reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,202 Commits 7 Branches 85 Tags
b0274e11be4c357ba73080304f224720daeeefab
Commit Graph
780 Commits
Author SHA1 Message Date
Bryan Boreham b0274e11be Fetch DNS listen address from daemon 
instead of assuming it's on the Docker bridge

Also move DNS address validation into NewDNSServer(),
so we only do it once.
 2020-07-31 11:58:56 +00:00
Bryan Boreham 00623be8a7 Merge pull request #3624 from weaveworks/trim-tools 
Remove some unused tools from the Weave docker containers
 2020-07-30 14:14:49 +01:00
Bryan Boreham 4d3e8d4a82 Merge pull request #3726 from weaveworks/slim-dependencies 
Slim utility binaries by reducing dependencies
 2020-07-30 14:13:47 +01:00
Bryan Boreham a3c76e141b Move name constants to separate 'chains' package, to reduce dependencies 
We don't want everyone that uses the `net` package to get a transitive
dependency on the Kubernetes APIs required by `npc`.
 2020-07-29 12:55:46 +00:00
Nesc58 f4009c39d8 wait added to iptables commands 2020-07-28 10:46:49 +02:00
Simon Howe 341bac9968 Rename Monitor -> MonitorForIptablesFlush 
- Makes it all a bit more explicit
 2020-07-24 15:04:28 +02:00
Simon Howe 899490c3f9 Removes disabling iptable canary 
- Should always be on. Simpler.
 2020-07-15 11:37:53 +02:00
Simon Howe 709b434f55 Clean up the Monitor go routine 2020-07-15 11:37:53 +02:00
Simon Howe 66eb80d841 Adds a CANARY chain and Monitor loop instead of reapplying iptables 2020-07-15 11:37:16 +02:00
Simon Howe 94e75e45af Make ConfigureIPTables idempotent and poll it 
- Instead of EnsureBridge
- Adds ipset.ExistEntry method
- Refactor ipset method names Exist <-> EntryExists
- Turn on iptable-refresh by default (10s)
- Adds a test that checks iptables are refreshed, check EXPOSE recovers
 2020-07-15 11:35:41 +02:00
Bryan Boreham a46d18da0c Use a more targeted iptables rule to block access to control port 
Only block the specific port Weave Net is listening on.
Add a comment so users know what the rule is for.

Remove the rule added in v2.6.3 because it was too coarse.
 2020-05-29 19:58:41 +00:00
Bryan Boreham 1f920513de Merge pull request #3804 from weaveworks/npc-errors-metrics2 
metric for NPC errors
 2020-05-23 20:43:55 +01:00
Bryan Boreham 09a204b978 NPC: increment metric each time an error is logged 2020-05-22 09:55:07 +00:00
Bryan Boreham 6ad3e69faf Plumb through /proc path config to Docker plugin 2020-05-18 14:47:26 +00:00
Murali Reddy 48015aa7be Weave-npc: while logging differentiate between fatal and non-fatal errors 2020-04-02 15:08:15 +05:30
Murali Reddy 5d0e44bb6f add missing dnsPolicy: ClusterFirstWithHostNet in weave-daemonset-k8s-1.11.yaml 
update apiVersion from rbac.authorization.k8s.io/v1beta1 to rbac.authorization.k8s.io/v1
 2020-02-11 13:15:33 +05:30
Murali Reddy 83024b946f use softlinks to link iptables to backend specific commands and update docs 2020-01-08 15:44:22 +05:30
Murali Reddy 4f48670345 set iptables backend to use if specified explicitly or auto-detect 2020-01-08 15:44:10 +05:30
Bryan Boreham 18deb42df1 Raise Kubernetes CPU requests from 10m to 50m 
This setting is passed by Kubelet to the Linux scheduler to ask for a share of
available CPU, so we should ask for a bit more than 1% of 1 CPU. Otherwise if a
CPU is contended Weave Net will get throttled frequently.

Weave Net in fastdp mode shouldn't need a lot of CPU most of the time, but at
startup there is quite a lot to do.

The setting is also used by the Kubernetes scheduler to decide how much will fit
on a node, so setting it much higher will reserve CPU that we shouldn't need most
of the time.
 2019-11-22 22:30:03 +00:00
Bryan Boreham b0d05f5e37 Increase default connection limit to 200 
Improvements in resource consumption in larger clusters mean we can
raise this limit.
 2019-11-05 14:21:24 +00:00
Michael Merrill 6a48da60ec Handling concurrent updates to configmap and IP reclamation (#3724) 
checking if peer to be removed has been removed by another pod

Signed-off-by: mmerrill3 <michael.merrill@vonage.com>
 2019-10-24 20:01:02 +01:00
Bryan Boreham 62c1d28524 Merge pull request #3716 from weaveworks/870-flake 
Randomise wait to reclaim IPs on node deletion, and fix flaky test 870
 2019-10-15 09:17:04 +01:00
Bryan Boreham 92b21ccd44 Merge pull request #3710 from weaveworks/exclude-self 
Exclude myself when building a list of peers that may need deleted
 2019-10-15 08:41:21 +01:00
Bryan Boreham cb5798f94d Merge pull request #3697 from christian-2/system-node-critical 
mark pods weave-net with priorityClassName: system-node-critical
 2019-10-12 12:00:13 +01:00
Bryan Boreham 821b787774 Move printing of node addresses after reclaim loop 
Otherwise we see all the node addresses in the middle of the log.
 2019-10-11 20:29:58 +00:00
Bryan Boreham 3ed7894e39 Debug log the node-deletion event 
So we know when it came in, also which node.
 2019-10-11 20:29:58 +00:00
Bryan Boreham f5c2f51964 Use a different seed for random numbers each run 
Without this, each run gets the same random numbers so all nodes are
racing to remove the deleted node.
 2019-10-11 20:29:58 +00:00
Bryan Boreham d1ed6c5747 Exclude myself when building a list of peers that may need deleted 
We already avoid actually doing the delete, but adding this check
stops the program logging that it was thinking about it.
 2019-10-10 13:22:20 +00:00
christian-2 6afedb881c mark pods weave-net with priorityClassName: system-node-critical 
* fixes #3691
* `weave-daemonset-k8s-1.11.yaml` is `weave-daemonset-k8s-1.9.yaml` plus `priorityClassName: system-node-critical`
* notice that a Kubernetes cluster created with `kubeadm` has its `kube-proxy`s marked as `system-node-critical` (and several other pods, such as `kube-apiserver` marked as `system-cluster-critical`)
 2019-09-04 14:16:46 +02:00
Sidharth Surana e90cbf290b Change the dnsPolicy for the weave-net pods to ClusterFirstWithHostNet 2019-08-30 10:12:57 -07:00
Bryan Boreham 1e0431f6b2 Merge pull request #3674 from weaveworks/weave-daemonset 
delete weave-daemonset.yaml
 2019-08-30 10:25:45 +01:00
Bryan Boreham ace2c12608 Merge pull request #3660 from Pensu/daemonset_api 
Move daemonset API to apps/v1
 2019-08-29 13:11:57 +01:00
Murali Reddy 9d485d0f21 delete weave-daemonset.yaml which predates the manifest weave-daemonset-k8s-1.6/1.7/1.8.yaml 
naming is counter intutive
 2019-08-29 11:37:55 +00:00
Peeyush Gupta 991945081a Move daemonset API to apps/v1 2019-08-29 13:57:16 +05:30
Bryan Boreham b07db6479a Merge pull request #3655 from tanishq-dubey/master 
Add tolerations for nodes tainted with NoExecute
 2019-08-28 11:11:26 +01:00
Reilly Brogan ef26b306e4 Forgot to make this change 2019-08-08 14:52:29 -05:00
Reilly Brogan 1588a7259d add newline 2019-08-08 14:43:48 -05:00
Reilly Brogan 3a92050ebb Add weave-npc wrapper script 2019-08-08 14:42:56 -05:00
Tanishq Dubey 959d0bf2e2 Add tolerations for nodes tainted with NoExecute 2019-06-30 00:27:57 -04:00
Murali Reddy 7a6ba40982 fix unit test failures 2019-05-30 15:58:18 +05:30
Bryan Boreham 4c6879679d Merge pull request #3639 from weaveworks/allowegress 
lazily add iptables rule to drop egress traffic from the pods only if network policies are applied
 2019-05-07 14:38:39 +01:00
Bryan Boreham 27848992b1 Merge branch '2.5' 2019-05-07 13:32:55 +00:00
Bryan Boreham 8a4fc9c02a Fix peer-list fuzz test to re-fetch list when it may be nil 2019-05-03 17:25:36 +00:00
Murali Reddy 4a1fbc7c38 lazily add iptables rule to drop egress traffic from the pods only 
if network policies are applied

does not address #3464 but just avoids the issue atleast for those who
dont use network policies
 2019-05-03 18:40:59 +05:30
Bryan Boreham eb7ba691ee Fetch storedPeerList after read from Kubernetes 
This avoids a race condition where the peer has added itself to the
list and the annotation since we read storedPeerList.
 2019-04-02 09:11:27 +00:00
Bryan Boreham fdf881420c Remove some unused tools from the Weave docker containers 
Use of `ethtool` was removed in #1958
`util-linux` was needed for `nsenter` which was removed in #3291
 2019-03-26 18:42:14 +00:00
Bryan Boreham 15b9b7416a Re-read peers ConfigMap from Kubernetes at start of every reclaim 
A previous reclaim may have left the map set to nil.
 2019-03-26 17:25:34 +00:00
Bryan Boreham 5024270232 Avoid panic on nil map 
It can be set to nil after a failed update; check rather than crashing.
 2019-03-26 17:20:24 +00:00
Bryan Boreham bd24dd7dae Make test harness and comments match Kubernetes behaviour on conflict error 
Kubernetes always returns nil on error; somehow I had the wrong idea
here.
 2019-03-26 17:19:22 +00:00
Bryan Boreham 9654df4d50 Merge pull request #3585 from weaveworks/0peers 
handle single node case where return peer list from kube-utils is empty
 2019-02-04 14:57:13 +00:00