From 11915948a27f50dde4cebad36cd5825cb98f72f8 Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Wed, 26 Feb 2020 10:27:01 +0530 Subject: [PATCH 1/4] add steps to install weave-net on EKS --- site/kubernetes/kube-addon.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 5c6a5dd5..b35dc8cf 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -7,6 +7,8 @@ search_type: Documentation The following topics are discussed: * [Installation](#install) + * [Installing on GKE](#gke) + * [Installing on EKS](#eks) * [Upgrading the Daemon Sets](#daemon-sets) * [CPU and Memory Requirements](#resources) * [Pod Eviction](#eviction) @@ -71,10 +73,24 @@ Shut down Kubernetes, and _on all nodes_ perform the following: Then relaunch Kubernetes and install the addon as described above. -**Note:** Installing on GKE +### Installing on GKE Please note that you must grant the user the ability to create roles in Kubernetes before launching Weave Net. This is a prerequisite to use use role-based access control on GKE. Please see the GKE [instructions](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control). +### Installing on EKS + +EKS by default installs `amazon-vpc-cni-k8s` CNI. Please follow below steps to use Weave-net as CNI + +- create EKS cluster in any of [prescribed](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html) way +- delete `amazon-vpc-cni-k8s` deamonset by running `kubectl delete ds aws-node -n kube-system` command +- delete `/etc/cni/net.d/10-aws.conflist` on each of the node +- edit instance security group to allow TCP 6783 and UDP 6783/6784 ports +- flush iptables nat, mangle, filter tables to clear any iptables configurations done by `amazon-vpc-cni-k8s` +- restart kube-proxy pods to reconfigure iptables +- apply weave-net daemoset by following above installation steps +- delete existing pods so they get recreated in Weave pod CIDR's address-space. + + ### Upgrading the Daemon Sets The DaemonSet definition specifies [Rolling From 4e3acfdc02fedf745123df0840aefb20218d904d Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Wed, 26 Feb 2020 10:29:50 +0530 Subject: [PATCH 2/4] add note on apiserver being on EKS managed network --- site/kubernetes/kube-addon.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index b35dc8cf..2608cf0a 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -90,6 +90,8 @@ EKS by default installs `amazon-vpc-cni-k8s` CNI. Please follow below steps to u - apply weave-net daemoset by following above installation steps - delete existing pods so they get recreated in Weave pod CIDR's address-space. +Please note that the api-server for your cluster will not be connected to Weave Net (it runs elsewhere, managed by EKS) so will not be able to connect to pods. + ### Upgrading the Daemon Sets From 48015aa7be413f1c945c6d0f1d38d48a91ba5ae5 Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Wed, 25 Mar 2020 15:47:46 +0530 Subject: [PATCH 3/4] Weave-npc: while logging differentiate between fatal and non-fatal errors --- common/logging.go | 6 ++++++ prog/weave-npc/main.go | 18 ++++++++++-------- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/common/logging.go b/common/logging.go index ffa01db6..fc46904c 100644 --- a/common/logging.go +++ b/common/logging.go @@ -54,6 +54,12 @@ func SetLogLevel(levelname string) { Log.Level = level } +func CheckError(e error) { + if e != nil { + Log.Error(e) + } +} + func CheckFatal(e error) { if e != nil { Log.Fatal(e) diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go index d5231b7e..9ac6f778 100644 --- a/prog/weave-npc/main.go +++ b/prog/weave-npc/main.go @@ -34,7 +34,9 @@ var ( bridgePortName string ) -func handleError(err error) { common.CheckFatal(err) } +func handleError(err error) { common.CheckError(err) } + +func handleFatal(err error) { common.CheckFatal(err) } func makeController(getter cache.Getter, resource string, objType runtime.Object, handlers cache.ResourceEventHandlerFuncs) cache.Controller { @@ -240,19 +242,19 @@ func root(cmd *cobra.Command, args []string) { } config, err := rest.InClusterConfig() - handleError(err) + handleFatal(err) client, err := kubernetes.NewForConfig(config) - handleError(err) + handleFatal(err) ipt, err := iptables.New() - handleError(err) + handleFatal(err) ips := ipset.New(common.LogLogger(), maxList) - handleError(resetIPTables(ipt)) - handleError(resetIPSets(ips)) - handleError(createBaseRules(ipt, ips)) + handleFatal(resetIPTables(ipt)) + handleFatal(resetIPSets(ips)) + handleFatal(createBaseRules(ipt, ips)) npc := npc.New(nodeName, ipt, ips, client) @@ -339,5 +341,5 @@ func main() { rootCmd.PersistentFlags().IntVar(&maxList, "max-list-size", 1024, "maximum size of ipset list (for namespaces)") rootCmd.PersistentFlags().StringVar(&bridgePortName, "bridge-port-name", "vethwe-bridge", "name of the brige port on which packets are received and sent") - handleError(rootCmd.Execute()) + handleFatal(rootCmd.Execute()) } From 438a5f5fd16935380947a280ae392627f4b1ebc8 Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Thu, 2 Apr 2020 16:12:02 +0530 Subject: [PATCH 4/4] clarify pods connect to api server --- site/kubernetes/kube-addon.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 2608cf0a..dd19c9e5 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -90,7 +90,7 @@ EKS by default installs `amazon-vpc-cni-k8s` CNI. Please follow below steps to u - apply weave-net daemoset by following above installation steps - delete existing pods so they get recreated in Weave pod CIDR's address-space. -Please note that the api-server for your cluster will not be connected to Weave Net (it runs elsewhere, managed by EKS) so will not be able to connect to pods. +Please note that while pods can connect to the Kubernetes API server for your cluser, API server will not be able to connect to the pods as API server nodes are not connected to Weave Net (they run on network managed by EKS). ### Upgrading the Daemon Sets