From 5c508f837ec3804f61f6cb04e840507763384cf4 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 11 Nov 2019 10:14:42 +0000 Subject: [PATCH 1/3] Add manifest for Kubernetes 1.11 and above --- bin/release | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/bin/release b/bin/release index de426682..243c2480 100755 --- a/bin/release +++ b/bin/release @@ -93,6 +93,7 @@ build() { sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.7.yaml sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.8.yaml sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.9.yaml + sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.11.yaml make SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER if make tests; then @@ -189,6 +190,13 @@ draft() { --name "weave-daemonset-k8s-1.9.yaml" \ --file "./prog/weave-kube/weave-daemonset-k8s-1.9.yaml" + github-release upload \ + --user $GITHUB_USER \ + --repo weave \ + --tag $LATEST_TAG \ + --name "weave-daemonset-k8s-1.11.yaml" \ + --file "./prog/weave-kube/weave-daemonset-k8s-1.11.yaml" + echo "** Draft $TYPE $RELEASE_NAME $VERSION created at" echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG" } @@ -304,6 +312,13 @@ publish() { --name "weave-daemonset-k8s-1.9.yaml" \ --file "./prog/weave-kube/weave-daemonset-k8s-1.9.yaml" + github-release upload \ + --user $GITHUB_USER \ + --repo weave \ + --tag latest_release \ + --name "weave-daemonset-k8s-1.11.yaml" \ + --file "./prog/weave-kube/weave-daemonset-k8s-1.11.yaml" + echo "** Release $RELEASE_NAME $VERSION published at" echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG" echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/latest_release" From 7c1b615c983d0b93bdbf4e78a77f8c584c236503 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 28 Nov 2019 20:45:28 +0000 Subject: [PATCH 2/3] Add a note about dropping CAP_NET_RAW in Kubernetes --- site/kubernetes/kube-addon.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 5a80820a..b3e96dff 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -458,3 +458,11 @@ You must pass the `password-secret` option as noted in the previous section to e A different option is to use `trusted-subnets` and whitelist only the subnets that host your k8s nodes. Mind that depending on your circumstances that might allow a malicious container running in your cluster to access the weave dataplane, still. Read on the [Securing Connections Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks/) document to see the alternatives. + +To improve security drop `CAP_NET_RAW` from pod capabilities: by default pods can forge packets from anywhere on the network, which enables attacks such as DNS spoofing. + +``` + securityContext: + capabilities: + drop: ["NET_RAW"] +``` From 8b220f638348426d629b98bc0c15758a28c10650 Mon Sep 17 00:00:00 2001 From: Alejo Carballude Date: Fri, 6 Dec 2019 16:00:03 -0300 Subject: [PATCH 3/3] Fix kube-addon documentation broken markdown link. --- site/kubernetes/kube-addon.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 5a80820a..078fc1d5 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -231,8 +231,7 @@ You may also set the `--log-level` flag to `warning` or `error` if you prefer to only log exceptional conditions. Many Kubernetes network issues occur at a higher level than Weave Net. -The [Kubernetes Service Debugging Guide] -(https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/) +The [Kubernetes Service Debugging Guide](https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/) has a detailed step-by-step guide. Once it is up and running, the status of Weave Net can be checked by