From 257774a0936e12c61d192168bcb732e42d1ffedd Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Thu, 18 Jun 2015 14:40:00 +0100 Subject: [PATCH 1/3] make `weave attach|expose|detach|hide` show IP addresses The output contains one IP address for each addr (i.e. [ip:] | net: | net:default) supplied on the command line; or, if none was specified, a single address from the default IPAM subnet. We don't want `weave run` to output the addresses, since it is meant to (only) output the container id. Hence we redirect the `attach` output to stderr in that case. Closes #954. --- weave | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/weave b/weave index b36721b0..e73a4530 100755 --- a/weave +++ b/weave @@ -143,7 +143,7 @@ if [ "$1" = "run" ] ; then collect_cidr_args "$@" shift $CIDR_ARG_COUNT CONTAINER=$(docker $DOCKER_CLIENT_ARGS run $DNS_ARGS -d "$@") - exec_remote attach $CIDR_ARGS --or-die $CONTAINER + exec_remote attach $CIDR_ARGS --or-die $CONTAINER >/dev/null echo $CONTAINER exit 0 elif [ "$1" != "--local" ] ; then @@ -850,6 +850,14 @@ ipam_cidrs_or_die() { fi } +show_addrs() { + addrs= + for cidr in "$@" ; do + addrs="$addrs ${cidr%/*}" + done + echo $addrs +} + ###################################################################### # weave proxy helpers ###################################################################### @@ -1170,6 +1178,7 @@ case "$COMMAND" in ipam_cidrs$ATTACH_TYPE $CONTAINER $CIDR_ARGS with_container_netns$ATTACH_TYPE $CONTAINER attach $ALL_CIDRS >/dev/null when_dns_running with_container_fqdn $CONTAINER put_dns_fqdn $ALL_CIDRS + show_addrs $ALL_CIDRS ;; detach) collect_cidr_args "$@" @@ -1182,6 +1191,7 @@ case "$COMMAND" in for CIDR in $IPAM_CIDRS ; do call_weave DELETE /ip/$CONTAINER/${CIDR%/*} done + show_addrs $ALL_CIDRS ;; dns-add) collect_ip_args "$@" @@ -1229,6 +1239,7 @@ case "$COMMAND" in fi fi done + show_addrs $ALL_CIDRS ;; hide) collect_cidr_args "$@" @@ -1246,6 +1257,7 @@ case "$COMMAND" in for CIDR in $IPAM_CIDRS ; do call_weave DELETE /ip/weave:expose/${CIDR%/*} done + show_addrs $ALL_CIDRS ;; stop) [ $# -eq 0 ] || usage From ebf725d86902bb8ae0d799570945a6f31115f653 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Fri, 19 Jun 2015 10:19:33 +0100 Subject: [PATCH 2/3] add some tests --- test/500_weave_multi_cidr_test.sh | 35 ++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 10 deletions(-) diff --git a/test/500_weave_multi_cidr_test.sh b/test/500_weave_multi_cidr_test.sh index 21163f0d..0bbf6e5d 100755 --- a/test/500_weave_multi_cidr_test.sh +++ b/test/500_weave_multi_cidr_test.sh @@ -58,6 +58,13 @@ assert_bridge_cidrs() { assert "echo $BRIDGE_CIDRS" "$CIDRS" } +assert_equal() { + result=$1 + shift + expected="$@" + assert "echo $result" "$expected" +} + start_suite "Weave run/start/attach/detach/expose/hide with multiple cidr arguments" # also check that these commands understand all address flavours @@ -82,33 +89,41 @@ weave_on $HOST1 start 10.2.1.1/24 ip:10.2.2.1/24 net:10.2.3. assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24 10.2.2.1/24 10.2.3.1/24 # Remove two of them -weave_on $HOST1 detach ip:10.2.2.1/24 net:10.2.3.0/24 $CID +IPS=$(weave_on $HOST1 detach ip:10.2.2.1/24 net:10.2.3.0/24 $CID) +assert_equal "$IPS" 10.2.2.1 10.2.3.1 assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24 # ...and the remaining one -weave_on $HOST1 detach 10.2.1.1/24 $CID +IPS=$(weave_on $HOST1 detach 10.2.1.1/24 $CID) +assert_equal "$IPS" 10.2.1.1 assert_ips_and_dns $HOST1 $CID $NAME. # Put one back -weave_on $HOST1 attach 10.2.1.1/24 $CID +IPS=$(weave_on $HOST1 attach 10.2.1.1/24 $CID) +assert_equal "$IPS" 10.2.1.1 assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24 # ...and the remaining two -weave_on $HOST1 attach ip:10.2.2.1/24 net:10.2.3.0/24 $CID +IPS=$(weave_on $HOST1 attach ip:10.2.2.1/24 net:10.2.3.0/24 $CID) +assert_equal "$IPS" 10.2.2.1 10.2.3.1 assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24 10.2.2.1/24 10.2.3.1/24 # Expose three cidrs -weave_on $HOST1 expose 10.2.1.2/24 ip:10.2.2.2/24 net:10.2.3.0/24 +IPS=$(weave_on $HOST1 expose 10.2.1.2/24 ip:10.2.2.2/24 net:10.2.3.0/24) +assert_equal "$IPS" 10.2.1.2 10.2.2.2 10.2.3.2 assert_bridge_cidrs $HOST1 weave 10.2.1.2/24 10.2.2.2/24 10.2.3.2/24 # Hide two of them -weave_on $HOST1 hide ip:10.2.2.2/24 net:10.2.3.0/24 +IPS=$(weave_on $HOST1 hide ip:10.2.2.2/24 net:10.2.3.0/24) +assert_equal "$IPS" 10.2.2.2 10.2.3.2 assert_bridge_cidrs $HOST1 weave 10.2.1.2/24 # ...and the remaining one -weave_on $HOST1 hide 10.2.1.2/24 +IPS=$(weave_on $HOST1 hide 10.2.1.2/24) +assert_equal "$IPS" 10.2.1.2 assert_bridge_cidrs $HOST1 weave # Now detach and run another container to check we have released IPs in IPAM -weave_on $HOST1 detach $CID -CID2=$(start_container $HOST1 net:10.2.3.0/24) -assert_container_cidrs $HOST1 $CID2 10.2.3.1/24 +IPS=$(weave_on $HOST1 detach $CID) +assert_equal "$IPS" 10.2.3.1 +CID2=$(start_container $HOST1 net:10.2.3.0/24) +assert_container_cidrs $HOST1 $CID2 10.2.3.1/24 end_suite From 7cf0d590034ed90223bdb4aeb5d1a44dfca1faa4 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Mon, 22 Jun 2015 12:34:32 +0100 Subject: [PATCH 3/3] update docs --- site/features.md | 43 +++++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 18 deletions(-) diff --git a/site/features.md b/site/features.md index 0abcc392..fa1a5568 100644 --- a/site/features.md +++ b/site/features.md @@ -175,33 +175,44 @@ illustrate, we can achieve the same effect as the first example with host1$ C=$(docker run -e WEAVE_CIDR=none -dti ubuntu) host1$ weave attach $C + 10.2.1.3 (Note that since we modified `DOCKER_HOST` to point to the proxy earlier, we have to pass `-e WEAVE_CIDR=none` to start a container that _doesn't_ get automatically attached to the weave network for the purposes of this example.) +The output shows the IP address that got allocated, in this case on +the default subnet. + There is a matching `weave detach` command: host1$ weave detach $C + 10.2.1.3 You can detach a container from one application network and attach it to another: host1$ weave detach net:default $C + 10.2.1.3 host1$ weave attach net:10.2.2.0/24 $C + 10.2.2.3 or attach a container to multiple application networks, effectively sharing it between applications: host1$ weave attach net:default + 10.2.1.3 host1$ weave attach net:10.2.2.0/24 + 10.2.2.3 Finally, multiple addresses can be attached or detached with a single invocation: host1$ weave attach net:default net:10.2.2.0/24 net:10.2.3.0/24 $C + 10.2.1.3 10.2.2.3 10.2.3.1 host1$ weave detach net:default net:10.2.2.0/24 net:10.2.3.0/24 $C + 10.2.1.3 10.2.2.3 10.2.3.1 ### Security @@ -237,37 +248,36 @@ Let's say that in our example we want `$HOST2` to have access to the application containers. On `$HOST2` we run host2$ weave expose + 10.2.1.132 -(There is a corresponding 'hide' command to revert this step.) +This grants the host access to all application containers in the +default subnet. An IP address is allocated for that purpose, which is +returned. So now -Now, after finding allocated IPs via `weave ps` + host2$ ping 10.2.1.132 - host2$ weave ps weave:expose - weave:expose 02:80:5c:02:f1:b2 10.2.1.132/24 +will work, and, more interestingly, we can ping our `a1` application +container, which is residing on `$HOST1`, after finding its IP +address: host1$ weave ps a1 a1 1e:88:d7:5b:77:68 10.2.1.2/24 -this - - host2$ ping 10.2.1.132 - -will work. And, more interestingly, - host2$ ping 10.2.1.2 -will work too, which is talking to a container that resides on `$HOST1`. - Multiple subnet addresses can be exposed or hidden with a single invocation: host2$ weave expose net:default net:10.2.2.0/24 + 10.2.1.132 10.2.2.130 host2$ weave hide net:default net:10.2.2.0/24 + 10.2.1.132 10.2.2.130 Finally, exposed addresses can be added to weaveDNS by supplying a fully-qualified domain name: host2$ weave expose -h exposed.weave.local + 10.2.1.132 ### Service export @@ -283,6 +293,7 @@ First we need to expose the application network to `$HOST2`, as explained [above](#host-network-integration), i.e. host2$ weave expose + 10.2.1.132 Then we add a NAT rule to route from the outside world to the destination container service. @@ -326,13 +337,11 @@ explained [above](#host-network-integration), this time on `$HOST1`, i.e. host1$ weave expose -h host1.weave.local + 10.2.1.3 Then we add a NAT rule to route from the above IP to the destination service. - host1$ weave ps weave:expose - weave:expose 66:46:f5:ac:7b:c9 10.2.1.3/24 - host1$ iptables -t nat -A PREROUTING -p tcp -d 10.2.1.3 --dport 3322 \ -j DNAT --to-destination $HOST3:2211 @@ -376,14 +385,12 @@ weave via `$HOST1`. We can export it on `$HOST2` by first exposing the application network with host2$ weave expose + 10.2.1.3 and then adding a NAT rule which routes traffic from the `$HOST2` network (i.e. anything which can connect to `$HOST2`) to the service endpoint in the weave network - host1$ weave ps weave:expose - weave:expose 66:46:f5:ac:7b:c9 10.2.1.3/24 - host2$ iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 4433 \ -j DNAT --to-destination 10.2.1.3:3322