From 18deb42df12fc3b17ad7af481a47a213b76e9a9d Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 22 Nov 2019 22:30:03 +0000 Subject: [PATCH 1/6] Raise Kubernetes CPU requests from 10m to 50m This setting is passed by Kubelet to the Linux scheduler to ask for a share of available CPU, so we should ask for a bit more than 1% of 1 CPU. Otherwise if a CPU is contended Weave Net will get throttled frequently. Weave Net in fastdp mode shouldn't need a lot of CPU most of the time, but at startup there is quite a lot to do. The setting is also used by the Kubernetes scheduler to decide how much will fit on a node, so setting it much higher will reserve CPU that we shouldn't need most of the time. --- prog/weave-kube/weave-daemonset-k8s-1.11.yaml | 4 ++-- prog/weave-kube/weave-daemonset-k8s-1.6.yaml | 4 ++-- prog/weave-kube/weave-daemonset-k8s-1.7.yaml | 4 ++-- prog/weave-kube/weave-daemonset-k8s-1.8.yaml | 4 ++-- prog/weave-kube/weave-daemonset-k8s-1.9.yaml | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/prog/weave-kube/weave-daemonset-k8s-1.11.yaml b/prog/weave-kube/weave-daemonset-k8s-1.11.yaml index 7fafa3a3..07f4d4f3 100644 --- a/prog/weave-kube/weave-daemonset-k8s-1.11.yaml +++ b/prog/weave-kube/weave-daemonset-k8s-1.11.yaml @@ -137,7 +137,7 @@ items: port: 6784 resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: @@ -168,7 +168,7 @@ items: #npc-args resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: diff --git a/prog/weave-kube/weave-daemonset-k8s-1.6.yaml b/prog/weave-kube/weave-daemonset-k8s-1.6.yaml index f093be7c..5245283e 100644 --- a/prog/weave-kube/weave-daemonset-k8s-1.6.yaml +++ b/prog/weave-kube/weave-daemonset-k8s-1.6.yaml @@ -117,7 +117,7 @@ items: port: 6784 resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: @@ -144,7 +144,7 @@ items: imagePullPolicy: Always resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true hostNetwork: true diff --git a/prog/weave-kube/weave-daemonset-k8s-1.7.yaml b/prog/weave-kube/weave-daemonset-k8s-1.7.yaml index f2548cad..4fc69f3e 100644 --- a/prog/weave-kube/weave-daemonset-k8s-1.7.yaml +++ b/prog/weave-kube/weave-daemonset-k8s-1.7.yaml @@ -126,7 +126,7 @@ items: port: 6784 resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: @@ -156,7 +156,7 @@ items: imagePullPolicy: Always resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: diff --git a/prog/weave-kube/weave-daemonset-k8s-1.8.yaml b/prog/weave-kube/weave-daemonset-k8s-1.8.yaml index 4dcc9dcc..66c1d86b 100644 --- a/prog/weave-kube/weave-daemonset-k8s-1.8.yaml +++ b/prog/weave-kube/weave-daemonset-k8s-1.8.yaml @@ -134,7 +134,7 @@ items: port: 6784 resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: @@ -165,7 +165,7 @@ items: #npc-args resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: diff --git a/prog/weave-kube/weave-daemonset-k8s-1.9.yaml b/prog/weave-kube/weave-daemonset-k8s-1.9.yaml index 42a3fdde..46f9af24 100644 --- a/prog/weave-kube/weave-daemonset-k8s-1.9.yaml +++ b/prog/weave-kube/weave-daemonset-k8s-1.9.yaml @@ -137,7 +137,7 @@ items: port: 6784 resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: @@ -168,7 +168,7 @@ items: #npc-args resources: requests: - cpu: 10m + cpu: 50m securityContext: privileged: true volumeMounts: From 01237446ebcaa18334ad7af60a9a600866d5c5cf Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 22 Nov 2019 23:23:55 +0000 Subject: [PATCH 2/6] Update docs to match new memory requests --- site/kubernetes/kube-addon.md | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 5a80820a..36ef3f6e 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -89,23 +89,18 @@ Kubernetes manages on each node, and only schedules pods to run on nodes that have enough free resources. -The components of a typical Kubernetes installation (with the master -node running etcd, scheduler, api-server, etc.) take up about 95% of a -CPU, which leaves little room to run anything else. For all of Weave -Net's features to work, it must run on every node, including the -master. +In the example manifests we request 10% of a CPU, which will be enough +for small installations, but you should monitor how much it uses in +your production clusters and adjust the requests to suit. -The best way to resolve this issue is to use machines with at least -two CPU cores. However if you are installing Kubernetes and Weave Net -for the first time, you may not be aware of this requirement. For this -reason, Weave Net launches as a DaemonSet with a specification that -reserves at least 1% CPU for each container. This enables Weave Net to -start up seamlessly on a single-CPU node. +We do not recommend that you set a CPU or memory _limit_ unless you +are very experienced in such matters, because the implementation of +limits in the Linux kernel sometimes behaves in a surprising way. -Depending on the workload, Weave Net may need more than 1% of the -CPU. The percentage set in the DaemonSet is the minimum and not a -limit. This minimum setting allows Weave Net to take advantage of -available CPU and "burst" above that limit if it needs to. +On a 1-node single-CPU cluster you may find Weave Net does not install +at all, because other Kubernetes components already take 95% of the +CPU. The best way to resolve this issue is to use machines with at +least two CPU cores. ## Pod Eviction From 4b30d97d4e040626b476c687e23ede34fee00cc7 Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Tue, 10 Dec 2019 12:51:00 +0530 Subject: [PATCH 3/6] update alpine base image to 3.10 that has iptables ver 1.8.3 --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 8bcbfabc..9e08a023 100644 --- a/Makefile +++ b/Makefile @@ -25,7 +25,7 @@ ifeq ($(ARCH),amd64) WEAVEEXEC_DOCKER_ARCH?=x86_64 # The name of the alpine baseimage to use as the base for weave images - ALPINE_BASEIMAGE?=alpine:3.8 + ALPINE_BASEIMAGE?=alpine:3.10 # The extension for the made images # Specifying none means for example weaveworks/weave:latest From 4f48670345239e4dc7201f8b336aad414a35d7dd Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Fri, 13 Dec 2019 06:12:29 +0530 Subject: [PATCH 4/6] set iptables backend to use if specified explicitly or auto-detect --- prog/weave-kube/launch.sh | 30 ++++++++++++++++++++++++++++++ prog/weave-npc/launch.sh | 30 ++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh index b838c3ef..143208fe 100755 --- a/prog/weave-kube/launch.sh +++ b/prog/weave-kube/launch.sh @@ -6,6 +6,34 @@ modprobe_safe() { modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2 } +# Setup iptables backend to be legacy or nftable +setup_iptables_backend() { + if [ -n "${IPTABLES_BACKEND}" ]; then + mode=$IPTABLES_BACKEND + else + # auto-detect if iptables backend mode to use if not specified explicitly + num_legacy_lines=$( (iptables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l) + num_nft_lines=$( (iptables-nft-save || true) 2>/dev/null | grep '^-' | wc -l) + if [ "${num_legacy_lines}" -ge 10 ]; then + mode="legacy" + else + if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then + mode="legacy" + else + mode="nft" + fi + fi + fi + if [ $mode = "nft" ]; then + rm /sbin/iptables + rm /sbin/iptables-save + rm /sbin/iptables-restore + ln /sbin/iptables-nft /sbin/iptables + ln /sbin/iptables-nft-save /sbin/iptables-save + ln /sbin/iptables-nft-restore /sbin/iptables-restore + fi +} + # Check whether xt_set actually exists xt_set_exists() { # Clean everything up in advance, in case there's leftovers @@ -24,6 +52,8 @@ xt_set_exists() { [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1) } +setup_iptables_backend + # Default if not supplied - same as weave net default IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12} HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784} diff --git a/prog/weave-npc/launch.sh b/prog/weave-npc/launch.sh index 776ddd84..104eeb11 100755 --- a/prog/weave-npc/launch.sh +++ b/prog/weave-npc/launch.sh @@ -2,5 +2,35 @@ set -e +# Setup iptables backend to be legacy or nftable +setup_iptables_backend() { + if [ -n "${IPTABLES_BACKEND}" ]; then + mode=$IPTABLES_BACKEND + else + # auto-detect if iptables backend mode to use if not specified explicitly + num_legacy_lines=$( (iptables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l) + num_nft_lines=$( (iptables-nft-save || true) 2>/dev/null | grep '^-' | wc -l) + if [ "${num_legacy_lines}" -ge 10 ]; then + mode="legacy" + else + if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then + mode="legacy" + else + mode="nft" + fi + fi + fi + if [ $mode = "nft" ]; then + rm /sbin/iptables + rm /sbin/iptables-save + rm /sbin/iptables-restore + ln /sbin/iptables-nft /sbin/iptables + ln /sbin/iptables-nft-save /sbin/iptables-save + ln /sbin/iptables-nft-restore /sbin/iptables-restore + fi +} + +setup_iptables_backend + # Start weave-npc with any flags specified in $EXTRA_ARGS as well as any flags passed to this container (for backwards compatibility) exec /usr/bin/weave-npc $EXTRA_ARGS $@ From 83024b946f231b1888e101c485ffcad0ece812d6 Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Wed, 8 Jan 2020 15:43:04 +0530 Subject: [PATCH 5/6] use softlinks to link iptables to backend specific commands and update docs --- prog/weave-kube/launch.sh | 6 +++--- prog/weave-npc/launch.sh | 6 +++--- site/kubernetes/kube-addon.md | 1 + 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh index 143208fe..0de63126 100755 --- a/prog/weave-kube/launch.sh +++ b/prog/weave-kube/launch.sh @@ -28,9 +28,9 @@ setup_iptables_backend() { rm /sbin/iptables rm /sbin/iptables-save rm /sbin/iptables-restore - ln /sbin/iptables-nft /sbin/iptables - ln /sbin/iptables-nft-save /sbin/iptables-save - ln /sbin/iptables-nft-restore /sbin/iptables-restore + ln -s /sbin/iptables-nft /sbin/iptables + ln -s /sbin/iptables-nft-save /sbin/iptables-save + ln -s /sbin/iptables-nft-restore /sbin/iptables-restore fi } diff --git a/prog/weave-npc/launch.sh b/prog/weave-npc/launch.sh index 104eeb11..baf8491e 100755 --- a/prog/weave-npc/launch.sh +++ b/prog/weave-npc/launch.sh @@ -24,9 +24,9 @@ setup_iptables_backend() { rm /sbin/iptables rm /sbin/iptables-save rm /sbin/iptables-restore - ln /sbin/iptables-nft /sbin/iptables - ln /sbin/iptables-nft-save /sbin/iptables-save - ln /sbin/iptables-nft-restore /sbin/iptables-restore + ln -s /sbin/iptables-nft /sbin/iptables + ln -s /sbin/iptables-nft-save /sbin/iptables-save + ln -s /sbin/iptables-nft-restore /sbin/iptables-restore fi } diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 73fc836e..bbf3b58e 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -406,6 +406,7 @@ The list of variables you can set is: * `NO_MASQ_LOCAL` - set to 1 to preserve the client source IP address when accessing Service annotated with `service.spec.externalTrafficPolicy=Local`. The feature works only with Weave IPAM (default). +* `IPTABLES_BACKEND` - set to `nft` to use `nftables` backend for `iptables` (default is `iptables`) Example: ``` From 861395011cf090ed7730581a480601af81596394 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 27 Jan 2020 17:05:46 +0000 Subject: [PATCH 6/6] Update Ruby version for the benefit of Netlify build Picked 2.6.2 based on message from Netlify build: "Included versions: 2.3.6 2.5.4 2.4.5 2.4.3 2.2.9 2.6.2" --- .ruby-version | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.ruby-version b/.ruby-version index 276cbf9e..097a15a2 100644 --- a/.ruby-version +++ b/.ruby-version @@ -1 +1 @@ -2.3.0 +2.6.2