Documentation
¶
Index ¶
- Constants
- type Config
- type Server
- func (s *Server) Handler() http.Handler
- func (s *Server) Listen() (net.Listener, error)
- func (s *Server) Serve(ctx context.Context, ln net.Listener) error
- func (s *Server) SetDataPlaneCheck(ctx context.Context, fn func() error)
- func (s *Server) SetDataPlaneReady()
- func (s *Server) SetDeliveryMode(m api.DeliveryMode)
- func (s *Server) SetDeliveryStopped()
- func (s *Server) SetRegistered()
- func (s *Server) SetSubsystemStopped(name string)
Constants ¶
const DefaultListen = "127.0.0.1:9101"
DefaultListen is the default health listen address. It binds loopback on purpose: the endpoints are unauthenticated, so the default must not expose them on the node's NICs — and, once the mesh is up, to every WireGuard peer. Under hostNetwork: true the kubelet probes from the host network namespace, which is the same namespace the process listens in, so a probe that sets host: 127.0.0.1 reaches a loopback-bound listener; that is the arrangement host-networked agents such as kube-proxy use. A wider bind stays available as an explicit opt-in through health.listen.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Enabled controls whether the health listener runs.
// nil means use default (true); explicit false disables the listener.
//
// The default is on because the shipped DaemonSet probes /healthz and
// /readyz unconditionally. An operator has to supply a ConfigMap for the
// control-plane URL, the node identity and the WireGuard settings anyway,
// and the health block is the one they have no reason to know about: with a
// default of off, an omitted block leaves the probe target unbound, the
// kubelet fails liveness and restarts the container — and that restart runs
// the drain path, which deletes the WireGuard interface and the
// deny-by-default chain on every node in the fleet, on a loop.
Enabled *bool `yaml:"enabled"`
// Listen is the address the health listener binds to.
// Default: DefaultListen
Listen string `yaml:"listen"`
}
Config holds the configuration for the health listener. Config is passed as a constructor argument — no file I/O in this package.
func (*Config) ApplyDefaults ¶
func (c *Config) ApplyDefaults()
ApplyDefaults sets default values for zero-valued fields.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the health listener. It serves the unauthenticated Kubernetes probe endpoints /healthz and /readyz over TCP, separate from the local node API so that a probe never needs credentials.
func NewServer ¶
NewServer creates a new Server. Config defaults are applied automatically. The delivery mode is seeded to api.DeliveryModeStreaming, mirroring the initial mode of the ReconnectEngine (internal/api/reconnect.go:127), so that readiness after registration does not depend on the order in which the caller wires up the mode-change callback.
func (*Server) Handler ¶
Handler returns the probe routes: GET /healthz and GET /readyz, and nothing else.
The responses are plain text rather than the node API's JSON error shape. That is deliberate: the kubelet ignores probe bodies entirely and Kubernetes' own healthz convention is plain text, so a human reading `curl` output is the only consumer. Do not "improve" this into a JSON status document — the fixed bodies are what guarantees the unauthenticated endpoint leaks nothing about the node or the control plane.
func (*Server) Listen ¶
Listen binds the configured health address. It is split from Serve so the caller can fail fast on an address already in use, before registration starts.
func (*Server) Serve ¶
Serve serves the probe routes on ln until ctx is cancelled, then shuts the listener down gracefully. It returns nil on a clean shutdown.
func (*Server) SetDataPlaneCheck ¶
SetDataPlaneCheck starts a background poller that re-runs fn every dataPlaneCheckPeriod until ctx is cancelled; probes read its last verdict. It complements SetDataPlaneReady, which records the initial bring-up.
The latch alone reports ready for the rest of the process's life: the mesh data plane is ordinary kernel state that other actors mutate afterwards — a node admin deleting the interface, a WireGuard module gone after a kernel upgrade — and a latched readiness would keep a node in rotation and let the next rolling update sweep the fleet.
The poll runs in the background rather than in the request path because the probe endpoints are unauthenticated: a per-probe check lets any caller that can reach the port drive one kernel query per GET, inside the process that programs the WireGuard interface and the nftables chain. A nil fn keeps the latch-only behaviour.
Note that what fn can observe bounds this: the caller checks the WireGuard interface, while a firewall baseline flushed by a co-resident actor stays undetected — neither the WireGuard nor the firewall controller exposes a read operation today.
func (*Server) SetDataPlaneReady ¶
func (s *Server) SetDataPlaneReady()
SetDataPlaneReady marks the mesh data plane as established: the WireGuard interface is configured and up, and the firewall baseline is installed. The caller invokes it once, after both have succeeded.
Readiness waits for it because a node without a tunnel carries no mesh traffic. Reporting such a node ready lets a DaemonSet rolling update march across the whole fleet while not a single node holds a data plane.
func (*Server) SetDeliveryMode ¶
func (s *Server) SetDeliveryMode(m api.DeliveryMode)
SetDeliveryMode records the current control-plane delivery mode.
func (*Server) SetDeliveryStopped ¶
func (s *Server) SetDeliveryStopped()
SetDeliveryStopped marks control-plane event delivery as stopped for good.
The delivery mode cannot express this on its own: the reconnect engine fires its mode-change callback only on an actual transition, and it returns without one on a permanent failure or a rejected node secret. The last recorded mode then stays whatever it was while no events arrive at all, so readiness needs a separate signal for "the delivery goroutine is gone".
func (*Server) SetRegistered ¶
func (s *Server) SetRegistered()
SetRegistered marks the node identity as registered. The caller invokes it once registration has succeeded, and on restart as soon as a persisted identity has been loaded.
func (*Server) SetSubsystemStopped ¶
SetSubsystemStopped records that a long-running subsystem exited before shutdown. Readiness answers 503 from then on: nothing restarts these goroutines, so the process stays alive while no longer doing the work the node was admitted for — and liveness is a constant by design, so the kubelet does not rescue it either.
name goes to the log, never to the response: the endpoint is unauthenticated, so the body stays a constant like every other one.
Source Files