If we have namespaces Source and Destination, and Destination
contains a NetworkPolicy allowing access from Source, we need
to provision the ipsets for Source and add them to relevant
selectors, even though Source is DefaultAllow.
This also fixes an issue where if the Namespace labels are updated,
that would be ignored.
Fixes#3059
Before this change, when using Docker 17.06 we get:
tests/integration/container_test.py:121: in test_create_with_restart_policy
'You cannot remove a running container', err
E AssertionError: 'You cannot remove a running container' not found in u'You cannot remove a restarting container
The modified image simply checks for "You cannot remove a".
There are 3 ways to get help:
• weave --help
• weave help
• weave <command> --help
At the moment, only the first one prints the usage instantaneously, the
others go much further in the script and take quite some time, which is
not idea of impatient users.
Note that "help" only works because it's not a recognized command and
ends up in the default case of "case $COMMAND" (and indeed, "Unknown
weave command 'help'" is displayed). This is because handle_help_arg()
always returns true and so the second part of:
handle_help_arg "$1" || handle_help_arg "--$1"
is never evaluated.
This commit changes things a bit so all 3 ways to get help are
recognized early, print the usage and exit.
Currently our `Makefile` and `bin/release` scripts are such that we effectively do the following when releasing:
```
publish:
for arch in [amd64 arm arm64]:
sub-publish:
clean_bin
publish
plugin_publish
```
which leads the Docker v2 plugin to contain `arm64` binaries even though we target `amd64`.
Swaping `publish` and `plugin_publish` is a simple way to avoid this.
The fix ensures that if odp is not supported (usually due to
missing openvswitch, vxlan or vport-vxlan kernel modules),
weaver will create the pcap based bridge instead of crashing.
`proxy_parse_args` is currently called:
- once, all the time
- again, if Docker is configured with TLS.
If a second call to `proxy_parse_args` happens, given the way we append to `PROXY_ARGS` and merge proxy and remaining args, genuine arguments like peers can be mixed with flags/options/etc. hence forming an invalid peers list and crashing Weave Net.
Just no-op instead.
This change is necessary because previously a recent build-tools
change no longer excludes prog/* from unit testing since other
projects actually do have genuine tests under there.
This behaviour was breaking the use of pod selectors for the 'from'
part of a rule.
Move checking of local pods into namespace.go so we can maintain
LocalIpSet correctly
Bryan Boreham