reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,823 Commits 7 Branches 85 Tags
acc24f1237f3be7e87aa0ce51db1c54b34517218
Commit Graph
6823 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martynas Pumputis acc24f1237 Do not exclude k8s node without any IP addr in reclaim 
Otherwise, such node will be rmpeer'd which can lead to the IPAM
inconsistencies "Received update for IP range I own at <..>".
 2018-09-06 14:49:20 +03:00
Bryan Boreham 612e265123 Merge pull request #3391 from weaveworks/debug-log 
add documentation to enable debug logging
 2018-09-06 12:45:58 +01:00
Murali Reddy 9cf50588b5 remove weave-npc logging details 2018-09-06 11:45:02 +00:00
Murali Reddy 6c2de466c0 add documnetatin to enable debug logging 2018-09-06 11:44:53 +00:00
Martynas Pumputis dd5994c7cf Merge pull request #3379 from weaveworks/issue-3226 
add missing --token argument in help for `weave launch`

Fix #3226
 2018-08-17 11:15:53 +02:00
Murali Reddy e6ba59f029 add missing --token argument in help for weave launch 
Fixes #3226
 2018-08-17 14:40:05 +05:30
Bryan Boreham 8fb3da6fc8 Merge pull request #3371 from weaveworks/parse-labels 
Parse labels
 2018-08-10 13:33:22 +01:00
Bryan Boreham 1814bbd2f2 Test container args-parsing code 
Extract function just to parse args, so we can call it separately and
test it.
 2018-08-08 13:24:53 +00:00
Bryan Boreham 374fed4699 Support --label flag on run-container command 2018-08-08 13:24:53 +00:00
Martynas Pumputis e669ac6ef8 Merge remote-tracking branch 'origin/2.3' into 2.4 2018-07-30 10:03:56 +02:00
Martynas Pumputis 4263ac1ac5 Merge pull request #3362 from weaveworks/issues/3361-defunct-procs 
Print defunct processes if such exist
 2018-07-30 08:33:41 +02:00
Martynas Pumputis 8176048268 Print defunct processes if such exist 
Instead of printing their count. Helps to determine which
process causes the zombies.
 2018-07-28 15:27:10 +02:00
Martynas Pumputis e2d6ee4223 Add release v2.4.0 v2.4.0 2018-07-25 10:32:04 +02:00
Bryan Boreham 90a81ce736 Merge pull request #3319 from weaveworks/weave-reset-err 
Make error "Weave is not running" less confusing when running on Kubernetes
 2018-07-24 10:18:24 +01:00
Bryan Boreham 9cf0dd1b87 Merge pull request #3313 from weaveworks/issues/2624-egress-npc 
Implement Egress NPC
 2018-07-24 10:17:45 +01:00
Martynas Pumputis e65cf32372 npc: Flush chain if rules mismatch in AddChainWithRules 
Also, move the helper function to net/iptables.go.
 2018-07-24 10:06:55 +02:00
Martynas Pumputis 0ad2001ab4 npc: ACCEPT already established connections in egress chain 
It's safe to accept such connections as they will be accepted
in the ingress chain anyway.
 2018-07-24 10:06:55 +02:00
Martynas Pumputis 70ff510e49 npc: Document egress rules 2018-07-24 10:06:55 +02:00
Martynas Pumputis 6377aeabdd npc: Do not ignore errors when creating chains 
Also, move ensureRulesAtTop to net/iptables.go
 2018-07-24 10:06:55 +02:00
Martynas Pumputis 1649080a35 npc: Add ns name into ipBlock ipset name 
Otherwise, the same ipBlock ipset can be used among different namespaces which
results in panic as refcounting of ipsets happens only per namespace, so
npc will try to create the same ipset twice.
 2018-07-24 10:06:55 +02:00
Martynas Pumputis c1ee358f66 npc: Fix ipset package import path after rebase 2018-07-24 10:06:55 +02:00
Martynas Pumputis 2c708b57a1 npc: Improve analyser comments 2018-07-24 10:06:55 +02:00
Martynas Pumputis c5772c814c npc: Add comments for traffic steering 2018-07-24 10:06:55 +02:00
Martynas Pumputis 10a5b6fb51 npc: Use constants for chains 2018-07-24 10:06:55 +02:00
Martynas Pumputis 07d31a8558 npc: Get rid of the legacy netpol 2018-07-24 10:06:55 +02:00
Martynas Pumputis cf3a3be8f2 npc: Replace isNil by reflect.IsNil 2018-07-24 10:06:23 +02:00
Martynas Pumputis 49224ec9f7 npc: Rename policy{Ingress,Egress} to policyType{Ingress,Egress} 2018-07-24 10:06:23 +02:00
Martynas Pumputis dee24aec65 npc: Add integration test for egress 
Also, install dig (bind-tools) in the network-tester image.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 9a63ade1b5 npc: Do not create WEAVE-NPC-EGRESS* chains in legacy netpol mode 2018-07-24 10:06:23 +02:00
Martynas Pumputis 18a6237ec7 npc: Check whether weave-local-pods exists before creating 
We do not destroy it anymore, thus the check.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis be8298926a npc: Pass --use-legacy-netpol to weaver in 840 2018-07-24 10:06:23 +02:00
Martynas Pumputis 86958be6cf npc: Add --use-legacy-netpol flag to weaver 
Egress does not work in the legacy netpol mode, so in the legacy case
we don't have to create the egress traffic steering rules. Otherwise,
some traffic will be blocked.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis a2d07c85da npc: Remove WEAVE-NPC-EGRESS* chains upon "weave reset" 
Also, fix removal of rule which steers traffic for ingress
processing.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 295ddc5248 npc: Try not to clear WEAVE-NPC-EGRESS chain 
First check whether the chain exists with the required rules, and
if not - create it.

If we flush each time we start weave-npc then we create a (short)
time window during which all egress traffic is allowed.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis a85a19e40a npc: Add unit test for egress policy with ipblock 2018-07-24 10:06:23 +02:00
Martynas Pumputis cec3c8a846 npc: Add iptables mocked interface 2018-07-24 10:06:23 +02:00
Martynas Pumputis 7da7ce85df npc: Extend TestDefaultAllow unit test to include egress 2018-07-24 10:06:23 +02:00
Martynas Pumputis 6055431b6f npc: Refactor bypassRules 2018-07-24 10:06:23 +02:00
Martynas Pumputis c0e2deb5a0 npc: Add WEAVE-NPC-EGRESS-ACCEPT chain 
For improving readability of NPC rules. The chain marks to-be-allowed egress
traffic.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 1f86ed55ba npc: Ensure default-allow rules for egress 2018-07-24 10:06:23 +02:00
Martynas Pumputis 35f1ba17e1 npc: Provision egress rules 2018-07-24 10:06:23 +02:00
Martynas Pumputis b84fbf86ec npc: Add a dummy isNil method to ruleHost interface 2018-07-24 10:06:23 +02:00
Martynas Pumputis a5e0b3452d npc: Create rules with IPBlock (egress only) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 0a1ca30aae npc: Add getRuleSpec for ipBlockSpec 2018-07-24 10:06:23 +02:00
Martynas Pumputis 2e85018c26 npc: Add ruleHost interface 
The idea for the interface is taken from the kitt1987/ipblock work.

The interface is going to be implemented by selectorSpec and
ipBlockSpec.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis affdc6f5af npc: Provision networkingv1.IPBlock (only for Egress) 2018-07-24 10:06:23 +02:00
Martynas Pumputis 9198bb5a68 npc: Refactor npc/ipblock.go 
- No need to validate networkingv1.IPBlock fields as k8s does it.
- Fix provisioning.
 2018-07-24 10:06:23 +02:00
Kitt Hsu 9769c8d5b9 support ipblock in npc 
NOTE(brb): This commit is cherry-picked from the kitt1987/ipblock
branch.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 688328dc57 npc: Steer traffic for egress processing 
We need two rules:

* `-A INPUT -i weave -j WEAVE-NPC-EGRESS`: applies to packets destined
  to a local node.
* `-A FORWARD -i weave -j WEAVE-NPC-EGRESS`: the rest. It can match
  an ingress packet.
 2018-07-24 10:06:23 +02:00
Martynas Pumputis 8904a4b144 npc: Get rid of selectorSpec.target 
We treat selectorSpec as a target selector if len(selectorSpec.policyTypes) > 0.
 2018-07-24 10:06:23 +02:00