reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,762 Commits 7 Branches 85 Tags
29ec43bdc818fee724f2e4f0ffe9bfe50158894e
Commit Graph
6762 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martynas Pumputis 29ec43bdc8 npc: Rename default-allow ipset for ingress 
As we're going to introduce one for egress, we cannot use
"default-allow" name for ingress.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis cabc05b06c npc: Add rule type (ingress, egress) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 89e820d62e npc: Create WEAVE-NPC-EGRESS chain with the base rules 
The following rules are provisioned by weave-npc:

-A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j RETURN
-A WEAVE-NPC-EGRESS -m set ! --match-set weave-local-pods src -j RETURN
-A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
-A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j NFLOG --nflog-group 86
-A WEAVE-NPC-EGRESS -m mark ! --mark 0x40000/0x40000 -j DROP

-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j RETURN

-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j RETURN

For each rule we create two (mark and return). We cannot just accept
a packet if it matches any rule, as a packet might need to traverse
the ingress npc as well which happens later in the chain (in some cases
we cannot detect whether packet is ingress or egress, so we need to
check both chains).
 2018-07-24 10:06:23 +02:00
Bryan Boreham 88616007b0 Merge pull request #3353 from louismunro/fix_xtables_lock 
Fix xtables.lock race condition between weave and kube-proxy.
 2018-07-23 13:35:26 +01:00
Munro, Louis b262a1eedc Fix xtables.lock race condition between weave and kube-proxy. 
Fixes #3351
 2018-07-22 13:12:00 -04:00
Bryan Boreham b8ce722a2c Merge pull request #3346 from murali-reddy/issue-3206 
3206: Protect against CNI plugin being called with the host namespace
 2018-07-19 12:02:49 +01:00
Bryan Boreham b8fa4af06a Merge branch '2.3' 2018-07-17 12:25:49 +01:00
Bryan Boreham ea8f041a20 Fix indentation of TOC 2018-07-17 11:38:09 +01:00
Bryan Boreham 52e8cdb011 Merge pull request #3348 from weaveworks/check-running 
Add instructions to check weave-kube logs
 2018-07-17 11:35:29 +01:00
Bryan Boreham ac9f47783c Review feedback 2018-07-17 10:24:26 +01:00
Murali Reddy 27f9aa16d6 3206: Protect against CNI plugin being called with the host namespace 
adding a check to verify if network namespace is not host network namespace

Fixes #3206
 2018-07-16 12:43:09 +05:30
Bryan Boreham 08dc649b9a Merge branch '2.3' 2018-07-12 08:58:54 +00:00
Bryan Boreham bb1a373272 Add instructions to check weave-kube logs 
"Check it is running" and "check the logs" are important steps when
troubleshooting.
 2018-07-12 08:53:02 +00:00
Martynas Pumputis e192f68891 Merge pull request #3345 from stevenjohnstone/issues/3337-symlink-upgrades-broken 
Issue #3337: fix upgrade_cni_plugin

Fix #3337
 2018-07-09 12:17:32 +02:00
Stevie Johnstone 73654791c1 Issue #3337: fix upgrade_cni_plugin 2018-07-09 10:33:04 +01:00
Martynas Pumputis 8908458942 Merge pull request #3340 from weaveworks/k8s-1-11 
Update smoke tests to use Kubernetes 1.11
 2018-07-09 09:49:11 +02:00
Bryan Boreham 26792283ab Merge pull request #3328 from weaveworks/minikube-docs 
Add minikube caveat to docs
 2018-07-05 13:39:06 +01:00
Bryan Boreham 32a92a4695 Add --force flag to kubeadm reset 2018-06-28 10:26:09 +00:00
Bryan Boreham 3bea2ae419 Bump to Kubernetes 1.11 2018-06-28 09:25:56 +00:00
Martynas Pumputis 58eaf19026 Merge pull request #3334 from weaveworks/issues/3332-add-nodestatus-perms 
Add permissions to set node status
 2018-06-21 17:37:11 +02:00
Bryan Boreham d513e68fab Add permissions to set node status 
This is needed to update the node NetworkUnavailable conditon
see https://github.com/weaveworks/weave/issues/3249
 2018-06-21 11:08:27 +00:00
Martynas Pumputis ca8bbb27a0 Add minikube caveat to docs 2018-06-16 18:04:03 +02:00
Martynas Pumputis 287dab27ae Merge pull request #3317 from weaveworks/break-infinite-loop 
Break out of kube rm-peers loop if nothing changes
 2018-06-12 14:52:39 +02:00
Martynas Pumputis 25c26519ed Merge remote-tracking branch 'origin/2.3' 2018-06-12 14:47:42 +02:00
Bryan Boreham cf66c8d507 Don't remove myself when reclaiming 
Some logs from users show an entry of X with annotation X, which
suggests we have gone down the path of removing ourselves. This change
avoids that possibility.
 2018-06-12 11:52:03 +00:00
Bryan Boreham 318bb767a5 Merge pull request #3320 from weaveworks/manifest-tool-make 
Fix manifest-tool cmd in Makefile
 2018-06-12 10:48:30 +01:00
Bryan Boreham ad6148f0f6 Break out of kube rm peers loop if nothing changes 
Avoid getting into an infinite loop if some of the logic or underlying
data is bad
 2018-06-12 08:31:35 +00:00
Martynas Pumputis 8042d3f22a Fix manifest-tool cmd in Makefile 2018-06-12 10:19:47 +02:00
Bryan Boreham 62c949df6e Merge pull request #3316 from weaveworks/fix-makefile 
Fix $HOME usage in Makefile
 2018-06-11 16:39:36 +01:00
Martynas Pumputis 8c7dc342e0 Fix $HOME var in Makefile 2018-06-11 17:23:22 +02:00
Martynas Pumputis d15439aeac Merge remote-tracking branch 'origin/2.3' 2018-06-11 16:39:03 +02:00
Martynas Pumputis c19c64a990 Merge pull request #3305 from weaveworks/issues/3289-many-namespaces 
Make the ipset list size bigger
 2018-06-11 16:36:26 +02:00
Bryan Boreham 8e374d9416 D'oh 2018-06-11 13:52:15 +00:00
Martynas Pumputis 49216ce365 Merge pull request #3307 from weaveworks/set-kube-netstatus 
Set Kubernetes NodeNetworkUnavailable to false when starting
 2018-06-11 15:20:14 +02:00
Bryan Boreham 812c58297f Merge pull request #3298 from weaveworks/issues/2924-preserve-src-ip-on-local 
2924: Preserve the client source IP
 2018-06-11 13:21:12 +01:00
Bryan Boreham 2a04df1049 Rename "kube-peers" to "kube-utils" 
It's now doing things like network status that are outside of the
scope of "peers".
 2018-06-11 11:22:07 +00:00
Martynas Pumputis 2eda624653 Merge pull request #3291 from weaveworks/withnetns-inproc 
Remove subprocess for changing netns
 2018-06-05 16:49:37 +02:00
Martynas Pumputis 2f8aa7a351 Add random nonce to test ipset name to prevent race 
As ipset.New(...) can be called by two processes (weaver and weave-npc)
at the same time, there is a possibility for a race when they both
check the comment support. To prevent the race, we append a random
nonce to the test ipset name.
 2018-06-05 08:52:21 +02:00
Martynas Pumputis b6115f0147 Address the PR comments 
- Track only local changes.
- Add comment to the iptables rule which prevents SNAT'ing.
- Rename the ipset to weaver-no-masq-local to prevent NPC from destroying it.
- Fix comment about create/flush WEAVE-EXPOSE.
- Add comment about reexpose being no-op if bridge hasn't been exposed.
- Add comment that the feature is not only for Kubernetes.
- Reuse the ipset instance.
 2018-06-04 19:22:48 +02:00
Bryan Boreham 5ff22a1a77 Review feedback: tidied up function names 2018-06-04 13:28:28 +00:00
Martynas Pumputis 7fdf8fee13 Mention NO_MASQ_LOCAL opt in the docs 2018-06-04 14:08:24 +02:00
Martynas Pumputis 45a9ea666e Add k8s integration test case for preserving client IP addr 
Also, increase timeout for smoke tests to 360 sec.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis efd5d0e410 Add /client_ip to network-tester 
The endpoint is going to be used by --no-masq-local integration tests.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis 6dbe95a0b5 Add NO_MASQ_LOCAL to weave-kube/launch.sh 
One can enable the feature by setting NO_MASQ_LOCAL=1 among
env vars of the weave-kube DaemonSet.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis a0ec06a487 Destroy weave-no-masq-local ipset upon "weave reset" 2018-06-04 14:08:24 +02:00
Martynas Pumputis ebf4b4b48a Implement and start using NoMasqLocalTracker 
The tracker updates the "no-masq-local" ipset with CIDR ranges allocated
by IPAM.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis 4f99efaaf4 Export tracker.RemoveCommon and tracker.Merge 
It's going to be used by NoMasqLocalTracker.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis 62c30d9130 Extern LocalRangeTracker interface with String method 
Cleaner approach than passing a tracker name to ipam/http.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis 21fb953d0f Create weave-no-masq-local ipset 
The ipset is used to track locally allocated CIDRs. If requested,
external traffic sent to pods within these CIDR ranges will
avoid SNAT'ing (NYI).
 2018-06-04 14:08:24 +02:00
Martynas Pumputis 27c98070e8 Move npc/ipset package to net/ipset 
It's going to be used by net/bridge.go.
 2018-06-04 14:08:24 +02:00