reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,364 Commits 7 Branches 85 Tags
master
Commit Graph
107 Commits
Author SHA1 Message Date
Raj Chaudhuri 999aeb7d0b Made changes to assume iptables-nft as the default backend for iptables, and provisioned for changing to legacy mode if required 2024-12-22 18:56:07 +05:30
Raj Chaudhuri 664e361ab4 In alpine base image, changed default iptables backend to legacy for backward compatibility 2024-03-17 09:23:53 +05:30
Raj Chaudhuri c1d3107418 Changed module name, edited default manifests in prog/weave-kube 
* Module name changed to `github.com/rajch/weave`
* Added environment variable `CHECKPOINT_DISABLE=1` to default manifests, to bypass weaveworks telemetry
 2024-03-01 18:05:19 +05:30
Raj Chaudhuri 00f8afd743 Changed registry user in publishables to rajchaudhuri on docker hub 
Also made some aesthetic changes to scripts and build files
 2024-02-29 15:14:44 +05:30
Bryan Boreham 263aecf4ef Merge pull request #3886 from avestuk/add-etc-machine-id-mount 
Update daemonset manifest to mount /etc/machine-id
 2021-01-22 14:21:16 +00:00
Alex Vest 9a2682671c Update daemonset manifest to mount /etc/machine-id 
Mounted as ReadOnly in order to minimize attack surface as in #3880
 2021-01-21 18:00:26 +00:00
Bryan Boreham ad621c807e Move Kubernetes API calls into kube-utils program 
This reduces the size of the 'weaver' binary.
 2021-01-19 17:22:47 +00:00
KevDG 3ef97f0c7c Workaround to fix ipset conflict with iptables 
Sleep before ipset destroy in startup, otherwise the operation can
sometimes fail - see https://github.com/weaveworks/weave/issues/3847
 2021-01-18 12:33:54 +00:00
Bryan Boreham fe61992c06 Make launch.sh compatible with older k8s manifests 2021-01-12 15:53:12 +00:00
Bryan Boreham 8eeb3ca4f2 Kubernetes: move part of launch to init container 
This allows the main container to run without write access to the host
filesystem, except for two specific areas, thus trimming the attack
surface.

We lose the behaviour that the CNI plugin is only installed if Weave Net
gets up and running at least once, so the error reports from kubelet
will be slightly different in the case that it never manages to run.
 2021-01-11 17:54:43 +00:00
Bryan Boreham b7a9947c2f Remove manifests for Kubernetes 1.6 and 1.7 
They are ancient history; reduce maintenance load by removing
 2021-01-11 14:34:09 +00:00
Bryan Boreham a0ac81b3b4 Stop running in host PID namespace 
We shouldn't need this
 2020-12-17 12:49:27 +00:00
Murali Reddy fca23f805a modify launch.sh to launch weaver with --no-masq-local by default 2020-08-04 16:21:30 +00:00
Nesc58 f4009c39d8 wait added to iptables commands 2020-07-28 10:46:49 +02:00
Murali Reddy 5d0e44bb6f add missing dnsPolicy: ClusterFirstWithHostNet in weave-daemonset-k8s-1.11.yaml 
update apiVersion from rbac.authorization.k8s.io/v1beta1 to rbac.authorization.k8s.io/v1
 2020-02-11 13:15:33 +05:30
Murali Reddy 83024b946f use softlinks to link iptables to backend specific commands and update docs 2020-01-08 15:44:22 +05:30
Murali Reddy 4f48670345 set iptables backend to use if specified explicitly or auto-detect 2020-01-08 15:44:10 +05:30
Bryan Boreham 18deb42df1 Raise Kubernetes CPU requests from 10m to 50m 
This setting is passed by Kubelet to the Linux scheduler to ask for a share of
available CPU, so we should ask for a bit more than 1% of 1 CPU. Otherwise if a
CPU is contended Weave Net will get throttled frequently.

Weave Net in fastdp mode shouldn't need a lot of CPU most of the time, but at
startup there is quite a lot to do.

The setting is also used by the Kubernetes scheduler to decide how much will fit
on a node, so setting it much higher will reserve CPU that we shouldn't need most
of the time.
 2019-11-22 22:30:03 +00:00
Bryan Boreham b0d05f5e37 Increase default connection limit to 200 
Improvements in resource consumption in larger clusters mean we can
raise this limit.
 2019-11-05 14:21:24 +00:00
Bryan Boreham cb5798f94d Merge pull request #3697 from christian-2/system-node-critical 
mark pods weave-net with priorityClassName: system-node-critical
 2019-10-12 12:00:13 +01:00
christian-2 6afedb881c mark pods weave-net with priorityClassName: system-node-critical 
* fixes #3691
* `weave-daemonset-k8s-1.11.yaml` is `weave-daemonset-k8s-1.9.yaml` plus `priorityClassName: system-node-critical`
* notice that a Kubernetes cluster created with `kubeadm` has its `kube-proxy`s marked as `system-node-critical` (and several other pods, such as `kube-apiserver` marked as `system-cluster-critical`)
 2019-09-04 14:16:46 +02:00
Sidharth Surana e90cbf290b Change the dnsPolicy for the weave-net pods to ClusterFirstWithHostNet 2019-08-30 10:12:57 -07:00
Bryan Boreham 1e0431f6b2 Merge pull request #3674 from weaveworks/weave-daemonset 
delete weave-daemonset.yaml
 2019-08-30 10:25:45 +01:00
Bryan Boreham ace2c12608 Merge pull request #3660 from Pensu/daemonset_api 
Move daemonset API to apps/v1
 2019-08-29 13:11:57 +01:00
Murali Reddy 9d485d0f21 delete weave-daemonset.yaml which predates the manifest weave-daemonset-k8s-1.6/1.7/1.8.yaml 
naming is counter intutive
 2019-08-29 11:37:55 +00:00
Peeyush Gupta 991945081a Move daemonset API to apps/v1 2019-08-29 13:57:16 +05:30
Tanishq Dubey 959d0bf2e2 Add tolerations for nodes tainted with NoExecute 2019-06-30 00:27:57 -04:00
Murali Reddy 17b45d9efa handle single node case where return peer list from kube-utils is empty 
fixes side affet introduced in #3454
 2019-01-18 01:06:37 +05:30
Murali Reddy df467be26e watch for node delete events and call reclaimRemovedPeers 2018-10-24 13:45:35 +05:30
Damien Lespiau 8d44f49edd kubernetes: Morph the livenessProbe into readinessProbe 
The liveness probe has the not-so-great side effect of killing the weave pods
if anything goes wrong, making debugging really difficult.

Not only that, we also bumped into the livenessProbe killing pods before they
had a chance to start (see below for the full story).

The readinessProbe is only used for Kubernetes Services: no traffic will be
routed to non-Ready pods when using the Service IP. We can use to to signal the
user something in wrong with Weave Net while not having Kubernetes delete the
pods behind our backs.

I removed the ininitialDelaySeconds field as Kurbernetes won't kill the pod if
not ready.

Notes from a debugging session:

Some nodes may have a vast amount of iptables rules, making each iptables
command take a few seconds (~5-10s). At startup, when the weave container
creates its chains, it runs quite a few iptables commands and the total time of
execution was > 30s.

It's important to note that, at this point, the weave process hasn't started as
those iptables commands are run by an initial script.

Kubernetes was trying to check for the container liveness, was failing, and
then proceeded to kill the weave pods before they had a chance to fully start.
 2018-09-28 15:50:39 +01:00
Martynas Pumputis 07d31a8558 npc: Get rid of the legacy netpol 2018-07-24 10:06:55 +02:00
Munro, Louis b262a1eedc Fix xtables.lock race condition between weave and kube-proxy. 
Fixes #3351
 2018-07-22 13:12:00 -04:00
Bryan Boreham d513e68fab Add permissions to set node status 
This is needed to update the node NetworkUnavailable conditon
see https://github.com/weaveworks/weave/issues/3249
 2018-06-21 11:08:27 +00:00
Martynas Pumputis 49216ce365 Merge pull request #3307 from weaveworks/set-kube-netstatus 
Set Kubernetes NodeNetworkUnavailable to false when starting
 2018-06-11 15:20:14 +02:00
Bryan Boreham 812c58297f Merge pull request #3298 from weaveworks/issues/2924-preserve-src-ip-on-local 
2924: Preserve the client source IP
 2018-06-11 13:21:12 +01:00
Bryan Boreham 2a04df1049 Rename "kube-peers" to "kube-utils" 
It's now doing things like network status that are outside of the
scope of "peers".
 2018-06-11 11:22:07 +00:00
Martynas Pumputis 6dbe95a0b5 Add NO_MASQ_LOCAL to weave-kube/launch.sh 
One can enable the feature by setting NO_MASQ_LOCAL=1 among
env vars of the weave-kube DaemonSet.
 2018-06-04 14:08:24 +02:00
Bryan Boreham 9b0d1bd054 Set Kubernetes NodeNetworkUnavailable to false when starting 2018-05-26 14:06:57 +00:00
Marc Carré 9f207f161a Add org.opencontainers.image.* labels to Dockerfiles 
- This should ultimately help for image-to-code back references.
- `org.label-schema.*` labels are now deprecated, in favour of `org.opencontainers.image.*` labels.
  See also: https://github.com/opencontainers/image-spec/blob/master/annotations.md#back-compatibility-with-label-schema
- Git revision is now injected at `docker build` time.
 2018-05-14 11:51:40 +01:00
Bryan Boreham f6fdaf6492 Only expose metrics by default in weave-kube 2018-04-04 15:00:53 +01:00
Bryan Boreham c528303841 Merge pull request #3265 from weaveworks/raise-kube-conn-limit 
Raise weave-kube default connection limit from 30 to 100
 2018-03-28 10:20:30 +01:00
Bryan Boreham a439288765 Raise weave-kube default connection limit from 30 to 100 
This was missed from 265bfcf
 2018-03-27 21:06:41 +00:00
Bryan Boreham ea3aba8971 Wait 5 seconds to let pod connect before rolling next pod 2018-01-31 10:54:07 +00:00
Bryan Boreham 3b499ce27c Rearrange peer reclaim checks in weave-kube launch script 
This is to make it behave better on fresh start, and in the case where
the manifest has not been updated to give it permissions.
 2017-11-16 14:14:54 +00:00
Bryan Boreham 570ab0b10b Avoid deleting persisted data on weave-kube upgrade 
Add a feature to weaveutil to get and set flags, then use this feature
to mark the DB when this version runs
 2017-11-15 11:26:43 +00:00
Bryan Boreham 214cf6cb2e Flip result code when checking for new peer 
This avoids mistaking an error condition for the result we should act on
 2017-11-15 10:11:02 +00:00
Bryan Boreham c67bc704e1 Temporarily raise kube-peers log level to debug 2017-11-14 14:16:01 +00:00
Bryan Boreham 3501ad45e6 Cope with a Kubernetes node being deleted and coming back 
Add features to weaver and kube-peers to find the peer name and check
if it is in the list, then in launch.sh delete persisted data if not.
 2017-11-14 14:15:31 +00:00
Bryan Boreham 71b39489da Maintain a list of peers in a Kubernetes annotation 
This is prework for a feature which will remove 'dead' peers
 2017-11-14 14:06:33 +00:00
Bryan Boreham ed8d92cfc6 RBAC to read and write ConfigMaps 2017-11-14 14:06:33 +00:00