github.com/fafucoder/cilium@v1.6.11/Documentation/policy/lifecycle.rst (about)

     1  .. only:: not (epub or latex or html)
     2  
     3      WARNING: You are looking at unreleased Cilium documentation.
     4      Please use the official rendered version released here:
     5      http://docs.cilium.io
     6  
     7  .. _endpoint_lifecycle:
     8  .. _Endpoint Lifecycle:
     9  
    10  Endpoint Lifecycle
    11  ==================
    12  
    13  This section specifies the lifecycle of Cilium endpoints.
    14  
    15  Every endpoint in Cilium is in one of the following states:
    16  
    17  * ``restoring``: The endpoint was started before Cilium started, and
    18    Cilium is restoring its networking configuration.
    19  * ``waiting-for-identity``: Cilium is allocating a unique identity for
    20    the endpoint.
    21  * ``waiting-to-regenerate``: The endpoint received an identity and is
    22    waiting for its networking configuration to be (re)generated.
    23  * ``regenerating``: The endpoint's networking configuration is being
    24    (re)generated. This includes programming BPF for that endpoint.
    25  * ``ready``: The endpoint's networking configuration has been
    26    successfully (re)generated.
    27  * ``disconnecting``: The endpoint is being deleted.
    28  * ``disconnected``: The endpoint has been deleted.
    29  
    30  .. image:: ../images/cilium-endpoint-lifecycle.png
    31     :scale: 50 %
    32     :align: center
    33  
    34  The state of an endpoint can be queried using the ``cilium endpoint
    35  list`` and ``cilium endpoint get`` CLI commands.
    36  
    37  While an endpoint is running, it transitions between the
    38  ``waiting-for-identity``, ``waiting-to-regenerate``, ``regenerating``,
    39  and ``ready`` states.  A transition into the ``waiting-for-identity``
    40  state indicates that the endpoint changed its identity.  A transition
    41  into the ``waiting-to-regenerate`` or ``regenerating`` state indicates
    42  that the policy to be enforced on the endpoint has changed because of
    43  a change in identity, policy, or configuration.
    44  
    45  An endpoint transitions into the ``disconnecting`` state when it is
    46  being deleted, regardless of its current state.
    47  
    48  In some environments, notably Docker and Kubernetes, Cilium can't
    49  determine the labels of an endpoint immediately when the endpoint is
    50  created, and therefore can't allocate an identity for the endpoint at
    51  that point.  Until the endpoint's labels are known, Cilium temporarily
    52  associates a special single label ``reserved:init`` to the endpoint.
    53  When the endpoint's labels become known, Cilium then replaces that
    54  special label with the endpoint's labels and allocates a proper
    55  identity to the endpoint.
    56  
    57  To allow traffic to/from endpoints while they are initializing, you
    58  can create policy rules that select the ``reserved:init`` label,
    59  and/or rules that allow traffic to/from the special ``init`` entity.
    60  
    61  For instance, writing a rule that allows all initializing endpoints to
    62  receive connections from the host and to perform DNS queries may be
    63  done as follows:
    64  
    65  .. only:: html
    66  
    67     .. tabs::
    68       .. group-tab:: k8s YAML
    69  
    70          .. literalinclude:: ../../examples/policies/l4/init.yaml
    71       .. group-tab:: JSON
    72  
    73          .. literalinclude:: ../../examples/policies/l4/init.json
    74  
    75  .. only:: epub or latex
    76  
    77          .. literalinclude:: ../../examples/policies/l4/init.json
    78  
    79  Likewise, writing a rule that allows an endpoint to receive DNS
    80  queries from initializing endpoints may be done as follows:
    81  
    82  .. only:: html
    83  
    84     .. tabs::
    85       .. group-tab:: k8s YAML
    86  
    87          .. literalinclude:: ../../examples/policies/l4/from_init.yaml
    88       .. group-tab:: JSON
    89  
    90          .. literalinclude:: ../../examples/policies/l4/from_init.json
    91  
    92  .. only:: epub or latex
    93  
    94          .. literalinclude:: ../../examples/policies/l4/from_init.json
    95  
    96  If any ingress (resp. egress) policy rules selects the
    97  ``reserved:init`` label, all ingress (resp. egress) traffic to
    98  (resp. from) initializing endpoints that is not explicitly allowed by
    99  those rules will be dropped.  Otherwise, if the policy enforcement
   100  mode is ``never`` or ``default``, all ingress (resp. egress) traffic
   101  is allowed to (resp. from) initializing endpoints.  Otherwise, all
   102  ingress (resp. egress) traffic is dropped.