Kibotos
API 参考kibotos.ctrl.v1

ResolverService

本页列出 kibotos.ctrl.v1 中 ResolverService 的方法及每个方法用到的消息与枚举，由 ctrl.proto 及其注释生成，注释保持英文。多个服务共用的消息与枚举见 kibotos.ctrl.v1 类型。

ctrl API使用 Operator 证书调用。调用方式

ResolverService owns caller-chosen DNS upstreams. A guest sends every DNS query to one address on its own link; a PUBLIC_INTERNET policy that lists a Resolver in NetworkPolicy.resolvers has those queries forwarded to it, directly from the host or through an Egress of the same policy. One Resolver may be referenced by many Workspaces. A Resolver carries no credential, so every read returns its whole content. Every write carries a command ID.

CreateResolver

CreateResolver stores a new Resolver at revision 1.

POST/kibotos.ctrl.v1.ResolverService/CreateResolver一元调用
请求CreateResolverRequest
响应CreateResolverResponse

GetResolver

POST/kibotos.ctrl.v1.ResolverService/GetResolver一元调用
请求GetResolverRequest
响应GetResolverResponse

ListResolvers

POST/kibotos.ctrl.v1.ResolverService/ListResolvers一元调用
请求ListResolversRequest
  • page_sizeuint32= 1

    Zero selects the server default. Values above the server maximum are rejected rather than silently changed.

  • page_tokenstring= 2

    Opaque cursor returned by the preceding page.

  • label_selectormap<string, string>= 3

    When non-empty, return only Resolvers that carry every entry as a label with exactly that value. Keys and values must satisfy the label rules. A page token is only valid with the selector it was issued for.

响应ListResolversResponse

UpdateResolver

UpdateResolver replaces the whole spec. expected_revision must equal the current revision or the call is aborted and nothing changes. Equal content is idempotent and keeps the revision; different content increments it. While a policy of a non-deleted Workspace sends queries to this Resolver directly, an upstream written as an IP address in a fixed special-purpose range, or a hostname that resolves into one when the server resolves it once, is invalid_argument. The call returns once the change is stored, without waiting for running Workspaces: each one that references this Resolver then sends its new queries to the new revision, which its network_policy_status.resolvers entry reports as applied_revision. Queries already sent complete against the previous revision. Updating a Resolver never changes the revision of a policy that references it.

POST/kibotos.ctrl.v1.ResolverService/UpdateResolver一元调用
请求UpdateResolverRequest
响应UpdateResolverResponse

DeleteResolver

DeleteResolver deletes a Resolver that no policy of a non-deleted Workspace references; while one does, it is failed_precondition. A deleted Resolver is not_found to every read and every reference.

POST/kibotos.ctrl.v1.ResolverService/DeleteResolver一元调用
请求DeleteResolverRequest
响应DeleteResolverResponse

UpdateResolverLabels

UpdateResolverLabels and UpdateResolverAnnotations follow the rules of their Workspace counterparts.

POST/kibotos.ctrl.v1.ResolverService/UpdateResolverLabels一元调用
请求UpdateResolverLabelsRequest
响应UpdateResolverLabelsResponse

UpdateResolverAnnotations

POST/kibotos.ctrl.v1.ResolverService/UpdateResolverAnnotations一元调用
请求UpdateResolverAnnotationsRequest
响应UpdateResolverAnnotationsResponse

消息与枚举

ResolverService 的多个方法用到以下消息与枚举。

ResolverSpec

ResolverSpec is the content of a Resolver. Exactly one protocol branch is selected; a create or update without one is invalid_argument. Reads return the selected branch and its content as stored.

An IP address is written in the canonical text of NetworkPolicy allow and deny, an IPv6 address inside brackets when a port follows. The host of a tls or https upstream is also the name its certificate is verified against with the system trust roots; when the host is an IP address the certificate must carry that address.

UdpResolver

UdpResolver is a DNS server reached over UDP. A query the guest sends over TCP is sent over TCP to the same address.

  • addressstring= 1

    address is an IP address or IP:port; the port defaults to 53. A hostname is invalid_argument.

TcpResolver

TcpResolver is a DNS server reached over TCP.

  • addressstring= 1

    address is an IP address or IP:port; the port defaults to 53. A hostname is invalid_argument.

TlsResolver

TlsResolver is a DNS-over-TLS server (RFC 7858).

  • addressstring= 1

    address is host or host:port, where host is an IP address or a hostname; the port defaults to 853.

HttpsResolver

HttpsResolver is a DNS-over-HTTPS server (RFC 8484); queries are sent with POST.

  • urlstring= 1

    url is https://host[:port]/path, where host is an IP address or a hostname; the port defaults to 443. User information, a query string and a fragment are invalid_argument. The path is visible to every caller of the same deployment that can read the Resolver.

Resolver

  • resolver_idstring= 1
  • revisionuint64= 3

    revision is assigned by the server: it is 1 at creation and increases by one each time the spec changes. It is independent of the revision of every policy that references this Resolver.

  • created_atgoogle.protobuf.Timestamp= 4
  • updated_atgoogle.protobuf.Timestamp= 5
  • annotationsmap<string, string>= 6

    labels and annotations have the same meaning, rules, and limits as on Workspace.

  • labelsmap<string, string>= 7
  • labels_revisionuint64= 8

    labels_revision is the CAS token UpdateResolverLabels expects.

  • annotations_revisionuint64= 9

    annotations_revision is the CAS token UpdateResolverAnnotations expects.

EgressService

本页列出 kibotos.ctrl.v1 中 EgressService 的方法及每个方法用到的消息与枚举，由 ctrl.proto 及其注释生成，注释保持英文。多个服务共用的消息与枚举见 kibotos.ctrl.v1 类型。

TransferService

本页列出 kibotos.ctrl.v1 中 TransferService 的方法及每个方法用到的消息与枚举，由 ctrl.proto 及其注释生成，注释保持英文。多个服务共用的消息与枚举见 kibotos.ctrl.v1 类型。

本页内容

CreateResolverGetResolverListResolversUpdateResolverDeleteResolverUpdateResolverLabelsUpdateResolverAnnotations消息与枚举ResolverSpecUdpResolverTcpResolverTlsResolverHttpsResolverResolver