Donavan Fritz
39ede9130b
Build flock Image / build (push) Has been cancelled
New pkg/agent/netpol implementing standard networking.k8s.io/v1 NetworkPolicy. Pipeline: pods + policies + namespaces → Translate → Render → Apply Supports ingress + egress, all three peer types (podSelector, namespaceSelector, ipBlock with except), numeric ports + port ranges, default-deny semantics derived from PolicyTypes (or inferred from non-empty Spec.Egress when unset). Apply path is `nft -f -` shell-out — single transaction, atomic, kernel guarantees partial-failure rollback. Idempotent dedup via last-applied script. Reconcile triggers: informer events, 30s self-heal tick, every CNI ADD/DEL. Verified against the three live cluster NetPols (calico-apiserver, remote-proxies/lodge-home-assistant, storage/garage-admin-restrict). Fuzz target stitches Translate + Render with random selector and peer inputs; 21 unit tests cover the policy semantics. Named ports skip with a warn — deferred until kubelet exposes them in a form that doesn't require shadowing pod state. Dockerfile: + nftables. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
29 lines
911 B
Docker
29 lines
911 B
Docker
FROM golang:1.26-alpine AS build
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY cmd/ ./cmd/
|
|
COPY pkg/ ./pkg/
|
|
|
|
RUN go test -count=1 ./...
|
|
|
|
ARG GIT_SHA=unknown
|
|
RUN CGO_ENABLED=0 go build -trimpath \
|
|
-ldflags="-s -w -X main.gitSHA=${GIT_SHA}" \
|
|
-o /out/flock ./cmd/flock \
|
|
&& CGO_ENABLED=0 go build -trimpath \
|
|
-ldflags="-s -w -X main.gitSHA=${GIT_SHA}" \
|
|
-o /out/flock-agent ./cmd/flock-agent \
|
|
&& CGO_ENABLED=0 go build -trimpath \
|
|
-ldflags="-s -w -X main.gitSHA=${GIT_SHA}" \
|
|
-o /out/flock-installer ./cmd/flock-installer
|
|
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache iproute2 bird nftables ca-certificates
|
|
COPY --from=build /out/flock /usr/local/bin/flock
|
|
COPY --from=build /out/flock-agent /usr/local/bin/flock-agent
|
|
COPY --from=build /out/flock-installer /usr/local/bin/flock-installer
|
|
ENTRYPOINT ["/usr/local/bin/flock-agent"]
|