Bryan Boreham
e64656d16f
Specify https for security
2018-08-02 10:11:42 +00:00
Bryan Boreham
e3231bb373
Stop running VM creation in the background
...
There's nothing else happening in parallel in this step now.
2018-07-30 10:19:28 +00:00
Bryan Boreham
44e0c6add7
Try to fix failing test 840
2018-07-30 10:19:28 +00:00
Bryan Boreham
1a8794e90f
Run coverage analysis in separate step, and save results
...
Remove CircleCI 1.0 implementation which used scp to contact other
lanes.
Note we can't use an env var in store_artifacts clause
2018-07-30 10:18:57 +00:00
Bryan Boreham
e3576e13a7
Don't copy the source directory somewhere else
2018-07-30 10:16:18 +00:00
Bryan Boreham
b3e77e81ea
Split into several jobs
...
Run build, lint and unit-test steps in a container, using a pre-built
image to save rebuilding at CircleCI
Move a couple of scripts up to config.yml for clarity
2018-07-30 10:16:18 +00:00
Bryan Boreham
b13eb5ada5
Run gen_coverage as a 'deploy'
2018-07-30 10:16:18 +00:00
Bryan Boreham
6337972c8a
Don't need to pipe background commands to file in Circle 2.0
2018-07-30 10:16:18 +00:00
Bryan Boreham
8620d0ae4f
Change CircleCI config to 2.0 version
...
Environment variables are moved out to a script, because CircleCI 2.0
does not support expansion of '$foo' in 'env' section.
2018-07-30 10:16:18 +00:00
Bryan Boreham
fc77e33d1d
Move circleci config to 2.0 location
2018-07-30 10:09:07 +00:00
Bryan Boreham
0164d24583
Tag build image with current git commit
2018-07-30 10:09:07 +00:00
Bryan Boreham
76ee9874d6
Add coverage commands to build image
2018-07-30 10:09:07 +00:00
Bryan Boreham
3699f89b98
Add docker command to build container
2018-07-30 10:09:07 +00:00
Bryan Boreham
911751d0c1
Remove docs-only support in CI - docs moved to Netlify
2018-07-30 09:22:34 +00:00
Martynas Pumputis
e669ac6ef8
Merge remote-tracking branch 'origin/2.3' into 2.4
2018-07-30 10:03:56 +02:00
Martynas Pumputis
4263ac1ac5
Merge pull request #3362 from weaveworks/issues/3361-defunct-procs
...
Print defunct processes if such exist
2018-07-30 08:33:41 +02:00
Martynas Pumputis
8176048268
Print defunct processes if such exist
...
Instead of printing their count. Helps to determine which
process causes the zombies.
2018-07-28 15:27:10 +02:00
Martynas Pumputis
e2d6ee4223
Add release v2.4.0
2018-07-25 10:32:04 +02:00
Bryan Boreham
90a81ce736
Merge pull request #3319 from weaveworks/weave-reset-err
...
Make error "Weave is not running" less confusing when running on Kubernetes
2018-07-24 10:18:24 +01:00
Bryan Boreham
9cf0dd1b87
Merge pull request #3313 from weaveworks/issues/2624-egress-npc
...
Implement Egress NPC
2018-07-24 10:17:45 +01:00
Martynas Pumputis
e65cf32372
npc: Flush chain if rules mismatch in AddChainWithRules
...
Also, move the helper function to net/iptables.go.
2018-07-24 10:06:55 +02:00
Martynas Pumputis
0ad2001ab4
npc: ACCEPT already established connections in egress chain
...
It's safe to accept such connections as they will be accepted
in the ingress chain anyway.
2018-07-24 10:06:55 +02:00
Martynas Pumputis
70ff510e49
npc: Document egress rules
2018-07-24 10:06:55 +02:00
Martynas Pumputis
6377aeabdd
npc: Do not ignore errors when creating chains
...
Also, move ensureRulesAtTop to net/iptables.go
2018-07-24 10:06:55 +02:00
Martynas Pumputis
1649080a35
npc: Add ns name into ipBlock ipset name
...
Otherwise, the same ipBlock ipset can be used among different namespaces which
results in panic as refcounting of ipsets happens only per namespace, so
npc will try to create the same ipset twice.
2018-07-24 10:06:55 +02:00
Martynas Pumputis
c1ee358f66
npc: Fix ipset package import path after rebase
2018-07-24 10:06:55 +02:00
Martynas Pumputis
2c708b57a1
npc: Improve analyser comments
2018-07-24 10:06:55 +02:00
Martynas Pumputis
c5772c814c
npc: Add comments for traffic steering
2018-07-24 10:06:55 +02:00
Martynas Pumputis
10a5b6fb51
npc: Use constants for chains
2018-07-24 10:06:55 +02:00
Martynas Pumputis
07d31a8558
npc: Get rid of the legacy netpol
2018-07-24 10:06:55 +02:00
Martynas Pumputis
cf3a3be8f2
npc: Replace isNil by reflect.IsNil
2018-07-24 10:06:23 +02:00
Martynas Pumputis
49224ec9f7
npc: Rename policy{Ingress,Egress} to policyType{Ingress,Egress}
2018-07-24 10:06:23 +02:00
Martynas Pumputis
dee24aec65
npc: Add integration test for egress
...
Also, install dig (bind-tools) in the network-tester image.
2018-07-24 10:06:23 +02:00
Martynas Pumputis
9a63ade1b5
npc: Do not create WEAVE-NPC-EGRESS* chains in legacy netpol mode
2018-07-24 10:06:23 +02:00
Martynas Pumputis
18a6237ec7
npc: Check whether weave-local-pods exists before creating
...
We do not destroy it anymore, thus the check.
2018-07-24 10:06:23 +02:00
Martynas Pumputis
be8298926a
npc: Pass --use-legacy-netpol to weaver in 840
2018-07-24 10:06:23 +02:00
Martynas Pumputis
86958be6cf
npc: Add --use-legacy-netpol flag to weaver
...
Egress does not work in the legacy netpol mode, so in the legacy case
we don't have to create the egress traffic steering rules. Otherwise,
some traffic will be blocked.
2018-07-24 10:06:23 +02:00
Martynas Pumputis
a2d07c85da
npc: Remove WEAVE-NPC-EGRESS* chains upon "weave reset"
...
Also, fix removal of rule which steers traffic for ingress
processing.
2018-07-24 10:06:23 +02:00
Martynas Pumputis
295ddc5248
npc: Try not to clear WEAVE-NPC-EGRESS chain
...
First check whether the chain exists with the required rules, and
if not - create it.
If we flush each time we start weave-npc then we create a (short)
time window during which all egress traffic is allowed.
2018-07-24 10:06:23 +02:00
Martynas Pumputis
a85a19e40a
npc: Add unit test for egress policy with ipblock
2018-07-24 10:06:23 +02:00
Martynas Pumputis
cec3c8a846
npc: Add iptables mocked interface
2018-07-24 10:06:23 +02:00
Martynas Pumputis
7da7ce85df
npc: Extend TestDefaultAllow unit test to include egress
2018-07-24 10:06:23 +02:00
Martynas Pumputis
6055431b6f
npc: Refactor bypassRules
2018-07-24 10:06:23 +02:00
Martynas Pumputis
c0e2deb5a0
npc: Add WEAVE-NPC-EGRESS-ACCEPT chain
...
For improving readability of NPC rules. The chain marks to-be-allowed egress
traffic.
2018-07-24 10:06:23 +02:00
Martynas Pumputis
1f86ed55ba
npc: Ensure default-allow rules for egress
2018-07-24 10:06:23 +02:00
Martynas Pumputis
35f1ba17e1
npc: Provision egress rules
2018-07-24 10:06:23 +02:00
Martynas Pumputis
b84fbf86ec
npc: Add a dummy isNil method to ruleHost interface
2018-07-24 10:06:23 +02:00
Martynas Pumputis
a5e0b3452d
npc: Create rules with IPBlock (egress only)
2018-07-24 10:06:23 +02:00
Martynas Pumputis
0a1ca30aae
npc: Add getRuleSpec for ipBlockSpec
2018-07-24 10:06:23 +02:00
Martynas Pumputis
2e85018c26
npc: Add ruleHost interface
...
The idea for the interface is taken from the kitt1987/ipblock work.
The interface is going to be implemented by selectorSpec and
ipBlockSpec.
2018-07-24 10:06:23 +02:00
Bryan Boreham