privnet

package

v0.9.2 Latest Latest Go to latest Published: Nov 6, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/GLINCKER/levelrail

Links

Open Source Insights

Documentation ¶

Overview ¶

Package privnet models VPC-like private networks and security-group style allow rules between apps, and answers which app pairs can talk.

Index ¶

Constants
func AppOwners(prefix string, apps []store.App, containers []docker.ContainerState) map[string]string
func Load(ctx context.Context, src Source) ([]Network, []Rule, []store.App, error)
func MeshHidden(nets []Network, rules []Rule) map[string]bool
func NetworkDockerName(prefix, id string) string
func PairKey(a, b string) [2]string
func RuleDockerName(prefix, id string) string
func SharedNetworks(prefix string, apps []store.App, containers []docker.ContainerState) map[[2]string]bool
type App
type Controller
- func NewController(src Source, rt Runtime, prefix, instanceID string) *Controller
- func (c *Controller) ForNode(nodeID string) *Controller
- func (c *Controller) Name() string
- func (c *Controller) Reconcile(ctx context.Context) (reconcile.Result, error)
type Edge
- func Evaluate(apps []App, nets []Network, rules []Rule) []Edge
type Link
- func Links(prefix string, nets []Network, rules []Rule) []Link
type Network
type Rule
type Runtime
type Source

Constants ¶

View Source

const (
	ViaNetwork = "network"
	ViaRule    = "rule"
	ViaNone    = ""
)

Edge reasons.

View Source

const MaxBlockedEdges = 200

MaxBlockedEdges caps how many blocked pairs Evaluate returns.

Variables ¶

This section is empty.

Functions ¶

func AppOwners ¶

func AppOwners(prefix string, apps []store.App, containers []docker.ContainerState) map[string]string

AppOwners maps container ID to app ID using the per-app network each container is attached to.

func Load ¶

func Load(ctx context.Context, src Source) ([]Network, []Rule, []store.App, error)

Load reads networks, rules and apps from the store in evaluator form.

func MeshHidden ¶

func MeshHidden(nets []Network, rules []Rule) map[string]bool

MeshHidden returns app IDs that must not be published to mesh DNS: members of a default-deny network with no allow rule that names them.

func NetworkDockerName ¶

func NetworkDockerName(prefix, id string) string

NetworkDockerName is the Docker network backing a private network.

func PairKey ¶

func PairKey(a, b string) [2]string

PairKey is the map key SharedNetworks uses for an unordered pair.

func RuleDockerName ¶

func RuleDockerName(prefix, id string) string

RuleDockerName is the Docker network backing an allow rule.

func SharedNetworks ¶

func SharedNetworks(prefix string, apps []store.App, containers []docker.ContainerState) map[[2]string]bool

SharedNetworks returns, per unordered app pair, whether some container of each app is attached to one common Docker network besides per-app ones.

Types ¶

type App ¶

type App struct {
	ID        string
	Name      string
	ProjectID string
	NodeID    string
}

App is the slice of an app the evaluator needs.

type Controller ¶

type Controller struct {
	// contains filtered or unexported fields
}

Controller keeps Docker networks in line with private networks and rules.

func NewController ¶

func NewController(src Source, rt Runtime, prefix, instanceID string) *Controller

NewController builds the enforcer. prefix must match the application controller's network prefix so per-app networks resolve to app IDs.

func (*Controller) ForNode ¶

func (c *Controller) ForNode(nodeID string) *Controller

ForNode names the controller for one remote node's runtime.

func (*Controller) Name ¶

func (c *Controller) Name() string

Name implements reconcile.Controller.

func (*Controller) Reconcile ¶

func (c *Controller) Reconcile(ctx context.Context) (reconcile.Result, error)

Reconcile implements reconcile.Controller.

type Edge ¶

type Edge struct {
	A         string
	B         string
	Allowed   bool
	Via       string
	ViaName   string
	RuleID    string
	CrossNode bool
}

Edge is the verdict for one unordered app pair (A sorts before B).

func Evaluate ¶

func Evaluate(apps []App, nets []Network, rules []Rule) []Edge

Evaluate returns every allowed pair plus the blocked pairs worth showing: apps in the same project where at least one belongs to a private network.

type Link ¶

type Link struct {
	Name string
	Apps []string
}

Link is one Docker network the enforcer keeps and the apps attached to it.

func Links ¶

func Links(prefix string, nets []Network, rules []Rule) []Link

Links returns the Docker networks that should exist: one per private network (members attached unless default-deny) and one per rule.

type Network ¶

type Network struct {
	ID          string
	Name        string
	DefaultDeny bool
	Members     []string
}

Network is a private network and its member app IDs.

type Rule ¶

type Rule struct {
	ID   string
	From string
	To   string
}

Rule allows two apps to reach each other across network boundaries.

type Runtime ¶

type Runtime interface {
	EnsureNetwork(ctx context.Context, name string) (string, error)
	RemoveNetwork(ctx context.Context, name string) error
	ListNetworksByPrefix(ctx context.Context, prefix string) ([]docker.NetworkInfo, error)
	ListByPrefix(ctx context.Context, prefix string) ([]docker.ContainerState, error)
	NetworkConnect(ctx context.Context, network, containerID string) error
	NetworkDisconnect(ctx context.Context, network, containerID string, force bool) error
}

Runtime is the Docker surface the controller needs.

type Source ¶

type Source interface {
	ListApps(ctx context.Context) ([]store.App, error)
	ListPrivateNetworks(ctx context.Context) ([]store.PrivateNetwork, error)
	ListPrivateNetworkRules(ctx context.Context) ([]store.PrivateNetworkRule, error)
}

Source is the store surface the controller and the API both read.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL