ResolverService
This page lists the methods of ResolverService in kibotos.ctrl.v1 with the messages and enums each one uses, generated from ctrl.proto and its comments. Those that several services use are on kibotos.ctrl.v1 types.
ResolverService owns caller-chosen DNS upstreams. A guest sends every DNS query to one address on its own link; a PUBLIC_INTERNET policy that lists a Resolver in NetworkPolicy.resolvers has those queries forwarded to it, directly from the host or through an Egress of the same policy. One Resolver may be referenced by many Workspaces. A Resolver carries no credential, so every read returns its whole content. Every write carries a command ID.
CreateResolver
CreateResolver stores a new Resolver at revision 1.
/kibotos.ctrl.v1.ResolverService/CreateResolverUnaryCreateResolverRequestPersisted in the same transaction as the create command, with the rules and limits of Workspace.labels and Workspace.annotations. Both are included in idempotency.
CreateResolverResponseGetResolver
/kibotos.ctrl.v1.ResolverService/GetResolverUnaryGetResolverRequestGetResolverResponseListResolvers
/kibotos.ctrl.v1.ResolverService/ListResolversUnaryListResolversRequestZero selects the server default. Values above the server maximum are rejected rather than silently changed.
Opaque cursor returned by the preceding page.
When non-empty, return only Resolvers that carry every entry as a label with exactly that value. Keys and values must satisfy the label rules. A page token is only valid with the selector it was issued for.
ListResolversResponseUpdateResolver
UpdateResolver replaces the whole spec. expected_revision must equal the current revision or the call is aborted and nothing changes. Equal content is idempotent and keeps the revision; different content increments it. While a policy of a non-deleted Workspace sends queries to this Resolver directly, an upstream written as an IP address in a fixed special-purpose range, or a hostname that resolves into one when the server resolves it once, is invalid_argument. The call returns once the change is stored, without waiting for running Workspaces: each one that references this Resolver then sends its new queries to the new revision, which its network_policy_status.resolvers entry reports as applied_revision. Queries already sent complete against the previous revision. Updating a Resolver never changes the revision of a policy that references it.
/kibotos.ctrl.v1.ResolverService/UpdateResolverUnaryUpdateResolverRequestThe revision the caller observed. It is required: a mismatch is aborted and never overwrites a concurrent update. Retries preserve this value.
The complete replacement.
UpdateResolverResponseDeleteResolver
DeleteResolver deletes a Resolver that no policy of a non-deleted Workspace references; while one does, it is failed_precondition. A deleted Resolver is not_found to every read and every reference.
/kibotos.ctrl.v1.ResolverService/DeleteResolverUnaryDeleteResolverRequestDeleteResolverResponseUpdateResolverLabels
UpdateResolverLabels and UpdateResolverAnnotations follow the rules of their Workspace counterparts.
/kibotos.ctrl.v1.ResolverService/UpdateResolverLabelsUnaryUpdateResolverLabelsRequestThe labels_revision the caller observed. Retries preserve this value.
The complete replacement; empty clears every label.
UpdateResolverLabelsResponseUpdateResolverAnnotations
/kibotos.ctrl.v1.ResolverService/UpdateResolverAnnotationsUnaryUpdateResolverAnnotationsRequestThe annotations_revision the caller observed. Retries preserve this value.
The complete replacement; empty clears every annotation.
UpdateResolverAnnotationsResponseMessages and enums
Several methods of ResolverService use these messages and enums.
ResolverSpec
ResolverSpec is the content of a Resolver. Exactly one protocol branch is selected; a create or update without one is invalid_argument. Reads return the selected branch and its content as stored.
An IP address is written in the canonical text of NetworkPolicy allow and deny, an IPv6 address inside brackets when a port follows. The host of a tls or https upstream is also the name its certificate is verified against with the system trust roots; when the host is an IP address the certificate must carry that address.
- One of
protocol
UdpResolver
UdpResolver is a DNS server reached over UDP. A query the guest sends over TCP is sent over TCP to the same address.
address is an IP address or IP:port; the port defaults to 53. A hostname is invalid_argument.
TcpResolver
TcpResolver is a DNS server reached over TCP.
address is an IP address or IP:port; the port defaults to 53. A hostname is invalid_argument.
TlsResolver
TlsResolver is a DNS-over-TLS server (RFC 7858).
address is host or host:port, where host is an IP address or a hostname; the port defaults to 853.
HttpsResolver
HttpsResolver is a DNS-over-HTTPS server (RFC 8484); queries are sent with POST.
url is https://host[:port]/path, where host is an IP address or a hostname; the port defaults to 443. User information, a query string and a fragment are invalid_argument. The path is visible to every caller of the same deployment that can read the Resolver.
Resolver
revision is assigned by the server: it is 1 at creation and increases by one each time the spec changes. It is independent of the revision of every policy that references this Resolver.
labels and annotations have the same meaning, rules, and limits as on Workspace.
labels_revision is the CAS token UpdateResolverLabels expects.
annotations_revision is the CAS token UpdateResolverAnnotations expects.
EgressService
This page lists the methods of EgressService in kibotos.ctrl.v1 with the messages and enums each one uses, generated from ctrl.proto and its comments. Those that several services use are on kibotos.ctrl.v1 types.
TransferService
This page lists the methods of TransferService in kibotos.ctrl.v1 with the messages and enums each one uses, generated from ctrl.proto and its comments. Those that several services use are on kibotos.ctrl.v1 types.