Create weave-no-masq-local ipset

The ipset is used to track locally allocated CIDRs. If requested,
external traffic sent to pods within these CIDR ranges will
avoid SNAT'ing (NYI).

prog/weave-npc/main.go

@@ -18,8 +18,9 @@ import (
 	"k8s.io/client-go/tools/cache"
 
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/npc"
+	"github.com/weaveworks/weave/net"
 	"github.com/weaveworks/weave/net/ipset"
+	"github.com/weaveworks/weave/npc"
 	"github.com/weaveworks/weave/npc/metrics"
 	"github.com/weaveworks/weave/npc/ulogd"
 )
@@ -56,7 +57,7 @@ func resetIPTables(ipt *iptables.IPTables) error {
 }
 
 func resetIPSets(ips ipset.Interface) error {
-	// Remove ipsets prefixed `weave-` only
+	// Remove ipsets prefixed `weave-` excluding weave-no-masq-local (used by weaver).
 
 	sets, err := ips.List(npc.IpsetNamePrefix)
 	if err != nil {
@@ -68,6 +69,9 @@ func resetIPSets(ips ipset.Interface) error {
 
 	// Must remove references to ipsets by other ipsets before they're destroyed
 	for _, s := range sets {
+		if s == ipset.Name(net.NoMasqLocalIpset) {
+			continue
+		}
 		common.Log.Debugf("Flushing ipset '%s'", string(s))
 		if err := ips.Flush(s); err != nil {
 			common.Log.Errorf("Failed to flush ipset '%s'", string(s))
@@ -76,6 +80,9 @@ func resetIPSets(ips ipset.Interface) error {
 	}
 
 	for _, s := range sets {
+		if s == ipset.Name(net.NoMasqLocalIpset) {
+			continue
+		}
 		common.Log.Debugf("Destroying ipset '%s'", string(s))
 		if err := ips.Destroy(s); err != nil {
 			common.Log.Errorf("Failed to destroy ipset '%s'", string(s))

prog/weaver/main.go

@@ -221,6 +221,7 @@ func main() {
 	mflag.BoolVar(&pluginConfig.EnableV2Multicast, []string{"-plugin-v2-multicast"}, false, "enable multicast for Docker plugin (v2)")
 	mflag.StringVar(&pluginConfig.Socket, []string{"-plugin-socket"}, "/run/docker/plugins/weave.sock", "plugin socket on which to listen")
 	mflag.StringVar(&pluginConfig.MeshSocket, []string{"-plugin-mesh-socket"}, "/run/docker/plugins/weavemesh.sock", "plugin socket on which to listen in mesh mode")
+	mflag.BoolVar(&bridgeConfig.NoMasqLocal, []string{"-no-masq-local"}, false, "do not SNAT external traffic sent to pods running on this node (Kubernetes only)")
 
 	proxyConfig := newProxyConfig()