Module port_forward 

Port forwarding into the network namespace of a pod, the Kubernetes portforward.k8s.io protocol, as k8s.io/cri-streaming serves it for CRI-O otherwise.

Over SPDY, the client opens two streams per forwarded connection, both with the port and requestID headers: an error stream, on which the server reports why forwarding failed, and a data stream, which carries the connection. The kubelet always uses SPDY, direct clients like crictl may tunnel it through a WebSocket instead.

A request waits for its second stream without reading the first one. client-go opens the error stream first and waits for its reply, a client which sends a lot on a data stream before opening its error stream holds up the connection until the request times out.

The older WebSocket protocol forwards one connection per port in the query of the request. Each port gets a data and an error channel, every message starts with its channel and the first one of each channel carries the port.

Modules

channels 🔒

The channel protocol: a connection per port in the query, each with a data and an error channel.

namespace 🔒

The thread which creates the sockets of a session in the network namespace of its pod.

requests 🔒

The SPDY protocol: the streams of a request pair up by their headers, then the request forwards one connection.

tunnel 🔒

Port forwarding over a WebSocket: the protocol, and SPDY tunneled through binary messages.

Structs

Early 🔒

What a client sent while its connection got established, within the connect budget of the session, see CONNECT_BUDGET. It gets collected into one buffer, small data does not take an allocation each.

PortForward 🔒

A port forward session of a pod.

Constants

BASE64_CHANNEL_PROTOCOL 🔒

CHANNEL_BUFFER 🔒

How many bytes of the client the ports of a WebSocket hold together, before the WebSocket is not read anymore. Without it, a client could make the server hold CHANNEL_QUEUE messages of up to the largest message size for each of MAX_CHANNEL_PORTS ports which do not take them.

CHANNEL_PROTOCOL 🔒

The WebSocket subprotocols of the channel protocol, which is binary without a subprotocol as well.

CHANNEL_QUEUE 🔒

How many messages of the client wait for a forwarded connection, before the WebSocket is not read anymore.

CLOSE_GRACE_PERIOD 🔒

How long the client gets to close its side of a connection after the container closed its side, and the container to send the rest of its output after writing to it failed, like CRI-O waits.

CONNECT_BUDGET 🔒

How much the connections of a session which get established hold for the client together. Their data moves from the byte budget of the client into this one, so that connections to a port which does not answer, which the connect timeout could take long, do not stop the others. Once it is used up, connecting streams stop taking their data, which then stays in the byte budget of the client and may stop reading the client like any stream which does not take its data. Any number of connections get established at once, like with CRI-O.

CONNECT_BUFFER 🔒

How much a client may send for a connection before it got established in the pod, a client which sends more fails the forwarding.

CONNECT_TIMEOUT 🔒

How long connecting to a port in the pod may take. Within the pod it gets accepted or refused right away, unless a firewall drops it.

HALF_CLOSE_GRACE_PERIOD 🔒

How long the pod gets to answer and close its side of a SPDY connection after the client closed its side. A client whose local application went away looks the same as one which only finished its request: client-go closes the data stream first, and resetting a stream it closed already sends nothing. Without a bound, a pod which never stops sending would keep the streams of such a request, which count against the most streams of the connection, for as long as the connection lasts. CRI-O ends both directions CLOSE_GRACE_PERIOD after either one finished, this is long enough for the answer to a request which ends with the client closing its side.

MAX_CHANNEL_PORTS 🔒

The most ports of a channel protocol request. Base64 clients get the channel as an ASCII digit offset, which stays a single byte for the channels of these ports.

OUTPUT_QUEUE 🔒

How many messages for the client wait for the WebSocket.

PORT_HEADER 🔒

PORT_QUERY 🔒

The query parameter with the ports of the channel protocol.

PROTOCOL 🔒

The protocol the client has to ask for in the upgrade request.

READ_BUFFER 🔒

How much of the container output goes into a single frame, as much as Go clients send per frame.

REQUEST_ID_HEADER 🔒

SOCKET_THREAD_LINGER 🔒

How long the thread waits for the next connection before it ends, which leaves the network namespace.

SOCKET_THREAD_STACK_SIZE 🔒

The stack of the thread which creates the sockets of a session within its network namespace.

SPDY_TUNNEL_PROTOCOL 🔒

The WebSocket subprotocol of SPDY tunneled through a WebSocket.

STREAM_TYPE_DATA 🔒

STREAM_TYPE_ERROR 🔒

TUNNEL_BUFFER 🔒

The size of the buffers between the WebSocket and the tunneled SPDY connection.

Traits

Input 🔒

The data a client sends for a forwarded connection. It counts against the budget of the client until it got written to the pod.