by-pass ingress network policy chains and accept the packet if
destination is not one of the local pods
return the packets so the egress network policy chains are skipped
in case packet's source is not one of the local pods
Fixes#3344
The liveness probe has the not-so-great side effect of killing the weave pods
if anything goes wrong, making debugging really difficult.
Not only that, we also bumped into the livenessProbe killing pods before they
had a chance to start (see below for the full story).
The readinessProbe is only used for Kubernetes Services: no traffic will be
routed to non-Ready pods when using the Service IP. We can use to to signal the
user something in wrong with Weave Net while not having Kubernetes delete the
pods behind our backs.
I removed the ininitialDelaySeconds field as Kurbernetes won't kill the pod if
not ready.
Notes from a debugging session:
Some nodes may have a vast amount of iptables rules, making each iptables
command take a few seconds (~5-10s). At startup, when the weave container
creates its chains, it runs quite a few iptables commands and the total time of
execution was > 30s.
It's important to note that, at this point, the weave process hasn't started as
those iptables commands are run by an initial script.
Kubernetes was trying to check for the container liveness, was failing, and
then proceeded to kill the weave pods before they had a chance to fully start.
from transient errors (heartbeast misses). In case of transient
errors OverlayForwarder is marked to be unhealty. When overlay forwarder
is unhealty its hept on hold so chooseBest() will skip selecting the forwrder
Once OverlayForwarder is considered healthy run chooseBest() again so the
forwarder can be selected if its the best forwarder
Fixes#1737
If we retain the Kubernetes list for a long time we might see a peer
appear in the Weave list and conclude it has been deleted. We must
always fetch the Kubernetes list after fetching the Weave list, during
deletion.
- In parallel on several goroutines, randomly add and remove peers.
- Maintain the test's own idea of current state.
- Check that the test's state and kube-utils' state are consistent.
Change the map used to reclaim peers so it is indexed by PeerName
which should be unique over time, rather than NodeName which can be
re-used. Create an auxilliary set of NodeNames to help.
This way, if we can see that a different peer was previously running
with the same node name, it can be included for reclaim.
Adrian Suwała