service

package
v1.19.6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 16, 2026 License: Apache-2.0 Imports: 31 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// EnableStandaloneDNSProxy is the name of the option to enable standalone DNS proxy
	EnableStandaloneDNSProxy = "enable-standalone-dns-proxy"

	// StandaloneDNSProxyServerPort is the port on which the standalone DNS proxy gRPC server should listen.
	StandaloneDNSProxyServerPort = "standalone-dns-proxy-server-port"

	// DNSMaxIPsPerRestoredRule defines the maximum number of IPs to maintain
	// for each FQDN selector in endpoint's restored DNS rules
	DNSMaxIPsPerRestoredRule = "dns-max-ips-per-restored-rule"

	// ToFQDNsEnableDNSCompression allows the DNS proxy to compress responses to
	// endpoints that are larger than 512 Bytes or the EDNS0 option, if present.
	ToFQDNsEnableDNSCompression = "tofqdns-enable-dns-compression"

	// DNSProxyConcurrencyProcessingGracePeriod is the amount of grace time to
	// wait while processing DNS messages when the DNSProxyConcurrencyLimit has
	// been reached.
	DNSProxyConcurrencyProcessingGracePeriod = "dnsproxy-concurrency-processing-grace-period"
)
View Source 
const (
	PolicyRulesTableName   = "sdp-policy-rules"
	IdentityToIPsTableName = "sdp-identity-to-ip"
)

Variables

View Source 
var Cell = cell.Module(
	"sdp-grpc-server",
	"Provides the standalone DNS proxy gRPC server",

	cell.Config(DefaultConfig),
	cell.Provide(newDefaultListener),
	cell.ProvidePrivate(newPolicyRulesTable),
	cell.ProvidePrivate(newIdentityToIPsTable),
	cell.Provide(newServer),
)

Cell provides the standalone DNS proxy gRPC server. It is responsible for sending the DNS rules and IP cache updates to the standalone DNS proxy. It also handles the DNS responses from the standalone DNS proxy and updates the DNS rules and IP cache accordingly. It receives the DNS rules during the endpoint regeneration event and listens for ip cache updates from the ipcache.

View Source 
var DefaultConfig = FQDNConfig{
	EnableStandaloneDNSProxy:                 false,
	StandaloneDNSProxyServerPort:             10095,
	ToFQDNsEnableDNSCompression:              true,
	DNSMaxIPsPerRestoredRule:                 1000,
	DNSProxyConcurrencyProcessingGracePeriod: 0,
}
View Source 
var (
	PolicyRulesIndex = statedb.Index[PolicyRules, identity.NumericIdentity]{
		Name: "id",
		FromObject: func(e PolicyRules) index.KeySet {
			return index.NewKeySet(index.Uint32(e.Identity.Uint32()))
		},
		FromKey: func(key identity.NumericIdentity) index.Key {
			return index.Uint32(key.Uint32())
		},
		FromString: index.Uint32String,
		Unique:     true,
	}
)

Functions

This section is empty.

Types

type FQDNConfig 

type FQDNConfig struct {
	// EnableStandaloneDNSProxy is the option to enable standalone DNS proxy
	EnableStandaloneDNSProxy bool

	// StandaloneDNSProxyServerPort is the user-configured global, Standalone DNS proxy gRPC server port
	StandaloneDNSProxyServerPort int

	// ToFQDNsEnableDNSCompression allows the DNS proxy to compress responses to
	// endpoints that are larger than 512 Bytes or the EDNS0 option, if present.
	ToFQDNsEnableDNSCompression bool

	// DNSMaxIPsPerRestoredRule defines the maximum number of IPs to maintain
	// for each FQDN selector in endpoint's restored DNS rules
	DNSMaxIPsPerRestoredRule int

	// DNSProxyConcurrencyProcessingGracePeriod is the amount of grace time to
	// wait while processing DNS messages when the DNSProxyConcurrencyLimit has
	// been reached.
	DNSProxyConcurrencyProcessingGracePeriod time.Duration
}

func (FQDNConfig) Flags 

func (def FQDNConfig) Flags(flags *pflag.FlagSet)

type FQDNDataServer 

type FQDNDataServer struct {
	pb.UnimplementedFQDNDataServer
	// contains filtered or unexported fields
}

FQDNDataServer is the server for the standalone DNS proxy grpc server It is responsible for handling the FQDN mapping requests from the SDP and sending the DNS Policy updates to the SDP.

func NewServer 

func NewServer(params serverParams) *FQDNDataServer

NewServer creates a new FQDNDataServer which is used to handle the Standalone DNS Proxy grpc service

func (*FQDNDataServer) IsEnabled added in v1.18.1 

func (s *FQDNDataServer) IsEnabled() bool

func (*FQDNDataServer) ListenAndServe 

func (s *FQDNDataServer) ListenAndServe(ctx context.Context, health cell.Health) error

ListenAndServe starts the Standalone DNS Proxy gRPC server on the given port

func (*FQDNDataServer) OnIPIdentityCacheChange 

func (s *FQDNDataServer) OnIPIdentityCacheChange(modType ipcache.CacheModification, cidr types.PrefixCluster, oldHostIP, newHostIP net.IP, oldID *ipcache.Identity, newID ipcache.Identity, encryptKey uint8, k8sMeta *ipcache.K8sMetadata, endpointFlags uint8)

OnIPIdentityCacheChange is a method to receive the IP identity cache change events

func (*FQDNDataServer) Stop 

func (s *FQDNDataServer) Stop()

func (*FQDNDataServer) StreamPolicyState 

func (s *FQDNDataServer) StreamPolicyState(stream pb.FQDNData_StreamPolicyStateServer) error

StreamPolicyState is a bidirectional streaming RPC to subscribe to DNS policies SDP calls this method to subscribe to DNS policies For each stream, we subscribe to the changes in the policy rules table and identity to IPs mapping. The flow of the method is as follows:

  1. Send the current state of the DNS rules and identity to IPs mapping to the client.
  2. Subscribe to the changes in the policy rules table and identity to IPs mapping.
  3. For each change in the policy rules table or identity to IPs mapping, send the current state of the DNS rules and identity to IPs mapping to the client.
  4. If the stream context is done, return.

func (*FQDNDataServer) UpdateMappingRequest 

func (s *FQDNDataServer) UpdateMappingRequest(ctx context.Context, mappings *pb.FQDNMapping) (*pb.UpdateMappingResponse, error)

UpdateMappingRequest updates the FQDN mapping with the given data SDP sends the fqdn mapping to cilium agent Steps to update the mapping: 1. Get the endpoint from the IP 2. If the endpoint is not found, return an error 3. If the IPs are not empty, update the cilium agent with the mapping Note: Not all metrics are reported by the standalone dns proxy yet and will be added in the future.

func (*FQDNDataServer) UpdatePolicyRules 

func (s *FQDNDataServer) UpdatePolicyRules(policies map[identity.NumericIdentity]policy.SelectorPolicy) error

UpdatePolicyRules updates the current state of the DNS rules with the given policies in the policy rules table. This method is called when the DNS rules are updated during the endpoint regeneration, we store the state of the DNS rules.

type PolicyRules added in v1.19.0 

type PolicyRules struct {
	Identity    identity.NumericIdentity
	PolicyRules []*pb.DNSPolicy
}

func (PolicyRules) TableHeader added in v1.19.0 

func (p PolicyRules) TableHeader() []string

TableHeader implements statedb.TableWritable.

func (PolicyRules) TableRow added in v1.19.0 

func (p PolicyRules) TableRow() []string

TableRow implements statedb.TableWritable.

type PolicyUpdater 

type PolicyUpdater interface {
	// UpdatePolicyRules is used to update the current state of the policy rules at the
	// gRPC server. These rules are sent to the standalone DNS proxy.
	// This is currently being called whenever there is a policy regeneration event
	// for an endpoint.
	UpdatePolicyRules(map[identity.NumericIdentity]policy.SelectorPolicy) error

	// IsEnabled returns true if the standalone DNS proxy is enabled
	IsEnabled() bool
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.