network

func CheckFirewall ¶ added in v1.2.3

func CheckFirewall(nodeIPOverride string) error

CheckFirewall verifies that the host firewall lets pods reach the API server on the node IP and reach each other. It attaches two throwaway pods to the CNI bridge, as the bridge plugin would, and lets the kernel decide: every firewall frontend (iptables, nftables, firewalld, ufw) is evaluated as it will be for real pod traffic. nodeIPOverride is resolved as KubeSolo does.

func DisableIPv6Sysctls ¶ added in v1.1.5

func DisableIPv6Sysctls() error

DisableIPv6Sysctls writes 1 to the kernel sysctl paths that disable IPv6 on all interfaces. It is idempotent — paths already set to 1 are skipped. All paths are attempted regardless of failure; errors are aggregated and returned.

func EnsurePodMasquerade ¶ added in v1.1.4

func EnsurePodMasquerade(podCIDR string) error

EnsurePodMasquerade programs a SNAT/masquerade rule for pod egress traffic so pods can reach external IPs. It is idempotent and mode-aware: iptables when UseIPTables says so, nftables otherwise.

This must be called before kubelet starts (so no pod ever starts without SNAT in place) and after flushNftablesNat (to restore the rule after the nat table is flushed for kube-proxy compatibility).

func GetHostResolvConf ¶ added in v1.1.1

func GetHostResolvConf(dataDir string, containerMode bool) string

GetHostResolvConf returns the path to a resolv.conf file that contains real upstream nameservers suitable for use by pods. It checks common resolv.conf locations and validates that they contain usable nameservers (global unicast). If no valid resolv.conf is found, it generates a fallback with public DNS servers.

func GetLocalIPs ¶

func GetLocalIPs() ([]net.IP, error)

GetLocalIPs returns all non-loopback IPv4 addresses

func GetNodeIP ¶

func GetNodeIP() (string, error)

GetNodeIP returns a non-loopback IPv4 address of the node, preferring a private (RFC 1918) address over a public one. On a host with several private addresses the first one encountered is returned, so the choice is not guaranteed to be stable across reboots — pin a specific address with --node-ip when that matters.

func GetNodeMTU ¶ added in v1.2.0

func GetNodeMTU() (int, error)

GetNodeMTU returns the MTU of whichever interface GetNodeIP would select the node IP from, so MTU detection stays consistent with node-IP selection on multi-NIC hosts. Returns types.DefaultMTU on any failure.

func IsComponentHealthy ¶

func IsComponentHealthy(client *http.Client, request *http.Request, component string) error

IsComponentHealthy checks if a component is healthy by sending a health check request and waiting for a response. It stops retrying once the request's context is cancelled.

func IsDNSName ¶

func IsDNSName(name string) bool

IsDNSName returns true if the given string is a valid DNS name it follows the RFC 1123 specification for DNS names

func IsIPv4Address ¶

func IsIPv4Address(ip string) bool

IsIPv4Address returns true if the given string is a valid IPv4 address

func ResolveLoadBalancerIP ¶ added in v1.2.0

func ResolveLoadBalancerIP(override, nodeIP string) string

ResolveLoadBalancerIP returns the IP to publish as the LoadBalancer EXTERNAL-IP. It falls back to nodeIP when the override is empty or not a valid IPv4 address, so a bad override never silently picks a different NIC than the node itself.

func ResolveMTU ¶ added in v1.2.0

func ResolveMTU(override int) (mtu int, pinned bool, err error)

ResolveMTU returns the MTU to apply to the embedded CNI bridge and pod veth interfaces, and whether it was explicitly pinned via a valid override. override <= 0 means "not specified": auto-detect via GetNodeMTU, not pinned. An override outside the valid IPv4 MTU range [68, 65535] is rejected with a warning and falls back to auto-detection, not pinned — a typo must not silently switch the caller into pinned behavior. A valid override is always used as-is and pinned, even if it differs from the auto-detected value (soft warning only, analogous to isLocalIP's VIP warning for --node-ip).

func ResolveNodeIP ¶ added in v1.1.8

func ResolveNodeIP(override string) (ip string, pinned bool, err error)

ResolveNodeIP returns the node IP to advertise and whether it was explicitly pinned via a valid override. When override is a valid IPv4 it is used as-is and pinned is true — a value not bound to a local interface is still allowed but logged (e.g. a VIP). An empty or unparseable override falls back to auto-detection via GetNodeIP with pinned false, so a typo does not silently switch the caller into "pinned" behavior.

func UseIPTables ¶ added in v1.2.3

func UseIPTables() bool

UseIPTables reports whether kubesolo programs netfilter through iptables rather than nftables. Both the kernel tables and the iptables binary have to be present: kubesolo modprobes ip_tables on every start, so the kernel side alone says nothing about whether the binary is installed, and RHEL 10 ships the module without iptables. Picking iptables mode there crash-loops kubesolo on its first iptables call, while nftables mode works.