reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #968 from rade/954_show_attach_expose_addresses

Browse Source 
show IP addresses in attach/expose/detach/hide
This commit is contained in:
Adam Harrison committed 2015-06-22 14:49:41 +01:00
2 parents d1eb2917e8 7cf0d59003
commit bda245bfdb
3 files changed
+63 -29
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

site/features.md
+25 -18
View File
@@ -175,33 +175,44 @@ illustrate, we can achieve the same effect as the first example with
host1$ C=$(docker run -e WEAVE_CIDR=none -dti ubuntu)
host1$ weave attach $C
10.2.1.3
(Note that since we modified `DOCKER_HOST` to point to the proxy
earlier, we have to pass `-e WEAVE_CIDR=none` to start a container
that _doesn't_ get automatically attached to the weave network for the
purposes of this example.)
The output shows the IP address that got allocated, in this case on
the default subnet.
There is a matching `weave detach` command:
host1$ weave detach $C
10.2.1.3
You can detach a container from one application network and attach it
to another:
host1$ weave detach net:default $C
10.2.1.3
host1$ weave attach net:10.2.2.0/24 $C
10.2.2.3
or attach a container to multiple application networks, effectively
sharing it between applications:
host1$ weave attach net:default
10.2.1.3
host1$ weave attach net:10.2.2.0/24
10.2.2.3
Finally, multiple addresses can be attached or detached with a single
invocation:
host1$ weave attach net:default net:10.2.2.0/24 net:10.2.3.0/24 $C
10.2.1.3 10.2.2.3 10.2.3.1
host1$ weave detach net:default net:10.2.2.0/24 net:10.2.3.0/24 $C
10.2.1.3 10.2.2.3 10.2.3.1
### <a name="security"></a>Security
@@ -237,37 +248,36 @@ Let's say that in our example we want `$HOST2` to have access to the
application containers. On `$HOST2` we run
host2$ weave expose
10.2.1.132
(There is a corresponding 'hide' command to revert this step.)
This grants the host access to all application containers in the
default subnet. An IP address is allocated for that purpose, which is
returned. So now
Now, after finding allocated IPs via `weave ps`
host2$ ping 10.2.1.132
host2$ weave ps weave:expose
weave:expose 02:80:5c:02:f1:b2 10.2.1.132/24
will work, and, more interestingly, we can ping our `a1` application
container, which is residing on `$HOST1`, after finding its IP
address:
host1$ weave ps a1
a1 1e:88:d7:5b:77:68 10.2.1.2/24
this
host2$ ping 10.2.1.132
will work. And, more interestingly,
host2$ ping 10.2.1.2
will work too, which is talking to a container that resides on `$HOST1`.
Multiple subnet addresses can be exposed or hidden with a single
invocation:
host2$ weave expose net:default net:10.2.2.0/24
10.2.1.132 10.2.2.130
host2$ weave hide net:default net:10.2.2.0/24
10.2.1.132 10.2.2.130
Finally, exposed addresses can be added to weaveDNS by supplying a
fully-qualified domain name:
host2$ weave expose -h exposed.weave.local
10.2.1.132
### <a name="service-export"></a>Service export
@@ -283,6 +293,7 @@ First we need to expose the application network to `$HOST2`, as
explained [above](#host-network-integration), i.e.
host2$ weave expose
10.2.1.132
Then we add a NAT rule to route from the outside world to the
destination container service.
@@ -326,13 +337,11 @@ explained [above](#host-network-integration), this time on `$HOST1`,
i.e.
host1$ weave expose -h host1.weave.local
10.2.1.3
Then we add a NAT rule to route from the above IP to the destination
service.
host1$ weave ps weave:expose
weave:expose 66:46:f5:ac:7b:c9 10.2.1.3/24
host1$ iptables -t nat -A PREROUTING -p tcp -d 10.2.1.3 --dport 3322 \
-j DNAT --to-destination $HOST3:2211
@@ -376,14 +385,12 @@ weave via `$HOST1`. We can export it on `$HOST2` by first exposing the
application network with
host2$ weave expose
10.2.1.3
and then adding a NAT rule which routes traffic from the `$HOST2`
network (i.e. anything which can connect to `$HOST2`) to the service
endpoint in the weave network
host1$ weave ps weave:expose
weave:expose 66:46:f5:ac:7b:c9 10.2.1.3/24
host2$ iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 4433 \
-j DNAT --to-destination 10.2.1.3:3322
test/500_weave_multi_cidr_test.sh
+25 -10
View File
@@ -58,6 +58,13 @@ assert_bridge_cidrs() {
assert "echo $BRIDGE_CIDRS" "$CIDRS"
}
assert_equal() {
result=$1
shift
expected="$@"
assert "echo $result" "$expected"
}
start_suite "Weave run/start/attach/detach/expose/hide with multiple cidr arguments"
# also check that these commands understand all address flavours
@@ -82,33 +89,41 @@ weave_on $HOST1 start 10.2.1.1/24 ip:10.2.2.1/24 net:10.2.3.
assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24 10.2.2.1/24 10.2.3.1/24
# Remove two of them
weave_on $HOST1 detach ip:10.2.2.1/24 net:10.2.3.0/24 $CID
IPS=$(weave_on $HOST1 detach ip:10.2.2.1/24 net:10.2.3.0/24 $CID)
assert_equal "$IPS" 10.2.2.1 10.2.3.1
assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24
# ...and the remaining one
weave_on $HOST1 detach 10.2.1.1/24 $CID
IPS=$(weave_on $HOST1 detach 10.2.1.1/24 $CID)
assert_equal "$IPS" 10.2.1.1
assert_ips_and_dns $HOST1 $CID $NAME.
# Put one back
weave_on $HOST1 attach 10.2.1.1/24 $CID
IPS=$(weave_on $HOST1 attach 10.2.1.1/24 $CID)
assert_equal "$IPS" 10.2.1.1
assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24
# ...and the remaining two
weave_on $HOST1 attach ip:10.2.2.1/24 net:10.2.3.0/24 $CID
IPS=$(weave_on $HOST1 attach ip:10.2.2.1/24 net:10.2.3.0/24 $CID)
assert_equal "$IPS" 10.2.2.1 10.2.3.1
assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24 10.2.2.1/24 10.2.3.1/24
# Expose three cidrs
weave_on $HOST1 expose 10.2.1.2/24 ip:10.2.2.2/24 net:10.2.3.0/24
IPS=$(weave_on $HOST1 expose 10.2.1.2/24 ip:10.2.2.2/24 net:10.2.3.0/24)
assert_equal "$IPS" 10.2.1.2 10.2.2.2 10.2.3.2
assert_bridge_cidrs $HOST1 weave 10.2.1.2/24 10.2.2.2/24 10.2.3.2/24
# Hide two of them
weave_on $HOST1 hide ip:10.2.2.2/24 net:10.2.3.0/24
IPS=$(weave_on $HOST1 hide ip:10.2.2.2/24 net:10.2.3.0/24)
assert_equal "$IPS" 10.2.2.2 10.2.3.2
assert_bridge_cidrs $HOST1 weave 10.2.1.2/24
# ...and the remaining one
weave_on $HOST1 hide 10.2.1.2/24
IPS=$(weave_on $HOST1 hide 10.2.1.2/24)
assert_equal "$IPS" 10.2.1.2
assert_bridge_cidrs $HOST1 weave
# Now detach and run another container to check we have released IPs in IPAM
weave_on $HOST1 detach $CID
CID2=$(start_container $HOST1 net:10.2.3.0/24)
assert_container_cidrs $HOST1 $CID2 10.2.3.1/24
IPS=$(weave_on $HOST1 detach $CID)
assert_equal "$IPS" 10.2.3.1
CID2=$(start_container $HOST1 net:10.2.3.0/24)
assert_container_cidrs $HOST1 $CID2 10.2.3.1/24
end_suite
weave
+13 -1
View File
@@ -143,7 +143,7 @@ if [ "$1" = "run" ] ; then
collect_cidr_args "$@"
shift $CIDR_ARG_COUNT
CONTAINER=$(docker $DOCKER_CLIENT_ARGS run $DNS_ARGS -d "$@")
exec_remote attach $CIDR_ARGS --or-die $CONTAINER
exec_remote attach $CIDR_ARGS --or-die $CONTAINER >/dev/null
echo $CONTAINER
exit 0
elif [ "$1" != "--local" ] ; then
@@ -850,6 +850,14 @@ ipam_cidrs_or_die() {
fi
}
show_addrs() {
addrs=
for cidr in "$@" ; do
addrs="$addrs ${cidr%/*}"
done
echo $addrs
}
######################################################################
# weave proxy helpers
######################################################################
@@ -1170,6 +1178,7 @@ case "$COMMAND" in
ipam_cidrs$ATTACH_TYPE $CONTAINER $CIDR_ARGS
with_container_netns$ATTACH_TYPE $CONTAINER attach $ALL_CIDRS >/dev/null
when_dns_running with_container_fqdn $CONTAINER put_dns_fqdn $ALL_CIDRS
show_addrs $ALL_CIDRS
;;
detach)
collect_cidr_args "$@"
@@ -1182,6 +1191,7 @@ case "$COMMAND" in
for CIDR in $IPAM_CIDRS ; do
call_weave DELETE /ip/$CONTAINER/${CIDR%/*}
done
show_addrs $ALL_CIDRS
;;
dns-add)
collect_ip_args "$@"
@@ -1229,6 +1239,7 @@ case "$COMMAND" in
fi
fi
done
show_addrs $ALL_CIDRS
;;
hide)
collect_cidr_args "$@"
@@ -1246,6 +1257,7 @@ case "$COMMAND" in
for CIDR in $IPAM_CIDRS ; do
call_weave DELETE /ip/weave:expose/${CIDR%/*}
done
show_addrs $ALL_CIDRS
;;
stop)
[ $# -eq 0 ] || usage