netpol

type Informers ¶ added in v2.11.0

type Informers interface {
	Pods() cache.SharedIndexInformer
	Namespaces() cache.SharedIndexInformer
	NetworkPolicies() cache.SharedIndexInformer
}

Informers is the set of shared informers the NPC reads from. We declare it here rather than accepting a full informer factory so that the controller can only reach the resources it actually watches.

type NetworkPolicyController ¶

type NetworkPolicyController interface {
	Run(healthChan chan<- *healthcheck.ControllerHeartbeat, stopCh <-chan struct{}, wg *sync.WaitGroup)
	RequestFullSync()

	PodEventHandler() cache.ResourceEventHandler
	NamespaceEventHandler() cache.ResourceEventHandler
	NetworkPolicyEventHandler() cache.ResourceEventHandler
	// contains filtered or unexported methods
}

NetworkPolicyController provides both ingress and egress filtering for pods as per the defined network policies. This interface has two implementations: one using iptables/ipsets and one using nftables. The implementation is selected via the UseNftablesForNetpol configuration option.

Both implementations use a similar architecture with per-pod firewall chains and per-policy chains. Each pod requiring ingress or egress filtering gets a pod-specific chain. Each network policy has its own chain with rules matching source and destination pod IPs (via ipsets or nftables sets). Traffic is filtered by jumping from top-level chains (INPUT, FORWARD, OUTPUT) to pod-specific chains, then to matching network policy chains, until a match accepts the packet or it gets dropped.

func NewNetworkPolicyController(clientset kubernetes.Interface,
	config *options.KubeRouterConfig, informers Informers,
	ipsetMutex *sync.Mutex, linkQ utils.LocalLinkQuerier,
	iptablesCmdHandlers map[v1core.IPFamily]utils.IPTablesHandler,
	ipSetHandlers map[v1core.IPFamily]utils.IPSetHandler,
	ipRanges svcip.RangeQuerier,
	knftInterfaces map[v1core.IPFamily]knftables.Interface,
) (NetworkPolicyController, error)

type NetworkPolicyControllerBase ¶ added in v2.11.0

type NetworkPolicyControllerBase struct {
	MetricsEnabled bool
	// contains filtered or unexported fields
}

NetworkPolicyController struct to hold information required by NetworkPolicyController

func (npc *NetworkPolicyControllerBase) ListNamespaceByLabels(
	namespaceSelector labels.Selector) ([]*api.Namespace, error)

func (npc *NetworkPolicyControllerBase) ListPodsByNamespaceAndLabels(namespace string,
	podSelector labels.Selector) (ret []*api.Pod, err error)

func (npc *NetworkPolicyControllerBase) NamespaceEventHandler() cache.ResourceEventHandler

func (npc *NetworkPolicyControllerBase) NetworkPolicyEventHandler() cache.ResourceEventHandler

func (npc *NetworkPolicyControllerBase) OnNetworkPolicyUpdate(obj any)

func (npc *NetworkPolicyControllerBase) OnPodUpdate(obj any)

func (npc *NetworkPolicyControllerBase) PodEventHandler() cache.ResourceEventHandler

func (npc *NetworkPolicyControllerBase) RequestFullSync()

type NetworkPolicyControllerIptables ¶ added in v2.11.0

type NetworkPolicyControllerIptables struct {
	*NetworkPolicyControllerBase
	// contains filtered or unexported fields
}

NetworkPolicyControllerIptables is the iptables-based implementation of NetworkPolicyController. It uses iptables chains and ipsets to enforce Kubernetes network policies. This is the original implementation and is used when UseNftablesForNetpol is disabled (the default behavior).

func NewNetworkPolicyControllerIptables(
	npcBase *NetworkPolicyControllerBase, config *options.KubeRouterConfig,
	iptablesCmdHandlers map[v1core.IPFamily]utils.IPTablesHandler,
	ipSetHandlers map[v1core.IPFamily]utils.IPSetHandler) (*NetworkPolicyControllerIptables, error)

func (npc *NetworkPolicyControllerIptables) Cleanup()

func (npc *NetworkPolicyControllerIptables) Run(
	healthChan chan<- *healthcheck.ControllerHeartbeat, stopCh <-chan struct{}, wg *sync.WaitGroup)

type NetworkPolicyControllerNftables ¶ added in v2.11.0

type NetworkPolicyControllerNftables struct {
	*NetworkPolicyControllerBase
	// contains filtered or unexported fields
}

NetworkPolicyControllerNftables is the nftables-based implementation of NetworkPolicyController. It uses nftables chains and named sets (instead of iptables chains and ipsets) to enforce Kubernetes network policies. This implementation is enabled via the UseNftablesForNetpol configuration option and provides the same network policy functionality as the iptables implementation.

func NewNetworkPolicyControllerNftables(
	npcBase *NetworkPolicyControllerBase, config *options.KubeRouterConfig,
	knftInterfaces map[v1core.IPFamily]knftables.Interface) (*NetworkPolicyControllerNftables, error)

func (npc *NetworkPolicyControllerNftables) Cleanup()

func (npc *NetworkPolicyControllerNftables) Run(
	healthChan chan<- *healthcheck.ControllerHeartbeat, stopCh <-chan struct{}, wg *sync.WaitGroup)