shaper

type Category ¶

type Category string

Category is a statusz traffic category as reported by the block node's statusz endpoints (inbound-clients / outbound-clients). The vocabulary is fixed by the BN's contract, not operator-configurable.

const (
	// CategoryPublisher is the inbound publisher category.
	CategoryPublisher Category = "publisher"
	// CategoryPartner is the inbound partner category.
	CategoryPartner Category = "partner"
	// CategoryRestricted is the inbound restricted category.
	CategoryRestricted Category = "restricted"
	// CategoryPeerBN is the outbound peer-block-node category. Its endpoints are
	// compound ip:port pairs — the backfill set is keyed on destination address
	// AND port.
	CategoryPeerBN Category = "peer_bn"
)

type CategoryEndpoints ¶

type CategoryEndpoints map[Category][]string

CategoryEndpoints is one poll's desired membership view, keyed by statusz category. For each category PRESENT in the map, the slice is its active endpoints: plain IPv4 hosts/CIDRs for inbound categories, "ip:port" pairs for the outbound peer_bn category. The present-vs-absent distinction is load bearing and preserved end to end:

• a category present with an empty (or nil) slice clears that policy's set;
• a category absent from the map leaves that policy's set untouched.

This is the minimal shape the diff needs; the statusz client (#751) decodes the wire NetworkData response into it, and the apply path (#754) consumes the resulting deltas.

type CheckResult ¶

type CheckResult struct {
	Digest  string              `json:"desired-digest"`
	Desired map[string][]string `json:"desired"`
}

CheckResult is the unprivileged detect path's output: the sha256 digest of the desired policy membership, and the canonical desired membership itself (policy name -> nft-rendered elements) so `--check --output json` is useful for daemon-side introspection and debugging, not just change detection.

type Endpoint ¶

type Endpoint struct {
	Address string `json:"address"`
	Port    string `json:"port"`
}

Endpoint is one side (local or remote) of a NetworkConnection. Port is a string because the BN reports "*" (any port) alongside numeric ports, and Address may be a single IP or a CIDR (e.g. "10.10.1.0/24").

type NetworkConnection ¶

type NetworkConnection struct {
	Local       Endpoint `json:"local"`
	Remote      Endpoint `json:"remote"`
	Category    string   `json:"category"`
	TLSRequired bool     `json:"tls_required"`
}

NetworkConnection is one active endpoint reported by a statusz endpoint. Category is left as the raw BN string here — mapping categories to policy names and nft sets is a separate concern from reading the endpoint.

type NetworkData ¶

type NetworkData struct {
	ActiveEndpoints []NetworkConnection `json:"active_endpoints"`
}

NetworkData is the decoded payload of a statusz endpoint: the set of active endpoints the BN currently reports.

type PolicyDelta ¶

type PolicyDelta struct {
	Policy string
	policy.SetDelta
}

PolicyDelta is the computed membership change for one policy set: the policy (nft set) name and the canonicalized add/delete lists.

type Reconciler ¶

type Reconciler struct {
	// contains filtered or unexported fields
}

Reconciler drives one reconcile of the block node traffic-shaper's nft policy set membership from statusz. It is the engine behind the `block node reconcile-shaper` worker: Check derives the desired membership and digests it (no privilege, no nft), while Apply additionally reads the live nft sets, diffs, and writes only the changed policies (root).

The three collaborators are seams so the orchestration is testable off-host: fetcher reads statusz, lister reads live nft membership, applier writes it.

func NewReconciler(statuszURL string) *Reconciler

func (r *Reconciler) Apply(ctx context.Context) (Result, error)

func (r *Reconciler) Check(ctx context.Context) (CheckResult, error)

type Result ¶

type Result struct {
	Applied   []string `json:"applied"`
	Skipped   []string `json:"skipped"`
	Unchanged []string `json:"unchanged"`
	Digest    string   `json:"digest"`
}

Result summarizes one Apply: the owned policies whose live membership was rewritten, those skipped because the operator apply lock was held (still out of sync, not yet reconciled), those left unchanged (already in the desired state), and the digest of the full desired membership (identical to what Check reports for the same statusz snapshot).

type StatuszClient ¶

type StatuszClient struct {
	// contains filtered or unexported fields
}

StatuszClient reads a Block Node's statusz REST/JSON endpoints.

func NewStatuszClient(baseURL string) *StatuszClient

func (c *StatuszClient) InboundClients(ctx context.Context) (NetworkData, error)

func (c *StatuszClient) OutboundClients(ctx context.Context) (NetworkData, error)