Documentation
¶
Overview ¶
Package egress provides the PreCreatePod plugin that injects the sandbox egress filter (an init container that installs the iptables redirect and a native sidecar that runs the proxy) into Pods of Pools whose Spec.NetworkPolicy is set. Enforcement lives entirely in the Pod network namespace + the sidecar, so it is independent of the sandbox container's image (survives in-place image swap) and of the cluster CNI (works on Calico / Aliyun ENI alike).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Image is the container image that carries the egress-proxy binary. Both
// the init container and the sidecar run it (different subcommands). Defaults
// to the operator's idle image, which is guaranteed present on pool nodes.
Image string
}
Config parameterizes the injected containers.
type Plugin ¶
type Plugin struct {
plugins.BasePlugin
// contains filtered or unexported fields
}
Plugin injects the egress filter sidecar. It self-gates on pool.Spec.NetworkPolicy — Pools without a policy are untouched.
func (*Plugin) PreCreatePod ¶
func (p *Plugin) PreCreatePod(_ context.Context, pod *corev1.Pod, pool *agentsv1alpha1.SandboxPool) (bool, *domain.AppError)
PreCreatePod injects the init container + native sidecar + policy volume when the owning Pool has a NetworkPolicy, and hardens the sandbox containers (strip NET_ADMIN, reject a uid collision with the proxy). Idempotent.
Source Files