Documentation
¶
Overview ¶
Package firewallstatus publishes this micro-VM's live nftables state on the per-VM NATS subject the control plane (and the UI) listen on.
Reverse direction of pkg/firewall : where the firewall subscriber pulls a desired ruleset on weft.firewall.<vm-uuid> and reconciles the kernel table, this emitter polls the kernel table and pushes a [pod.FirewallStatus] on weft.firewall.<vm-uuid>.status. Same shape weft-router's statusemitter uses for its BGP RouterStatus.
Cadence : a ticker (default 10 s) calls the ReadFunc, stamps the status with the current wall-clock time, and publishes. The first tick fires immediately at Run() entry so a dashboard sees a value inside a second of boot. Best-effort : publish or read failures log + skip ; the next tick reconciles.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Emitter ¶
type Emitter struct {
// contains filtered or unexported fields
}
Emitter periodically reads + publishes FirewallStatus for one VM.
type ReadFunc ¶
type ReadFunc func() pod.FirewallStatus
ReadFunc returns the current FirewallStatus, typically by inspecting the kernel nftables table. Production implementation is network.ReadFirewallStatus ; tests inject a stub.
Source Files