reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,368 Commits 7 Branches 85 Tags
feature/gitea-ci
Commit Graph
811 Commits
Author SHA1 Message Date
Raj Chaudhuri 999aeb7d0b Made changes to assume iptables-nft as the default backend for iptables, and provisioned for changing to legacy mode if required 2024-12-22 18:56:07 +05:30
Raj Chaudhuri 78f596fbda Provisioned for Docker V2 plugin on multiple architectures, blocked CHECKPOINT, updated docs 2024-04-09 19:01:34 +05:30
Raj Chaudhuri 664e361ab4 In alpine base image, changed default iptables backend to legacy for backward compatibility 2024-03-17 09:23:53 +05:30
Raj Chaudhuri e50040883f Docker API client version bumped to 1.24 everywhere 2024-03-07 19:27:12 +05:30
Raj Chaudhuri c1d3107418 Changed module name, edited default manifests in prog/weave-kube 
* Module name changed to `github.com/rajch/weave`
* Added environment variable `CHECKPOINT_DISABLE=1` to default manifests, to bypass weaveworks telemetry
 2024-03-01 18:05:19 +05:30
Raj Chaudhuri 00f8afd743 Changed registry user in publishables to rajchaudhuri on docker hub 
Also made some aesthetic changes to scripts and build files
 2024-02-29 15:14:44 +05:30
Raj Chaudhuri 1bb1f02b1d libCNI upgraded to v1.1.2 
This was all work done previously by @hswong3i in
https://github.com/weaveworks/weave/pull/3939

All credit to them
 2023-03-29 12:10:13 +05:30
Bryan Boreham 263aecf4ef Merge pull request #3886 from avestuk/add-etc-machine-id-mount 
Update daemonset manifest to mount /etc/machine-id
 2021-01-22 14:21:16 +00:00
Alex Vest 9a2682671c Update daemonset manifest to mount /etc/machine-id 
Mounted as ReadOnly in order to minimize attack surface as in #3880
 2021-01-21 18:00:26 +00:00
Bryan Boreham ad621c807e Move Kubernetes API calls into kube-utils program 
This reduces the size of the 'weaver' binary.
 2021-01-19 17:22:47 +00:00
KevDG 3ef97f0c7c Workaround to fix ipset conflict with iptables 
Sleep before ipset destroy in startup, otherwise the operation can
sometimes fail - see https://github.com/weaveworks/weave/issues/3847
 2021-01-18 12:33:54 +00:00
Bryan Boreham fe61992c06 Make launch.sh compatible with older k8s manifests 2021-01-12 15:53:12 +00:00
Bryan Boreham 8eeb3ca4f2 Kubernetes: move part of launch to init container 
This allows the main container to run without write access to the host
filesystem, except for two specific areas, thus trimming the attack
surface.

We lose the behaviour that the CNI plugin is only installed if Weave Net
gets up and running at least once, so the error reports from kubelet
will be slightly different in the case that it never manages to run.
 2021-01-11 17:54:43 +00:00
Bryan Boreham b7a9947c2f Remove manifests for Kubernetes 1.6 and 1.7 
They are ancient history; reduce maintenance load by removing
 2021-01-11 14:34:09 +00:00
Bryan Boreham a0ac81b3b4 Stop running in host PID namespace 
We shouldn't need this
 2020-12-17 12:49:27 +00:00
Bryan Boreham 8c52698222 Move egress logging rule beside drop rule 
Otherwise we might log a blocked connection even though the packet
was not dropped.
 2020-08-26 10:02:32 +00:00
Bryan Boreham 4795ba5807 Show stack-trace from panic in weave-npc 
Rather than exiting silently, fetch the stack trace and print that
for the user to understand what happened.

Exit via existing fatal-error code.
 2020-08-05 09:45:20 +00:00
Bryan Boreham 23a827088b Remove unused stopChan 2020-08-05 09:44:19 +00:00
naemono 269786abf5 Simply run os.Exit on panic of goroutine 2020-08-05 09:40:02 +00:00
Bryan Boreham 9cf4104de7 Merge pull request #3838 from weaveworks/go1_14_4 
Update to Go 1.14.4 and modules; update other dependencies
 2020-08-04 18:25:40 +01:00
Murali Reddy fca23f805a modify launch.sh to launch weaver with --no-masq-local by default 2020-08-04 16:21:30 +00:00
Bryan Boreham b3d387fb86 Update Kubernetes client packages to 0.18.6 
Lots of functions need Context parameters added
 2020-08-04 10:11:30 +00:00
Bryan Boreham d14502e071 Update Prometheus client to latest version 
Also let Prometheus export process and Go metrics
 2020-08-04 10:11:28 +00:00
Bryan Boreham 4592758e48 Merge pull request #3789 from hairyhenderson/add-connection-type-label-to-weave-connection-metric-3788 
Add new 'type' and 'encryption' labels to weave_connections metric
 2020-08-03 11:40:16 +01:00
Bryan Boreham cdbc25d462 Merge pull request #3231 from weaveworks/issues/1770-fetch-dns-address 
Fetch DNS listen address from daemon
 2020-07-31 13:47:41 +01:00
Bryan Boreham b0274e11be Fetch DNS listen address from daemon 
instead of assuming it's on the Docker bridge

Also move DNS address validation into NewDNSServer(),
so we only do it once.
 2020-07-31 11:58:56 +00:00
Bryan Boreham 34dc4dabce Clean up some lint warnings 
I ran golangci-lint and it pointed out a few things to clean up.
 2020-07-31 10:28:55 +00:00
Bryan Boreham 28e482af14 Avoid some deprecated APIs 2020-07-31 10:28:55 +00:00
Bryan Boreham df52117bfa Remove unused code 2020-07-31 09:03:27 +00:00
Bryan Boreham 00623be8a7 Merge pull request #3624 from weaveworks/trim-tools 
Remove some unused tools from the Weave docker containers
 2020-07-30 14:14:49 +01:00
Bryan Boreham 4d3e8d4a82 Merge pull request #3726 from weaveworks/slim-dependencies 
Slim utility binaries by reducing dependencies
 2020-07-30 14:13:47 +01:00
Bryan Boreham 2cc5c635c9 Add 'encrypted' label to connections metric 
Extend tests to check it shows up.
Tests assume that metrics are published with metrics in alphabetical
order, which appears to be the case for now.
 2020-07-30 11:07:33 +00:00
Bryan Boreham 865e2b726f Ensure maps for connection counts are created before use 
We know all the expected states, so can pre-create maps
 2020-07-30 10:25:14 +00:00
Dave Henderson 2deb7e2e48 Add new 'type' label to weave_connections metric 
Signed-off-by: Dave Henderson <dhenderson@gmail.com>
 2020-07-30 10:24:38 +00:00
Bryan Boreham a3c76e141b Move name constants to separate 'chains' package, to reduce dependencies 
We don't want everyone that uses the `net` package to get a transitive
dependency on the Kubernetes APIs required by `npc`.
 2020-07-29 12:55:46 +00:00
Nesc58 f4009c39d8 wait added to iptables commands 2020-07-28 10:46:49 +02:00
Simon Howe 341bac9968 Rename Monitor -> MonitorForIptablesFlush 
- Makes it all a bit more explicit
 2020-07-24 15:04:28 +02:00
Simon Howe 899490c3f9 Removes disabling iptable canary 
- Should always be on. Simpler.
 2020-07-15 11:37:53 +02:00
Simon Howe 709b434f55 Clean up the Monitor go routine 2020-07-15 11:37:53 +02:00
Simon Howe 66eb80d841 Adds a CANARY chain and Monitor loop instead of reapplying iptables 2020-07-15 11:37:16 +02:00
Simon Howe 94e75e45af Make ConfigureIPTables idempotent and poll it 
- Instead of EnsureBridge
- Adds ipset.ExistEntry method
- Refactor ipset method names Exist <-> EntryExists
- Turn on iptable-refresh by default (10s)
- Adds a test that checks iptables are refreshed, check EXPOSE recovers
 2020-07-15 11:35:41 +02:00
Bryan Boreham a46d18da0c Use a more targeted iptables rule to block access to control port 
Only block the specific port Weave Net is listening on.
Add a comment so users know what the rule is for.

Remove the rule added in v2.6.3 because it was too coarse.
 2020-05-29 19:58:41 +00:00
Bryan Boreham 1f920513de Merge pull request #3804 from weaveworks/npc-errors-metrics2 
metric for NPC errors
 2020-05-23 20:43:55 +01:00
Bryan Boreham 09a204b978 NPC: increment metric each time an error is logged 2020-05-22 09:55:07 +00:00
Bryan Boreham 6ad3e69faf Plumb through /proc path config to Docker plugin 2020-05-18 14:47:26 +00:00
Murali Reddy 48015aa7be Weave-npc: while logging differentiate between fatal and non-fatal errors 2020-04-02 15:08:15 +05:30
Murali Reddy 5d0e44bb6f add missing dnsPolicy: ClusterFirstWithHostNet in weave-daemonset-k8s-1.11.yaml 
update apiVersion from rbac.authorization.k8s.io/v1beta1 to rbac.authorization.k8s.io/v1
 2020-02-11 13:15:33 +05:30
Murali Reddy 83024b946f use softlinks to link iptables to backend specific commands and update docs 2020-01-08 15:44:22 +05:30
Murali Reddy 4f48670345 set iptables backend to use if specified explicitly or auto-detect 2020-01-08 15:44:10 +05:30
Bryan Boreham 18deb42df1 Raise Kubernetes CPU requests from 10m to 50m 
This setting is passed by Kubelet to the Linux scheduler to ask for a share of
available CPU, so we should ask for a bit more than 1% of 1 CPU. Otherwise if a
CPU is contended Weave Net will get throttled frequently.

Weave Net in fastdp mode shouldn't need a lot of CPU most of the time, but at
startup there is quite a lot to do.

The setting is also used by the Kubernetes scheduler to decide how much will fit
on a node, so setting it much higher will reserve CPU that we shouldn't need most
of the time.
 2019-11-22 22:30:03 +00:00