From f6fdaf64924d49b1d080c2382f9d21b431edb9b8 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Wed, 4 Apr 2018 12:22:59 +0100 Subject: [PATCH 1/4] Only expose metrics by default in weave-kube --- prog/weave-kube/launch.sh | 10 ++++++++-- prog/weaver/main.go | 11 ++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh index c8ba8ebf..9ee11402 100755 --- a/prog/weave-kube/launch.sh +++ b/prog/weave-kube/launch.sh @@ -27,7 +27,7 @@ xt_set_exists() { # Default if not supplied - same as weave net default IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12} HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784} -STATUS_ADDR=${WEAVE_STATUS_ADDR:-0.0.0.0:6782} +METRICS_ADDR=${WEAVE_METRICS_ADDR:-0.0.0.0:6782} HOST_ROOT=${HOST_ROOT:-/host} CONN_LIMIT=${CONN_LIMIT:-100} DB_PREFIX=${DB_PREFIX:-/weavedb/weave-net} @@ -54,6 +54,12 @@ else fi fi +STATUS_OPTS="--metrics-addr=$METRICS_ADDR" +# --status-addr exposes internal information, so only turn it on if asked to. +if [ -n "${WEAVE_STATUS_ADDR}" ]; then + STATUS_OPTS="$STATUS_OPTS --status-addr=$WEAVE_STATUS_ADDR" +fi + # Default is that npc will be running; allow caller to override WEAVE_NPC_OPTS="--expect-npc" if [ "${EXPECT_NPC}" = "0" ]; then @@ -144,7 +150,7 @@ post_start_actions & /home/weave/weaver $EXTRA_ARGS --port=6783 $(router_bridge_opts) \ --name="$PEERNAME" \ --host-root=$HOST_ROOT \ - --http-addr=$HTTP_ADDR --status-addr=$STATUS_ADDR --docker-api='' --no-dns \ + --http-addr=$HTTP_ADDR $STATUS_OPTS --docker-api='' --no-dns \ --db-prefix="$DB_PREFIX" \ --ipalloc-range=$IPALLOC_RANGE $NICKNAME_ARG \ --ipalloc-init $IPALLOC_INIT \ diff --git a/prog/weaver/main.go b/prog/weaver/main.go index 4db2b796..52a7b6bc 100644 --- a/prog/weaver/main.go +++ b/prog/weaver/main.go @@ -155,6 +155,7 @@ func main() { noDiscovery bool httpAddr string statusAddr string + metricsAddr string ipamConfig ipamConfig dockerAPI string peers []string @@ -192,6 +193,7 @@ func main() { mflag.IntVar(&bridgeConfig.MTU, []string{"-mtu"}, 0, "MTU size") mflag.StringVar(&httpAddr, []string{"-http-addr"}, "", "address to bind HTTP interface to (disabled if blank, absolute path indicates unix domain socket)") mflag.StringVar(&statusAddr, []string{"-status-addr"}, "", "address to bind status+metrics interface to (disabled if blank, absolute path indicates unix domain socket)") + mflag.StringVar(&metricsAddr, []string{"-metrics-addr"}, "", "address to bind metrics interface to (disabled if blank, absolute path indicates unix domain socket)") mflag.StringVar(&ipamConfig.Mode, []string{"-ipalloc-init"}, "", "allocator initialisation strategy (consensus, seed or observer)") mflag.StringVar(&ipamConfig.IPRangeCIDR, []string{"-ipalloc-range"}, "", "IP address range reserved for automatic allocation, in CIDR notation") mflag.StringVar(&ipamConfig.IPSubnetCIDR, []string{"-ipalloc-default-subnet"}, "", "subnet to allocate within by default, in CIDR notation") @@ -474,10 +476,17 @@ func main() { muxRouter.Methods("GET").Path("/metrics").Handler(metricsHandler(router, allocator, ns, dnsserver)) statusMux := http.NewServeMux() statusMux.Handle("/", muxRouter) - Log.Println("Listening for metrics requests on", statusAddr) + Log.Println("Listening for status+metrics requests on", statusAddr) go listenAndServeHTTP(statusAddr, statusMux) } + if metricsAddr != "" { + metricsMux := http.NewServeMux() + metricsMux.Handle("/metrics", metricsHandler(router, allocator, ns, dnsserver)) + Log.Println("Listening for metrics requests on", metricsAddr) + go listenAndServeHTTP(metricsAddr, metricsMux) + } + if plugin != nil { go plugin.Start(httpAddr, dockerCli, waitReady.Add()) } From a7295e2d031407a9035ea87e37dc5d410ea2a9ad Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 9 Apr 2018 11:55:50 +0100 Subject: [PATCH 2/4] Mention metrics and status addresses in the docs --- site/kubernetes/kube-addon.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index ad7cd892..fdf37967 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -346,6 +346,10 @@ The list of variables you can set is: * `WEAVE_EXPOSE_IP` - set the IP address used as a gateway from the Weave network to the host network - this is useful if you are configuring the addon as a static pod. +* `WEAVE_METRICS_ADDR` - address and port that the Weave Net + daemon will serve Prometheus-style metrics on (defaults to 0.0.0.0:6782) +* `WEAVE_STATUS_ADDR` - address and port that the Weave Net + daemon will serve status requests on (defaults to disabled) * `WEAVE_MTU` - Weave Net defaults to 1376 bytes, but you can set a smaller size if your underlying network has a tighter limit, or set a larger size for better performance if your network supports jumbo From 5645f31934fa0aab3d030721a3535823a5250935 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 9 Apr 2018 13:11:29 +0100 Subject: [PATCH 3/4] Update docs for metrics endpoints --- site/tasks/manage/metrics.md | 40 +++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 17 deletions(-) diff --git a/site/tasks/manage/metrics.md b/site/tasks/manage/metrics.md index a2b27371..da776cfd 100644 --- a/site/tasks/manage/metrics.md +++ b/site/tasks/manage/metrics.md @@ -10,9 +10,6 @@ controller](/site/kubernetes/kube-addon.md#npc). ### Router Metrics -The endpoint address is `localhost:6782`; the following metrics are -exposed: - * `weave_connections` - Number of peer-to-peer connections. * `weave_connection_terminations_total` - Number of peer-to-peer connections terminated. @@ -25,27 +22,36 @@ exposed: * `weave_ipam_pending_allocates` - Number of pending allocates. * `weave_ipam_pending_claims` - Number of pending claims. -#### Publish Router Metrics Endpoint - -By default, when started via `weave launch`, weave listens on its local -interface to serve metrics. To publish your metrics throughout your cluster, -e.g. if your prometheus server is installed on a different host machine, -you need to set `WEAVE_STATUS_ADDR` to your corresponding IP and port. -Default port is 6782. - -`WEAVE_STATUS_ADDR=X.X.X.X:PORT` - -You can set `WEAVE_STATUS_ADDR=0.0.0.0:6782` to listen on all interfaces, -but be aware, this may expose your metrics to the public internet. - ### Kubernetes Network Policy Controller Metrics -The endpoint address is `localhost:6781`; the following metric is +The following metric is exposed: * `weavenpc_blocked_connections_total` - Connection attempts blocked by policy controller. +### Metrics Endpoint Addresses + +When installed as a Kubernetes Addon, the router listens for metrics +requests on 0.0.0.0:6782 and the Network Policy Controller listens on +0.0.0.0:6781. No other requests are served on these endpoints. + +>Note: If your Kubernetes hosts are exposed to the public internet +then these metrics endpoints will also be exposed. + +When started via `weave launch`, by default weave listens on its local +interface to serve metrics and other read-only status requests. To +publish your metrics throughout your cluster, you can set +`WEAVE_STATUS_ADDR`: + +`WEAVE_STATUS_ADDR=X.X.X.X:PORT` + +Set it to an empty string to disable. + +You can also add `--metrics-addr=X.X.X.X:PORT` to specify an address +to listen for metrics only. + + # Static Configuration for Weave Net The following YAML fragment can be used in your Prometheus configuration to From fcb6f762a987970ca3d737c6aae84654fdb16425 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 9 Apr 2018 13:42:09 +0100 Subject: [PATCH 4/4] Review feedback --- site/tasks/manage/metrics.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/site/tasks/manage/metrics.md b/site/tasks/manage/metrics.md index da776cfd..5adfb9f5 100644 --- a/site/tasks/manage/metrics.md +++ b/site/tasks/manage/metrics.md @@ -34,7 +34,7 @@ exposed: When installed as a Kubernetes Addon, the router listens for metrics requests on 0.0.0.0:6782 and the Network Policy Controller listens on -0.0.0.0:6781. No other requests are served on these endpoints. +0.0.0.0:6781. No other requests are served on these endpoints. >Note: If your Kubernetes hosts are exposed to the public internet then these metrics endpoints will also be exposed. @@ -48,9 +48,8 @@ publish your metrics throughout your cluster, you can set Set it to an empty string to disable. -You can also add `--metrics-addr=X.X.X.X:PORT` to specify an address -to listen for metrics only. - +You can also pass the parameter `--metrics-addr=X.X.X.X:PORT` to +`weave launch` to specify an address to listen for metrics only. # Static Configuration for Weave Net