diff --git a/site/features.md b/site/features.md index af72ffdc..8692affe 100644 --- a/site/features.md +++ b/site/features.md @@ -141,10 +141,8 @@ Let's begin by configuring weave's allocator to manage multiple subnets: host1$ weave launch -iprange 10.2.0.0/16 -ipsubnet 10.2.1.0/24 - host1$ weave launch-dns && weave launch-proxy host1$ eval $(weave proxy-env) host2$ weave launch -iprange 10.2.0.0/16 -ipsubnet 10.2.1.0/24 $HOST1 - host2$ weave launch-dns && weave launch-proxy host2$ eval $(weave proxy-env) This delegates the entire 10.2.0.0/16 subnet to weave, and instructs diff --git a/site/proxy.md b/site/proxy.md index 04861579..0514e30b 100644 --- a/site/proxy.md +++ b/site/proxy.md @@ -23,11 +23,18 @@ instead of `weave run`. ## Setup The proxy sits between the Docker client (command line or API) and the -Docker daemon, intercepting the communication between the two. +Docker daemon, intercepting the communication between the two. You can +start it simultaneously with the router and weaveDNS via `launch`: -To start the proxy, run + host1$ weave launch - host1$ weave launch-proxy +or independently via `launch-proxy`: + + host1$ weave launch-router && weave launch-dns && weave launch-proxy + +The first form is more convenient, however you can only pass proxy +related configuration arguments to `launch-proxy` so if you need to +modify the default behaviour you will have to use the latter. By default, the proxy listens on port 12375, on all network interfaces. This can be adjusted with the `-H` argument, e.g. @@ -49,10 +56,12 @@ Alternatively, the proxy host can be set on a per-command basis with host1$ docker $(weave proxy-config) ps -The proxy can be stopped with +The proxy can be stopped independently with host1$ weave stop-proxy +or in conjunction with the router and weaveDNS via `stop`. + If you set your `DOCKER_HOST` to point at the proxy, remember to revert to the original setting. diff --git a/site/weavedns.md b/site/weavedns.md index 0720ab77..c97d80d5 100644 --- a/site/weavedns.md +++ b/site/weavedns.md @@ -28,13 +28,23 @@ hosts. WeaveDNS is deployed as a set of containers that communicate with each other over the weave network. One such container needs to be started -on every weave host, by invoking the weave script command -`launch-dns`: +on every weave host, either simultaneously with the router and proxy +via `launch`: ```bash -host1$ weave launch && weave launch-dns && weave launch-proxy +host1$ weave launch host1$ eval $(weave proxy-env) ``` +or independently via `launch-dns`: + +```bash +host1$ weave launch-router && weave launch-dns && weave launch-proxy +host1$ eval $(weave proxy-env) +``` + +The first form is more convenient, however you can only pass weaveDNS +related configuration arguments to `launch-dns` so if you need to +modify the default behaviour you will have to use the latter. Application containers will use weaveDNS automatically if it is running at the point when they are started. They will use it for name @@ -67,7 +77,11 @@ however specify an address in CIDR format manually. In this case you are responsible for ensuring that the IP addresses specified are uniquely allocated and not in use by any other container. -Finally, WeaveDNS containers can be stopped with `stop-dns`. +Finally, weaveDNS can be stopped independently with + + host1$ weave stop-dns + +or in conjunction with the router and proxy via `stop`. ## How it works @@ -112,7 +126,7 @@ Returning to our earlier example, let us start an additional `pingme` container, this time on the 2nd host, and then run some ping tests... ```bash -host2$ weave launch && weave launch-dns && weave launch-proxy +host2$ weave launch host2$ eval $(weave proxy-env) host2$ docker run -dti --name=pingme ubuntu diff --git a/test/150_connect_forget_test.sh b/test/150_connect_forget_test.sh index a1ac7df9..8f8da392 100755 --- a/test/150_connect_forget_test.sh +++ b/test/150_connect_forget_test.sh @@ -15,8 +15,8 @@ assert_peers() { start_suite "Connecting and forgetting routers after launch" -weave_on $HOST1 launch -weave_on $HOST2 launch +weave_on $HOST1 launch-router +weave_on $HOST2 launch-router start_container $HOST1 $C1/24 --name=c1 start_container $HOST2 $C2/24 --name=c2 @@ -33,8 +33,8 @@ assert_raises "exec_on $HOST1 c1 $PING $C2" # Forget everyone and disonnect assert_raises "weave_on $HOST2 forget $HOST1 $HOST2" -assert_raises "weave_on $HOST1 stop" -assert_raises "weave_on $HOST1 launch" +assert_raises "weave_on $HOST1 stop-router" +assert_raises "weave_on $HOST1 launch-router" assert_peers $HOST2 "" assert_raises "exec_on $HOST1 c1 sh -c '! $PING $C2'" diff --git a/test/210_dns_multicast_test.sh b/test/210_dns_multicast_test.sh index dbb559bc..fb47f334 100755 --- a/test/210_dns_multicast_test.sh +++ b/test/210_dns_multicast_test.sh @@ -29,8 +29,8 @@ check() { start_suite "Resolve names across hosts (with and without IPAM), and repopulate on restart" -weave_on $HOST1 launch -iprange $UNIVERSE -weave_on $HOST2 launch -iprange $UNIVERSE $HOST1 +weave_on $HOST1 launch-router -iprange $UNIVERSE +weave_on $HOST2 launch-router -iprange $UNIVERSE $HOST1 start_container $HOST2 $C2/24 --name=c2 -h $NAME2 start_container_with_dns $HOST1 $C1/24 --name=c1 diff --git a/test/280_with_or_without_dns_test.sh b/test/280_with_or_without_dns_test.sh index f537b7dd..2a58be95 100755 --- a/test/280_with_or_without_dns_test.sh +++ b/test/280_with_or_without_dns_test.sh @@ -20,7 +20,7 @@ assert_resolution() { start_suite "With or without DNS test" -weave_on $HOST1 launch +weave_on $HOST1 launch-router DNS_IP=$(weave_on $HOST1 docker-bridge-ip) diff --git a/test/500_weave_multi_cidr_test.sh b/test/500_weave_multi_cidr_test.sh index 0bbf6e5d..884d7c74 100755 --- a/test/500_weave_multi_cidr_test.sh +++ b/test/500_weave_multi_cidr_test.sh @@ -73,7 +73,7 @@ start_suite "Weave run/start/attach/detach/expose/hide with multiple cidr argume # specific address, i.e. we are assuming that IPAM always returns the # lowest available address in the subnet -weave_on $HOST1 launch -debug -iprange 10.2.3.0/24 +weave_on $HOST1 launch-router -debug -iprange 10.2.3.0/24 launch_dns_on $HOST1 10.254.254.254/24 # Run container with three cidrs diff --git a/test/620_proxy_entrypoint_command_test.sh b/test/620_proxy_entrypoint_command_test.sh index f2b5f959..20316d32 100755 --- a/test/620_proxy_entrypoint_command_test.sh +++ b/test/620_proxy_entrypoint_command_test.sh @@ -26,7 +26,7 @@ run_container "grep ^1$ /sys/class/net/ethwe/carrier" build_image false '["/bin/false"]' '' run_container "--entrypoint='grep' false ^1$ /sys/class/net/ethwe/carrier" -weave_on $HOST1 launch -iprange 10.2.2.0/24 +weave_on $HOST1 launch-router -iprange 10.2.2.0/24 docker_on $HOST1 kill weaveproxy weave_on $HOST1 launch-proxy diff --git a/test/650_proxy_env_test.sh b/test/650_proxy_env_test.sh index beb8a558..97e33084 100755 --- a/test/650_proxy_env_test.sh +++ b/test/650_proxy_env_test.sh @@ -13,6 +13,6 @@ assert_raises "docker $(weave_on $HOST1 proxy-config) $CMD" # Check we can use the weave script through the proxy assert_raises "eval '$(weave_on $HOST1 proxy-env)' ; $WEAVE version" assert_raises "eval '$(weave_on $HOST1 proxy-env)' ; $WEAVE ps" -assert_raises "eval '$(weave_on $HOST1 proxy-env)' ; $WEAVE launch" +assert_raises "eval '$(weave_on $HOST1 proxy-env)' ; $WEAVE launch-router" end_suite diff --git a/test/660_proxy_ipam_test.sh b/test/660_proxy_ipam_test.sh index 11137995..f0635f83 100755 --- a/test/660_proxy_ipam_test.sh +++ b/test/660_proxy_ipam_test.sh @@ -17,8 +17,8 @@ assert_no_ethwe() { start_suite "Ping proxied containers over cross-host weave network (with IPAM)" -weave_on $HOST1 launch -iprange $UNIVERSE -weave_on $HOST2 launch -iprange $UNIVERSE $HOST1 +weave_on $HOST1 launch-router -iprange $UNIVERSE +weave_on $HOST2 launch-router -iprange $UNIVERSE $HOST1 weave_on $HOST1 launch-proxy weave_on $HOST2 launch-proxy --no-default-ipam diff --git a/test/670_proxy_tls_test.sh b/test/670_proxy_tls_test.sh index 1d284133..69cff352 100755 --- a/test/670_proxy_tls_test.sh +++ b/test/670_proxy_tls_test.sh @@ -6,7 +6,7 @@ start_suite "Boot the proxy with TLS-enabled Docker support" PWD=$($SSH $HOST1 pwd) -weave_on $HOST1 launch +weave_on $HOST1 launch-router weave_on $HOST1 launch-proxy \ --tlsverify \ --tlscacert $PWD/tls/ca.pem \ diff --git a/weave b/weave index f3317164..88609fcc 100755 --- a/weave +++ b/weave @@ -26,31 +26,34 @@ CIDR_REGEXP="$IP_REGEXP/[0-9]{1,2}" usage() { echo "Usage:" echo "weave setup" - echo "weave launch [-password ] [-nickname ] [-nodiscovery]" - echo " [-iprange [-ipsubnet ]] ..." - echo "weave launch-dns []" - echo "weave launch-proxy [-H ] [--with-dns | --without-dns]" - echo " [--no-default-ipam]" - echo "weave connect [--replace] [ ...]" - echo "weave forget ..." - echo "weave run [--with-dns | --without-dns] [ ...] ..." - echo "weave start [ ...] " - echo "weave attach [ ...] " - echo "weave detach [ ...] " - echo "weave dns-add [ ...] [-h ]" - echo "weave dns-remove [ ...] [-h ]" - echo "weave expose [ ...] [-h ]" - echo "weave hide [ ...]" - echo "weave ps [ ...]" + echo "weave launch [-password ] [-nickname ] [-nodiscovery]" + echo " [-iprange [-ipsubnet ]] ..." + echo "weave launch-router [-password ] [-nickname ] [-nodiscovery]" + echo " [-iprange [-ipsubnet ]] ..." + echo "weave launch-dns []" + echo "weave launch-proxy [-H ] [--with-dns | --without-dns]" + echo " [--no-default-ipam]" + echo "weave connect [--replace] [ ...]" + echo "weave forget ..." + echo "weave run [--with-dns | --without-dns] [ ...] ..." + echo "weave start [ ...] " + echo "weave attach [ ...] " + echo "weave detach [ ...] " + echo "weave dns-add [ ...] [-h ]" + echo "weave dns-remove [ ...] [-h ]" + echo "weave expose [ ...] [-h ]" + echo "weave hide [ ...]" + echo "weave ps [ ...]" echo "weave status" echo "weave proxy-env" echo "weave proxy-config" echo "weave version" echo "weave stop" + echo "weave stop-router" echo "weave stop-dns" echo "weave stop-proxy" echo "weave reset" - echo "weave rmpeer " + echo "weave rmpeer " echo echo "where = [:]" echo " = /" @@ -933,6 +936,114 @@ proxy_addr() { return 1 } +###################################################################### +# launch helpers +###################################################################### + +launch_router() { + create_bridge + # We set the router name to the bridge mac since that is + # stable across re-creations of the containers. + # + # TODO use the mac of one of the physical host interfaces + # (eth0, wlan0, etc) so the name becomes stable across host + # restarts. + PEERNAME=$(cat /sys/class/net/$BRIDGE/address) + # backward compatibility... + if is_cidr "$1" ; then + echo "WARNING: $1 parameter ignored; 'weave launch' no longer takes a CIDR as the first parameter" >&2 + shift 1 + fi + CONTAINER_PORT=$PORT + ARGS="" + IPRANGE= + IPRANGE_SPECIFIED= + while [ $# -gt 0 ] ; do + case "$1" in + -password) + [ $# -gt 1 ] || usage + WEAVE_PASSWORD="$2" + export WEAVE_PASSWORD + shift 2 + ;; + -port) + [ $# -gt 1 ] || usage + CONTAINER_PORT="$2" + shift 2 + ;; + -iprange) + [ $# -gt 1 ] || usage + IPRANGE="$2" + IPRANGE_SPECIFIED=1 + shift 2 + ;; + *) + ARGS="$ARGS '$(echo "$1" | sed "s|'|'\"'\"'|g")'" + shift + ;; + esac + done + eval "set -- $ARGS" + if [ -z "$IPRANGE_SPECIFIED" ] ; then + IPRANGE="10.128.0.0/10" + if command_exists netcheck && ! netcheck $IPRANGE ; then + echo "Default -iprange $IPRANGE overlaps with existing route." >&2 + echo "Please pick another range and set it on all hosts." >&2 + exit 1 + fi + fi + # Set WEAVE_DOCKER_ARGS in the environment in order to supply + # additional parameters, such as resource limits, to docker + # when launching the weave container. + CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME \ + -p $PORT:$CONTAINER_PORT/tcp -p $PORT:$CONTAINER_PORT/udp \ + -v /var/run/docker.sock:/var/run/docker.sock \ + -e WEAVE_PASSWORD \ + -e WEAVE_CIDR=none \ + $WEAVE_DOCKER_ARGS $IMAGE -iface $CONTAINER_IFNAME -port $CONTAINER_PORT -name "$PEERNAME" -nickname "$(hostname)" -iprange "$IPRANGE" "$@") + with_container_netns_or_die $CONTAINER launch + wait_for_status $CONTAINER_NAME $HTTP_PORT + if [ -n "$IPRANGE" ] ; then + # Tell the newly-started weave IP allocator about existing weave IPs + with_container_addresses ipam_claim weave:expose $(docker ps -q --no-trunc) + fi +} + +launch_dns() { + collect_cidr_args "$@" + [ $CIDR_ARG_COUNT -lt 2 ] || usage + shift $CIDR_ARG_COUNT + create_bridge + docker_bridge_ip + # Set WEAVEDNS_DOCKER_ARGS in the environment in order to supply + # additional parameters, such as resource limits, to docker + # when launching the weave container. + DNS_CONTAINER=$(docker run --privileged -d --name=$DNS_CONTAINER_NAME \ + -p $DOCKER_BRIDGE_IP:53:53/udp \ + -e WEAVE_CIDR=none \ + -v /var/run/docker.sock:/var/run/docker.sock \ + $WEAVEDNS_DOCKER_ARGS $DNS_IMAGE -iface $CONTAINER_IFNAME -httpiface "$DNS_HTTP_IFNAME" "$@") + ipam_cidrs_or_die $DNS_CONTAINER $CIDR_ARGS + with_container_netns_or_die $DNS_CONTAINER attach $ALL_CIDRS + populate_dns +} + +launch_proxy() { + # Set WEAVEPROXY_DOCKER_ARGS in the environment in order to supply + # additional parameters, such as resource limits, to docker + # when launching the weaveproxy container. + proxy_args "$@" + PROXY_CONTAINER=$(docker run --privileged -d --name=$PROXY_CONTAINER_NAME --net=host \ + $PROXY_VOLUMES \ + -v /var/run/docker.sock:/var/run/docker.sock \ + -v /proc:/hostproc \ + -e PROCFS=/hostproc \ + -e WEAVE_CIDR=none \ + --entrypoint=/home/weave/weaveproxy \ + $WEAVEPROXY_DOCKER_ARGS $EXEC_IMAGE $PROXY_ARGS) + wait_for_log $PROXY_CONTAINER_NAME "proxy listening" +} + ########################################################################################## [ $(id -u) = 0 ] || { @@ -993,110 +1104,26 @@ case "$COMMAND" in create_bridge --without-ethtool ;; launch) + check_not_running $CONTAINER_NAME $BASE_IMAGE + check_not_running $DNS_CONTAINER_NAME $BASE_DNS_IMAGE + check_not_running $PROXY_CONTAINER_NAME $EXEC_IMAGE + launch_router "$@" + launch_dns + launch_proxy + ;; + launch-router) check_not_running $CONTAINER_NAME $BASE_IMAGE - create_bridge - # We set the router name to the bridge mac since that is - # stable across re-creations of the containers. - # - # TODO use the mac of one of the physical host interfaces - # (eth0, wlan0, etc) so the name becomes stable across host - # restarts. - PEERNAME=$(cat /sys/class/net/$BRIDGE/address) - # backward compatibility... - if is_cidr "$1" ; then - echo "WARNING: $1 parameter ignored; 'weave launch' no longer takes a CIDR as the first parameter" >&2 - shift 1 - fi - CONTAINER_PORT=$PORT - ARGS="" - IPRANGE= - IPRANGE_SPECIFIED= - while [ $# -gt 0 ] ; do - case "$1" in - -password) - [ $# -gt 1 ] || usage - WEAVE_PASSWORD="$2" - export WEAVE_PASSWORD - shift 2 - ;; - -port) - [ $# -gt 1 ] || usage - CONTAINER_PORT="$2" - shift 2 - ;; - -iprange) - [ $# -gt 1 ] || usage - IPRANGE="$2" - IPRANGE_SPECIFIED=1 - shift 2 - ;; - *) - ARGS="$ARGS '$(echo "$1" | sed "s|'|'\"'\"'|g")'" - shift - ;; - esac - done - eval "set -- $ARGS" - if [ -z "$IPRANGE_SPECIFIED" ] ; then - IPRANGE="10.128.0.0/10" - if command_exists netcheck && ! netcheck $IPRANGE ; then - echo "Default -iprange $IPRANGE overlaps with existing route." >&2 - echo "Please pick another range and set it on all hosts." >&2 - exit 1 - fi - fi - # Set WEAVE_DOCKER_ARGS in the environment in order to supply - # additional parameters, such as resource limits, to docker - # when launching the weave container. - CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME \ - -p $PORT:$CONTAINER_PORT/tcp -p $PORT:$CONTAINER_PORT/udp \ - -v /var/run/docker.sock:/var/run/docker.sock \ - -e WEAVE_PASSWORD \ - -e WEAVE_CIDR=none \ - $WEAVE_DOCKER_ARGS $IMAGE -iface $CONTAINER_IFNAME -port $CONTAINER_PORT -name "$PEERNAME" -nickname "$(hostname)" -iprange "$IPRANGE" "$@") - with_container_netns_or_die $CONTAINER launch - wait_for_status $CONTAINER_NAME $HTTP_PORT - if [ -n "$IPRANGE" ] ; then - # Tell the newly-started weave IP allocator about existing weave IPs - with_container_addresses ipam_claim weave:expose $(docker ps -q --no-trunc) - fi + launch_router "$@" echo $CONTAINER ;; launch-dns) - collect_cidr_args "$@" - [ $CIDR_ARG_COUNT -lt 2 ] || usage - shift $CIDR_ARG_COUNT check_not_running $DNS_CONTAINER_NAME $BASE_DNS_IMAGE - create_bridge - docker_bridge_ip - # Set WEAVEDNS_DOCKER_ARGS in the environment in order to supply - # additional parameters, such as resource limits, to docker - # when launching the weave container. - DNS_CONTAINER=$(docker run --privileged -d --name=$DNS_CONTAINER_NAME \ - -p $DOCKER_BRIDGE_IP:53:53/udp \ - -e WEAVE_CIDR=none \ - -v /var/run/docker.sock:/var/run/docker.sock \ - $WEAVEDNS_DOCKER_ARGS $DNS_IMAGE -iface $CONTAINER_IFNAME -httpiface "$DNS_HTTP_IFNAME" "$@") - ipam_cidrs_or_die $DNS_CONTAINER $CIDR_ARGS - with_container_netns_or_die $DNS_CONTAINER attach $ALL_CIDRS - populate_dns + launch_dns "$@" echo $DNS_CONTAINER ;; launch-proxy) check_not_running $PROXY_CONTAINER_NAME $EXEC_IMAGE - # Set WEAVEPROXY_DOCKER_ARGS in the environment in order to supply - # additional parameters, such as resource limits, to docker - # when launching the weaveproxy container. - proxy_args "$@" - PROXY_CONTAINER=$(docker run --privileged -d --name=$PROXY_CONTAINER_NAME --net=host \ - $PROXY_VOLUMES \ - -v /var/run/docker.sock:/var/run/docker.sock \ - -v /proc:/hostproc \ - -e PROCFS=/hostproc \ - -e WEAVE_CIDR=none \ - --entrypoint=/home/weave/weaveproxy \ - $WEAVEPROXY_DOCKER_ARGS $EXEC_IMAGE $PROXY_ARGS) - wait_for_log $PROXY_CONTAINER_NAME "proxy listening" + launch_proxy "$@" echo $PROXY_CONTAINER ;; proxy-env) @@ -1275,6 +1302,13 @@ case "$COMMAND" in show_addrs $ALL_CIDRS ;; stop) + [ $# -eq 0 ] || usage + stop $PROXY_CONTAINER_NAME "Proxy" + stop $DNS_CONTAINER_NAME "WeaveDNS" + stop $CONTAINER_NAME "Weave" + conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true + ;; + stop-router) [ $# -eq 0 ] || usage stop $CONTAINER_NAME "Weave" conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true