reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,812 Commits 7 Branches 85 Tags
v1.9.8
Commit Graph
462 Commits
Author SHA1 Message Date
Bryan Boreham 2584335b11 Allow any non-local traffic onto the weave bridge 
If it's destined for a pod on another node it will be checked again
when it reaches that other node.  The previous version was rejecting
traffic coming in from outside the cluster.
 2017-06-12 17:00:57 +00:00
Maxim Filatov cb3b858df6 Weave-NPC should get hostname from K8s Downward API. 
It is necessary in case when kubelet's args includes `--hostname_override=`.
Without this change, pods on hostname overriding kubelets will never be local,
and all pod's traffic will be blocked.
 2017-05-31 18:06:17 +03:00
Bryan Boreham 2d3e070288 Let through connections from local pods to non-local pods 
This means we only filter connections at the destination end,
which is a better match for the ingress-only rules.
 2017-05-30 14:11:35 +00:00
Bryan Boreham 138141ac9b Ignore updates for pods on other nodes 2017-05-30 14:11:34 +00:00
Bryan Boreham fa56ad8bc3 Refactor: move logging of ipset entries down to ipset package 2017-05-30 14:11:33 +00:00
Bryan Boreham 9d29da8d27 Refactor creation of base iptables rules 2017-05-30 14:11:31 +00:00
Avi Deitcher c05955d598 First cut of adding hairpin functionality to weave 2017-05-30 10:30:49 +00:00
Mike Bryant 8668f6bb1e Flush weave ipsets before destroying 
ipsets can't be destroyed when there are references to them.
This takes the easy way out and flushes all weave ipsets first.

Fixes #2915
 2017-05-12 09:44:26 +01:00
Mike Bryant 95ee99d652 style: singular vs plural 2017-05-12 09:44:18 +01:00
Mike Bryant 9419ad16bf Clean up xt_set_exists components in advance 
If this function dies in the middle, the leftover weave-kube-test set
causes this function and weave-npc to break. In particular
this means we can never restart weave with the launch script.

Here we clean up in advance, in case there's leftovers from a previous run

Fixes #2934
 2017-05-08 12:15:23 +01:00
Marc Carré d128488339 Merge pull request #2926 from weaveworks/issues/2808-improve-hairpin-messages 
Fixes #2808. Improve hairpin log messages.
 2017-05-03 20:21:20 +01:00
Marc Carré c8c61adca4 Merge pull request #2907 from weaveworks/issues/2771-checkpoint-net-modes 
Add checkpoint flag per connection type
 2017-05-03 18:20:30 +01:00
Bryan Boreham 7c8f33f525 Add checkpoint flag per connection type 2017-05-03 16:56:49 +00:00
Bryan Boreham b19f2df6f8 Improve hairpin log messages 2017-05-03 14:35:20 +00:00
Bryan Boreham b3ac56e3d2 Update mesh library and check for errors newly returned 2017-05-03 11:08:28 +00:00
Bryan Boreham 24c2743a58 Check addresses are IPv4 in kube-peers 2017-04-28 11:05:38 +00:00
Mike Bryant e78be1fc35 fix(kube-peers): Add support for ExternalIP addresses 
Why:
* In some environments Nodes have an ExternalIP but no InternalIP

This change addresses the need by:
* Falling back to ExternalIP addresses if there isn't an InternalIP for a node
 2017-04-27 13:56:23 +01:00
Bryan Boreham d9ca54e777 Don't use Printf without a format 2017-03-21 11:38:35 +00:00
Bryan Boreham 1f6a6349a9 Remove useless 'break' 2017-03-21 11:38:35 +00:00
Bryan Boreham ef7571f1ef Can't catch SIGKILL 2017-03-21 11:38:35 +00:00
Bryan Boreham 9da5cee8d9 Rename Kubernetes daemonset to "1.6" 
To emphasise this is the version that adopters of Kubernetes 1.6 need
to use.
 2017-03-17 11:45:06 +00:00
Lucas Käldström 2e58e92d48 Add a weave-kube manifest that works for kubeadm v1.6 2017-03-17 11:43:48 +00:00
Bryan Boreham c3c28ea27e Update CNI library to version 0.5.0 2017-03-16 18:23:20 +00:00
Bryan Boreham 623abeef4c gofmt 2017-03-14 17:56:59 +00:00
Stephan Austermühle dc2925263c Destroy ipsets prefixed weave- only (issue #2751) 2017-03-14 17:56:59 +00:00
Marc CARRE 21a0fc30e8 Run weaver without exec. 
This:

1. prevents from generating defunct (a.k.a. zombie) processes, and therefore fixes #2836; but also
2. reintroduces #2684/#2688 as shells do not forward signals and we are still running more than one process.

A proper fix would leverage something like tini.
See also:

- github.com/krallin/tini
- github.com/krallin/tini/issues/8
- github.com/docker-library/official-images#init

Sample output:

- during initialisation:

```
$ ps auxf
[...]
root      1380  0.4  1.9 879660 74660 ?        Ssl  Mar13   6:02 /usr/bin/docker daemon -H fd:// -H unix:///
root      1664  0.0  0.4 502116 18528 ?        Ssl  Mar13   0:06  \_ docker-containerd -l /var/run/docker/li
root     15482  0.0  0.0 200496  3364 ?        Sl   15:04   0:00      \_ docker-containerd-shim 3d1f5eb6e090
root     15496  0.0  0.0   1524   996 ?        Ss   15:04   0:00      |   \_ /bin/sh /home/weave/launch.sh
root     15780  0.0  0.0   1524    64 ?        S    15:04   0:00      |       \_ /bin/sh /home/weave/launch.
root     15872  0.0  0.0   1772  1272 ?        S    15:04   0:00      |       |   \_ /bin/sh /home/weave/wea
root     15897  0.0  0.0   1772   324 ?        S    15:04   0:00      |       |       \_ /bin/sh /home/weave
root     15898  0.0  0.0  14656  2948 ?        S    15:04   0:00      |       |           \_ curl -o /tmp/we
root     15781 10.0  1.5 484556 60296 ?        Sl   15:04   0:00      |       \_ /home/weave/weaver --port=6
[...]
```

- after initialisation:

```
$ ps auxf
[...]
root      1380  0.4  1.9 879660 74660 ?        Ssl  Mar13   6:02 /usr/bin/docker daemon -H fd:// -H unix:///
root      1664  0.0  0.4 502116 18592 ?        Ssl  Mar13   0:06  \_ docker-containerd -l /var/run/docker/li
root     15482  0.0  0.0 200496  3364 ?        Sl   15:04   0:00      \_ docker-containerd-shim 3d1f5eb6e090
root     15496  0.0  0.0   1524   996 ?        Ss   15:04   0:00      |   \_ /bin/sh /home/weave/launch.sh
root     15781  2.3  1.6 503064 64320 ?        Sl   15:04   0:00      |       \_ /home/weave/weaver --port=6[...]
```
 2017-03-14 15:34:47 +00:00
Martynas Pumputis 3607cf2d7a Add check for xt_set module 
The check is based on actually trying to install an iptables rule
which uses the module.
 2017-03-01 10:37:43 +00:00
Martynas Pumputis a57cf4bc83 Ignore modprobe errors in weave-kube/launch.sh 
weave-kube is run by alpine image which uses busybox. modprobe of
busybox will return the "module not found" error [1], if a module is
built-in, which is an opposite behavior to modprobe distributed in
mainstream distros (e.g. ubuntu).

[1]: https://bugs.busybox.net/show_bug.cgi?id=5270
 2017-02-28 11:26:40 +00:00
Bryan Boreham cb73cf3f51 Ensure we have the kernel modules loaded for weave-npc 2017-02-27 12:32:57 +00:00
Martynas Pumputis 7a3e8e64b7 Merge pull request #2810 from ocadotechnology/add-pending-metrics 
Add prometheus metrics for pending Allocates and Claims
 2017-02-24 15:55:39 +00:00
Bryan Boreham f7c0da3ae1 Merge pull request #2781 from keontang/luanch-update 
Add CONN_LIMIT environment var for running container
 2017-02-23 12:40:01 +00:00
Mike Bryant fad537cad7 Add prometheus metrics for pending Allocates and Claims 2017-02-23 11:41:07 +00:00
Martynas Pumputis 32d44e09a1 Merge pull request #2787 from weaveworks/issues/2784-preclaim-addresses 
Claim existing IP addresses at startup with no race condition

Fixes #2784
 2017-02-13 17:51:38 +00:00
Bryan Boreham 7075b5d9fd Extend pre-existing address reclaim to docker containers 2017-02-13 11:30:34 +00:00
Bryan Boreham e26dbf11e9 Stop collecting addresses in launch script now we do it in Go 2017-02-10 15:11:14 +00:00
Bryan Boreham 39ac1a0037 Collect existing weave addresses at start-up, to avoid a race when 
doing it from the script

Note we need to run weaver in the host pid namespace, so it can search
for existing container IPs. Also now we are firing off sub-processes
it's better to not be PID 1 so Linux doesn't expect us to reap zombies.
 2017-02-10 15:10:02 +00:00
Jiyuan Tang bee031ad70 Add CONN_LIMIT environment for running container 2017-02-09 19:34:16 +08:00
Adam Harrison defa5cc3d3 Handle cache.DeleteFinalStateUnknown 2017-02-08 12:48:32 +00:00
Martynas Pumputis 5278eb7ebc Merge pull request #2747 from weaveworks/issues/2689-npc-mcast-simple 
Add rule to allow multicast at top level
 2017-02-01 18:20:38 +00:00
Martynas Pumputis 60323d0960 Add fastdp crypto 2017-01-31 17:21:01 +00:00
Marc CARRE ee659d4033 Replace weave/common/mflagext with common/mflagext. 
Removes duplication between weave and common and reduces the amount of sources to compile.
 2017-01-31 10:49:29 +00:00
Marc CARRE 8f9b2a36c0 Remove dep. on docker and use mflag from common. 
This reduces the number of dependencies, and avoids having docker as a vendored dependency, which should speed the build up.
 2017-01-31 10:30:12 +00:00
Tom Wilkie 590a151bde Move signal handling loop to common. 2017-01-26 17:55:19 +00:00
Lucas Käldström 29eee4e858 Fixing review feedback, adding checksums, etc 2017-01-24 17:24:04 +02:00
Lucas Käldström 454c6f713d Make Weave Net multi-architecture and add support for ARM and ARM 64-bit 2017-01-24 17:23:00 +02:00
Bryan Boreham f067c7d44e Add rule to allow multicast at top level 2017-01-23 12:11:44 +00:00
Adam Harrison 57a250a20b Pin alpine container version 2017-01-16 12:27:53 +00:00
Bryan Boreham 7d308a4ac5 Wire weaveutil unique-id into weave script 
Also ensure the right host directories are mounted when create-bridge
is called from either the weave script or weave-kube.
 2017-01-11 13:14:35 +00:00
Bryan Boreham ebcb7f6108 Use persisted peer name if it matches old-style ID 2017-01-11 13:14:35 +00:00
Bryan Boreham 70a20b4d26 Generate peer name / mac address in Go 2017-01-11 13:12:30 +00:00