shaper

type Category ¶

type Category string

Category is a statusz traffic category as reported by the block node's statusz endpoints (statusz/inbound / statusz/outbound). The vocabulary is fixed by the BN's contract, not operator-configurable: partner, publisher, public, restricted.

const (
	// CategoryPublisher is the publisher category.
	CategoryPublisher Category = "publisher"
	// CategoryPartner is the partner category. It appears on both statusz
	// endpoints and binds to a different policy set per direction: inbound
	// partner clients feed bn-partner-out, while outbound partner connections are
	// the peer block nodes this BN backfills from and feed the compound
	// bn-backfill set.
	CategoryPartner Category = "partner"
	// CategoryRestricted is the restricted category.
	CategoryRestricted Category = "restricted"
	// CategoryPublic is the public category. It is recognized but deliberately
	// left unmapped: public access is enforced by the bn-public-out port-match
	// set, not reconciled from statusz membership, so a public endpoint is
	// neither an "unknown category" surprise nor a monitor-owned set.
	CategoryPublic Category = "public"
)

type CheckResult ¶

type CheckResult struct {
	Digest       string              `json:"desired-digest"`
	Desired      map[string][]string `json:"desired"`
	DesiredPorts map[string][]string `json:"desired-ports"`
}

CheckResult is the unprivileged detect path's output: the sha256 digest of the desired policy state, the canonical desired CIDR membership (policy name -> nft-rendered elements), and the desired per-policy listener ports derived from statusz local.port, so `--check --output json` is useful for daemon-side introspection and debugging, not just change detection. The digest covers BOTH membership and ports, so a ports-only change is still detected.

type Direction ¶ added in v0.27.0

type Direction int

Direction is the statusz endpoint an endpoint set is read from: inbound (clients connecting to this BN) or outbound (connections this BN opens). The same category string can bind to a different policy set per direction, so a binding is keyed on (direction, category), not category alone.

const (
	// Inbound is the statusz/inbound endpoint.
	Inbound Direction = iota
	// Outbound is the statusz/outbound endpoint.
	Outbound
)

type Endpoint ¶

type Endpoint struct {
	Address string `json:"address"`
	Port    string `json:"port"`
}

Endpoint is one side (local or remote) of a NetworkConnection. Port is a string because the BN reports "*" (any port) alongside numeric ports, and Address may be a single IP or a CIDR (e.g. "10.10.1.0/24").

type NetworkConnection ¶

type NetworkConnection struct {
	Local       Endpoint `json:"local"`
	Remote      Endpoint `json:"remote"`
	Category    string   `json:"category"`
	TLSRequired bool     `json:"tlsRequired"`
}

NetworkConnection is one active endpoint reported by a statusz endpoint. Category is left as the raw BN string here — mapping categories to policy names and nft sets is a separate concern from reading the endpoint.

type NetworkData ¶

type NetworkData struct {
	ActiveEndpoints []NetworkConnection `json:"activeEndpoints"`
}

NetworkData is the decoded payload of a statusz endpoint: the set of active endpoints the BN currently reports.

type PolicyDelta ¶

type PolicyDelta struct {
	Policy string
	policy.SetDelta
}

PolicyDelta is the computed membership change for one policy set: the policy (nft set) name and the canonicalized add/delete lists.

type Reconciler ¶

type Reconciler struct {
	// contains filtered or unexported fields
}

Reconciler drives one reconcile of the block node traffic-shaper's nft policy set membership from statusz. It is the engine behind the `block node reconcile-shaper` worker: Check derives the desired membership and digests it (no privilege, no nft), while Apply additionally reads the live nft sets, diffs, and writes only the changed policies (root).

The three collaborators are seams so the orchestration is testable off-host: fetcher reads statusz, lister reads live nft membership, applier writes it.

func NewReconciler(statuszURL string) *Reconciler

func (r *Reconciler) Apply(ctx context.Context) (Result, error)

func (r *Reconciler) Check(ctx context.Context) (CheckResult, error)

type Result ¶

type Result struct {
	Applied   []string `json:"applied"`
	Skipped   []string `json:"skipped"`
	Unchanged []string `json:"unchanged"`
	Digest    string   `json:"digest"`
}

Result summarizes one Apply: the owned policies whose live membership was rewritten, those skipped because the operator apply lock was held (still out of sync, not yet reconciled), those left unchanged (already in the desired state), and the digest of the full desired membership (identical to what Check reports for the same statusz snapshot).

type StatuszClient ¶

type StatuszClient struct {
	// contains filtered or unexported fields
}

StatuszClient reads a Block Node's statusz REST/JSON endpoints.

func NewStatuszClient(baseURL string) *StatuszClient

func (c *StatuszClient) InboundClients(ctx context.Context) (NetworkData, error)

func (c *StatuszClient) OutboundClients(ctx context.Context) (NetworkData, error)