GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

resolver

package

v1.18.2 Latest Latest Go to latest Published: Sep 16, 2025 License: Apache-2.0 Imports: 20 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Overview ¶

Package resolver provides the logic for merging in the various sources of configuration, overrides, and drop-ins.

Index ¶

Constants
func ResolveConfigurations(ctx context.Context, logger *slog.Logger, client client.Clientset, ...) (map[string]string, error)
func WriteConfigurations(ctx context.Context, logger *slog.Logger, destDir string, ...) error
type ConfigOverride
type ConfigSource
- func ReadConfigSource(ctx context.Context, logger *slog.Logger, client client.Clientset, ...) (config map[string]string, sources []ConfigSource, err error)
- func (cs *ConfigSource) String() string

Constants ¶

View Source

const (
	KindConfigMap  = "config-map"
	KindNode       = "node"
	KindNodeConfig = "cilium-node-config"

	ConfigSources          = "config-sources"
	ConfigSourcesOverrides = "config-sources-overrides"
)

Variables ¶

This section is empty.

Functions ¶

func ResolveConfigurations ¶

func ResolveConfigurations(ctx context.Context, logger *slog.Logger, client client.Clientset, nodeName string, sources []ConfigSource, allowConfigKeys, denyConfigKeys []string) (map[string]string, error)

func WriteConfigurations ¶

func WriteConfigurations(ctx context.Context, logger *slog.Logger, destDir string, data map[string]string) error

WriteConfigurations writes the key-value pairs in data to destDir. It writes it like a Kubernetes config-map: It uses a double-layer symlink to allow for atomic updates: destDir/key -> ..data/key ..data -> ..data_$time

Types ¶

type ConfigOverride ¶ added in v1.17.0

type ConfigOverride struct {
	AllowConfigKeys []string `json:"allowConfigKeys"` // List of configuration keys that are allowed to be overridden (e.g. set from not the first source. Takes precedence over deny-config-keys
	DenyConfigKeys  []string `json:"denyConfigKeys"`  // List of configuration keys that are not allowed to be overridden (e.g. set from not the first source. If allow-config-keys is set, this field is ignored"
}

type ConfigSource ¶

type ConfigSource struct {
	Kind      string `json:"kind"`      // one of KindConfigMap, KindNodeConfig, KindNode
	Namespace string `json:"namespace"` // The namespace for the ConfigMap, CiliumNodeConfigs or empty for Node
	Name      string `json:"name"`      // The name of the ConfigMap or Node, unused for Overrides
}

func ReadConfigSource ¶

func ReadConfigSource(ctx context.Context, logger *slog.Logger, client client.Clientset, nodeName string, source ConfigSource) (config map[string]string, sources []ConfigSource, err error)

func (*ConfigSource) String ¶

func (cs *ConfigSource) String() string

Source Files ¶

View all Source files

resolver.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL