Documentation
¶
Overview ¶
Package ingress is fuse-proxy: stable public tcp ports in front of guests that dial in over internal/tunnel.
a route is a public port that belongs to an owner (a vm id) and leads to one port inside that owner's guest. the port is the stable thing. which owner it belongs to can change, and that is the whole of what a migrate does here: the new vm adopts the old vm's ports, and the url every client holds keeps working without any of them learning that anything moved.
Index ¶
- func AdminHandler(p *Proxy, cfg AdminConfig) http.Handler
- type AdminConfig
- type Client
- type Config
- type Metrics
- type Opener
- type PortSpec
- type Proxy
- func (p *Proxy) Authenticate(owner, token string) bool
- func (p *Proxy) Close()
- func (p *Proxy) Publish(owner, token string, ports []PortSpec, adoptFrom string) ([]Route, error)
- func (p *Proxy) Remove(owner string) (bool, error)
- func (p *Proxy) Routes(owner string) ([]Route, bool)
- func (p *Proxy) Start(t Opener)
- type Route
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AdminHandler ¶
func AdminHandler(p *Proxy, cfg AdminConfig) http.Handler
AdminHandler serves the admin api.
Types ¶
type AdminConfig ¶
type AdminConfig struct {
Token string
// PublicHost is the name or address clients and guests reach this machine
// by. TunnelPort is the udp port guests dial.
PublicHost string
TunnelPort int
ServerCertPEM string
// Metrics serves GET /metrics. like /healthz it needs no token, matching
// the orchestrator's /metrics, so a scraper never holds the admin token.
Metrics http.Handler
}
AdminConfig is what the admin api needs beyond the proxy itself.
type Client ¶
Client is the orchestrator's end of the admin api.
func (*Client) Lookup ¶
func (c *Client) Lookup(ctx context.Context, owner string) (orchestrator.IngressGrant, error)
Lookup implements orchestrator.IngressProxy.
func (*Client) Publish ¶
func (c *Client) Publish(ctx context.Context, req orchestrator.IngressRequest) (orchestrator.IngressGrant, error)
Publish implements orchestrator.IngressProxy.
type Config ¶
type Config struct {
// StatePath is where owners and routes are persisted. routes have to
// outlive the process: a proxy that came back with different ports would
// have broken every url it exists to keep stable.
StatePath string
// PortMin and PortMax bound the public ports handed out, inclusive.
PortMin, PortMax int
// BindHost is the address public listeners bind, "" for all.
BindHost string
// HoldTimeout is how long a client connection waits for its guest to be
// reachable before it is closed.
HoldTimeout time.Duration
Logger *slog.Logger
// Metrics is optional; nil records nothing.
Metrics *Metrics
}
Config tunes a Proxy.
type Metrics ¶ added in v0.36.0
type Metrics struct {
// contains filtered or unexported fields
}
Metrics is fuse-proxy's prometheus metrics. a nil *Metrics records nothing, so a Proxy built without one (the tests) needs no special casing.
series labeled by owner are deleted when the owner is removed, so the label set is bounded by the live fleet rather than by every vm ever published.
func NewMetrics ¶ added in v0.36.0
func NewMetrics(reg prometheus.Registerer) *Metrics
NewMetrics creates and registers fuse-proxy's metrics on reg.
func (*Metrics) GuestConnected ¶ added in v0.36.0
GuestConnected implements tunnel.Metrics.
func (*Metrics) GuestsConnected ¶ added in v0.36.0
GuestsConnected implements tunnel.Metrics.
func (*Metrics) PathMigrated ¶ added in v0.36.0
PathMigrated implements tunnel.Metrics.
type Opener ¶
type Opener interface {
Open(ctx context.Context, owner string, port int) (net.Conn, error)
Drop(owner string)
Retire(owner string)
}
Opener is the part of tunnel.Server the proxy uses.
type Proxy ¶
type Proxy struct {
// contains filtered or unexported fields
}
Proxy owns the routes and their listeners.
func (*Proxy) Authenticate ¶
Authenticate is the tunnel server's authenticator.
func (*Proxy) Publish ¶
Publish creates or updates owner so that it has exactly ports, and returns its routes.
a route that already exists under the same name keeps its public port, so publishing again is how a token is rotated without the url moving. with adoptFrom, each name takes the public port of the same name under adoptFrom, and adoptFrom loses it. connections already running to the old guest are left alone: they are streams on the old guest's tunnel and end when it does.
Source Files