Mike Bryant
de1d409c6a
Fix review comments
2017-08-23 09:40:44 +01:00
Mike Bryant
2555e491e1
fix: Missing nil checks
...
Fixes #3095
2017-08-23 01:21:15 +01:00
Mike Bryant
e10ce2345b
Add comments to iptables rules and ipsets
...
Fixes #2621
2017-07-17 11:00:08 +01:00
Mike Bryant
cbc3d5b04c
Don't bypass selector provisioning when not default deny
...
If we have namespaces Source and Destination, and Destination
contains a NetworkPolicy allowing access from Source, we need
to provision the ipsets for Source and add them to relevant
selectors, even though Source is DefaultAllow.
This also fixes an issue where if the Namespace labels are updated,
that would be ignored.
Fixes #3059
2017-07-14 14:45:41 +01:00
Mike Bryant
219b03cb6b
Add regression test for weave-npc race condition
2017-07-14 14:45:41 +01:00
Mike Bryant
c33cd2657c
Refactor iptables usage in weave-npc to make it testable
2017-07-14 14:45:41 +01:00
Bryan Boreham
ced84955d3
Stop ignoring local pods
...
This behaviour was breaking the use of pod selectors for the 'from'
part of a rule.
Move checking of local pods into namespace.go so we can maintain
LocalIpSet correctly
2017-06-22 14:16:53 +00:00
Bryan Boreham
8e418b8743
More logging for namespace changes
2017-06-22 13:51:05 +00:00
Bryan Boreham
8a1f8d549e
Let through connections from local pods to non-local pods
...
This means we only filter connections at the destination end,
which is a better match for the ingress-only rules.
2017-05-19 15:17:20 +00:00
Bryan Boreham
a2b674e094
Ignore updates for pods on other nodes
2017-05-19 15:17:20 +00:00
Bryan Boreham
c4796dcdf5
Refactor: move logging of ipset entries down to ipset package
2017-05-19 15:17:20 +00:00
stuart.warren
9cbf0289d8
fix(npc): create ipsets with only valid xml characters
...
Why:
* xml output of ipset is invalid because ipset itself doesn't appear to
escape invalid chars
* fixes #2958
2017-05-15 11:20:04 +01:00
Bryan Boreham
5f30846092
Unwind changes to doExec and handle List() error differently
...
exec.Output() already wraps the stderr output, so we don't need to do that.
2017-03-14 17:56:59 +00:00
Bryan Boreham
6ddbc5cb57
Simplify List()
2017-03-14 17:56:59 +00:00
Stephan Austermühle
dc2925263c
Destroy ipsets prefixed weave- only (issue #2751 )
2017-03-14 17:56:59 +00:00
Bryan Boreham
201321f390
Remove refcounts on destroy and flush
2017-02-14 10:50:22 +00:00
Bryan Boreham
3afc528c88
Reference-count ipset entries
2017-02-14 10:26:59 +00:00
Adam Harrison
ae0cb5d483
SIGKILL ulogd on weave-npc exit
2017-01-11 14:12:01 +00:00
liubog2008
1635093341
fix a bug of updating network policy
2016-12-28 14:12:06 +08:00
Bryan Boreham
7d8a18bd20
Change rest of npc to weave common logging
2016-12-13 13:52:48 +00:00
Bryan Boreham
6a04c6c7bd
Change to weave common logging
2016-12-07 11:53:31 +00:00
Bryan Boreham
8530528dd5
Drop pod log messages to Debug level
2016-12-07 11:51:53 +00:00
Bryan Boreham
8a45292e24
Log objects via JSON for better debugging
2016-12-06 17:40:17 +00:00
Bryan Boreham
16fca913de
Merge branch '1.8'
2016-11-24 15:27:36 +00:00
Marc CARRE
48569265e2
Add logging of connection blocked by Weave NPC.
2016-11-24 14:02:22 +00:00
Adam Harrison
ef270764f3
Merge branch '1.8'
...
Fixes #2632 .
2016-11-22 15:28:03 +00:00
Bryan Boreham
4219c2c2ab
Only look at IP addresses on pods that haven't finished
2016-11-22 13:49:28 +00:00
Adam Harrison
915638d17a
Address linter failures
2016-11-14 15:13:19 +00:00
Adam Harrison
19088ba8bc
Import from weave-npc repo
2016-11-02 11:28:59 +00:00
Mike Bryant