reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,975 Commits 7 Branches 85 Tags
v2.5.2
Commit Graph
730 Commits
Author SHA1 Message Date
Bryan Boreham 8a4fc9c02a Fix peer-list fuzz test to re-fetch list when it may be nil 2019-05-03 17:25:36 +00:00
Bryan Boreham eb7ba691ee Fetch storedPeerList after read from Kubernetes 
This avoids a race condition where the peer has added itself to the
list and the annotation since we read storedPeerList.
 2019-04-02 09:11:27 +00:00
Bryan Boreham 15b9b7416a Re-read peers ConfigMap from Kubernetes at start of every reclaim 
A previous reclaim may have left the map set to nil.
 2019-03-26 17:25:34 +00:00
Bryan Boreham 5024270232 Avoid panic on nil map 
It can be set to nil after a failed update; check rather than crashing.
 2019-03-26 17:20:24 +00:00
Bryan Boreham bd24dd7dae Make test harness and comments match Kubernetes behaviour on conflict error 
Kubernetes always returns nil on error; somehow I had the wrong idea
here.
 2019-03-26 17:19:22 +00:00
Bryan Boreham 27178b1c79 Check and report the error return from getKubePeers() 2019-01-15 11:15:36 +00:00
Murali Reddy 99e360ce3b skip egress network policies for the traffic node->bridge ip 2018-12-04 09:43:50 +05:30
Murali Reddy 06669325a7 add --physdev-is-bridged flag when using physdev module for iptables 
rules created by weave-npc to prevent warning in kernel logs

Fixes #3449
 2018-11-20 13:34:10 +05:30
Bryan Boreham a5161b28f5 Merge pull request #3399 from weaveworks/rmpeer 
watch for Kubernetes node delete events and reclaim removed peers IP space on delete event
 2018-11-01 11:08:53 +00:00
Murali Reddy c48c746791 replace peerlist with current set of Kubernetes nodes 2018-10-31 18:06:48 +05:30
Murali Reddy d3c5241f12 addressing review comments 2018-10-31 17:26:55 +05:30
Murali Reddy 427d694e1b add checkpoint to include Kubernetes cluster information 
Fixes #3324
 2018-10-30 13:33:12 +05:30
Murali Reddy f334575e69 perform weave connect replace on node delete with empty peer list 2018-10-30 11:54:59 +05:30
Murali Reddy ea423755cc review comment: removing unnessary verbose code 2018-10-30 10:56:05 +05:30
Murali Reddy 4a40380d0f addressing review comments 2018-10-24 13:45:35 +05:30
Murali Reddy df467be26e watch for node delete events and call reclaimRemovedPeers 2018-10-24 13:45:35 +05:30
Bryan Boreham bf9985b0c8 Merge pull request #3423 from weaveworks/issue-3344 
Replace weave-local-pods ipset with physdev iptables rule
 2018-10-17 18:03:26 +01:00
Murali Reddy 408e5f7bdd make error message more appropriate 2018-10-17 21:16:52 +05:30
Murali Reddy d351b9f020 remove weave-local-pods ipset which no longer used by weave-npc 2018-10-17 15:34:46 +05:30
Bryan Boreham 965b5c627e Merge pull request #3421 from weaveworks/2018-09-28-moar-initialDelaySeconds 
kubernetes: Morph the livenessProbe into readinessProbe
 2018-10-16 14:46:34 +01:00
Murali Reddy d00e7335bb dont maintain weave-local-pods ipset on pod add/delete/update 2018-10-16 14:02:23 +05:30
Murali Reddy e3eb16a1f9 addressing review comments 2018-10-09 11:21:47 +05:30
Murali Reddy 59c1abe9b9 addressing review comments 2018-10-04 14:08:56 +05:30
Murali Reddy 4f9f0dfc3e Replace weave-local-pods ipset with physdev iptables rule 
by-pass ingress network policy chains and accept the packet if
destination is not one of the local pods

return the packets so the egress network policy chains are skipped
in case packet's source is not one of the local pods

Fixes #3344
 2018-10-02 11:02:36 +05:30
Damien Lespiau 8d44f49edd kubernetes: Morph the livenessProbe into readinessProbe 
The liveness probe has the not-so-great side effect of killing the weave pods
if anything goes wrong, making debugging really difficult.

Not only that, we also bumped into the livenessProbe killing pods before they
had a chance to start (see below for the full story).

The readinessProbe is only used for Kubernetes Services: no traffic will be
routed to non-Ready pods when using the Service IP. We can use to to signal the
user something in wrong with Weave Net while not having Kubernetes delete the
pods behind our backs.

I removed the ininitialDelaySeconds field as Kurbernetes won't kill the pod if
not ready.

Notes from a debugging session:

Some nodes may have a vast amount of iptables rules, making each iptables
command take a few seconds (~5-10s). At startup, when the weave container
creates its chains, it runs quite a few iptables commands and the total time of
execution was > 30s.

It's important to note that, at this point, the weave process hasn't started as
those iptables commands are run by an initial script.

Kubernetes was trying to check for the container liveness, was failing, and
then proceeded to kill the weave pods before they had a chance to fully start.
 2018-09-28 15:50:39 +01:00
Murali Reddy 7a959df648 handles an edge case where peer claimed to own the action (to reclaim) but no longer 
exists hence lock persists foever, fix makes a peer own the reclaim when nonexistent node found

Fixes #3386
 2018-09-27 16:00:44 +05:30
Martynas Pumputis 66bd443183 Merge remote-tracking branch 'origin/2.4' 2018-09-12 18:25:30 +03:00
Bryan Boreham 008eeb03ad Improve comments and error checking 2018-09-12 14:11:09 +00:00
Bryan Boreham 41c48dc678 Update test to call reclaimPeer() 2018-09-12 14:11:09 +00:00
Bryan Boreham 09be35dee0 Fetch stored peer list every time round the retry loop 
This ensures we take account of other peers' updates and closes a race
condition whereby another peer's changes can be overwritten.
 2018-09-12 14:11:09 +00:00
Bryan Boreham c3ad641d94 Refactor: extract reclaimPeer() function 2018-09-12 14:11:09 +00:00
Bryan Boreham bacb3952a3 Fetch Kubernetes node list every time round reclaim loop 
If we retain the Kubernetes list for a long time we might see a peer
appear in the Weave list and conclude it has been deleted. We must
always fetch the Kubernetes list after fetching the Weave list, during
deletion.
 2018-09-12 14:10:59 +00:00
Bryan Boreham 70257a6c19 Add test for kube-utils peer list 
- In parallel on several goroutines, randomly add and remove peers.
 - Maintain the test's own idea of current state.
 - Check that the test's state and kube-utils' state are consistent.
 2018-09-12 12:37:16 +00:00
Bryan Boreham bfe9f00e55 Fake kubernetes API which implements optimistic locking 
Mostly copied from kubernetes/client-go files
 2018-09-12 12:37:16 +00:00
Bryan Boreham 591be2d08f Refactor: Introduce an interface so weave client can be mocked 2018-09-12 12:37:16 +00:00
Bryan Boreham c3ce052cc5 Refactor: use Kubernetes.Interface instead of *Clientset 
So we can call with a mock for testing
 2018-09-12 12:35:34 +00:00
Bryan Boreham 7dcd4bdf47 Refactor: extract peerlist fns to new file 2018-09-12 12:35:34 +00:00
Martynas Pumputis 79d812a9c2 Merge remote-tracking branch 'origin/2.4' 2018-09-12 13:58:08 +03:00
Martynas Pumputis 78e00f9a3a Merge pull request #3397 from weaveworks/issues/3394-delete-old-me 
Reclaim IPs when node name is re-used
 2018-09-12 13:57:12 +03:00
Bryan Boreham 2ff0bbe150 Reclaim IPs when node name is re-used 
Change the map used to reclaim peers so it is indexed by PeerName
which should be unique over time, rather than NodeName which can be
re-used.  Create an auxilliary set of NodeNames to help.

This way, if we can see that a different peer was previously running
with the same node name, it can be included for reclaim.
 2018-09-10 15:10:51 +00:00
Martynas Pumputis a182bd4514 Merge pull request #3388 from myENA/feature/skip-nat-via-weave-expose 
add --without-masquerade option to `weave expose`
 2018-09-10 15:45:52 +03:00
Martynas Pumputis acc24f1237 Do not exclude k8s node without any IP addr in reclaim 
Otherwise, such node will be rmpeer'd which can lead to the IPAM
inconsistencies "Received update for IP range I own at <..>".
 2018-09-06 14:49:20 +03:00
Aaron Hurt 4b9c533b94 add the ability to skip creation of MASQUERADE rules via iptables when executing weave expose command 2018-08-31 11:46:31 -05:00
Bryan Boreham 1814bbd2f2 Test container args-parsing code 
Extract function just to parse args, so we can call it separately and
test it.
 2018-08-08 13:24:53 +00:00
Bryan Boreham 374fed4699 Support --label flag on run-container command 2018-08-08 13:24:53 +00:00
Martynas Pumputis e65cf32372 npc: Flush chain if rules mismatch in AddChainWithRules 
Also, move the helper function to net/iptables.go.
 2018-07-24 10:06:55 +02:00
Martynas Pumputis 0ad2001ab4 npc: ACCEPT already established connections in egress chain 
It's safe to accept such connections as they will be accepted
in the ingress chain anyway.
 2018-07-24 10:06:55 +02:00
Martynas Pumputis 70ff510e49 npc: Document egress rules 2018-07-24 10:06:55 +02:00
Martynas Pumputis 07d31a8558 npc: Get rid of the legacy netpol 2018-07-24 10:06:55 +02:00
Martynas Pumputis 9a63ade1b5 npc: Do not create WEAVE-NPC-EGRESS* chains in legacy netpol mode 2018-07-24 10:06:23 +02:00