network

func DisableIPv6Sysctls ¶ added in v1.1.5

func DisableIPv6Sysctls() error

DisableIPv6Sysctls writes 1 to the kernel sysctl paths that disable IPv6 on all interfaces. It is idempotent — paths already set to 1 are skipped. All paths are attempted regardless of failure; errors are aggregated and returned.

func EnsurePodMasquerade ¶ added in v1.1.4

func EnsurePodMasquerade(podCIDR string) error

EnsurePodMasquerade programs a SNAT/masquerade rule for pod egress traffic so pods can reach external IPs. It is idempotent and mode-aware: iptables on systems that have the ip_tables kernel module, nftables otherwise.

This must be called before kubelet starts (so no pod ever starts without SNAT in place) and after flushNftablesNat (to restore the rule after the nat table is flushed for kube-proxy compatibility).

func GetHostResolvConf ¶ added in v1.1.1

func GetHostResolvConf(dataDir string, containerMode bool) string

GetHostResolvConf returns the path to a resolv.conf file that contains real upstream nameservers suitable for use by pods. It checks common resolv.conf locations and validates that they contain usable nameservers (global unicast). If no valid resolv.conf is found, it generates a fallback with public DNS servers.

func GetLocalIPs ¶

func GetLocalIPs() ([]net.IP, error)

GetLocalIPs returns all non-loopback IPv4 addresses

func GetNodeIP ¶

func GetNodeIP() (string, error)

GetNodeIP returns a non-loopback IPv4 address of the node, preferring a private (RFC 1918) address over a public one. On a host with several private addresses the first one encountered is returned, so the choice is not guaranteed to be stable across reboots — pin a specific address with --node-ip when that matters.

func GetNodeMTU ¶ added in v1.2.0

func GetNodeMTU() (int, error)

GetNodeMTU returns the MTU of whichever interface GetNodeIP would select the node IP from, so MTU detection stays consistent with node-IP selection on multi-NIC hosts. Returns types.DefaultMTU on any failure.

func IsComponentHealthy ¶

func IsComponentHealthy(client *http.Client, request *http.Request, component string) error

IsComponentHealthy checks if a component is healthy by sending a health check request and waiting for a response. It stops retrying once the request's context is cancelled.

func IsDNSName ¶

func IsDNSName(name string) bool

IsDNSName returns true if the given string is a valid DNS name it follows the RFC 1123 specification for DNS names

func IsIPv4Address ¶

func IsIPv4Address(ip string) bool

IsIPv4Address returns true if the given string is a valid IPv4 address

func ResolveLoadBalancerIP ¶ added in v1.2.0

func ResolveLoadBalancerIP(override, nodeIP string) string

ResolveLoadBalancerIP returns the IP to publish as the LoadBalancer EXTERNAL-IP. It falls back to nodeIP when the override is empty or not a valid IPv4 address, so a bad override never silently picks a different NIC than the node itself.

func ResolveMTU ¶ added in v1.2.0

func ResolveMTU(override int) (mtu int, pinned bool, err error)

ResolveMTU returns the MTU to apply to the embedded CNI bridge and pod veth interfaces, and whether it was explicitly pinned via a valid override. override <= 0 means "not specified": auto-detect via GetNodeMTU, not pinned. An override outside the valid IPv4 MTU range [68, 65535] is rejected with a warning and falls back to auto-detection, not pinned — a typo must not silently switch the caller into pinned behavior. A valid override is always used as-is and pinned, even if it differs from the auto-detected value (soft warning only, analogous to isLocalIP's VIP warning for --node-ip).

func ResolveNodeIP ¶ added in v1.1.8

func ResolveNodeIP(override string) (ip string, pinned bool, err error)

ResolveNodeIP returns the node IP to advertise and whether it was explicitly pinned via a valid override. When override is a valid IPv4 it is used as-is and pinned is true — a value not bound to a local interface is still allowed but logged (e.g. a VIP). An empty or unparseable override falls back to auto-detection via GetNodeIP with pinned false, so a typo does not silently switch the caller into "pinned" behavior.