From d2ebaf3ab767156a4a62a3b7b9a6739455ac2ece Mon Sep 17 00:00:00 2001 From: Marc CARRE Date: Wed, 12 Jul 2017 15:04:55 +0100 Subject: [PATCH 1/6] Make Ansible's docker_install_role overridable. Currently: - there is no easy way to change the way we install Docker from Net - if build-tools' default was to change, Net could break. This change addresses this situation. --- test/run-integration-tests.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/run-integration-tests.sh b/test/run-integration-tests.sh index 97c8e9d1..bd5afd01 100755 --- a/test/run-integration-tests.sh +++ b/test/run-integration-tests.sh @@ -26,6 +26,7 @@ NAME=${NAME:-"$(whoami | sed -e 's/[\.\_]*//g' | cut -c 1-4)"} PROVIDER=${PROVIDER:-gcp} # Provision using provided provider, or Google Cloud Platform by default. NUM_HOSTS=${NUM_HOSTS:-3} PLAYBOOK=${PLAYBOOK:-setup_weave-net_test.yml} +PLAYBOOK_DOCKER_INSTALL_ROLE=${PLAYBOOK_DOCKER_INSTALL_ROLE:-docker-from-get.docker.com} TESTS=${TESTS:-} RUNNER_ARGS=${RUNNER_ARGS:-""} # Dependencies' versions: @@ -269,7 +270,7 @@ function provision() { function configure_with_ansible() { ansible-playbook -u "$1" -i "$2" --private-key="$3" --forks="${4:-$NUM_HOSTS}" \ --ssh-extra-args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \ - --extra-vars "docker_version=$DOCKER_VERSION kubernetes_version=$KUBERNETES_VERSION kubernetes_cni_version=$KUBERNETES_CNI_VERSION" \ + --extra-vars "docker_version=$DOCKER_VERSION kubernetes_version=$KUBERNETES_VERSION kubernetes_cni_version=$KUBERNETES_CNI_VERSION docker_install_role=$PLAYBOOK_DOCKER_INSTALL_ROLE" \ "$DIR/../tools/config_management/$PLAYBOOK" } From 4b5299d124b80d2c4a2af021f2b5824b6658a8dd Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Tue, 22 Aug 2017 11:28:19 +0000 Subject: [PATCH 2/6] Add release v2.0.2 --- CHANGELOG.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b3b2189e..e5a7357a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,23 @@ +## Release 2.0.2 + +Bug fixes and minor improvements + +* Fix race condition in weave-npc which would intermittently block all traffic for a namespace #3057,#3059 +* Ensure Fast Datapath works on machines that need to mount the kernel module dynamically #3080 +* Regression: weave-npc would block everything if `kubelet --hostname-override` was used #3049,#3051 +* Fix netfilter rules to block containers from accessing the Weave Net control endpoint #3093 +* If DNS server is off then disable proxy DNS registration, to avoid spurious errors #3054,#3088 +* Add comments to each iptables rule and ipset, to help when troubleshooting #3064 +* Remove code that checked for an outdated fallback address for Kubernetes api-server #3071 +* Add a label to the weavedb image so it can be filtered out by tools #3066 +* Fix various build and continuous-integration failures #3061 +* Print 'help' text faster in the weave script #3056 +* Add an option to create continuous integration hosts in different ways #3060 +* Remove remnants of the pre-2.0 proxy and plugin from build and test #3035,#3036 + +[Full list of changes](https://github.com/weaveworks/weave/milestone/60?closed=1). + + ## Release 2.0.1 Bug fixes and minor improvements From 2555e491e1884db56250b97f3dca78c456c6afb8 Mon Sep 17 00:00:00 2001 From: Mike Bryant Date: Wed, 23 Aug 2017 01:21:15 +0100 Subject: [PATCH 3/6] fix: Missing nil checks Fixes #3095 --- npc/rule.go | 18 ++++++++++++------ npc/rule_test.go | 16 ++++++++++++++++ 2 files changed, 28 insertions(+), 6 deletions(-) create mode 100644 npc/rule_test.go diff --git a/npc/rule.go b/npc/rule.go index 5ed49129..d2fac379 100644 --- a/npc/rule.go +++ b/npc/rule.go @@ -30,13 +30,19 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds args = append(args, "--dport", *dstPort) } args = append(args, "-j", "ACCEPT") - srcComment := "" - if srcHost.nsName != "" { - srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key) - } else { - srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key) + srcComment := "anywhere" + if srcHost != nil { + if srcHost.nsName != "" { + srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key) + } else { + srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key) + } } - args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> namespace: %s, key: %s", srcComment, dstHost.nsName, dstHost.key)) + dstComment := "anywhere" + if dstHost != nil { + dstComment = fmt.Sprintf("pods: namespace: %s, selector: %s", dstHost.nsName, dstHost.key) + } + args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment)) key := strings.Join(args, " ") return &ruleSpec{key, args} diff --git a/npc/rule_test.go b/npc/rule_test.go new file mode 100644 index 00000000..dee1802f --- /dev/null +++ b/npc/rule_test.go @@ -0,0 +1,16 @@ +package npc + +import ( + "github.com/stretchr/testify/require" + "testing" +) + +func TestRegressionHandleNil3095(t *testing.T) { + // Test for handling nil values + // https://github.com/weaveworks/weave/issues/3095 + + rs := newRuleSpec(nil, nil, nil, nil) + + require.NotEqual(t, rs.key, "") + +} From de1d409c6ac44c9d68c358a5de51ab79fbb06211 Mon Sep 17 00:00:00 2001 From: Mike Bryant Date: Wed, 23 Aug 2017 09:40:44 +0100 Subject: [PATCH 4/6] Fix review comments --- npc/rule.go | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/npc/rule.go b/npc/rule.go index d2fac379..fd695f98 100644 --- a/npc/rule.go +++ b/npc/rule.go @@ -20,18 +20,9 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds if proto != nil { args = append(args, "-p", *proto) } - if srcHost != nil { - args = append(args, "-m", "set", "--match-set", string(srcHost.ipsetName), "src") - } - if dstHost != nil { - args = append(args, "-m", "set", "--match-set", string(dstHost.ipsetName), "dst") - } - if dstPort != nil { - args = append(args, "--dport", *dstPort) - } - args = append(args, "-j", "ACCEPT") srcComment := "anywhere" if srcHost != nil { + args = append(args, "-m", "set", "--match-set", string(srcHost.ipsetName), "src") if srcHost.nsName != "" { srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key) } else { @@ -40,8 +31,13 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds } dstComment := "anywhere" if dstHost != nil { + args = append(args, "-m", "set", "--match-set", string(dstHost.ipsetName), "dst") dstComment = fmt.Sprintf("pods: namespace: %s, selector: %s", dstHost.nsName, dstHost.key) } + if dstPort != nil { + args = append(args, "--dport", *dstPort) + } + args = append(args, "-j", "ACCEPT") args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment)) key := strings.Join(args, " ") From 527bcffe3baaac6f7b6e8cb7ffc1f6caee52b0da Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Wed, 23 Aug 2017 09:39:40 +0000 Subject: [PATCH 5/6] Extend weave-kube smoke test: add a policy with blank 'from' Per issue #3095 this crashes the commenting code. Also added check to see if the pods are still running. --- test/840_weave_kube_3_test.sh | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index 9b98dec1..9718b556 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -94,6 +94,20 @@ spec: run: nettest EOF +# Another policy, this time with no 'from' section, just to check that doesn't cause a crash +run_on $HOST1 "$KUBECTL apply -f -" < Date: Wed, 23 Aug 2017 11:08:24 +0000 Subject: [PATCH 6/6] Add release v2.0.3 --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e5a7357a..ec1afb9a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +## Release 2.0.3 + +Bug fixes + +* Weave-npc would crash on a policy with no 'from' part - regression introduced in 2.0.2 #3095,#3096,#3097 + +[Full list of changes](https://github.com/weaveworks/weave/milestone/61?closed=1). + + ## Release 2.0.2 Bug fixes and minor improvements