reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,875 Commits 7 Branches 85 Tags
a182bd4514360bbf192daca0e3a2312cc7b34df7
Commit Graph
690 Commits
Author SHA1 Message Date
Martynas Pumputis a182bd4514 Merge pull request #3388 from myENA/feature/skip-nat-via-weave-expose 
add --without-masquerade option to `weave expose`
 2018-09-10 15:45:52 +03:00
Martynas Pumputis acc24f1237 Do not exclude k8s node without any IP addr in reclaim 
Otherwise, such node will be rmpeer'd which can lead to the IPAM
inconsistencies "Received update for IP range I own at <..>".
 2018-09-06 14:49:20 +03:00
Aaron Hurt 4b9c533b94 add the ability to skip creation of MASQUERADE rules via iptables when executing weave expose command 2018-08-31 11:46:31 -05:00
Bryan Boreham 1814bbd2f2 Test container args-parsing code 
Extract function just to parse args, so we can call it separately and
test it.
 2018-08-08 13:24:53 +00:00
Bryan Boreham 374fed4699 Support --label flag on run-container command 2018-08-08 13:24:53 +00:00
Martynas Pumputis e65cf32372 npc: Flush chain if rules mismatch in AddChainWithRules 
Also, move the helper function to net/iptables.go.
 2018-07-24 10:06:55 +02:00
Martynas Pumputis 0ad2001ab4 npc: ACCEPT already established connections in egress chain 
It's safe to accept such connections as they will be accepted
in the ingress chain anyway.
 2018-07-24 10:06:55 +02:00
Martynas Pumputis 70ff510e49 npc: Document egress rules 2018-07-24 10:06:55 +02:00
Martynas Pumputis 07d31a8558 npc: Get rid of the legacy netpol 2018-07-24 10:06:55 +02:00
Martynas Pumputis 9a63ade1b5 npc: Do not create WEAVE-NPC-EGRESS* chains in legacy netpol mode 2018-07-24 10:06:23 +02:00
Martynas Pumputis 18a6237ec7 npc: Check whether weave-local-pods exists before creating 
We do not destroy it anymore, thus the check.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 86958be6cf npc: Add --use-legacy-netpol flag to weaver 
Egress does not work in the legacy netpol mode, so in the legacy case
we don't have to create the egress traffic steering rules. Otherwise,
some traffic will be blocked.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 295ddc5248 npc: Try not to clear WEAVE-NPC-EGRESS chain 
First check whether the chain exists with the required rules, and
if not - create it.

If we flush each time we start weave-npc then we create a (short)
time window during which all egress traffic is allowed.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis c0e2deb5a0 npc: Add WEAVE-NPC-EGRESS-ACCEPT chain 
For improving readability of NPC rules. The chain marks to-be-allowed egress
traffic.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 89e820d62e npc: Create WEAVE-NPC-EGRESS chain with the base rules 
The following rules are provisioned by weave-npc:

-A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j RETURN
-A WEAVE-NPC-EGRESS -m set ! --match-set weave-local-pods src -j RETURN
-A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
-A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j NFLOG --nflog-group 86
-A WEAVE-NPC-EGRESS -m mark ! --mark 0x40000/0x40000 -j DROP

-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j RETURN

-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j RETURN

For each rule we create two (mark and return). We cannot just accept
a packet if it matches any rule, as a packet might need to traverse
the ingress npc as well which happens later in the chain (in some cases
we cannot detect whether packet is ingress or egress, so we need to
check both chains).
 2018-07-24 10:06:23 +02:00
Munro, Louis b262a1eedc Fix xtables.lock race condition between weave and kube-proxy. 
Fixes #3351
 2018-07-22 13:12:00 -04:00
Bryan Boreham d513e68fab Add permissions to set node status 
This is needed to update the node NetworkUnavailable conditon
see https://github.com/weaveworks/weave/issues/3249
 2018-06-21 11:08:27 +00:00
Martynas Pumputis 25c26519ed Merge remote-tracking branch 'origin/2.3' 2018-06-12 14:47:42 +02:00
Bryan Boreham cf66c8d507 Don't remove myself when reclaiming 
Some logs from users show an entry of X with annotation X, which
suggests we have gone down the path of removing ourselves. This change
avoids that possibility.
 2018-06-12 11:52:03 +00:00
Bryan Boreham ad6148f0f6 Break out of kube rm peers loop if nothing changes 
Avoid getting into an infinite loop if some of the logic or underlying
data is bad
 2018-06-12 08:31:35 +00:00
Martynas Pumputis d15439aeac Merge remote-tracking branch 'origin/2.3' 2018-06-11 16:39:03 +02:00
Martynas Pumputis 49216ce365 Merge pull request #3307 from weaveworks/set-kube-netstatus 
Set Kubernetes NodeNetworkUnavailable to false when starting
 2018-06-11 15:20:14 +02:00
Bryan Boreham 812c58297f Merge pull request #3298 from weaveworks/issues/2924-preserve-src-ip-on-local 
2924: Preserve the client source IP
 2018-06-11 13:21:12 +01:00
Bryan Boreham 2a04df1049 Rename "kube-peers" to "kube-utils" 
It's now doing things like network status that are outside of the
scope of "peers".
 2018-06-11 11:22:07 +00:00
Martynas Pumputis 2eda624653 Merge pull request #3291 from weaveworks/withnetns-inproc 
Remove subprocess for changing netns
 2018-06-05 16:49:37 +02:00
Martynas Pumputis b6115f0147 Address the PR comments 
- Track only local changes.
- Add comment to the iptables rule which prevents SNAT'ing.
- Rename the ipset to weaver-no-masq-local to prevent NPC from destroying it.
- Fix comment about create/flush WEAVE-EXPOSE.
- Add comment about reexpose being no-op if bridge hasn't been exposed.
- Add comment that the feature is not only for Kubernetes.
- Reuse the ipset instance.
 2018-06-04 19:22:48 +02:00
Martynas Pumputis 6dbe95a0b5 Add NO_MASQ_LOCAL to weave-kube/launch.sh 
One can enable the feature by setting NO_MASQ_LOCAL=1 among
env vars of the weave-kube DaemonSet.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis ebf4b4b48a Implement and start using NoMasqLocalTracker 
The tracker updates the "no-masq-local" ipset with CIDR ranges allocated
by IPAM.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis 62c30d9130 Extern LocalRangeTracker interface with String method 
Cleaner approach than passing a tracker name to ipam/http.
 2018-06-04 14:08:24 +02:00
Martynas Pumputis 21fb953d0f Create weave-no-masq-local ipset 
The ipset is used to track locally allocated CIDRs. If requested,
external traffic sent to pods within these CIDR ranges will
avoid SNAT'ing (NYI).
 2018-06-04 14:08:24 +02:00
Martynas Pumputis 27c98070e8 Move npc/ipset package to net/ipset 
It's going to be used by net/bridge.go.
 2018-06-04 14:08:24 +02:00
Bryan Boreham 9b0d1bd054 Set Kubernetes NodeNetworkUnavailable to false when starting 2018-05-26 14:06:57 +00:00
Bryan Boreham 4c1c2a5661 Add --max-list-size option for ipset lists 
and default it to 1024 for cases where the size is fixed by the kernel
 2018-05-25 17:24:22 +00:00
Martynas Pumputis 6dce685105 Merge remote-tracking branch 'origin/2.3' 2018-05-22 17:21:03 +02:00
Marc Carré 9f207f161a Add org.opencontainers.image.* labels to Dockerfiles 
- This should ultimately help for image-to-code back references.
- `org.label-schema.*` labels are now deprecated, in favour of `org.opencontainers.image.*` labels.
  See also: https://github.com/opencontainers/image-spec/blob/master/annotations.md#back-compatibility-with-label-schema
- Git revision is now injected at `docker build` time.
 2018-05-14 11:51:40 +01:00
Bryan Boreham c2c14410d2 Remove subprocess for changing netns 
Now that Go 1.10 has removed the issue which made us do this.
 2018-04-30 23:40:59 +01:00
Bryan Boreham 672c770dbe Rework /report handler to pull format from URL 
Otherwise test 150 would fail - Gorilla mux was not handling a newline
in the format parameter.  This way you also get a better error if you
have an error in the parameter - instead of a 404.
 2018-04-27 14:34:49 +01:00
Bryan Boreham 847046a225 Update to match upstream changes 2018-04-27 14:34:48 +01:00
Bryan Boreham f6fdaf6492 Only expose metrics by default in weave-kube 2018-04-04 15:00:53 +01:00
Bryan Boreham c528303841 Merge pull request #3265 from weaveworks/raise-kube-conn-limit 
Raise weave-kube default connection limit from 30 to 100
 2018-03-28 10:20:30 +01:00
Bryan Boreham a439288765 Raise weave-kube default connection limit from 30 to 100 
This was missed from 265bfcf
 2018-03-27 21:06:41 +00:00
Martynas Pumputis fff656f7e4 Merge pull request #3235 from weaveworks/wait-5-sec 
Wait 5 seconds to let pod connect before rolling next pod
 2018-03-08 14:36:11 +01:00
Bryan Boreham 20eee3818e Merge pull request #3236 from weaveworks/apk-ca-certs 
Install ca-certificates instead of copying them
 2018-02-28 17:00:31 +00:00
Martynas Pumputis 0268aeb25f Install ca-certificates instead of copying them 
There is a package for alpine:
https://pkgs.alpinelinux.org/packages?name=ca-certificates&branch=v3.6
 2018-02-01 14:44:00 +01:00
Bryan Boreham ea3aba8971 Wait 5 seconds to let pod connect before rolling next pod 2018-01-31 10:54:07 +00:00
Bryan Boreham 265bfcf9d7 Raise default connection limit from 30 to 100 2018-01-31 10:48:05 +00:00
Bryan Boreham e7f30106c0 Pass the WeaveDNS Domain into the proxy 
instead of obtaining it via the http api
 2018-01-29 15:55:36 +00:00
Bryan Boreham 86d2800b59 Make proxy use configured WeaveDNS address 
rather than assuming it is listening on the weave bridge
 2018-01-29 15:55:36 +00:00
Bryan Boreham e65006042d Remove obsolete --dns-effective-listen-address parameter 
it was needed when we ran inside a container network namespace
 2018-01-29 15:55:36 +00:00
Martynas Pumputis a0c8fc2ddb Pass WEAVE_NO_BRIDGED_FASTDP to weaver 2017-12-17 19:05:12 +01:00