From 65b3894a8e8a0266715f48a9ab491517ff30ba1a Mon Sep 17 00:00:00 2001 From: Daniel Holbach Date: Fri, 2 Aug 2019 09:53:07 +0200 Subject: [PATCH 1/4] Answer how Weave Net works Actually Bryan answered it, when a reader of our website asked. Signed-off-by: Daniel Holbach --- site/overview.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/site/overview.md b/site/overview.md index 850a030e..fca94748 100644 --- a/site/overview.md +++ b/site/overview.md @@ -9,6 +9,9 @@ Weave Net creates a virtual network that connects Docker containers across multi Services provided by application containers on the weave network can be exposed to the outside world, regardless of where they are running. Similarly, existing internal systems can be opened to accept connections from application containers irrespective of their location. +### How does it work? + +Weave Net creates a new Layer 2 network using Linux kernel features; one daemon sets up that network and manages routing between machines and there are various ways to attach to that network (e.g. a CNI plugin which runs as a separate process). Also one more daemon if you are using Kubernetes Network Policy. ## Why Weave? From cc6d10c9b10a317aad293d51d370db174677529a Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Wed, 14 Aug 2019 13:59:41 +0000 Subject: [PATCH 2/4] Pin busybox version to 1.28 to avoid CI issues --- test/600_proxy_docker_py.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/test/600_proxy_docker_py.sh b/test/600_proxy_docker_py.sh index a849cfef..1f69d8b1 100755 --- a/test/600_proxy_docker_py.sh +++ b/test/600_proxy_docker_py.sh @@ -13,6 +13,9 @@ docker_py_test() { # Work round https://github.com/docker/docker-py/issues/852 docker_on $HOST1 pull busybox:buildroot-2014.02 >/dev/null + # Work round https://github.com/weaveworks/weave/issues/3680 - pin busybox version to 1.28 + docker_on $HOST1 pull busybox:1.28 >/dev/null + docker_on $HOST1 tag busybox:1.28 busybox:latest >/dev/null # Get a list of the tests for use to shard docker_on $HOST1 pull $IMAGE >/dev/null CANDIDATES=$(docker_on $HOST1 run \ From 9971fc3dacadae1a898a54da68ee69597381117c Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 29 Aug 2019 16:24:07 +0000 Subject: [PATCH 3/4] =?UTF-8?q?=C3=82Add=20a=20note=20about=20incompatibil?= =?UTF-8?q?ity=20with=20iptables=201.8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- site/kubernetes/kube-addon.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index e0b48597..08be3bf3 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -339,6 +339,8 @@ UDP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC. ### Things to watch out for +- Weave Net does not work on hosts running iptables 1.8 or above, only with 1.6. + Track this via issue [#3465](https://github.com/weaveworks/weave/issues/3465) - Don't turn on `--masquerade-all` on kube-proxy: this will change the source address of every pod-to-pod conversation which will make it impossible to correctly enforce network policies that restrict which From ee47f0c3eed8175f3fe1b3ef1c967a1856fddccc Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 30 Sep 2019 15:12:21 +0000 Subject: [PATCH 4/4] Use buffered chan to avoid losing docker events Docker imposes a limit that events have to be retrieved within 100ms or they are dropped on the sending side. Adding buffer space within the Weave Net process allows those events to be collected from Docker more quickly. 1024 is an arbitrary number, much higher than we expect to need. --- common/docker/client.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/common/docker/client.go b/common/docker/client.go index 381c887d..ddbe4aae 100644 --- a/common/docker/client.go +++ b/common/docker/client.go @@ -99,7 +99,9 @@ func (c *Client) AddObserver(ob ContainerObserver) error { pending := make(pendingStarts) retryInterval := InitialInterval for { - events := make(chan *docker.APIEvents) + // Use a buffered chan so the client library can run ahead of the listener + // - Docker will drop an event if it is not collected quickly enough. + events := make(chan *docker.APIEvents, 1024) if err := c.AddEventListener(events); err != nil { c.errorf("Unable to add listener to Docker API: %s - retrying in %ds", err, retryInterval/time.Second) } else {