From 6036037817ae065dad44fce43bbc20cf802820c5 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Mon, 27 Feb 2017 18:10:13 +0000
Subject: [PATCH 1/3] Added kops update to the release instructions

---
 docs/release-process.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/release-process.md b/docs/release-process.md
index 7fa980f1..872857a6 100644
--- a/docs/release-process.md
+++ b/docs/release-process.md
@@ -138,6 +138,8 @@ Finally, for **Mainline** releases only:
   published to https://www.weave.works
 * Add the new version of `weave-net` to the checkpoint system at
   https://checkpoint-api.weave.works/admin
+* File a PR to update the version of the daemonset at
+  https://github.com/kubernetes/kops/tree/master/upup/models/cloudup/resources/addons/networking.weave
 
 ## Troubleshooting
 

From a57cf4bc8303d664a74545738c519f641092c1e8 Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Tue, 28 Feb 2017 11:19:13 +0000
Subject: [PATCH 2/3] Ignore modprobe errors in weave-kube/launch.sh

weave-kube is run by alpine image which uses busybox. modprobe of
busybox will return the "module not found" error [1], if a module is
built-in, which is an opposite behavior to modprobe distributed in
mainstream distros (e.g. ubuntu).

[1]: https://bugs.busybox.net/show_bug.cgi?id=5270
---
 prog/weave-kube/launch.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh
index 16cd5d57..8a3484d7 100755
--- a/prog/weave-kube/launch.sh
+++ b/prog/weave-kube/launch.sh
@@ -2,6 +2,10 @@
 
 set -e
 
+modprobe_safe() {
+    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel"
+}
+
 # Default if not supplied - same as weave net default
 IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12}
 HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784}
@@ -17,8 +21,8 @@ EXPECT_NPC=${EXPECT_NPC:-1}
 
 # Ensure we have the required modules for NPC
 if [ "${EXPECT_NPC}" != "0" ]; then
-    modprobe br_netfilter
-    modprobe xt_set
+    modprobe_safe br_netfilter
+    modprobe_safe xt_set
 fi
 
 # kube-proxy requires that bridged traffic passes through netfilter

From 3607cf2d7a2fbc201e41439004d54f34a2860a8b Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Tue, 28 Feb 2017 16:27:21 +0000
Subject: [PATCH 3/3] Add check for xt_set module

The check is based on actually trying to install an iptables rule
which uses the module.
---
 prog/weave-kube/launch.sh          | 16 +++++++++++++++-
 prog/weaveexec/Dockerfile.template |  1 +
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh
index 8a3484d7..e7f79331 100755
--- a/prog/weave-kube/launch.sh
+++ b/prog/weave-kube/launch.sh
@@ -3,7 +3,20 @@
 set -e
 
 modprobe_safe() {
-    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel"
+    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
+}
+
+# Check whether xt_set actually exists
+xt_set_exists() {
+    ipset create weave-kube-test hash:ip
+    iptables -t filter -N WEAVE-KUBE-TEST
+    if ! iptables -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
+        NOT_EXIST=1
+    fi
+    iptables -F WEAVE-KUBE-TEST
+    iptables -X WEAVE-KUBE-TEST
+    ipset destroy weave-kube-test
+    [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
 }
 
 # Default if not supplied - same as weave net default
@@ -23,6 +36,7 @@ EXPECT_NPC=${EXPECT_NPC:-1}
 if [ "${EXPECT_NPC}" != "0" ]; then
     modprobe_safe br_netfilter
     modprobe_safe xt_set
+    xt_set_exists
 fi
 
 # kube-proxy requires that bridged traffic passes through netfilter
diff --git a/prog/weaveexec/Dockerfile.template b/prog/weaveexec/Dockerfile.template
index 90c87de8..09d76848 100644
--- a/prog/weaveexec/Dockerfile.template
+++ b/prog/weaveexec/Dockerfile.template
@@ -19,6 +19,7 @@ RUN apk add --update \
     curl \
     ethtool \
     iptables \
+    ipset \
     iproute2 \
     util-linux \
     conntrack-tools \