From 01fe09065c8ff34764535b22ac67cb75e8494d21 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 27 Feb 2017 14:25:43 +0000 Subject: [PATCH] Add weave-npc required kernel modules to docs --- docs/weavenpc-design.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/weavenpc-design.md b/docs/weavenpc-design.md index 5b1693bf..5827e57f 100644 --- a/docs/weavenpc-design.md +++ b/docs/weavenpc-design.md @@ -19,6 +19,9 @@ NetworkPolicy object updates from the k8s API server: network policy, containing the IP addresses of all pods in the namespace whose labels match that selector +IPsets are implemented by the kernel module `xt_set`, without which +weave-npc will not work. + ipset names are generated deterministically from a string representation of the corresponding label selector. Because ipset names are limited to 31 characters in length, this is done by taking a @@ -94,6 +97,9 @@ The following traffic is NOT affected: (e.g. kubelet health checks) * Traffic routed from an application container to the internet +The above mechanism relies on the kernel module `br_netfilter` being +loaded and enabled via `/proc/sys/net/bridge/bridge-nf-call-iptables`. + See these resources for helpful context: * http://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html