diff --git a/CHANGELOG.md b/CHANGELOG.md index ec1afb9a..fd6539fe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +## Release 2.0.4 + +Bug fixes + +* weave-npc failed on Centos 7, due to older 'ipset' version in kernel #3099,#3100 + +[Full list of changes](https://github.com/weaveworks/weave/milestone/62?closed=1). + + ## Release 2.0.3 Bug fixes diff --git a/npc/ipset/ipset.go b/npc/ipset/ipset.go index 965d278e..e1d0d6f7 100644 --- a/npc/ipset/ipset.go +++ b/npc/ipset/ipset.go @@ -33,14 +33,33 @@ type Interface interface { type ipset struct { refCount *log.Logger + enableComments bool } func New(logger *log.Logger) Interface { - return &ipset{refCount: newRefCount(), Logger: logger} + ips := &ipset{refCount: newRefCount(), Logger: logger, enableComments: true} + + // Check for comment support + testIpsetName := Name("weave-test-comment") + // Clear it out if it already exists + _ = ips.Destroy(testIpsetName) + // Test for comment support + if err := ips.Create(testIpsetName, HashIP); err != nil { + ips.Logger.Printf("failed to create %s; disabling comment support", testIpsetName) + ips.enableComments = false + } + // If it was created, destroy it + _ = ips.Destroy(testIpsetName) + + return ips } func (i *ipset) Create(ipsetName Name, ipsetType Type) error { - return doExec("create", string(ipsetName), string(ipsetType), "comment") + args := []string{"create", string(ipsetName), string(ipsetType)} + if i.enableComments { + args = append(args, "comment") + } + return doExec(args...) } func (i *ipset) AddEntry(ipsetName Name, entry string, comment string) error { @@ -48,7 +67,11 @@ func (i *ipset) AddEntry(ipsetName Name, entry string, comment string) error { if i.inc(ipsetName, entry) > 1 { // already in the set return nil } - return doExec("add", string(ipsetName), entry, "comment", comment) + args := []string{"add", string(ipsetName), entry} + if i.enableComments { + args = append(args, "comment", comment) + } + return doExec(args...) } func (i *ipset) DelEntry(ipsetName Name, entry string) error { diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index fedfe39a..d8b2badc 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -12,8 +12,9 @@ The following topics are discussed: * [CPU and Memory Requirements](#resources) * [Pod Eviction](#eviction) * [Network Policy Controller](#npc) +* [Troubleshooting](#troubleshooting) * [Troubleshooting Blocked Connections](#blocked-connections) - * [Changing Configuration Options](#configuration-options) +* [Changing Configuration Options](#configuration-options) ## Installation @@ -83,8 +84,8 @@ and so you will need to perform the procedure manually: * Apply the updated addon manifest `kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"` * Kill each Weave Net pod with `kubectl delete` and then wait for it to reboot before moving on to the next pod. -**Note:** If you delete all Weave Net pods at the same time they will - lose track of IP address range ownership, possibly leading to +**Note:** In versions prior to Weave Net 2.0, deleting all Weave Net pods at the same time + will result in them losing track of IP address range ownership, possibly leading to duplicate IP addresses if you then start a new copy of Weave Net. ## CPU and Memory Requirements @@ -163,6 +164,80 @@ definition](http://kubernetes.io/docs/api-reference/extensions/v1beta1/definitio all multicast traffic) by adding `--allow-mcast=false` as an argument to `weave-npc` in the YAML configuration. +## Troubleshooting + +The status of Weave Net can be checked by running its CLI commands. This can be done in various ways: + +1\. [Install the `weave` script](/site/installing-weave.md) and run: + +``` +$ weave status + Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29) + + Service: router + Protocol: weave 1..2 + Name: 42:8e:e8:c4:52:1b(host-0) + Encryption: disabled + PeerDiscovery: enabled + Targets: 3 + Connections: 3 (2 established, 1 failed) + Peers: 3 (with 6 established connections) + TrustedSubnets: none + + Service: ipam + Status: ready + Range: 10.32.0.0/12 + DefaultSubnet: 10.32.0.0/12 +``` + +2\. If you don't want to install additional software onto your hosts, run via `kubectl` commands, which produce the exact same outcome as the previous example: + +``` +### Identify the Weave Net pods: + +$ kubectl get pods -n kube-system -l name=weave-net -o wide +NAME READY STATUS RESTARTS AGE IP NODE +weave-net-1jkl6 2/2 Running 0 1d 10.128.0.4 host-0 +weave-net-bskbv 2/2 Running 0 1d 10.128.0.5 host-1 +weave-net-m4x1b 2/2 Running 0 1d 10.128.0.6 host-2 +``` + +The above shows all Weave Net pods available in your cluster. +You can see Kubernetes has deployed one Weave Net pod per host, in order to interconnect all hosts. + +You then need to: + - choose which pod you want to run your command from (in most cases it doesn't matter + which one you pick so just pick the first one, e.g. pod `weave-net-1jkl6` here) + - use `kubectl exec` to run the `weave status` command + - specify the absolute path `/home/weave/weave` and add `--local` because it's running inside a container + +``` +$ kubectl exec -n kube-system weave-net-1jkl6 -c weave -- /home/weave/weave --local status + + Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29) + + Service: router + Protocol: weave 1..2 + Name: 42:8e:e8:c4:52:1b(host-0) + Encryption: disabled + PeerDiscovery: enabled + Targets: 3 + Connections: 3 (2 established, 1 failed) + Peers: 3 (with 6 established connections) + TrustedSubnets: none + + Service: ipam + Status: ready + Range: 10.32.0.0/12 + DefaultSubnet: 10.32.0.0/12 +``` + +3\. Finally you could also use [Weave Cloud](https://cloud.weave.works/) and monitor all your pods, including Weave Net's ones, from there. + +![Weave Net status screen in Weave Cloud](weave-cloud-net-status.png) + +For more information see [What is Weave Cloud?](https://www.weave.works/faq/weave-cloud-faq/) + ### Troubleshooting Blocked Connections If you suspect that legitimate traffic is being blocked by the Weave Network Policy Controller, the first thing to do is check the `weave-npc` container's logs. @@ -195,7 +270,7 @@ TCP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC. UDP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC. ``` -### Changing Configuration Options +## Changing Configuration Options #### Using `cloud.weave.works` @@ -277,72 +352,3 @@ For example, - name: IPALLOC_RANGE value: 10.0.0.0/16 ``` - -## Operations - -When using the Kubernetes addon, Weave Net's peers are managed via Kubernetes and very little effort should be required from your end to operate your network. - -However, should you need it, you can still run `weave` CLI commands to, for example, confirm Weave Net' status. This can be done in various ways: - -1. You could [install the `weave` script](/site/installing-weave.md) and run the same commands you would run without Kubernetes: - -``` -$ weave status - Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29) - - Service: router - Protocol: weave 1..2 - Name: 42:8e:e8:c4:52:1b(host-0) - Encryption: disabled - PeerDiscovery: enabled - Targets: 3 - Connections: 3 (2 established, 1 failed) - Peers: 3 (with 6 established connections) - TrustedSubnets: none - - Service: ipam - Status: ready - Range: 10.32.0.0/12 - DefaultSubnet: 10.32.0.0/12 -``` - -2. If you do not want to install anything else on your hosts, you can use the following `kubectl` commands, which will produce the exact same outcome as the previous example: - -``` -### Identify the Weave Net pods: - -$ kubectl get pods --all-namespaces -o wide | grep weave -kube-system weave-net-1jkl6 2/2 Running 0 1d 10.128.0.4 host-0 -kube-system weave-net-bskbv 2/2 Running 0 1d 10.128.0.5 host-1 -kube-system weave-net-m4x1b 2/2 Running 0 1d 10.128.0.6 host-2 - -### The above shows all Weave Net pods available in your cluster. -### You can see Kubernetes has deployed one Weave Net pod per host, in order to interconnect all hosts. - -### You then need to: -### - choose which pod you want to run your command from (e.g.: here, pod weave-net-1jkl6, running on host-0), and -### - make sure you pass --local to weave, in addition to your command: - -$ kubectl exec -n kube-system weave-net-1jkl6 -- /home/weave/weave --local status -Defaulting container name to weave. -Use 'kubectl describe pod/weave-net-1jkl6' to see all of the containers in this pod. - - Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29) - - Service: router - Protocol: weave 1..2 - Name: 42:8e:e8:c4:52:1b(host-0) - Encryption: disabled - PeerDiscovery: enabled - Targets: 3 - Connections: 3 (2 established, 1 failed) - Peers: 3 (with 6 established connections) - TrustedSubnets: none - - Service: ipam - Status: ready - Range: 10.32.0.0/12 - DefaultSubnet: 10.32.0.0/12 -``` - -3. Finally you could also use [Weave Cloud](https://cloud.weave.works/) and monitor all your pods, including Weave Net's ones, from there. diff --git a/site/kubernetes/weave-cloud-net-status.png b/site/kubernetes/weave-cloud-net-status.png new file mode 100644 index 00000000..b0a7b6e3 Binary files /dev/null and b/site/kubernetes/weave-cloud-net-status.png differ