pub struct SidecarController { /* private fields */ }Expand description
The sidecar controller: configures the inbound and outbound listeners and (when production-ready) the iptables/TPROXY redirect bootstrap.
§Stubbed
The controller is a SCAFFOLD today. It records the resolved
SidecarConfig and exposes the listener configuration the runtime
would bind, but does NOT:
- install iptables REDIRECT/TPROXY rules (the init-container bootstrap that runs as root and configures the pod’s network namespace would land here when production-ready),
- open the inbound/outbound listener sockets,
- terminate or wrap mTLS (the mTLS wiring lives in
security::tls, which would consume the SVID cert/key and trust bundle fromcrate::mesh::spiffe::SpiffeClient).
The controller is the compile-time seam: it validates the configuration shape and documents the runtime contract so the production wiring lands here without touching config, validation, or metrics.
Implementations§
Source§impl SidecarController
impl SidecarController
Sourcepub fn new(config: SidecarConfig) -> Self
pub fn new(config: SidecarConfig) -> Self
Build a controller from the resolved sidecar config.
Sourcepub fn config(&self) -> &SidecarConfig
pub fn config(&self) -> &SidecarConfig
The resolved sidecar configuration.
Sourcepub fn inbound_listener(&self) -> (SidecarMode, u16, SidecarRedirectMode)
pub fn inbound_listener(&self) -> (SidecarMode, u16, SidecarRedirectMode)
The inbound listener configuration: the port the sidecar binds to receive traffic destined for the local app, and the redirect mode used to capture it. Inbound terminates mTLS, applies policies, and forwards to the local app over loopback.
Sourcepub fn outbound_listener(&self) -> (SidecarMode, u16, SidecarRedirectMode)
pub fn outbound_listener(&self) -> (SidecarMode, u16, SidecarRedirectMode)
The outbound listener configuration: the port the sidecar binds to receive traffic the local app sends to remote services, and the redirect mode used to capture it. Outbound applies policies, wraps the request in mTLS, and dials the remote sidecar.
Sourcepub fn install_redirects(&self)
pub fn install_redirects(&self)
Install the iptables/TPROXY redirect rules that capture traffic into the inbound and outbound listeners.
§Stubbed
This is a documented no-op today. The sidecar bootstrap (the
init container that runs as root and configures the pod’s
network namespace with iptables REDIRECT or TPROXY rules) would
land here when production-ready. Today the controller records
the configured redirect mode and logs that the bootstrap is
stubbed, so an operator who builds with --features mesh sees
the configuration is accepted and the redirect is scaffolded.
Trait Implementations§
Source§impl Clone for SidecarController
impl Clone for SidecarController
Source§fn clone(&self) -> SidecarController
fn clone(&self) -> SidecarController
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read moreAuto Trait Implementations§
impl Freeze for SidecarController
impl RefUnwindSafe for SidecarController
impl Send for SidecarController
impl Sync for SidecarController
impl Unpin for SidecarController
impl UnwindSafe for SidecarController
Blanket Implementations§
§impl<T> AnyExt for T
impl<T> AnyExt for T
§fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
T behind reference§fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
T behind mutable reference§fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
T behind Rc pointer§fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
T behind Arc pointer§fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
T behind Box pointer§fn downcast_move<T>(this: Self) -> Option<T>
fn downcast_move<T>(this: Self) -> Option<T>
Self to T,
useful only in generic context as a workaround for specializationSource§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
§impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
fn coerce_rc_to(self: Rc<X>) -> Rc<T>
fn coerce_box_to(self: Box<X>) -> Box<T>
fn coerce_ref_to(&self) -> &T
fn coerce_mut_to(&mut self) -> &mut T
§impl<T> Instrument for T
impl<T> Instrument for T
§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more