plumbing untouched and matches the captureAuthorities pattern.

func (*SnapshotCache) SetSecrets 

func (c *SnapshotCache) SetSecrets(ctx context.Context, secrets []*tlsv3.Secret) error

SetSecrets replaces all cached secrets and regenerates the snapshot. Secret resources contain TLS certificates (SVIDs) and validation contexts (trust bundles) sourced from SPIRE.

func (*SnapshotCache) SetServiceChainFilters 

func (c *SnapshotCache) SetServiceChainFilters(filters map[string]proxy.ExtensionFilter)

SetServiceChainFilters replaces the service-wide ALWAYS-ON extension filters (proposal 025 M4 CHAIN scope), keyed by "<ns>/<svc>". Fed by the gamma reconciler from CHAIN-scope HTTPFilters with a Service targetRef; at most one per service. Enabled at each service's capture vhost (vhost-level typed_per_filter_config).

func (*SnapshotCache) SetServiceInboundFilters 

func (c *SnapshotCache) SetServiceInboundFilters(filters map[string]proxy.ExtensionFilter)

SetServiceInboundFilters replaces the destination-side (INBOUND scope, 027 M3) filters, keyed by "<ns>/<svc>". Enabled on the target service's own pods' inbound listeners; requires the authz sidecar (dropped with a warning otherwise).

func (*SnapshotCache) SetServiceRoutes 

func (c *SnapshotCache) SetServiceRoutes(routes map[string][]proxy.GammaRoute)

SetServiceRoutes replaces the GAMMA east-west L7 rules (HTTPRoute parentRef= Service, proposal 018 Phase 2). A depended-on service's rule backends enter the dependency set (so their EDS clusters generate) and its outbound vhost is enriched. Signals a scoped-snapshot rebuild on change.

func (*SnapshotCache) SetSpireEnabled 

func (c *SnapshotCache) SetSpireEnabled(enabled bool)

SetSpireEnabled records whether SPIRE-backed mTLS is on. The agent calls this with cfg.SpireEnabled before the manager starts. When false the per-pod inbound listener is built cleartext (no downstream mTLS transport socket), matching the outbound clusters, which already go cleartext without a node SVID — so the mesh data path is routable with SPIRE off. Read without locking on every listener build.

func (*SnapshotCache) SetStaticDependencies 

func (c *SnapshotCache) SetStaticDependencies(services []string)

SetStaticDependencies replaces the fixed (edge) dependency set with the given services and signals a dependency change if it differs, so the scoped registry watch and the cluster snapshot rebuild to exactly the exposed set.

func (*SnapshotCache) SetTCPServiceRoutes 

func (c *SnapshotCache) SetTCPServiceRoutes(routes map[string][]proxy.L4ServiceRoute)

SetTCPServiceRoutes replaces the TCPRoute-derived per-service L4 rules (proposal 018, Phase 3b). On change, it regenerates all per-pod capture listeners (which embed per-ClusterIP TCP floor chains) and triggers a full snapshot rebuild.

func (*SnapshotCache) SetTLSServiceRoutes 

func (c *SnapshotCache) SetTLSServiceRoutes(routes map[string][]proxy.L4ServiceRoute)

SetTLSServiceRoutes replaces the TLSRoute-derived per-service SNI rules (proposal 018, Phase 3b). On change, regenerates capture listeners and signals a snapshot rebuild.

func (*SnapshotCache) SetUDPServiceRoutes 

func (c *SnapshotCache) SetUDPServiceRoutes(routes map[string][]proxy.L4Backend)

SetUDPServiceRoutes replaces the UDPRoute-derived per-service UDP routes (proposal 018, Phase 3b). On change, regenerates all per-pod UDP capture listeners (each pod gets one UDP listener covering all services' UDP routes) and triggers a full snapshot rebuild so Envoy picks up the new listeners and their backend UDP clusters.

func (*SnapshotCache) SetUDSServicePolicies 

func (c *SnapshotCache) SetUDSServicePolicies(policies map[string]string)

SetUDSServicePolicies replaces the service-scoped UDS delivery map (proposal 034 Phase 1b), keyed by "<ns>/<svc>". A pod of a listed service is delivered to the declared socket unless it carries its own uds-socket annotation (which wins).

On change the affected pods' delivery clusters are rebuilt and pushed: the policy is authored independently of the workload, so nothing else would.

func (*SnapshotCache) SetVirtualHosts 

func (c *SnapshotCache) SetVirtualHosts(vhosts []VirtualHost)

SetVirtualHosts replaces the edge's exposed virtual hosts. It scopes the dependency set to the union of every route's backend service (plus L4 route backends) and rebuilds the snapshot's route table — including when only the hostnames or matches changed (the service set, and therefore the dependency set, didn't).

func (*SnapshotCache) SetWaypointConfig 

func (c *SnapshotCache) SetWaypointConfig(enabled bool, tunnelPort uint32)

SetWaypointConfig enables the split-horizon east/west waypoint rewrite (proposal 019) and sets the node tunnel port dialed for cross-cluster endpoints. Off by default; must be called before the manager starts (read without locking on every cluster build).

func (*SnapshotCache) SignalIfRetentionExpired 

func (c *SnapshotCache) SignalIfRetentionExpired()

SignalIfRetentionExpired emits a dependency-change signal when any retained (absent) service has outlived the retention grace, so the refresher runs a reload that prunes it. Pruning is otherwise reload-driven — and under demand-scoped watches a node in steady state receives NO events once a service leaves its dependency set, so the retained empty cluster/vhost would shadow the on-demand catch-all forever (fast 503 instead of ODCDS; observed in vivo 2026-06-12: svc-4's pods moved off a node and the stale vhost stuck). The refresher calls this from its periodic prune tick.

func (*SnapshotCache) VirtualHosts 

func (c *SnapshotCache) VirtualHosts() []types.Resource

VirtualHosts returns all cached virtual host resources as a flat slice. Virtual hosts define routing rules for outbound traffic to services. Thread-safe.

type VirtualHost 

type VirtualHost struct {
	Hosts  []string
	Routes []Route
	// TLSSecret is the provider-prefixed SDS name of the cert presented for this
	// virtual host's hosts (empty = no cert). Cert bytes are supplied separately
	// via SetEdgeTLSSecrets.
	TLSSecret string
	// Gateways are the "<ns>/<name>" keys of the Gateways this route attaches to
	// (its parentRefs). Under proposal 021 Phase 2 it scopes which per-Gateway route
	// tables get this vhost — assignment is by ATTACHMENT, not by cert. Empty means
	// unscoped (Phase 1 shared listener, or attach-to-all fallback).
	Gateways []string
}

VirtualHost is the cache's projection of a Gateway API HTTPRoute into edge Envoy virtual hosts. (The VirtualHost CRD, proposal 017, was retired and subsumed by HTTPRoute per proposal 018 — this Go type keeps the name but is no longer backed by any CRD.) It is a set of external hosts carrying an ordered list of path-matched routes to backend services, optionally served under a downstream cert. Empty Routes makes it inert. Empty Hosts is NOT inert — per Gateway API a hostname-less route matches every host on its listener, so it is served via the edge's catch-all "*" vhost (see buildEdgeVhostsLocked).

Source Files

View all Source files

Directories

Path Synopsis
Package cachemetrics holds the agent xDS snapshot-generation instruments.
 Package cachemetrics holds the agent xDS snapshot-generation instruments.
Package snapversion generates xDS snapshot version strings for the agent cache.
 Package snapversion generates xDS snapshot version strings for the agent cache.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.