reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,524 Commits 7 Branches 85 Tags
cb0c9e5fba1a00a69bcac52ca5a038ad5ed1b219
Commit Graph
6524 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Brice Fernandes cb0c9e5fba Document: Add file-level docstrings for kube-peers 2017-11-14 14:06:33 +00:00
Brice Fernandes 6a0e39e5ee Minor refactor for clarity 2017-11-14 14:06:33 +00:00
Bryan Boreham a552f194b4 Code to reclaim IP address space from removed peers 2017-11-14 14:06:33 +00:00
Bryan Boreham 267bd8b51d Pseudo-code to clean up dead peers 2017-11-14 14:06:33 +00:00
Brice Fernandes 497dddabc1 Improve config locking by using optimistic locking strategy 
Loop using jitter until the update succeeds
 2017-11-14 14:06:33 +00:00
Bryan Boreham 71b39489da Maintain a list of peers in a Kubernetes annotation 
This is prework for a feature which will remove 'dead' peers
 2017-11-14 14:06:33 +00:00
Bryan Boreham ed8d92cfc6 RBAC to read and write ConfigMaps 2017-11-14 14:06:33 +00:00
Bryan Boreham f431ee289b Refactor: create config in main function 2017-11-14 14:06:33 +00:00
Bryan Boreham 21086a0b2a Merge branch '2.0' 2017-11-13 12:51:29 +00:00
Bryan Boreham d7119169df Add length to log message for too-big DF broadcast frame 2017-11-13 11:06:34 +00:00
Brice Fernandes 89e5d935a6 Document test runner feature to pick number of hosts 
Merge pull request #3164 from weaveworks/improve-test-docs
 2017-11-09 17:00:31 +00:00
Brice Fernandes 884e1d7a6b Document test runner feature to pick number of hosts 2017-11-09 15:48:21 +00:00
Bryan Boreham 5b1ca02ecc Merge pull request #3151 from weaveworks/issues/3105-k8s-17-netpolicies-whitelist 
Implement Kubernetes 1.7 NetworkPolicy semantics
 2017-11-07 16:31:01 +00:00
Martynas Pumputis f51347feac npc: Address PR comments 
* Add comments about presence of `analysePolicyLegacy` and `analysePolicy`.
* Use non-legacy netpol in TestRegressionPolicyNamespaceOrdering3059.
 2017-11-07 15:40:58 +02:00
Martynas Pumputis b605b832ed npc: Extend k8s NetworkPolicy smoke tests 
- Test that pods not matching ingress rules are not able to access
  the nettest pods.
- Test upgrading of NPC (from legacy to non-legacy).
- Test new semantics of k8s netpol.
 2017-11-07 14:55:03 +02:00
Bryan Boreham e148b72284 Merge branch '2.0' 2017-11-06 11:48:29 +00:00
Bryan Boreham 16db921349 Merge pull request #3128 from weaveworks/k8s-notes 
Added 'things to watch out for' section in Kubernetes instructions
 2017-11-03 10:59:35 +00:00
Bryan Boreham 4c235b3648 Merge pull request #3160 from weaveworks/2017-11-02-update-gopacket 
Update gopacket to latest master to benefit from memory optimization
 2017-11-03 10:32:35 +00:00
Damien Lespiau 1a8d479227 Update gopacket to latest master to benefit from memory optimization 
Upstream has done some work saving 133k allocated objects on startup (init()),
which translates into a saving of 30-50MB RSS memory.

Details: https://github.com/google/gopacket/pull/377#issuecomment-338984309
 2017-11-02 17:07:31 +00:00
Matthias Radestock 7aad364116 Merge pull request #3158 from weaveworks/2.0 
merge branch 2.0
 2017-10-31 08:11:17 +00:00
Matthias Radestock 4958d9e423 Merge pull request #3156 from weaveworks/3153-v2-plugin-dockerhub 
document using v2 plugin from dockerhub rather than store

Fixes #3153.
 2017-10-31 07:08:50 +00:00
Matthias Radestock 474f1f3673 document using v2 plugin from dockerhub rather than store 
Since the latter is hard to update and hence frequently out of date.

Fixes #3153.
 2017-10-30 20:43:45 +00:00
Martynas Pumputis 9aa7044f1e npc: Add unit tests for default-allow ipsets 2017-10-22 19:42:08 +02:00
Martynas Pumputis 7c39f96d08 npc: Implement networking.k8s.io/v1/NetworkPolicy semantics (k8s 1.7) 
The main difference between new and legacy (pre-1.7) netpol semantics
are the following:

    * The DenyDefault ingress isolation annotation is obsoleted.
    * Traffic is allowed to a pod if there are no netpol selecting
      the pod.

See https://kubernetes.io/docs/api-reference/v1.6/#networkpolicyspec-v1beta1-extensions
vs https://kubernetes.io/docs/api-reference/v1.7/#networkpolicyspec-v1-networking
for more details.

weave-npc can operate either in the legacy or the new mode (default). To
use the legacy, pass "--use-legacy-netpol" arg when starting the npc.

In non-legacy mode we create for each Namespace a default-allow ipset
which stores IP addrs of such Pods which are not selected by any
NetworkPolicy.The ipsets are dst's in rules of the WEAVE-NPC-DEFAULT chain.
 2017-10-22 19:37:18 +02:00
Martynas Pumputis 3c3e0b0352 Enable access to "networkpolicies" of "networking.k8s.io" API group 
Since 1.7, k8s netpol is no longer in beta, so NPC can start subscribing
from the non-beta API group.
 2017-10-22 19:32:52 +02:00
Martynas Pumputis 8467742d6d Increase smoke test timeout from 240 to 300 sec 
The 840 smoke test (k8s + npc) sometimes might take longer than 240 sec.
 2017-10-22 19:29:52 +02:00
Martynas Pumputis 5cfc3f8c47 Bump k8s version in smoke tests to 1.7.8 2017-10-22 19:29:21 +02:00
Bryan Boreham 62dbe03193 Don't log nil errors in CNI DEL 2017-10-17 16:13:48 +00:00
Martynas Pumputis 8755da4b5a Add smoke tests to check FORWARDing after 'expose' 2017-10-17 12:08:43 +01:00
Martynas Pumputis 25cff16bd1 Create WEAVE-EXPOSE iptables chain 
Docker 1.13 has changed a default policy of FORWARD chain to DROP
(https://github.com/moby/moby/pull/28257) which makes containers
inaccessible from a remote host when the bridge is exposed.

The change breaks e.g. the AWSVPC mode. To overcome this we install
an explicit rule for accepting forwarded ingress traffic to an
exposed subnet which is appended to the WEAVE-EXPOSE chain.

The chain is a target of the rule "-t filter -A FORWARD -o weave".
 2017-10-17 12:08:43 +01:00
Martynas Pumputis ade6738789 Handle "weave expose" in weaver 
The change makes "weave expose" to call the "/expose" HTTP
endpoint implemented in router which exposes the bridge.

Such architectural change required as we need to know whether NPC is
enabled when exposing the bridge and weaver knows this fact the best.

Unfortunately, this change makes impossible to "weave expose"
when weaver is not running.
 2017-10-17 12:08:43 +01:00
Bryan Boreham ea0e3a14e0 Merge branch '2.0' 2017-10-17 10:17:25 +00:00
Bryan Boreham 4a1a1e83c8 Update Python 'setuptools' module to resolve issue 
Symptom of issue was this message:

error in cryptography setup command: Invalid environment marker: platform_python_implementation != 'PyPy'
 2017-10-17 10:17:06 +00:00
Bryan Boreham ee48700b40 Merge pull request #3141 from bjhaid/upgrade_client_go 
Upgrading client go and vendoring its extra dependencies.
 2017-10-11 16:08:00 +01:00
Bryan Boreham 0791ce8ab0 Merge branch '2.0' 2017-10-11 10:49:13 +00:00
Ayodele Abejide 1ac543aba7 Upgrading client go and vendoring it's extra dependencies. 2017-10-10 16:48:35 +00:00
Bryan Boreham 3d5f80630d Merge pull request #3142 from weaveworks/fixnotes 
Fixnotes
 2017-10-10 16:10:00 +01:00
abuehrle be2da07735 fix note pins 2017-10-10 09:46:35 -05:00
Bryan Boreham 276d0b621b Add release v2.0.5 v2.0.5 2017-10-05 11:57:23 +00:00
Martynas Pumputis 6733dac9fc Merge remote-tracking branch 'origin/issues/3136-fix-etc-hosts' into 2.0 2017-10-05 13:18:41 +02:00
Martynas Pumputis 80b286ebf7 Merge pull request #3138 from weaveworks/issues/3136-fix-etc-hosts 
Add back EXEC_IMAGE so proxy can docker-run itself

Fixes #3136
 2017-10-05 13:14:16 +02:00
Bryan Boreham 2c143612e2 Add back EXEC_IMAGE so proxy can exec itself 2017-10-05 11:01:57 +00:00
Bryan Boreham be412812f9 Remove unused variable assignment 2017-10-05 10:45:51 +00:00
Bryan Boreham bfed7c24f8 Merge pull request #3129 from mkumatag/ppc64le_suuport 
Add ppc64le support
 2017-10-04 17:29:30 +01:00
Bryan Boreham fe859952e0 Merge branch '2.0' 2017-10-04 16:05:07 +00:00
Bryan Boreham 86361c5b60 Merge pull request #3137 from weaveworks/lint-nonsense 
Remove explicit error check at end of functions to placate lint
 2017-10-04 16:59:01 +01:00
Bryan Boreham 35c017a787 Remove explicit error check at end of functions to placate lint 
It's sad because this changes a regular pattern into an irregular one,
which will create spurious diffs if more work is added at the end of
the function.  Still, this is easier than fixing the lint runner to
ignore the report.
 2017-10-04 13:40:13 +00:00
Bryan Boreham 79d65bc98b Report errors from rewriting /etc/hosts 2017-10-04 13:32:52 +00:00
Brice Fernandes 6bc69199d3 Merge pull request #3135 from weaveworks/fix-build-osx 
Fix builds on OSX
 2017-10-04 14:00:18 +01:00
Brice Fernandes 292cbc484a Fix other occurences of GNU-specific sed invocation 2017-10-04 12:12:28 +01:00