controller

package
v0.25.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 12, 2026 License: Apache-2.0 Imports: 57 Imported by: 0

Documentation

Overview

Package controller implements the Kubernetes node controller for CIDR allocation.

Package controller implements the GatewayPool controller for managing gateway node pools.

Package controller implements the Peering aggregation controller.

Package controller implements site labeling and pod CIDR assignment.

Index

Constants

View Source 
const (
	ManagedKubeProxyNodeLabelKey   = "net.unbounded-cloud.io/kube-proxy"
	ManagedKubeProxyNodeLabelValue = "managed"
)
View Source 
const (

	// WireGuardPubKeyAnnotation is the annotation key for a node's WireGuard public key
	WireGuardPubKeyAnnotation = "net.unbounded-cloud.io/wg-pubkey"

	// WireGuardPortAnnotation is the annotation key for a gateway node's
	// assigned WireGuard port (used for gateway-to-gateway peering).
	WireGuardPortAnnotation = "net.unbounded-cloud.io/wireguard-port"

	// TunnelMTUAnnotation is the annotation key for a node's detected
	// maximum tunnel MTU (default-route MTU minus encapsulation
	// overhead). The controller compares this against the configured node MTU
	// to surface warnings when the configured value is too high.
	TunnelMTUAnnotation = "net.unbounded-cloud.io/tunnel-mtu"

	// ProtectionFinalizer prevents deletion of Sites and GatewayPools that
	// still have active nodes assigned. The controller adds this finalizer
	// when nodes are present and removes it when the last node is unassigned.
	ProtectionFinalizer = "net.unbounded-cloud.io/protection"
)
View Source 
const DefaultKubeProxyRepository = "registry.k8s.io/kube-proxy"

DefaultKubeProxyRepository is where the managed kube-proxy image comes from when neither the configuration nor the cluster's own kube-proxy names one.

View Source 
const (
	NodeAgentPodNodeNameIndex = "unboundedNetNodeName"
)

Variables

View Source 
var (
	SiteNodesGauge = promauto.NewGaugeVec(prometheus.GaugeOpts{
		Namespace: controllerNamespace,
		Name:      "site_nodes_total",
		Help:      "Number of nodes in each site.",
	}, []string{"site"})

	SiteNodeSlicesGauge = promauto.NewGaugeVec(prometheus.GaugeOpts{
		Namespace: controllerNamespace,
		Name:      "site_node_slices_total",
		Help:      "Number of SiteNodeSlice objects per site.",
	}, []string{"site"})

	PodCIDRAllocations = promauto.NewCounter(prometheus.CounterOpts{
		Namespace: controllerNamespace,
		Name:      "pod_cidr_allocations_total",
		Help:      "Total pod CIDR allocations.",
	})

	PodCIDRReleases = promauto.NewCounter(prometheus.CounterOpts{
		Namespace: controllerNamespace,
		Name:      "pod_cidr_releases_total",
		Help:      "Total pod CIDR releases.",
	})

	PodCIDRExhaustion = promauto.NewCounter(prometheus.CounterOpts{
		Namespace: controllerNamespace,
		Name:      "pod_cidr_exhaustion_total",
		Help:      "Total pod CIDR pool exhaustion events.",
	})

	GatewayPoolNodesGauge = promauto.NewGaugeVec(prometheus.GaugeOpts{
		Namespace: controllerNamespace,
		Name:      "gateway_pool_nodes_total",
		Help:      "Number of nodes in each gateway pool.",
	}, []string{"pool"})

	GatewayPoolReachableSitesGauge = promauto.NewGaugeVec(prometheus.GaugeOpts{
		Namespace: controllerNamespace,
		Name:      "gateway_pool_reachable_sites_total",
		Help:      "Number of reachable sites per gateway pool.",
	}, []string{"pool"})

	GatewayPoolRoutesGauge = promauto.NewGaugeVec(prometheus.GaugeOpts{
		Namespace: controllerNamespace,
		Name:      "gateway_pool_routes_total",
		Help:      "Number of routes per gateway pool.",
	}, []string{"pool"})
)

Resource state metrics -- set after each successful reconciliation.

View Source 
var (
	CRDEnsureDuration = promauto.NewHistogramVec(prometheus.HistogramOpts{
		Namespace: controllerNamespace,
		Name:      "crd_ensure_duration_seconds",
		Help:      "Duration of CRD ensure operations in seconds.",
		Buckets:   metrics.DefaultDurationBuckets,
	}, []string{"crd"})

	CRDEnsureErrors = promauto.NewCounterVec(prometheus.CounterOpts{
		Namespace: controllerNamespace,
		Name:      "crd_ensure_errors_total",
		Help:      "Total CRD ensure errors by CRD name.",
	}, []string{"crd"})
)

CRD management metrics.

Functions

func ManagedKubeProxyImage added in v0.24.0 

func ManagedKubeProxyImage(ctx context.Context, clientset kubernetes.Interface, configured string) (string, error)

ManagedKubeProxyImage works out the image the managed kube-proxy DaemonSets run from the configured --managed-kube-proxy-image value:

  • A reference with a tag or digest is used as-is, without reading the cluster.
  • A reference without one takes the tag of the image kube-system/kube-proxy runs, so a mirror of the provider's image keeps the provider's version. Without a provider tag, the registry is searched for the API server's major.minor.patch version, preferring the highest numeric maintenance suffix over the exact version tag.
  • Empty reuses the kube-system/kube-proxy image, and otherwise falls back to registry.k8s.io/kube-proxy. An unversioned provider image supplies its repository, but still needs the API server version and registry search.

Provider reads fall back after retries. Fallback selection requires a valid API server version and a matching registry tag; failures return errors rather than choosing latest. Explicit and provider-supplied versions are used as-is. The image is worked out once, when the controller starts leading.

func NodeAgentPodNodeNameIndexFunc added in v0.19.0 

func NodeAgentPodNodeNameIndexFunc(obj interface{}) ([]string, error)

func NodeSiteLabel added in v0.1.23 

func NodeSiteLabel(node *corev1.Node) string

NodeSiteLabel returns the site a Node belongs to, preferring the canonical label (unbounded-cloud.io/site) and falling back to the deprecated net.unbounded-cloud.io/site.

func ResolveNodeExternalIPsAt added in v0.5.0 

func ResolveNodeExternalIPsAt(node *corev1.Node, now time.Time) ([]string, time.Time, error)

ResolveNodeExternalIPsAt returns declared, provider, or unexpired discovered addresses in precedence order.

Types

type AssignmentAllocatorDebugState 

type AssignmentAllocatorDebugState struct {
	Key             string                        `json:"key"`
	SiteName        string                        `json:"siteName"`
	AssignmentIndex int                           `json:"assignmentIndex"`
	CidrBlocks      []string                      `json:"cidrBlocks"`
	NodeRegexes     []string                      `json:"nodeRegexes,omitempty"`
	Allocator       allocator.AllocatorDebugState `json:"allocator"`
}

AssignmentAllocatorDebugState contains debug info for one assignment allocator.

type Controller 

type Controller struct {
	// contains filtered or unexported fields
}

Controller manages CIDR allocation for Kubernetes nodes.

func NewController 

func NewController(
	clientset kubernetes.Interface,
	informerFactory informers.SharedInformerFactory,
	alloc *allocator.Allocator,
	nodeRegexPattern string,
	recorder record.EventRecorder,
) (*Controller, error)

NewController creates a new node CIDR controller. If nodeRegexPattern is non-empty, only nodes matching the regex will be processed.

func (*Controller) DryRun 

func (c *Controller) DryRun(ctx context.Context) error

DryRun performs a single evaluation pass and prints proposed changes without applying them.

func (*Controller) InformerSynced 

func (c *Controller) InformerSynced() bool

InformerSynced returns true if the informer cache has been synced.

func (*Controller) InitializeAllocator 

func (c *Controller) InitializeAllocator(ctx context.Context) error

InitializeAllocator scans all existing nodes and marks their CIDRs as allocated. Note: This marks CIDRs from ALL nodes as allocated, regardless of the node filter, to avoid allocating CIDRs that are already in use by nodes outside the filter.

func (*Controller) Run 

func (c *Controller) Run(ctx context.Context, workers int) error

Run starts the controller.

type GatewayPoolController 

type GatewayPoolController struct {
	// contains filtered or unexported fields
}

GatewayPoolController manages GatewayPool status based on node selector matches.

func NewGatewayPoolController 

func NewGatewayPoolController(
	clientset kubernetes.Interface,
	dynamicClient dynamic.Interface,
	dynamicInformerFactory dynamicinformer.DynamicSharedInformerFactory,
	nodeInformerFactory informers.SharedInformerFactory,
) (*GatewayPoolController, error)

NewGatewayPoolController creates a new gateway pool controller.

func (*GatewayPoolController) Run 

func (gc *GatewayPoolController) Run(ctx context.Context, workers int) error

Run starts the gateway pool controller.

type LeaseFence added in v0.9.0 

type LeaseFence interface {
	ValidUntil() time.Time
}

LeaseFence reports how long the current process can rely on holding the leader lease. ValidUntil returns the zero time when the lease is not held.

type ManagedKubeProxyController added in v0.1.4 

type ManagedKubeProxyController struct {
	// contains filtered or unexported fields
}

ManagedKubeProxyController reconciles kube-proxy DaemonSets for unbounded nodes that are not already covered by the cluster provider's kube-proxy.

func NewManagedKubeProxyController added in v0.1.4 

func NewManagedKubeProxyController(
	clientset kubernetes.Interface,
	dynamicInformerFactory dynamicinformer.DynamicSharedInformerFactory,
	informerFactory informers.SharedInformerFactory,
	options ManagedKubeProxyOptions,
) (*ManagedKubeProxyController, error)

NewManagedKubeProxyController creates a controller for managed kube-proxy.

func (*ManagedKubeProxyController) Run added in v0.1.4 

func (c *ManagedKubeProxyController) Run(ctx context.Context, workers int) error

Run starts the managed kube-proxy controller.

type ManagedKubeProxyOptions added in v0.1.4 

type ManagedKubeProxyOptions struct {
	Namespace string
	Image     string
}

ManagedKubeProxyOptions configures the kube-proxy DaemonSets created for unbounded-managed nodes.

type NodeAssignmentController added in v0.19.0 

type NodeAssignmentController struct {
	// contains filtered or unexported fields
}

NodeAssignmentController replaces only node-agent Pods whose acknowledged effective assignment differs from the desired labels on their Node.

func NewNodeAssignmentController added in v0.19.0 

func NewNodeAssignmentController(
	clientset kubernetes.Interface,
	nodeInformer coreinformers.NodeInformer,
	podInformer coreinformers.PodInformer,
) (*NodeAssignmentController, error)

func (*NodeAssignmentController) Run added in v0.19.0 

func (c *NodeAssignmentController) Run(ctx context.Context, workers int) error

type PeeringAggregationController 

type PeeringAggregationController struct {
	// contains filtered or unexported fields
}

PeeringAggregationController updates GatewayPool status based on Peering relationships.

func NewPeeringAggregationController 

func NewPeeringAggregationController(
	dynamicClient dynamic.Interface,
	dynamicInformerFactory dynamicinformer.DynamicSharedInformerFactory,
) (*PeeringAggregationController, error)

NewPeeringAggregationController creates a new peering aggregation controller.

func (*PeeringAggregationController) Run 

func (pc *PeeringAggregationController) Run(ctx context.Context, workers int) error

Run starts the peering aggregation controller.

type SiteController 

type SiteController struct {
	// contains filtered or unexported fields
}

SiteController manages site labeling and pod CIDR assignment for nodes.

func NewSiteController 

func NewSiteController(
	clientset kubernetes.Interface,
	dynamicClient dynamic.Interface,
	dynamicInformerFactory dynamicinformer.DynamicSharedInformerFactory,
	nodeInformerFactory informers.SharedInformerFactory,
) (*SiteController, error)

NewSiteController creates a new site controller.

func (*SiteController) DebugState 

func (sc *SiteController) DebugState() SiteControllerDebugState

DebugState returns a snapshot of the site controller's internal state.

func (*SiteController) GetNodeLister 

func (sc *SiteController) GetNodeLister() corev1listers.NodeLister

GetNodeLister returns the node lister for use by other components.

func (*SiteController) GetSiteForNode 

func (sc *SiteController) GetSiteForNode(node *corev1.Node) string

GetSiteForNode looks up which site a node belongs to using the cached sites. This is a faster lookup for use by other components.

func (*SiteController) GetSiteInformer 

func (sc *SiteController) GetSiteInformer() cache.SharedIndexInformer

GetSiteInformer returns the site informer for use by other components.

func (*SiteController) Ready added in v0.3.0 

func (sc *SiteController) Ready() <-chan struct{}

Ready is closed after informer sync, initial reconciliation, and allocator seeding.

func (*SiteController) Run 

func (sc *SiteController) Run(ctx context.Context, workers int) error

Run starts the site controller

func (*SiteController) SetLeaseFence added in v0.9.0 

func (sc *SiteController) SetLeaseFence(fence LeaseFence)

SetLeaseFence makes pod CIDR allocation conditional on holding the leader lease. It must be called before Run.

type SiteControllerDebugState 

type SiteControllerDebugState struct {
	HasSynced       bool                            `json:"hasSynced"`
	AllocatorsReady bool                            `json:"allocatorsReady"`
	WorkqueueLength int                             `json:"workqueueLength"`
	SiteCount       int                             `json:"siteCount"`
	Allocators      []AssignmentAllocatorDebugState `json:"allocators"`
	InformerCounts  map[string]int                  `json:"informerCounts"`
}

SiteControllerDebugState contains debug info for the site controller.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.