From 0205adcedb596312a68eb796e0ecd57e42b5bf75 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Wed, 22 Nov 2017 11:17:50 +0000 Subject: [PATCH 1/3] Trim the JSON logged for Kubernetes objects by weave-npc Remove things like "args" and "env" which bulk the logs, aren't relevant to the function of weave-npc, and may include sensitive information. Use a black-list rather than a white-list because we can't be sure what information will be necessary in future. --- npc/json.go | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/npc/json.go b/npc/json.go index fd975554..c5946718 100644 --- a/npc/json.go +++ b/npc/json.go @@ -4,7 +4,56 @@ import ( "encoding/json" ) +// Return JSON suitable for logging an API object. func js(v interface{}) string { + // Get the raw JSON a, _ := json.Marshal(v) + // Convert this back into a tree of key-value maps + var m map[string]interface{} + if err := json.Unmarshal(a, &m); err != nil { + // If that didn't work, just return the raw version + return string(a) + } + // Trim some bulk, and potentially sensitive areas + withMap(m["metadata"], func(status map[string]interface{}) { + delete(status, "ownerReferences") + }) + withMap(m["spec"], func(spec map[string]interface{}) { + delete(spec, "tolerations") + delete(spec, "volumes") + rangeSlice(spec["containers"], func(container map[string]interface{}) { + delete(container, "args") + delete(container, "command") + delete(container, "env") + delete(container, "livenessProbe") + delete(container, "resources") + delete(container, "securityContext") + delete(container, "volumeMounts") + }) + }) + withMap(m["status"], func(status map[string]interface{}) { + delete(status, "containerStatuses") + }) + // Now marshall what's left to JSON + a, _ = json.Marshal(m) return string(a) } + +// Helper function: operate on a map node from a tree of key-value maps +func withMap(m interface{}, f func(map[string]interface{})) { + if v, ok := m.(map[string]interface{}); ok { + f(v) + } +} + +// Helper function: operate on all nodes under i which is a slice in a +// tree of key-value maps +func rangeSlice(i interface{}, f func(map[string]interface{})) { + if s, ok := i.([]interface{}); ok { + for _, v := range s { + if m, ok := v.(map[string]interface{}); ok { + f(m) + } + } + } +} From b373a069e984ab7fb0934de974a2a5701cebeda0 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Sat, 6 Jan 2018 14:48:20 +0100 Subject: [PATCH 2/3] Fix link to k8s legacy netpol docs --- site/kubernetes/kube-addon.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 917f443a..181ca32a 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -299,7 +299,7 @@ You can customise the YAML you get from `cloud.weave.works` by passing some of W - `disable-npc`: boolean (`true|false`). Default: `false`. - `env.NAME=VALUE`: add environment variable `NAME` and set it to `VALUE`. - `seLinuxOptions.NAME=VALUE`: add SELinux option `NAME` and set it to `VALUE`, e.g. `seLinuxOptions.type=spc_t` - - `use-legacy-netpol`: use [legacy NetworkPolicy semantics](https://v1-7.docs.kubernetes.io/docs/api-reference/v1.7/#networkpolicy-v1-networking), boolean (`true|false`). Default: `true` for Kubernetes version <= 1.6, `false` for > 1.6. + - `use-legacy-netpol`: use [legacy NetworkPolicy semantics](https://v1-6.docs.kubernetes.io/docs/api-reference/v1.6/#networkpolicy-v1beta1-extensions), boolean (`true|false`). Default: `true` for Kubernetes version <= 1.6, `false` for > 1.6. The list of variables you can set is: From d6ae1f8375db52ecf77e000e0d06694ab3ccae0d Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 12 Jan 2018 09:48:30 +0000 Subject: [PATCH 3/3] Add CONN_LIMIT to kube-addon docs --- site/kubernetes/kube-addon.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index f73b394c..e0054105 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -329,6 +329,8 @@ The list of variables you can set is: * `CHECKPOINT_DISABLE` - if set to 1, disable checking for new Weave Net versions (default is blank, i.e. check is enabled) +* `CONN_LIMIT` - soft limit on the number of connections between + peers. Defaults to 30. * `HAIRPIN_MODE` - Weave Net defaults to enabling hairpin on the bridge side of the `veth` pair for containers attached. If you need to disable hairpin, e.g. your kernel is one of those that can panic if hairpin is enabled, then you can disable it