reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,035 Commits 7 Branches 85 Tags
123762ec8d2d44c43841b0df2f5ba35a58cf151e
Commit Graph
745 Commits
Author SHA1 Message Date
Bryan Boreham b07db6479a Merge pull request #3655 from tanishq-dubey/master 
Add tolerations for nodes tainted with NoExecute
 2019-08-28 11:11:26 +01:00
Reilly Brogan ef26b306e4 Forgot to make this change 2019-08-08 14:52:29 -05:00
Reilly Brogan 1588a7259d add newline 2019-08-08 14:43:48 -05:00
Reilly Brogan 3a92050ebb Add weave-npc wrapper script 2019-08-08 14:42:56 -05:00
Tanishq Dubey 959d0bf2e2 Add tolerations for nodes tainted with NoExecute 2019-06-30 00:27:57 -04:00
Murali Reddy 7a6ba40982 fix unit test failures 2019-05-30 15:58:18 +05:30
Bryan Boreham 4c6879679d Merge pull request #3639 from weaveworks/allowegress 
lazily add iptables rule to drop egress traffic from the pods only if network policies are applied
 2019-05-07 14:38:39 +01:00
Bryan Boreham 27848992b1 Merge branch '2.5' 2019-05-07 13:32:55 +00:00
Bryan Boreham 8a4fc9c02a Fix peer-list fuzz test to re-fetch list when it may be nil 2019-05-03 17:25:36 +00:00
Murali Reddy 4a1fbc7c38 lazily add iptables rule to drop egress traffic from the pods only 
if network policies are applied

does not address #3464 but just avoids the issue atleast for those who
dont use network policies
 2019-05-03 18:40:59 +05:30
Bryan Boreham eb7ba691ee Fetch storedPeerList after read from Kubernetes 
This avoids a race condition where the peer has added itself to the
list and the annotation since we read storedPeerList.
 2019-04-02 09:11:27 +00:00
Bryan Boreham 15b9b7416a Re-read peers ConfigMap from Kubernetes at start of every reclaim 
A previous reclaim may have left the map set to nil.
 2019-03-26 17:25:34 +00:00
Bryan Boreham 5024270232 Avoid panic on nil map 
It can be set to nil after a failed update; check rather than crashing.
 2019-03-26 17:20:24 +00:00
Bryan Boreham bd24dd7dae Make test harness and comments match Kubernetes behaviour on conflict error 
Kubernetes always returns nil on error; somehow I had the wrong idea
here.
 2019-03-26 17:19:22 +00:00
Bryan Boreham 9654df4d50 Merge pull request #3585 from weaveworks/0peers 
handle single node case where return peer list from kube-utils is empty
 2019-02-04 14:57:13 +00:00
Bryan Boreham e1e4a7887a Merge branch '2.5' 2019-01-18 11:20:25 +00:00
Murali Reddy 17b45d9efa handle single node case where return peer list from kube-utils is empty 
fixes side affet introduced in #3454
 2019-01-18 01:06:37 +05:30
Bryan Boreham 27178b1c79 Check and report the error return from getKubePeers() 2019-01-15 11:15:36 +00:00
Bryan Boreham d4d9ba1e35 Merge pull request #3454 from weaveworks/self-peer 
prevent kubernetes node connecting to self
 2019-01-03 16:16:49 +00:00
Murali Reddy d2a9a51296 follow project conventions in ordering the imports 2018-12-04 10:58:43 +05:30
Murali Reddy 99e360ce3b skip egress network policies for the traffic node->bridge ip 2018-12-04 09:43:50 +05:30
Murali Reddy 81b17469f4 prevent kubernetes node connecting to self by excluding the node IP from the list of the peers passed to weaver 
Fixes #3398
 2018-11-21 11:47:30 +05:30
Murali Reddy 06669325a7 add --physdev-is-bridged flag when using physdev module for iptables 
rules created by weave-npc to prevent warning in kernel logs

Fixes #3449
 2018-11-20 13:34:10 +05:30
Bryan Boreham a5161b28f5 Merge pull request #3399 from weaveworks/rmpeer 
watch for Kubernetes node delete events and reclaim removed peers IP space on delete event
 2018-11-01 11:08:53 +00:00
Murali Reddy c48c746791 replace peerlist with current set of Kubernetes nodes 2018-10-31 18:06:48 +05:30
Murali Reddy d3c5241f12 addressing review comments 2018-10-31 17:26:55 +05:30
Murali Reddy 427d694e1b add checkpoint to include Kubernetes cluster information 
Fixes #3324
 2018-10-30 13:33:12 +05:30
Murali Reddy f334575e69 perform weave connect replace on node delete with empty peer list 2018-10-30 11:54:59 +05:30
Murali Reddy ea423755cc review comment: removing unnessary verbose code 2018-10-30 10:56:05 +05:30
Murali Reddy 4a40380d0f addressing review comments 2018-10-24 13:45:35 +05:30
Murali Reddy df467be26e watch for node delete events and call reclaimRemovedPeers 2018-10-24 13:45:35 +05:30
Bryan Boreham bf9985b0c8 Merge pull request #3423 from weaveworks/issue-3344 
Replace weave-local-pods ipset with physdev iptables rule
 2018-10-17 18:03:26 +01:00
Murali Reddy 408e5f7bdd make error message more appropriate 2018-10-17 21:16:52 +05:30
Murali Reddy d351b9f020 remove weave-local-pods ipset which no longer used by weave-npc 2018-10-17 15:34:46 +05:30
Bryan Boreham 965b5c627e Merge pull request #3421 from weaveworks/2018-09-28-moar-initialDelaySeconds 
kubernetes: Morph the livenessProbe into readinessProbe
 2018-10-16 14:46:34 +01:00
Murali Reddy d00e7335bb dont maintain weave-local-pods ipset on pod add/delete/update 2018-10-16 14:02:23 +05:30
Murali Reddy e3eb16a1f9 addressing review comments 2018-10-09 11:21:47 +05:30
Murali Reddy 59c1abe9b9 addressing review comments 2018-10-04 14:08:56 +05:30
Murali Reddy 4f9f0dfc3e Replace weave-local-pods ipset with physdev iptables rule 
by-pass ingress network policy chains and accept the packet if
destination is not one of the local pods

return the packets so the egress network policy chains are skipped
in case packet's source is not one of the local pods

Fixes #3344
 2018-10-02 11:02:36 +05:30
Damien Lespiau 8d44f49edd kubernetes: Morph the livenessProbe into readinessProbe 
The liveness probe has the not-so-great side effect of killing the weave pods
if anything goes wrong, making debugging really difficult.

Not only that, we also bumped into the livenessProbe killing pods before they
had a chance to start (see below for the full story).

The readinessProbe is only used for Kubernetes Services: no traffic will be
routed to non-Ready pods when using the Service IP. We can use to to signal the
user something in wrong with Weave Net while not having Kubernetes delete the
pods behind our backs.

I removed the ininitialDelaySeconds field as Kurbernetes won't kill the pod if
not ready.

Notes from a debugging session:

Some nodes may have a vast amount of iptables rules, making each iptables
command take a few seconds (~5-10s). At startup, when the weave container
creates its chains, it runs quite a few iptables commands and the total time of
execution was > 30s.

It's important to note that, at this point, the weave process hasn't started as
those iptables commands are run by an initial script.

Kubernetes was trying to check for the container liveness, was failing, and
then proceeded to kill the weave pods before they had a chance to fully start.
 2018-09-28 15:50:39 +01:00
Murali Reddy 7a959df648 handles an edge case where peer claimed to own the action (to reclaim) but no longer 
exists hence lock persists foever, fix makes a peer own the reclaim when nonexistent node found

Fixes #3386
 2018-09-27 16:00:44 +05:30
Martynas Pumputis 66bd443183 Merge remote-tracking branch 'origin/2.4' 2018-09-12 18:25:30 +03:00
Bryan Boreham 008eeb03ad Improve comments and error checking 2018-09-12 14:11:09 +00:00
Bryan Boreham 41c48dc678 Update test to call reclaimPeer() 2018-09-12 14:11:09 +00:00
Bryan Boreham 09be35dee0 Fetch stored peer list every time round the retry loop 
This ensures we take account of other peers' updates and closes a race
condition whereby another peer's changes can be overwritten.
 2018-09-12 14:11:09 +00:00
Bryan Boreham c3ad641d94 Refactor: extract reclaimPeer() function 2018-09-12 14:11:09 +00:00
Bryan Boreham bacb3952a3 Fetch Kubernetes node list every time round reclaim loop 
If we retain the Kubernetes list for a long time we might see a peer
appear in the Weave list and conclude it has been deleted. We must
always fetch the Kubernetes list after fetching the Weave list, during
deletion.
 2018-09-12 14:10:59 +00:00
Bryan Boreham 70257a6c19 Add test for kube-utils peer list 
- In parallel on several goroutines, randomly add and remove peers.
 - Maintain the test's own idea of current state.
 - Check that the test's state and kube-utils' state are consistent.
 2018-09-12 12:37:16 +00:00
Bryan Boreham bfe9f00e55 Fake kubernetes API which implements optimistic locking 
Mostly copied from kubernetes/client-go files
 2018-09-12 12:37:16 +00:00
Bryan Boreham 591be2d08f Refactor: Introduce an interface so weave client can be mocked 2018-09-12 12:37:16 +00:00