diff --git a/bin/release b/bin/release index 41c8bbec..b1b4e5bc 100755 --- a/bin/release +++ b/bin/release @@ -91,6 +91,7 @@ build() { sed -i.bak "/SCRIPT_VERSION=/ c\SCRIPT_VERSION=\"$VERSION\"" ./weave sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset.yaml sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.6.yaml + sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.7.yaml make SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER if make tests; then @@ -173,6 +174,13 @@ draft() { --name "weave-daemonset-k8s-1.6.yaml" \ --file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml" + github-release upload \ + --user $GITHUB_USER \ + --repo weave \ + --tag $LATEST_TAG \ + --name "weave-daemonset-k8s-1.7.yaml" \ + --file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml" + echo "** Draft $TYPE $RELEASE_NAME $VERSION created at" echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG" } @@ -274,6 +282,13 @@ publish() { --name "weave-daemonset-k8s-1.6.yaml" \ --file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml" + github-release upload \ + --user $GITHUB_USER \ + --repo weave \ + --tag latest_release \ + --name "weave-daemonset-k8s-1.7.yaml" \ + --file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml" + echo "** Release $RELEASE_NAME $VERSION published at" echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG" echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/latest_release" diff --git a/net/arp.go b/net/arp.go index 4a4e0d78..bbd6dd7b 100644 --- a/net/arp.go +++ b/net/arp.go @@ -17,10 +17,7 @@ func ConfigureARPCache(procPath, name string) error { if err := sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/delay_first_probe_time", name), "2"); err != nil { return err } - if err := sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/ucast_solicit", name), "1"); err != nil { - return err - } - return nil + return sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/ucast_solicit", name), "1") } func sysctl(procPath, variable, value string) error { diff --git a/net/bridge.go b/net/bridge.go index 61c9fc2c..54fd70bd 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -383,11 +383,7 @@ func (bf bridgedFastdpImpl) init(config *BridgeConfig) error { return errors.Wrap(err, "creating bridged fastdp veth pair") } - if err := linkSetUpByName(bf.datapathName); err != nil { - return err - } - - return nil + return linkSetUpByName(bf.datapathName) } func (b bridgeImpl) attach(veth *netlink.Veth) error { @@ -473,11 +469,7 @@ func configureIPTables(config *BridgeConfig) error { if err = ipt.ClearChain("nat", "WEAVE"); err != nil { return errors.Wrap(err, "clearing WEAVE chain") } - if err = ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE"); err != nil { - return err - } - - return nil + return ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE") } func linkSetUpByName(linkName string) error { diff --git a/net/ipsec/ipsec.go b/net/ipsec/ipsec.go index 3e60603a..f58110ab 100644 --- a/net/ipsec/ipsec.go +++ b/net/ipsec/ipsec.go @@ -421,10 +421,7 @@ func (ipsec *IPSec) installDropNonEncrypted(srcIP, dstIP net.IP, udpPort int, in func (ipsec *IPSec) removeDropNonEncrypted(srcIP, dstIP net.IP, udpPort int, inSPI SPI) error { rules := rulesDropNonEncrypted(srcIP, dstIP, udpPort, inSPI) - if err := ipsec.resetRules(rules, true); err != nil { - return err - } - return nil + return ipsec.resetRules(rules, true) } func (ipsec *IPSec) removeDropNonEncryptedInbound(srcIP, dstIP net.IP, inSPI SPI) error { diff --git a/net/veth.go b/net/veth.go index c42c2713..9a336ab5 100644 --- a/net/veth.go +++ b/net/veth.go @@ -218,11 +218,7 @@ func SetupIface(ifaceName, newIfName string) error { if err := ConfigureARPCache("/proc", newIfName); err != nil { return err } - if err := ipt.Append("filter", "INPUT", "-i", newIfName, "-d", "224.0.0.0/4", "-j", "DROP"); err != nil { - return err - } - - return nil + return ipt.Append("filter", "INPUT", "-i", newIfName, "-d", "224.0.0.0/4", "-j", "DROP") } // NB: This function can be used only by a process that terminates immediately @@ -332,8 +328,5 @@ func ExposeNAT(ipnet net.IPNet) error { if err := addNatRule(ipt, "-d", cidr, "!", "-s", cidr, "-j", "MASQUERADE"); err != nil { return err } - if err := addNatRule(ipt, "-s", cidr, "!", "-d", cidr, "-j", "MASQUERADE"); err != nil { - return err - } - return nil + return addNatRule(ipt, "-s", cidr, "!", "-d", cidr, "-j", "MASQUERADE") } diff --git a/npc/namespace.go b/npc/namespace.go index 222cdf02..1925ec71 100644 --- a/npc/namespace.go +++ b/npc/namespace.go @@ -65,10 +65,7 @@ func (ns *ns) empty() bool { } func (ns *ns) destroy() error { - if err := ns.podSelectors.deprovision(ns.uid, map[string]*selectorSpec{ns.allPods.key: ns.allPods}, nil); err != nil { - return err - } - return nil + return ns.podSelectors.deprovision(ns.uid, map[string]*selectorSpec{ns.allPods.key: ns.allPods}, nil) } func (ns *ns) onNewPodSelector(selector *selector) error { @@ -180,11 +177,7 @@ func (ns *ns) addNetworkPolicy(obj *extnapi.NetworkPolicy) error { if err := ns.podSelectors.provision(obj.ObjectMeta.UID, nil, podSelectors); err != nil { return err } - if err := ns.rules.provision(obj.ObjectMeta.UID, nil, rules); err != nil { - return err - } - - return nil + return ns.rules.provision(obj.ObjectMeta.UID, nil, rules) } func (ns *ns) updateNetworkPolicy(oldObj, newObj *extnapi.NetworkPolicy) error { @@ -217,11 +210,7 @@ func (ns *ns) updateNetworkPolicy(oldObj, newObj *extnapi.NetworkPolicy) error { if err := ns.podSelectors.provision(oldObj.ObjectMeta.UID, oldPodSelectors, newPodSelectors); err != nil { return err } - if err := ns.rules.provision(oldObj.ObjectMeta.UID, oldRules, newRules); err != nil { - return err - } - - return nil + return ns.rules.provision(oldObj.ObjectMeta.UID, oldRules, newRules) } func (ns *ns) deleteNetworkPolicy(obj *extnapi.NetworkPolicy) error { @@ -240,11 +229,7 @@ func (ns *ns) deleteNetworkPolicy(obj *extnapi.NetworkPolicy) error { if err := ns.nsSelectors.deprovision(obj.ObjectMeta.UID, nsSelectors, nil); err != nil { return err } - if err := ns.podSelectors.deprovision(obj.ObjectMeta.UID, podSelectors, nil); err != nil { - return err - } - - return nil + return ns.podSelectors.deprovision(obj.ObjectMeta.UID, podSelectors, nil) } func bypassRule(nsIpsetName ipset.Name, namespace string) []string { diff --git a/prog/weave-kube/weave-daemonset-k8s-1.7.yaml b/prog/weave-kube/weave-daemonset-k8s-1.7.yaml new file mode 100644 index 00000000..dad670b3 --- /dev/null +++ b/prog/weave-kube/weave-daemonset-k8s-1.7.yaml @@ -0,0 +1,152 @@ +apiVersion: v1 +kind: List +items: + - apiVersion: v1 + kind: ServiceAccount + metadata: + name: weave-net + labels: + name: weave-net + namespace: kube-system + - apiVersion: rbac.authorization.k8s.io/v1beta1 + kind: ClusterRole + metadata: + name: weave-net + labels: + name: weave-net + rules: + - apiGroups: + - '' + resources: + - pods + - namespaces + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - extensions + resources: + - networkpolicies + verbs: + - get + - list + - watch + - apiVersion: rbac.authorization.k8s.io/v1beta1 + kind: ClusterRoleBinding + metadata: + name: weave-net + labels: + name: weave-net + roleRef: + kind: ClusterRole + name: weave-net + apiGroup: rbac.authorization.k8s.io + subjects: + - kind: ServiceAccount + name: weave-net + namespace: kube-system + - apiVersion: extensions/v1beta1 + kind: DaemonSet + metadata: + name: weave-net + labels: + name: weave-net + namespace: kube-system + spec: + template: + metadata: + labels: + name: weave-net + spec: + containers: + - name: weave + command: + - /home/weave/launch.sh + env: + - name: HOSTNAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + image: 'weaveworks/weave-kube:latest' + imagePullPolicy: Always + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /status + port: 6784 + initialDelaySeconds: 30 + resources: + requests: + cpu: 10m + securityContext: + privileged: true + volumeMounts: + - name: weavedb + mountPath: /weavedb + - name: cni-bin + mountPath: /host/opt + - name: cni-bin2 + mountPath: /host/home + - name: cni-conf + mountPath: /host/etc + - name: dbus + mountPath: /host/var/lib/dbus + - name: lib-modules + mountPath: /lib/modules + - name: xtables-lock + mountPath: /run/xtables.lock + readOnly: false + - name: weave-npc + env: + - name: HOSTNAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + image: 'weaveworks/weave-npc:latest' + imagePullPolicy: Always + resources: + requests: + cpu: 10m + securityContext: + privileged: true + volumeMounts: + - name: xtables-lock + mountPath: /run/xtables.lock + readOnly: false + hostNetwork: true + hostPID: true + restartPolicy: Always + securityContext: + seLinuxOptions: {} + serviceAccountName: weave-net + tolerations: + - effect: NoSchedule + operator: Exists + volumes: + - name: weavedb + hostPath: + path: /var/lib/weave + - name: cni-bin + hostPath: + path: /opt + - name: cni-bin2 + hostPath: + path: /home + - name: cni-conf + hostPath: + path: /etc + - name: dbus + hostPath: + path: /var/lib/dbus + - name: lib-modules + hostPath: + path: /lib/modules + - name: xtables-lock + hostPath: + path: /run/xtables.lock + updateStrategy: + type: RollingUpdate diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go index 7e877c00..2821bd7d 100644 --- a/prog/weave-npc/main.go +++ b/prog/weave-npc/main.go @@ -50,11 +50,7 @@ func resetIPTables(ipt *iptables.IPTables) error { return err } - if err := ipt.ClearChain(npc.TableFilter, npc.MainChain); err != nil { - return err - } - - return nil + return ipt.ClearChain(npc.TableFilter, npc.MainChain) } func resetIPSets(ips ipset.Interface) error { @@ -116,12 +112,8 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error { if err := ips.Create(npc.LocalIpset, ipset.HashIP); err != nil { return err } - if err := ipt.Append(npc.TableFilter, npc.MainChain, - "-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil { - return err - } - - return nil + return ipt.Append(npc.TableFilter, npc.MainChain, + "-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT") } func root(cmd *cobra.Command, args []string) { diff --git a/proxy/proxy.go b/proxy/proxy.go index 893168bc..c106913c 100644 --- a/proxy/proxy.go +++ b/proxy/proxy.go @@ -330,11 +330,7 @@ func copyOwnerAndPermissions(from, to string) error { return nil } - if err = os.Chown(to, int(moreStat.Uid), int(moreStat.Gid)); err != nil { - return err - } - - return nil + return os.Chown(to, int(moreStat.Uid), int(moreStat.Gid)) } func (proxy *Proxy) listen(protoAndAddr string) (net.Listener, string, error) { diff --git a/site/concepts/ip-addresses.md b/site/concepts/ip-addresses.md index e510c1c6..7f22454c 100644 --- a/site/concepts/ip-addresses.md +++ b/site/concepts/ip-addresses.md @@ -32,7 +32,7 @@ You can of course also manually change the IP of any given container or subnet o ### IP Address Notation in Weave In the IP address `10.4.2.6/8`, the network prefix is the first 8 bits -- `10`. Written out in full, that network is `10.0.0.0/8`. +\- `10`. Written out in full, that network is `10.0.0.0/8`. The most common prefix lengths are 8, 16 and 24, but there is nothing stopping you using a /9 network or a /26. For example, `6.250.3.1/9` is on the diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index 9718b556..c5a02595 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -47,7 +47,7 @@ fi # Ensure Kubernetes uses locally built container images and inject code coverage environment variable (or do nothing depending on $COVERAGE): sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \ -e "s%env:%$COVERAGE_ARGS%" \ - "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.6.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -" + "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.7.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -" sleep 5 diff --git a/test/images/network-tester/network-tester b/test/images/network-tester/network-tester new file mode 100755 index 00000000..1fb586a9 Binary files /dev/null and b/test/images/network-tester/network-tester differ