reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,205 Commits 7 Branches 85 Tags
0c4aeb3a0b216c2d116087ddef8e7a61a57fc747
Commit Graph
91 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Murali Reddy 0c4aeb3a0b Run smoke-tests with Kubernetes 1.14.0 and CNI 0.7.5 2020-07-31 16:29:02 +00:00
Murali Reddy f24cf798bc build tool updates 
including changes to accommodate current get.docker.com script
 2020-07-31 16:28:52 +00:00
Murali Reddy 3d66dcd94e run terraform init for gcp plugin initialization 2020-07-31 14:52:46 +00:00
Murali Reddy 77fbb2c12b introduce weavenpc_policy_enforcement_errors prometheus metric 
to track number of errors occured during enforcing network policies

Fixes #3791
 2020-05-22 09:54:11 +00:00
Murali Reddy 438a5f5fd1 clarify pods connect to api server 2020-04-02 16:12:02 +05:30
Murali Reddy 48015aa7be Weave-npc: while logging differentiate between fatal and non-fatal errors 2020-04-02 15:08:15 +05:30
Murali Reddy 0c4659c3b5 Merge branch '2.6' 2020-03-17 22:36:38 +05:30
Murali Reddy 14730f8572 Add release v2.6.2 2020-03-17 20:36:24 +05:30
Murali Reddy 6bc0e5e71c send FastDatapathCryptoInitSARemote control message only if encryption is enabled 
Fixes #3781
 2020-03-11 21:26:09 +05:30
Murali Reddy 6e1770d24d Merge branch '2.6' 2020-03-06 23:14:42 +05:30
Murali Reddy 57bca8e955 Add release v2.6.1 2020-03-06 18:36:33 +05:30
Murali Reddy 4e3acfdc02 add note on apiserver being on EKS managed network 2020-02-26 10:29:50 +05:30
Murali Reddy 11915948a2 add steps to install weave-net on EKS 2020-02-26 10:27:01 +05:30
Murali Reddy 5d0e44bb6f add missing dnsPolicy: ClusterFirstWithHostNet in weave-daemonset-k8s-1.11.yaml 
update apiVersion from rbac.authorization.k8s.io/v1beta1 to rbac.authorization.k8s.io/v1
 2020-02-11 13:15:33 +05:30
Murali Reddy 83024b946f use softlinks to link iptables to backend specific commands and update docs 2020-01-08 15:44:22 +05:30
Murali Reddy 4f48670345 set iptables backend to use if specified explicitly or auto-detect 2020-01-08 15:44:10 +05:30
Murali Reddy 4b30d97d4e update alpine base image to 3.10 that has iptables ver 1.8.3 2020-01-08 15:43:51 +05:30
Murali Reddy d44e34584a Update tools submodule to latest commit 2a2df527894bcaa5d42ad80654c43e1e5a6b03d7 2019-12-06 18:48:49 +05:30
Murali Reddy 6d2366ca4c upgrade to newer terraform that is compatible with google cloud API 
Fixes #3741
 2019-12-06 10:19:27 +05:30
Murali Reddy 640c5c346c add mocks for GossipNeighbourSubset 2019-11-05 13:25:56 +00:00
Murali Reddy 9d485d0f21 delete weave-daemonset.yaml which predates the manifest weave-daemonset-k8s-1.6/1.7/1.8.yaml 
naming is counter intutive
 2019-08-29 11:37:55 +00:00
Murali Reddy 9090fddd9f add net-dev as channel to ask question regarding weave-net 
Fixes #3667
 2019-07-31 11:33:10 +05:30
Murali Reddy 90ccc4a014 use space to check if entry in a range has allocations while doing ring merge 2019-06-07 18:12:35 +05:30
Murali Reddy a6f2ee5ccc add seperate match function to matach pod/namespace/namespacedpod selectors 2019-06-07 11:52:40 +05:30
Murali Reddy 332808c524 add details of kube-proxy mode iptables/ipvs and falgs 2019-06-06 11:05:25 +05:30
Murali Reddy db006060e6 Fix the incorrect case #4 in k8s-src-ip.md 
With cluster IP, traffic is masquraded only when --masquerade-all option is specified
or --cluster-cidr is specified and the source is not from the cluster CIDR range

https://github.com/kubernetes/kubernetes/blob/v1.14.2/pkg/proxy/iptables/proxier.go#L842
 2019-06-03 10:20:15 +05:30
Murali Reddy 7a6ba40982 fix unit test failures 2019-05-30 15:58:18 +05:30
Murali Reddy 75e106b667 using an explicti selector set for network policies with both namespace and pod lable selectors 2019-05-30 12:03:28 +05:30
Murali Reddy 391613d015 add details of ipset used for ipblock's excpet list 2019-05-29 08:04:23 +00:00
Murali Reddy 7334869134 update weavenpc design document to reflect current design 2019-05-29 08:04:18 +00:00
Murali Reddy bb4f51499d add support for combination of podSelector and namespaceSelector 
in network policies

- enhance selectorSpec to accomodate both pod and namespace selectors
- enhance analysePolicy to handle policies with both selectors

Fixes #3312
 2019-05-28 12:40:39 +05:30
Murali Reddy cc88aa2145 Merge branch '2.5' 2019-05-16 18:11:30 +05:30
Murali Reddy 4b5d827d94 Add release v2.5.2 2019-05-16 11:42:47 +05:30
Murali Reddy 5e69e8a7b4 check for allocations in the range that got transffered when its split 2019-05-13 20:02:36 +05:30
Murali Reddy 2d912263b1 add ring debug log during merge() 2019-05-13 12:43:19 +05:30
Murali Reddy ac9d72875d ignore the error on IPAM delete for the container with 0 addresses 2019-05-10 17:25:58 +05:30
Murali Reddy 51d7f455c9 move code to reset the entry free space from entries.merge() to Ring.Merge() 2019-05-10 17:23:45 +05:30
Murali Reddy 89db74338e during merge we receive update to an entry that ring owns, and has a newer version, set our version to the one received plus one, effectively imposing our existing entry 2019-05-09 16:05:22 +05:30
Murali Reddy ea2084d871 return from further processign networkpolicy if base rule failed to gets created 2019-05-06 16:27:38 +05:30
Murali Reddy 4a1fbc7c38 lazily add iptables rule to drop egress traffic from the pods only 
if network policies are applied

does not address #3464 but just avoids the issue atleast for those who
dont use network policies
 2019-05-03 18:40:59 +05:30
Murali Reddy 11c55a3a07 fix lint 2019-05-03 10:55:13 +05:30
Murali Reddy a400d43df7 resolve inconsistencies detected during ring merge 
Fixes #1962
 2019-05-03 10:55:13 +05:30
Murali Reddy 4f8fe2c13f gossip broadcast updated rin on donating a range to other peer 
Fixes #3628
 2019-04-26 15:21:23 +05:30
Murali Reddy 873781ab58 bump up the version of entry by large value so that transfer of range 
takes precedence (if there is any conflict in merging entry) over
other operations on the entry that increments the version

Fixes #3612
 2019-04-26 15:15:47 +05:30
Murali Reddy 06e0e6ace0 add debug log for ipam ring and entry updates 
Fixes #3627
 2019-04-09 12:39:16 +05:30
Murali Reddy 13644ee1b0 fix use of manifest tool in release process 2019-01-29 12:58:09 +05:30
Murali Reddy 54d24e65ef Merge branch '2.5' 2019-01-21 19:40:21 +05:30
Murali Reddy b8bce1c28f Add release v2.5.1 2019-01-21 13:14:17 +05:30
Murali Reddy 17b45d9efa handle single node case where return peer list from kube-utils is empty 
fixes side affet introduced in #3454
 2019-01-18 01:06:37 +05:30
Murali Reddy f82440f792 modification to reflect CONN_LIMIT only for Kubernetes 2018-12-05 16:14:41 +05:30
Murali Reddy ad2dc562af document connection limit 
Fixes #3395
 2018-12-05 15:52:57 +05:30
Murali Reddy d2a9a51296 follow project conventions in ordering the imports 2018-12-04 10:58:43 +05:30
Murali Reddy 99e360ce3b skip egress network policies for the traffic node->bridge ip 2018-12-04 09:43:50 +05:30
Murali Reddy 81b17469f4 prevent kubernetes node connecting to self by excluding the node IP from the list of the peers passed to weaver 
Fixes #3398
 2018-11-21 11:47:30 +05:30
Murali Reddy 06669325a7 add --physdev-is-bridged flag when using physdev module for iptables 
rules created by weave-npc to prevent warning in kernel logs

Fixes #3449
 2018-11-20 13:34:10 +05:30
Murali Reddy bc9939fcdc add delay before checking ipam status 2018-11-01 14:51:19 +05:30
Murali Reddy c48c746791 replace peerlist with current set of Kubernetes nodes 2018-10-31 18:06:48 +05:30
Murali Reddy d3c5241f12 addressing review comments 2018-10-31 17:26:55 +05:30
Murali Reddy 427d694e1b add checkpoint to include Kubernetes cluster information 
Fixes #3324
 2018-10-30 13:33:12 +05:30
Murali Reddy f16d4561e0 remove realunch weave pod to test the unreachable_ip_addresses_count 2018-10-30 12:34:28 +05:30
Murali Reddy f334575e69 perform weave connect replace on node delete with empty peer list 2018-10-30 11:54:59 +05:30
Murali Reddy ea423755cc review comment: removing unnessary verbose code 2018-10-30 10:56:05 +05:30
Murali Reddy 4a40380d0f addressing review comments 2018-10-24 13:45:35 +05:30
Murali Reddy df467be26e watch for node delete events and call reclaimRemovedPeers 2018-10-24 13:45:35 +05:30
Murali Reddy edba711283 update client-go to include informeres, listers 2018-10-24 13:45:35 +05:30
Murali Reddy 408e5f7bdd make error message more appropriate 2018-10-17 21:16:52 +05:30
Murali Reddy d351b9f020 remove weave-local-pods ipset which no longer used by weave-npc 2018-10-17 15:34:46 +05:30
Murali Reddy d00e7335bb dont maintain weave-local-pods ipset on pod add/delete/update 2018-10-16 14:02:23 +05:30
Murali Reddy e3eb16a1f9 addressing review comments 2018-10-09 11:21:47 +05:30
Murali Reddy 6b2631e378 addressing review comment. keep forwarder running forever even on heart beat timeouts 2018-10-05 09:47:23 +05:30
Murali Reddy 59c1abe9b9 addressing review comments 2018-10-04 14:08:56 +05:30
Murali Reddy 4f9f0dfc3e Replace weave-local-pods ipset with physdev iptables rule 
by-pass ingress network policy chains and accept the packet if
destination is not one of the local pods

return the packets so the egress network policy chains are skipped
in case packet's source is not one of the local pods

Fixes #3344
 2018-10-02 11:02:36 +05:30
Murali Reddy 7a959df648 handles an edge case where peer claimed to own the action (to reclaim) but no longer 
exists hence lock persists foever, fix makes a peer own the reclaim when nonexistent node found

Fixes #3386
 2018-09-27 16:00:44 +05:30
Murali Reddy 1806ca5665 add rbac prerequisite for using weave net on GKE 
fixes #3111
 2018-09-26 18:51:40 +05:30
Murali Reddy 7141ccc271 prevent a case where tryOps endsup called recursivley when persisted data exists 
but has empty data

Fixes #3067
 2018-09-26 16:10:06 +05:30
Murali Reddy b3cb38eda4 addressing review comments 2018-09-24 17:53:28 +05:30
Murali Reddy 62758ca337 log the heartbeat send/recieve/miss 2018-09-21 16:45:47 +05:30
Murali Reddy 3c67c3c5f1 changes differentiate beteween fatal errors (for e.g. ipsec init) 
from transient errors (heartbeast misses). In case of transient
errors OverlayForwarder is marked to be unhealty. When overlay forwarder
is unhealty its hept on hold so chooseBest() will skip selecting the forwrder

Once OverlayForwarder is considered healthy run chooseBest() again so the
forwarder can be selected if its the best forwarder

Fixes #1737
 2018-09-21 16:45:47 +05:30
Murali Reddy 9cf50588b5 remove weave-npc logging details 2018-09-06 11:45:02 +00:00
Murali Reddy 6c2de466c0 add documnetatin to enable debug logging 2018-09-06 11:44:53 +00:00
Murali Reddy ddfec13f17 add portmap requirement in kube-addon.md 2018-09-05 12:06:13 +05:30
Murali Reddy b8b47787be integration test for HostPort support 2018-09-05 08:35:27 +05:30
Murali Reddy 16a8988e41 addressing review comments 2018-09-03 15:25:57 +05:30
Murali Reddy 90907a7647 Fix to use 10-weave.conflist instead of 10-weave.conf as CNI config file. 
Also adds support for portmap as additional plugin along with weave-net

Fixes #3016
 2018-08-31 16:11:24 +05:30
Murali Reddy 40980aeb90 Monitor and throw error message in the logs if Weave bridge interface 
is found to be in DOWN state

Fixes #3133 Do something more useful when the weave bridge is DOWN

On Weave restart there is already logic in place to create the bridge interface
and bring it up, this fix only monotors the weave bridge interface and logs error if
it is in DOWN state
 2018-08-23 10:02:21 +05:30
Murali Reddy e6ba59f029 add missing --token argument in help for weave launch 
Fixes #3226
 2018-08-17 14:40:05 +05:30
Murali Reddy e0359a32f2 Merge pull request #3367 from weaveworks/issues/3168-ingress-ipblock 
Add ipBlock support for Ingress netpol
 2018-08-16 13:24:47 +05:30
Murali Reddy a19d025677 addressing review comment 2018-08-14 20:16:04 +05:30
Murali Reddy 6625e29071 addressing review comments 2018-08-10 19:36:18 +05:30
Murali Reddy d5e864736b weave-npc doesn't handle named ports 
Support for names ports in enhancement, but with this PR just adding more graceful failure.

Fixes #3032
 2018-08-10 18:37:08 +05:30
Murali Reddy 27f9aa16d6 3206: Protect against CNI plugin being called with the host namespace 
adding a check to verify if network namespace is not host network namespace

Fixes #3206
 2018-07-16 12:43:09 +05:30