Documentation
¶
Index ¶
- func CompileEgressRuleset(policy model.NetPolicy, resolve NodeResolver, opts CompileOptions) (string, error)
- func CompileIngressInputRules(policy model.NetPolicy, resolve NodeResolver) ([]network.NFTInputRule, error)
- func ExpandGroupPolicies(policies []model.GroupNetPolicy, resolved map[string][]string) map[string]model.NetPolicy
- func NormalizePolicy(policy model.NetPolicy, resolve NodeResolver) (model.NetPolicy, error)
- type CompileOptions
- type DomainSet
- type EgressPlan
- type Graph
- type GraphEdge
- type GraphExternal
- type GraphNode
- type NodeResolver
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CompileEgressRuleset ¶
func CompileEgressRuleset(policy model.NetPolicy, resolve NodeResolver, opts CompileOptions) (string, error)
CompileEgressRuleset renders a per-node egress policy into a deterministic nftables batch. It intentionally owns a separate lattice_policy table so this first committed path cannot conflict with the existing lattice_guard input table used by baseline node firewall inputs.
func CompileIngressInputRules ¶
func CompileIngressInputRules(policy model.NetPolicy, resolve NodeResolver) ([]network.NFTInputRule, error)
CompileIngressInputRules extracts the ingress side of a per-node NetPolicy into typed lattice_guard input rules. It intentionally does not render nft syntax directly: the Network Guard renderer owns the single input chain so DNS/proxy/ACL providers cannot create competing default-drop hooks.
func ExpandGroupPolicies ¶
func ExpandGroupPolicies(policies []model.GroupNetPolicy, resolved map[string][]string) map[string]model.NetPolicy
ExpandGroupPolicies materializes group-scoped policies into one per-node model.NetPolicy per node covered by any policy's scope group. A rule whose remote is a group (NetRefGroup) fans out to one node-ref rule per resolved remote member, so the UNCHANGED per-node compiler never sees a group ref.
Policies apply in (Priority, ID) order; within a policy, rule order is preserved. resolved maps a group ID to its resolved member node IDs (as produced by internal/groups.ResolveAll).
The returned policies are tagged GroupDerived=true and keyed by target node ID. Because they contain CONCRETE node refs, the compiled plan SHA changes whenever membership changes — closing the plan-staleness gap by construction (a node joining/leaving a remote group changes the rule set, hence the SHA).
func NormalizePolicy ¶
Types ¶
type CompileOptions ¶
type EgressPlan ¶
type EgressPlan struct {
Ruleset string `json:"ruleset"`
DomainSets []DomainSet `json:"domain_sets,omitempty"`
}
func CompileEgressPlan ¶
func CompileEgressPlan(policy model.NetPolicy, resolve NodeResolver, opts CompileOptions) (EgressPlan, error)
CompileEgressPlan returns the nftables batch plus the domain-backed named sets that must be populated on the node before the selfcheck runs.
type Graph ¶
type Graph struct {
Nodes []GraphNode `json:"nodes"`
Edges []GraphEdge `json:"edges"`
Externals []GraphExternal `json:"externals"`
}
Source Files