- Test that pods not matching ingress rules are not able to access
the nettest pods.
- Test upgrading of NPC (from legacy to non-legacy).
- Test new semantics of k8s netpol.
The change makes "weave expose" to call the "/expose" HTTP
endpoint implemented in router which exposes the bridge.
Such architectural change required as we need to know whether NPC is
enabled when exposing the bridge and weaver knows this fact the best.
Unfortunately, this change makes impossible to "weave expose"
when weaver is not running.
Mount iptables lock file in weave-kube
iptables uses the file `/run/xtables.lock` so that if changes are
under way, another instance of the iptables command can wait till it
is finished.
We need to mount the lock file from the host to the container in order
for this mechanism to work at all.
Note we rely on kubelet touching the file before running any pods -
see https://github.com/kubernetes/kubernetes/pull/47212
Currently:
- there is no easy way to change the way we install Docker from Net
- if build-tools' default was to change, Net could break.
This change addresses this situation.
Before this change, when using Docker 17.06 we get:
tests/integration/container_test.py:121: in test_create_with_restart_policy
'You cannot remove a running container', err
E AssertionError: 'You cannot remove a running container' not found in u'You cannot remove a restarting container
The modified image simply checks for "You cannot remove a".
Remove tests of situations that don't exist any more and fix the following tests:
- Fix test 660: pass arguments in correct order.
- Fix test 620: no double launch, weave stop instead of kill -9.
- Now that router and proxy have been merged, we should only call `weave launch` once.
- `sudo kill -9` was introduced because we previously had `docker kill` (see: http://github.com/weaveworks/weave/commit/cb73b738621d57727072ae998cdeaec337f23a1a), because we had no `weave stop-proxy` yet (see: http://github.com/weaveworks/weave/commit/e31f21a6d224d61de1d8a940ea4b0b45cebc9723). Pre-proxy-merge, this should just have been `weave stop-proxy`, and now that router and proxy have been merged, we should just call `weave stop`.
- Fix test 650: no double launch.
- Fix test 630: remove redundant case & assertions.
- Fix test 090: remove irrelevant assertions.
PING
Given `proxy` & `router` processes have been merged, `launch-proxy`,
`launch-router`, `stop-proxy`, `stop-router` do not make sense any more, and
should just be `launch` and `stop` with the appropriate flags.
Note: we no longer need to detect awsvpc when launching.
The "AWS VPC" mode is now set via the `--awsvpc` flag.
Before we had to "detect" it when the proxy was potentially started
later, after the router had started.
We drop WEAVEPROXY_DOCKER_ARGS as obsolete.
Fixes:
- `test/run-integration-tests.sh:160:75: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh:265:56: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh:295:61: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh:309:49: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh:316:41: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh: run shfmt -i 4 -w test/run-integration-tests.sh`
See also: https://circleci.com/gh/weaveworks/weave/8685
Fixes:
- `test/run-integration-tests.sh:160:75: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh:265:56: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh:295:61: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh:309:49: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh:316:41: arithmetic expressions must consist of names and numbers`
- `test/run-integration-tests.sh: run shfmt -i 4 -w test/run-integration-tests.sh`
See also: https://circleci.com/gh/weaveworks/weave/8685
Renamed to "is_plugin_v1_enabled" and "is_plugin_v2_enabled".
Improve weave status and weave launch* err message when plugin-v2 is running
```
$ weave launch
Docker plugin "weaveworks/net-plugin" is running; Aborting.
$ weave status
<..>
Service: plugin (v2)
DriverName: weaveworks/net-plugin
```
This simplifies the following:
- plugin-v2 does not need to start "plugin" as a separate process, thus
Docker is able to properly restart plugin-v2 in a case of any child
process failing.
- No need for weaveplugin container.
plugin is enabled by default when running "weave launch". when starting
only the router, you should pass "--plugin" parameter to enable it.
The env var WEAVE_NO_PLUGIN is no more.
Since 1.12.0, `docker inspect -f "{{ .NetworkSettings.Networks.<network>.Aliases }}"` also returns the container's short ID.
See also: https://github.com/docker/docker/blob/master/CHANGELOG.md
> 1.12.0 (2016-07-28)
> Networking
> Add container's short-id as default network alias #21901
Upgrading `docker/docker-py` to 1.9.0-rc2 effectively relaxes test assertions for:
- `tests/integration/network_test.py#test_connect_with_aliases`
- `tests/integration/network_test.py#test_create_with_aliases`
which do something equivalent to:
```
$ docker network create net1
$ docker run --name c1 -d busybox top
$ docker network connect --alias foo --alias bar net1 c1
$ docker inspect -f "{{ .NetworkSettings.Networks.net1.Aliases }}" c1
[foo bar e52bf50e5ee7]
```
allowing us to be consistent with the above change.
In 1.8.1, the below fails as the container's short ID would be present:
```
self.assertEqual(
container_data['NetworkSettings']['Networks'][net_name]['Aliases'],
['foo', 'bar'])
```
In 1.9.0-rc2, the below passes as the container's short ID is ignored:
```
aliases = (
container_data['NetworkSettings']['Networks'][net_name]['Aliases']
)
assert 'foo' in aliases
assert 'bar' in aliases
```
Bryan Boreham