reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,159 Commits 7 Branches 85 Tags
v2.6.4
Commit Graph
769 Commits
Author SHA1 Message Date
Bryan Boreham a46d18da0c Use a more targeted iptables rule to block access to control port 
Only block the specific port Weave Net is listening on.
Add a comment so users know what the rule is for.

Remove the rule added in v2.6.3 because it was too coarse.
 2020-05-29 19:58:41 +00:00
Bryan Boreham 1f920513de Merge pull request #3804 from weaveworks/npc-errors-metrics2 
metric for NPC errors
 2020-05-23 20:43:55 +01:00
Bryan Boreham 09a204b978 NPC: increment metric each time an error is logged 2020-05-22 09:55:07 +00:00
Bryan Boreham 6ad3e69faf Plumb through /proc path config to Docker plugin 2020-05-18 14:47:26 +00:00
Murali Reddy 48015aa7be Weave-npc: while logging differentiate between fatal and non-fatal errors 2020-04-02 15:08:15 +05:30
Murali Reddy 5d0e44bb6f add missing dnsPolicy: ClusterFirstWithHostNet in weave-daemonset-k8s-1.11.yaml 
update apiVersion from rbac.authorization.k8s.io/v1beta1 to rbac.authorization.k8s.io/v1
 2020-02-11 13:15:33 +05:30
Murali Reddy 83024b946f use softlinks to link iptables to backend specific commands and update docs 2020-01-08 15:44:22 +05:30
Murali Reddy 4f48670345 set iptables backend to use if specified explicitly or auto-detect 2020-01-08 15:44:10 +05:30
Bryan Boreham 18deb42df1 Raise Kubernetes CPU requests from 10m to 50m 
This setting is passed by Kubelet to the Linux scheduler to ask for a share of
available CPU, so we should ask for a bit more than 1% of 1 CPU. Otherwise if a
CPU is contended Weave Net will get throttled frequently.

Weave Net in fastdp mode shouldn't need a lot of CPU most of the time, but at
startup there is quite a lot to do.

The setting is also used by the Kubernetes scheduler to decide how much will fit
on a node, so setting it much higher will reserve CPU that we shouldn't need most
of the time.
 2019-11-22 22:30:03 +00:00
Bryan Boreham b0d05f5e37 Increase default connection limit to 200 
Improvements in resource consumption in larger clusters mean we can
raise this limit.
 2019-11-05 14:21:24 +00:00
Michael Merrill 6a48da60ec Handling concurrent updates to configmap and IP reclamation (#3724) 
checking if peer to be removed has been removed by another pod

Signed-off-by: mmerrill3 <michael.merrill@vonage.com>
 2019-10-24 20:01:02 +01:00
Bryan Boreham 62c1d28524 Merge pull request #3716 from weaveworks/870-flake 
Randomise wait to reclaim IPs on node deletion, and fix flaky test 870
 2019-10-15 09:17:04 +01:00
Bryan Boreham 92b21ccd44 Merge pull request #3710 from weaveworks/exclude-self 
Exclude myself when building a list of peers that may need deleted
 2019-10-15 08:41:21 +01:00
Bryan Boreham cb5798f94d Merge pull request #3697 from christian-2/system-node-critical 
mark pods weave-net with priorityClassName: system-node-critical
 2019-10-12 12:00:13 +01:00
Bryan Boreham 821b787774 Move printing of node addresses after reclaim loop 
Otherwise we see all the node addresses in the middle of the log.
 2019-10-11 20:29:58 +00:00
Bryan Boreham 3ed7894e39 Debug log the node-deletion event 
So we know when it came in, also which node.
 2019-10-11 20:29:58 +00:00
Bryan Boreham f5c2f51964 Use a different seed for random numbers each run 
Without this, each run gets the same random numbers so all nodes are
racing to remove the deleted node.
 2019-10-11 20:29:58 +00:00
Bryan Boreham d1ed6c5747 Exclude myself when building a list of peers that may need deleted 
We already avoid actually doing the delete, but adding this check
stops the program logging that it was thinking about it.
 2019-10-10 13:22:20 +00:00
christian-2 6afedb881c mark pods weave-net with priorityClassName: system-node-critical 
* fixes #3691
* `weave-daemonset-k8s-1.11.yaml` is `weave-daemonset-k8s-1.9.yaml` plus `priorityClassName: system-node-critical`
* notice that a Kubernetes cluster created with `kubeadm` has its `kube-proxy`s marked as `system-node-critical` (and several other pods, such as `kube-apiserver` marked as `system-cluster-critical`)
 2019-09-04 14:16:46 +02:00
Sidharth Surana e90cbf290b Change the dnsPolicy for the weave-net pods to ClusterFirstWithHostNet 2019-08-30 10:12:57 -07:00
Bryan Boreham 1e0431f6b2 Merge pull request #3674 from weaveworks/weave-daemonset 
delete weave-daemonset.yaml
 2019-08-30 10:25:45 +01:00
Bryan Boreham ace2c12608 Merge pull request #3660 from Pensu/daemonset_api 
Move daemonset API to apps/v1
 2019-08-29 13:11:57 +01:00
Murali Reddy 9d485d0f21 delete weave-daemonset.yaml which predates the manifest weave-daemonset-k8s-1.6/1.7/1.8.yaml 
naming is counter intutive
 2019-08-29 11:37:55 +00:00
Peeyush Gupta 991945081a Move daemonset API to apps/v1 2019-08-29 13:57:16 +05:30
Bryan Boreham b07db6479a Merge pull request #3655 from tanishq-dubey/master 
Add tolerations for nodes tainted with NoExecute
 2019-08-28 11:11:26 +01:00
Reilly Brogan ef26b306e4 Forgot to make this change 2019-08-08 14:52:29 -05:00
Reilly Brogan 1588a7259d add newline 2019-08-08 14:43:48 -05:00
Reilly Brogan 3a92050ebb Add weave-npc wrapper script 2019-08-08 14:42:56 -05:00
Tanishq Dubey 959d0bf2e2 Add tolerations for nodes tainted with NoExecute 2019-06-30 00:27:57 -04:00
Murali Reddy 7a6ba40982 fix unit test failures 2019-05-30 15:58:18 +05:30
Bryan Boreham 4c6879679d Merge pull request #3639 from weaveworks/allowegress 
lazily add iptables rule to drop egress traffic from the pods only if network policies are applied
 2019-05-07 14:38:39 +01:00
Bryan Boreham 27848992b1 Merge branch '2.5' 2019-05-07 13:32:55 +00:00
Bryan Boreham 8a4fc9c02a Fix peer-list fuzz test to re-fetch list when it may be nil 2019-05-03 17:25:36 +00:00
Murali Reddy 4a1fbc7c38 lazily add iptables rule to drop egress traffic from the pods only 
if network policies are applied

does not address #3464 but just avoids the issue atleast for those who
dont use network policies
 2019-05-03 18:40:59 +05:30
Bryan Boreham eb7ba691ee Fetch storedPeerList after read from Kubernetes 
This avoids a race condition where the peer has added itself to the
list and the annotation since we read storedPeerList.
 2019-04-02 09:11:27 +00:00
Bryan Boreham 15b9b7416a Re-read peers ConfigMap from Kubernetes at start of every reclaim 
A previous reclaim may have left the map set to nil.
 2019-03-26 17:25:34 +00:00
Bryan Boreham 5024270232 Avoid panic on nil map 
It can be set to nil after a failed update; check rather than crashing.
 2019-03-26 17:20:24 +00:00
Bryan Boreham bd24dd7dae Make test harness and comments match Kubernetes behaviour on conflict error 
Kubernetes always returns nil on error; somehow I had the wrong idea
here.
 2019-03-26 17:19:22 +00:00
Bryan Boreham 9654df4d50 Merge pull request #3585 from weaveworks/0peers 
handle single node case where return peer list from kube-utils is empty
 2019-02-04 14:57:13 +00:00
Bryan Boreham e1e4a7887a Merge branch '2.5' 2019-01-18 11:20:25 +00:00
Murali Reddy 17b45d9efa handle single node case where return peer list from kube-utils is empty 
fixes side affet introduced in #3454
 2019-01-18 01:06:37 +05:30
Bryan Boreham 27178b1c79 Check and report the error return from getKubePeers() 2019-01-15 11:15:36 +00:00
Bryan Boreham d4d9ba1e35 Merge pull request #3454 from weaveworks/self-peer 
prevent kubernetes node connecting to self
 2019-01-03 16:16:49 +00:00
Murali Reddy d2a9a51296 follow project conventions in ordering the imports 2018-12-04 10:58:43 +05:30
Murali Reddy 99e360ce3b skip egress network policies for the traffic node->bridge ip 2018-12-04 09:43:50 +05:30
Murali Reddy 81b17469f4 prevent kubernetes node connecting to self by excluding the node IP from the list of the peers passed to weaver 
Fixes #3398
 2018-11-21 11:47:30 +05:30
Murali Reddy 06669325a7 add --physdev-is-bridged flag when using physdev module for iptables 
rules created by weave-npc to prevent warning in kernel logs

Fixes #3449
 2018-11-20 13:34:10 +05:30
Bryan Boreham a5161b28f5 Merge pull request #3399 from weaveworks/rmpeer 
watch for Kubernetes node delete events and reclaim removed peers IP space on delete event
 2018-11-01 11:08:53 +00:00
Murali Reddy c48c746791 replace peerlist with current set of Kubernetes nodes 2018-10-31 18:06:48 +05:30
Murali Reddy d3c5241f12 addressing review comments 2018-10-31 17:26:55 +05:30