Document trusted subnets
Update features and troubleshooting markdown.
This commit is contained in:
Adam Harrison committed
1 parent
e0cb9cf24d
commit
b9792f8f96
2 files changed
+40
-28
No files matched your search
+13
-5
@@ -63,7 +63,9 @@ Weave automatically chooses the fastest available method to transport
|
||||
data between peers. The most performant of these ('fastdp') offers
|
||||
near-native throughput and latency but does not support encryption;
|
||||
consequently supplying a password will cause the router to fall back
|
||||
to a slower mode ('sleeve') that does.
|
||||
to a slower mode ('sleeve') that does, for connections that traverse
|
||||
untrusted networks (see the [security](#security) section for more
|
||||
details).
|
||||
|
||||
Even when encryption is not in use, certain adverse network conditions
|
||||
will cause this fallback to occur dynamically; in these circumstances,
|
||||
@@ -321,10 +323,16 @@ way to generate a random password which satsifies this requirement is
|
||||
|
||||
< /dev/urandom tr -dc A-Za-z0-9 | head -c9 ; echo
|
||||
|
||||
The same password must be specified for all weave peers. Note that
|
||||
supplying a password will [cause weave to fall back to a slower
|
||||
method](#fast-data-path) for transporting data between
|
||||
peers.
|
||||
The same password must be specified for all weave peers; by default
|
||||
both control and data plane traffic will then use authenticated
|
||||
encryption. If some of your peers are colocated in a trusted network
|
||||
(for example within the boundary of your own datacentre) you can use
|
||||
the `--trusted-subnets` argument to `weave launch` to selectively
|
||||
disable data plane encryption as an optimisation. Both peers must
|
||||
consider the other to be in a trusted subnet for this to take place -
|
||||
if they do not, weave will [fall back to a slower
|
||||
method](#fast-data-path) for transporting data between peers as fast
|
||||
datapath does not support encryption.
|
||||
|
||||
Be aware that:
|
||||
|
||||
|
||||
+27
-23
@@ -68,29 +68,30 @@ A status summary can be obtained with `weave status`:
|
||||
````
|
||||
$ weave status
|
||||
|
||||
Version: 1.1.0
|
||||
Version: 1.1.0
|
||||
|
||||
Service: router
|
||||
Protocol: weave 1..2
|
||||
Name: 4a:0f:f6:ec:1c:93(host1)
|
||||
Encryption: disabled
|
||||
PeerDiscovery: enabled
|
||||
Targets: [192.168.48.14 192.168.48.15]
|
||||
Connections: 5 (1 established, 1 pending, 1 retrying, 1 failed, 1 connecting)
|
||||
Peers: 3 (with 5 established, 1 pending connections)
|
||||
Service: router
|
||||
Protocol: weave 1..2
|
||||
Name: 4a:0f:f6:ec:1c:93(host1)
|
||||
Encryption: disabled
|
||||
PeerDiscovery: enabled
|
||||
Targets: [192.168.48.14 192.168.48.15]
|
||||
Connections: 5 (1 established, 1 pending, 1 retrying, 1 failed, 1 connecting)
|
||||
Peers: 3 (with 5 established, 1 pending connections)
|
||||
TrustedSubnets: none
|
||||
|
||||
Service: ipam
|
||||
Consensus: achieved
|
||||
Range: 10.32.0.0-10.47.255.255
|
||||
DefaultSubnet: 10.32.0.0/12
|
||||
Service: ipam
|
||||
Consensus: achieved
|
||||
Range: 10.32.0.0-10.47.255.255
|
||||
DefaultSubnet: 10.32.0.0/12
|
||||
|
||||
Service: dns
|
||||
Domain: weave.local.
|
||||
TTL: 1
|
||||
Entries: 9
|
||||
Service: dns
|
||||
Domain: weave.local.
|
||||
TTL: 1
|
||||
Entries: 9
|
||||
|
||||
Service: proxy
|
||||
Address: tcp://127.0.0.1:12375
|
||||
Service: proxy
|
||||
Address: tcp://127.0.0.1:12375
|
||||
|
||||
````
|
||||
|
||||
@@ -129,6 +130,9 @@ state. Further details are available with
|
||||
number of connections peers have to other peers. Further details are
|
||||
available with [`weave status peers`](#weave-status-peers).
|
||||
|
||||
'TrustedSubnets' shows subnets which the router trusts as specified by
|
||||
the `--trusted-subnets` option to `weave launch`.
|
||||
|
||||
There are further sections for the [IP address
|
||||
allocator](ipam.html#troubleshooting),
|
||||
[weaveDNS](weavedns.html#troubleshooting), and [Weave Docker API
|
||||
@@ -141,8 +145,8 @@ obtained with `weave status connections`:
|
||||
|
||||
````
|
||||
$ weave status connections
|
||||
<- 192.168.48.12:33866 established fastdp 7e:21:4a:70:2f:45(host2)
|
||||
<- 192.168.48.13:60773 pending fastdp 7e:ae:cd:d5:23:8d(host3)
|
||||
<- 192.168.48.12:33866 established unencrypted fastdp 7e:21:4a:70:2f:45(host2)
|
||||
<- 192.168.48.13:60773 pending encrypted fastdp 7e:ae:cd:d5:23:8d(host3)
|
||||
-> 192.168.48.14:6783 retrying dial tcp4 192.168.48.14:6783: no route to host
|
||||
-> 192.168.48.15:6783 failed dial tcp4 192.168.48.15:6783: no route to host, retry: 2015-08-06 18:55:38.246910357 +0000 UTC
|
||||
-> 192.168.48.16:6783 connecting
|
||||
@@ -162,8 +166,8 @@ The columns are as follows:
|
||||
heartbeat
|
||||
* `established` - TCP connection and corresponding UDP path are up
|
||||
* Info - the failure reason for failed and retrying connections, or
|
||||
the data transport method, remote peer name and nickname for
|
||||
pending and established connections
|
||||
the encryption mode, data transport method, remote peer name and
|
||||
nickname for pending and established connections
|
||||
|
||||
### <a name="weave-status-peers"></a>List peers
|
||||
|
||||
|
||||
Reference in new issue
Block a user