Documentation
¶
Overview ¶
Package firewallstatus publishes this micro-VM's live nftables state on the per-VM NATS subject the control plane (and the UI) listen on.
Reverse direction of pkg/firewall : where the firewall subscriber pulls a desired ruleset on weft.firewall.<vm-uuid> and reconciles the kernel table, this emitter polls the kernel table and pushes a [pod.FirewallStatus] on weft.firewall.<vm-uuid>.status. Same shape weft-router's statusemitter uses for its BGP RouterStatus.
Cadence : a ticker (default 10 s) calls the ReadFunc, stamps the status with the current wall-clock time, and publishes. The first tick fires immediately at Run() entry so a dashboard sees a value inside a second of boot. Best-effort : publish or read failures log + skip ; the next tick reconciles.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Emitter ¶
type Emitter struct {
// contains filtered or unexported fields
}
Emitter periodically reads + publishes FirewallStatus for one VM.
func New ¶
func New(nc *nats.Conn, vmID string, read ReadFunc, interval time.Duration, logger *log.Logger) (*Emitter, error)
New constructs an Emitter. interval <= 0 defaults to 10 s. logger nil defaults to log.Default.
func (*Emitter) Run ¶
Run ticks every interval until ctx is cancelled. Publishes one status message immediately on entry so a fresh boot is visible without waiting for the first tick.
func (*Emitter) SetMetricsHook ¶ added in v0.3.1
func (e *Emitter) SetMetricsHook(h PublishHook)
SetMetricsHook installs a PublishHook the Emitter calls after every publishOnce. Safe to call before Run() ; calling after Run starts is allowed but races with the first tick — wire the hook at construction time in cmd/weft-microvm-agent for deterministic counts. Passing nil clears the hook.
Exported strictly as the metrics surface ; sibling subscribers (mesh / mounts / firewall) wire metrics at the ApplyFunc seam instead, but the Emitter owns its own publish loop so the hook belongs to the type.
func (*Emitter) SetReadHook ¶ added in v0.4.0
SetReadHook installs a ReadHook the Emitter calls right after every successful ReadFunc invocation, before the publish step. Passing nil clears the hook. Wire from cmd/weft-microvm-agent at construction time so the drop-counter accumulator sees every tick.
Separate from SetMetricsHook because the two observe different edges : ReadHook fires on every read (the kernel counter snapshot is fresh whether or not the publish that follows succeeds), PublishHook fires after the publish attempt.
type PublishHook ¶ added in v0.3.1
type PublishHook func(err error)
PublishHook is the metrics seam : Emitter calls it exactly once per publishOnce invocation, after the publish attempt returns, with the transport error (nil on success). cmd-side wiring routes it to the agent's metrics.Recorder so a parallel counter to apply_total ticks on every status emission ; tests leave it nil.
Kept narrow on purpose : the hook receives only the error, not the payload, so a future call-site can wire a different observer (logs, audit, derived gauges) without ratcheting up the contract.
type ReadFunc ¶
type ReadFunc func() pod.FirewallStatus
ReadFunc returns the current FirewallStatus, typically by inspecting the kernel nftables table. Production implementation is network.ReadFirewallStatus ; tests inject a stub.
type ReadHook ¶ added in v0.4.0
type ReadHook func(packets, bytes uint64)
ReadHook is the metrics seam for the drop-counter pair : Emitter calls it exactly once per publishOnce invocation, right after the ReadFunc returns, with the freshly observed (DropsPackets, DropsBytes). cmd-side wiring routes it to metrics.Recorder.RecordFirewallDrops, which folds the kernel's reset-on-rebuild counter into a monotonic Prometheus counter pair.
Symmetric to PublishHook : both fire on every publishOnce, neither short-circuits the other, both are nil-by-default + safe-to-omit.
Source Files