reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'master' into 140_weave_connect

Browse Source 
Conflicts:
	weave
This commit is contained in:
Matthias Radestock committed 2014-10-27 14:33:26 +00:00
2 parents 6393e545ae 4b8988346f
commit 741f4616a4
2 files changed
+75 -57
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+16 -16
View File
@@ -55,20 +55,20 @@ containers, one on each host.
On $HOST1 run (as root)
host1# weave launch 10.0.0.1/16
host1# weave launch
host1# C=$(weave run 10.0.1.1/24 -t -i ubuntu)
The first line starts the weave router, in a container. This needs to
be done once on each host. We tell weave that its IP address should
be 10.0.0.1, and that the weave network is on 10.0.0.0/16.
be done once on each host.
The second line runs our application container. We give it an IP
address and network (a subnet of the weave network). `weave run`
invokes `docker run -d` with all the parameters following the IP
address and network. So we could be launching any container this way;
here we just take a stock ubuntu container and launch a shell in
it. There's also a `weave start` command, which invokes `docker start`
for starting existing containers.
address and network, in
[CIDR notation](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation).
`weave run` invokes `docker run -d` with all the parameters following
the IP address and network. So we could be launching any container
this way; here we just take a stock ubuntu container and launch a
shell in it. There's also a `weave start` command, which invokes
`docker start` for starting existing containers.
If our application consists of more than one container on this host we
simply launch them with a variation on that second line.
@@ -81,15 +81,15 @@ unique.
We repeat similar steps on $HOST2...
host2# weave launch 10.0.0.2/16 $HOST1
host2# weave launch $HOST1
host2# C=$(weave run 10.0.1.2/24 -t -i ubuntu)
The only difference, apart from the choice of IP addresses for the
weave router and the application container, is that we tell our weave
that it should peer with the weave on $HOST1 (specified as the IP
address or hostname, and optional `:port`, by which $HOST2 can reach
it). NB: if there is a firewall between $HOST1 and $HOST2, you must
open port 6783 for TCP and UDP.
The only difference, apart from the choice of IP address for the
application container, is that we tell our weave that it should peer
with the weave on $HOST1 (specified as the IP address or hostname, and
optional `:port`, by which $HOST2 can reach it). NB: if there is a
firewall between $HOST1 and $HOST2, you must open port 6783 for TCP
and UDP.
Note that we could instead have told the weave on $HOST1 to connect to
$HOST2, or told both about each other. Order does not matter here;
weave
+59 -41
View File
@@ -3,14 +3,14 @@ set -e
usage() {
echo "Usage:"
echo "weave launch <cidr> [-password <password>] <peer> ..."
echo "weave launch [-password <password>] <peer> ..."
echo "weave connect <peer>"
echo "weave run <cidr> <docker run args> ..."
echo "weave start <cidr> <container_id>"
echo "weave attach <cidr> <container_id>"
echo "weave detach <cidr> <container_id>"
echo "weave expose <cidr>"
echo "weave hide <cidr>"
echo "weave connect <peer>"
echo "weave status"
echo "weave version"
echo "weave stop"
@@ -56,9 +56,13 @@ check_command_and_run() {
fi
}
validate_cidr() {
is_cidr() {
# The regexp here is far from precise, but good enough.
if ! echo "$1" | grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$' >/dev/null ; then
echo "$1" | grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$' >/dev/null
}
validate_cidr() {
if ! is_cidr "$1" ; then
echo "Invalid CIDR: $1" >&2
echo "CIDR must of be of form <ip_address>/<routing_prefix_length>, e.g. 10.0.1.1/24" >&2
exit 1
@@ -87,6 +91,16 @@ add_iptables_rule() {
fi
}
# Delete a rule from iptables, if it exist
delete_iptables_rule() {
IPTABLES_TABLE="$1"
shift 1
if run_iptables -t $IPTABLES_TABLE -C "$@" >/dev/null 2>&1
then
run_iptables -t $IPTABLES_TABLE -D "$@" >/dev/null
fi
}
create_bridge() {
[ ! -d /sys/class/net/$BRIDGE ] && {
ip link add name $BRIDGE type bridge
@@ -103,6 +117,9 @@ create_bridge() {
# Work around the situation where there are no rules allowing traffic
# across our bridge. E.g. ufw
add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT
# create a chain for masquerading
run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true
add_iptables_rule nat POSTROUTING -j WEAVE
}
ip link set dev $BRIDGE up
}
@@ -112,16 +129,6 @@ destroy_bridge() {
ip link del dev $BRIDGE
fi
run_iptables -t filter -D FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT 2>/dev/null || true
}
setup_masquerading() {
run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true
add_iptables_rule nat POSTROUTING -j WEAVE
add_iptables_rule nat WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
add_iptables_rule nat WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
}
stop_masquerading() {
run_iptables -t nat -F WEAVE >/dev/null 2>&1 || true
run_iptables -t nat -D POSTROUTING -j WEAVE >/dev/null 2>&1 || true
run_iptables -t nat -X WEAVE >/dev/null 2>&1 || true
@@ -180,6 +187,29 @@ with_container_netns () {
return $STATUS
}
connect_container_to_bridge() {
if ! ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU ; then
return 1
fi
if ! ip link set $GUEST_IFNAME netns $NETNS ; then
# failed before we assigned the veth to the container's
# namespace - delete it
ip link del $LOCAL_IFNAME type veth || true
return 1
fi
ip link set $LOCAL_IFNAME master $BRIDGE &&
ip link set $LOCAL_IFNAME up &&
ip netns exec $NETNS ip link set $GUEST_IFNAME name $CONTAINER_IFNAME
}
launch() {
connect_container_to_bridge &&
ip netns exec $NETNS ip link set $CONTAINER_IFNAME up &&
check_command_and_run ethtool ip netns exec $NETNS ethtool -K eth0 tx off >/dev/null
}
attach() {
if ip link show $LOCAL_IFNAME >/dev/null 2>&1 ; then
# veth name already exists, so assume we set it up already;
@@ -196,23 +226,10 @@ attach() {
return 0
fi
if ! ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU ; then
return 1
fi
if ! ip link set $GUEST_IFNAME netns $NETNS ; then
# failed before we assigned the veth to the container's
# namespace - delete it
ip link del $LOCAL_IFNAME type veth || true
return 1
fi
if ! ip link set $LOCAL_IFNAME master $BRIDGE ||
! ip link set $LOCAL_IFNAME up ||
! ip netns exec $NETNS ip link set $GUEST_IFNAME name $CONTAINER_IFNAME ||
if ! connect_container_to_bridge ||
! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME ||
! ip netns exec $NETNS ip link set $CONTAINER_IFNAME up ||
! check_command_and_run ethtool ip netns exec $NETNS ethtool -K $2 tx off >/dev/null ; then
! check_command_and_run ethtool ip netns exec $NETNS ethtool -K $CONTAINER_IFNAME tx off >/dev/null ; then
return 1
fi
@@ -243,10 +260,6 @@ detach() {
case "$COMMAND" in
launch)
[ $# -gt 0 ] || usage
validate_cidr $1
CIDR=$1
shift 1
case $(docker inspect --format '{{ .State.Running }} {{ .Config.Image }}' $CONTAINER_NAME 2>/dev/null) in
"true $IMAGE")
echo "Weave is already running." >&2
@@ -265,8 +278,6 @@ case "$COMMAND" in
;;
esac
create_bridge
stop_masquerading
setup_masquerading $CIDR
# We set the router name to the bridge mac since that is
# stable across re-creations of the containers.
#
@@ -274,11 +285,16 @@ case "$COMMAND" in
# (eth0, wlan0, etc) so the name becomes stable across host
# restarts.
MACADDR=`cat /sys/class/net/$BRIDGE/address`
# backward compatibility...
if is_cidr "$1" ; then
echo "WARNING: $1 parameter ignored; 'weave launch' no longer takes a CIDR as the first parameter" >&2
shift 1
fi
# Set WEAVE_DOCKER_ARGS in the environment in order to supply
# additional parameters, such as resource limits, to docker
# when launching the weave container.
CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME -p $PORT:$PORT/tcp -p $PORT:$PORT/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@" | tail -n 1)
with_container_netns $CONTAINER attach $CIDR eth0
with_container_netns $CONTAINER launch
echo $CONTAINER
;;
connect)
@@ -321,7 +337,7 @@ case "$COMMAND" in
shift 1
create_bridge
CONTAINER=$(docker run -d "$@" | tail -n 1)
with_container_netns $CONTAINER attach $CIDR $CONTAINER_IFNAME
with_container_netns $CONTAINER attach $CIDR
echo $CONTAINER
;;
start)
@@ -329,14 +345,14 @@ case "$COMMAND" in
validate_cidr $1
create_bridge
CONTAINER=$(docker start $2)
with_container_netns $CONTAINER attach $1 $CONTAINER_IFNAME
with_container_netns $CONTAINER attach $1
echo $CONTAINER
;;
attach)
[ $# -eq 2 ] || usage
validate_cidr $1
create_bridge
with_container_netns $2 attach $1 $CONTAINER_IFNAME
with_container_netns $2 attach $1
;;
detach)
[ $# -eq 2 ] || usage
@@ -350,6 +366,8 @@ case "$COMMAND" in
if ! ip addr show dev $BRIDGE | grep -qF $1
then
ip addr add dev $BRIDGE $1
add_iptables_rule nat WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
add_iptables_rule nat WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
fi
;;
hide)
@@ -359,6 +377,8 @@ case "$COMMAND" in
if ip addr show dev $BRIDGE | grep -qF $1
then
ip addr del dev $BRIDGE $1
delete_iptables_rule nat WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
delete_iptables_rule nat WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
fi
;;
stop)
@@ -368,14 +388,12 @@ case "$COMMAND" in
fi
docker rm -f $CONTAINER_NAME >/dev/null 2>&1 || true
check_command_and_run conntrack conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true
stop_masquerading
;;
reset)
[ $# -eq 0 ] || usage
docker kill $CONTAINER_NAME >/dev/null 2>&1 || true
docker rm -f $CONTAINER_NAME >/dev/null 2>&1 || true
check_command_and_run conntrack conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true
stop_masquerading
destroy_bridge
;;
*)