reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,777 Commits 7 Branches 85 Tags
0a1ca30aae1fdcffbeae7abd2eed43d565d3d3fc
Commit Graph
6777 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martynas Pumputis 0a1ca30aae npc: Add getRuleSpec for ipBlockSpec 2018-07-24 10:06:23 +02:00
Martynas Pumputis 2e85018c26 npc: Add ruleHost interface 
The idea for the interface is taken from the kitt1987/ipblock work.

The interface is going to be implemented by selectorSpec and
ipBlockSpec.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis affdc6f5af npc: Provision networkingv1.IPBlock (only for Egress) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 9198bb5a68 npc: Refactor npc/ipblock.go 
- No need to validate networkingv1.IPBlock fields as k8s does it.
- Fix provisioning.
 2018-07-24 10:06:23 +02:00
Kitt Hsu 9769c8d5b9 support ipblock in npc 
NOTE(brb): This commit is cherry-picked from the kitt1987/ipblock
branch.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 688328dc57 npc: Steer traffic for egress processing 
We need two rules:

* `-A INPUT -i weave -j WEAVE-NPC-EGRESS`: applies to packets destined
  to a local node.
* `-A FORWARD -i weave -j WEAVE-NPC-EGRESS`: the rest. It can match
  an ingress packet.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 8904a4b144 npc: Get rid of selectorSpec.target 
We treat selectorSpec as a target selector if len(selectorSpec.policyTypes) > 0.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 8d1ee752d4 npc: Rename dstSelector to targetSelector 
dstSelector becomes ambiguous once we introduce the egress.

So, from now on, we call selector a target selector if it selects
pods to which a netpol applies (aka NetworkPolicySpec.podSelector).
 2018-07-24 10:06:23 +02:00
Martynas Pumputis f02a11b27b npc: Analyse egress policy 
This is a copy-paste from the ingress part with small modifications.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 5e675f26f7 npc: Embed policyType into rule 
This ensures two rules with the same rulespec but of different
policyType will end up having different keys.

Sharing the same key would prevent from provisioning the rules.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 497a9c7fd0 npc: Replace rulesType by policyType 2018-07-24 10:06:23 +02:00
Martynas Pumputis 5afcd0595d npc: Parse PolicyTypes field when analysing a netpol 2018-07-24 10:06:23 +02:00
Martynas Pumputis f27d4d2117 npc: Add defaultAllowIPSetName helper 2018-07-24 10:06:23 +02:00
Martynas Pumputis 79727a86fa npc: Manage entries in egressDefaultAllowIPSet 2018-07-24 10:06:23 +02:00
Martynas Pumputis d474c1c26d npc: Add policyType to selectorSpec 
This allows us to distinguish between ingress and egress
dst selectors (required when managing entries in default-allow
ipsets).
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 29ec43bdc8 npc: Rename default-allow ipset for ingress 
As we're going to introduce one for egress, we cannot use
"default-allow" name for ingress.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis cabc05b06c npc: Add rule type (ingress, egress) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 89e820d62e npc: Create WEAVE-NPC-EGRESS chain with the base rules 
The following rules are provisioned by weave-npc:

-A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j RETURN
-A WEAVE-NPC-EGRESS -m set ! --match-set weave-local-pods src -j RETURN
-A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
-A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j NFLOG --nflog-group 86
-A WEAVE-NPC-EGRESS -m mark ! --mark 0x40000/0x40000 -j DROP

-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j RETURN

-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j RETURN

For each rule we create two (mark and return). We cannot just accept
a packet if it matches any rule, as a packet might need to traverse
the ingress npc as well which happens later in the chain (in some cases
we cannot detect whether packet is ingress or egress, so we need to
check both chains).
 2018-07-24 10:06:23 +02:00
Bryan Boreham 88616007b0 Merge pull request #3353 from louismunro/fix_xtables_lock 
Fix xtables.lock race condition between weave and kube-proxy.
 2018-07-23 13:35:26 +01:00
Munro, Louis b262a1eedc Fix xtables.lock race condition between weave and kube-proxy. 
Fixes #3351
 2018-07-22 13:12:00 -04:00
Bryan Boreham b8ce722a2c Merge pull request #3346 from murali-reddy/issue-3206 
3206: Protect against CNI plugin being called with the host namespace
 2018-07-19 12:02:49 +01:00
Bryan Boreham b8fa4af06a Merge branch '2.3' 2018-07-17 12:25:49 +01:00
Bryan Boreham ea8f041a20 Fix indentation of TOC 2018-07-17 11:38:09 +01:00
Bryan Boreham 52e8cdb011 Merge pull request #3348 from weaveworks/check-running 
Add instructions to check weave-kube logs
 2018-07-17 11:35:29 +01:00
Bryan Boreham ac9f47783c Review feedback 2018-07-17 10:24:26 +01:00
Murali Reddy 27f9aa16d6 3206: Protect against CNI plugin being called with the host namespace 
adding a check to verify if network namespace is not host network namespace

Fixes #3206
 2018-07-16 12:43:09 +05:30
Bryan Boreham 08dc649b9a Merge branch '2.3' 2018-07-12 08:58:54 +00:00
Bryan Boreham bb1a373272 Add instructions to check weave-kube logs 
"Check it is running" and "check the logs" are important steps when
troubleshooting.
 2018-07-12 08:53:02 +00:00
Martynas Pumputis e192f68891 Merge pull request #3345 from stevenjohnstone/issues/3337-symlink-upgrades-broken 
Issue #3337: fix upgrade_cni_plugin

Fix #3337
 2018-07-09 12:17:32 +02:00
Stevie Johnstone 73654791c1 Issue #3337: fix upgrade_cni_plugin 2018-07-09 10:33:04 +01:00
Martynas Pumputis 8908458942 Merge pull request #3340 from weaveworks/k8s-1-11 
Update smoke tests to use Kubernetes 1.11
 2018-07-09 09:49:11 +02:00
Bryan Boreham 26792283ab Merge pull request #3328 from weaveworks/minikube-docs 
Add minikube caveat to docs
 2018-07-05 13:39:06 +01:00
Bryan Boreham 32a92a4695 Add --force flag to kubeadm reset 2018-06-28 10:26:09 +00:00
Bryan Boreham 3bea2ae419 Bump to Kubernetes 1.11 2018-06-28 09:25:56 +00:00
Martynas Pumputis 58eaf19026 Merge pull request #3334 from weaveworks/issues/3332-add-nodestatus-perms 
Add permissions to set node status
 2018-06-21 17:37:11 +02:00
Bryan Boreham d513e68fab Add permissions to set node status 
This is needed to update the node NetworkUnavailable conditon
see https://github.com/weaveworks/weave/issues/3249
 2018-06-21 11:08:27 +00:00
Martynas Pumputis ca8bbb27a0 Add minikube caveat to docs 2018-06-16 18:04:03 +02:00
Martynas Pumputis 287dab27ae Merge pull request #3317 from weaveworks/break-infinite-loop 
Break out of kube rm-peers loop if nothing changes
 2018-06-12 14:52:39 +02:00
Martynas Pumputis 25c26519ed Merge remote-tracking branch 'origin/2.3' 2018-06-12 14:47:42 +02:00
Bryan Boreham cf66c8d507 Don't remove myself when reclaiming 
Some logs from users show an entry of X with annotation X, which
suggests we have gone down the path of removing ourselves. This change
avoids that possibility.
 2018-06-12 11:52:03 +00:00
Bryan Boreham 318bb767a5 Merge pull request #3320 from weaveworks/manifest-tool-make 
Fix manifest-tool cmd in Makefile
 2018-06-12 10:48:30 +01:00
Bryan Boreham ad6148f0f6 Break out of kube rm peers loop if nothing changes 
Avoid getting into an infinite loop if some of the logic or underlying
data is bad
 2018-06-12 08:31:35 +00:00
Martynas Pumputis 8042d3f22a Fix manifest-tool cmd in Makefile 2018-06-12 10:19:47 +02:00
Bryan Boreham 62c949df6e Merge pull request #3316 from weaveworks/fix-makefile 
Fix $HOME usage in Makefile
 2018-06-11 16:39:36 +01:00
Martynas Pumputis 8c7dc342e0 Fix $HOME var in Makefile 2018-06-11 17:23:22 +02:00
Martynas Pumputis d15439aeac Merge remote-tracking branch 'origin/2.3' 2018-06-11 16:39:03 +02:00
Martynas Pumputis c19c64a990 Merge pull request #3305 from weaveworks/issues/3289-many-namespaces 
Make the ipset list size bigger
 2018-06-11 16:36:26 +02:00
Bryan Boreham 8e374d9416 D'oh 2018-06-11 13:52:15 +00:00
Martynas Pumputis 49216ce365 Merge pull request #3307 from weaveworks/set-kube-netstatus 
Set Kubernetes NodeNetworkUnavailable to false when starting
 2018-06-11 15:20:14 +02:00
Bryan Boreham 812c58297f Merge pull request #3298 from weaveworks/issues/2924-preserve-src-ip-on-local 
2924: Preserve the client source IP
 2018-06-11 13:21:12 +01:00