reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,262 Commits 7 Branches 85 Tags
b7a9947c2fabcbca41eab31e0d88fb19e959d51d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Bryan Boreham b7a9947c2f Remove manifests for Kubernetes 1.6 and 1.7 
They are ancient history; reduce maintenance load by removing
 2021-01-11 14:34:09 +00:00
Bryan Boreham a0ac81b3b4 Stop running in host PID namespace 
We shouldn't need this
 2020-12-17 12:49:27 +00:00
Bryan Boreham c6d0d140a4 Use newest manifest in k8s tests 2020-12-17 12:49:27 +00:00
Bryan Boreham 9bb14662e5 Add security policy 2020-12-17 11:52:07 +00:00
Bryan Boreham 414cbfb838 Simplify Kubernetes externalTrafficPolicy:local test 
There's no point stopping and starting the daemons now "no-masq-local"
is the default.
 2020-08-27 15:20:04 +00:00
Bryan Boreham 8c52698222 Move egress logging rule beside drop rule 
Otherwise we might log a blocked connection even though the packet
was not dropped.
 2020-08-26 10:02:32 +00:00
Bryan Boreham 30ce219794 Add release v2.7.0 2020-08-05 10:38:13 +00:00
Bryan Boreham 4795ba5807 Show stack-trace from panic in weave-npc 
Rather than exiting silently, fetch the stack trace and print that
for the user to understand what happened.

Exit via existing fatal-error code.
 2020-08-05 09:45:20 +00:00
Bryan Boreham 23a827088b Remove unused stopChan 2020-08-05 09:44:19 +00:00
Bryan Boreham 0ab2d08f0c Update docs now NO_MASQ_LOCAL is the default 2020-08-04 16:21:30 +00:00
Bryan Boreham 4d7e9931f9 Remove NO_MASQ_LOCAL setting from test 840 
now it's the default
 2020-08-04 16:21:30 +00:00
Bryan Boreham 2864d1ebc5 Use Go 1.14.4 in CI build 2020-08-04 10:11:30 +00:00
Bryan Boreham b3d387fb86 Update Kubernetes client packages to 0.18.6 
Lots of functions need Context parameters added
 2020-08-04 10:11:30 +00:00
Bryan Boreham d14502e071 Update Prometheus client to latest version 
Also let Prometheus export process and Go metrics
 2020-08-04 10:11:28 +00:00
Bryan Boreham 9439606c57 Update vendor files 2020-08-04 10:11:27 +00:00
Bryan Boreham feb05c0904 Move to Go modules: initial go.mod 2020-08-04 10:11:27 +00:00
Bryan Boreham 514695e127 Update Go version to 1.14.6 2020-08-04 10:11:27 +00:00
Bryan Boreham f9e27f76d6 Merge remote-tracking branch 'gobomb/fix-nil-ns-pointer' 
Needed a few modifications to resolve conflicts due to changed
datatype of UID.
 2020-08-03 12:32:31 +00:00
Bryan Boreham c50b3380ea Fix tests where newer Docker returns hex ID of container as network ID 2020-07-31 16:29:41 +00:00
Bryan Boreham aa9caab1b0 Fix incompatibility in Docker Python test 
Using code from https://github.com/bboreham/docker-py/tree/v1.9.0-prime

Also change to using Python 3 since 2.x is EOL.
 2020-07-31 16:29:41 +00:00
Bryan Boreham fab09693b9 Bump Docker to 19.03.1 for smoke tests 2020-07-31 14:52:46 +00:00
Bryan Boreham 9ffd0e3450 Fix up tests for DNS changes 
Now that `weave dns-args` doesn't parse any flags we need to
call it or not call it, which `start_container` will do for us.

Also add back the part of the test where we run weaver with and
without DNS, which had become lost in 8b061fd555

Also change a couple of tests to use proxy to start containers,
again to avoid needing `dns-args` to parse flags.
 2020-07-31 11:59:20 +00:00
Bryan Boreham 5b2311bb45 Remove obsolete args parsing from dns-args 
It was used as part of 'weave run'; does not make sense to support
--name, -h, etc., on 'weave dns-args'.
 2020-07-31 11:59:20 +00:00
Bryan Boreham b0274e11be Fetch DNS listen address from daemon 
instead of assuming it's on the Docker bridge

Also move DNS address validation into NewDNSServer(),
so we only do it once.
 2020-07-31 11:58:56 +00:00
Bryan Boreham 34dc4dabce Clean up some lint warnings 
I ran golangci-lint and it pointed out a few things to clean up.
 2020-07-31 10:28:55 +00:00
Bryan Boreham 28e482af14 Avoid some deprecated APIs 2020-07-31 10:28:55 +00:00
Bryan Boreham c197624689 Fix up incorrect output formatting 2020-07-31 09:03:27 +00:00
Bryan Boreham 00bc020498 Use Context instead of deprecated http.CloseNotifier interface 2020-07-31 09:03:27 +00:00
Bryan Boreham df52117bfa Remove unused code 2020-07-31 09:03:27 +00:00
Bryan Boreham 2cc5c635c9 Add 'encrypted' label to connections metric 
Extend tests to check it shows up.
Tests assume that metrics are published with metrics in alphabetical
order, which appears to be the case for now.
 2020-07-30 11:07:33 +00:00
Bryan Boreham 865e2b726f Ensure maps for connection counts are created before use 
We know all the expected states, so can pre-create maps
 2020-07-30 10:25:14 +00:00
Bryan Boreham f6a3af4a10 Add a check for correct metrics in smoke-test 2020-07-30 10:25:14 +00:00
Bryan Boreham 6bc656d66c Move address range helpers into address package 
This means that users don't drag in a dependency on aws-sdk.
 2020-07-29 13:08:35 +00:00
Bryan Boreham ca4f93d0d7 Remove the dependency of 'ipset' package on Kubernetes 
We don't want everyone that uses the `net` package to get a transitive
dependency on the Kubernetes APIs, so have it define the `UID` type.

Conceptually this is a simple change because `UID` is a `string`, but
unfortunately it is used in a lot of places.
 2020-07-29 13:08:35 +00:00
Bryan Boreham a3c76e141b Move name constants to separate 'chains' package, to reduce dependencies 
We don't want everyone that uses the `net` package to get a transitive
dependency on the Kubernetes APIs required by `npc`.
 2020-07-29 12:55:46 +00:00
Bryan Boreham 9928ddb401 Merge branch '2.6' 2020-07-27 17:44:11 +00:00
Bryan Boreham a90c0075c8 Typo 2020-06-17 17:03:13 +00:00
Bryan Boreham 1ff09fd4d1 Merge branch '2.6' 2020-06-10 17:15:14 +00:00
Bryan Boreham e0348233af Add release v2.6.5 2020-06-10 13:41:13 +00:00
Bryan Boreham 88799b36b2 Merge branch '2.6' 2020-06-04 17:53:53 +00:00
Bryan Boreham 27f8f9092f router: tell goroutine to exit when forwarder is stopped 
Otherwise a goroutine is leaked each time a connection is closed.
 2020-06-04 17:46:18 +00:00
Bryan Boreham 7174738d9d Don't exit if machine has no ipv6 installed 
We are trying to turn off `accept_ra`, so if we get an error that the
option doesn't exist we can just ignore it.
 2020-06-04 16:12:38 +00:00
Bryan Boreham 11d75b27a6 Merge branch '2.6' 2020-05-30 12:13:46 +00:00
Bryan Boreham c7a235a54a Add release v2.6.4 2020-05-30 10:11:08 +00:00
Bryan Boreham 9d669c3312 Merge branch '2.6' 2020-05-29 19:59:33 +00:00
Bryan Boreham d45579bf82 Allow time for network policy changes to take effect 
Also change from waiting longer to polling until connections are
established after restarting Weave Net.
 2020-05-29 19:59:13 +00:00
Bryan Boreham a46d18da0c Use a more targeted iptables rule to block access to control port 
Only block the specific port Weave Net is listening on.
Add a comment so users know what the rule is for.

Remove the rule added in v2.6.3 because it was too coarse.
 2020-05-29 19:58:41 +00:00
Bryan Boreham 7c2084b9af Move ansible install out from every CI run 
to only where we create images.
 2020-05-29 13:33:30 +00:00
Bryan Boreham ac54cfb753 Merge branch '2.6' 2020-05-29 09:02:12 +00:00
Bryan Boreham f78c4dacc5 Add release v2.6.3 2020-05-28 10:12:54 +00:00
Bryan Boreham 6ee961b068 Block non-local traffic to the Weave control port 
We expect the loopback address 127.0.0.1 to be accessible only from
the local host.

We need to allow RELATED,ESTABLISHED traffic which may be the return
path of a Kubernetes HostPort.
 2020-05-27 16:43:50 +00:00
Bryan Boreham 0d4099bba5 Clarify the purpose of the net-dev Slack channel 2020-05-27 10:58:59 +00:00
Bryan Boreham 21c7bb3ff6 Merge branch '2.6' 2020-05-26 08:31:53 +00:00
Bryan Boreham 09a204b978 NPC: increment metric each time an error is logged 2020-05-22 09:55:07 +00:00
Bryan Boreham 6ad3e69faf Plumb through /proc path config to Docker plugin 2020-05-18 14:47:26 +00:00
Bryan Boreham e2088ef401 Disable accept_ra setting on interfaces we create 2020-05-14 10:21:41 +00:00
Bryan Boreham 0f3864968e refactor: supply /proc path to CreateAndAttachVeth() 
Move the assumptions about where we're running up towards the caller.
 2020-05-14 10:21:09 +00:00
Bryan Boreham ff9bcdf561 Merge branch '2.6' 2020-05-08 10:30:27 +00:00
Bryan Boreham 06b0a82465 Merge branch '2.6' 2020-03-12 10:38:59 +00:00
Bryan Boreham 0ca831f50b Reduce pcap timeout to avoid overflow 
The value is passed by google/gopacket into a signed 32-bit int, so we
must pick a timeout which is less than 2^31 microseconds.

See https://github.com/google/gopacket/issues/708
 2020-03-11 12:21:07 +00:00
Bryan Boreham 9f00f78d3b Merge branch '2.6' 2020-02-26 14:44:51 +00:00
Bryan Boreham 6e7a469a62 Note different ways to ask for static IPs 2020-02-05 09:57:12 +00:00
Bryan Boreham ca0498b860 Fix warning log to use formatted variant 2020-01-28 15:15:28 +00:00
Bryan Boreham bbfa682083 Move send of ipsec message outside lock 
The send may block, so do all changes to the forwarder object and
release the lock before attempting to send.
 2020-01-28 15:13:33 +00:00
Bryan Boreham f763c40c10 Update connection limit in docs 2020-01-28 12:53:14 +00:00
Bryan Boreham 6a458d0712 Merge branch '2.6' 2020-01-27 17:51:32 +00:00
Bryan Boreham 861395011c Update Ruby version for the benefit of Netlify build 
Picked 2.6.2 based on message from Netlify build:
"Included versions: 2.3.6 2.5.4 2.4.5 2.4.3 2.2.9 2.6.2"
 2020-01-27 17:05:46 +00:00
Bryan Boreham 526538d9d1 Merge branch 'master' into 2.6 2019-12-07 11:55:16 +00:00
Bryan Boreham 7c1b615c98 Add a note about dropping CAP_NET_RAW in Kubernetes 2019-12-04 21:04:55 +00:00
Bryan Boreham 390a4099d0 Merge branch '2.6' 2019-11-28 20:47:39 +00:00
Bryan Boreham 01237446eb Update docs to match new memory requests 2019-11-22 23:23:55 +00:00
Bryan Boreham 18deb42df1 Raise Kubernetes CPU requests from 10m to 50m 
This setting is passed by Kubelet to the Linux scheduler to ask for a share of
available CPU, so we should ask for a bit more than 1% of 1 CPU. Otherwise if a
CPU is contended Weave Net will get throttled frequently.

Weave Net in fastdp mode shouldn't need a lot of CPU most of the time, but at
startup there is quite a lot to do.

The setting is also used by the Kubernetes scheduler to decide how much will fit
on a node, so setting it much higher will reserve CPU that we shouldn't need most
of the time.
 2019-11-22 22:30:03 +00:00
Bryan Boreham 5c508f837e Add manifest for Kubernetes 1.11 and above 2019-11-11 10:15:53 +00:00
Bryan Boreham e000472af7 Release 2.6 2019-11-05 19:40:45 +00:00
Bryan Boreham 6d70284c21 Increase default connection limit to 200 
Improvements in resource consumption in larger clusters mean we can
raise this limit.
 2019-11-05 19:40:45 +00:00
Bryan Boreham 4529d1587c Release 2.6 2019-11-05 16:12:30 +00:00
Bryan Boreham b0d05f5e37 Increase default connection limit to 200 
Improvements in resource consumption in larger clusters mean we can
raise this limit.
 2019-11-05 14:21:24 +00:00
Bryan Boreham 3780ce4dfb Update Weave Mesh library to 0.4 2019-11-05 12:26:14 +00:00
Bryan Boreham b871c1eecb Delete test binary committed in error 2019-11-05 12:16:45 +00:00
Bryan Boreham 9a6d0c9cf5 Remove the need for a third host in test 320 
This was necessary when we didn't have ipam persistence, as the
comment said "to remember the IPAM CRDT when we stop host2".
But we have persistence to hold the CRDT so we don't need host3.

Rename the test so the test runner only gives it 2 hosts.
 2019-11-04 16:13:46 +00:00
Bryan Boreham d2c78d3196 Tell 'timeout' to use signal 9, so command dies immediately 
We were seeing flakes in test 320, seemingly because the 'docker run'
command would sometimes send a delete request for the container it had
started, before dying.

We need the container to carry on running so we can check it does get
attached when the cluster reaches quorum. Sending signal 9 means the
command dies immediately and does not get a chance to delete the
container.
 2019-11-01 16:39:34 +00:00
Bryan Boreham a43bd88ddd Add the error message why an IP claim is denied 2019-10-25 17:13:59 +00:00
Bryan Boreham e8fcd21baa Retry IP allocator claims 
It may be that we cannot talk to a peer straight away, so allow claims
to be retried a few times before giving up.
 2019-10-25 17:13:11 +00:00
Bryan Boreham 80e9dee9b2 Update CI image again 2019-10-22 11:19:51 +00:00
Bryan Boreham 5110a604f8 Bump to Go 1.13.3 2019-10-22 09:31:31 +00:00
Bryan Boreham 404f1bbef3 Bump image used in CI to Go 1.13.1 2019-10-15 09:29:38 +00:00
Bryan Boreham 56491b35f1 Go 1.13 needs different static linking flags 
We don't need to pre-build the Go standard library or use -i flag
either - Go sorts that all out for us now.
 2019-10-15 09:29:38 +00:00
Bryan Boreham dd70668b89 Update tools submodule to latest commit f041a74ffbf2 2019-10-15 09:29:38 +00:00
Bryan Boreham e5441b44e9 Bump Go version in build container to 1.13.1 2019-10-15 09:27:45 +00:00
Bryan Boreham 4da2501d7a Add sleeps in tests for topology gossip to propagate 
The new weaveworks/mesh version defers topology updates by up to 1
second, so we can't expect to connect two nodes and immediately ping
between them.
 2019-10-15 09:01:00 +00:00
Bryan Boreham 04680fc52c Update weaveworks/mesh to v0.3 2019-10-15 09:01:00 +00:00
Bryan Boreham 88cd86a5f2 Add checksum file for s390x qemu binary 2019-10-12 12:45:17 +00:00
Bryan Boreham b18c88524d Merge branch '2.5' 2019-10-12 11:10:09 +00:00
Bryan Boreham 90e0c43bf2 Add a note on how to secure the Kubernetes Addon configuration. 
Original author Vladimir Pouzanov <farcaller@google.com>
 2019-10-12 11:08:57 +00:00
Bryan Boreham 79e032c984 Reduce time test script waits for IPs to be reclaimed 
Now we have a callback when a node is removed, there should be no
reason to wait 90 seconds.

The reclaim does wait up to 5 seconds before starting, so allowing 10
seconds in the script should be sufficient.
 2019-10-11 20:29:58 +00:00
Bryan Boreham 821b787774 Move printing of node addresses after reclaim loop 
Otherwise we see all the node addresses in the middle of the log.
 2019-10-11 20:29:58 +00:00
Bryan Boreham 3ed7894e39 Debug log the node-deletion event 
So we know when it came in, also which node.
 2019-10-11 20:29:58 +00:00
Bryan Boreham 30ed34bd2c Shut down Kubernetes in test of deleted node 2019-10-11 20:29:58 +00:00
Bryan Boreham f5c2f51964 Use a different seed for random numbers each run 
Without this, each run gets the same random numbers so all nodes are
racing to remove the deleted node.
 2019-10-11 20:29:58 +00:00
Bryan Boreham d1ed6c5747 Exclude myself when building a list of peers that may need deleted 
We already avoid actually doing the delete, but adding this check
stops the program logging that it was thinking about it.
 2019-10-10 13:22:20 +00:00