dnsmgr

type Manager ¶

type Manager struct {
	// contains filtered or unexported fields
}

Manager decides which pods the DNS program observes.

A pod is observed exactly while some policy with a `dns` behavior selects it. That is both an efficiency and a privacy boundary: an unselected pod's queries never enter the ring buffer, so they cannot be dropped, decoded, or reported, and no node-wide firehose exists to fall behind.

Attachment and admission are separate steps because they fail differently. A link is per container cgroup and its absence means no packets are seen at all; a cgroup id in the gate is what lets an attached program emit. Both are reconciled from the same selection decision.

func New(logger logr.Logger, t tracer) *Manager

func (m *Manager) PodDeleted(uid string) error

func (m *Manager) PodEvent(pod corev1.Pod, nsLabels map[string]string, cgInfos []*containers.ContainerCgroupInfo, _ string) error

func (m *Manager) RuntimePolicyEvent(rp *compiler.EvaluationResult, eventType string) error