package telepresence.manager
Get desktop application:
View/edit binary Protocol Buffers messages
service Manager
manager.proto:1091rpc ArriveAsAgent (, )
manager.proto:1117ArriveAsAgent establishes a session between an agent and the Manager.
rpc ArriveAsClient (, )
manager.proto:1108ArriveAsClient establishes a session between a client and the Manager.
rpc CreateIntercept (, )
manager.proto:1212CreateIntercept lets a client create an intercept. It will be created in the "WATING" disposition, and it will remain in that state until the Agent (the app-sidecar) calls ReviewIntercept() to transition it to the "ACTIVE" disposition (or one of the error dispositions).
rpc Depart (, )
manager.proto:1124Depart terminates a session.
rpc EnsureAgent (, )
manager.proto:1195EnsureAgent ensures that an agent is injected to the pods of a workload and returns the agents, sorted by pod name.
message
manager.proto:440optional session = 1
string name = 2
string namespace = 3
bool node_agent = 4
Request that this agent be served by a node-hosted traffic-agent (a manager-created Job that enters the target pod's namespaces) rather than by a sidecar injected into the workload. Requires the traffic-manager to have node-agent mode enabled.
rpc GetAgentConfig (, )
manager.proto:1099GetAgentConfig returns the agent configuration for a specific workload.
rpc GetAgentImageFQN (, )
manager.proto:1096GetAgentImageFQN returns fully qualified name of the image that is injected into intercepted pods.
rpc GetClientConfig (, )
manager.proto:1102GetClientConfig returns the config that connected clients should use for this manager.
message
manager.proto:882bytes config_yaml = 1
config_yaml is a yaml blob containing the client config.
rpc GetIntercept (, )
manager.proto:1218GetIntercept gets info from intercept name
GetKnownWorkloadKinds returns the known workload kinds that the manager can handle. This set may include Deployment, StatefulSet, ReplicaSet, Rollout (Argo Rollouts) as configured in the manager's Helm values.
rpc GetQuicAgentCert (, )
manager.proto:1268GetQuicAgentCert mints a QUIC server certificate for the calling agent's own SNI name (quicfwd.AgentSNI(pod UID)), so it can run a QUIC listener behind the forwarder. The caller's session must be an agent session (established via ArriveAsAgent/ReconnectAgent). The returned descriptor has enabled == false when the manager has no QUIC CA.
message
manager.proto:733QuicAgentCert is the response to GetQuicAgentCert: a server certificate, minted by the traffic-manager's QUIC CA for the caller agent's own SNI name, so the agent can run a QUIC listener behind the forwarder. See docs/reference/quic-transport-architecture.md, "Agent connections over QUIC".
bool enabled = 1
false only for a manager predating the unconditional CA (see NewService): the CA is now always present, so the remaining fields are only absent when talking to one of those older managers.
bytes cert_pem = 2
Server certificate (PEM) for the agent's SNI name.
bytes key_pem = 3
Private key (PEM) for cert_pem.
bytes ca_pem = 4
CA bundle (PEM) the agent uses as ClientCAs, to verify client certificates presented by connecting clients.
string sni = 5
The SNI name the certificate was minted for (quicfwd.AgentSNI(pod UID)).
string authentication_mode = 6
The manager's security.authentication.mode. Agents mirror it when deciding whether to require the session credential (see "Traffic-agent ports" in docs/reference/authentication.md).
GetQuicTunnelEndpoint returns the descriptor for the traffic-manager's QUIC endpoint, including a session-scoped client certificate, so that the caller can dial it directly instead of tunneling over this port-forwarded connection. The returned descriptor has enabled == false when no QUIC endpoint is exposed.
message
manager.proto:630QuicTunnelEndpoint describes the traffic-manager's QUIC endpoint, if any, so that a client can dial it directly instead of tunneling over the port-forwarded connection.
bool enabled = 1
Whether the traffic-manager has a QUIC listener exposed. The remaining fields are only meaningful when this is true.
string host = 2
Externally reachable host or IP of the QUIC endpoint.
int32 port = 3
UDP port of the QUIC endpoint.
bytes ca_pem = 4
CA bundle (PEM) to verify the server certificate against.
bytes client_cert_pem = 5
Session-scoped client certificate (PEM) to present to the server.
bytes client_key_pem = 6
Private key (PEM) for the client certificate.
string server_name = 7
TLS server name to use when verifying the server certificate.
string alpn = 8
ALPN protocol to offer in the TLS handshake. An empty value means the client's built-in default.
repeated candidates = 9
Candidate dialable addresses for the QUIC endpoint, ordered by the traffic-manager's preference (see "Zero-configuration endpoint discovery" in docs/reference/quic-transport-architecture.md). The client dials candidates concurrently and keeps the first whose handshake completes. host/port above always duplicate the first entry, if any, so an older client (built before this field existed) still gets a single address to dial.
GetSessionCredential returns the session-scoped credential used to authenticate against a traffic-agent's file-sharing and gRPC ports, in both its certificate and bearer-token forms. It is only served to the session's owner.
message
manager.proto:677SessionCredential is the response to GetSessionCredential: the session-scoped credential -- in both its certificate and bearer-token forms -- used to authenticate against a traffic-agent's file-sharing and gRPC ports. See "Traffic-agent ports" in docs/reference/authentication.md.
bytes ca_pem = 1
CA bundle (PEM) that signed the client certificate and the token.
bytes client_cert_pem = 2
Client certificate (PEM) whose CommonName is the session ID.
bytes client_key_pem = 3
Private key (PEM) for client_cert_pem.
string token = 4
Signed bearer token naming the session; rides where a certificate cannot (the FTP password, gRPC metadata).
optional expiry = 5
Expiry shared by the certificate and the token.
rpc GetTelepresenceAPI (, )
manager.proto:1105GetTelepresenceAPI returns information about the TelepresenceAPI server
message
manager.proto:593int32 port = 1
The port that the TelepresenceAPI is using, or 0 if it's not enabled
rpc Lookup (, )
manager.proto:1231Lookup performs an LookupIP in the cluster and returns the resultings IPs.
rpc LookupDNS (, )
manager.proto:1235LookupDNS performs a DNS lookup in the cluster. If the caller has intercepts active, the lookup will be performed from the intercepted pods.
rpc PrepareIntercept (, )
manager.proto:1205Request that the traffic-manager makes the preparations necessary to create the given intercept.
message
manager.proto:458string error = 1
int32 error_category = 2
string namespace = 3
string service_uid = 4
string service_name = 5
string service_port_name = 6
int32 service_port = 7
string workload_kind = 8
string agent_image = 9
string protocol = 10
TCP or UDP
string container_name = 11
int32 container_port = 12
repeated string pod_ports = 13
repeated bytes service_ips = 14
The cluster IPs of the service, each in netip.Addr binary form.
rpc ReconnectAgent (, )
manager.proto:1111ReconnectAgent re-establishes a session between an agent and the Manager.
message
manager.proto:366optional session = 1
optional agent = 2
rpc ReconnectClient (, )
manager.proto:1114ReconnectClient re-establishes a session between a client and the Manager.
message
manager.proto:371optional session = 1
optional client = 2
repeated intercepts = 3
repeated agents = 4
rpc ReleaseAgent (, )
manager.proto:1201ReleaseAgent releases the caller's claim on a node-agent previously ensured with node_agent=true in EnsureAgentRequest. The manager reaps the node-agent Job once no live intercept or claim remains. For a sidecar agent (or an unknown claim) it is a no-op.
message
manager.proto:452optional session = 1
string name = 2
string namespace = 3
rpc Remain (, )
manager.proto:1121Remain indicates that the session is still valid, and potentially updates the auth token for the session.
message
manager.proto:517optional session = 1
optional last_activity = 3
rpc RemoveIntercept (, )
manager.proto:1215RemoveIntercept lets a client remove an intercept.
rpc ReportMetrics (, )
manager.proto:1281ReportMetrics is used by a traffic-agent to report metrics for streams established when clients connect directly to traffic-agents using port-forward.
message
manager.proto:933string client_session_id = 1
uint64 ingress_bytes = 2
Number of bytes sent from the client to the traffic-agent.
uint64 egress_bytes = 3
Number of bytes sent from traffic-agent to the client.
rpc ResolveServicePort (, )
manager.proto:1239ResolveServicePort resolves a service port given by name or number to the service's ClusterIP and numeric port.
message
manager.proto:788ResolveServicePort request sent from a client.
optional session = 1
Client session
string namespace = 2
Namespace of the service.
string service = 3
Name of the service.
string port = 4
Service port name or port number.
string protocol = 5
Port protocol, TCP when empty.
message
manager.proto:801bytes cluster_ip = 1
The service's ClusterIP in netip.Addr binary form.
int32 port = 2
Resolved port number.
rpc ReviewIntercept (, )
manager.proto:1223ReviewIntercept lets an agent approve or reject an intercept by changing the disposition from "WATING" to "ACTIVE" or to an error, and setting a human-readable status message.
message
manager.proto:488optional session = 1
string id = 2
InterceptDispositionType disposition = 3
string message = 4
string pod_ip = 5
pod IP and sftp port to use when doing sshfs mounts
int32 sftp_port = 6
int32 ftp_port = 12
string mount_point = 10
The directory where the intercept mounts can be found in the agent
string mechanism_args_desc = 7
A human-friendly description of what the InterceptSpec.mechanism_args say.
map<string, string> environment = 11
The environment of the intercepted container
map<string, int32> mounts = 13
Map of mount path -> MountPolicy of the attached container
rpc SetLogLevel (, )
manager.proto:1128SetLogLevel will temporarily set the log-level for the traffic-manager and all traffic-agents for a duration that is determined b the request.
rpc StreamLogs (, stream )
manager.proto:1135StreamLogs streams logs for the traffic-manager and/or traffic-agents selected by the request. The handler calls ensureClientSession. The stream is bounded server-side -- chunk size, per-pod byte cap, concurrent pod readers, and request deadline -- with every limit configured as a manager Helm value.
message
manager.proto:535optional session = 1
The session of the requesting client. The handler calls ensureClientSession.
bool traffic_manager = 2
Whether or not logs from the traffic-manager are desired.
string agents = 3
The traffic-agent(s) logs are desired from. Can be `all`, `false` or the empty string (both meaning no agent logs), or a substring to filter based on pod names.
bool get_pod_yaml = 4
Whether or not to also stream the pod's yaml as deployed to the cluster.
message
manager.proto:557LogChunk is one frame of a StreamLogs response. The manager reads from several pods concurrently and multiplexes their output onto a single response stream; frame together with the (pod_name, pod_namespace) pair let a client demultiplex per-pod data even though frames from different pods interleave.
string pod_name = 1
The pod this chunk originates from.
string pod_namespace = 2
LogChunk.Frame frame = 3
oneof payload
bytes data = 4
A chunk of log data, in the order it was read from the pod.
string error = 5
Reported in place of further data when this pod's collection failed, e.g. it was denied by the logs.telepresence.io SubjectAccessReview or the pod disappeared mid-stream. One pod's error does not abort the stream for the others.
bytes pod_yaml = 6
The pod's manifest as deployed to the cluster. Sent once, when the request's get_pod_yaml is set.
rpc Tunnel (stream , stream )
manager.proto:1250A Tunnel represents one single connection where the client or traffic-agent represents one end (the client-side) and the traffic-manager represents the other (the server side). The first message that a client sends when the tunnel is established is will always contain the session ID, connection ID, and timeouts used by the dialer endpoints.
rpc UninstallAgents (, )
manager.proto:1285UninstallAgents will uninstall the traffic-agent from the given workloads (or all workloads if the list is empty).
message
manager.proto:1075optional session_info = 1
The session_info identifies the client connection, and hence the namespace for the resulting watcher.
repeated string agents = 2
The agents to install. Empty means all agents in the connected namespace.
rpc Version (, )
manager.proto:1093Version returns the version information of the Manager.
rpc WatchAgentPods (, stream )
manager.proto:1140WatchAgentPods notifies a client of the set of known Agents from the client connections namespace that the client can connect to when port-forwards are allowed.
message
manager.proto:914repeated agents = 1
rpc WatchAgentPodsDelta (, stream )
manager.proto:1145WatchAgentPods notifies a client of changes to the set of known Agents from the client connections namespace that the client can connect to when port-forwards are allowed.
rpc WatchAgentPodsInNamespacesDelta (, stream )
manager.proto:1150WatchAgentPodsInNamespacesDelta notifies a client of changes to the set of known Agents from the requested namespaces that the client can connect to when port-forwards are allowed.
message
manager.proto:384optional session = 1
repeated string namespaces = 2
rpc WatchAgents (, stream )
manager.proto:1156WatchAgents notifies a client of the set of known Agents. A session ID is required; if no session ID is given then the call returns immediately, having not delivered any snapshots.
rpc WatchAgentsDelta (, stream )
manager.proto:1159WatchAgents notifies a client of changes to the set of known Agents.
message
manager.proto:393map<string, > upserts = 1
repeated string removals = 2
rpc WatchClusterInfo (, stream )
manager.proto:1186WatchClusterInfo returns information needed when establishing connectivity to the cluster.
message
manager.proto:827ClusterInfo contains information that the root daemon needs in order to establish outbound traffic to the cluster.
repeated bytes service_cidrs = 1
The service_cidrs reported by NetworkingV1().ServiceCIDRs() in netip.Prefix binary form.
optional service_subnet = 2
service_subnet is the Kubernetes service subnet. Deprecated: use service_cidrs
repeated pod_subnets = 3
pod_subnets are the subnets used for Kubenetes pods.
bytes manager_pod_ip = 5
manager_pod_ip is the ip address of the traffic manager
int32 manager_pod_port = 8
manager_pod_port is the port of the traffic manager
bytes injector_svc_ip = 9
injector_svc_ip is the ip address of the traffic manager's agent injector service
int32 injector_svc_port = 10
injector_svc_port is the port of the traffic manager's agent injector service
string injector_svc_host = 11
injector_svc_host is the http host of the traffic manager's agent injector service
optional routing = 6
Router configuration
optional dns = 7
DNS configuration
rpc WatchIntercepts (, stream )
manager.proto:1167WatchIntercepts notifies a client or agent of the set of intercepts relevant to that client or agent. If a session ID is given, then only intercepts associated with that session are watched. If no session ID is given, then all intercepts are watched.
rpc WatchInterceptsDelta (, stream )
manager.proto:1171WatchInterceptsDelta notifies a client or agent of changes in the set of intercepts relevant to that client or agent.
rpc WatchLogLevel (, stream )
manager.proto:1242WatchLogLevel lets an agent receive log-level updates
rpc WatchNamespaces (, stream )
manager.proto:1191WatchNamespaces streams the manager's managed-namespace set, pushed on every change. The handler validates and binds the supplied client session before subscribing.
message
manager.proto:1087NamespaceList is the manager's managed-namespace set, pushed on every change. Served unfiltered: it is the same set for every caller, not scoped to the requesting session.
repeated string namespaces = 1
rpc WatchQuicBackends (, stream )
manager.proto:1277WatchQuicBackends notifies the QUIC forwarder of the set of pod IPs (traffic-manager and traffic-agent alike) it may route QUIC traffic to. Unlike the other Watch* RPCs this call carries no SessionInfo: the forwarder has no client session, and the backend set it returns is not scoped to one. The first message is sent immediately on subscribe; a new one follows whenever the backend set changes. Every message is a full QuicBackendSnapshot, not a delta.
message
manager.proto:718QuicBackendSnapshot is a full replacement snapshot of every pod IP the QUIC forwarder may route to. There is no delta variant: each snapshot replaces the previous one in its entirety, which keeps the forwarder simple and self-healing across a manager restart.
repeated backends = 1
rpc WatchSessionEvents (, stream )
manager.proto:1178WatchSessionEvents notifies a client of changes to the set of known agent pods in the requested namespaces and to the client's own intercepts, multiplexed onto a single stream. It replaces the combination of WatchAgentsDelta, WatchInterceptsDelta, and WatchAgentPodsInNamespacesDelta for clients that support it.
message
manager.proto:409SessionEventsRequest identifies the watching session and scopes the agent portion of the WatchSessionEvents stream.
optional session = 1
repeated string namespaces = 2
Namespaces in which the client wants agent events in addition to the session's connected namespace. This is the set of mapped namespaces that the client is permitted to port-forward to.
message
manager.proto:424SessionEventsDelta multiplexes agent-pod and intercept deltas onto one stream. Either or both fields may be present in a single message. Container-level agent data (environments, mounts, ports) is deliberately not streamed; clients retrieve it on demand from the EnsureAgent response or from InterceptInfo.
optional agent_pods = 1
Agent pods in the requested namespaces plus the session's connected namespace. Same projection as the WatchAgentPodsInNamespacesDelta stream, including the per-client intercepted flag.
optional intercepts = 2
The watching client's intercepts.
rpc WatchWorkloads (, stream )
manager.proto:1182WatchWorkloads notifies a client of the set of Workloads from the client connection's namespace.
message
manager.proto:1061optional session_info = 1
The session_info identifies the client connection, and hence the namespace for the resulting watcher.
optional since = 2
The timestamp from which the first delta should be computed. Set to undefined to get a delta that contains everything.
string namespace = 3
The namespace to watch. Must be one of the namespaces that are managed by the traffic-manager. Defaults to the connected namespace.
message
manager.proto:1053WorkloadEventDelta contains the changes made to the subscribed namespace since the time given in the timestamp. A watcher can rely on that received deltas are consecutive.
optional since = 1
The timestamp from which this delta is computed. Typically equal to the time when the previous delta was sent.
repeated events = 2
message
manager.proto:923Used as request type in: connector.Connector.GetAgentConfig, Manager.GetAgentConfig
optional session = 1
string name = 2
string namespace = 3
message
manager.proto:929Used as response type in: connector.Connector.GetAgentConfig, Manager.GetAgentConfig
bytes data = 1
message
manager.proto:887Used as response type in: connector.Connector.AgentImageFQN, Manager.GetAgentImageFQN
string f_q_n = 1
message
manager.proto:33AgentInfo is the self-reported metadata that an Agent (app-sidecar) reports at boot-up when it connects to the Telepresence Manager.
Used as request type in: Manager.ArriveAsAgent
Used as field type in: , , ,
string name = 1
name of the Workload
string kind = 13
string namespace = 7
namespace of the Workload
string pod_name = 8
Pod name (from metadata.name)
string pod_ip = 2
Pod IP (from status.podIP)
string pod_uid = 14
Pod UID
int32 api_port = 9
Port number for the agent gRPC API
int32 sftp_port = 10
Port number for the agent SFTP server
int32 ftp_port = 11
Port number for the agent FTP server
string product = 3
distinguish open source, our closed source, someone else's thing
string version = 4
repeated mechanisms = 5
This is a list of the mechanisms that the Agent advertises that it supports.
map<string, > containers = 12
bool node_agent = 15
True when the agent is node-hosted: a Job in the traffic-manager's namespace that enters the target pod's namespaces, rather than a sidecar running in the workload's own pods.
int32 quic_port = 16
UDP port of this agent's QUIC listener, reachable only through the QUIC forwarder (see docs/reference/quic-transport-architecture.md, "Agent connections over QUIC"). 0 means this agent has no QUIC listener.
repeated intercept_targets = 18
Service-backed targets advertised by this agent. Older agents leave this empty and continue to use workload-scoped intercept matching.
bool container_environment_omitted = 17
True when this AgentInfo came from a lightweight watch snapshot and its container environment maps were intentionally omitted. Callers that need those maps must fetch a full AgentInfo through EnsureAgent.
message
manager.proto:67Used in:
map<string, string> environment = 1
The container environment
string mount_point = 4
The directory where the intercept mounts can be found in the agent
map<string, int32> mounts = 13
Map of mount -> MountPolicy
message
manager.proto:92InterceptTarget describes one service-backed target that this agent can handle. The traffic-manager uses these claims when a single Service selects pods owned by more than one workload.
Used in:
string service_uid = 1
.metadata.uid of the Service associated with the target.
string service_name = 2
Name of the Service, retained for diagnostics.
string service_port_name = 3
Name and number of the selected Service port.
int32 service_port = 4
string protocol = 5
Protocol and local container target used by this agent.
string container_name = 6
int32 container_port = 7
message
manager.proto:57"Mechanisms" are the ways that an Agent can decide handle incoming requests, and decide whether to send them to the in-cluster service, or whether to intercept them. The "tcp" mechanism is the only one in Telepresence open source, and handles things at the TCP-level and either intercepts all TCP streams or doesn't intercept anything. Other Agents than the Telepresence one may implement more mechanisms, such as Ambassador Labs' "Service Preview" Agent which implements the "http" mechanism which handles th "http" mechanism, which handles things at the HTTP-request-level and can decide to intercept individual HTTP requests based on the request headers.
Used in:
string name = 1
"tcp" or "http" or "grpc" or ...
string product = 2
distinguish open source, our closed source, someone else's thing
string version = 3
message
manager.proto:389Used as response type in: Manager.EnsureAgent, Manager.WatchAgents
repeated agents = 1
message
manager.proto:891Used in: , ,
string pod_id = 7
string pod_name = 1
string namespace = 2
bytes pod_ip = 3
int32 api_port = 4
bool intercepted = 5
string workload_name = 6
bool node_agent = 8
True when the agent is node-hosted: a Job in the traffic-manager's namespace that enters the target pod's namespaces, rather than a sidecar running in the workload's own pods.
string quic_sni = 9
SNI name (quicfwd.AgentSNI(pod UID)) to dial, through the QUIC forwarder, to reach this agent's QUIC listener. Empty means this agent has no QUIC listener, so it must be dialed via port-forward only.
string version = 10
The agent's version.
message
manager.proto:918Used as response type in: Manager.WatchAgentPodsDelta, Manager.WatchAgentPodsInNamespacesDelta
Used as field type in:
map<string, > upserts = 1
repeated string removals = 2
message
manager.proto:17ClientInfo is the self-reported metadata that the on-laptop Telepresence client reports whenever it connects to the in-cluster Manager.
Used as request type in: Manager.ArriveAsClient
Used as field type in:
string name = 1
user@hostname
string namespace = 6
namespace that the client is connected to
string install_id = 2
string product = 3
"telepresence"
string version = 4
bool supports_compact_agent_info = 7
Clients that set this can receive lightweight AgentInfo updates from the watch streams and fetch full container environments only when needed.
message
manager.proto:434Used as request type in: Manager.CreateIntercept, Manager.PrepareIntercept
optional session = 1
optional intercept_spec = 2
message
manager.proto:870Used in:
repeated string include_suffixes = 1
repeated string exclude_suffixes = 2
bytes kube_ip = 3
kube_dns_ip is the IP address of the kube-dns.kube-system service, Deprecated: No longer used by clients >= 2.8.0
string cluster_domain = 4
cluster_domain is the domain of the cluster, ending with a dot, e.g. "cluster.local."
message
manager.proto:808optional session = 1
Agent session
optional request = 2
DNSRequest is the request that this is a response to
optional response = 3
The response, which might be nil in case no address was found
message
manager.proto:772LookupHost request sent from a client
Used as request type in: Manager.LookupDNS
Used as field type in:
optional session = 1
Client session
string name = 2
uint32 type = 3
message
manager.proto:779Used as response type in: Manager.LookupDNS
Used as field type in:
int32 r_code = 1
DNS return code
bytes rrs = 2
rrs is an array of packed RR records
message
manager.proto:722Used as response type in: agent.Agent.WatchDial
bytes conn_id = 1
int64 roundtrip_latency = 2
int64 dial_timeout = 3
message
manager.proto:483Used as request type in: connector.Connector.GetIntercept, Manager.GetIntercept
optional session = 1
string name = 2
message
manager.proto:820IPNet is a subnet. e.g. 10.43.0.0/16
Used in: , ,
bytes ip = 1
int32 mask = 2
Used in: ,
UNSPECIFIED = 0
ACTIVE = 1
WAITING = 2
REMOVED = 9
NO_CLIENT = 3
What does "NO_CLIENT" mean? The Manager garbage-collects the intercept if the client goes away.
NO_AGENT = 4
NO_AGENT indicates that there are no currently-running agents that can service the intercept, or that there is a inconsistency between the agents that are running. This may be an ephemeral state, such as inconsistency between agents during the middle of a rolling update.
NO_MECHANISM = 5
NO_MECHANISM indicates that the agent(s) that would handle this intercept do not report that they support the mechanism of the intercept. For example, if you are running the OSS agent but ask for an intercept using the "http" mechanism, which requires the Ambassador Telepresence agent.
NO_PORTS = 6
NO_PORT indicates that the manager was unable to allocate a port to act as the rendezvous point between the client and the agent.
AGENT_ERROR = 7
AGENT_ERROR indicates that the intercept was submitted to an agent, but that the agent rejected it (by calling ReviewIntercept).
BAD_ARGS = 8
BAD_ARGS indicates that something about the mechanism_args is invalid.
message
manager.proto:308InterceptInfo contains information about a live intercept in an agent
Used as response type in: connector.Connector.CreateIntercept, connector.Connector.GetIntercept, Manager.CreateIntercept, Manager.GetIntercept
Used as field type in: , , ,
optional spec = 1
string id = 5
optional client_session = 6
InterceptDispositionType disposition = 3
The current intercept state; a status code and a human-friendly message to go along with the status code. These may be set manager itself, or may be set by the agent's call to ReviewIntercept.
string message = 4
string pod_name = 19
Name and port to use when establishing port-forward to the pod's gRPC API.
int32 api_port = 20
string pod_ip = 10
int32 sftp_port = 11
int32 ftp_port = 18
string client_mount_point = 2
The directory where the client mounts the remote mount_point. Only set when obtaining InterceptInfo from the user daemon.
string mount_point = 16
The directory where the intercept mounts can be found in the agent
string mechanism_args_desc = 12
A human-friendly description of what the spec.mechanism_args say. This is set by the agent's call to ReviewIntercept.
map<string, string> environment = 17
The environment of the intercepted app
map<string, int32> mounts = 22
Map of mount path -> MountPolicy
optional modified_at = 21
Timestamp for last modification made by traffic-manager
repeated service_workloads = 23
Workloads whose ready Service-selected pods participate in this intercept. This is populated by the manager for Service-scoped intercepts so server-side integrations can configure every participating workload.
message
manager.proto:402Used as response type in: Manager.WatchInterceptsDelta
Used as field type in:
map<string, > upserts = 1
repeated string removals = 2
message
manager.proto:398Used as response type in: Manager.WatchIntercepts
Used as field type in:
repeated intercepts = 1
message
manager.proto:130InterceptSpec contains static information about an intercept. It is shared by all running agent instances.
Used in: , ,
string name = 1
A human-friendly name for this intercept. This is usually the same as the agent name below; the name/namespace of the Workload, but it could be something else. It is invalid for the same client to attempt to create multiple intercepts with the same name.
string client = 2
Same as ClientInfo.Name; "user@hostname".
string agent = 3
Same as AgentInfo.Name of the Workload.
string workload_kind = 13
Kind of the Workload
string namespace = 8
Same as AgentInfo.Namespace of the Workload
string mechanism = 4
How to decide which subset of requests to that agent to intercept.
string target_host = 6
The host that the target_ports are routed to.
repeated string pod_ports = 5
Ports that will be forwarded from the intercepting pod's IP address to the target_host, using the following syntax: PORT = port-decl ["/" protocol ] port-decl = port-spec [ ":" uint16 ] protocol = "TCP" | "UDP" port-spec = name | uint16 If two numbers are used, they signify source:destination.
repeated string local_ports = 18
Ports that will be forwarded from the intercepting client's localhost to the intercepted pod. Uses the same syntax as target_ports.
string port_identifier = 10
Identifier for the service or container port: either the name or port number optionally followed by a "/TCP" or "/UDP"
string service_port_name = 19
The resolved service port name
int32 service_port = 20
The resolved service port
string service_uid = 12
.uid.metadata of service associated with intercept
string service_name = 14
name of the aforementioned service
string protocol = 21
The resolved protocol used by the container port
TCP or UDP
string container_name = 24
Name of container that provides environment and mounts. This is normally the container that owns the container_port, but in some cases it will differ because the container_port is owned by some kind of routing mechanism (such as nginx).
int32 container_port = 23
The resolved container port that is intercepted.
int32 target_port = 7
The port on the workstation that the intercepted container_port is redirected to.
int64 roundtrip_latency = 16
The delay imposed by a call roundtrip between the traffic-agent and the client on the workstation. This delay is added to the dial_timeout when the workstation performs a dial on behalf of the traffic-agent.
int64 dial_timeout = 17
The dial timeout to use when a dial is made on the intercepting workstation.
repeated int32 extra_ports = 15
Extra ports that will be forwarded from the intercepting client's localhost to the intercepted pod. Deprecated: use local_ports instead
bool replace = 22
Whether to replace the running container.
bool wiretap = 26
place a wiretap on intercepted ports instead of redirecting them
bool no_default_port = 25
Intercept desire no default port.
map<string, string> header_filters = 27
HTTP header filters for HTTP Intercepts. Only requests containing these headers (key=value) will be intercepted. Multiple headers use AND logic.
repeated string path_filters = 28
Path filter patterns for HTTP Intercepts. Supports glob patterns like "/api/v1/*". If specified, only requests matching these paths will be intercepted.
map<string, string> metadata = 29
Metadata to associate with the intercept. Retrievable using the API server.
bool plaintext = 30
Plaintext instructs the traffic-agent to use plain text when communicating with the client.
repeated bytes service_ips = 31
The cluster IPs of the service that the intercept is made on, each in netip.Addr binary form.
bool node_agent = 32
Request that this intercept be served by a node-hosted traffic-agent (a manager-created Job that enters the target pod's namespaces) rather than by a sidecar injected into the workload. Requires the traffic-manager to have node-agent mode enabled.
bool shared_service = 33
Set by the traffic-manager when the intercept is expanded to every workload selected by its Service. Clients leave it unset.
message
manager.proto:301InterceptWorkload identifies one workload whose pods participate in a Service-scoped intercept.
Used in:
string namespace = 1
string workload_kind = 2
string workload_name = 3
message
manager.proto:943Used as response type in: connector.Connector.GetKnownWorkloadKinds, Manager.GetKnownWorkloadKinds
repeated WorkloadInfo.Kind kinds = 1
Used in:
DATA_UNSPECIFIED = 0
A payload frame: data, error, or pod_yaml is set.
BEGIN = 1
Sent once, first, when the manager starts reading from this pod. Carries no payload.
END = 2
Sent once, last, for this pod, whether or not it ended in an error. Carries no payload.
message
manager.proto:523Used as request type in: daemon.Daemon.SetLogLevel, Manager.SetLogLevel
Used as response type in: Manager.WatchLogLevel
string log_level = 1
optional duration = 2
The time that this log-level will be in effect before falling back to the configured log-level.
optional session = 3
The session of the client requesting the change. Unset in requests from older clients.
message
manager.proto:758Used as request type in: agent.Agent.Lookup, Manager.Lookup
optional session = 1
Client session
string name = 2
The name to use for the LookupIP request.
message
manager.proto:766Used as response type in: agent.Agent.Lookup, Manager.Lookup
repeated bytes ips = 1
List of found IPs in netip.Addr binary form.
message
manager.proto:123PortMapping describes a mapping from a port number in the intercepted container to a port on the client for --from-pod and or vice versa when using --to-pod.
int32 from = 1
int32 to = 2
message
manager.proto:698QuicBackend identifies one live pod IP that the QUIC forwarder (a separate stateless packet router; see docs/reference/quic-transport-architecture.md) may route traffic to.
Used in:
bytes ip = 1
Pod IP in netip.Addr binary form (4 or 16 bytes), the same encoding AgentPodInfo.pod_ip uses.
string kind = 2
"manager" or "agent".
int32 port = 3
UDP port of this backend's QUIC listener.
string pod_uid = 4
Pod UID of this backend, used by the forwarder to resolve an AgentSNI (quicfwd.AgentSNI) to this entry. Empty for kind "manager".
message
manager.proto:668One dialable address for the QUIC endpoint. Candidates are ordered by the manager's preference; the client keeps the first that handshakes.
Used in:
string host = 1
int32 port = 2
message
manager.proto:478Used as request type in: connector.Connector.RemoveIntercept, Manager.RemoveIntercept
optional session = 1
string name = 2
message
manager.proto:956RouteAssociation describes a route object (currently always an Ingress in the service's own namespace) that routes traffic to one of the ports of the service it is associated with.
Used in:
string type = 1
string name = 2
repeated string hosts = 3
repeated string paths = 4
bool tls = 5
string port_name = 6
The service port that this route targets.
int32 port = 7
repeated string addresses = 8
Load-balancer addresses (IPs or hostnames) of the route object, used to reach the route when it declares no hosts.
message
manager.proto:864Used in:
repeated also_proxy_subnets = 1
repeated never_proxy_subnets = 2
repeated allow_conflicting_subnets = 3
message
manager.proto:975ServiceAssociation describes a service in the workload's namespace whose selector matches the workload's pods, together with the routes that target that service.
Used in: ,
string name = 1
repeated ports = 2
repeated routes = 3
message
manager.proto:947Used in:
string name = 1
int32 port = 2
string target_port = 3
message
manager.proto:378Used as request type in: agent.Agent.WatchDial, Manager.Depart, Manager.GetKnownWorkloadKinds, Manager.GetQuicAgentCert, Manager.GetQuicTunnelEndpoint, Manager.GetSessionCredential, Manager.WatchAgentPods, Manager.WatchAgentPodsDelta, Manager.WatchAgents, Manager.WatchAgentsDelta, Manager.WatchClusterInfo, Manager.WatchIntercepts, Manager.WatchInterceptsDelta, Manager.WatchNamespaces
Used as response type in: Manager.ArriveAsAgent, Manager.ArriveAsClient
Used as field type in: , , , , , , , , , , , , , , , , , , , , , ,
string session_id = 1
string manager_install_id = 2
optional string install_id = 3
message
manager.proto:624TunnelMessage is a message sent over a Tunnel. First byte indicates type of message
Used as request type in: agent.Agent.Tunnel, Manager.Tunnel
Used as response type in: agent.Agent.Tunnel, Manager.Tunnel
bytes payload = 1
message
manager.proto:600VersionInfo2 is different than telepresence.common.VersionInfo in that it is limited to just name and version.
Used as response type in: agent.Agent.Version, Manager.Version
Used as field type in:
string name = 1
string version = 2
bool auth_supported = 3
Whether the responding server authenticates bearer tokens presented in gRPC metadata. Only the traffic-manager populates this.
bool auth_required = 4
Whether the responding server rejects calls that carry no valid bearer token. Only the traffic-manager populates this. Clients whose kubeconfig credentials cannot produce a token should surface a clear error instead of connecting.
uint32 auth_x509_port = 5
Container port of the traffic-manager's x509 authentication listener, or zero when disabled. A client whose kubeconfig credentials are a client certificate can perform a TLS handshake against this port, presenting that certificate, and receives a short-lived manager-issued bearer token to use as per-RPC authorization metadata. Only the traffic-manager populates this.
message
manager.proto:1040Used in:
WorkloadEvent.Type type = 1
optional workload = 2
Used in:
ADDED_UNSPECIFIED = 0
MODIFIED = 1
DELETED = 2
message
manager.proto:983WorkloadInfo contains information about a workload (typically a Deployment).
Used in:
WorkloadInfo.Kind kind = 1
string name = 2
string namespace = 3
string uid = 7
int32 desired_replicas = 8
int32 ready_replicas = 9
repeated services = 10
WorkloadInfo.AgentState agent_state = 4
repeated intercept_clients = 5
WorkloadInfo.State state = 6
Used in:
NO_AGENT_UNSPECIFIED = 0
Workload has never been intercepted, so no agent has been installed.
INSTALLED = 1
An agent has been installed into workload's pods, but it is not currently intercepted.
INTERCEPTED = 2
The workload (or rather its pods) is currently intercepted.
message
manager.proto:1021Used in:
string client = 1
name of intercepting client
Used in: ,
UNSPECIFIED = 0
DEPLOYMENT = 1
REPLICASET = 2
STATEFULSET = 3
ROLLOUT = 4
Used in:
UNKNOWN_UNSPECIFIED = 0
The state of this workload is not known.
AVAILABLE = 1
Available means the deployment is available, ie. at least the minimum available replicas required are up and running for at least minReadySeconds.
PROGRESSING = 2
Progressing means the workload is progressing. Progress for a workload is considered when a new replica set is created or adopted, and when new pods scale up or old pods scale down. Progress is not estimated for paused workloads or when progressDeadlineSeconds is not specified.
FAILURE = 3
FAILURE means that one of its pods fails to be created or deleted.