Module sidecar 

Sidecar traffic interception (DW-107).

dwara runs as a sidecar in each pod. An init container (or the sidecar bootstrap) configures the network so all traffic to and from the local application flows through the sidecar:

• INBOUND: traffic destined for the local app is redirected to the sidecar’s inbound listener. The sidecar terminates mTLS (verifying the peer’s SPIFFE SVID against the trust bundle), applies policies, then forwards the plaintext request to the local app over loopback.
• OUTBOUND: traffic the local app sends to a remote service is redirected to the sidecar’s outbound listener. The sidecar applies policies, wraps the request in mTLS (presenting the local workload’s SVID), then dials the remote service’s sidecar.

Redirect modes

Two redirect modes are scaffolded:

• SidecarRedirectMode::Iptables: the init container installs iptables REDIRECT rules that send traffic to the inbound/outbound listener ports. This is the default and the most common mode (used by Istio/Linkerd-style sidecars).
• SidecarRedirectMode::Tproxy: TPROXY (transparent proxy) mode uses iptables TPROXY + IP_TRANSPARENT so the sidecar receives the original destination address (no REDIRECT port rewrite), enabling the sidecar to know the intended upstream without parsing the SO_ORIGINAL_DST socket option.

Stubbed

The actual iptables/TPROXY rule installation is STUBBED. The SidecarController records the configured inbound/outbound listeners and documents the redirect setup, but does NOT install iptables rules or open sockets. The sidecar bootstrap (the init container that runs as root and configures the network namespace) would land here when production-ready. Today the controller is the compile-time scaffold: it validates the configuration shape and exposes the listener configuration the runtime would bind.

Structs

SidecarConfig

The resolved sidecar configuration: the listener ports and redirect mode the controller binds. Built from the config schema (MeshSidecarConfig) at compile time.

SidecarController

The sidecar controller: configures the inbound and outbound listeners and (when production-ready) the iptables/TPROXY redirect bootstrap.

Enums

SidecarMode

The direction of traffic a sidecar listener handles.

SidecarRedirectMode

The redirect mode the sidecar bootstrap uses to capture traffic.