From a450d2e741d89ae9de85c50548d9a22f23c9d441 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Wed, 17 Jan 2018 17:32:57 +0100 Subject: [PATCH 1/5] Bump CI k8s vsn to 1.9.2 --- DEPENDENCIES | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/DEPENDENCIES b/DEPENDENCIES index 19d08d1c..67353fe8 100644 --- a/DEPENDENCIES +++ b/DEPENDENCIES @@ -1,3 +1,3 @@ DOCKER_VERSION=17.06 -KUBERNETES_VERSION=1.7.8 -KUBERNETES_CNI_VERSION=0.5.1 +KUBERNETES_VERSION=1.9.2 +KUBERNETES_CNI_VERSION=0.6.0 From 180d5542057ea5013a8c6dc0f598355cc3ab2437 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Sat, 20 Jan 2018 14:53:45 +0100 Subject: [PATCH 2/5] Do not pin k8s vsn in 840 smoke test --- test/840_weave_kube_3_test.sh | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index 89f65a47..e8c6a238 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -29,9 +29,7 @@ docker_on $HOST1 run --rm --privileged --net=host --entrypoint=/usr/sbin/ipset w docker_on $HOST1 run --rm --privileged --net=host --entrypoint=/usr/sbin/ipset weaveworks/weave-npc add test_840_ipset 192.168.1.11 # kubeadm init upgrades to latest Kubernetes version by default, therefore we try to lock the version using the below option: -#k8s_version="$(run_on $HOST1 "kubelet --version" | grep -oP "(?<=Kubernetes )v[\d\.\-beta]+")" -# Hack! Override version here as installation via package is broken http://github.com/kubernetes/kubernetes/issues/57334 -k8s_version="v1.8.5" +k8s_version="$(run_on $HOST1 "kubelet --version" | grep -oP "(?<=Kubernetes )v[\d\.\-beta]+")" k8s_version_option="$([[ "$k8s_version" > "v1.6" ]] && echo "kubernetes-version" || echo "use-kubernetes-version")" for host in $HOSTS; do From c46e3e8cf73e81e400f2f14847a047a012c47c95 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Sat, 20 Jan 2018 15:14:31 +0100 Subject: [PATCH 3/5] Skip CA verification in k8s smoke tests --- test/840_weave_kube_3_test.sh | 2 +- test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index e8c6a238..adbc9d4c 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -36,7 +36,7 @@ for host in $HOSTS; do if [ $host = $HOST1 ] ; then run_on $host "sudo systemctl start kubelet && sudo kubeadm init --$k8s_version_option=$k8s_version --token=$TOKEN --pod-network-cidr=$WEAVE_NETWORK" else - run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN $HOST1IP:$KUBE_PORT" + run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN --discovery-token-unsafe-skip-ca-verification $HOST1IP:$KUBE_PORT" fi done diff --git a/test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh b/test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh index 19d22592..ea7ba401 100755 --- a/test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh +++ b/test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh @@ -44,7 +44,7 @@ function setup_kubernetes_cluster { if [ $host = $HOST1 ] ; then run_on $host "sudo systemctl start kubelet && sudo kubeadm init --$k8s_version_option=$k8s_version --token=$TOKEN" else - run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN $HOST1IP:$KUBE_PORT" + run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN --discovery-token-unsafe-skip-ca-verification $HOST1IP:$KUBE_PORT" fi done From 7bc089f5c5189a4a14e1cd6e812eab83b9f9fe3b Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Mon, 29 Jan 2018 15:56:15 +0100 Subject: [PATCH 4/5] Add iproute2 scope info to assertions The latest alpine linux changed iproute2 of busybox which now includes scope info. --- test/195_no_multicast_route_1_test.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/195_no_multicast_route_1_test.sh b/test/195_no_multicast_route_1_test.sh index b4c1288c..45996920 100755 --- a/test/195_no_multicast_route_1_test.sh +++ b/test/195_no_multicast_route_1_test.sh @@ -21,7 +21,7 @@ start_container_local_plugin $HOST1 --name=c3 assert "show_multicast_route_on $HOST1 c1" assert "show_multicast_route_on $HOST1 c2" -assert "show_multicast_route_on $HOST1 c3" "224.0.0.0/4 dev ethwe0 " +assert "show_multicast_route_on $HOST1 c3" "224.0.0.0/4 dev ethwe0 scope link " # Now try via docker network options # using ssh rather than docker -H because CircleCI docker client is older @@ -30,7 +30,7 @@ $SSH $HOST1 docker run --net=testmcastfalse --name c4 -di $SMALL_IMAGE /bin/sh assert "show_multicast_route_on $HOST1 c4" $SSH $HOST1 docker network create --driver weavemesh --ipam-driver weavemesh --opt works.weave.multicast testmcasttrue $SSH $HOST1 docker run --net=testmcasttrue --name c5 -di $SMALL_IMAGE /bin/sh -assert "show_multicast_route_on $HOST1 c5" "224.0.0.0/4 dev ethwe0 " +assert "show_multicast_route_on $HOST1 c5" "224.0.0.0/4 dev ethwe0 scope link " # Ensure current proxy options are obeyed on container start docker_on $HOST1 stop -t 1 c2 @@ -39,7 +39,7 @@ weave_on $HOST1 launch proxy docker_on $HOST1 start c2 -assert "show_multicast_route_on $HOST1 c2" "224.0.0.0/4 dev ethwe " +assert "show_multicast_route_on $HOST1 c2" "224.0.0.0/4 dev ethwe scope link " docker_on $HOST1 rm -f c3 c4 c5 $SSH $HOST1 docker network rm testmcasttrue testmcastfalse From 42617776133b60b0c3484c0781d1f021ad37779f Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Mon, 29 Jan 2018 16:03:43 +0100 Subject: [PATCH 5/5] Remove "-j KUBESERVICES" during teardown in 840 smoke test Remove the rule to ensure that api-server is not accessible while kube-proxy is not ready. Otherwise, we have a race between "-j KUBE-FORWARD" and "-j WEAVE-NPC" which makes the NodePort isolation test case to fail. --- test/840_weave_kube_3_test.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index adbc9d4c..48d57d56 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -5,6 +5,10 @@ tear_down_kubeadm() { for host in $HOSTS; do run_on $host "sudo kubeadm reset && sudo rm -r -f /opt/cni/bin/*weave*" + # Remove the rule to ensure that api-server is not accessible while kube-proxy + # is not ready. Otherwise, we have a race between "-j KUBE-FORWARD" and "-j WEAVE-NPC" + # which makes the NodePort isolation test case to fail. + run_on $host "sudo iptables -t nat -D PREROUTING -m comment --comment \"kubernetes service portals\" -j KUBE-SERVICES" || true done }