Add release v1.9.8

Merge pull request #3014 from weaveworks/issues/3011-allow-non-pod-source
Allow any non-local traffic onto the weave bridge
2017-06-15 17:05:11 +00:00 · 2017-06-14 14:52:11 +01:00 · 2017-06-14 13:14:06 +00:00 · 2017-06-12 17:00:57 +00:00 · 2017-06-12 09:42:22 +01:00 · 2017-06-09 08:30:13 +01:00
98 changed files with 698 additions and 361 deletions
@@ -70,3 +70,6 @@ test/coverage.*
 *qemu-*-static
 terraform.tfstate
 terraform.tfstate.backup
+
+# Website
+site-build
@@ -0,0 +1 @@
+2.3.4
@@ -1,3 +1,69 @@
+## Release 1.9.8
+
+Bug fixes and minor improvements
+
+* Fix weave-npc blocking NodePort and any other non-local access #3011,#3014
+* Fix bug where IPAM would duplicate a fixed IP address assigned via Docker plugin #3003,#3010
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/56?closed=1).
+
+
+## Release 1.9.7
+
+This is identical to 1.9.6 with one additional bug-fix:
+
+* weave-npc would block everything if `kubelet --hostname-override` was used #2995,#2996
+
+## Release 1.9.6
+
+Bug fixes and minor improvements
+
+* Ensure that Kubernetes pods can contact a service implemented within
+  the same pod, by turning on "hairpin mode". This is required because
+  of a quiet change between Kubernetes 1.5 and 1.6. #2993
+* Network Policy Controller (`weave-npc`) now checks local addresses
+  only, so it doesn't interfere with cross-cluster traffic. It should
+  be more efficient too #2622,#2973,#2979
+* Stop reporting back to Kubernetes any issues encountered when
+  deleting a pod's network interface. This is required because
+  of a quiet change between Kubernetes 1.5 and 1.6. #2921,#2928
+* Fixed an issue whereby `weave-npc` couldn't start because one
+  `ipset` was referring to another one and could not be destroyed #2915,#2949
+* Improved the code which checks whether the kernel supports `ipset` #2934,#2935
+* `weave-npc` now creates ipsets with only valid xml characters in the
+  name #2958,#2959
+
+Build and Testing
+
+* In build container use cross-compilers from debian package
+  repository, so they match other components #2940
+* Pin the version of the linting tool `shfmt` so the set of things it
+  checks is stable #2987
+* Fix lint error in script that runs smoke-tests #2962
+* Moved website publishing from Wordpress to Netlify #2986
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/55?closed=1).
+
+## Release 1.9.5
+
+Bug fixes and minor improvements
+
+* Improve log messages generated if "hairpin" conditions are detected,
+  to make clear which kind is likely to cause problems #2808/#2926
+* Filter out IPv6 peer addresses from Kubernetes; Weave Net currently
+  only supports IPv4 #2904/#2912
+* Fix rare crash during initialization of weave-kube #2893/#2892
+* Include overlay and encryption modes in checkpoint reports, in case
+  this is relevant to a version upgrade #2771/#2907
+
+Build and Testing
+
+* Ensure CI build can run gcloud tools  #2887
+* Prevent kubeadm from upgrading Kubernetes if we are trying to test an older version #2886
+* Upgrade build scripts to support Kubernetes 1.6 #2880
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/54?closed=1).
+
 ## Release 1.9.4

 Bug fixes and minor improvements
@@ -378,3 +378,14 @@ integration-tests: all testrunner
 #     integration-tests
 #
 	RUNNER_ARGS="-parallel" ./test/run-integration-tests.sh
+
+# This target is only intended for use in Netlify CI environment for generating preview pages on feature branches and pull requests.
+# We need to obtain website repository (checked out under `site-build`) and place `site` directory into the context (`site-build/_weave_net_docs`).
+# We then run make in `site-build` and Netlify will publish the output (`site-build/_site`).
+netlify-site-preview:
+	@mkdir -p site-build
+	@curl --user $(WEBSITE_GITHUB_USER) --silent 'https://codeload.github.com/weaveworks/website-next/tar.gz/$(WEBSITE_BRANCH)' \
+	  | tar --extract --gunzip --directory site-build --strip 1
+	@cp -r site site-build/_weave_net_docs
+	@$(MAKE) -C site-build netlify_ensure_install
+	@$(MAKE) -C site-build BUILD_ENV=netlify
@@ -1,43 +0,0 @@
-#!/bin/bash
-
-set -e
-set -o pipefail
-
-source "$STATE"
-
-site_changes() {
-    curl -s https://api.github.com/repos/weaveworks/weave/pulls/$1/files |
-        jq -r '.[]|.status + " " + .filename' |
-        grep -oP '^(added|modified|removed) site/.*(?=\.md$)'
-}
-
-format_comment() {
-    if [ ! -d .git ] || ! BRANCH=$(git symbolic-ref --short HEAD) || [ -z "$BRANCH" ] ; then
-        echo "Could not determine branch" >&2
-        return 1
-    fi
-
-    echo "#### Documentation changes:"
-    while read ACTION PAGE; do
-        echo "$ACTION [${PAGE#site/}]($WP_DEV_URL/docs/net/${BRANCH#issues/}/${PAGE#site/}/)"
-    done | sort
-}
-
-post_comment() {
-    jq -s -R '. | tostring | { body: . }' |
-        curl -s -d @- \
-            -H "Authorization: Bearer $WP_GH_COMMENT_TOKEN" \
-            -H 'Content-Type: application/json' \
-            https://api.github.com/repos/weaveworks/weave/issues/$GH_PR/comments > /dev/null
-}
-
-cd $SRCDIR
-bin/install-wordepress v1.0.0
-bin/publish-site "$WP_DEV_URL" "$WP_DEV_USER" "$WP_DEV_PASSWORD"
-
-if [ -n "$WP_GH_COMMENT_TOKEN" -a -n "$GH_PR" ] ; then
-    echo ">>> Adding doc changelog to GitHub PR $GH_PR"
-    if CHANGES=$(site_changes $GH_PR) && [ -n "$CHANGES" ] ; then
-        echo "$CHANGES" | format_comment | post_comment
-    fi
-fi
@@ -11,7 +11,3 @@ if [ -n "$TEST_AND_PUBLISH" ] ; then
    # CircleCI doesn't let us install the qemu module to do ARM docker builds
    make publish ALL_ARCHITECTURES=amd64 UPDATE_LATEST=latest-only
 fi
-
-cd $SRCDIR
-bin/install-wordepress v1.0.0
-bin/publish-site "$WP_DEV_URL" "$WP_DEV_USER" "$WP_DEV_PASSWORD"
@@ -1,7 +0,0 @@
-#!/bin/bash
-
-set -e
-
-cd $SRCDIR
-bin/install-wordepress v1.0.0
-bin/publish-site "$WP_LIVE_URL" "$WP_LIVE_USER" "$WP_LIVE_PASSWORD"
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-if [ $# -ne 1 ] ; then
-    echo USAGE: install-wordepress [COMMIT-ISH] >&2
-    exit 1
-fi
-
-go get github.com/weaveworks/wordepress
-cd /home/ubuntu/src/github.com/weaveworks/wordepress
-git checkout $1
-cd cmd/wordepress
-go get
@@ -1,46 +0,0 @@
-#!/bin/bash
-
-set -e
-set -o pipefail
-
-PRODUCT=net
-
-fatal() {
-    echo "$@" >&2
-    exit 1
-}
-
-if [ ! -d .git ] ; then
-    fatal "Current directory is not a git clone"
-fi
-
-if ! BRANCH=$(git symbolic-ref --short HEAD) || [ -z "$BRANCH" ] ; then
-    fatal "Could not determine branch"
-fi
-
-case "$BRANCH" in
-    issues/*)
-        VERSION="${BRANCH#issues/}"
-        TAGS="$VERSION"
-        ;;
-    *)
-        if echo "$BRANCH" | grep -qE '^[0-9]+\.[0-9]+' ; then
-            DESCRIBE=$(git describe --match 'v*')
-            if ! VERSION=$(echo "$DESCRIBE" | grep -oP '(?<=^v)[0-9]+\.[0-9]+\.[0-9]+') ; then
-                fatal "Could not infer latest $BRANCH version from $DESCRIBE"
-            fi
-            TAGS="latest"
-        else
-            VERSION="$BRANCH"
-            TAGS="$VERSION"
-        fi
-        ;;
-esac
-
-for TAG in $TAGS ; do
-    echo ">>> Publishing $PRODUCT $VERSION to $1/docs/$PRODUCT/$TAG"
-    wordepress \
-        --url "$1" --user "$2" --password "$3" \
-        --product "$PRODUCT" --version "$VERSION" --tag "$TAG" \
-        publish site
-done
@@ -20,13 +20,12 @@ ENV GCC_CROSSCOMPILERS \

 # Temporarily add the Ubuntu repositories, because we're going to install gcc cross-compilers from there
 # Install the build-essential and crossbuild-essential-ARCH packages
-RUN echo "deb http://archive.ubuntu.com/ubuntu xenial main universe" > /etc/apt/sources.list.d/cgocrosscompiling.list \
-  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32 \
+RUN echo "deb http://emdebian.org/tools/debian/ jessie main" > /etc/apt/sources.list.d/cgocrosscompiling.list \
+  && curl http://emdebian.org/tools/debian/emdebian-toolchain-archive.key | apt-key add - \
+  && for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done \
  && apt-get update \
  && apt-get install -y build-essential \
  && for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done \
-  && rm /etc/apt/sources.list.d/cgocrosscompiling.list \
-  && apt-get update \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

 # Install some required packages
@@ -41,11 +40,15 @@ RUN apt-get update \
 		flex \
 		bison

+RUN curl -fsSLo shfmt https://github.com/mvdan/sh/releases/download/v1.3.0/shfmt_v1.3.0_linux_amd64 && \
+	echo "b1925c2c405458811f0c227266402cf1868b4de529f114722c2e3a5af4ac7bb2  shfmt" | sha256sum -c && \
+	chmod +x shfmt && \
+	mv shfmt /usr/bin
+
 # Install common Go tools
 RUN go get \
 	github.com/golang/lint/golint \
 	github.com/fzipp/gocyclo \
-	gopkg.in/mvdan/sh.v1/cmd/shfmt \
 	github.com/fatih/hclfmt \
 	github.com/client9/misspell/cmd/misspell

@@ -11,7 +11,7 @@ machine:
  environment:
    GOPATH: /home/ubuntu:$GOPATH
    SRCDIR: /home/ubuntu/src/github.com/weaveworks/weave
-    PATH: $PATH:$HOME/.local/bin
+    PATH: $PATH:$HOME/.local/bin:/opt/google-cloud-sdk/bin
    CLOUDSDK_CORE_DISABLE_PROMPTS: 1
    STATE: /home/ubuntu/state.env
    # Base name of VMs for integration tests:
@@ -59,18 +59,8 @@ teardown:
        parallel: true

 deployment:
-  release:
-    branch: /[0-9]+\.[0-9]+/
-    owner: weaveworks
-    commands:
-      - "$SRCDIR/bin/circle-deploy-release"
  master:
    branch: master
    owner: weaveworks
    commands:
      - "$SRCDIR/bin/circle-deploy-master"
-  issues:
-    branch: /.*/
-    owner: weaveworks
-    commands:
-      - "$SRCDIR/bin/circle-deploy-issues"
@@ -77,8 +77,10 @@ iptables -A WEAVE-NPC -m state --state NEW -j WEAVE-NPC-INGRESS

 To direct traffic into the policy engine:

+```
 iptables -A FORWARD -o weave -m physdev ! --physdev-out vethwe-bridge -j WEAVE-NPC
 iptables -A FORWARD -o weave -m physdev ! --physdev-out vethwe-bridge -j DROP
+```

 Note this only affects traffic which egresses the bridge on a physical
 port which is not the Weave Net router - in other words, it is
@@ -265,6 +265,10 @@ func (alloc *Allocator) tryPendingOps() {
 	alloc.tryOps(&alloc.pendingAllocates)
 }

+func (alloc *Allocator) havePendingOps() bool {
+	return len(alloc.pendingPrimes)+len(alloc.pendingClaims)+len(alloc.pendingAllocates) > 0
+}
+
 func (alloc *Allocator) spaceRequestDenied(sender mesh.PeerName, r address.Range) {
 	for i := 0; i < len(alloc.pendingClaims); {
 		claim := alloc.pendingClaims[i].(*claim)
@@ -696,8 +700,12 @@ func (alloc *Allocator) actorLoop(actionChan <-chan func(), stopChan <-chan stru
 			// Retry things in case messages got lost between here and recipients
 			if alloc.awaitingConsensus {
 				alloc.propose()
-			} else {
-				alloc.tryPendingOps()
+			} else if alloc.havePendingOps() {
+				if alloc.ring.Empty() {
+					alloc.establishRing()
+				} else {
+					alloc.tryPendingOps()
+				}
 			}
 			alloc.removeDeadContainers()
 		}
@@ -9,6 +9,7 @@ import (

 	"github.com/stretchr/testify/require"

+	"github.com/weaveworks/weave/api"
 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/net/address"
 	"github.com/weaveworks/weave/testing/gossip"
@@ -30,6 +31,10 @@ func (alloc *Allocator) SimplyClaim(ident string, cidr address.CIDR) error {
 	return alloc.Claim(ident, cidr, true, true, returnFalse)
 }

+func (alloc *Allocator) AnonymousClaim(cidr address.CIDR) error {
+	return alloc.Claim(api.NoContainerID, cidr, false, true, returnFalse)
+}
+
 func TestAllocFree(t *testing.T) {
 	const (
 		container1 = "abcdef"
@@ -170,6 +175,8 @@ func TestAllocatorClaim(t *testing.T) {
 		universe   = "10.0.3.0/24"
 		testAddr1  = "10.0.3.5/24"
 		testAddr2  = "10.0.4.2/24"
+		testAddr4  = "10.0.2.3/23"
+		subnet4    = "10.0.2.0/23"
 		testPre    = "10.0.3.1/24"
 	)

@@ -203,6 +210,9 @@ func TestAllocatorClaim(t *testing.T) {
 	// claim for a different container should fail
 	err = alloc.SimplyClaim(container1, addr1)
 	require.Error(t, err)
+	// claim for an anonymous container, will assume it's the same one
+	err = alloc.AnonymousClaim(addr1)
+	require.NoError(t, err)
 	// claiming the address allocated on the other peer should fail
 	err = alloc.SimplyClaim(container1, address.MakeCIDR(subnet, addrx))
 	require.Error(t, err, "claiming address allocated on other peer should fail")
@@ -215,6 +225,15 @@ func TestAllocatorClaim(t *testing.T) {
 	addr2, _ := address.ParseCIDR(testAddr2)
 	err = alloc.SimplyClaim(container1, addr2)
 	require.NoError(t, err)
+	err = alloc.SimplyClaim(container3, addr2)
+	require.Error(t, err)
+	// Anonymous claim outside of our universe
+	addr4, _ := address.ParseCIDR(testAddr4)
+	subnet4cidr, _ := address.ParseCIDR(subnet4)
+	require.NoError(t, alloc.AnonymousClaim(addr4))
+	addr5, err := alloc.Allocate(api.NoContainerID, subnet4cidr, false, returnFalse)
+	require.NoError(t, err)
+	require.NotEqual(t, addr4.Start(), addr5)
 }

 func (alloc *Allocator) pause() func() {
@@ -40,10 +40,29 @@ func (c *claim) Try(alloc *Allocator) bool {
 		return true
 	}

+	addOwned := func() {
+		if c.ident == api.NoContainerID {
+			alloc.addOwned(c.cidr.Addr.String(), c.cidr, c.isContainer)
+		} else {
+			alloc.addOwned(c.ident, c.cidr, c.isContainer)
+		}
+	}
+
 	if !alloc.ring.Contains(c.cidr.Addr) {
-		// Address not within our universe; assume user knows what they are doing
 		alloc.infof("Address %s claimed by %s - not in our range", c.cidr, c.ident)
-		alloc.addOwned(c.ident, c.cidr, c.isContainer)
+		previousOwner := alloc.findOwner(c.cidr.Addr)
+		switch {
+		case previousOwner == "":
+			addOwned()
+		case previousOwner == c.ident: // already owned by this ID
+		case c.ident == api.NoContainerID: // already owned by anonymous container
+			// do nothing (no automatic fall-through in Go)
+		case !alloc.dead[previousOwner].IsZero(): // already owned by dead container
+			alloc.removeOwned(previousOwner, c.cidr.Addr)
+			addOwned()
+		default:
+			c.sendResult(fmt.Errorf("address %s already in use by %s", c.cidr, previousOwner))
+		}
 		c.sendResult(nil)
 		return true
 	}
@@ -85,11 +104,7 @@ func (c *claim) Try(alloc *Allocator) bool {
 		// Unused address, we try to claim it:
 		if err := alloc.space.Claim(c.cidr.Addr); err == nil {
 			alloc.debugln("Claimed", c.cidr, "for", c.ident)
-			if c.ident == api.NoContainerID {
-				alloc.addOwned(c.cidr.Addr.String(), c.cidr, c.isContainer)
-			} else {
-				alloc.addOwned(c.ident, c.cidr, c.isContainer)
-			}
+			addOwned()
 			c.sendResult(nil)
 		} else {
 			c.sendResult(err)
@@ -113,7 +113,7 @@ func interfaceExistsInNamespace(netNSPath string, ifName string) bool {

 // NB: This function can be used only by a process that terminates immediately
 //     after calling the function as it changes netns via WithNetNSLinkUnsafe.
-func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMulticastRoute bool, cidrs []*net.IPNet, keepTXOn bool) error {
+func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMulticastRoute bool, cidrs []*net.IPNet, keepTXOn bool, hairpinMode bool) error {
 	ns, err := netns.GetFromPath(netNSPath)
 	if err != nil {
 		return err
@@ -131,7 +131,7 @@ func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMult
 			id = id[:maxIDLen] // trim passed ID if too long
 		}
 		name, peerName := vethPrefix+"pl"+id, vethPrefix+"pg"+id
-		_, err := CreateAndAttachVeth(name, peerName, bridgeName, mtu, keepTXOn, func(veth netlink.Link) error {
+		veth, err := CreateAndAttachVeth(name, peerName, bridgeName, mtu, keepTXOn, func(veth netlink.Link) error {
 			if err := netlink.LinkSetNsFd(veth, int(ns)); err != nil {
 				return fmt.Errorf("failed to move veth to container netns: %s", err)
 			}
@@ -143,6 +143,10 @@ func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMult
 		if err != nil {
 			return err
 		}
+		if err = netlink.LinkSetHairpin(veth, hairpinMode); err != nil {
+			return fmt.Errorf("unable to set hairpin mode to %t for bridge side of veth %s: %s", hairpinMode, name, err)
+		}
+
 	}

 	if err := WithNetNSLinkUnsafe(ns, ifName, func(veth netlink.Link) error {
@@ -8,4 +8,6 @@ const (
 	IngressChain = "WEAVE-NPC-INGRESS"

 	IpsetNamePrefix = "weave-"
+
+	LocalIpset = IpsetNamePrefix + "local-pods"
 )
@@ -29,6 +29,8 @@ type NetworkPolicyController interface {
 type controller struct {
 	sync.Mutex

+	nodeName string // my node name
+
 	ipt *iptables.IPTables
 	ips ipset.Interface

@@ -36,11 +38,12 @@ type controller struct {
 	nsSelectors *selectorSet   // selector string -> nsSelector
 }

-func New(ipt *iptables.IPTables, ips ipset.Interface) NetworkPolicyController {
+func New(nodeName string, ipt *iptables.IPTables, ips ipset.Interface) NetworkPolicyController {
 	c := &controller{
-		ipt: ipt,
-		ips: ips,
-		nss: make(map[string]*ns)}
+		nodeName: nodeName,
+		ipt:      ipt,
+		ips:      ips,
+		nss:      make(map[string]*ns)}

 	c.nsSelectors = newSelectorSet(ips, c.onNewNsSelector)

@@ -82,10 +85,21 @@ func (npc *controller) withNS(name string, f func(ns *ns) error) error {
 	return nil
 }

+func (npc *controller) checkLocalPod(obj *coreapi.Pod, event string) bool {
+	if obj.Spec.NodeName != npc.nodeName {
+		common.Log.Debugf("%s ignored for pod %s/%s on node %s", event, obj.ObjectMeta.Namespace, obj.ObjectMeta.Name, obj.Spec.NodeName)
+		return false
+	}
+	return true
+}
+
 func (npc *controller) AddPod(obj *coreapi.Pod) error {
 	npc.Lock()
 	defer npc.Unlock()

+	if !npc.checkLocalPod(obj, "AddPod") {
+		return nil
+	}
 	common.Log.Debugf("EVENT AddPod %s", js(obj))
 	return npc.withNS(obj.ObjectMeta.Namespace, func(ns *ns) error {
 		return errors.Wrap(ns.addPod(obj), "add pod")
@@ -96,6 +110,10 @@ func (npc *controller) UpdatePod(oldObj, newObj *coreapi.Pod) error {
 	npc.Lock()
 	defer npc.Unlock()

+	// Pods don't move across nodes so we only check the new version
+	if !npc.checkLocalPod(newObj, "UpdatePod") {
+		return nil
+	}
 	common.Log.Debugf("EVENT UpdatePod %s %s", js(oldObj), js(newObj))
 	return npc.withNS(oldObj.ObjectMeta.Namespace, func(ns *ns) error {
 		return errors.Wrap(ns.updatePod(oldObj, newObj), "update pod")
@@ -106,6 +124,9 @@ func (npc *controller) DeletePod(obj *coreapi.Pod) error {
 	npc.Lock()
 	defer npc.Unlock()

+	if !npc.checkLocalPod(obj, "DeletePod") {
+		return nil
+	}
 	common.Log.Debugf("EVENT DeletePod %s", js(obj))
 	return npc.withNS(obj.ObjectMeta.Namespace, func(ns *ns) error {
 		return errors.Wrap(ns.deletePod(obj), "delete pod")
@@ -1,6 +1,7 @@
 package ipset

 import (
+	"log"
 	"os/exec"
 	"strings"

@@ -31,10 +32,11 @@ type Interface interface {

 type ipset struct {
 	refCount
+	*log.Logger
 }

-func New() Interface {
-	return &ipset{refCount: newRefCount()}
+func New(logger *log.Logger) Interface {
+	return &ipset{refCount: newRefCount(), Logger: logger}
 }

 func (i *ipset) Create(ipsetName Name, ipsetType Type) error {
@@ -42,6 +44,7 @@ func (i *ipset) Create(ipsetName Name, ipsetType Type) error {
 }

 func (i *ipset) AddEntry(ipsetName Name, entry string) error {
+	i.Logger.Printf("adding entry %s to %s", entry, ipsetName)
 	if i.inc(ipsetName, entry) > 1 { // already in the set
 		return nil
 	}
@@ -49,6 +52,7 @@ func (i *ipset) AddEntry(ipsetName Name, entry string) error {
 }

 func (i *ipset) DelEntry(ipsetName Name, entry string) error {
+	i.Logger.Printf("deleting entry %s from %s", entry, ipsetName)
 	if i.dec(ipsetName, entry) > 0 { // still needed
 		return nil
 	}
@@ -88,6 +88,7 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
 		return nil
 	}

+	ns.ips.AddEntry(LocalIpset, obj.Status.PodIP)
 	return ns.podSelectors.addToMatching(obj.ObjectMeta.Labels, obj.Status.PodIP)
 }

@@ -100,10 +101,12 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 	}

 	if hasIP(oldObj) && !hasIP(newObj) {
+		ns.ips.DelEntry(LocalIpset, oldObj.Status.PodIP)
 		return ns.podSelectors.delFromMatching(oldObj.ObjectMeta.Labels, oldObj.Status.PodIP)
 	}

 	if !hasIP(oldObj) && hasIP(newObj) {
+		ns.ips.AddEntry(LocalIpset, newObj.Status.PodIP)
 		return ns.podSelectors.addToMatching(newObj.ObjectMeta.Labels, newObj.Status.PodIP)
 	}

@@ -139,6 +142,7 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
 		return nil
 	}

+	ns.ips.DelEntry(LocalIpset, obj.Status.PodIP)
 	return ns.podSelectors.delFromMatching(obj.ObjectMeta.Labels, obj.Status.PodIP)
 }

@@ -43,12 +43,10 @@ func (s *selector) matches(labelMap map[string]string) bool {
 }

 func (s *selector) addEntry(entry string) error {
-	common.Log.Infof("adding entry %s to %s", entry, s.spec.ipsetName)
 	return s.ips.AddEntry(s.spec.ipsetName, entry)
 }

 func (s *selector) delEntry(entry string) error {
-	common.Log.Infof("deleting entry %s from %s", entry, s.spec.ipsetName)
 	return s.ips.DelEntry(s.spec.ipsetName, entry)
 }

@@ -7,12 +7,13 @@ import (

 const (
 	// This array:
-	// * Must include only printable UTF8 characters that are represented with a single byte
+	// * Must include only printable UTF8 characters that are represented with a single byte (http://www.utf8-chartable.de/)
 	// * Must be at least of length 85 (`len("weave-") + l(2^160)/l(85)` equals 31, the maximum ipset name length)
 	// * Must not include commas as those are treated specially by `ipset add` when adding a named set to a list:set
 	// * Should not include space for readability
+	// * Should not include invalid chars for XML `<>&"'`
 	// * Should not include single quote or backslash to be nice to shell users
-	ShortNameSymbols = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789(){}[]<>_$%^&*|/?.;:@#~"
+	ShortNameSymbols = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789(){}[]+=_$%^!*|/?.;:@#~"
 )

 // sha1 hash an arbitrary string and represent it using the full range of
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"net"
 	"os"
-	"strings"
 	"syscall"

 	"github.com/containernetworking/cni/pkg/ipam"
@@ -35,7 +34,8 @@ func NewCNIPlugin(weave *weaveapi.Client) *CNIPlugin {

 func loadNetConf(bytes []byte) (*NetConf, error) {
 	n := &NetConf{
-		BrName: weavenet.WeaveBridgeName,
+		BrName:      weavenet.WeaveBridgeName,
+		HairpinMode: true,
 	}
 	if err := json.Unmarshal(bytes, n); err != nil {
 		return nil, fmt.Errorf("failed to load netconf: %v", err)
@@ -129,7 +129,7 @@ func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error {
 		id = fmt.Sprintf("%x", data)
 	}

-	if err := weavenet.AttachContainer(args.Netns, id, args.IfName, conf.BrName, conf.MTU, false, []*net.IPNet{&ip.Address}, false); err != nil {
+	if err := weavenet.AttachContainer(args.Netns, id, args.IfName, conf.BrName, conf.MTU, false, []*net.IPNet{&ip.Address}, false, conf.HairpinMode); err != nil {
 		return err
 	}
 	if err := weavenet.WithNetNSLinkUnsafe(ns, args.IfName, func(link netlink.Link) error {
@@ -183,16 +183,21 @@ func assignBridgeIP(bridgeName string, ipnet net.IPNet) error {
 	return nil
 }

+// As of CNI 0.5 spec:
+//   "Plugins should generally complete a DEL action without error even if some resources are missing"
+// this method should therefore return nil in most, if not all, cases.
 func (c *CNIPlugin) CmdDel(args *skel.CmdArgs) error {
 	conf, err := loadNetConf(args.StdinData)
 	if err != nil {
-		return err
+		logOnStderr(err)
+		return nil
 	}

 	// As of CNI 0.3 spec, runtimes can send blank if they just want the address deallocated
 	if args.Netns != "" {
 		if _, err = weavenet.WithNetNS(args.Netns, "del-iface", args.IfName); err != nil {
-			return fmt.Errorf("error removing interface %q: %s", args.IfName, err)
+			// We log the error and carry on instead of returning nil, as there may still be resources to free in IPAM.
+			logOnStderr(fmt.Errorf("error removing interface %q: %s", args.IfName, err))
 		}
 	}

@@ -202,20 +207,21 @@ func (c *CNIPlugin) CmdDel(args *skel.CmdArgs) error {
 	} else {
 		err = ipam.ExecDel(conf.IPAM.Type, args.StdinData)
 	}
-	// Hack - don't know how we should detect this situation properly
-	if args.Netns == "" && strings.Contains(err.Error(), "no addresses") {
-		err = nil
-	}
-	if err != nil {
-		return fmt.Errorf("unable to release IP address: %s", err)
-	}
+	logOnStderr(fmt.Errorf("unable to release IP address: %s", err))
 	return nil
 }

+// Standard error is inherited from the caller (e.g. Kubelet, when running Weave Net's CNI plugin
+// under Kubernetes) hence provided errors should eventually appear in the caller's log files.
+func logOnStderr(err error) {
+	fmt.Fprintln(os.Stderr, "weave-cni:", err)
+}
+
 type NetConf struct {
 	types.NetConf
-	BrName string `json:"bridge"`
-	IsGW   bool   `json:"isGateway"`
-	IPMasq bool   `json:"ipMasq"`
-	MTU    int    `json:"mtu"`
+	BrName      string `json:"bridge"`
+	IsGW        bool   `json:"isGateway"`
+	IPMasq      bool   `json:"ipMasq"`
+	MTU         int    `json:"mtu"`
+	HairpinMode bool   `json:"hairpinMode"`
 }
@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"log"
+	"net"

 	"k8s.io/client-go/kubernetes"
 	api "k8s.io/client-go/pkg/api/v1"
@@ -35,10 +36,25 @@ func getKubePeers() ([]string, error) {
 	}
 	addresses := make([]string, 0, len(nodeList.Items))
 	for _, peer := range nodeList.Items {
+		var internalIP, externalIP string
 		for _, addr := range peer.Status.Addresses {
-			if addr.Type == "InternalIP" {
-				addresses = append(addresses, addr.Address)
+			// Check it's a valid ipv4 address
+			ip := net.ParseIP(addr.Address)
+			if ip == nil || ip.To4() == nil {
+				continue
 			}
+			if addr.Type == "InternalIP" {
+				internalIP = ip.To4().String()
+			} else if addr.Type == "ExternalIP" {
+				externalIP = ip.To4().String()
+			}
+		}
+
+		// Fallback for cases where a Node has an ExternalIP but no InternalIP
+		if internalIP != "" {
+			addresses = append(addresses, internalIP)
+		} else if externalIP != "" {
+			addresses = append(addresses, externalIP)
 		}
 	}
 	return addresses, nil
@@ -8,6 +8,11 @@ modprobe_safe() {

 # Check whether xt_set actually exists
 xt_set_exists() {
+    # Clean everything up in advance, in case there's leftovers
+    iptables -F WEAVE-KUBE-TEST 2>/dev/null || true
+    iptables -X WEAVE-KUBE-TEST 2>/dev/null || true
+    ipset destroy weave-kube-test 2>/dev/null || true
+
    ipset create weave-kube-test hash:ip
    iptables -t filter -N WEAVE-KUBE-TEST
    if ! iptables -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
@@ -92,6 +92,12 @@ spec:
              cpu: 10m
          securityContext:
            privileged: true
+          env:
+          - name: HOSTNAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.nodeName
      restartPolicy: Always
      tolerations:
      - key: node-role.kubernetes.io/master
@@ -59,6 +59,12 @@ spec:
              cpu: 10m
          securityContext:
            privileged: true
+          env:
+          - name: HOSTNAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.nodeName
      restartPolicy: Always
      volumes:
        - name: weavedb
@@ -28,6 +28,7 @@ var (
 	metricsAddr string
 	logLevel    string
 	allowMcast  bool
+	nodeName    string
 )

 func handleError(err error) { common.CheckFatal(err) }
@@ -53,6 +54,41 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}

+	return nil
+}
+
+func resetIPSets(ips ipset.Interface) error {
+	// Remove ipsets prefixed `weave-` only
+
+	sets, err := ips.List(npc.IpsetNamePrefix)
+	if err != nil {
+		common.Log.Errorf("Failed to retrieve list of ipsets")
+		return err
+	}
+
+	common.Log.Debugf("Got list of ipsets: %v", sets)
+
+	// Must remove references to ipsets by other ipsets before they're destroyed
+	for _, s := range sets {
+		common.Log.Debugf("Flushing ipset '%s'", string(s))
+		if err := ips.Flush(s); err != nil {
+			common.Log.Errorf("Failed to flush ipset '%s'", string(s))
+			return err
+		}
+	}
+
+	for _, s := range sets {
+		common.Log.Debugf("Destroying ipset '%s'", string(s))
+		if err := ips.Destroy(s); err != nil {
+			common.Log.Errorf("Failed to destroy ipset '%s'", string(s))
+			return err
+		}
+	}
+
+	return nil
+}
+
+func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	// Configure main chain static rules
 	if err := ipt.Append(npc.TableFilter, npc.MainChain,
 		"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil {
@@ -76,26 +112,13 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}

-	return nil
-}
-
-func resetIPSets(ips ipset.Interface) error {
-	// Remove ipsets prefixed `weave-` only
-
-	sets, err := ips.List(npc.IpsetNamePrefix)
-	if err != nil {
-		common.Log.Errorf("Failed to retrieve list of ipsets")
+	// If the destination address is not any of the local pods, let it through
+	if err := ips.Create(npc.LocalIpset, ipset.HashIP); err != nil {
 		return err
 	}
-
-	common.Log.Debugf("Got list of ipsets: %v", sets)
-
-	for _, s := range sets {
-		common.Log.Debugf("Destroying ipsets '%s'", string(s))
-		if err := ips.Destroy(s); err != nil {
-			common.Log.Errorf("Failed to destroy ipset '%s'", string(s))
-			return err
-		}
+	if err := ipt.Append(npc.TableFilter, npc.MainChain,
+		"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil {
+		return err
 	}

 	return nil
@@ -103,7 +126,14 @@ func resetIPSets(ips ipset.Interface) error {

 func root(cmd *cobra.Command, args []string) {
 	common.SetLogLevel(logLevel)
-	common.Log.Infof("Starting Weaveworks NPC %s", version)
+	if nodeName == "" {
+		// HOSTNAME is set by Kubernetes for pods in the host network namespace
+		nodeName = os.Getenv("HOSTNAME")
+	}
+	if nodeName == "" {
+		common.Log.Fatalf("Must set node name via --node-name or $HOSTNAME")
+	}
+	common.Log.Infof("Starting Weaveworks NPC %s; node name %q", version, nodeName)

 	if err := metrics.Start(metricsAddr); err != nil {
 		common.Log.Fatalf("Failed to start metrics: %v", err)
@@ -122,12 +152,13 @@ func root(cmd *cobra.Command, args []string) {
 	ipt, err := iptables.New()
 	handleError(err)

-	ips := ipset.New()
+	ips := ipset.New(common.LogLogger())

 	handleError(resetIPTables(ipt))
 	handleError(resetIPSets(ips))
+	handleError(createBaseRules(ipt, ips))

-	npc := npc.New(ipt, ips)
+	npc := npc.New(nodeName, ipt, ips)

 	nsController := makeController(client.Core().RESTClient(), "namespaces", &coreapi.Namespace{},
 		cache.ResourceEventHandlerFuncs{
@@ -207,6 +238,7 @@ func main() {
 	rootCmd.PersistentFlags().StringVar(&metricsAddr, "metrics-addr", ":6781", "metrics server bind address")
 	rootCmd.PersistentFlags().StringVar(&logLevel, "log-level", "debug", "logging level (debug, info, warning, error)")
 	rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
+	rootCmd.PersistentFlags().StringVar(&nodeName, "node-name", "", "only generate rules that apply to this node")

 	handleError(rootCmd.Execute())
 }
@@ -6,6 +6,7 @@ import (
 	"time"

 	"github.com/weaveworks/go-checkpoint"
+	weave "github.com/weaveworks/weave/router"
 )

 var checker *checkpoint.Checker
@@ -16,7 +17,7 @@ const (
 	updateCheckPeriod = 6 * time.Hour
 )

-func checkForUpdates(dockerVersion string, network string) {
+func checkForUpdates(dockerVersion string, router *weave.NetworkRouter) {
 	newVersion.Store("")
 	success.Store(true)

@@ -51,9 +52,6 @@ func checkForUpdates(dockerVersion string, network string) {
 		"docker-version": dockerVersion,
 		"kernel-version": kernelVersion,
 	}
-	if network != "" {
-		flags["network"] = network
-	}

 	// Start background version checking
 	params := checkpoint.CheckParams{
@@ -61,6 +59,21 @@ func checkForUpdates(dockerVersion string, network string) {
 		Version:       version,
 		SignatureFile: "",
 		Flags:         flags,
+		ExtraFlags:    func() []checkpoint.Flag { return checkpointFlags(router) },
 	}
 	checker = checkpoint.CheckInterval(&params, updateCheckPeriod, handleResponse)
 }
+
+func checkpointFlags(router *weave.NetworkRouter) []checkpoint.Flag {
+	flags := []checkpoint.Flag{}
+	status := weave.NewNetworkRouterStatus(router)
+	for _, conn := range status.Connections {
+		if connectionName, ok := conn.Attrs["name"].(string); ok {
+			if _, encrypted := conn.Attrs["encrypted"]; encrypted {
+				connectionName = connectionName + " encrypted"
+			}
+			flags = append(flags, checkpoint.Flag{Key: "network", Value: connectionName})
+		}
+	}
+	return flags
+}
@@ -231,7 +231,8 @@ func main() {

 	if bridge != nil {
 		if err := weavenet.DetectHairpin("vethwe-bridge", Log); err != nil {
-			Log.Errorf("DetectHairpin failed: %s", err)
+			Log.Errorf("Setting may cause connectivity issues : %s", err)
+			Log.Infof("Hairpin mode may have been enabled by other software on this machine")
 		}
 	}

@@ -254,7 +255,8 @@ func main() {
 	checkFatal(err)
 	defer db.Close()

-	router := weave.NewNetworkRouter(config, networkConfig, name, nickName, overlay, db)
+	router, err := weave.NewNetworkRouter(config, networkConfig, name, nickName, overlay, db)
+	checkFatal(err)
 	Log.Println("Our name is", router.Ourself)

 	if peers, err = router.InitialPeers(resume, peers); err != nil {
@@ -274,11 +276,7 @@ func main() {
 		dockerVersion = dockerCli.DockerVersion()
 	}

-	network := ""
-	if isAWSVPC {
-		network = "awsvpc"
-	}
-	checkForUpdates(dockerVersion, network)
+	checkForUpdates(dockerVersion, router)

 	observeContainers := func(o docker.ContainerObserver) {
 		if dockerCli != nil {
@@ -476,7 +474,9 @@ func createAllocator(router *weave.NetworkRouter, config ipamConfig, preClaims [

 	allocator := ipam.NewAllocator(c)

-	allocator.SetInterfaces(router.NewGossip("IPallocation", allocator))
+	gossip, err := router.NewGossip("IPallocation", allocator)
+	checkFatal(err)
+	allocator.SetInterfaces(gossip)
 	allocator.Start()
 	router.Peers.OnGC(func(peer *mesh.Peer) { allocator.PeerGone(peer.Name) })

@@ -486,7 +486,9 @@ func createAllocator(router *weave.NetworkRouter, config ipamConfig, preClaims [
 func createDNSServer(config dnsConfig, router *mesh.Router, isKnownPeer func(mesh.PeerName) bool) (*nameserver.Nameserver, *nameserver.DNSServer) {
 	ns := nameserver.New(router.Ourself.Peer.Name, config.Domain, isKnownPeer)
 	router.Peers.OnGC(func(peer *mesh.Peer) { ns.PeerGone(peer.Name) })
-	ns.SetGossip(router.NewGossip("nameserver", ns))
+	gossip, err := router.NewGossip("nameserver", ns)
+	checkFatal(err)
+	ns.SetGossip(gossip)
 	upstream := nameserver.NewUpstream(config.ResolvConf, config.EffectiveListenAddress)
 	dnsserver, err := nameserver.NewDNSServer(ns, config.Domain, config.ListenAddress,
 		upstream, uint32(config.TTL), config.ClientTimeout)
@@ -14,11 +14,12 @@ import (

 func attach(args []string) error {
 	if len(args) < 4 {
-		cmdUsage("attach-container", "[--no-multicast-route] [--keep-tx-on] <container-id> <bridge-name> <mtu> <cidr>...")
+		cmdUsage("attach-container", "[--no-multicast-route] [--keep-tx-on] [--hairpin-mode=true|false] <container-id> <bridge-name> <mtu> <cidr>...")
 	}

 	keepTXOn := false
 	withMulticastRoute := true
+	hairpinMode := true
 	for i := 0; i < len(args); {
 		switch args[i] {
 		case "--no-multicast-route":
@@ -27,6 +28,9 @@ func attach(args []string) error {
 		case "--keep-tx-on":
 			keepTXOn = true
 			args = append(args[:i], args[i+1:]...)
+		case "--hairpin-mode=false":
+			hairpinMode = false
+			args = append(args[:i], args[i+1:]...)
 		default:
 			i++
 		}
@@ -55,7 +59,7 @@ func attach(args []string) error {
 		return err
 	}

-	err = weavenet.AttachContainer(weavenet.NSPathByPid(pid), fmt.Sprint(pid), weavenet.VethName, args[1], mtu, withMulticastRoute, cidrs, keepTXOn)
+	err = weavenet.AttachContainer(weavenet.NSPathByPid(pid), fmt.Sprint(pid), weavenet.VethName, args[1], mtu, withMulticastRoute, cidrs, keepTXOn, hairpinMode)
 	// If we detected an error but the container has died, tell the user that instead.
 	if err != nil && !processExists(pid) {
 		err = fmt.Errorf("Container %s died", args[0])
@@ -1224,7 +1224,7 @@ func (fastdp *FastDatapath) send(fops FlowOp, frame []byte, lock *fastDatapathLo
 	}

 	if fastdp.isHairpinFlow(&flow) {
-		log.Error("Vetoed installation of hairpin flow ", flow)
+		log.Warning("Vetoed installation of hairpin flow ", flow)
 		return
 	}

@@ -51,7 +51,7 @@ type NetworkRouter struct {
 	db   db.DB
 }

-func NewNetworkRouter(config mesh.Config, networkConfig NetworkConfig, name mesh.PeerName, nickName string, overlay NetworkOverlay, db db.DB) *NetworkRouter {
+func NewNetworkRouter(config mesh.Config, networkConfig NetworkConfig, name mesh.PeerName, nickName string, overlay NetworkOverlay, db db.DB) (*NetworkRouter, error) {
 	if overlay == nil {
 		overlay = NullNetworkOverlay{}
 	}
@@ -59,7 +59,11 @@ func NewNetworkRouter(config mesh.Config, networkConfig NetworkConfig, name mesh
 		networkConfig.Bridge = NullBridge{}
 	}

-	router := &NetworkRouter{Router: mesh.NewRouter(config, name, nickName, overlay, common.LogLogger()), NetworkConfig: networkConfig, db: db}
+	meshRouter, err := mesh.NewRouter(config, name, nickName, overlay, common.LogLogger())
+	if err != nil {
+		return nil, err
+	}
+	router := &NetworkRouter{Router: meshRouter, NetworkConfig: networkConfig, db: db}
 	router.Peers.OnInvalidateShortIDs(overlay.InvalidateShortIDs)
 	router.Routes.OnChange(overlay.InvalidateRoutes)
 	router.Macs = NewMacCache(macMaxAge,
@@ -67,7 +71,7 @@ func NewNetworkRouter(config mesh.Config, networkConfig NetworkConfig, name mesh
 			log.Println("Expired MAC", mac, "at", peer)
 		})
 	router.Peers.OnGC(func(peer *mesh.Peer) { router.Macs.Delete(peer) })
-	return router
+	return router, nil
 }

 // Start listening for TCP connections, locally captured packets, and
@@ -1,6 +1,7 @@
 ---
 title: Building Weave Net
 menu_order: 120
+search_type: Documentation
 ---
 You only need to build Weave Net if you want to work on the Weave Net codebase
 (or you just enjoy building software).
@@ -1,6 +1,7 @@
 ---
 title: Integrating Kubernetes and Mesos via the CNI Plugin
 menu_order: 65
+search_type: Documentation
 ---

 > The recommended way of using Weave with Kubernetes is via the new
@@ -11,11 +12,11 @@ menu_order: 65
 CNI, the [_Container Network Interface_](https://github.com/containernetworking/cni),
 is a proposed standard for configuring network interfaces for Linux
 application containers.  CNI is supported by
-[Kubernetes](http://kubernetes.io/), [Apache Mesos](mesos.apache.org)
+[Kubernetes](http://kubernetes.io/), [Apache Mesos](http://mesos.apache.org)
 and 
 [others](https://github.com/containernetworking/cni#who-is-using-cni).

-###Installing the Weave Net CNI plugin
+### Installing the Weave Net CNI plugin

 If your machine has the directories normally used to host CNI plugins, 
 then the Weave Net CNI plugin is installed when you run `weave setup`.
@@ -29,7 +30,7 @@ Then run:

    weave setup

-####Launching Weave Net
+#### Launching Weave Net

 To create a network that spans multiple hosts, the Weave peers must be connected to each other.  
 This is accomplished by specifying the other hosts during `weave launch` or via
@@ -40,7 +41,7 @@ for a discussion on peer connections.

    weave launch <peer hosts>

-####Using the CNI network configuration file
+#### Using the CNI network configuration file

 All CNI plugins are configured by a JSON file in the directory
 `/etc/cni/net.d/`.  `weave setup` installs a minimal configuration
@@ -64,9 +65,9 @@ The following other fields in the spec are supported:
 - `ipam / subnet` - default is to use Weave's IPAM default subnet
 - `ipam / gateway` - default is to use the Weave bridge IP address (allocated by `weave expose`)

-###Using the Weave Net CNI plugin
+### Using the Weave Net CNI plugin

-####Configuring Kubernetes to use the CNI Plugin
+#### Configuring Kubernetes to use the CNI Plugin

 After you've launched Weave and peered your hosts, you can configure
 Kubernetes to use Weave, by adding the following options to the
@@ -79,7 +80,7 @@ for more details.

 Now, whenever Kubernetes starts a pod, it will be attached to the Weave network.

-####Configuring Mesos to use the CNI plugin
+#### Configuring Mesos to use the CNI plugin

 To use the CNI plugin, the Mesos Agent must be started with reference
 to the CNI configuration and binary directories:
@@ -105,7 +106,7 @@ connected to the weave network)"
 For more information, see the 
 [Mesos documentation](http://mesos.apache.org/documentation/cni/).

-###Caveats
+### Caveats

 - The Weave Net router container must be running for CNI to allocate addresses
 - The CNI plugin does not add entries to weaveDNS.
@@ -1,6 +1,7 @@
 ---
 title: FAQ
 menu_order: 200
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: Feature Overview
 menu_order: 20
+search_type: Documentation
 ---

 * [Virtual Ethernet Switch](#virtual-ethernet-switch)
@@ -27,7 +28,7 @@ menu_order: 20

 For step-by-step instructions on how to use Weave Net, see [Using Weave Net](/site/using-weave.md).

-###<a name="virtual-ethernet-switch"></a>Virtual Ethernet Switch
+### <a name="virtual-ethernet-switch"></a>Virtual Ethernet Switch

 Weave Net creates a virtual network that connects Docker containers
 deployed across multiple hosts.
@@ -46,7 +47,7 @@ over Weave Net.
 To start using Weave Net, see [Installing Weave Net](/site/installing-weave.md) 
 and [Using Weave Net](/site/using-weave.md).

-###<a name="fast-data-path"></a>Fast Datapath
+### <a name="fast-data-path"></a>Fast Datapath

 Weave Net automatically chooses the fastest available method to 
 transport data between peers. The best performing of these 
@@ -55,7 +56,7 @@ transport data between peers. The best performing of these
 See [Using Fast Datapath](/site/using-weave/fastdp.md) and
 [How Fast Datapath Works](/site/how-it-works/fastdp-how-it-works.md).

-###<a name="docker"></a>Seamless Docker Integration (Weave Docker API Proxy)
+### <a name="docker"></a>Seamless Docker Integration (Weave Docker API Proxy)

 Weave Net includes a [Docker API Proxy](/site/weave-docker-api.md), which can be 
 used to start containers using the Docker [command-line interface](https://docs.docker.com/reference/commandline/cli/) or the [remote API](https://docs.docker.com/reference/api/docker_remote_api/), and attach them to the Weave network before they begin execution.
@@ -73,7 +74,7 @@ policy, are re-attached to the Weave network by the `Weave Docker API Proxy`.
 See [Integrating Docker via the API Proxy](/site/weave-docker-api.md).


-###<a name="plugin"></a>Weave Network Docker Plugin
+### <a name="plugin"></a>Weave Network Docker Plugin

 Weave Net can also be used as a [Docker plugin](https://docs.docker.com/engine/extend/plugins_network/).  A Docker network 
 named `weave` is created by `weave launch`, which is used as follows:
@@ -88,14 +89,14 @@ when there are network connectivity problems.
 See [Integrating Docker via the Network Plugin](/site/plugin.md) for more details.


-###<a name="cniplugin"></a>Weave Network CNI Plugin
+### <a name="cniplugin"></a>Weave Network CNI Plugin

 Weave can be used as a plugin to systems that support the [Container Network Interface](https://github.com/appc/cni), such as Kubernetes and Mesosphere.

 See [Integrating Kubernetes and Mesos via the CNI Plugin](/site/cni-plugin.md) for more details.


-###<a name="addressing"></a>IP Address Management (IPAM)
+### <a name="addressing"></a>IP Address Management (IPAM)
 
 Containers are automatically allocated a unique IP address. To view the addresses allocated by Weave, run `weave ps`.

@@ -106,7 +107,7 @@ For a discussion on how Weave Net uses IPAM, see [Automatic IP Address Managemen
 [the basics of IP addressing](/site/how-it-works/ip-addresses.md) for an explanation of addressing and private networks. 


-###<a name="naming-and-discovery"></a>Naming and Discovery
+### <a name="naming-and-discovery"></a>Naming and Discovery
 
 Named containers are automatically registered in [weaveDNS](/site/weavedns.md), 
 and are discoverable by using standard, simple name lookups:
@@ -119,7 +120,7 @@ WeaveDNS also supports [load balancing](/site/weavedns/load-balance-fault-weaved

 See [Discovering Containers with WeaveDNS](/site/weavedns.md).
 
-###<a name="application-isolation"></a>Application Isolation
+### <a name="application-isolation"></a>Application Isolation

 A single Weave network can host multiple, isolated 
 applications, with each application's containers being able 
@@ -136,13 +137,13 @@ See [Isolating Applications](/site/using-weave/application-isolation.md)
 for information on how to use the isolation-through-subnets 
 technique with Weave Net.

-###<a name="network-policy"></a>Network Policy
+### <a name="network-policy"></a>Network Policy

 The Weave [Kubernetes Addon](/site/kube-addon.md) includes a network
 policy controller that implements [Kubernetes Network
 Policies](http://kubernetes.io/docs/user-guide/networkpolicies/).

-###<a name="dynamic-network-attachment"></a>Dynamic Network Attachment
+### <a name="dynamic-network-attachment"></a>Dynamic Network Attachment

 At times, you may not know the application network for a 
 given container in advance. In these cases, you can take 
@@ -153,7 +154,7 @@ See [Dynamically Attaching and Detaching Containers](/site/using-weave/dynamical
 for details. 


-###<a name="security"></a>Security
+### <a name="security"></a>Security

 In keeping with our ease-of-use philosophy, the cryptography 
 in Weave Net is intended to satisfy a particular user requirement: 
@@ -179,14 +180,14 @@ and, additionally in the case of encrypted fast datapath using [the cryptography
 For information on how to secure your Docker network connections, see [Securing Connections Across Untrusted Networks](/site/using-weave/security-untrusted-networks.md) and for a more technical discussion on how Weave implements encryption see, [Weave Encryption](/site/how-it-works/encryption.md) and [How Weave Implements Encryption](/site/how-it-works/encryption-implementation.md).


-###<a name="host-network-integration"></a>Host Network Integration
+### <a name="host-network-integration"></a>Host Network Integration

 Weave Net application networks can be integrated with a host's network, and establish connectivity between the host and 
 application containers anywhere.

 See [Integrating with the Host Network](/site/using-weave/host-network-integration.md).

-###<a name="services"></a>Managing Services: Exporting, Importing, Binding and Routing
+### <a name="services"></a>Managing Services: Exporting, Importing, Binding and Routing
 
 * **Exporting Services** - Services running in containers on a Weave network can be made accessible to the outside world or to other networks.
 * **Importing Services** - Applications can run anywhere, and yet still be made accessible by specific application containers or services.
@@ -195,7 +196,7 @@ See [Integrating with the Host Network](/site/using-weave/host-network-integrati

 See [Managing Services - Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md) for instructions on how to manage services on a Weave container network. 

-###<a name="multi-cloud-networking"></a>Multi-Cloud Networking
+### <a name="multi-cloud-networking"></a>Multi-Cloud Networking

 Weave can network containers hosted in different cloud providers 
 or data centers. For example, you can run an application consisting 
@@ -206,7 +207,7 @@ of containers that run on [Google Compute Engine](https://cloud.google.com/compu
 See [Enabling Multi-Cloud networking and Muti-hop Routing](/site/using-weave/multi-cloud-multi-hop.md).


-###<a name="multi-hop-routing"></a>Multi-Hop Routing
+### <a name="multi-hop-routing"></a>Multi-Hop Routing

 A network of containers across more than two hosts can be established 
 even when there is only partial connectivity between the hosts. Weave Net
@@ -216,14 +217,14 @@ of connected hosts between them.
 See [Enabling Multi-Cloud networking and Multi-hop Routing](/site/using-weave/multi-cloud-multi-hop.md).


-###<a name="dynamic-topologies"></a>Dynamic Topologies
+### <a name="dynamic-topologies"></a>Dynamic Topologies

 Hosts can be added to or removed from a Weave network without stopping
 or reconfiguring the remaining hosts. See [Adding and Removing Hosts
 Dynamically.](/site/using-weave/finding-adding-hosts-dynamically.md)


-###<a name="container-mobility"></a>Container Mobility
+### <a name="container-mobility"></a>Container Mobility

 Containers can be moved between hosts without requiring any 
 reconfiguration or, in many cases, restarts of other containers. 
@@ -233,7 +234,7 @@ with the same IP address as it was given originally.
 See [Managing Services - Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md), in particular, Routing Services for more information on container mobility. 


-###<a name="fault-tolerance"></a>Fault Tolerance
+### <a name="fault-tolerance"></a>Fault Tolerance

 Weave Net peers continually exchange topology information, and 
 monitor and (re)establish network connections to other peers. 
@@ -1,6 +1,7 @@
 ---
 title: Understanding how Weave Net Works
 menu_order: 90
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: How Weave Net Implements Encryption
 menu_order: 70
+search_type: Documentation
 ---

 This section describes some details of Weave Net's built-in
@@ -13,7 +14,7 @@ This section describes some details of Weave Net's built-in



-####<a name="ephemeral-key"></a>Establishing the Ephemeral Session Key
+#### <a name="ephemeral-key"></a>Establishing the Ephemeral Session Key

 For every connection between peers, a fresh public/private key pair is
 created at both ends, using NaCl's `GenerateKey` function. The public
@@ -48,7 +49,7 @@ not be able to form valid ephemeral session keys.
 The same ephemeral session key is used for both TCP and UDP traffic
 between two peers.

-###<a name="csprng"></a> Key Generation and The Linux CSPRNG
+### <a name="csprng"></a> Key Generation and The Linux CSPRNG

 Generating fresh keys for every connection
 provides forward secrecy at the cost of placing a demand on the Linux
@@ -84,7 +85,7 @@ Weave Net's demand on `/dev/urandom` is causing you problems with blocking
 `/dev/random` reads, please get in touch with us - we'd love to hear
 about your use case.

-####<a name="tcp"></a>Encypting and Decrypting TCP Messages
+#### <a name="tcp"></a>Encypting and Decrypting TCP Messages

 TCP connection are only used to exchange topology information between
 peers, via a message-based protocol. Encryption of each message is
@@ -105,9 +106,9 @@ polarity. As a result the receiver will only be able to decrypt a
 message if it has the expected sequence number. This prevents replay
 attacks.

-####<a name="udp"></a>Encrypting and Decrypting UDP Packets
+#### <a name="udp"></a>Encrypting and Decrypting UDP Packets

-#####Sleeve
+##### Sleeve

 UDP connections carry captured traffic between peers. For a UDP packet
 sent between peers that are using crypto, the encapsulation looks as
@@ -181,7 +182,7 @@ contained in the set. The window spans at least 2^20 message sequence
 numbers, and hence any re-ordering between the most recent ~1 million
 messages is handled without dropping messages.

-#####Fast Datapath
+##### Fast Datapath

 Encryption in fastdp uses [the ESP protocol of IPsec](https://tools.ietf.org/html/rfc2406)
 in the transport mode. Each VXLAN packet is encrypted with
@@ -1,6 +1,7 @@
 ---
 title: Encryption and Weave Net
 menu_order: 60
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: How Fast Datapath Works
 menu_order: 30
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: IP Addresses, Routes and Networks
 menu_order: 50
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: How Weave Net Interprets Network Topology
 menu_order: 20
+search_type: Documentation
 ---

 This section contains the following topics: 
@@ -11,7 +12,7 @@ This section contains the following topics:
 * [What Happens When The Topology is Out of Date?](#out-of-date-topology)


-###<a name="topology"></a>Communicating Topology Among Peers
+### <a name="topology"></a>Communicating Topology Among Peers

 Topology messages capture which peers are connected to other peers. 
 Weave peers communicate their knowledge of the topology
@@ -49,7 +50,7 @@ improved update containing them is gossiped.
 If the update mentions a peer that the receiver does not know, then
 the entire update is ignored.

-####<a name="messages"></a>How Messages Are Formed
+#### <a name="messages"></a>How Messages Are Formed

 Every gossip message is structured as follows:

@@ -120,14 +121,14 @@ which the structure is:
    | Connection N: Established         |
    +-----------------------------------+

-####<a name="removing-peers"></a>Removing Peers
+#### <a name="removing-peers"></a>Removing Peers

 If a peer, after receiving a topology update, sees that another peer
 no longer has any connections within the network, it drops all
 knowledge of that second peer.


-####<a name="out-of-date-topology"></a>What Happens When The Topology is Out of Date?
+#### <a name="out-of-date-topology"></a>What Happens When The Topology is Out of Date?

 The propagation of topology changes to all peers is not instantaneous.
 Therefore, it is very possible for a node elsewhere in the network to have an
@@ -1,6 +1,7 @@
 ---
 title: Weave Net Router Sleeve Encapsulation
 menu_order: 10
+search_type: Documentation
 ---

 When the Weave Net router forwards packets to peers in `sleeve` mode
@@ -1,11 +1,12 @@
 ---
 title: Installing Weave Net
 menu_order: 30
+search_type: Documentation
 ---


 Ensure you are running Linux (kernel 3.8 or later) and have Docker
-(version 1.6.0 or later) installed. 
+(version 1.10.0 or later) installed.

 Install Weave Net by running the following:

@@ -20,13 +21,13 @@ After your VM is setup with Docker Machine, Weave Net can be launched directly f

 With Weave Net downloaded onto your VMs or hosts, you are ready to launch a Weave network and deploy apps onto it. See [Using Weave Net](/site/using-weave.md).

-###Quick Start Screencast
+### Quick Start Screencast

 <a href="https://youtu.be/kihQCCT1ykE" target="_blank">
  <img src="hello-screencast.png" alt="Click to watch the screencast" />
 </a>

-###Checkpoint
+### Checkpoint

 Weave Net [periodically contacts Weaveworks servers for available
 versions](https://github.com/weaveworks/go-checkpoint).  New versions
@@ -45,12 +46,12 @@ To disable this check, run the following before launching Weave Net:

    export CHECKPOINT_DISABLE=1

-###Guides for Specific Platforms
+### Guides for Specific Platforms

 CoreOS users see [here](/guides/networking-docker-containers-with-weave-on-coreos/) for an example of installing Weave using cloud-config.

 Amazon ECS users see [here](https://github.com/weaveworks/integrations/blob/master/aws/ecs/README.md)
-for the latest Weave AMIs and [here](http://weave.works/guides/service-discovery-with-weave-aws-ecs.html) to get started with Weave Net on ECS.
+for the latest Weave AMIs and [here](https://www.weave.works/docs/tutorials/old-guides/ecs/) to get started with Weave Net on ECS.

 If you're on Amazon EC2, the standard installation instructions at the
 top of this page, provide the simplest setup and the most flexibility.
@@ -1,6 +1,7 @@
 ---
 title: Using Weave with Systemd
 menu_order: 130
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: Introducing Weave Net
 menu_order: 10
+search_type: Documentation
 ---


@@ -9,52 +10,52 @@ Weave Net creates a virtual network that connects Docker containers across multi
 Services provided by application containers on the weave network can be exposed to the outside world, regardless of where they are running. Similarly, existing internal systems can be opened to accept connections from application containers irrespective of their location.


-##Why Weave?
+## Why Weave?

-###Hassle Free Configuration
+### Hassle Free Configuration

 Weave Net simplifies setting up a container network. Because containers on a Weave network use standard port numbers, (for example MySQL’s default is port 3306), managing microservices is straightforward. Every container can find the IP of any other container using a simple DNS query on the container's name, and it can also communicate directly without NAT, without using port mappings or complicated ambassador linking.  And best of all deploying a Weave container network requires zero changes to your application’s code. 

 ![Weave Net Encapsulation](weave-net-overview.png)

-###Service Discovery
+### Service Discovery

 Weave Net implements service discovery by providing a fast "micro DNS" server at each node. You simply name containers and everything 'just works', including load balancing across multiple containers with the same name.  

-###No External Cluster Store Required
+### No External Cluster Store Required

 All other Docker networking plugins, including Docker's own "Overlay" driver, require that you set up Docker with a cluster store – a central database like Consul or Zookeeper – before you can even use them. Besides being difficult to set up, maintain and manage, every Docker host must also be in constant contact with the cluster store: if you lose the connection, even temporarily, then you cannot start or stop any containers.

 Weave Net is bundled with a Docker Network plugin that doesn't require an external cluster store. You can get started right away and you can start and stop containers even when there are network connectivity problems.  
 For information about the Weave Docker Plugin, see [How The Weave Network Plugin Works](/site/plugin/plugin-how-it-works.md).

-###Operates in Partially Connected Networks
+### Operates in Partially Connected Networks

 Weave Net can forward traffic between nodes, and it works even if the mesh network is only partially connected.  This means that you can have a mix of legacy systems and containerized apps and still use Weave Net to keep everything in communication. 

-###Weave Net is Fast
+### Weave Net is Fast

 Weave Net automatically chooses the fastest path between two hosts, offering near native throughput and latency, all without your intervention.  

 See [How Fast Datapath Works](/site/using-weave/fastdp.md) for more information.

-###Network Operations Friendly
+### Network Operations Friendly

 Weave uses industry-standard VXLAN encapsulation between hosts. This means you can continue using your favorite packet analyzing tools, such as ‘Wireshark’ to inspect and troubleshoot protocols.

-###Weave Net is Secure
+### Weave Net is Secure

 Weave Net traverses firewalls without requiring a TCP add-on. You can encrypt your traffic, which allows you to connect to apps on hosts even across an untrusted network.  

-###Multicast Support
+### Multicast Support

 Multicast addressing and routing is fully supported in Weave Net. Data can be sent to one multicast address and it will be automatically broadcast to all of its recipients. 

-###NAT Traversal
+### NAT Traversal

 With Weave Net, deploy your applications - whether peer-to-peer file sharing, voice over IP or anything else - and take advantage of built-in NAT traversal. With Weave your app is portable, containerized and with its standardized approach to networking it gives you one less thing to worry about.

-###Run with Anything: Kubernetes, Mesos, Amazon ECS, ...
+### Run with Anything: Kubernetes, Mesos, Amazon ECS, ...

 Weave Net is a good choice if you want one tool for everything.  For example: In addition to Docker plugins, you can also use Weave as a Kubernetes plugin.  You can also use Weave with Amazon ECS or with Mesos and Marathon.  
 Refer to our Getting Started and Integration Guides for more information.
@@ -1,6 +1,7 @@
 ---
 title: Allocating IP Addresses
 menu_order: 70
+search_type: Documentation
 ---


@@ -112,7 +113,7 @@ peers. This can be useful to add peers to an existing fixed cluster
 (for example in response to a scale-out event) without worrying about
 adjusting initial peer counts accordingly.

-####<a name="quorum"></a> `--ipalloc-init consensus=` and How Quorum is Achieved
+#### <a name="quorum"></a> `--ipalloc-init consensus=` and How Quorum is Achieved

 Normally it isn't a problem to over-estimate the value supplied to
 `--ipalloc-init consensus=`, but if you supply a number that is too
@@ -1,6 +1,7 @@
 ---
 title: Automatic Allocation Across Multiple Subnets
 menu_order: 10
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: Starting, Stopping and Removing Peers
 menu_order: 20
+search_type: Documentation
 ---


@@ -34,7 +35,7 @@ them to be owned by host1. The name "host3" is resolved via the
 'nickname' feature of Weave Net, which defaults to the local host
 name. Alternatively, you can supply a peer name as shown in `weave status`.

-###<a name="caution-rmpeer"></a>Caution###
+### <a name="caution-rmpeer"></a>Caution###

 You cannot call `weave rmpeer` on more than one host. The address
 space, which was owned by the stale peer cannot be left dangling, and
@@ -1,6 +1,7 @@
 ---
 title: Troubleshooting the IP Allocator
 menu_order: 30
+search_type: Documentation
 ---


@@ -1,32 +1,44 @@
 ---
 title: Integrating Kubernetes via the Addon
 menu_order: 63
+search_type: Documentation
 ---

 The following topics are discussed:

 * [Installation](#install)
-* [Network Policy Controller](#npc)
+ * [Upgrading Kubernetes to version 1.6](#kube-1.6-upgrade)
 * [Upgrading the Daemon Sets](#daemon-sets)
+ * [CPU and Memory Requirements](#resources)
+ * [Pod Eviction](#eviction)
 * [Network Policy Controller](#npc)
 * [Troubleshooting Blocked Connections](#blocked-connections)
 * [Changing Configuration Options](#configuration-options)


-##<a name="install"></a> Installation
+## <a name="install"></a> Installation

 Weave Net can be installed onto your CNI-enabled Kubernetes cluster
 with a single command:

+* Kubernetes versions `1.6` and above:
+
 ```
-kubectl apply -f https://git.io/weave-kube
+$ kubectl apply -f https://git.io/weave-kube-1.6
+```
+
+* Kubernetes versions up to `1.5`:
+
+```
+$ kubectl apply -f https://git.io/weave-kube
 ```

 After a few seconds, a Weave Net pod should be running on each
 Node and any further pods you create will be automatically attached to the Weave
 network.

-**Note:** This command requires Kubernetes 1.4 or later.
+**Note:** This command requires Kubernetes 1.4 or later, and we
+recommend your master node has at least two CPU cores.

 > CNI, the [_Container Network Interface_](https://github.com/containernetworking/cni),
 > is a proposed standard for configuring network interfaces for Linux
@@ -51,12 +63,27 @@ Shut down Kubernetes, and _on all nodes_ perform the following:
 Then relaunch Kubernetes and install the addon as described
 above.

-The URL [https://git.io/weave-kube](https://git.io/weave-kube) points
-to the YAML file for the latest release of the Weave Net addon.
+The URLs [https://git.io/weave-kube](https://git.io/weave-kube) and [https://git.io/weave-kube-1.6](https://git.io/weave-kube-1.6) point
+to the YAML file for the [latest release](https://github.com/weaveworks/weave/releases/tag/latest_release) of the Weave Net addon.
 Historic versions are archived on our [GitHub release
 page](https://github.com/weaveworks/weave/releases).

-###<a name="daemon-sets"></a> Upgrading the Daemon Sets
+## <a name="kube-1.6-upgrade"></a> Upgrading Kubernetes to version 1.6
+
+In version 1.6, Kubernetes has increased security, so we need to
+create a special service account to run Weave Net. This is done in
+the file `weave-daemonset-k8s-1.6.yaml` attached to the [Weave Net
+release](https://github.com/weaveworks/weave/releases/latest).
+
+Also, the
+[toleration](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/taint-toleration-dedicated.md)
+required to let Weave Net run on master nodes has moved from an
+annotation to a field on the DaemonSet spec object.
+
+If you have edited the Weave Net DaemonSet from a previous release,
+you will need to re-make your changes against the new version.
+
+### <a name="daemon-sets"></a> Upgrading the Daemon Sets

 Kubernetes does not currently support rolling upgrades of daemon sets,
 and so you will need to perform the procedure manually:
@@ -68,7 +95,65 @@ and so you will need to perform the procedure manually:
  lose track of IP address range ownership, possibly leading to
  duplicate IP addresses if you then start a new copy of Weave Net.

-##<a name="npc"></a>Network Policy Controller
+## <a name="resources"></a>CPU and Memory Requirements
+
+Kubernetes manages
+[resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/)
+on each node, and only schedules pods to run on nodes that have enough
+free resources.
+
+The components of a typical Kubernetes installation (with the master
+node running etcd, scheduler, api-server, etc.) take up about 95% of a
+CPU, which leaves little room to run anything else. For all of Weave
+Net's features to work, it must run on every node, including the
+master.
+
+The best way to resolve this issue is to use machines with at least
+two CPU cores. However if you are installing Kubernetes and Weave Net
+for the first time, you may not be aware of this requirement. For this
+reason, Weave Net launches as a DaemonSet with a specification that
+reserves at least 1% CPU for each container. This enables Weave Net to
+start up seamlessly on a single-CPU node.
+
+Depending on the workload, Weave Net may need more than 1% of the
+CPU. The percentage set in the DaemonSet is the minimum and not a
+limit. This minimum setting allows Weave Net to take advantage of
+available CPU and "burst" above that limit if it needs to.
+
+## <a name="eviction"></a>Pod Eviction
+
+If a node runs out of CPU, memory or disk, Kubernetes may [decide to
+evict](https://kubernetes.io/docs/concepts/cluster-administration/out-of-resource/)
+one or more pods. It may choose to evict the Weave Net pod, which will
+disrupt pod network operations.
+
+You can reduce the chance of eviction by changing the DaemonSet to
+have a much bigger request, and a limit of the same value.
+
+This causes Kubernetes to apply a ["guaranteed" rather than a
+"burstable" policy](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/resource-qos.md).
+However a similar request for disk space can not
+be made, and so please be aware of this issue and monitor your
+resources to ensure that they stay below 100%.
+
+You can see when pods have been evicted via the `kubectl get events` command
+
+```
+LASTSEEN   COUNT     NAME          KIND    TYPE      REASON     SOURCE            MESSAGE
+1m         1         mypod-09vkd   Pod     Warning   Evicted    kubelet, node-1   The node was low on resource: memory.
+```
+
+or `kubectl get pods`
+
+```
+NAME                READY     STATUS    RESTARTS   AGE       IP          NODE
+mypod-09vkd         0/1       Evicted   0          1h        <none>      node-1
+```
+
+If you see this in your cluster, consider some of the above steps to
+reduce disruption.
+
+## <a name="npc"></a>Network Policy Controller

 The addon also supports the [Kubernetes policy
 API](http://kubernetes.io/docs/user-guide/networkpolicies/) so that
@@ -86,7 +171,7 @@ definition](http://kubernetes.io/docs/api-reference/extensions/v1beta1/definitio
  all multicast traffic) by adding `--allow-mcast` as an argument to
  `weave-npc` in the YAML configuration.

-###<a name="blocked-connections"></a> Troubleshooting Blocked Connections
+### <a name="blocked-connections"></a> Troubleshooting Blocked Connections

 If you suspect that legitimate traffic is being blocked by the Weave Network Policy Controller, the first thing to do is check the `weave-npc` container's logs.

@@ -118,7 +203,7 @@ TCP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC.
 UDP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC.
 ```

-###<a name="configuration-options"></a> Changing Configuration Options
+### <a name="configuration-options"></a> Changing Configuration Options

 The default configuration settings can be changed by saving and editing the
 addon YAML before running `kubectl apply`. Additional arguments may be
@@ -138,21 +223,25 @@ inserted into the YAML file like this:

 The list of variables you can set is:

-* CHECKPOINT\_DISABLE - if set to 1, disable checking for new Weave Net
+* `CHECKPOINT_DISABLE` - if set to 1, disable checking for new Weave Net
  versions (default is blank, i.e. check is enabled)
-* IPALLOC\_RANGE - the range of IP addresses used by Weave Net
-  and the subnet they are placed in (CIDR format; default 10.32.0.0/12)
-* EXPECT\_NPC - set to 0 to disable Network Policy Controller (default is on)
-* KUBE\_PEERS - list of addresses of peers in the Kubernetes cluster
+* `IPALLOC_RANGE` - the range of IP addresses used by Weave Net
+  and the subnet they are placed in (CIDR format; default `10.32.0.0/12`)
+* `EXPECT_NPC` - set to 0 to disable Network Policy Controller (default is on)
+* `KUBE_PEERS` - list of addresses of peers in the Kubernetes cluster
  (default is to fetch the list from the api-server)
-* IPALLOC\_INIT - set the initialization mode of the [IP Address
+* `IPALLOC_INIT` - set the initialization mode of the [IP Address
  Manager](/site/operational-guide/concepts.md#ip-address-manager)
-  (defaults to consensus amongst the KUBE\_PEERS)
-* WEAVE\_EXPOSE\_IP - set the IP address used as a gateway from the
+  (defaults to consensus amongst the `KUBE_PEERS`)
+* `WEAVE_EXPOSE_IP` - set the IP address used as a gateway from the
  Weave network to the host network - this is useful if you are
  configuring the addon as a static pod.
-* WEAVE\_MTU - Weave Net defaults to 1376 bytes, but you can set a
+* `WEAVE_MTU` - Weave Net defaults to 1376 bytes, but you can set a
  smaller size if your underlying network has a tighter limit, or set
  a larger size for better performance if your network supports jumbo
  frames - see [here](/site/using-weave/fastdp.md#mtu) for more
  details.
+* `HAIRPIN_MODE` - Weave Net defaults to enabling hairpin on the bridge side of
+  the `veth` pair for containers attached. If you need to disable hairpin, e.g. your
+  kernel is one of those that can panic if hairpin is enabled, then you can disable it
+  by setting `HAIRPIN_MODE=false`.
@@ -1,6 +1,7 @@
 ---
 title: Monitoring with Prometheus
 menu_order: 105
+search_type: Documentation
 ---

 Two endpoints are exposed: one for the Weave Net router, and, when deployed as
@@ -1,6 +1,7 @@
 ---
 title: Operational Guide
 menu_order: 45
+search_type: Documentation
 ---
 This operational guide is intended to give you an overview of how to
 operate and manage a Weave Network in production. It consists of three
@@ -1,6 +1,7 @@
 ---
 title: Autoscaling
 menu_order: 40
+search_type: Documentation
 ---

 ### Bootstrapping
@@ -1,6 +1,7 @@
 ---
 title: Concepts
 menu_order: 10
+search_type: Documentation
 ---
 This section describes some of the essential concepts with which you will
 need to be familiar before continuing to the example deployment
@@ -18,18 +19,18 @@ The following concepts are described:
    * [Observers](#observers)
 * [Persistence](#persistence)

-##<a name="host"></a>Host
+## <a name="host"></a>Host

 For the purposes of this documentation a host is an
 installation of the Linux operating system that is running an
 instance of the Docker Engine. The host may be executing directly on bare
 hardware or inside a virtual machine.

-##<a name="peer"></a>Peer
+## <a name="peer"></a>Peer

 A peer is a running instance of Weave Net, typically one per host.

-##<a name="peer-name"></a>Peer Name
+## <a name="peer-name"></a>Peer Name

 Weave Net peers are identified by a 48-bit value formatted like an
 ethernet MAC address, for example, `01:23:45:67:89:ab`. The 'peer
@@ -66,14 +67,14 @@ The appropriate strategy for assigning peer names depends on the type
 and method of your particular deployment and is discussed in more
 detail below.

-##<a name="peer-discovery"></a>Peer Discovery
+## <a name="peer-discovery"></a>Peer Discovery

 Peer discovery is a mechanism that allows peers to learn about new
 Weave Net hosts from existing peers without being explicitly told. Peer
 discovery is
 [enabled by default](/site/using-weave/finding-adding-hosts-dynamically.md).

-##<a name="network-partition"></a>Network Partition
+## <a name="network-partition"></a>Network Partition

 A network partition is a transient condition whereby some arbitrary
 subsets of peers are unable to communicate with each other for the
@@ -82,7 +83,7 @@ optic line severed. Weave Net is designed to allow peers and their
 containers to make maximum safe progress under conditions of
 partition, healing automatically once the partition is over.

-##<a name="ip-address-manager"></a>IP Address Manager (IPAM)
+## <a name="ip-address-manager"></a>IP Address Manager (IPAM)

 [IPAM](/site/ipam.md) is the subsystem responsible for dividing up a
 large contiguous block of IP addresses (known as the IP allocation
@@ -116,7 +117,7 @@ scenarios:

 * [Uniform Dynamic Cluster](/site/operational-guide/uniform-dynamic-cluster.md)

-###<a name="consensus"></a>Consensus
+### <a name="consensus"></a>Consensus

 Alternatively, when a new network is formed for the first time, peers
 can be configured to co-ordinate amongst themselves to automatically
@@ -132,7 +133,7 @@ scenarios:
 * [Interactive Deployment](/site/operational-guide/interactive.md)
 * [Uniform Fixed Cluster](/site/operational-guide/uniform-fixed-cluster.md)

-###<a name="observers"></a>Observers
+### <a name="observers"></a>Observers

 Finally, an option is provided to start a peer as an _observer_. Such
 peers do not require a seed peer name list or an initial peer
@@ -146,7 +147,7 @@ scenarios:

 * [Autoscaling](/site/operational-guide/autoscaling.md)

-##<a name="persistence"></a>Persistence
+## <a name="persistence"></a>Persistence

 Certain information is remembered between launches of Weave Net (for
 example across reboots):
@@ -1,6 +1,7 @@
 ---
 title: Interactive Deployment
 menu_order: 20
+search_type: Documentation
 ---
 Weave Net can be launched interactively on the command line, and as 
 long as Docker is configured to start on boot, the network will survive 
@@ -1,6 +1,7 @@
 ---
 title: Administrative Tasks
 menu_order: 60
+search_type: Documentation
 ---

 The following administrative tasks are discussed: 
@@ -12,7 +13,7 @@ The following administrative tasks are discussed:
 * [Resetting Persisted Data](#reset)


-##<a name="start-on-boot"></a>Configuring Weave Net to Start Automatically on Boot
+## <a name="start-on-boot"></a>Configuring Weave Net to Start Automatically on Boot

 `weave launch` runs all of Weave Net's containers with a Docker restart
 policy set to `always`.  If you have launched Weave Net manually at least
@@ -23,7 +24,7 @@ If you are aiming for a non-interactive installation, use
 [systemd](/site/installing-weave/systemd.md) or a similar init system to
 launch Weave using the `--no-restart` flag after Docker has been started.

-##<a name="detect-reclaim-ipam"></a>Detecting and Reclaiming Lost IP Address Space
+## <a name="detect-reclaim-ipam"></a>Detecting and Reclaiming Lost IP Address Space

 The recommended method of removing a peer is to run `weave reset` on that
 peer before the underlying host is decommissioned or repurposed. This
@@ -43,7 +44,7 @@ or possible:
 In some cases you may already be aware of the problem, as you were
 unable to execute `weave reset` successfully or because you know
 through other channels that the host has died. In these cases you can
-proceed straight to [Manually Reclaiming Lost Address Space](#reclaim-address-space).
+proceed straight to [Manually Reclaiming Lost Address Space](#manually-reclaim-address-space).

 However in some scenarios it may not be obvious that space has been
 lost, in which case you can check for it periodically with the
@@ -56,7 +57,7 @@ range managed by peer and also identifies the names of unreachable peers. If you
 that the peer is truly gone, rather than temporarily unreachable due to a
 partition, you can reclaim their space manually.

-###<a name="manually-reclaim-address-space"></a>Manually Reclaiming Address Space
+### <a name="manually-reclaim-address-space"></a>Manually Reclaiming Address Space

 When a peer dies unexpectedly the remaining peers will consider its
 address space to be unavailable even after it has remained unreachable
@@ -70,7 +71,7 @@ command is provided to perform this task, and must
 be executed on _one_ of the remaining peers. That peer will then take
 ownership of the freed address space.

-##<a name="cluster-upgrade"></a>Upgrading a Cluster
+## <a name="cluster-upgrade"></a>Upgrading a Cluster

 Protocol versioning and feature negotiation are employed in Weave Net
 to enable incremental rolling upgrades. Each major maintains
@@ -102,7 +103,7 @@ To minimize downtime while the new script is pulling the new container images:
 there are any special caveats or deviations from the standard
 procedure.

-##<a name="reset"></a>Resetting Persisted Data
+## <a name="reset"></a>Resetting Persisted Data

 Weave Net persists information in a data volume container named
 `weavedb`. If you wish to start from a completely clean slate (for
@@ -1,6 +1,7 @@
 ---
 title: Uniform Dynamic Clusters
 menu_order: 50
+search_type: Documentation
 ---

 A uniform dynamic cluster has the following characteristics:
@@ -1,6 +1,7 @@
 ---
 title: Uniform Fixed Clusters
 menu_order: 30
+search_type: Documentation
 ---

 This scenario describes a production deployment of a fixed number of N
@@ -1,11 +1,11 @@
 ---
 title: Integrating Docker via the Network Plugin
 menu_order: 60
+search_type: Documentation
 ---

 * [Launching Weave Net and Running Containers Using the Plugin](#launching)
 * [Restarting the Plugin](#restarting)
- * [Configuring the Plugin](#configuring)

 Docker versions 1.9 and later have a plugin mechanism for adding
 different network providers. Weave Net installs itself as a network
@@ -34,7 +34,7 @@ which a helper is provided in the Weave script:
    # ping foo


-###<a name="launching"></a>Launching Weave Net and Running Containers Using the Plugin
+### <a name="launching"></a>Launching Weave Net and Running Containers Using the Plugin

 Just launch the Weave Net router onto each host and make a peer connection with the other hosts:

@@ -55,7 +55,7 @@ then run your containers using the Docker command-line:
    64 bytes from 10.32.0.2: icmp_seq=2 ttl=64 time=0.052 ms


-###<a name="multi"></a>Creating multiple Docker Networks
+### <a name="multi"></a>Creating multiple Docker Networks

 Docker enables you to create multiple independent networks and attach
 different sets of containers to each network. However, coordinating
@@ -79,7 +79,7 @@ Containers attached to different Docker Networks are
 [isolated through subnets](https://www.weave.works/docs/net/latest/using-weave/application-isolation/).


-###<a name="restarting"></a>Restarting the Plugin
+### <a name="restarting"></a>Restarting the Plugin

 The plugin, like all Weave Net components, is started with a policy of `--restart=always`, so that it is always there after a restart or reboot. If you remove this container (for example, when using `weave reset`) before removing all endpoints created using `--net=weave`, Docker may hang for a long time when it subsequently tries to re-establish communications to the plugin.

@@ -90,7 +90,7 @@ If you are using `systemd` with Docker 1.9, it is advised that you modify the Do
    TimeoutStartSec=0


-###<a name="configuring"></a>Configuring the Plugin
+### <a name="configuring"></a>Configuring the Plugin

 The plugin accepts a number of configuration parameters. To supply
 these, instead of running `weave launch`, start the router and plugin
@@ -1,6 +1,7 @@
 ---
 title: How the Weave Net Docker Network Plugin Works
 menu_order: 20
+search_type: Documentation
 ---


@@ -22,7 +23,7 @@ If you do create additional networks using the `weavemesh` driver, containers at

 There's no specific documentation from Docker on using a cluster
 store, but the first part of
-[Getting Started with Docker Multi-host Networking](https://github.com/docker/docker/blob/master/docs/userguide/networking/get-started-overlay.md) is a good place to start.
+[Getting Started with Docker Multi-host Networking](https://docs.docker.com/engine/userguide/networking/get-started-overlay/) is a good place to start.

 >**Note:** In the case of multiple networks using the `weave` driver, all containers are on the same virtual network but Docker allocates their addresses on different subnets so they cannot talk to each other directly.

@@ -1,6 +1,7 @@
 ---
 title: Troubleshooting Weave Net
 menu_order: 110
+search_type: Documentation
 ---


@@ -1,9 +1,10 @@
 ---
 title: Using Weave Net
 menu_order: 40
+search_type: Documentation
 ---

-Weave Net provides a simple to deploy networking solution for containerized apps. Here, we describe how to manage a Weave container network using a sample application which consists of two simple `netcat` services deployed to containers on two separate hosts, and sometimes extended across three hosts.  
+Weave Net provides a simple to deploy networking solution for containerized apps. Here, we describe how to manage a Weave container network using a sample application which consists of two simple `netcat` services deployed to containers on two separate hosts.

 This section contains the following topics: 

@@ -13,7 +14,7 @@ This section contains the following topics:
 * [Starting the Netcat Service](#start-netcat)


-###<a name="launching"></a>Launching Weave Net
+### <a name="launching"></a>Launching Weave Net

 Before launching Weave Net and deploying your apps, ensure that Docker is [installed](https://docs.docker.com/engine/installation/) on both hosts. 

@@ -57,7 +58,7 @@ You can also preload the images by running `weave setup`. Preloaded images are u
 If you are deploying an application that consists of more than one container to the same host, launch them one after another using `docker run`, as appropriate.  


-###<a name="peer-connections"></a>Creating Peer Connections Between Hosts
+### <a name="peer-connections"></a>Creating Peer Connections Between Hosts

 To launch Weave Net on an additional host and create a peer connection, run the following:

@@ -73,7 +74,7 @@ You can also peer with other hosts by specifying the IP address, and a `:port` b

 There are a number of different ways that you can specify peers on a Weave network. You can launch Weave Net on `$HOST1` and then peer with `$HOST2`, or you can launch on `$HOST2` and peer with `$HOST1` or you can tell both hosts about each other at launch. The order in which peers are specified is not important. Weave Net automatically (re)connects to peers when they become available. 

-####Specifying Multiple Peers at Launch
+#### Specifying Multiple Peers at Launch

 To specify multiple peers, supply a list of addresses to which you want to connect, all separated by spaces. 

@@ -83,7 +84,7 @@ For example:

 Peers can also be dynamically added. See [Adding Hosts Dynamically](/site/using-weave/finding-adding-hosts-dynamically.md) for more information.

-####Restricting Access
+#### Restricting Access

 By default Weave Net listens on all host IPs (i.e. 0.0.0.0). This
 can be altered with the `--host` parameter to `weave launch`, for example, 
@@ -95,7 +96,7 @@ Weave Net control and data ports.
 For communication across untrusted networks, connections can be
 [encrypted](/site/using-weave/security-untrusted-networks.md).

-###<a name="testing"></a>Testing Container Communications
+### <a name="testing"></a>Testing Container Communications

 With two containers running on separate hosts, test that both containers are able to find and communicate with one another using ping. 

@@ -116,7 +117,7 @@ Similarly, in the container started on `$HOST2`...
    1 packets transmitted, 1 received, 0% packet loss, time 0ms
    rtt min/avg/max/mdev = 0.366/0.366/0.366/0.000 ms

-###<a name="start-netcat"></a>Starting the Netcat Service
+### <a name="start-netcat"></a>Starting the Netcat Service

 The `netcat` service can be started using the following commands:  

@@ -1,6 +1,7 @@
 ---
 title: Isolating Applications on a Weave Network
 menu_order: 30
+search_type: Documentation
 ---

 A single Weave network can host multiple, isolated applications where each application's containers are able 
@@ -1,6 +1,7 @@
 ---
 title: Using IP Routing on an Amazon Web Services Virtual Private Cloud
 menu_order: 110
+search_type: Documentation
 ---

 If your container infrastructure is running entirely within Amazon Web Services (AWS) 
@@ -16,7 +17,7 @@ on which they live.

 ![Weave Net AWS-VPC Mode](weave-net-awsvpc-1007x438.png)

-###Configuring EC2 Instances to use Weave AWS-VPC Mode
+### Configuring EC2 Instances to use Weave AWS-VPC Mode

 First, your AWS instances need to be given write access to the route
 table via its
@@ -59,7 +60,7 @@ addresses will flow over the AWS network unmodified.
 Finally, since Weave will be operating with IP addresses outside of the 
 range allocated by Amazon, you must disable "Source/Destination check" on each machine.

-###Using AWS-VPC Mode
+### Using AWS-VPC Mode

 Launch Weave Net with the `--awsvpc` flag:

@@ -68,7 +69,7 @@ Launch Weave Net with the `--awsvpc` flag:
 >>**Note:** You will still need to supply the names or IP addresses of other hosts in
 your cluster.

-###Present Limitations
+### Present Limitations

 - AWS-VPC mode does not inter-operate with other Weave Net modes; it
  is all or nothing.  In this mode, all hosts in a cluster must be AWS
@@ -85,7 +86,7 @@ your cluster.
 - All of your containers must be on the same network, with no subnet
  isolation. (We hope to ease this limitation in future.)

-###Packet size (MTU)
+### Packet size (MTU)

 The Maximum Transmission Unit, or MTU, is the technical term for the
 limit on how big a single packet can be on the network. Weave Net
@@ -1,6 +1,7 @@
 ---
 title: Allocating IPs in a Specific Range
 menu_order: 15
+search_type: Documentation
 ---

 The default configurations for both Weave Net and Docker use [Private
@@ -1,6 +1,7 @@
 ---
 title: Dynamically Attaching and Detaching Applications
 menu_order: 40
+search_type: Documentation
 ---


@@ -20,7 +21,7 @@ where,

 >Note If you are using the Weave Docker API proxy, it will have modified `DOCKER_HOST` to point to the proxy and therefore you will have to pass `-e WEAVE_CIDR=none` to start a container that _doesn't_ get automatically attached to the weave network for the purposes of this example.

-###Dynamically Detaching Containers
+### Dynamically Detaching Containers

 A container can be detached from a subnet, by using the `weave detach` command:

@@ -1,6 +1,7 @@
 ---
 title: Using Fast Datapath
 menu_order: 96
+search_type: Documentation
 ---


@@ -10,13 +11,13 @@ When Weave Net cannot use the fast data path between two hosts, it falls back to

 See [How Fastdp Works](/site/how-it-works/fastdp-how-it-works.md) for a more in-depth discussion of this feature. 

-###Disabling Fast Datapath
+### Disabling Fast Datapath

 You can disable fastdp by enabling the `WEAVE_NO_FASTDP` environment variable at `weave launch`:

    $ WEAVE_NO_FASTDP=true weave launch

-###Fast Datapath and Encryption
+### Fast Datapath and Encryption

 Fast datapath implements encryption using IPsec which is configured with IP
 transformation framework (XFRM) provided by the Linux kernel.
@@ -28,7 +29,7 @@ Cloud Platform denies ESP packets by default.
 See [How Weave Implements Encryption](/site/how-it-works/encryption-implementation.md)
 for more details for the fastdp encryption.

-###Viewing Connection Mode Fastdp or Sleeve
+### Viewing Connection Mode Fastdp or Sleeve

 Weave Net automatically uses the fastest datapath for every connection unless it encounters a situation that prevents it from working. To ensure that Weave Net can use the fast datapath:

@@ -48,7 +49,7 @@ Where fastdp indicates that fast datapath is being used on a connection. If fast
    $ weave status connections
    <- 192.168.122.25:54782  established sleeve 8a:50:4c:23:11:ae(ubuntu1204)

-###<a name="mtu"></a>Packet size (MTU)
+### <a name="mtu"></a>Packet size (MTU)

 The Maximum Transmission Unit, or MTU, is the technical term for the
 limit on how big a single packet can be on the network. Weave Net
@@ -1,6 +1,7 @@
 ---
 title: Adding and Removing Hosts Dynamically
 menu_order: 90
+search_type: Documentation
 ---

 To add a host to an existing Weave network, launch Weave Net on the
@@ -23,7 +24,7 @@ hosts run:
 Any other existing hosts on the Weave network will attempt to
 establish connections to the new host as well.

-###Instructing Peers to Forget a Host
+### Instructing Peers to Forget a Host

 To instruct a peer to forget a particular host specified to it via
 `weave launch` or `weave connect` run:
@@ -34,14 +35,14 @@ This prevents the peer from reconnecting to that host once
 connectivity to it is lost, and can be used to administratively remove
 any decommissioned peers from the network.

-###Bulk Replacing Hosts
+### Bulk Replacing Hosts

 Hosts can also be bulk-replaced. All existing hosts will be forgotten,
 and the new hosts added:

    host# weave connect --replace $NEW_HOST1 $NEW_HOST2

-###Restarting Docker and Weave Net
+### Restarting Docker and Weave Net

 If Weave Net is restarted by Docker it automatically remembers any
 previous connect and forget operations, however if you stop it
@@ -1,6 +1,7 @@
 ---
 title: Integrating with the Host Network
 menu_order: 60
+search_type: Documentation
 ---

 Weave application networks can be integrated with an external host network, establishing connectivity between the host and with application containers running anywhere.
@@ -22,7 +23,7 @@ And you can also ping the `a1` netcat application container residing on `$HOST1`

    host2$ ping $(weave dns-lookup a1)

-###Exposing Multiple Subnets
+### Exposing Multiple Subnets

 Multiple subnet addresses can be exposed or hidden using a single command:

@@ -31,14 +32,14 @@ Multiple subnet addresses can be exposed or hidden using a single command:
    host2$ weave hide   net:default net:10.2.2.0/24
    10.2.1.132 10.2.2.130

-###Adding Exposed Addresses to weaveDNS
+### Adding Exposed Addresses to weaveDNS

 Exposed addresses can also be added to weaveDNS by supplying fully qualified domain names:

    host2$ weave expose -h exposed.weave.local
    10.2.1.132

-###<a name="routing"></a>Routing from Another Host
+### <a name="routing"></a>Routing from Another Host

 After running `weave expose`, you can use Linux routing to provide
 access to the Weave network from hosts that are not running Weave Net:
@@ -1,6 +1,7 @@
 ---
 title: Manually Specifying the IP Address of a Container
 menu_order: 20
+search_type: Documentation
 ---

 Containers are automatically allocated an IP address that is unique across the Weave network. You can see which address was allocated by running, [`weave ps`](/site/troubleshooting.md#weave-status):
@@ -1,10 +1,11 @@
 ---
 title: Enabling Multi-Cloud, Multi-Hop Networking and Routing
 menu_order: 100
+search_type: Documentation
 ---


-###Enabling Multi-Cloud Networking
+### Enabling Multi-Cloud Networking

 Before multi-cloud networking can be enabled, you must configure the network to allow 
 connections through Weave Net's control and data ports on the Docker hosts. By default, the 
@@ -20,7 +21,7 @@ port and UDP 9000/9001 for its data port.
 the same setting.


-###Multi-hop routing
+### Multi-hop routing

 A network of containers across more than two hosts can be 
 established even when there is only partial connectivity 
@@ -1,6 +1,7 @@
 ---
 title: Securing Connections Across Untrusted Networks
 menu_order: 80
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: Managing Services - Exporting, Importing, Binding and Routing
 menu_order: 70
+search_type: Documentation
 ---

 This section contains the following topics: 
@@ -13,7 +14,7 @@ This section contains the following topics:



-###<a name="exporting"></a>Exporting Services
+### <a name="exporting"></a>Exporting Services

 Services running in containers on a Weave network can be made
 accessible to the outside world (and, more generally, to other networks)
@@ -43,7 +44,7 @@ With the above in place, you can connect to the 'nc' service from anywhere using

 Similar NAT rules to the above can be used to expose services not just to the outside world but also to other, internal, networks.

-###<a name="importing"></a>Importing Services
+### <a name="importing"></a>Importing Services

 Applications running in containers on a Weave network can be given access to services, which are only reachable from certain 
 Weave hosts, regardless of where the actual application containers are located.
@@ -73,7 +74,7 @@ You can now connect to it from the application container running on `$HOST2` usi

 Note that you should be able to run this command from any application container.

-###<a name="binding"></a>Binding Services
+### <a name="binding"></a>Binding Services

 Importing a service provides a degree of indirection that allows late and dynamic binding, similar to what can be achieved with a proxy. 

@@ -81,7 +82,7 @@ Referring back to the [netcat services example that is running on three hosts](#

 You can point application containers to another service location by changing the above NAT rule, without altering the applications.

-###<a name="routing"></a>Routing Services
+### <a name="routing"></a>Routing Services

 You can combine the service export and service import features to establish connectivity between applications and services residing on disjointed networks, even if those networks are separated by firewalls and have overlapping IP ranges. 

@@ -103,7 +104,7 @@ Now any host on the same network as `$HOST2` is able to access the service:

    echo 'Hello, world.' | nc $HOST2 4433

-###<a name="change-location"></a>Dynamically Changing Service Locations
+### <a name="change-location"></a>Dynamically Changing Service Locations

 Furthermore, as explained in Binding Services, service locations can be dynamically altered without having to change any of the applications that access them.  

@@ -1,6 +1,7 @@
 ---
 title: Integrating Docker via the API Proxy
 menu_order: 50
+search_type: Documentation
 ---

 The Docker API proxy automatically attaches containers to the Weave
@@ -9,7 +10,7 @@ network when they are started using the ordinary Docker
 or the [remote API](https://docs.docker.com/reference/api/docker_remote_api/),
 instead of `weave run`.

-###<a name="attaching-containers"></a>Attaching Containers to a Weave Network
+### <a name="attaching-containers"></a>Attaching Containers to a Weave Network

 There are three ways to attach containers to a Weave network (which method to use is 
 entirely up to you):
@@ -34,7 +35,7 @@ See [Integrating Docker via the Network Plugin](/site/plugin.md).
 does not use the Weave Docker API Proxy. 
 See [Launching Containers With Weave Run (without the Proxy)](/site/weave-docker-api/launching-without-proxy.md). 

-###<a name="weave-api-proxy"></a>Setting Up The Weave Net Docker API Proxy
+### <a name="weave-api-proxy"></a>Setting Up The Weave Net Docker API Proxy

 The proxy sits between the Docker client (command line or API) and the
 Docker daemon, and intercepts the communication between the two. You can
@@ -1,6 +1,7 @@
 ---
 title: Using Automatic Discovery With the Weave Net Proxy
 menu_order: 30
+search_type: Documentation
 ---

 Containers launched via the proxy use [weaveDNS](/site/weavedns.md)
@@ -1,6 +1,7 @@
 ---
 title: Automatic IP Allocation and the Weave Proxy
 menu_order: 25
+search_type: Documentation
 ---


@@ -19,7 +20,7 @@ To start a container without connecting it to the Weave network, pass

    host1$ docker run -ti -e WEAVE_CIDR=none weaveworks/ubuntu

-###Disabling Automatic IP Address Allocation
+### Disabling Automatic IP Address Allocation

 If you do not want an IP to be assigned by default, the proxy needs to
 be passed the `--no-default-ipalloc` flag, for example:
@@ -1,6 +1,7 @@
 ---
 title: Launching Containers With Weave Run (without the Proxy)
 menu_order: 50
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: Name resolution via `/etc/hosts`
 menu_order: 40
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: Securing the Docker Communications With TLS
 menu_order: 20
+search_type: Documentation
 ---

 If you are [connecting to the docker daemon with
@@ -1,6 +1,7 @@
 ---
 title: Troubleshooting
 menu_order: 60
+search_type: Documentation
 ---

 The command
@@ -1,6 +1,7 @@
 ---
 title: Using The Weave Docker API Proxy
 menu_order: 10
+search_type: Documentation
 ---


@@ -12,7 +13,7 @@ When they are started via the Weave Net proxy, containers are
 [automatically assigned IP addresses](/site/ipam.md) and connected to the
 Weave network.  

-###Creating and Starting Containers with the Weave Net Proxy
+### Creating and Starting Containers with the Weave Net Proxy

 To create and start a container via the Weave Net proxy run:

@@ -33,7 +34,7 @@ variable by space-separating them, as in
 `WEAVE_CIDR="10.2.1.1/24 10.2.2.1/24"`.


-###Returning Weave Network Settings Instead of Docker Network Settings
+### Returning Weave Network Settings Instead of Docker Network Settings

 The Docker NetworkSettings (including IP address, MacAddress, and
 IPPrefixLen), are still returned when `docker inspect` is run. If you want
@@ -46,13 +47,13 @@ only includes one of them.

    host1$ weave launch-router && weave launch-proxy --rewrite-inspect

-###Multicast Traffic and Launching the Weave Proxy
+### Multicast Traffic and Launching the Weave Proxy

 By default, multicast traffic is routed over the Weave network.
 To turn this off, for example, because you want to configure your own multicast
 route, add the `--no-multicast-route` flag to `weave launch-proxy`.

-###Other Weave Proxy options
+### Other Weave Proxy options

 * `--without-dns` -- stop telling containers to use [WeaveDNS](/site/weavedns.md)
 * `--log-level=debug|info|warning|error` -- controls how much
@@ -1,6 +1,7 @@
 ---
 title: Discovering Containers with WeaveDNS
 menu_order: 80
+search_type: Documentation
 ---


@@ -1,6 +1,7 @@
 ---
 title: How Weave Finds Containers
 menu_order: 10
+search_type: Documentation
 ---


@@ -21,7 +22,7 @@ When weaveDNS is queried for a name in a domain other than
 `.weave.local`, it queries the host's configured nameserver, which is
 the standard behaviour for Docker containers.

-###Specifying a Different Docker Bridge Device
+### Specifying a Different Docker Bridge Device

 So that containers can connect to a stable and always routable IP
 address, weaveDNS listens on port 53 to the Docker bridge device, which
@@ -1,6 +1,7 @@
 ---
 title: Load Balancing and Fault Resilience with weaveDNS
 menu_order: 20
+search_type: Documentation
 ---


@@ -48,7 +49,7 @@ WeaveDNS removes the addresses of any container that dies. This offers
 a simple way to implement redundancy. E.g. if in our example we stop
 one of the `pingme` containers and re-run the ping tests, eventually
 (within ~30s at most, since that is the weaveDNS
-[cache expiry time](#ttl)) we will only be hitting the address of the
+[cache expiry time](/site/weavedns/managing-entries-weavedns.md#ttl)) we will only be hitting the address of the
 container that is still alive.

 **See Also**
@@ -1,6 +1,7 @@
 ---
 title: Managing Domains
 menu_order: 30
+search_type: Documentation
 ---

 The following topics are discussed:
@@ -44,6 +45,6 @@ link-local as per [RFC6762](https://tools.ietf.org/html/rfc6762),
 (though this is not strictly necessary).


- * [How Weave Finds Containers](/site/how-works-weavedns.md.md)
+ * [How Weave Finds Containers](/site/how-works-weavedns.md)
 * [Load Balancing and Fault Resilience with WeaveDNS](/site/weavedns/load-balance-fault-weavedns.md)
 * [Managing Domain Entries](/site/weavedns/managing-entries-weavedns.md)
@@ -1,19 +1,16 @@
 ---
 title: Managing Domain Entries
 menu_order: 40
+search_type: Documentation
 ---

-
 The following topics are discussed: 

 * [Adding and removing extra DNS entries](#add-remove)
 * [Resolving WeaveDNS entries from the Host](#resolve-weavedns-entries-from-host)
 * [Hot-swapping Service Containers](#hot-swapping)
-* [Retaining DNS Entries When Containers Stop](#retain-stopped)
 * [Configuring a Custom TTL](#ttl)

-
-
 ### <a name="add-remove"></a>Adding and Removing Extra DNS Entries

 If you want to give the container a name in DNS *other* than its
@@ -81,6 +78,6 @@ weaveDNS instance will receive.

 **See Also**

- * [How Weave Finds Containers](/site/how-works-weavedns.md)
+ * [How Weave Finds Containers](/site/weavedns/how-works-weavedns.md)
 * [Load Balancing and Fault Resilience with WeaveDNS](/site/weavedns/load-balance-fault-weavedns.md)
 * [Managing Domains](/site/weavedns/managing-domains-weavedns.md)
@@ -1,6 +1,7 @@
 ---
 title: Troubleshooting and Present Limitations
 menu_order: 50
+search_type: Documentation
 ---


@@ -8,7 +8,7 @@ cni_connect() {
    pid=$(container_pid $1 $2)
    id=$(docker_on $1 inspect -f '{{.Id}}' $2)
    run_on $1 sudo CNI_COMMAND=ADD CNI_CONTAINERID=$id CNI_IFNAME=eth0 \
-    CNI_NETNS=/proc/$pid/ns/net CNI_PATH=/opt/cni/bin /opt/cni/bin/weave-net 
+    CNI_NETNS=/proc/$pid/ns/net CNI_PATH=/opt/cni/bin /opt/cni/bin/weave-net
 }

 run_on $HOST1 sudo mkdir -p /opt/cni/bin
@@ -19,6 +19,11 @@ weave_on $HOST1 launch
 C0=$(docker_on $HOST1 run --net=none --name=c0 -dt $SMALL_IMAGE /bin/sh)
 C1=$(docker_on $HOST1 run --net=none --privileged --name=c1 -dt $SMALL_IMAGE /bin/sh)
 C2=$(docker_on $HOST1 run --net=none --name=c2 -dt $SMALL_IMAGE /bin/sh)
+CH0=$(docker_on $HOST1 run --net=none --name=ch0 -dt $SMALL_IMAGE /bin/sh)
+CH1=$(docker_on $HOST1 run --net=none --name=ch1 -dt $SMALL_IMAGE /bin/sh)
+CH2=$(docker_on $HOST1 run --net=none --name=ch2 -dt $SMALL_IMAGE /bin/sh)
+
+
 # Enable unsolicited ARPs so that ping after the address reuse does not time out
 exec_on $HOST1 c1 sysctl -w net.ipv4.conf.all.arp_accept=1

@@ -52,6 +57,29 @@ cni_connect $HOST1 c2 <<EOF
 }
 EOF

+# examples to test hairpin
+cni_connect $HOST1 ch0 <<EOF
+{
+    "name": "weave",
+    "type": "weave-net",
+    "hairpinMode": true
+}
+EOF
+cni_connect $HOST1 ch1 <<EOF
+{
+    "name": "weave",
+    "type": "weave-net",
+    "hairpinMode": false
+}
+EOF
+cni_connect $HOST1 ch2 <<EOF
+{
+    "name": "weave",
+    "type": "weave-net"
+}
+EOF
+
+
 C0IP=$(container_ip $HOST1 c0)
 C1IP=$(container_ip $HOST1 c1)
 C2IP=$(container_ip $HOST1 c2)
@@ -85,6 +113,29 @@ assert_raises "[ $C2IP != $C3IP ]"
 assert_raises "[ $BRIP != $C3IP ]"
 assert_raises "exec_on $HOST1 c1 $PING $C3IP"

+#####
+#
+# Hairpin mode tests
+#
+# here we check that the bridge side of the veth is set to hairpin mode (true or false) correctly
+# check for each of
+# - ch0 explicitly true
+# - ch1 explicitly false
+# - ch2 unset, which should default to true
+#
+# we take advantage of the veth name being constructed from the container ID)
+#
+# should this reliance ever fail and we need to get it from the system, do the following for each:
+# CH0_PEER_ID=$(exec_on $HOST1 ch0 cat /sys/class/net/eth0/iflink)
+# CH0_PEER=$($SSH $HOST1 ip link show | awk "/^${CH0_PEER_ID}:/"' {print $2}' | sed 's/@.*$//g' )
+# CH0_HAIRPIN=$($SSH $HOST1 cat /sys/devices/virtual/net/weave/brif/$CH0_PEER/hairpin_mode)
+# assert_raises "[ $CH0_HAIRPIN == 1 ]"
+#
+assert "$SSH $HOST1 cat /sys/devices/virtual/net/weave/brif/vethwepl${CH0:0:7}/hairpin_mode" "1"
+assert "$SSH $HOST1 cat /sys/devices/virtual/net/weave/brif/vethwepl${CH1:0:7}/hairpin_mode" "0"
+assert "$SSH $HOST1 cat /sys/devices/virtual/net/weave/brif/vethwepl${CH2:0:7}/hairpin_mode" "1"
+
+

 # Ensure existing containers can reclaim their IP addresses after CNI has been used -- see #2548
 stop_weave_on $HOST1
@@ -24,7 +24,11 @@ tear_down_kubeadm
 docker_on $HOST1 run --rm --privileged --net=host --entrypoint=/usr/sbin/ipset weaveworks/weave-npc create test_840_ipset bitmap:ip range 192.168.1.0/24 || true
 docker_on $HOST1 run --rm --privileged --net=host --entrypoint=/usr/sbin/ipset weaveworks/weave-npc add test_840_ipset 192.168.1.11

-run_on $HOST1 "sudo systemctl start kubelet && sudo kubeadm init --token=$TOKEN"
+# kubeadm init upgrades to latest Kubernetes version by default, therefore we try to lock the version using the below option:
+k8s_version="$(run_on $HOST1 "kubelet --version" | grep -oP "(?<=Kubernetes )v[\d\.\-beta]+")"
+k8s_version_option="$([[ "$k8s_version" > "v1.6" ]] && echo "kubernetes-version" || echo "use-kubernetes-version")"
+
+run_on $HOST1 "sudo systemctl start kubelet && sudo kubeadm init --$k8s_version_option=$k8s_version --token=$TOKEN"
 run_on $HOST2 "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN $HOST1IP"
 run_on $HOST3 "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN $HOST1IP"

@@ -2,7 +2,7 @@ This directory contains integration tests for weave.

 ## Requirements

-You need three VMs with `docker` (`>=1.6.0`) installed and listening on TCP
+You need three VMs with `docker` (`>=1.10.0`) installed and listening on TCP
 port `2375` (see below). You also need to be able to SSH to these VMs without 
 having to input anything.

@@ -65,7 +65,7 @@ function print_vars() {
 }

 function verify_dependencies() {
-    local deps=(python terraform ansible-playbook)
+    local deps=(python terraform ansible-playbook gcloud)
    for dep in "${deps[@]}"; do
        if [ ! "$(which "$dep")" ]; then
            echo >&2 "$dep is not installed or not in PATH."
@@ -157,7 +157,8 @@ function create_image() {
        terraform destroy -force "$DIR/../tools/provisioning/gcp"
        rm terraform.tfstate*
        echo
-        greenly echo "> Created GCP image $IMAGE_NAME in $(date -u -d @$(($(date +%s) - begin_img)) +"%T")."
+        local end_img=$(date +%s)
+        greenly echo "> Created GCP image $IMAGE_NAME in $(date -u -d @$((end_img - begin_img)) +"%T")."
    else
        wait_for_image
    fi
@@ -261,7 +262,8 @@ function provision() {
    esac
    [ "$1" == "on" ] && set_hosts
    echo
-    greenly echo "> Provisioning took $(date -u -d @$(($(date +%s) - begin_prov)) +"%T")."
+    local end_prov=$(date +%s)
+    greenly echo "> Provisioning took $(date -u -d @$((end_prov - begin_prov)) +"%T")."
 }

 function configure_with_ansible() {
@@ -282,7 +284,7 @@ function configure() {
        local inventory_file=$(mktemp /tmp/ansible_inventory_XXXXX)
        echo "[all]" >"$inventory_file"
        # shellcheck disable=SC2001
-        echo "$2" | sed "s/$/:$3/" >>"$inventory_file"
+        echo "$2" | sed "s/\$/:$3/" >>"$inventory_file"

        # Configure the provisioned machines using Ansible, allowing up to 3 retries upon failure (e.g. APT connectivity issues, etc.):
        for i in $(seq 3); do
@@ -290,7 +292,8 @@ function configure() {
        done

        echo
-        greenly echo "> Configuration took $(date -u -d @$(($(date +%s) - begin_conf)) +"%T")."
+        local end_conf=$(date +%s)
+        greenly echo "> Configuration took $(date -u -d @$((end_conf - begin_conf)) +"%T")."
    fi
 }

@@ -303,13 +306,16 @@ function run_tests() {
    "$DIR/run_all.sh" "$@"
    local status=$?
    echo
-    greenly echo "> Tests took $(date -u -d @$(($(date +%s) - begin_tests)) +"%T")."
+    local end_tests=$(date +%s)
+    greenly echo "> Tests took $(date -u -d @$((end_tests - begin_tests)) +"%T")."
    return $status
 }

+# shellcheck disable=SC2155
 function end() {
    echo
-    echo "> Build took $(date -u -d @$(($(date +%s) - begin)) +"%T")."
+    local end_time=$(date +%s)
+    echo "> Build took $(date -u -d @$((end_time - begin)) +"%T")."
 }

 function echo_export_hosts() {
@@ -23,4 +23,4 @@ if [ -n "$CIRCLECI" -o -n "$PARALLEL" ]; then
    RUNNER_ARGS="$RUNNER_ARGS -parallel"
 fi

-HOSTS="$HOSTS" "${DIR}/../tools/runner/runner" $RUNNER_ARGS $TESTS
+HOSTS="$HOSTS" "${DIR}/../tools/runner/runner" -timeout=240 $RUNNER_ARGS $TESTS
@@ -1070,17 +1070,20 @@ create_cni_config() {
    cat >"$1" <<EOF
 {
    "name": "weave",
-    "type": "weave-net"
+    "type": "weave-net",
+    "hairpinMode": $2
 }
 EOF
 }

 setup_cni() {
+    # if env var HAIRPIN_MODE is not set, default it to true
+    HAIRPIN_MODE=${HAIRPIN_MODE:-true}
    if install_cni_plugin $CNI_PLUGIN_DIR ; then
        upgrade_cni_plugin $CNI_PLUGIN_DIR
    fi
    if [ -d $HOST_ROOT/etc/cni/net.d -a ! -f $HOST_ROOT/etc/cni/net.d/10-weave.conf ] ; then
-        create_cni_config $HOST_ROOT/etc/cni/net.d/10-weave.conf
+        create_cni_config $HOST_ROOT/etc/cni/net.d/10-weave.conf $HAIRPIN_MODE
    fi
 }
Author	SHA1	Message	Date
Bryan Boreham	a7ebe53cfa	Add release v1.9.8	2017-06-15 17:05:11 +00:00
Marc Carré	b655a3aede	Merge pull request #3014 from weaveworks/issues/3011-allow-non-pod-source Allow any non-local traffic onto the weave bridge	2017-06-14 14:52:11 +01:00
Bryan Boreham	819b395ae4	Temporarily raise the test timeout Docker 1.11 seems much slower at the pull tests than Docker 1.13 while we investigate that, raise the timeout to allow tests to pass	2017-06-14 13:14:06 +00:00
Bryan Boreham	2584335b11	Allow any non-local traffic onto the weave bridge If it's destined for a pod on another node it will be checked again when it reaches that other node. The previous version was rejecting traffic coming in from outside the cluster.	2017-06-12 17:00:57 +00:00
Bryan Boreham	21d4fff450	Update broken link to Docker docs	2017-06-12 09:42:22 +01:00
Marc Carré	a5d7fb66f0	Merge pull request #3010 from weaveworks/issues/3003-anonymous-claim Fix use of '_' as container ID in claim outside range	2017-06-09 08:30:13 +01:00
Bryan Boreham	b01a204c1f	Check who previously owned an address claimed outside the range	2017-06-08 16:25:09 +00:00
Bryan Boreham	e9310eba98	Don't use '_' as container ID in claim outside range And added unit test for various claim-without-ID situations	2017-06-07 16:38:19 +00:00
Bryan Boreham	69285270e5	Bump Ruby version 2.3.4 is pre-installed by CircleCI, whereas 2.3.0 isn't	2017-06-07 13:01:15 +00:00
Bryan Boreham	6bd11a426e	typo	2017-06-01 14:28:10 +00:00
Bryan Boreham	1abdc3afcf	Add release v1.9.7	2017-06-01 13:51:06 +00:00
Bryan Boreham	b8f98a5387	Merge pull request #2996 from Bregor/issues/2995-npc-and-hostname_override Weave-NPC should get hostname from K8s Downward API.	2017-06-01 14:33:22 +01:00
Maxim Filatov	cb3b858df6	Weave-NPC should get hostname from K8s Downward API. It is necessary in case when kubelet's args includes `--hostname_override=`. Without this change, pods on hostname overriding kubelets will never be local, and all pod's traffic will be blocked.	2017-05-31 18:06:17 +03:00
Bryan Boreham	afb0d5bd3d	Add release v1.9.6	2017-05-30 16:28:11 +00:00
Bryan Boreham	2d3e070288	Let through connections from local pods to non-local pods This means we only filter connections at the destination end, which is a better match for the ingress-only rules.	2017-05-30 14:11:35 +00:00
Bryan Boreham	138141ac9b	Ignore updates for pods on other nodes	2017-05-30 14:11:34 +00:00
Bryan Boreham	fa56ad8bc3	Refactor: move logging of ipset entries down to ipset package	2017-05-30 14:11:33 +00:00
Bryan Boreham	9d29da8d27	Refactor creation of base iptables rules	2017-05-30 14:11:31 +00:00
Bryan Boreham	68f2cb9caa	Merge pull request #2993 from weaveworks/hairpin-option-1.9 Turn on hairpin mode on veth bridge ports	2017-05-30 14:50:37 +01:00
Avi Deitcher	d13c7ea7ee	Make hairpin mode default true in CNI	2017-05-30 10:30:54 +00:00
Avi Deitcher	4c7c702b6d	Test of hairpin mode in CNI	2017-05-30 10:30:54 +00:00
Avi Deitcher	c05955d598	First cut of adding hairpin functionality to weave	2017-05-30 10:30:49 +00:00
Bryan Boreham	ca64ab54e7	Remove trailing space	2017-05-30 10:30:02 +00:00
Àbéjídé Àyodélé	e64442f6de	Highlight the forward rules	2017-05-25 13:43:51 +00:00
Bryan Boreham	987a1618e9	Merge pull request #2985 from weaveworks/fix-broken-url-to-ecs-guide Fix broken link to ECS guide	2017-05-23 17:59:49 +01:00
Marc CARRE	0ab95cdd27	Fix broken URL to ECS guide.	2017-05-23 16:58:36 +00:00
Marc Carré	b0d0c3d731	Merge pull request #2986 from weaveworks/remove-wordepress Stop doing Wordpress previews on Pantheon	2017-05-23 12:01:05 +01:00
Bryan Boreham	534dd8e16a	Stop doing Wordpress previews on Pantheon Now we are using Netlify instead	2017-05-23 11:33:57 +01:00
Marc Carré	79e703c8ac	Merge pull request #2987 from weaveworks/use-fixed-version-of-shfmt Use shfmt v1.3.0 instead of latest from master	2017-05-23 11:31:03 +01:00
Marc CARRE	d4a98a58f4	Use shfmt v1.3.0 instead of latest from master. Before this change, `go get`-ting` would pick the latest version of `shfmt` which keeps changing, hence frequently breaking our builds. After this change, we download the `shfmt` binary from its GitHub releases page which is fast and locks the version we use. Note that `RUN` does not like herestrings, hence `echo "..." \| sha256sum -c` for checksum. Alternatives considered: - `go get gopkg.in/mvdan/sh.v1/cmd/shfmt` -- but `gopkg.in` currently doesn't behave well for this tool - `go build` from a `git` tag -- but this is much more involved.	2017-05-23 10:59:11 +01:00
Bryan Boreham	72532324ed	Give up on versioned copy of shfmt; it doesn't build	2017-05-18 10:18:11 +00:00
Marc Carré	68106d804e	Merge pull request #2959 from ocadotechnology/wip-2958 fix(npc): create ipsets with only valid xml characters	2017-05-15 13:30:10 +01:00
Bryan Boreham	efff6d6e63	Merge pull request #2962 from weaveworks/fix-shfmt-lint-error Fix shfmt lint error by escaping $ in sed expression	2017-05-15 13:21:12 +01:00
Marc CARRE	6bbd8d7a4c	Escape $ in sed expression. This fixes new error raised by latest version of shfmt, leading to build failures.	2017-05-15 12:36:55 +01:00
stuart.warren	9cbf0289d8	fix(npc): create ipsets with only valid xml characters Why: * xml output of ipset is invalid because ipset itself doesn't appear to escape invalid chars * fixes #2958	2017-05-15 11:20:04 +01:00
Bryan Boreham	255d087416	Merge pull request #2949 from ocadotechnology/wip-2915 Flush weave ipsets before destroying	2017-05-12 13:15:09 +01:00
Mike Bryant	8668f6bb1e	Flush weave ipsets before destroying ipsets can't be destroyed when there are references to them. This takes the easy way out and flushes all weave ipsets first. Fixes #2915	2017-05-12 09:44:26 +01:00
Mike Bryant	95ee99d652	style: singular vs plural	2017-05-12 09:44:18 +01:00
Bryan Boreham	30583ec8f2	Merge pull request #2930 from weaveworks/fix-broken-links Fix some broken links in documentation	2017-05-11 16:24:00 +01:00
Bryan Boreham	e370ef7007	Fix 'How Weave Finds Containers' link	2017-05-11 15:06:29 +00:00
Ilya Dmitrichenko	42953faf70	Fix some broken links in documentation	2017-05-11 15:06:20 +00:00
Bryan Boreham	6c29a1f648	Merge pull request #2940 from weaveworks/fix_libssl_mismatch Fix build libssl issue: Use cross-compilers from debian rather than ubuntu	2017-05-09 13:37:10 +01:00
Marcus Cobden	fa29b18be7	Use cross-compilers from debian rather than ubuntu	2017-05-09 09:32:54 +00:00
Bryan Boreham	40db885b3a	Merge pull request #2935 from ocadotechnology/wip-2934 Clean up xt_set_exists components in advance	2017-05-09 10:04:56 +01:00
Bryan Boreham	ae0c16f375	Merge pull request #2884 from weaveworks/issues/2794-kube-evict-docs Add pod resources and eviction to weave-kube doc	2017-05-09 10:02:54 +01:00
Bryan Boreham	909b751d6d	Explain how to see Evicted pods	2017-05-08 13:14:59 +00:00
Mike Bryant	9419ad16bf	Clean up xt_set_exists components in advance If this function dies in the middle, the leftover weave-kube-test set causes this function and weave-npc to break. In particular this means we can never restart weave with the launch script. Here we clean up in advance, in case there's leftovers from a previous run Fixes #2934	2017-05-08 12:15:23 +01:00
Bryan Boreham	2c12c4f67e	Merge pull request #2928 from weaveworks/issues/2921-ignore-enoent-on-iface-del Ignore errors on network interface delete during CNI Delete	2017-05-05 20:45:38 +01:00
Marc CARRE	be11db45d8	Ignore error when deleting a container's interface. Fixes #2921, as all errors are now ignored, including `ENOENT`. This command typically attempts to delete the network interface `eth0` of a container being destroyed by Kubernetes. If this interface has already been destroyed or is missing for whatever reason, we still want to remove this container's entry from IPAM in order to free associated resources.	2017-05-05 17:24:08 +00:00
Marc CARRE	30213bd71e	Comply to CNI 0.5 spec by always returning nil on DEL. See also: "Plugins should generally complete a DEL action without error even if some resources are missing." in: https://github.com/containernetworking/cni/blob/v0.5.0/SPEC.md	2017-05-05 17:24:08 +00:00
Bryan Boreham	b14501f358	Merge pull request #2931 from weaveworks/patch-wordepress Use a version of wordepress that handles 'search-type' attribute	2017-05-05 18:21:42 +01:00
Bryan Boreham	e93a145bab	Build a version of wordepress that handles 'search-type' attribute	2017-05-05 16:58:33 +00:00
Ilya Dmitrichenko	8b245a442c	Add website preview	2017-05-05 15:23:08 +01:00
Bryan Boreham	041b6fe251	Add release v1.9.5	2017-05-04 08:49:15 +00:00
Marc Carré	d128488339	Merge pull request #2926 from weaveworks/issues/2808-improve-hairpin-messages Fixes #2808. Improve hairpin log messages.	2017-05-03 20:21:20 +01:00
Marc Carré	c8c61adca4	Merge pull request #2907 from weaveworks/issues/2771-checkpoint-net-modes Add checkpoint flag per connection type	2017-05-03 18:20:30 +01:00
Bryan Boreham	7c8f33f525	Add checkpoint flag per connection type	2017-05-03 16:56:49 +00:00
Bryan Boreham	15bf6eab1e	Merge pull request #2925 from weaveworks/doc-search-tag added search tag type	2017-05-03 17:35:00 +01:00
abuehrle	10333b0f3e	added search tag type	2017-05-03 16:33:40 +00:00
Ilya Dmitrichenko	52a5ca8f88	Fix broken link in docs	2017-05-03 16:43:57 +01:00
Bryan Boreham	b19f2df6f8	Improve hairpin log messages	2017-05-03 14:35:20 +00:00
Bryan Boreham	b3ac56e3d2	Update mesh library and check for errors newly returned	2017-05-03 11:08:28 +00:00
Marc Carré	cc77ad2c65	Merge pull request #2912 from weaveworks/issues/2904-filter-ipv6-kube-peers Filter out IPv6 addresses from kube-peers	2017-05-02 11:45:31 +01:00
Bryan Boreham	24c2743a58	Check addresses are IPv4 in kube-peers	2017-04-28 11:05:38 +00:00
Bryan Boreham	b49f5bdb99	Merge pull request #2916 from ocadotechnology/allow-for-externalip fix(kube-peers): Add support for ExternalIP addresses	2017-04-27 15:29:02 +01:00
Marc CARRE	28a1578d20	Please ./tools/lint -nocomment -notestpackage. Fixes: - `test/run-integration-tests.sh:160:75: arithmetic expressions must consist of names and numbers` - `test/run-integration-tests.sh:265:56: arithmetic expressions must consist of names and numbers` - `test/run-integration-tests.sh:295:61: arithmetic expressions must consist of names and numbers` - `test/run-integration-tests.sh:309:49: arithmetic expressions must consist of names and numbers` - `test/run-integration-tests.sh:316:41: arithmetic expressions must consist of names and numbers` - `test/run-integration-tests.sh: run shfmt -i 4 -w test/run-integration-tests.sh` See also: https://circleci.com/gh/weaveworks/weave/8685	2017-04-27 14:06:42 +00:00
Mike Bryant	e78be1fc35	fix(kube-peers): Add support for ExternalIP addresses Why: * In some environments Nodes have an ExternalIP but no InternalIP This change addresses the need by: * Falling back to ExternalIP addresses if there isn't an InternalIP for a node	2017-04-27 13:56:23 +01:00
Bryan Boreham	109e249aa6	Review feedback	2017-04-25 14:08:25 +00:00
Marc Carré	402fe094f4	Merge pull request #2893 from weaveworks/ipam-ops-reentrant. Fixes #2892 . IPAM: Make sure we have a ring before calling tryOps()	2017-04-12 13:25:32 +01:00
Bryan Boreham	1c1b3248c0	Make sure we have a ring before calling tryOps() because otherwise the pending ops can be modified from inside Try()	2017-04-11 15:36:53 +00:00
Bryan Boreham	60c5e11871	Add pod resources and eviction to weave-kube doc	2017-04-11 12:29:27 +00:00
Ilya Dmitrichenko	5cae747b36	Consisten spacing in Markdown headings Jekyll doesn't tolerate this, and it's generally cosidered a cleaner style, we've had a bit of mixed style and this makes it consistent.	2017-04-10 12:44:38 +00:00
Bryan Boreham	ef0dae4ed3	Simple example is only on two hosts	2017-04-10 11:37:06 +00:00
Bryan Boreham	2686be1b93	Update mention of Docker 1.6 to 1.10	2017-04-10 10:45:42 +00:00
Marc Carré	b845360091	Merge pull request #2887 from weaveworks/issues/add-gcloud-to-circle-path Fix gcloud dependency for CI builds	2017-04-07 15:01:20 +01:00
Martynas Pumputis	953d451105	Check for gcloud in verify_dependencies In CI builds, we rely on gcloud installed by Circle CI. Any change to Circle $PATH or the installation might break CI builds in non-obvious way.	2017-04-07 14:44:31 +01:00
Martynas Pumputis	75d80c4828	Add /opt/google-cloud-sk/bin to PATH of circle.yml Otherwise, "gcloud" cannot be found.	2017-04-07 14:43:35 +01:00
Bryan Boreham	877658d22e	Merge pull request #2886 from weaveworks/lock-kubeadm-version Lock kubeadm's Kubernetes version	2017-04-06 14:37:58 +01:00
Marc CARRE	1c797ca901	Upgrade to latest version of build-tools. This brings a fix to the Ansible playbook which enables locking of `kubeadm`'s Kubernetes version.	2017-04-06 13:49:51 +01:00
Marc CARRE	520a72c8e6	Lock kubeadm's Kubernetes version. Without this commit, `kubeadm` typically upgrades whichever version of Kubernetes is installed, sometimes leading to conflicts in between components' version. This fixes the issue behind #2876 and should avoid build failures like [weave/8373](https://circleci.com/gh/weaveworks/weave/8373).	2017-04-06 13:49:48 +01:00
Marc CARRE	98fec7e5aa	Revert "Disable temporary 840 smoke tests" This reverts commit `b687484dda`.	2017-04-06 10:43:56 +01:00
Bryan Boreham	038aac41fd	Fix weave-kube doc table of contents	2017-04-05 13:56:17 +00:00
Martynas Pumputis	c54fe016b1	Merge pull request #2880 from weaveworks/upgrade-build-tools Upgrade to latest build-tools.	2017-04-04 15:44:05 +01:00
Marc CARRE	9c9b46479d	Upgrade to latest build-tools. Adds better support for CentOS, for Kubernetes 1.6 (default: 1.6.1), and makes Docker installation role configurable, among others.	2017-04-04 15:13:41 +01:00
Bryan Boreham	28c290074b	Merge pull request #2876 from weaveworks/issues/disable-840 Disable temporary the 840 weave kube smoke test	2017-03-31 18:55:59 +02:00
Martynas Pumputis	b687484dda	Disable temporary 840 smoke tests To trigger doc publishing	2017-03-30 17:45:20 +01:00
Bryan Boreham	fd731beb87	Merge pull request #2871 from weaveworks/weave-kube-formatting Fix formatting of code snippets in site/kube-addon.md.	2017-03-29 11:53:07 +01:00
Marc CARRE	35cc653737	Add links to URLs and relevant resources.	2017-03-29 11:28:49 +01:00
Marc CARRE	1254d680ed	Fix formatting of env. vars. in site/kube-addon.md.	2017-03-29 11:28:42 +01:00
Marc CARRE	23c0b6a04b	Fix formatting of kubectl apply snippets in site/kube-addon.md.	2017-03-29 11:28:36 +01:00
Martynas Pumputis	ede1ec970c	Merge pull request #2861 from weaveworks/weave-kube-1.6-docs Update weave-kube docs for k8s 1.6	2017-03-29 10:36:49 +01:00
Bryan Boreham	fbab5a7280	Review feedback	2017-03-29 08:37:28 +00:00
Bryan Boreham	a92cfc1ffe	Added instructions for Kubernetes 1.6 changes	2017-03-21 15:28:41 +00:00