Add release v2.0.3

fix: Missing nil checks

.gitignore

@@ -37,7 +37,6 @@ coverage.html
 prog/weaver/weaver
 prog/weavedns/weavedns
 prog/weavehosts/weavehosts
-prog/weaveproxy/weaveproxy
 prog/sigproxy/sigproxy
 prog/weavewait/weavewait
 prog/weavewait/weavewait_noop
@@ -55,7 +54,6 @@ releases
 weave*.tar.gz
 prog/weaver/weave
 prog/weaveexec/weavehosts
-prog/weaveexec/weaveproxy
 prog/weaveexec/weavewait
 prog/weaveexec/weavewait_noop
 prog/weaveexec/weavewait_nomcast

CHANGELOG.md

@@ -1,3 +1,45 @@
+## Release 2.0.3
+
+Bug fixes
+
+* Weave-npc would crash on a policy with no 'from' part - regression introduced in 2.0.2 #3095,#3096,#3097
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/61?closed=1).
+
+
+## Release 2.0.2
+
+Bug fixes and minor improvements
+
+* Fix race condition in weave-npc which would intermittently block all traffic for a namespace  #3057,#3059
+* Ensure Fast Datapath works on machines that need to mount the kernel module dynamically #3080
+* Regression: weave-npc would block everything if `kubelet --hostname-override` was used #3049,#3051
+* Fix netfilter rules to block containers from accessing the Weave Net control endpoint #3093
+* If DNS server is off then disable proxy DNS registration, to avoid spurious errors #3054,#3088
+* Add comments to each iptables rule and ipset, to help when troubleshooting #3064
+* Remove code that checked for an outdated fallback address for Kubernetes api-server #3071
+* Add a label to the weavedb image so it can be filtered out by tools #3066
+* Fix various build and continuous-integration failures #3061
+* Print 'help' text faster in the weave script #3056
+* Add an option to create continuous integration hosts in different ways  #3060
+* Remove remnants of the pre-2.0 proxy and plugin from build and test #3035,#3036
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/60?closed=1).
+
+
+## Release 2.0.1
+
+Bug fixes and minor improvements
+
+* Fall back to slower data path (`sleeve`), rather than crashing, when the machine lacks VXLAN support (required for “fast data path”, `fastdp`)  #3043
+* Fix bug in processing of arguments when Docker has TLS enabled, rather than crashing with invalid peers list, e.g. `lookup --tlsverify: no such host` #3039
+* Add `kube-system` namespace back to `weave-kube`'s YAMLs, preventing omissions leading to errors like `error contacting APIServer: the server does not allow access to the requested resource` #3033,#3042
+* Fix release script to prevent ARM64 binaries to end up in AMD64 `net-plugin`, leading to `Error response from daemon: dial unix /run/docker/plugins/<id>/weave.sock: connect: no such file or directory` when installing `net-plugin` #3045
+* `weave reset` and `weave rmpeer` now only contact Weave Cloud when Weave Net is configured with a Weave Cloud token, preventing unnecessary requests and potentially confusing `401 Unauthorized` errors in Weave Net’s logs #3044
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/58?closed=1).
+
+
 ## Release 2.0.0
 
 New Features

DEPENDENCIES

@@ -1,3 +1,3 @@
-DOCKER_VERSION=1.13.1
+DOCKER_VERSION=17.06
 KUBERNETES_VERSION=1.6.2
 KUBERNETES_CNI_VERSION=0.5.1

README.md

@@ -10,13 +10,13 @@
 [Weaveworks](https://www.weave.works) is the company that delivers the most productive way for developers to connect, observe and control
 Docker containers.
 
-This repository contains [Weave Net](https://www.weave.works/products/weave-net/), the first product developed by Weaveworks, and with over 8 million downloads to date, it enables you to get started with Docker clusters and portable apps in a fraction of the time compared with other solutions.
+This repository contains [Weave Net](https://www.weave.works/products/weave-net/), the first product developed by Weaveworks, and with over 8 million downloads to date, enables you to get started with Docker clusters and portable apps in a fraction of the time compared with other solutions.
 
 ## Weave Cloud: 
 
 [Weave Cloud](https://www.weave.works/product/cloud/) is software-as-a-service that simplifies deployment, monitoring and management for containers and microservices. It extends and complements popular orchestrators, and enables developers and DevOps to realize faster deployments, insightful monitoring, visualization and networking.
 
-Weave Cloud is built using these Open Source projects: [Weave Scope](https://www.weave.works/products/weave-scope/), a powerful container monitoring tool that automatically maps Docker containers and their interactions, [Weave Cortex](https://github.com/weaveworks/cortex), a horizontally-scalable version of Prometheus, and [Weave Flux](https://www.weave.works/products/weave-flux/), a continuous deployment tool that works with Kubernetes.
+Weave Cloud is built using these Open Source projects: [Weave Scope](https://www.weave.works/products/weave-scope/), a powerful container visualization tool that automatically maps Docker containers and their interactions, [Weave Cortex](https://github.com/weaveworks/cortex), a horizontally-scalable version of Prometheus, and [Weave Flux](https://www.weave.works/products/weave-flux/), a continuous deployment tool that works with Kubernetes.
 
 # Weave Net
 
@@ -28,7 +28,7 @@ Services provided by application containers on the Weave network can be exposed
 
 If you have any questions about, feedback for or a problem with Weave Net:
 
-- Read [the Weave Net docs](https://www.weave.works/docs/net/latest/introducing-weave/).
+- Read [the Weave Net docs](https://www.weave.works/docs/net/latest/overview).
 - Invite yourself to the <a href="https://weaveworks.github.io/community-slack/" target="_blank"> #weave-community </a> slack channel.
 - Ask a question on the <a href="https://weave-community.slack.com/messages/general/"> #weave-community</a> slack channel.
 - Join the <a href="https://www.meetup.com/pro/Weave/"> Weave User Group </a> and get invited to online talks, hands-on training and meetups in your area.
@@ -39,5 +39,5 @@ Your feedback is always welcome!
 
 ## Further Information
 
-* [Installing Weave Net](https://www.weave.works/docs/net/latest/installing-weave/)
+* [Installing Weave Net](https://www.weave.works/docs/net/latest/install/installing-weave)
-* [Weave Net Product Overview](https://www.weave.works/products/weave-net/)
+* [Weave Net Product Overview](https://www.weave.works/products/weave-net)

bin/release

@@ -187,14 +187,14 @@ publish() {
     fi
 
     if [ "$RELEASE_TYPE" = 'PRERELEASE' ] ; then
-        echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
-        make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
-        echo "** Docker images tagged and pushed"
-
         echo "== Building and pushing plugin"
         make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER plugin_publish
         echo "** Plugin built and pushed"
 
+        echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
+        make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
+        echo "** Docker images tagged and pushed"
+
         echo "== Publishing pre-release on GitHub"
 
         github-release publish \
@@ -223,14 +223,14 @@ publish() {
         fi
         echo '** Sanity checks OK for publishing tag' $LATEST_TAG as $DOCKERHUB_USER/weave:$VERSION
 
-        echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
-        make PUBLISH_WEAVEDB=$IS_MAINLINE UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
-        echo "** Docker images tagged and pushed"
-
         echo "== Building and pushing plugin"
         make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER plugin_publish
         echo "** Plugin built and pushed"
 
+        echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
+        make PUBLISH_WEAVEDB=$IS_MAINLINE UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
+        echo "** Docker images tagged and pushed"
+
         echo "== Publishing release on GitHub"
 
         github-release publish \

net/bridge.go

@@ -62,7 +62,8 @@ type Bridge interface {
 	String() string                  // human-readable type string
 }
 
-var errBridgeFallback = errors.New("special error value used to trigger a fallback to bridge type")
+// Used to indicate a fallback to the Bridge type
+var errBridgeNotSupported = errors.New("bridge not supported")
 
 type bridgeImpl struct{ bridge netlink.Link }
 type fastdpImpl struct{ datapathName string }
@@ -226,7 +227,7 @@ func (config *BridgeConfig) configuredBridgeType() Bridge {
 	}
 }
 
-func EnsureBridge(procPath string, config *BridgeConfig) (Bridge, error) {
+func EnsureBridge(procPath string, config *BridgeConfig, log *logrus.Logger) (Bridge, error) {
 	bridgeType, err := ExistingBridgeType(config.WeaveBridgeName, config.DatapathName)
 	if bridgeType != nil || err != nil {
 		return bridgeType, err
@@ -235,7 +236,8 @@ func EnsureBridge(procPath string, config *BridgeConfig) (Bridge, error) {
 	bridgeType = config.configuredBridgeType()
 	for {
 		if err := bridgeType.init(config); err != nil {
-			if err == errBridgeFallback {
+			if errors.Cause(err) == errBridgeNotSupported {
+				log.Warnf("Skipping bridge creation of %q due to: %s", bridgeType, err)
 				bridgeType = bridgeImpl{}
 				continue
 			}
@@ -333,12 +335,16 @@ func (b bridgeImpl) init(config *BridgeConfig) error {
 
 func (f fastdpImpl) init(config *BridgeConfig) error {
 	odpSupported, err := odp.CreateDatapath(f.datapathName)
+	if !odpSupported {
+		msg := ""
+		if err != nil {
+			msg = err.Error()
+		}
+		return errors.Wrap(errBridgeNotSupported, msg)
+	}
 	if err != nil {
 		return errors.Wrapf(err, "creating datapath %q", f.datapathName)
 	}
-	if !odpSupported {
-		return errBridgeFallback
-	}
 	datapath, err := netlink.LinkByName(f.datapathName)
 	if err != nil {
 		return errors.Wrapf(err, "finding datapath %q", f.datapathName)

npc/controller.go

@@ -3,13 +3,13 @@ package npc
 import (
 	"sync"
 
-	"github.com/coreos/go-iptables/iptables"
 	"github.com/pkg/errors"
 	coreapi "k8s.io/client-go/pkg/api/v1"
 	extnapi "k8s.io/client-go/pkg/apis/extensions/v1beta1"
 
 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/npc/iptables"
 )
 
 type NetworkPolicyController interface {
@@ -31,14 +31,14 @@ type controller struct {
 
 	nodeName string // my node name
 
-	ipt *iptables.IPTables
+	ipt iptables.Interface
 	ips ipset.Interface
 
 	nss         map[string]*ns // ns name -> ns struct
 	nsSelectors *selectorSet   // selector string -> nsSelector
 }
 
-func New(nodeName string, ipt *iptables.IPTables, ips ipset.Interface) NetworkPolicyController {
+func New(nodeName string, ipt iptables.Interface, ips ipset.Interface) NetworkPolicyController {
 	c := &controller{
 		nodeName: nodeName,
 		ipt:      ipt,
@@ -54,7 +54,7 @@ func (npc *controller) onNewNsSelector(selector *selector) error {
 	for _, ns := range npc.nss {
 		if ns.namespace != nil {
 			if selector.matches(ns.namespace.ObjectMeta.Labels) {
-				if err := ns.ips.AddEntry(selector.spec.ipsetName, string(ns.allPods.ipsetName)); err != nil {
+				if err := selector.addEntry(string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
 					return err
 				}
 			}

npc/controller_test.go

@@ -0,0 +1,182 @@
+package npc
+
+import (
+	"log"
+	"testing"
+
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/require"
+	"github.com/weaveworks/weave/npc/ipset"
+	unversionedapi "k8s.io/client-go/pkg/api/unversioned"
+	coreapi "k8s.io/client-go/pkg/api/v1"
+	extnapi "k8s.io/client-go/pkg/apis/extensions/v1beta1"
+	"k8s.io/client-go/pkg/util/intstr"
+)
+
+type mockSet struct {
+	name    ipset.Name
+	setType ipset.Type
+	subSets map[string]bool
+}
+
+type mockIPSet struct {
+	sets map[string]mockSet
+}
+
+func newMockIPSet() mockIPSet {
+	i := mockIPSet{
+		sets: make(map[string]mockSet),
+	}
+
+	return i
+}
+
+func (i *mockIPSet) Create(ipsetName ipset.Name, ipsetType ipset.Type) error {
+	if _, ok := i.sets[string(ipsetName)]; ok {
+		return errors.Errorf("ipset %s already exists", ipsetName)
+	}
+	i.sets[string(ipsetName)] = mockSet{name: ipsetName, setType: ipsetType, subSets: make(map[string]bool)}
+	return nil
+}
+
+func (i *mockIPSet) AddEntry(ipsetName ipset.Name, entry string, comment string) error {
+	log.Printf("adding entry %s to %s", entry, ipsetName)
+	if _, ok := i.sets[entry]; !ok {
+		return errors.Errorf("ipset %s does not exist", entry)
+	}
+	if _, ok := i.sets[string(ipsetName)].subSets[entry]; ok {
+		return errors.Errorf("ipset %s is already a member of %s", entry, ipsetName)
+	}
+	i.sets[string(ipsetName)].subSets[entry] = true
+
+	return nil
+}
+
+func (i *mockIPSet) DelEntry(ipsetName ipset.Name, entry string) error {
+	log.Printf("deleting entry %s from %s", entry, ipsetName)
+	if _, ok := i.sets[string(ipsetName)]; !ok {
+		return errors.Errorf("ipset %s does not exist", ipsetName)
+	}
+	if _, ok := i.sets[string(ipsetName)].subSets[entry]; !ok {
+		return errors.Errorf("ipset %s is not a member of %s", entry, ipsetName)
+	}
+	delete(i.sets[string(ipsetName)].subSets, entry)
+
+	return nil
+}
+
+func (i *mockIPSet) Flush(ipsetName ipset.Name) error {
+	return errors.New("Not Implemented")
+}
+
+func (i *mockIPSet) FlushAll() error {
+	return errors.New("Not Implemented")
+}
+
+func (i *mockIPSet) Destroy(ipsetName ipset.Name) error {
+	if _, ok := i.sets[string(ipsetName)]; !ok {
+		return errors.Errorf("ipset %s does not exist", ipsetName)
+	}
+	delete(i.sets, string(ipsetName))
+	return nil
+}
+
+func (i *mockIPSet) DestroyAll() error {
+	return errors.New("Not Implemented")
+}
+
+func (i *mockIPSet) List(prefix string) ([]ipset.Name, error) {
+	return []ipset.Name{}, errors.New("Not Implemented")
+}
+
+type mockIPTables struct {
+}
+
+func (ipt *mockIPTables) Append(table, chain string, rulespec ...string) error {
+	return nil
+}
+
+func (ipt *mockIPTables) Delete(table, chain string, rulespec ...string) error {
+	return nil
+}
+
+func (ipt *mockIPTables) Insert(table, chain string, pos int, rulespec ...string) error {
+	return nil
+}
+
+func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
+	// Test for race condition between namespace and networkpolicy events
+	// https://github.com/weaveworks/weave/issues/3059
+
+	sourceNamespace := &coreapi.Namespace{
+		ObjectMeta: coreapi.ObjectMeta{
+			Name: "source",
+			Labels: map[string]string{
+				"app": "source",
+			},
+		},
+	}
+
+	destinationNamespace := &coreapi.Namespace{
+		ObjectMeta: coreapi.ObjectMeta{
+			Name: "destination",
+		},
+	}
+
+	port := intstr.FromInt(12345)
+
+	networkPolicy := &extnapi.NetworkPolicy{
+		ObjectMeta: coreapi.ObjectMeta{
+			Name:      "network-policy",
+			Namespace: "destination",
+		},
+		Spec: extnapi.NetworkPolicySpec{
+			Ingress: []extnapi.NetworkPolicyIngressRule{
+				{
+					From: []extnapi.NetworkPolicyPeer{
+						{
+							NamespaceSelector: &unversionedapi.LabelSelector{
+								MatchLabels: map[string]string{
+									"app": "source",
+								},
+							},
+						},
+					},
+					Ports: []extnapi.NetworkPolicyPort{
+						{
+							Port: &port,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// Namespaces first
+	m := newMockIPSet()
+	controller := New("foo", &mockIPTables{}, &m)
+
+	const (
+		selectorIPSetName = "weave-I239Zp%sCvoVt*D6u=A!2]YEk"
+		sourceIPSetName   = "weave-HboJG1fGgG]/SR%k9H#hv5e96"
+	)
+
+	controller.AddNamespace(sourceNamespace)
+	controller.AddNamespace(destinationNamespace)
+
+	controller.AddNetworkPolicy(networkPolicy)
+
+	require.Equal(t, true, m.sets[selectorIPSetName].subSets[sourceIPSetName])
+
+	// NetworkPolicy first
+	m = newMockIPSet()
+	controller = New("foo", &mockIPTables{}, &m)
+
+	controller.AddNetworkPolicy(networkPolicy)
+
+	controller.AddNamespace(sourceNamespace)
+	controller.AddNamespace(destinationNamespace)
+
+	require.Equal(t, true, m.sets[selectorIPSetName].subSets[sourceIPSetName])
+
+}

npc/ipset/ipset.go

@@ -19,7 +19,7 @@ const (
 
 type Interface interface {
 	Create(ipsetName Name, ipsetType Type) error
-	AddEntry(ipsetName Name, entry string) error
+	AddEntry(ipsetName Name, entry string, comment string) error
 	DelEntry(ipsetName Name, entry string) error
 	Flush(ipsetName Name) error
 	Destroy(ipsetName Name) error
@@ -40,15 +40,15 @@ func New(logger *log.Logger) Interface {
 }
 
 func (i *ipset) Create(ipsetName Name, ipsetType Type) error {
-	return doExec("create", string(ipsetName), string(ipsetType))
+	return doExec("create", string(ipsetName), string(ipsetType), "comment")
 }
 
-func (i *ipset) AddEntry(ipsetName Name, entry string) error {
+func (i *ipset) AddEntry(ipsetName Name, entry string, comment string) error {
 	i.Logger.Printf("adding entry %s to %s", entry, ipsetName)
 	if i.inc(ipsetName, entry) > 1 { // already in the set
 		return nil
 	}
-	return doExec("add", string(ipsetName), entry)
+	return doExec("add", string(ipsetName), entry, "comment", comment)
 }
 
 func (i *ipset) DelEntry(ipsetName Name, entry string) error {

npc/iptables/iptables.go

@@ -0,0 +1,7 @@
+package iptables
+
+type Interface interface {
+	Append(table, chain string, rulespec ...string) error
+	Delete(table, chain string, rulespec ...string) error
+	Insert(table, chain string, pos int, rulespec ...string) error
+}

npc/namespace.go

@@ -2,8 +2,8 @@ package npc
 
 import (
 	"encoding/json"
+	"fmt"
 
-	"github.com/coreos/go-iptables/iptables"
 	"k8s.io/client-go/pkg/api/unversioned"
 	coreapi "k8s.io/client-go/pkg/api/v1"
 	extnapi "k8s.io/client-go/pkg/apis/extensions/v1beta1"
@@ -12,10 +12,11 @@ import (
 
 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/npc/iptables"
 )
 
 type ns struct {
-	ipt *iptables.IPTables // interface to iptables
+	ipt iptables.Interface // interface to iptables
 	ips ipset.Interface    // interface to ipset
 
 	name      string                               // k8s Namespace name
@@ -32,7 +33,7 @@ type ns struct {
 	rules        *ruleSet
 }
 
-func newNS(name, nodeName string, ipt *iptables.IPTables, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) {
+func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) {
 	allPods, err := newSelectorSpec(&unversioned.LabelSelector{}, name, ipset.HashIP)
 	if err != nil {
 		return nil, err
@@ -74,7 +75,7 @@ func (ns *ns) onNewPodSelector(selector *selector) error {
 	for _, pod := range ns.pods {
 		if hasIP(pod) {
 			if selector.matches(pod.ObjectMeta.Labels) {
-				if err := selector.addEntry(pod.Status.PodIP); err != nil {
+				if err := selector.addEntry(pod.Status.PodIP, podComment(pod)); err != nil {
 					return err
 				}
 			}
@@ -98,9 +99,9 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
 	}
 
 	if ns.checkLocalPod(obj) {
-		ns.ips.AddEntry(LocalIpset, obj.Status.PodIP)
+		ns.ips.AddEntry(LocalIpset, obj.Status.PodIP, podComment(obj))
 	}
-	return ns.podSelectors.addToMatching(obj.ObjectMeta.Labels, obj.Status.PodIP)
+	return ns.podSelectors.addToMatching(obj.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
 }
 
 func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
@@ -120,9 +121,9 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 
 	if !hasIP(oldObj) && hasIP(newObj) {
 		if ns.checkLocalPod(newObj) {
-			ns.ips.AddEntry(LocalIpset, newObj.Status.PodIP)
+			ns.ips.AddEntry(LocalIpset, newObj.Status.PodIP, podComment(newObj))
 		}
-		return ns.podSelectors.addToMatching(newObj.ObjectMeta.Labels, newObj.Status.PodIP)
+		return ns.podSelectors.addToMatching(newObj.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
 	}
 
 	if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) ||
@@ -140,7 +141,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 				}
 			}
 			if newMatch {
-				if err := ps.addEntry(newObj.Status.PodIP); err != nil {
+				if err := ps.addEntry(newObj.Status.PodIP, podComment(newObj)); err != nil {
 					return err
 				}
 			}
@@ -246,18 +247,18 @@ func (ns *ns) deleteNetworkPolicy(obj *extnapi.NetworkPolicy) error {
 	return nil
 }
 
-func bypassRule(nsIpsetName ipset.Name) []string {
+func bypassRule(nsIpsetName ipset.Name, namespace string) []string {
-	return []string{"-m", "set", "--match-set", string(nsIpsetName), "dst", "-j", "ACCEPT"}
+	return []string{"-m", "set", "--match-set", string(nsIpsetName), "dst", "-j", "ACCEPT", "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace}
 }
 
 func (ns *ns) ensureBypassRule(nsIpsetName ipset.Name) error {
 	common.Log.Debugf("ensuring rule for DefaultAllow in namespace: %s, set %s", ns.name, nsIpsetName)
-	return ns.ipt.Append(TableFilter, DefaultChain, bypassRule(ns.allPods.ipsetName)...)
+	return ns.ipt.Append(TableFilter, DefaultChain, bypassRule(ns.allPods.ipsetName, ns.name)...)
 }
 
 func (ns *ns) deleteBypassRule(nsIpsetName ipset.Name) error {
 	common.Log.Debugf("removing default rule in namespace: %s, set %s", ns.name, nsIpsetName)
-	return ns.ipt.Delete(TableFilter, DefaultChain, bypassRule(ns.allPods.ipsetName)...)
+	return ns.ipt.Delete(TableFilter, DefaultChain, bypassRule(ns.allPods.ipsetName, ns.name)...)
 }
 
 func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
@@ -265,11 +266,13 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
 
 	// Insert a rule to bypass policies if namespace is DefaultAllow
 	if !isDefaultDeny(obj) {
-		return ns.ensureBypassRule(ns.allPods.ipsetName)
+		if err := ns.ensureBypassRule(ns.allPods.ipsetName); err != nil {
+			return err
+		}
 	}
 
 	// Add namespace ipset to matching namespace selectors
-	return ns.nsSelectors.addToMatching(obj.ObjectMeta.Labels, string(ns.allPods.ipsetName))
+	return ns.nsSelectors.addToMatching(obj.ObjectMeta.Labels, string(ns.allPods.ipsetName), namespaceComment(ns))
 }
 
 func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
@@ -282,10 +285,14 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
 	if oldDefaultDeny != newDefaultDeny {
 		common.Log.Infof("namespace DefaultDeny changed from %t to %t", oldDefaultDeny, newDefaultDeny)
 		if oldDefaultDeny {
-			return ns.ensureBypassRule(ns.allPods.ipsetName)
+			if err := ns.ensureBypassRule(ns.allPods.ipsetName); err != nil {
+				return err
+			}
 		}
 		if newDefaultDeny {
-			return ns.deleteBypassRule(ns.allPods.ipsetName)
+			if err := ns.deleteBypassRule(ns.allPods.ipsetName); err != nil {
+				return err
+			}
 		}
 	}
 
@@ -303,7 +310,7 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
 				}
 			}
 			if newMatch {
-				if err := selector.addEntry(string(ns.allPods.ipsetName)); err != nil {
+				if err := selector.addEntry(string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
 					return err
 				}
 			}
@@ -318,7 +325,9 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error {
 
 	// Remove bypass rule
 	if !isDefaultDeny(obj) {
-		return ns.deleteBypassRule(ns.allPods.ipsetName)
+		if err := ns.deleteBypassRule(ns.allPods.ipsetName); err != nil {
+			return err
+		}
 	}
 
 	// Remove namespace ipset from any matching namespace selectors
@@ -360,3 +369,11 @@ func isDefaultDeny(namespace *coreapi.Namespace) bool {
 		nnp.Ingress.Isolation != nil &&
 		*(nnp.Ingress.Isolation) == DefaultDeny
 }
+
+func namespaceComment(namespace *ns) string {
+	return "namespace: " + namespace.name
+}
+
+func podComment(pod *coreapi.Pod) string {
+	return fmt.Sprintf("namespace: %s, pod: %s", pod.ObjectMeta.Namespace, pod.ObjectMeta.Name)
+}

npc/rule.go

@@ -1,12 +1,13 @@
 package npc
 
 import (
+	"fmt"
 	"strings"
 
-	"github.com/coreos/go-iptables/iptables"
 	"k8s.io/client-go/pkg/types"
 
 	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/npc/iptables"
 )
 
 type ruleSpec struct {
@@ -19,27 +20,36 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds
 	if proto != nil {
 		args = append(args, "-p", *proto)
 	}
+	srcComment := "anywhere"
 	if srcHost != nil {
 		args = append(args, "-m", "set", "--match-set", string(srcHost.ipsetName), "src")
+		if srcHost.nsName != "" {
+			srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key)
+		} else {
+			srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key)
+		}
 	}
+	dstComment := "anywhere"
 	if dstHost != nil {
 		args = append(args, "-m", "set", "--match-set", string(dstHost.ipsetName), "dst")
+		dstComment = fmt.Sprintf("pods: namespace: %s, selector: %s", dstHost.nsName, dstHost.key)
 	}
 	if dstPort != nil {
 		args = append(args, "--dport", *dstPort)
 	}
 	args = append(args, "-j", "ACCEPT")
+	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment))
 	key := strings.Join(args, " ")
 
 	return &ruleSpec{key, args}
 }
 
 type ruleSet struct {
-	ipt   *iptables.IPTables
+	ipt   iptables.Interface
 	users map[string]map[types.UID]struct{}
 }
 
-func newRuleSet(ipt *iptables.IPTables) *ruleSet {
+func newRuleSet(ipt iptables.Interface) *ruleSet {
 	return &ruleSet{ipt, make(map[string]map[types.UID]struct{})}
 }
 

npc/rule_test.go

@@ -0,0 +1,16 @@
+package npc
+
+import (
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestRegressionHandleNil3095(t *testing.T) {
+	// Test for handling nil values
+	// https://github.com/weaveworks/weave/issues/3095
+
+	rs := newRuleSpec(nil, nil, nil, nil)
+
+	require.NotEqual(t, rs.key, "")
+
+}

npc/selector.go

@@ -15,6 +15,7 @@ type selectorSpec struct {
 
 	ipsetType ipset.Type // type of ipset to provision
 	ipsetName ipset.Name // generated ipset name
+	nsName    string     // Namespace name
 }
 
 func newSelectorSpec(json *unversioned.LabelSelector, nsName string, ipsetType ipset.Type) (*selectorSpec, error) {
@@ -30,7 +31,8 @@ func newSelectorSpec(json *unversioned.LabelSelector, nsName string, ipsetType i
 		// the shortname because you can specify the same selector in multiple
 		// namespaces - we need those to map to distinct ipsets
 		ipsetName: ipset.Name(IpsetNamePrefix + shortName(nsName+":"+key)),
-		ipsetType: ipsetType}, nil
+		ipsetType: ipsetType,
+		nsName:    nsName}, nil
 }
 
 type selector struct {
@@ -42,8 +44,8 @@ func (s *selector) matches(labelMap map[string]string) bool {
 	return s.spec.selector.Matches(labels.Set(labelMap))
 }
 
-func (s *selector) addEntry(entry string) error {
+func (s *selector) addEntry(entry string, comment string) error {
-	return s.ips.AddEntry(s.spec.ipsetName, entry)
+	return s.ips.AddEntry(s.spec.ipsetName, entry, comment)
 }
 
 func (s *selector) delEntry(entry string) error {
@@ -67,10 +69,10 @@ func newSelectorSet(ips ipset.Interface, onNewSelector selectorFn) *selectorSet
 		entries:       make(map[string]*selector)}
 }
 
-func (ss *selectorSet) addToMatching(labelMap map[string]string, entry string) error {
+func (ss *selectorSet) addToMatching(labelMap map[string]string, entry string, comment string) error {
 	for _, s := range ss.entries {
 		if s.matches(labelMap) {
-			if err := s.addEntry(entry); err != nil {
+			if err := s.addEntry(entry, comment); err != nil {
 				return err
 			}
 		}

prog/kube-peers/main.go

@@ -20,17 +20,6 @@ func getKubePeers() ([]string, error) {
 		return nil, err
 	}
 	nodeList, err := c.Nodes().List(api.ListOptions{})
-	if err != nil {
-		// Fallback for cases (e.g. from kube-up.sh) where kube-proxy is not running on master
-		config.Host = "http://localhost:8080"
-		log.Print("error contacting APIServer: ", err, "; trying with fallback: ", config.Host)
-		c, err = kubernetes.NewForConfig(config)
-		if err != nil {
-			return nil, err
-		}
-		nodeList, err = c.Nodes().List(api.ListOptions{})
-	}
-
 	if err != nil {
 		return nil, err
 	}

prog/net-plugin/config.json

@@ -13,7 +13,8 @@
   "linux": {
     "capabilities": [
       "CAP_SYS_ADMIN",
-      "CAP_NET_ADMIN"
+      "CAP_NET_ADMIN",
+      "CAP_SYS_MODULE"
     ]
   },
   "mounts": [
@@ -40,6 +41,12 @@
       "source": "/etc/",
       "type": "bind",
       "options": ["rbind"]
+    },
+    {
+      "destination": "/lib/modules/",
+      "source": "/lib/modules/",
+      "type": "bind",
+      "options": ["rbind"]
     }
   ],
   "env": [

prog/weave-kube/weave-daemonset-k8s-1.6.yaml

@@ -7,6 +7,7 @@ items:
       name: weave-net
       labels:
         name: weave-net
+      namespace: kube-system
   - apiVersion: rbac.authorization.k8s.io/v1beta1
     kind: ClusterRole
     metadata:
@@ -52,6 +53,7 @@ items:
       name: weave-net
       labels:
         name: weave-net
+      namespace: kube-system
     spec:
       template:
         metadata:
@@ -95,6 +97,12 @@ items:
                 - name: lib-modules
                   mountPath: /lib/modules
             - name: weave-npc
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
               image: 'weaveworks/weave-npc:latest'
               imagePullPolicy: Always
               resources:

prog/weave-kube/weave-daemonset.yaml

@@ -7,12 +7,14 @@ items:
       name: weave-net
       labels:
         name: weave-net
+      namespace: kube-system
   - apiVersion: extensions/v1beta1
     kind: DaemonSet
     metadata:
       name: weave-net
       labels:
         name: weave-net
+      namespace: kube-system
     spec:
       template:
         metadata:
@@ -59,6 +61,12 @@ items:
                 - name: lib-modules
                   mountPath: /lib/modules
             - name: weave-npc
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
               image: 'weaveworks/weave-npc:latest'
               imagePullPolicy: Always
               resources:

prog/weavedb/Dockerfile

@@ -1,6 +1,7 @@
 # This is a nearly-empty image that we use to create a data-only container for persistence
 FROM scratch
 LABEL maintainer "Weaveworks Inc <help@weave.works>"
+LABEL works.weave.role=system
 ENTRYPOINT ["data-only"]
 # Work round Docker refusing to save an empty image
 COPY Dockerfile /

prog/weaver/discovery.go

@@ -77,7 +77,7 @@ func peerDiscoveryDelete(discoveryEndpoint, token, peername string) error {
 
 func HandleHTTPPeer(router *mux.Router, alloc *ipam.Allocator, discoveryEndpoint, token, peername string) {
 	router.Methods("DELETE").Path("/peer").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if discoveryEndpoint != "" {
+		if discoveryEndpoint != "" && token != "" {
 			if err := peerDiscoveryDelete(discoveryEndpoint, token, peername); err != nil {
 				Log.Errorf("Error while deleting self from peer discovery: %s", err)
 			}
@@ -90,7 +90,7 @@ func HandleHTTPPeer(router *mux.Router, alloc *ipam.Allocator, discoveryEndpoint
 
 	router.Methods("DELETE").Path("/peer/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ident := mux.Vars(r)["id"]
-		if discoveryEndpoint != "" {
+		if discoveryEndpoint != "" && token != "" {
 			// TODO: deal with this being either a peername or a nickname
 			if err := peerDiscoveryDelete(discoveryEndpoint, token, ident); err != nil {
 				Log.Errorf("Error while deleting self from peer discovery: %s", err)

prog/weaver/main.go

@@ -254,6 +254,9 @@ func main() {
 	var proxy *weaveproxy.Proxy
 	var err error
 	if proxyConfig.Enabled {
+		if noDNS {
+			proxyConfig.WithoutDNS = true
+		}
 		// Start Weave Proxy:
 		proxy, err = weaveproxy.NewProxy(*proxyConfig)
 		if err != nil {
@@ -282,7 +285,8 @@ func main() {
 	name := peerName(routerName, bridgeConfig.WeaveBridgeName, dbPrefix, hostRoot)
 
 	bridgeConfig.Mac = name.String()
-	bridgeType, err := weavenet.EnsureBridge(procPath, &bridgeConfig)
+	bridgeConfig.Port = config.Port
+	bridgeType, err := weavenet.EnsureBridge(procPath, &bridgeConfig, Log)
 	checkFatal(err)
 	Log.Println("Bridge type is", bridgeType)
 

prog/weaver/main_test.go

@@ -7,6 +7,7 @@ import (
 )
 
 func TestMain(t *testing.T) {
-	weavetest.TrimTestArgs()
+	if weavetest.TrimTestArgs() {
-	main()
+		main()
+	}
 }

prog/weaveutil/bridge.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"strconv"
 
+	"github.com/weaveworks/weave/common"
 	weavenet "github.com/weaveworks/weave/net"
 )
 
@@ -47,7 +48,7 @@ func createBridge(args []string) error {
 		NPC:              args[9] == "--expect-npc",
 	}
 	procPath := args[8]
-	bridgeType, err := weavenet.EnsureBridge(procPath, &config)
+	bridgeType, err := weavenet.EnsureBridge(procPath, &config, common.Log)
 	if err != nil {
 		return err
 	}

site/building.md

@@ -1,6 +1,6 @@
 ---
 title: Building Weave Net
-menu_order: 120
+menu_order: 220
 search_type: Documentation
 ---
 You only need to build Weave Net if you want to work on the Weave Net codebase

site/concepts.md

@@ -0,0 +1,23 @@
+---
+title: Concepts in Weave Net
+menu_order: 20
+search_type: Documentation
+---
+
+The section contains topics about how Weave Net works as well as providing a technical deep dive on how Weave Net implements fast datapath, and encryption.
+
+* [Understanding Weave Net](/site/concepts/how-it-works.md)
+* [Weave Net Router Sleeve Encapsulation](/site/concepts/router-encapsulation.md)
+* [How Weave Net Interprets Network Topology](/site/concepts/network-topology.md)
+     * [Communicating Topology Among Peers](https://weave.works/docs/net/latest/concepts/network-topology/#topology)
+     * [How Messages are Formed](https://weave.works/docs/net/latest/concepts/network-topology/#messages)
+     * [Removing Peers](https://weave.works/docs/net/latest/concepts/network-topology/#removing-peers)
+     * [What Happens When The Topology is Out of Date?](https://weave.works/docs/net/latest/concepts/network-topology/#out-of-date-topology)
+* [Fast Datapath & Weave Net](/site/concepts/fastdp-how-it-works.md)
+* [IP Addresses, Routes and Networks](/site/concepts/ip-addresses.md)
+* [Encryption and Weave Net](/site/concepts/encryption.md)
+     * [How Weave Net Implements Encryption](/site/concepts/encryption-implementation.md)
+          * [Establishing the Emphemeral Session Key](https://weave.works/docs/net/latest/concepts/network-topology/#ephemeral-key)
+          * [Key Generation and the Linux CSPRIN](https://weave.works/docs/net/latest/concepts/network-topology/#cspring)
+          * [Encrypting and Decrypting TCP Messages](https://weave.works/docs/net/latest/concepts/network-topology/#tcp)
+          * [Encrypting and Decrypting UDP Messages](https://weave.works/docs/net/latest/concepts/network-topology/#udp)

site/concepts/encryption-implementation.md

@@ -1,11 +1,11 @@
 ---
 title: How Weave Net Implements Encryption
-menu_order: 70
+menu_order: 60
 search_type: Documentation
 ---
 
 This section describes some details of Weave Net's built-in
-[encryption](/site/how-it-works/encryption.md):
+[encryption](/site/concepts/encryption.md):
 
  * [Establishing the Ephemeral Session Key](#ephemeral-key)
  * [Key Generation](#csprng)
@@ -148,7 +148,7 @@ follows:
     | Frame N: Captured payload         |  |
     +-----------------------------------+ -+
 
-This is very similar to the [non-crypto encapsulation](/site/how-it-works/router-encapsulation.md).
+This is very similar to the [non-crypto encapsulation](/site/concepts/router-encapsulation.md).
 
 All of the frames on a connection are encrypted with the same
 ephemeral session key, and a nonce constructed from a message sequence
@@ -211,4 +211,4 @@ Integrity Check Value of AES-GCM.
 
  * [architecture documentation](https://github.com/weaveworks/weave/blob/master/docs/architecture.txt)
  * [fastdp encryption](https://github.com/weaveworks/weave/blob/master/docs/fastdp-crypto.md)
- * [Securing Containers Across Untrusted Networks](/site/using-weave/security-untrusted-networks.md)
+ * [Securing Containers Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks.md)

site/concepts/encryption.md

@@ -1,14 +1,14 @@
 ---
 title: Encryption and Weave Net
-menu_order: 60
+menu_order: 50
 search_type: Documentation
 ---
 
 
 Weave Net peers
-[communicate with each other over both TCP and UDP](/site/how-it-works.md). This
+[communicate with each other over both TCP and UDP](/site/concepts/how-it-works.md). This
 communication
-[can be encrypted](/site/using-weave/security-untrusted-networks.md).
+[can be encrypted](/site/tasks/manage/security-untrusted-networks.md).
 
 Encryption of control plane traffic (TCP) and data plane traffic (UDP) of sleeve
 overlay is accomplished using the [NaCl](http://nacl.cr.yp.to/)
@@ -41,5 +41,5 @@ the IP transformation framework (XFRM).
 
 **See Also**
 
- * [How Weave Implements Encryption](/site/how-it-works/encryption-implementation.md)
+ * [How Weave Implements Encryption](/site/concepts/encryption-implementation.md)
- * [Securing Containers Across Untrusted Networks](/site/using-weave/security-untrusted-networks.md)
+ * [Securing Containers Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks.md)

site/concepts/fastdp-how-it-works.md

@@ -1,5 +1,5 @@
 ---
-title: How Fast Datapath Works
+title: Fast Datapath & Weave Net
 menu_order: 30
 search_type: Documentation
 ---
@@ -25,7 +25,7 @@ Prior to version 1.2, Weave Net used a custom encapsulation format. Fast datapat
 
 **See Also**
 
- * [Using Weave Net](/site/using-weave.md)
+ * [Launching Weave Net](/site/install/using-weave.md)
- * [Using Fast Datapath](/site/using-weave/fastdp.md)
+ * [Using Fast Datapath](/site/tasks/manage/fastdp.md)
 
 

site/concepts/how-it-works.md

@@ -1,11 +1,9 @@
 ---
-title: Understanding how Weave Net Works
+title: Understanding Weave Net
-menu_order: 90
+menu_order: 10
 search_type: Documentation
 ---
 
-
-
 A Weave network consists of a number of 'peers' - Weave Net routers
 residing on different hosts. Each peer has a name, which tends to
 remain the same over restarts, a human friendly nickname for use in
@@ -15,7 +13,7 @@ the router is concerned, although the name defaults to a MAC address.
 
 Weave Net routers establish TCP connections with each other, over which they
 perform a protocol handshake and subsequently exchange
-[topology](/site/router-topology/network-topology.md) information. 
+[topology](/site/concepts/network-topology.md) information. 
 These connections are encrypted if
 so configured. Peers also establish UDP "connections", possibly
 encrypted, which carry encapsulated network packets. These
@@ -27,7 +25,7 @@ is given an IP address and netmask supplied either by the user or
 by Weave Net's IP address allocator.
 
 Weave Net routes packets between containers on different hosts via two
-methods: a [fast data path](/site/using-weave/fastdp.md) method, which operates
+methods: a [fast data path](/site/tasks/manage/fastdp.md) method, which operates
 entirely in kernel space, and a fallback `sleeve` method, in which
 packets destined for non-local containers are captured by the kernel
 and processed by the Weave Net router in user space, forwarded over
@@ -47,5 +45,5 @@ first send it to peer 3:
 
 **See Also**
 
- * [Weave Router Sleeve Encapsulation](/site/how-it-works/router-encapsulation.md)
+ * [Weave Router Sleeve Encapsulation](/site/concepts/router-encapsulation.md)
- * [How Weave Interprets Network Topology](/site/how-it-works/network-topology.md)
+ * [How Weave Interprets Network Topology](/site/concepts/network-topology.md)

site/concepts/ip-addresses.md

@@ -1,6 +1,6 @@
 ---
 title: IP Addresses, Routes and Networks
-menu_order: 50
+menu_order: 40
 search_type: Documentation
 ---
 
@@ -8,7 +8,7 @@ search_type: Documentation
 Weave Net runs containers on a private network, which means that IP addresses are isolated from the rest of the
 Internet, and that you don't have to worry about addresses clashing. 
 
-You can of course also manually change the IP of any given container or subnet on a Weave network.  See, [How to Manually Specify IP Addresses and Subnets](/site/using-weave/manual-ip-address.md)
+You can of course also manually change the IP of any given container or subnet on a Weave network.  See, [How to Manually Specify IP Addresses and Subnets](/site/tasks/ipam/manual-ip-address.md)
 
 ### Some Definitions
 
@@ -64,4 +64,4 @@ find a match, so uses the default rule.
 
 **See Also**
 
- * [Allocating IPs in a Specific Range](/site/using-weave/configuring-weave.md)
+ * [Allocating IPs in a Specific Range](/site/tasks/ipam/configuring-weave.md)

site/concepts/network-topology.md

@@ -145,7 +145,7 @@ which time the topology should have updated.
 
 **See Also**
 
- * [Weave Net Router Encapsulation](/site/how-it-works/router-encapsulation.md)
+ * [Weave Net Router Encapsulation](/site/concepts/router-encapsulation.md)
  
  
  

site/concepts/router-encapsulation.md

@@ -1,11 +1,11 @@
 ---
 title: Weave Net Router Sleeve Encapsulation
-menu_order: 10
+menu_order: 15
 search_type: Documentation
 ---
 
 When the Weave Net router forwards packets to peers in `sleeve` mode
-(rather than via the [fast data path](/site/using-weave/fastdp.md)), the
+(rather than via the [fast data path](/site/tasks/manage/fastdp.md)), the
 encapsulation looks something like this:
 
     +-----------------------------------+
@@ -62,4 +62,4 @@ MAC discovery.
 
 **See Also**
 
- * [How Weave Net Interprets Network Topology](/site/how-it-works/network-topology.md)
+ * [How Weave Net Interprets Network Topology](/site/concepts/network-topology.md)

site/faq.md

@@ -19,13 +19,13 @@ See [Troubleshooting Weave - List attached containers](/site/troubleshooting.md#
 
 You can manually change the IP of a container using [Classless Inter-Domain Routing or CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). 
 
-For more information, refer to [Manually Specifying the IP Address of a Container](/site/using-weave/manual-ip-address.md). 
+For more information, refer to [Manually Specifying the IP Address of a Container](/site/tasks/ipam/manual-ip-address.md). 
 
 
 <a name="expose-container"></a>
 **Q: How do I expose one of my containers to the outside world?**
 
-Exposing a container to the outside world is described in [Exporting Services](/site/using-weave/service-management.md#exporting).
+Exposing a container to the outside world is described in [Exporting Services](/site/tasks/manage/service-management.md#exporting).
 
 
 <a name="legacy-network"></a>
@@ -35,9 +35,9 @@ Yes you can.
 
 For example, you have a Weave network that runs on hosts A, B, C. and you have an additional host, that we'll call P, where neither Weave nor Docker are running.  However, you need to connect from a process running on host P to a specific container running on host B on the Weave network.  Since the Weave network is completely separate from any network that P is connected to, you cannot connect the container using the container's IP address. 
 
-A simple way to accomplish this would be to run Weave on the host and then run, `weave expose` to expose the network to any running containers. Or you set up a route from P to one of A, B or C. See [Integrating a Network Host](/site/using-weave/host-network-integration.md).
+A simple way to accomplish this would be to run Weave on the host and then run, `weave expose` to expose the network to any running containers. Or you set up a route from P to one of A, B or C. See [Integrating a Network Host](/site/tasks/manage/host-network-integration.md).
 
-Yet another option is to expose a port from the container on host B and then connect to it. You can read about exposing ports in [Exporting Services](/site/using-weave/service-management.md#exporting).
+Yet another option is to expose a port from the container on host B and then connect to it. You can read about exposing ports in [Exporting Services](/site/tasks/manage/service-management.md#exporting).
 
 
 <a name="duplicate-ip"></a>
@@ -45,7 +45,7 @@ Yet another option is to expose a port from the container on host B and then con
 
 Under normal circumstances, this should never happen, but it can occur if `weave rmpeer` was run on more than one host. 
 
-For more information see [Starting, Stopping and Removing Peers](/site/ipam/stop-remove-peers-ipam.md).
+For more information see [Starting, Stopping and Removing Peers](/site/tasks/ipam/stop-remove-peers-ipam.md).
 
 
 <a name="dead-node"></a>
@@ -53,7 +53,7 @@ For more information see [Starting, Stopping and Removing Peers](/site/ipam/stop
 
 When a node goes out of service, the best option is to call `weave rmpeer` on one host and then `weave forget` on all the other hosts.
 
-See [Starting, Stopping and Removing Peers](/site/ipam/stop-remove-peers-ipam.md) for an in-depth discussion.
+See [Starting, Stopping and Removing Peers](/site/tasks/ipam/stop-remove-peers-ipam.md) for an in-depth discussion.
 
 
 <a name="performance"></a>
@@ -63,7 +63,7 @@ All virtualization techniques have some overhead, and Weave's overhead is typica
 
 Weave Net also automatically uses the fastest datapath between two hosts. When Weave Net can't use the fast datapath between two hosts, it falls back to the slower packet forwarding approach. Selecting the fastest forwarding approach is automatic, and is determined on a connection-by-connection basis. For example, a Weave network spanning two data centers might use fast datapath within the data centers, but not for the more constrained network link between them.
 
-For more information about fast datapath see [How Fast Datapath Works](/site/how-it-works/fastdp-how-it-works.md).
+For more information about fast datapath see [How Fast Datapath Works](/site/concepts/fastdp-how-it-works.md).
 
 
 <a name="query-fastdp"></a>
@@ -71,7 +71,7 @@ For more information about fast datapath see [How Fast Datapath Works](/site/how
 
 To view whether Weave is using fastdp or not, you can run, `weave status connections`
 
-For more information on this command, see [Using Fast Datapath](/site/using-weave/fastdp.md).
+For more information on this command, see [Using Fast Datapath](/site/tasks/manage/fastdp.md).
 
 
 <a name="encrypted-fastdp"></a>
@@ -79,12 +79,12 @@ For more information on this command, see [Using Fast Datapath](/site/using-weav
 
 Yes, 1.9 version of Weave Net added the encryption feature to fastdp.
 
-See [Using Fast Datapath](/site/using-weave/fastdp.md) for more information.
+See [Using Fast Datapath](/site/tasks/manage/fastdp.md) for more information.
 
 <a name="app-isolation"></a>
 **Q: Can I create multiple networks where containers can communicate on one network, but are isolated from containers on other networks?**
 
-Yes, of course!  Weave allows you to run isolated networks and still allow open communications between individual containers from those isolated networks. You can find information on how to do this in [Application Isolation](/site/using-weave/application-isolation.md).
+Yes, of course!  Weave allows you to run isolated networks and still allow open communications between individual containers from those isolated networks. You can find information on how to do this in [Application Isolation](/site/tasks/manage/application-isolation.md).
 
 
 **<a name="ports"></a>Q: Which ports does Weave Net use (e.g. if I am configuring a firewall) ?**
@@ -92,7 +92,7 @@ Yes, of course!  Weave allows you to run isolated networks and still allow open
 You must permit traffic to flow through TCP 6783 and UDP 6783/6784,
 which are Weave’s control and data ports.
 
-The daemon also uses TCP port 6782 for [metrics](/site/metrics.md), but
+The daemon also uses TCP port 6782 for [metrics](/site/tasks/manage/metrics.md), but
 you would only need to open up this port if you wish to collect metrics
 from another host.
 
@@ -116,6 +116,6 @@ Ubuntu image with those two commands added.
 **See Also**
 
  * [Troubleshooting Weave](/site/troubleshooting.md)
- * [Troubleshooting IPAM](/site/ipam.md)
+ * [Troubleshooting IPAM](/site/tasks/ipam/ipam.md)
- * [Troubleshooting the Proxy](/site/weave-docker-api/using-proxy.md)
+ * [Troubleshooting the Proxy](/site/tasks/weave-docker-api/using-proxy.md)
  

site/install.md

@@ -0,0 +1,42 @@
+---
+title: Installing Weave Net
+menu_order: 30
+search_type: Documentation
+---
+
+Install Weave Net from the command line on its own or if you are using Docker, Kubernetes or Mesosphere as a Docker or a CNI plugin. Weave Net can also be launched it as a cloud agent within Weave Cloud to visualize and troubleshoot peer connections.
+
+
+## Installing Weave Net Stand-alone and in Weave Cloud
+
+* [Installing Weave Net](https://www.weave.works/docs/net/latest/install/installing-weave/)
+* [Launching Weave Net](https://www.weave.works/docs/net/latest/install/using-weave/)
+* [Visualizing Weave Net in Weave Cloud](https://www.weave.works/docs/net/latest/install/weave-cloud/)
+* [Using Weave with Systemd](https://www.weave.works/docs/net/latest/install/systemd/)
+
+
+## Weave Net Docker Plugin
+
+* [How the Weave Net Docker Network Plugins Work](https://www.weave.works/docs/net/latestplugin/plugin-how-it-works/)
+* [Integrating Docker via the Network Plugin (V2)](https://www.weave.works/docs/net/latest/install/plugin/plugin-v2/)
+     * [Installation](https://www.weave.works/docs/net/latest/install/plugin/plugin-v2/#installation)
+     * [Configuring the Plugin](https://www.weave.works/docs/net/latest/install/plugin/plugin-v2/#configuring)
+     * [Running Services or Containers Using the Plugin](https://www.weave.works/docs/net/latest/install/plugin/plugin-v2/#usage)
+* [Integrating Docker via the Network Plugin (Legacy)](https://www.weave.works/docs/net/latest/install/plugin/plugin/)
+     * [Launching Weave Net and Running Containers Using the Plugin](https://www.weave.works/docs/net/latest/install/plugin/plugin/#launching)
+     * [Restarting the Plugin](https://www.weave.works/docs/net/latest/install/plugin/plugin/#restarting)
+
+## Weave Net CNI plugin for Kubernetes and Mesosphere
+
+* [Integrating Kubernetes and Mesos via the CNI Plugin](https://www.weave.works/docs/net/latest/kubernetes/)
+* [Integrating Kubernetes via the Addon](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/)
+     * [Installation](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#install)
+     * [Upgrading Kubernetes to version 1.6](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#kube-1.6-upgrade)
+     * [Upgrading the Daemon Sets](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#daemon-sets)
+     * [CPU and Memory Requirements](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#resources)
+     * [Pod Eviction](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#eviction)
+     * [Network Policy Controller](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#npc)
+     * [Troubleshooting Blocked Connections](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#blocked-connections)
+     * [Changing Configuration Options](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#configuration-options)
+
+

site/install/installing-weave.md

@@ -1,6 +1,6 @@
 ---
 title: Installing Weave Net
-menu_order: 30
+menu_order: 10
 search_type: Documentation
 ---
 
@@ -17,9 +17,9 @@ If you are on OSX and you are using Docker Machine ensure that a VM is running a
 before downloading Weave Net. To set up a VM see [the Docker Machine
 documentation](https://docs.docker.com/installation/mac/#from-your-shell) or refer to ["Part 1: Launching Weave Net with Docker Machine"](/guides/part-1-launching-weave-net-with-docker-machine/).
 
-After your VM is setup with Docker Machine, Weave Net can be launched directly from the OSX host. Weave Net respects the environment variable `DOCKER_HOST`, so that you can run and control a Weave Network locally on a remote host. See [Using The Weave Docker API Proxy](/site/weave-docker-api/using-proxy.md).
+After your VM is setup with Docker Machine, Weave Net can be launched directly from the OSX host. Weave Net respects the environment variable `DOCKER_HOST`, so that you can run and control a Weave Network locally on a remote host. See [Using The Weave Docker API Proxy](/site/tasks/weave-docker-api/using-proxy.md).
 
-With Weave Net downloaded onto your VMs or hosts, you are ready to launch a Weave network and deploy apps onto it. See [Using Weave Net](/site/using-weave.md).
+With Weave Net downloaded onto your VMs or hosts, you are ready to launch a Weave network and deploy apps onto it. See [Launching Weave Net](/site/install/using-weave.md).
 
 ### Quick Start Screencast
 
@@ -32,7 +32,7 @@ With Weave Net downloaded onto your VMs or hosts, you are ready to launch a Weav
 Weave Net [periodically contacts Weaveworks servers for available
 versions](https://github.com/weaveworks/go-checkpoint).  New versions
 are announced in the log and in [the status
-summary](/site/troubleshooting.md#weave-status).
+summary](/site/troubleshooting.md/#weave-status).
 
 The information sent in this check is:
 
@@ -55,19 +55,19 @@ for the latest Weave AMIs and [here](https://www.weave.works/docs/tutorials/old-
 
 If you're on Amazon EC2, the standard installation instructions at the
 top of this page, provide the simplest setup and the most flexibility.
-A [special no-overlay mode for EC2](/site/using-weave/awsvpc.md) can
+A [special no-overlay mode for EC2](/site/tasks/manage/awsvpc.md) can
 optionally be enabled, which allows containers to communicate at the
 full speed of the underlying network.
 
 To make encryption in fast datapath work on Google Cloud Platform, see
-[here](/site/faq.md#ports).
+[here](/site/faq.md/#ports).
 
 **See Also** 
 
- * [Using Weave Net](/site/using-weave.md)
+ * [Launching Weave Net](/site/install/using-weave.md)
- * [Getting Started Guides](http://www.weave.works/guides/)
+ * [Tutorials](https://www.weave.works/docs/tutorials/)
- * [Features](/site/features.md)
+ * [Features](/site/overview/features.md)
  * [Troubleshooting](/site/troubleshooting.md)
  * [Building](/site/building.md)
- * [Using Weave with Systemd](/site/installing-weave/systemd.md)
+ * [Using Weave with Systemd](/site/install/systemd.md)
  

site/install/plugin.md

@@ -0,0 +1,6 @@
+---
+title: Weave Net Docker Plugin
+menu_order: 50
+search_type: Documentation
+---
+

site/install/plugin/plugin-how-it-works.md

@@ -1,6 +1,6 @@
 ---
 title: How the Weave Net Docker Network Plugins Work
-menu_order: 20
+menu_order: 10
 search_type: Documentation
 ---
 
@@ -11,7 +11,7 @@ named `weave` that can only work with one (like Docker's overlay driver), while
 the V2 plugin provides *one* - `store/weaveworks/net-plugin:latest_release`
 operating only in swarm mode.
 
-### `weavemesh` driver
+### weavemesh driver
 
 * Weave Net handles all co-ordination between hosts (referred to by Docker as a "local scope" driver)
 * Supports a single network only. A network named `weave` is automatically created for you.
@@ -19,7 +19,7 @@ operating only in swarm mode.
 
 If you do create additional networks using the `weavemesh` driver, containers attached to them will be able to communicate with containers attached to `weave`. There is no isolation between those networks.
 
-### `weave` driver
+### weave driver
 
 * This runs in what Docker calls "global scope", which requires an external cluster store
 * Supports multiple networks that must be created using `docker network create --driver weave ...`
@@ -41,7 +41,7 @@ The plugin accepts the following options via `docker network create ... --opt`:
    network created when the plugin is first launched has the multicast
    option turned on, but for any networks you create it defaults to off.
 
-### `store/weaveworks/net-plugin:latest_release` driver
+### store/weaveworks/net-plugin:latest_release driver
 
 * The driver runs within the plugin V2.
 * Requires Docker to run in [swarm mode](https://docs.docker.com/engine/swarm/swarm-mode/).
@@ -51,6 +51,6 @@ The plugin accepts the following options via `docker network create ... --opt`:
 
 **See Also**
 
- * [Integrating Docker via the Network Plugin (Legacy)](/site/plugin.md)
+ * [Integrating Docker via the Network Plugin (Legacy)](/site/install/plugin/plugin.md)
- * [Integrating Docker via the Network Plugin (V2)](/site/plugin-v2.md)
+ * [Integrating Docker via the Network Plugin (V2)](/site/install/plugin/plugin-v2.md)
 

site/install/plugin/plugin-v2.md

@@ -1,6 +1,6 @@
 ---
 title: Integrating Docker via the Network Plugin (V2)
-menu_order: 65
+menu_order: 20
 search_type: Documentation
 ---
 
@@ -34,18 +34,18 @@ There are several configuration parameters which can be set with:
 The parameters include:
 
 * `WEAVE_PASSWORD` - if non empty, it will instruct Weave Net to encrypt
-   traffic - see [here](/site/using-weave/security-untrusted-networks.md) for
+   traffic - see [here](/site/tasks/manage/security-untrusted-networks.md) for
    more details.
 * `WEAVE_MULTICAST` - set to 1 on each host running the plugin to enable
   multicast traffic on any Weave Net network.
 * `WEAVE_MTU` - Weave Net defaults to 1376 bytes, but you can set a
   smaller size if your underlying network has a tighter limit, or set
   a larger size for better performance if your network supports jumbo
-  frames - see [here](/site/using-weave/fastdp.md#mtu) for more
+  frames - see [here](/site/tasks/manage/fastdp.md#mtu) for more
   details.
 * `IPALLOC_RANGE` - the range of IP addresses used by Weave Net and the subnet
   they are placed in (CIDR format; default 10.32.0.0/12).
-  See [here](/site/using-weave/configuring-weave.md) for more details.
+  See [here](/site/tasks/ipam/configuring-weave.md) for more details.
 
 Before setting any parameter, the plugin has to be disabled with:
 
@@ -76,5 +76,5 @@ Or to start a container:
 
 **See Also**
 
- * [Integrating Docker via the Network Plugin (Legacy)](/site/plugin.md)
+ * [Integrating Docker via the Network Plugin (Legacy)](/site/install/plugin/plugin.md)
- * [How the Weave Network Plugins Work](/site/plugin/plugin-how-it-works.md)
+ * [How the Weave Network Plugins Work](/site/install/plugin/plugin-how-it-works.md)

site/install/plugin/plugin.md

@@ -1,6 +1,6 @@
 ---
 title: Integrating Docker via the Network Plugin (Legacy)
-menu_order: 60
+menu_order: 30
 search_type: Documentation
 ---
 
@@ -14,9 +14,9 @@ Networking Plugin is fast and easy to use, and, unlike other
 networking plugins, does not require an external cluster store.
 
 To create a network which can span multiple Docker hosts, Weave Net peers must be connected to each other, by specifying the other hosts during `weave launch` or via
-[`weave connect`](/site/using-weave/finding-adding-hosts-dynamically.md).
+[`weave connect`](/site/tasks/manage/finding-adding-hosts-dynamically.md).
 
-See [Using Weave Net](/site/using-weave.md#peer-connections) for a discussion on peer connections. 
+See [Launching Weave Net](/site/install/using-weave.md#peer-connections) for a discussion on peer connections. 
 
 After you've launched Weave Net and peered your hosts,  you can start containers using the following, for example:
 
@@ -25,7 +25,7 @@ After you've launched Weave Net and peered your hosts,  you can start containers
 on any of the hosts, and they can all communicate with each other
 using any protocol, even multicast.
 
-In order to use Weave Net's [Service Discovery](/site/weavedns.md) you
+In order to use Weave Net's [Service Discovery](/site/tasks/weavedns/weavedns.md) you
 must pass the additional arguments `--dns` and `-dns-search`, for
 which a helper is provided in the Weave script:
 
@@ -63,7 +63,7 @@ this between hosts requires that you run Docker in ["swarm mode"](https://docs.d
 ["key-value store"](https://docs.docker.com/engine/userguide/networking/get-started-overlay/#/set-up-a-key-value-store).
 
 To operate in swarm mode, you are required to use the plugin v2 of Weave Net.
-See [Integrating Docker via the Network Plugin (V2)](/site/plugin-v2.md) for
+See [Integrating Docker via the Network Plugin (V2)](/site/install/plugin/plugin-v2.md) for
 more details.
 
 If your Docker installation has a key-value store, create a network
@@ -96,4 +96,4 @@ If you are using `systemd` with Docker 1.9, it is advised that you modify the Do
 
 **See Also**
 
- * [How the Weave Network Plugins Work](/site/plugin/plugin-how-it-works.md)
+ * [How the Weave Network Plugins Work](/site/install/plugin/plugin-how-it-works.md)

site/install/systemd.md

@@ -1,11 +1,11 @@
 ---
 title: Using Weave with Systemd
-menu_order: 130
+menu_order: 40
 search_type: Documentation
 ---
 
 
-Having installed Weave Net as per [Installing Weave](/site/installing-weave.md), you might find it convenient to configure the
+Having installed Weave Net as per [Installing Weave](/site/install/installing-weave.md), you might find it convenient to configure the
 init daemon to start Weave on boot. Most recent Linux distribution releases ship with [systemd](http://www.freedesktop.org/wiki/Software/systemd/). The information below provides you with some initial guidance on getting a Weave Net service configured on a systemd-based OS.
 
 ## Weave Net Service Unit and Configuration
@@ -32,11 +32,11 @@ create the `/etc/sysconfig/weave` environment file using the following format:
 
     PEERS="HOST1 HOST2 .. HOSTn"
 
-You can also use the [`weave connect`](/site/using-weave/finding-adding-hosts-dynamically.md) command to add participating hosts dynamically.
+You can also use the [`weave connect`](/site/tasks/manage/finding-adding-hosts-dynamically.md) command to add participating hosts dynamically.
 
-Additionally, if you want to enable [encryption](/site/using-weave/security-untrusted-networks.md) specify a
+Additionally, if you want to enable [encryption](/site/tasks/manage/security-untrusted-networks.md) specify a
 password using `WEAVE_PASSWORD="wfvAwt7sj"` in the `/etc/sysconfig/weave` environment file, and it will get picked up by
-Weave Net on launch. Recommendations for choosing a suitably strong password can be found [here](/site/using-weave/security-untrusted-networks.md).
+Weave Net on launch. Recommendations for choosing a suitably strong password can be found [here](/site/tasks/manage/security-untrusted-networks.md).
 
 You can now launch Weave Net using
 
@@ -64,7 +64,7 @@ context with the commands shown below. You will need to have the
 
 **See Also**
 
- * [Using Weave Net](/site/using-weave.md)
+ * [Launching Weave Net](/site/install/using-weave.md)
- * [Getting Started Guides](http://www.weave.works/guides/)
+ * [Tutorials](https://www.weave.works/docs/tutorials/)
- * [Features](/site/features.md)
+ * [Features](/site/overview/features.md)
  * [Troubleshooting](/site/troubleshooting.md)

site/install/using-weave.md

@@ -1,6 +1,6 @@
 ---
-title: Using Weave Net
+title: Launching Weave Net
-menu_order: 40
+menu_order: 20
 search_type: Documentation
 ---
 
@@ -13,7 +13,6 @@ This section contains the following topics:
  * [Testing Container Communications](#testing)
  * [Starting the Netcat Service](#start-netcat)
 
-
 ### <a name="launching"></a>Launching Weave Net
 
 Before launching Weave Net and deploying your apps, ensure that Docker is [installed](https://docs.docker.com/engine/installation/) on both hosts. 
@@ -82,7 +81,7 @@ For example:
 
     host2$ weave launch <ip address> <ip address> 
 
-Peers can also be dynamically added. See [Adding Hosts Dynamically](/site/using-weave/finding-adding-hosts-dynamically.md) for more information.
+Peers can also be dynamically added. See [Adding Hosts Dynamically](/site/tasks/manage/finding-adding-hosts-dynamically.md) for more information.
 
 #### Restricting Access
 
@@ -94,7 +93,7 @@ Standard firewall rules can be deployed to restrict access to the
 Weave Net control and data ports.
 
 For communication across untrusted networks, connections can be
-[encrypted](/site/using-weave/security-untrusted-networks.md).
+[encrypted](/site/tasks/manage/security-untrusted-networks.md).
 
 ### <a name="testing"></a>Testing Container Communications
 
@@ -135,8 +134,8 @@ Weave Net supports *any* protocol, and it doesn't have to be over TCP/IP. For ex
 
 **See Also** 
 
- * [Installing Weave Net](/site/installing-weave.md)
+ * [Installing Weave Net](/site/install/installing-weave.md)
- * [Using Weave Cloud to get started with Weave Net](/site/using-weave/weave-cloud.md)
+ * [Using Weave Cloud to get started with Weave Net](/site/install/weave-cloud.md)
- * [Using Fastdp With Weave Net](/site/using-weave/fastdp.md)
+ * [Using Fastdp With Weave Net](/site/tasks/manage/fastdp.md)
- * [Integrating Docker via the Network Plugin (Legacy)](/site/plugin.md)
+ * [Integrating Docker via the Network Plugin (Legacy)](/site/install/plugin/plugin.md)
- * [Integrating Docker via the Network Plugin (V2)](/site/plugin-v2.md)
+ * [Integrating Docker via the Network Plugin (V2)](/site/install/plugin/plugin-v2.md)

site/install/weave-cloud.md

@@ -1,6 +1,6 @@
 ---
-title: Using Weave Cloud to get started with Weave Net
+title: Visualizing Weave Net in Weave Cloud
-menu_order: 10
+menu_order: 30
 search_type: Documentation
 ---
 
@@ -86,7 +86,7 @@ first and automatically create a connection to it.
 
 >**Note:** If there is a firewall between `$HOST1` and `$HOST2`,  you must permit traffic to flow through TCP 6783 and UDP 6783/6784, which are Weave’s control and data ports.
 
-Now you can proceed to [test container communications](/site/using-weave#testing)
+Now you can proceed to [test container communications](/site/install/using-weave#testing)
 
 ### <a name="how-it-works"></a>How Peer Discovery Works
 
@@ -110,19 +110,19 @@ error message in its log and exit. To check the logs run:
     host1$ docker logs weave
 
 When a Weave Net instance is formed for the first time, the peers must
-initialize the [IP Allocation Manager](/site/ipam.md). This process,
+initialize the [IP Allocation Manager](/site/tasks/ipam/ipam.md). This process,
 and the configuration options available, are unchanged when using
 Weave Cloud.
 
 When you shut down a peer for good, use [the `weave reset`
-command](/site/ipam/stop-remove-peers-ipam.md) and it will be removed
+command](/site/tasks/ipam/stop-remove-peers-ipam.md) and it will be removed
 from the Weave Cloud database so future peers will not attempt to
 connect to it.
 
 **See Also**
 
- * [Installing Weave Net](/site/installing-weave.md)
+ * [Installing Weave Net](/site/install/installing-weave.md)
- * [Using Weave Net](/site/using-weave.md)
+ * [Launching Weave Net](/site/install/using-weave.md)
- * [Using Fastdp With Weave Net](/site/using-weave/fastdp.md)
+ * [Using Fastdp With Weave Net](/site/tasks/manage/fastdp.md)
- * [Integrating Docker via the Network Plugin (Legacy)](/site/plugin.md)
+ * [Integrating Docker via the Network Plugin (Legacy)](/site/install/plugin/plugin.md)
- * [Integrating Docker via the Network Plugin (V2)](/site/plugin-v2.md)
+ * [Integrating Docker via the Network Plugin (V2)](/site/install/plugin/plugin-v2.md)

site/kubernetes.md

@@ -1,11 +1,11 @@
 ---
 title: Integrating Kubernetes and Mesos via the CNI Plugin
-menu_order: 65
+menu_order: 40
 search_type: Documentation
 ---
 
 > The recommended way of using Weave with Kubernetes is via the new
-> [Kubernetes Addon](/site/kube-addon.md). The instructions below
+> [Kubernetes Addon](/site/kubernetes/kube-addon.md). The instructions below
 > remain valid however, and are still the recommended method for
 > integrating with Mesos.
 
@@ -34,9 +34,9 @@ Then run:
 
 To create a network that spans multiple hosts, the Weave peers must be connected to each other.  
 This is accomplished by specifying the other hosts during `weave launch` or via
-[`weave connect`](/site/using-weave/finding-adding-hosts-dynamically.md).
+[`weave connect`](/site/tasks/manage/finding-adding-hosts-dynamically.md).
 
-See [Creating Peer Connections Between Hosts](/site/using-weave.md#peer-connections) 
+See [Creating Peer Connections Between Hosts](/site/install/using-weave.md#peer-connections) 
 for a discussion on peer connections. 
 
     weave launch <peer hosts>

site/kubernetes/kube-addon.md

@@ -1,6 +1,6 @@
 ---
 title: Integrating Kubernetes via the Addon
-menu_order: 63
+menu_order: 20
 search_type: Documentation
 ---
 
@@ -22,7 +22,7 @@ Weave Net can be installed onto your CNI-enabled Kubernetes cluster
 with a single command:
 
 ```
-$ kubectl apply -n kube-system -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"
+$ kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"
 ```
 
 After a few seconds, a Weave Net pod should be running on each
@@ -43,7 +43,7 @@ recommend your master node has at least two CPU cores.
 > Alternatively, you can [configure CNI yourself](http://kubernetes.io/docs/admin/network-plugins/#cni)
 
 **Note:** If using the [Weave CNI
-Plugin](/site/cni-plugin.md) from a prior full install of Weave Net with your
+Plugin](/site/kubernetes.md) from a prior full install of Weave Net with your
 cluster, you must first uninstall it before applying the Weave-kube addon.
 Shut down Kubernetes, and _on all nodes_ perform the following:
 
@@ -55,21 +55,6 @@ Shut down Kubernetes, and _on all nodes_ perform the following:
 Then relaunch Kubernetes and install the addon as described
 above.
 
-**Note:** The URLs:
-
-- [https://git.io/weave-kube](https://git.io/weave-kube), and
-- [https://git.io/weave-kube-1.6](https://git.io/weave-kube-1.6)
-
-point to:
-
-- [https://cloud.weave.works/k8s/v1.5/net](https://cloud.weave.works/k8s/v1.5/net), and
-- [https://cloud.weave.works/k8s/v1.6/net](https://cloud.weave.works/k8s/v1.6/net).
-
-In the past, these URLs pointed to the static YAML files for the [latest release](https://github.com/weaveworks/weave/releases/tag/latest_release) of the Weave Net addon, respectively:
-
-- [`latest_release/weave-daemonset.yaml`](https://github.com/weaveworks/weave/releases/download/latest_release/weave-daemonset.yaml) and
-- [`latest_release/weave-daemonset-k8s-1.6.yaml`](https://github.com/weaveworks/weave/releases/download/latest_release/weave-daemonset-k8s-1.6.yaml).
-
 ## <a name="kube-1.6-upgrade"></a> Upgrading Kubernetes to version 1.6
 
 In version 1.6, Kubernetes has increased security, so we need to
@@ -95,7 +80,7 @@ the Weave Net pods one by one.
 Kubernetes v1.5 and below does not support rolling upgrades of daemon sets,
 and so you will need to perform the procedure manually:
 
-* Apply the updated addon manifest `kubectl apply -f https://git.io/weave-kube`
+* Apply the updated addon manifest `kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"`
 * Kill each Weave Net pod with `kubectl delete` and then wait for it to reboot before moving on to the next pod.
 
 **Note:** If you delete all Weave Net pods at the same time they will
@@ -175,8 +160,8 @@ definition](http://kubernetes.io/docs/api-reference/extensions/v1beta1/definitio
   Controller allows all multicast traffic. Since a single multicast
   address may be used by multiple pods, we cannot implement rules to
   isolate them individually.  You can turn this behaviour off (block
-  all multicast traffic) by adding `--allow-mcast` as an argument to
+  all multicast traffic) by adding `--allow-mcast=false` as an
-  `weave-npc` in the YAML configuration.
+  argument to `weave-npc` in the YAML configuration.
 
 ### <a name="blocked-connections"></a> Troubleshooting Blocked Connections
 
@@ -214,7 +199,7 @@ UDP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC.
 
 #### Using `cloud.weave.works`
 
-If the YAML file is from `cloud.weave.works` as described above, then you can customise it by passing some of Weave Net's options, arguments and environment variables as query parameters:
+You can customise the YAML you get from `cloud.weave.works` by passing some of Weave Net's options, arguments and environment variables as query parameters:
 
   - `version`: Weave Net's version. Default: `latest`, i.e. latest release. *N.B.*: This only changes the specified version inside the generated YAML file, it does not ensure that the rest of the YAML is compatible with that version. To freeze the YAML version save a copy of the YAML file from the [release page](https://github.com/weaveworks/weave/releases) and use that copy instead of downloading it each time from `cloud.weave.works`.
   - `password-secret`: name of the Kubernetes secret containing your password.
@@ -222,7 +207,7 @@ If the YAML file is from `cloud.weave.works` as described above, then you can cu
 
         $ echo "s3cr3tp4ssw0rd" > /var/lib/weave/weave-passwd.txt
         $ kubectl create secret -n kube-system generic weave-passwd --from-file=/var/lib/weave/weave-passwd.txt
-        $ kubectl apply -n kube-system -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')&password-secret=weave-passwd"
+        $ kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')&password-secret=weave-passwd"
 
   - `known-peers`: comma-separated list of hosts. Default: empty.
   - `trusted-subnets`: comma-separated list of CIDRs. Default: empty.
@@ -252,12 +237,12 @@ The list of variables you can set is:
 * `WEAVE_MTU` - Weave Net defaults to 1376 bytes, but you can set a
   smaller size if your underlying network has a tighter limit, or set
   a larger size for better performance if your network supports jumbo
-  frames - see [here](/site/using-weave/fastdp.md#mtu) for more
+  frames - see [here](/site/tasks/manage/fastdp.md#mtu) for more
   details.
 
 Example:
 ```
-$ kubectl apply -n kube-system -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')&env.WEAVE_MTU=1337"
+$ kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')&env.WEAVE_MTU=1337"
 ```
 This command -- notice `&env.WEAVE_MTU=1337` at the end of the URL -- generates a YAML file containing, among others:
 
@@ -292,3 +277,72 @@ For example,
             - name: IPALLOC_RANGE
               value: 10.0.0.0/16
 ```
+
+## <a name="operations"></a> Operations
+
+When using the Kubernetes addon, Weave Net's peers are managed via Kubernetes and very little effort should be required from your end to operate your network.
+
+However, should you need it, you can still run `weave` CLI commands to, for example, confirm Weave Net' status. This can be done in various ways:
+
+1. You could [install the `weave` script](/site/installing-weave.md) and run the same commands you would run without Kubernetes:
+
+```
+$ weave status
+        Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29)
+
+        Service: router
+       Protocol: weave 1..2
+           Name: 42:8e:e8:c4:52:1b(host-0)
+     Encryption: disabled
+  PeerDiscovery: enabled
+        Targets: 3
+    Connections: 3 (2 established, 1 failed)
+          Peers: 3 (with 6 established connections)
+ TrustedSubnets: none
+
+        Service: ipam
+         Status: ready
+          Range: 10.32.0.0/12
+  DefaultSubnet: 10.32.0.0/12
+```
+
+2. If you do not want to install anything else on your hosts, you can use the following `kubectl` commands, which will produce the exact same outcome as the previous example:
+
+```
+### Identify the Weave Net pods:
+
+$ kubectl get pods --all-namespaces -o wide | grep weave
+kube-system  weave-net-1jkl6  2/2  Running  0  1d  10.128.0.4  host-0
+kube-system  weave-net-bskbv  2/2  Running  0  1d  10.128.0.5  host-1
+kube-system  weave-net-m4x1b  2/2  Running  0  1d  10.128.0.6  host-2
+
+### The above shows all Weave Net pods available in your cluster.
+### You can see Kubernetes has deployed one Weave Net pod per host, in order to interconnect all hosts.
+
+### You then need to:
+### - choose which pod you want to run your command from (e.g.: here, pod weave-net-1jkl6, running on host-0), and
+### - make sure you pass --local to weave, in addition to your command:
+
+$ kubectl exec -n kube-system weave-net-1jkl6 -- /home/weave/weave --local status
+Defaulting container name to weave.
+Use 'kubectl describe pod/weave-net-1jkl6' to see all of the containers in this pod.
+
+        Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29)
+
+        Service: router
+       Protocol: weave 1..2
+           Name: 42:8e:e8:c4:52:1b(host-0)
+     Encryption: disabled
+  PeerDiscovery: enabled
+        Targets: 3
+    Connections: 3 (2 established, 1 failed)
+          Peers: 3 (with 6 established connections)
+ TrustedSubnets: none
+
+        Service: ipam
+         Status: ready
+          Range: 10.32.0.0/12
+  DefaultSubnet: 10.32.0.0/12
+```
+
+3. Finally you could also use [Weave Cloud](https://cloud.weave.works/) and monitor all your pods, including Weave Net's ones, from there.

site/operational-guide/autoscaling.md

@@ -25,7 +25,7 @@ and partitions.
 ### Scaling Out
 
 On the additional dynamic peer, at boot, via
-[systemd](/site/installing-weave/systemd.md) or equivalent:
+[systemd](/site/install/systemd.md) or equivalent:
 
     weave launch --no-restart --ipalloc-init=observer $PEERS
 

site/operational-guide/concepts.md

@@ -72,7 +72,7 @@ detail below.
 Peer discovery is a mechanism that allows peers to learn about new
 Weave Net hosts from existing peers without being explicitly told. Peer
 discovery is
-[enabled by default](/site/using-weave/finding-adding-hosts-dynamically.md).
+[enabled by default](/site/tasks/manage/finding-adding-hosts-dynamically.md).
 
 ## <a name="network-partition"></a>Network Partition
 
@@ -85,7 +85,7 @@ partition, healing automatically once the partition is over.
 
 ## <a name="ip-address-manager"></a>IP Address Manager (IPAM)
 
-[IPAM](/site/ipam.md) is the subsystem responsible for dividing up a
+[IPAM](/site/tasks/ipam/ipam.md) is the subsystem responsible for dividing up a
 large contiguous block of IP addresses (known as the IP allocation
 range) amongst peers so that individual addresses may be uniquely
 assigned to containers anywhere on the overlay network.

site/operational-guide/tasks.md

@@ -21,7 +21,7 @@ once and your system is configured to start Docker on boot, then Weave Net
 will start automatically on system restarts.
 
 If you are aiming for a non-interactive installation, use
-[systemd](/site/installing-weave/systemd.md) or a similar init system to
+[systemd](/site/install/systemd.md) or a similar init system to
 launch Weave using the `--no-restart` flag after Docker has been started.
 
 ## <a name="detect-reclaim-ipam"></a>Detecting and Reclaiming Lost IP Address Space
@@ -66,7 +66,7 @@ after which one of the remaining peers could decide unilaterally that
 it is safe to appropriate the space for itself, and so an
 administrative action is required to reclaim it.
 
-The [`weave rmpeer`](/site/ipam/stop-remove-peers-ipam.md)
+The [`weave rmpeer`](/site/tasks/ipam/stop-remove-peers-ipam.md)
 command is provided to perform this task, and must
 be executed on _one_ of the remaining peers. That peer will then take
 ownership of the freed address space.
@@ -115,6 +115,6 @@ you can issue the following command:
 
 **See Also**
 
- * [Allocating IP Addresses](/site/ipam.md)
+ * [Allocating IP Addresses](/site/tasks/ipam/ipam.md)
- * [Troubleshooting the IP Allocator](/site/ipam/troubleshooting-ipam.md)
+ * [Troubleshooting the IP Allocator](/site/tasks/ipam/troubleshooting-ipam.md)
 

site/operational-guide/uniform-dynamic-cluster.md

@@ -18,7 +18,7 @@ A uniform dynamic cluster has the following characteristics:
 ## Bootstrapping
 
 On each initial peer N, at boot, via
-[systemd](/site/installing-weave/systemd.md):
+[systemd](/site/install/systemd.md):
 
     hostN$ weave launch --no-restart --name ::N --ipalloc-init seed=$SEED $PEERS
 
@@ -45,7 +45,7 @@ Where
 ## Adding a Peer
 
 On each new peer, at boot, via
-[systemd](/site/installing-weave/systemd.md):
+[systemd](/site/install/systemd.md):
 
     hostN$ weave launch --no-restart --name ::N --ipalloc-init seed=$SEED $PEERS
 

site/operational-guide/uniform-fixed-cluster.md

@@ -24,7 +24,7 @@ A uniform fixed cluster has the following characteristics:
 ### Bootstrapping
 
 On each initial peer, at boot, via
-[systemd](/site/installing-weave/systemd.md):
+[systemd](/site/install/systemd.md):
 
     weave launch --no-restart $PEERS
 
@@ -56,7 +56,7 @@ that](/site/troubleshooting.md) before moving on.
 ### Adding a Peer
 
 On the new peer, at boot, via
-[systemd](/site/installing-weave/systemd.md) run:
+[systemd](/site/install/systemd.md) run:
 
     weave launch --no-restart $PEERS
 

site/overview.md

@@ -27,7 +27,7 @@ Weave Net implements service discovery by providing a fast "micro DNS" server at
 All other Docker networking plugins, including Docker's own "Overlay" driver, require that you set up Docker with a cluster store – a central database like Consul or Zookeeper – before you can even use them. Besides being difficult to set up, maintain and manage, every Docker host must also be in constant contact with the cluster store: if you lose the connection, even temporarily, then you cannot start or stop any containers.
 
 Weave Net is bundled with a Docker Network plugin that doesn't require an external cluster store. You can get started right away and you can start and stop containers even when there are network connectivity problems.  
-For information about the Weave Docker Plugin, see [How The Weave Network Plugin Works](/site/plugin/plugin-how-it-works.md).
+For information about the Weave Docker Plugin, see [How The Weave Network Plugin Works](/site/install/plugin/plugin-how-it-works.md).
 
 ### Operates in Partially Connected Networks
 
@@ -37,7 +37,7 @@ Weave Net can forward traffic between nodes, and it works even if the mesh netwo
 
 Weave Net automatically chooses the fastest path between two hosts, offering near native throughput and latency, all without your intervention.  
 
-See [How Fast Datapath Works](/site/using-weave/fastdp.md) for more information.
+See [How Fast Datapath Works](/site/tasks/manage/fastdp.md) for more information.
 
 ### Network Operations Friendly
 
@@ -60,7 +60,7 @@ With Weave Net, deploy your applications - whether peer-to-peer file sharing, vo
 Weave Net is a good choice if you want one tool for everything.  For example: In addition to Docker plugins, you can also use Weave as a Kubernetes plugin.  You can also use Weave with Amazon ECS or with Mesos and Marathon.  
 Refer to our Getting Started and Integration Guides for more information.
 
-For a complete list and description of Weave Net’s current feature set see, [Weave Net Features](/site/features.md).
+For a complete list and description of Weave Net’s current feature set see, [Weave Net Features](/site/overview/features.md).
 
 
 

site/overview/features.md

@@ -26,7 +26,7 @@ search_type: Documentation
  * [Container Mobility](#container-mobility)
  * [Fault Tolerance](#fault-tolerance) 
 
-For step-by-step instructions on how to use Weave Net, see [Using Weave Net](/site/using-weave.md).
+For step-by-step instructions on how to use Weave Net, see [Launching Weave Net](/site/install/using-weave.md).
 
 ### <a name="virtual-ethernet-switch"></a>Virtual Ethernet Switch
 
@@ -44,8 +44,8 @@ a container network.
 Broadcast and Multicast protocols can also be used
 over Weave Net.
 
-To start using Weave Net, see [Installing Weave Net](/site/installing-weave.md) 
+To start using Weave Net, see [Installing Weave Net](/site/install/installing-weave.md) 
-and [Using Weave Net](/site/using-weave.md).
+and [Launching Weave Net](/site/install/using-weave.md).
 
 ### <a name="fast-data-path"></a>Fast Datapath
 
@@ -53,12 +53,12 @@ Weave Net automatically chooses the fastest available method to
 transport data between peers. The best performing of these 
 (the 'fast datapath') offers near-native throughput and latency.
 
-See [Using Fast Datapath](/site/using-weave/fastdp.md) and
+See [Using Fast Datapath](/site/tasks/manage/fastdp.md) and
-[How Fast Datapath Works](/site/how-it-works/fastdp-how-it-works.md).
+[How Fast Datapath Works](/site/concepts/fastdp-how-it-works.md).
 
 ### <a name="docker"></a>Seamless Docker Integration (Weave Docker API Proxy)
 
-Weave Net includes a [Docker API Proxy](/site/weave-docker-api.md), which can be 
+Weave Net includes a [Docker API Proxy](/site/tasks/weave-docker-api/weave-docker-api.md), which can be 
 used to start containers using the Docker [command-line interface](https://docs.docker.com/reference/commandline/cli/) or the [remote API](https://docs.docker.com/reference/api/docker_remote_api/), and attach them to the Weave network before they begin execution.
 
 To use the proxy, run:
@@ -71,7 +71,7 @@ Containers started in this way that subsequently restart, either
 by an explicit `docker restart` command or by Docker restart 
 policy, are re-attached to the Weave network by the `Weave Docker API Proxy`.
 
-See [Integrating Docker via the API Proxy](/site/weave-docker-api.md).
+See [Integrating Docker via the API Proxy](/site/tasks/weave-docker-api/weave-docker-api.md).
 
 
 ### <a name="plugin"></a>Weave Network Docker Plugin
@@ -84,15 +84,15 @@ named `weave` is created by `weave launch`, which is used as follows:
 Using the Weave plugin enables you to take advantage of [Docker's network functionality](https://docs.docker.com/engine/extend/plugins_network/).
 
 There are two plugin implementations for Weave Net: the
-["Legacy"](/site/plugin.md) plugin which doesn't require an external
+["Legacy"](/site/install/plugin/plugin.md) plugin which doesn't require an external
-cluster store, and the ["V2"](/site/plugin-v2.md) plugin which
+cluster store, and the ["V2"](/site/install/plugin/plugin-v2.md) plugin which
 supports Docker swarm mode.
 
 ### <a name="cniplugin"></a>Weave Network CNI Plugin
 
 Weave can be used as a plugin to systems that support the [Container Network Interface](https://github.com/appc/cni), such as Kubernetes and Mesosphere.
 
-See [Integrating Kubernetes and Mesos via the CNI Plugin](/site/cni-plugin.md) for more details.
+See [Integrating Kubernetes and Mesos via the CNI Plugin](/site/kubernetes.md) for more details.
 
 
 ### <a name="addressing"></a>IP Address Management (IPAM)
@@ -100,24 +100,24 @@ See [Integrating Kubernetes and Mesos via the CNI Plugin](/site/cni-plugin.md) f
 Containers are automatically allocated a unique IP address. To view the addresses allocated by Weave, run `weave ps`.
 
 Instead of allowing Weave to automatically allocate addresses, an IP address and a network can be explicitly 
-specified. See [How to Manually Specify IP Addresses and Subnets](/site/using-weave/manual-ip-address.md) for instructions. 
+specified. See [How to Manually Specify IP Addresses and Subnets](/site/tasks/ipam/manual-ip-address.md) for instructions. 
 
-For a discussion on how Weave Net uses IPAM, see [Automatic IP Address Management](/site/ipam.md). And also review the 
+For a discussion on how Weave Net uses IPAM, see [Automatic IP Address Management](/site/tasks/ipam/ipam.md). And also review the 
-[the basics of IP addressing](/site/how-it-works/ip-addresses.md) for an explanation of addressing and private networks. 
+[the basics of IP addressing](/site/concepts/ip-addresses.md) for an explanation of addressing and private networks. 
 
 
 ### <a name="naming-and-discovery"></a>Naming and Discovery
  
-Named containers are automatically registered in [weaveDNS](/site/weavedns.md), 
+Named containers are automatically registered in [weaveDNS](/site/tasks/weavedns/weavedns.md), 
 and are discoverable by using standard, simple name lookups:
 
     host1$ docker run -dti --name=service weaveworks/ubuntu
     host1$ docker run -ti weaveworks/ubuntu
     root@7b21498fb103:/# ping service
 
-WeaveDNS also supports [load balancing](/site/weavedns/load-balance-fault-weavedns.md), [fault resilience](/site/weavedns/load-balance-fault-weavedns.md) and [hot swapping](/site/weavedns/managing-entries-weavedns.md). 
+WeaveDNS also supports [load balancing](/site/tasks/weavedns/load-balance-fault-weavedns.md), [fault resilience](/site/tasks/weavedns/load-balance-fault-weavedns.md) and [hot swapping](/site/tasks/weavedns/managing-entries-weavedns.md). 
 
-See [Discovering Containers with WeaveDNS](/site/weavedns.md).
+See [Discovering Containers with WeaveDNS](/site/tasks/weavedns/weavedns.md).
  
 ### <a name="application-isolation"></a>Application Isolation
 
@@ -132,13 +132,13 @@ _isolation-through-subnets_ technique. This common strategy
  techniques can be used to deploy your applications to 
  containers.
 
-See [Isolating Applications](/site/using-weave/application-isolation.md) 
+See [Isolating Applications](/site/tasks/manage/application-isolation.md) 
 for information on how to use the isolation-through-subnets 
 technique with Weave Net.
 
 ### <a name="network-policy"></a>Network Policy
 
-The Weave [Kubernetes Addon](/site/kube-addon.md) includes a network
+The Weave [Kubernetes Addon](/site/kubernetes/kube-addon.md) includes a network
 policy controller that implements [Kubernetes Network
 Policies](http://kubernetes.io/docs/user-guide/networkpolicies/).
 
@@ -149,7 +149,7 @@ given container in advance. In these cases, you can take
 advantage of Weave's ability to attach and detach running 
 containers to and from any network. 
 
-See [Dynamically Attaching and Detaching Containers](/site/using-weave/dynamically-attach-containers.md) 
+See [Dynamically Attaching and Detaching Containers](/site/tasks/manage/dynamically-attach-containers.md) 
 for details. 
 
 
@@ -176,7 +176,7 @@ running alongside Weave.
 Weave Net implements encryption and security using the Go version of [Daniel J.  Bernstein's NaCl library](http://nacl.cr.yp.to/index.html),
 and, additionally in the case of encrypted fast datapath using [the cryptography framework of the Linux kernel](https://en.wikipedia.org/wiki/Crypto_API_(Linux)).
 
-For information on how to secure your Docker network connections, see [Securing Connections Across Untrusted Networks](/site/using-weave/security-untrusted-networks.md) and for a more technical discussion on how Weave implements encryption see, [Weave Encryption](/site/how-it-works/encryption.md) and [How Weave Implements Encryption](/site/how-it-works/encryption-implementation.md).
+For information on how to secure your Docker network connections, see [Securing Connections Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks.md) and for a more technical discussion on how Weave implements encryption see, [Weave Encryption](/site/concepts/encryption.md) and [How Weave Implements Encryption](/site/concepts/encryption-implementation.md).
 
 
 ### <a name="host-network-integration"></a>Host Network Integration
@@ -184,7 +184,7 @@ For information on how to secure your Docker network connections, see [Securing
 Weave Net application networks can be integrated with a host's network, and establish connectivity between the host and 
 application containers anywhere.
 
-See [Integrating with the Host Network](/site/using-weave/host-network-integration.md).
+See [Integrating with the Host Network](/site/tasks/manage/host-network-integration.md).
 
 ### <a name="services"></a>Managing Services: Exporting, Importing, Binding and Routing
  
@@ -193,7 +193,7 @@ See [Integrating with the Host Network](/site/using-weave/host-network-integrati
  * **Binding Services** - A container can be bound to a particular IP and port without having to change your application code, while at the same time will maintain its original endpoint. 
  * **Routing Services** - By combining the importing and exporting features, you can connect to disjointed networks, even when separated by firewalls and where there may be overlapping IP addresses.  
 
-See [Managing Services - Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md) for instructions on how to manage services on a Weave container network. 
+See [Managing Services - Exporting, Importing, Binding and Routing](/site/tasks/manage/service-management.md) for instructions on how to manage services on a Weave container network. 
 
 ### <a name="multi-cloud-networking"></a>Multi-Cloud Networking
 
@@ -203,7 +203,7 @@ of containers that run on [Google Compute Engine](https://cloud.google.com/compu
 (GCE), [Amazon Elastic Compute Cloud](https://aws.amazon.com/ec2/) 
 (EC2) and in a local data centre all at the same time.
 
-See [Enabling Multi-Cloud networking and Muti-hop Routing](/site/using-weave/multi-cloud-multi-hop.md).
+See [Enabling Multi-Cloud networking and Muti-hop Routing](/site/tasks/manage/multi-cloud-multi-hop.md).
 
 
 ### <a name="multi-hop-routing"></a>Multi-Hop Routing
@@ -213,14 +213,14 @@ even when there is only partial connectivity between the hosts. Weave Net
 routes traffic between containers as long as there is at least one *path* 
 of connected hosts between them.
 
-See [Enabling Multi-Cloud networking and Multi-hop Routing](/site/using-weave/multi-cloud-multi-hop.md).
+See [Enabling Multi-Cloud networking and Multi-hop Routing](/site/tasks/manage/multi-cloud-multi-hop.md).
 
 
 ### <a name="dynamic-topologies"></a>Dynamic Topologies
 
 Hosts can be added to or removed from a Weave network without stopping
 or reconfiguring the remaining hosts. See [Adding and Removing Hosts
-Dynamically.](/site/using-weave/finding-adding-hosts-dynamically.md)
+Dynamically.](/site/tasks/manage/finding-adding-hosts-dynamically.md)
 
 
 ### <a name="container-mobility"></a>Container Mobility
@@ -230,7 +230,7 @@ reconfiguration or, in many cases, restarts of other containers.
 All that is required is for the migrated container to be started 
 with the same IP address as it was given originally.
 
-See [Managing Services - Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md), in particular, Routing Services for more information on container mobility. 
+See [Managing Services - Exporting, Importing, Binding and Routing](/site/tasks/manage/service-management.md), in particular, Routing Services for more information on container mobility. 
 
 
 ### <a name="fault-tolerance"></a>Fault Tolerance

site/tasks.md

@@ -0,0 +1,71 @@
+---
+title: Weave Net Tasks
+menu_order: 50
+search_type: Documentation
+---
+
+The section describes the configuration options available in Weave Net. It is divided into: Managing Containerized Applications, Administering IP Addresses, Managing WeaveDNS, and finally attaching Docker Containers via the Weave API Proxy. 
+
+
+## Managing Containerized Applications
+
+
+* [Isolating Applications on a Weave Network](https://weave.works/docs/net/latest/tasks/manage/application-isolation/)
+* [Dynamically Attaching and Detaching Applications](https://weave.works/docs/net/latest/tasks/dynamically-attach-containers/)
+* [Integrating with the Host Network](https://weave.works/docs/net/latest/tasks/host-network-integration/)
+* [Managing Services - Exporting, Importing, Binding and Routing](https://weave.works/docs/net/latest/tasks/manage/service-management/)
+     * [Exporting Services](https://weave.works/docs/net/latest/tasks/manage/service-management/#exporting)
+     * [Importing Services](https://weave.works/docs/net/latest/tasks/manage/service-management/#importing)
+     * [Binding Services](https://weave.works/docs/net/latest/tasks/manage/service-management/#binding)
+     * [Routing Services](https://weave.works/docs/net/latest/tasks/manage/service-management/#routing)
+     * [Dynamically Changing Service Locations](https://weave.works/docs/net/latest/tasks/manage/service-management/#change-location)
+* [Securing Connections Across Untrusted Networks](https://weave.works/docs/net/latest/tasks//manage/security-untrusted-networks/)
+* [Adding and Removing Hosts Dynamically](https://weave.works/docs/net/latest/tasks/manage/finding-adding-hosts-dynamically/)
+* [Using Fast Datapath](https://weave.works/docs/net/latest/tasks/manage/fastdp/)
+* [Enabling Multi-Cloud, Multi-Hop Networking and Routing](https://weave.works/docs/net/latest/tasks/manage/multi-cloud-multi-hop/)
+* [Configuring IP Routing on an Amazon Web Services Virtual Private Cloud](https://weave.works/docs/net/latest/tasks/manage/awsvpc/)
+* [Monitoring with Prometheus](https://weave.works/docs/net/latest/tasks/manage/metrics/)
+
+
+## Administering IP Addresses
+
+
+* [Allocating IP Addresses](https://weave.works/docs/net/latest/tasks/ipam/ipam/)
+     * [Initializing Peers on a Weave Network](https://weave.works/docs/net/latest/tasks/ipam/ipam/#initialization)
+     * [--ipalloc-init:consensus and How Quorum is Achieved](https://weave.works/docs/net/latest/tasks/ipam/ipam/#quorum)
+     * [Priming a Peer](https://weave.works/docs/net/latest/tasks/ipam/ipam/#priming-a-peer)
+     * [Choosing an Allocation Range](https://weave.works/docs/net/latest/tasks/ipam/ipam/#range)
+* [Allocating IPs in a Specific Range](https://weave.works/docs/net/latest/tasks/ipam/configuring-weave/)
+* [Manually Specifying the IP Address of a Container](https://weave.works/docs/net/latest/tasks/ipam/manual-ip-address/)
+* [Automatic Allocation Across Multiple Subnets](https://weave.works/docs/net/latest/tasks/ipam/allocation-multi-ipam/)
+* [Starting, Stopping and Removing Peers](https://weave.works/docs/net/latest/tasks/ipam/stop-remove-peers-ipam/)
+* [Troubleshooting the IP Allocator](https://weave.works/docs/net/latest/tasks/ipam/troubleshooting-ipam/)
+
+
+## Managing WeaveDNS
+
+
+* [Discovering Containers with WeaveDNS](https://weave.works/docs/net/latest/tasks/weavedns/weavedns/)
+* [How Weave Finds Containers](https://weave.works/docs/net/latest/tasks/weavedns/how-works-weavedns/)
+* [Load Balancing and Fault Resilience with weaveDNS](https://weave.works/docs/net/latest/tasks/weavedns/load-balance-fault-weavedns/)
+* [Managing Domains](https://weave.works/docs/net/latest/tasks/weavedns/managing-domains-weavedns/)
+     * [Configuring the domain search path](https://weave.works/docs/net/latest/tasks/weavedns/managing-domains-weavedns/#domain-search-path)
+     * [Using a different local domain](https://weave.works/docs/net/latest/tasks/weavedns/managing-domains-weavedns/#local-domain)
+* [Managing Domain Entries](https://weave.works/docs/net/latest/tasks/weavedns/managing-entries-weavedns/)
+     * [Adding and removing extra DNS entries](https://weave.works/docs/net/latest/tasks/weavedns/managing-entries-weavedns/#add-remove)
+     * [Resolving WeaveDNS entries from the Host](https://weave.works/docs/net/latest/tasks/weavedns/managing-entries-weavedns/#resolve-weavedns-entries-from-host)
+     * [Hot-swapping Service Containers](https://weave.works/docs/net/latest/tasks/weavedns/managing-entries-weavedns/#hot-swapping)
+     * [Configuring a Custom TTL](https://weave.works/docs/net/latest/tasks/weavedns/managing-entries-weavedns/#ttl)
+* [Troubleshooting and Present Limitations](https://weave.works/docs/net/latest/tasks/weavedns/troubleshooting-weavedns/)
+
+
+## Attaching Docker Containers via the Weave API Proxy
+
+
+* [Integrating Docker via the API Proxy](https://weave.works/docs/net/latest/tasks/weave-docker-api/weave-docker-api/)
+* [Using The Weave Docker API Proxy](https://weave.works/docs/net/latest/tasks/weave-docker-api/using-proxy/)
+* [Securing the Docker Communications With TLS](https://weave.works/docs/net/latest/tasks/weave-docker-api/securing-proxy/)
+* [Automatic IP Allocation and the Weave Proxy](https://weave.works/docs/net/latest/tasks/weave-docker-api/ipam-proxy/)
+* [Using Automatic Discovery With the Weave Net Proxy](https://weave.works/docs/net/latest/tasks/weave-docker-api/automatic-discovery-proxy/)
+* [Name resolution via `/etc/hosts`](https://weave.works/docs/net/latest/tasks/weave-docker-api/name-resolution-proxy/)
+* [Launching Containers With Weave Run (without the Proxy)](https://weave.works/docs/net/latest/tasks/weave-docker-api/launching-without-proxy/)

site/tasks/ipam.md

@@ -0,0 +1,5 @@
+---
+title: Administering IP Addresses
+menu_order: 20
+search_type: Documentation
+---

site/tasks/ipam/allocation-multi-ipam.md

@@ -1,6 +1,6 @@
 ---
 title: Automatic Allocation Across Multiple Subnets
-menu_order: 10
+menu_order: 30
 search_type: Documentation
 ---
 
@@ -10,7 +10,7 @@ puts all containers into a subnet that spans the entire allocation
 range, so that every Weave-attached container can communicate with every other
 Weave-attached container.
 
-If you want some [isolation](/site/using-weave/application-isolation.md), you
+If you want some [isolation](/site/tasks/manage/application-isolation.md), you
 can choose to run containers on different subnets.  To request the
 allocation of an address from a particular subnet, set the
 `WEAVE_CIDR` environment variable to `net:<subnet>` when creating the
@@ -63,6 +63,6 @@ for manual allocation.
 
 **See Also**
 
- * [Address Allocation with IP Address Management (IPAM)](/site/ipam.md)
+ * [Address Allocation with IP Address Management (IPAM)](/site/tasks/ipam/ipam.md)
- * [Isolating Applications on a Weave Network](/site/using-weave/application-isolation.md)
+ * [Isolating Applications on a Weave Network](/site/tasks/manage/application-isolation.md)
- * [Starting, Stopping and Removing Peers](/site/ipam/stop-remove-peers-ipam.md)
+ * [Starting, Stopping and Removing Peers](/site/tasks/ipam/stop-remove-peers-ipam.md)

site/tasks/ipam/configuring-weave.md

@@ -1,6 +1,6 @@
 ---
 title: Allocating IPs in a Specific Range
-menu_order: 15
+menu_order: 10
 search_type: Documentation
 ---
 
@@ -40,4 +40,4 @@ Networks](https://en.wikipedia.org/wiki/Private_network).  For example
 
 **See Also**
 
- * [IP Addresses, Routes and Networks](/site/how-it-works/ip-addresses.md)
+ * [IP Addresses, Routes and Networks](/site/concepts/ip-addresses.md)

site/tasks/ipam/ipam.md

@@ -1,6 +1,6 @@
 ---
 title: Allocating IP Addresses
-menu_order: 70
+menu_order: 5
 search_type: Documentation
 ---
 
@@ -180,7 +180,7 @@ The range parameter is written in
 in this example "/16" means the first 16 bits of the address form the
 network address and the allocator is to allocate container addresses
 that all start 10.2. See [IP
-addresses and routes](/site/how-it-works/ip-addresses.md) for more information.
+addresses and routes](/site/concepts/ip-addresses.md) for more information.
 
 Weave shares the IP address range across all peers, dynamically
 according to their needs.  If a group of peers becomes isolated from
@@ -202,5 +202,5 @@ named `weavedb` is used to store this data.
 
  **See Also**
 
- * [Automatic Allocation Across Multiple Subnets](/site/ipam/allocation-multi-ipam.md)
+ * [Automatic Allocation Across Multiple Subnets](/site/tasks/ipam/allocation-multi-ipam.md)
- * [Integrating Docker via the Network Plugin (Legacy)](/site/plugin.md)
+ * [Integrating Docker via the Network Plugin (Legacy)](/site/install/plugin/plugin.md)

site/tasks/ipam/manual-ip-address.md

@@ -11,7 +11,7 @@ Containers are automatically allocated an IP address that is unique across the W
 
 Weave Net detects when a container has exited and releases its allocated addresses so they can be re-used by the network.
 
-See the [Automatic IP Address Management](/site/ipam.md) and also an explanation of [the basics of IP addressing](/site/how-it-works/ip-addresses.md) for further details.
+See the [Automatic IP Address Management](/site/tasks/ipam/ipam.md) and also an explanation of [the basics of IP addressing](/site/concepts/ip-addresses.md) for further details.
 
 Instead of allowing Weave Net to allocate IP addresses automatically (using IPAM), there may be instances where you need to control a particular container or a cluster by setting an IP address for it.  
 
@@ -52,7 +52,7 @@ Individual IP addresses given to containers must, of course, be unique. If you p
 
 **See Also**
 
- * [Managing Services - Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md)
+ * [Managing Services - Exporting, Importing, Binding and Routing](/site/tasks/manage/service-management.md)
- * [Allocating IPs in a Specific Range](/site/using-weave/configuring-weave.md) 
+ * [Allocating IPs in a Specific Range](/site/tasks/ipam/configuring-weave.md) 
- * [Automatic IP Address Management](/site/ipam.md)   
+ * [Automatic IP Address Management](/site/tasks/ipam/ipam.md)   
 

site/tasks/ipam/stop-remove-peers-ipam.md

@@ -1,6 +1,6 @@
 ---
 title: Starting, Stopping and Removing Peers
-menu_order: 20
+menu_order: 40
 search_type: Documentation
 ---
 
@@ -24,7 +24,7 @@ later rejoin the Weave network, the same IP address may be allocated
 twice.
 
 Assume you had started the three peers in the
-[overview example](/site/ipam.md), and then host3
+[overview example](/site/tasks/ipam/ipam.md), and then host3
 caught fire, you can go to one of the other hosts and run:
 
     host1$ weave rmpeer host3
@@ -37,25 +37,25 @@ name. Alternatively, you can supply a peer name as shown in `weave status`.
 
 ### <a name="caution-rmpeer"></a>Caution###
 
-You cannot call `weave rmpeer` on more than one host. The address
+Do not invoke `weave rmpeer` for the same peer on more than one
-space, which was owned by the stale peer cannot be left dangling, and
+host.
-as a result it gets reassigned. In this instance, the address is
-reassigned to the peer on which `weave rmpeer` was run. Therefore, if
-you run `weave forget` and then `weave rmpeer` on more than one host
-at a time, it results in duplicate IPs on more than one host.
 
-Once the peers detect the inconsistency, they log the error and drop
+The removed peer's address range cannot be left dangling and is
+therefore reassigned to the peer on which `weave rmpeer` was
+run. Consequently, if you run `weave rmpeer` for the same peer on more
+than one host, the removed peer's address range will be owned by
+multiple peers.
+
+Once the peers detect this inconsistency, they log the error and drop
 the connection that supplied the inconsistent data. The rest of the
 peers will carry on with their view of the world, but the network will
-not function correctly.
+not function correctly. Depending on the timing of the `rmpeer` and
-
+the communication between peers, several peer cliques may form -
-Some peers may be able to communicate their claim to the others before
+groups of peers that are talking to each other, but repeatedly drop
-they run `rmpeer` (i.e. it's a race), so what you can expect is a few
+attempted connections with peers in other cliques.
-cliques of peers that are still talking to each other, but repeatedly
-dropping attempted connections with peers in other cliques.
 
 **See Also**
 
- * [Address Allocation with IP Address Management (IPAM)](/site/ipam.md)
+ * [Address Allocation with IP Address Management (IPAM)](/site/tasks/ipam/ipam.md)
- * [Automatic Allocation Across Multiple Subnets](/site/ipam/allocation-multi-ipam.md)
+ * [Automatic Allocation Across Multiple Subnets](/site/tasks/ipam/allocation-multi-ipam.md)
- * [Isolating Applications on a Weave Network](/site/using-weave/application-isolation.md)
+ * [Isolating Applications on a Weave Network](/site/tasks/manage/application-isolation.md)

site/tasks/ipam/troubleshooting-ipam.md

@@ -1,6 +1,6 @@
 ---
 title: Troubleshooting the IP Allocator
-menu_order: 30
+menu_order: 50
 search_type: Documentation
 ---
 
@@ -64,4 +64,4 @@ Columns are as follows:
   ipam` was run; whilst this could be a transient condition due to a
   partition, it may be because the peer has failed and needs to be
   removed administratively - see [Starting, Stopping and Removing
-  Peers](/site/ipam/stop-remove-peers-ipam.md) for more details.
+  Peers](/site/tasks/ipam/stop-remove-peers-ipam.md) for more details.

site/tasks/manage.md

@@ -0,0 +1,5 @@
+---
+title: Managing Containerized Applications
+menu_order: 10
+search_type: Documentation
+---

site/tasks/manage/application-isolation.md

@@ -1,6 +1,6 @@
 ---
 title: Isolating Applications on a Weave Network
-menu_order: 30
+menu_order: 5
 search_type: Documentation
 ---
 
@@ -14,7 +14,7 @@ techniques can still be used to deploy applications to a container network.
 To begin isolating an application (or parts of an application),  
 configure Weave Net's IP allocator to manage multiple subnets. 
 
-Using [the netcat example](/site/using-weave.md), configure multiple subsets:
+Using [the netcat example](/site/install/using-weave.md), configure multiple subsets:
 
     host1$ weave launch --ipalloc-range 10.2.0.0/16 --ipalloc-default-subnet 10.2.1.0/24
     host1$ eval $(weave env)
@@ -66,5 +66,5 @@ isolation between application containers, that feature needs to be disabled by [
 
 **See Also** 
 
- * [Automatic Allocation Across Multiple Subnets](/site/ipam/allocation-multi-ipam.md)
+ * [Automatic Allocation Across Multiple Subnets](/site/tasks/ipam/allocation-multi-ipam.md)
- * [Managing Services - Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md)
+ * [Managing Services - Exporting, Importing, Binding and Routing](/site/tasks/manage/service-management.md)

site/tasks/manage/awsvpc.md

@@ -1,6 +1,6 @@
 ---
-title: Using IP Routing on an Amazon Web Services Virtual Private Cloud
+title: Configuring IP Routing on an Amazon Web Services Virtual Private Cloud
-menu_order: 110
+menu_order: 80
 search_type: Documentation
 ---
 
@@ -75,7 +75,7 @@ your cluster.
   is all or nothing.  In this mode, all hosts in a cluster must be AWS
   instances. (We hope to ease this limitation in future.)
 - The `weave launch` command waits until the
-  [IP address manager](/site//operational-guide/concepts.md#ip-address-manager-ipam)
+  [IP address manager](/site/operational-guide/concepts.md#ip-address-manager-ipam)
   is ready, i.e. until after this peer has been able to make contact
   with other peers and confirm that it has joined the cluster the
   bridge.  Without AWS-VPC, `weave launch` returns without waiting.
@@ -101,5 +101,5 @@ In AWS-VPC mode you can run the following:
 
 **See Also**
 
- * [Using Weave Net](/site/using-weave.md)
+ * [Launching Weave Net](/site/install/using-weave.md)
 

site/tasks/manage/dynamically-attach-containers.md

@@ -1,6 +1,6 @@
 ---
 title: Dynamically Attaching and Detaching Applications
-menu_order: 40
+menu_order: 10
 search_type: Documentation
 ---
 
@@ -32,7 +32,7 @@ with the `--without-dns` argument).
     10.32.0.1
 
 If you would like `/etc/hosts` to contain the Weave Net address (the
-same way [the proxy does](/site/weave-docker-api/name-resolution-proxy.md)),
+same way [the proxy does](/site/tasks/weave-docker-api/name-resolution-proxy.md)),
 specify `--rewrite-hosts` when running `weave attach`:
 
     host1$ weave attach --rewrite-hosts c1
@@ -69,4 +69,4 @@ Finally, multiple addresses can be attached or detached using a single command:
 
 **See Also**
 
- * [Adding and Removing Hosts Dynamically](/site/using-weave/finding-adding-hosts-dynamically.md)
+ * [Adding and Removing Hosts Dynamically](/site/tasks/manage/finding-adding-hosts-dynamically.md)

site/tasks/manage/fastdp.md

@@ -1,6 +1,6 @@
 ---
 title: Using Fast Datapath
-menu_order: 96
+menu_order: 60
 search_type: Documentation
 ---
 
@@ -9,7 +9,7 @@ The most important thing to know about fast datapath is that you don't need to c
 
 When Weave Net cannot use the fast data path between two hosts, it falls back to a slower packet forwarding approach called `sleeve`. Selecting the fastest forwarding approach is automatic, and is determined on a connection-by-connection basis. For example, a Weave network spanning two data centers might use fast data path within the data centers, but not for the more constrained network link between them. 
 
-See [How Fastdp Works](/site/how-it-works/fastdp-how-it-works.md) for a more in-depth discussion of this feature. 
+See [How Fastdp Works](/site/concepts/fastdp-how-it-works.md) for a more in-depth discussion of this feature. 
 
 ### Disabling Fast Datapath
 
@@ -26,7 +26,7 @@ Each encrypted dataplane packet is encapsulated into [ESP](https://tools.ietf.or
 thus in some networks a firewall rule for allowing ESP traffic needs to be installed. E.g. Google
 Cloud Platform denies ESP packets by default.
 
-See [How Weave Implements Encryption](/site/how-it-works/encryption-implementation.md)
+See [How Weave Implements Encryption](/site/concepts/encryption-implementation.md)
 for more details for the fastdp encryption.
 
 ### Viewing Connection Mode Fastdp or Sleeve
@@ -71,6 +71,6 @@ frame" configuration:
 
 **See Also**
 
- * [Using Weave Net](/site/using-weave.md)
+ * [Launching Weave Net](/site/install/using-weave.md)
- * [How Fastdp Works](/site/how-it-works/fastdp-how-it-works.md)
+ * [How Fastdp Works](/site/concepts/fastdp-how-it-works.md)
  * [Performance measurements](/blog/weave-docker-networking-performance-fast-data-path/)

site/tasks/manage/finding-adding-hosts-dynamically.md

@@ -1,6 +1,6 @@
 ---
 title: Adding and Removing Hosts Dynamically
-menu_order: 90
+menu_order: 50
 search_type: Documentation
 ---
 
@@ -68,5 +68,5 @@ with `weave launch` and `weave connect` run:
 
 **See Also**
 
- * [Enabling Multi-Cloud, Multi-Hop Networking and Routing](/site/using-weave/multi-cloud-multi-hop.md)
+ * [Enabling Multi-Cloud, Multi-Hop Networking and Routing](/site/tasks/manage/multi-cloud-multi-hop.md)
- * [Stopping and Removing Peers](/site/ipam/stop-remove-peers-ipam.md)
+ * [Stopping and Removing Peers](/site/tasks/ipam/stop-remove-peers-ipam.md)

site/tasks/manage/host-network-integration.md

@@ -1,12 +1,12 @@
 ---
 title: Integrating with the Host Network
-menu_order: 60
+menu_order: 20
 search_type: Documentation
 ---
 
 Weave application networks can be integrated with an external host network, establishing connectivity between the host and with application containers running anywhere.
 
-For example, returning to the [netcat example](/site/using-weave.md), you’ve now decided that you need to have the application containers that are running on `$HOST2` accessible by other hosts and containers. 
+For example, returning to the [netcat example](/site/install/using-weave.md), you’ve now decided that you need to have the application containers that are running on `$HOST2` accessible by other hosts and containers. 
 
 On `$HOST2` run:
 
@@ -53,12 +53,12 @@ for example,  `10.2.0.0/16` or `10.32.0.0/12` and,
  * `<exposing-host>` is the address of the machine on which you ran `weave expose`.
 
 >**Note:** You must ensure that the [IP subnet used by Weave
-Net](/site/ipam.md#range) does not clash with anything on those other
+Net](/site/tasks/ipam/ipam.md#range) does not clash with anything on those other
 hosts.
 
 
 **See Also**
 
- * [Using Weave Net](/site/using-weave.md)
+ * [Launching Weave Net](/site/install/using-weave.md)
- * [General information on IP Addresses, Routes and Networks](/site/how-it-works/ip-addresses.md)
+ * [General information on IP Addresses, Routes and Networks](/site/concepts/ip-addresses.md)
- * [Managing Services - Exporting, Importing, Binding and Routing](/site/using-weave/service-management.md)
+ * [Managing Services - Exporting, Importing, Binding and Routing](/site/tasks/manage/service-management.md)

site/tasks/manage/metrics.md

@@ -1,12 +1,12 @@
 ---
 title: Monitoring with Prometheus
-menu_order: 105
+menu_order: 90
 search_type: Documentation
 ---
 
 Two endpoints are exposed: one for the Weave Net router, and, when deployed as
-a [Kubernetes Addon](/site/kube-addon.md), one for the [network policy
+a [Kubernetes Addon](/site/kubernetes/kube-addon.md), one for the [network policy
-controller](/site/kube-addon.md#npc).
+controller](/site/kubernetes/kube-addon.md#npc).
 
 ### Router Metrics
 

site/tasks/manage/multi-cloud-multi-hop.md

@@ -1,6 +1,6 @@
 ---
 title: Enabling Multi-Cloud, Multi-Hop Networking and Routing
-menu_order: 100
+menu_order: 70
 search_type: Documentation
 ---
 
@@ -39,6 +39,6 @@ traffic via the local data center.
 
 **See Also** 
 
- * [Finding and Adding Hosts Dynamically](/site/using-weave/finding-adding-hosts-dynamically.md)
+ * [Finding and Adding Hosts Dynamically](/site/tasks/manage/finding-adding-hosts-dynamically.md)
 
 

site/tasks/manage/security-untrusted-networks.md

@@ -1,6 +1,6 @@
 ---
 title: Securing Connections Across Untrusted Networks
-menu_order: 80
+menu_order: 40
 search_type: Documentation
 ---
 
@@ -53,5 +53,5 @@ Be aware that:
 
 **See Also**
 
- * [Weave Encryption](/site/how-it-works/encryption.md)
+ * [Weave Encryption](/site/concepts/encryption.md)
- * [Using Fast Datapath](/site/using-weave/fastdp.md)
+ * [Using Fast Datapath](/site/tasks/manage/fastdp.md)

site/tasks/manage/service-management.md

@@ -1,6 +1,6 @@
 ---
 title: Managing Services - Exporting, Importing, Binding and Routing
-menu_order: 70
+menu_order: 30
 search_type: Documentation
 ---
 
@@ -21,10 +21,10 @@ accessible to the outside world (and, more generally, to other networks)
 from any Weave Net host, irrespective of where the service containers are
 located.
 
-Returning to the [netcat example service](/site/using-weave.md), 
+Returning to the [netcat example service](/site/install/using-weave.md), 
 you can expose the netcat service running on `HOST1` and make it accessible to the outside world via `$HOST2`. 
 
-First, expose the application network to `$HOST2`, as explained in [Integrating with the Host Network](/site/using-weave/host-network-integration.md):
+First, expose the application network to `$HOST2`, as explained in [Integrating with the Host Network](/site/tasks/manage/host-network-integration.md):
 
     host2$ weave expose
     10.2.1.132
@@ -49,11 +49,11 @@ Similar NAT rules to the above can be used to expose services not just to the ou
 Applications running in containers on a Weave network can be given access to services, which are only reachable from certain 
 Weave hosts, regardless of where the actual application containers are located.
 
-Expanding on the [netcat service example](/site/using-weave.md), you now decide to add a third, non-containerized, netcat service. This additional netcat service runs on `$HOST3`, and listens on port 2211, but it is not on the Weave network. 
+Expanding on the [netcat service example](/site/install/using-weave.md), you now decide to add a third, non-containerized, netcat service. This additional netcat service runs on `$HOST3`, and listens on port 2211, but it is not on the Weave network. 
 
 An additional caveat is that `$HOST3` can only be reached from `$HOST1`, which is not accessible via `$HOST2`. Nonetheless, you still need to make the `$HOST3` service available to an application that is running in a container on `$HOST2`.
 
-To satisfy this scenario, first [expose the application network to the host](/site/using-weave/host-network-integration.md) by running the following on `$HOST1`: 
+To satisfy this scenario, first [expose the application network to the host](/site/tasks/manage/host-network-integration.md) by running the following on `$HOST1`: 
 
     host1$ weave expose -h host1.weave.local
     10.2.1.3
@@ -88,7 +88,7 @@ You can combine the service export and service import features to establish conn
 
 Each network imports its services into Weave Net, while at the same time, exports from Weave Net any services that are required by its applications. In this scenario, there are no application containers (although, there could be). Weave Net is acting as an address translation and routing facility, and uses the Weave container network as an intermediary.
 
-Expanding on the [netcat example](/site/using-weave.md), you can also import an additional netcat service running on `$HOST3` into Weave Net via `$HOST1`. 
+Expanding on the [netcat example](/site/install/using-weave.md), you can also import an additional netcat service running on `$HOST3` into Weave Net via `$HOST1`. 
 
 Begin importing the service onto `$HOST2` by first exposing the application network:
 
@@ -113,6 +113,6 @@ For example, you can move the netcat service to `$HOST4:2211`  and it will retai
 
 **See Also**
 
- * [Adding and Removing Hosts Dynamically](/site/using-weave/finding-adding-hosts-dynamically.md)
+ * [Adding and Removing Hosts Dynamically](/site/tasks/manage/finding-adding-hosts-dynamically.md)
- * [Enabling Multi-Cloud, Multi-Hop Networking and Routing](/site/using-weave/multi-cloud-multi-hop.md)
+ * [Enabling Multi-Cloud, Multi-Hop Networking and Routing](/site/tasks/manage/multi-cloud-multi-hop.md)
 

site/tasks/weave-docker-api.md

@@ -0,0 +1,6 @@
+---
+title: Attaching Docker Containers via the Weave API Proxy
+menu_order: 40
+search_type: Documentation
+---
+

site/tasks/weave-docker-api/automatic-discovery-proxy.md

@@ -1,12 +1,12 @@
 ---
 title: Using Automatic Discovery With the Weave Net Proxy
-menu_order: 30
+menu_order: 40
 search_type: Documentation
 ---
 
-Containers launched via the proxy use [weaveDNS](/site/weavedns.md)
+Containers launched via the proxy use [weaveDNS](/site/tasks/weavedns/weavedns.md)
 automatically if it is running when they are started -
-see the [weaveDNS usage](/site/weavedns.md#usage) section for an in depth
+see the [weaveDNS usage](/site/tasks/weavedns/weavedns.md#usage) section for an in depth
 explanation of the behaviour and how to control it.
 
 Typically, the proxy passes on container names as-is to weaveDNS
@@ -56,5 +56,5 @@ to the proxy, the specified label takes precedence over the container's name.
 
 **See Also**
 
- * [Name resolution via `/etc/hosts`](/site/weave-docker-api/name-resolution-proxy.md)
+ * [Name resolution via `/etc/hosts`](/site/tasks/weave-docker-api/name-resolution-proxy.md)
- * [How Weave Finds Containers](/site/weavedns/how-works-weavedns.md)
+ * [How Weave Finds Containers](/site/tasks/weavedns/how-works-weavedns.md)

site/tasks/weave-docker-api/ipam-proxy.md

@@ -1,11 +1,11 @@
 ---
 title: Automatic IP Allocation and the Weave Proxy
-menu_order: 25
+menu_order: 30
 search_type: Documentation
 ---
 
 
-If [automatic IP address allocation](/site/ipam.md) is enabled in Weave Net (by default IPAM is enabled),
+If [automatic IP address allocation](/site/tasks/ipam/ipam.md) is enabled in Weave Net (by default IPAM is enabled),
 then containers started via the proxy are automatically assigned an IP address, *without having to specify any
 special environment variables or any other options*.
 
@@ -38,5 +38,5 @@ container with a blank `WEAVE_CIDR`, for example:
 
 **See Also**
 
- * [Address Allocation with IP Address Management (IPAM)](/site/ipam.md)
+ * [Address Allocation with IP Address Management (IPAM)](/site/tasks/ipam/ipam.md)
- * [How to Manually Specify IP Addresses and Subnets](/site/using-weave/manual-ip-address.md)
+ * [How to Manually Specify IP Addresses and Subnets](/site/tasks/ipam/manual-ip-address.md)

site/tasks/weave-docker-api/launching-without-proxy.md

@@ -1,6 +1,6 @@
 ---
 title: Launching Containers With Weave Run (without the Proxy)
-menu_order: 50
+menu_order: 60
 search_type: Documentation
 ---
 
@@ -14,7 +14,7 @@ limitations, we have removed `weave run`.
 If you have scripts using `weave run`, you can achieve exactly the
 same effect by combining `docker run` and `weave attach`; see
 [Dynamically Attaching and Detaching
-Containers](/site/using-weave/dynamically-attach-containers.md) for
+Containers](/site/tasks/manage/dynamically-attach-containers.md) for
 details.
 
 The `weave start` and `weave restart` commands have also been removed,

site/tasks/weave-docker-api/name-resolution-proxy.md

@@ -1,6 +1,6 @@
 ---
 title: Name resolution via `/etc/hosts`
-menu_order: 40
+menu_order: 50
 search_type: Documentation
 ---
 
@@ -31,5 +31,5 @@ Docker-managed networks), the proxy must be launched using the
 
 **See Also**
 
- * [Using Automatic Discovery With the Weave Proxy](/site/weave-docker-api/automatic-discovery-proxy.md)
+ * [Using Automatic Discovery With the Weave Proxy](/site/tasks/weave-docker-api/automatic-discovery-proxy.md)
 

site/tasks/weave-docker-api/securing-proxy.md

@@ -56,4 +56,4 @@ proxy port.
 
 **See Also**
 
- * [Setting Up The Weave Docker API Proxy](/site/weave-docker-api.md)
+ * [Setting Up The Weave Docker API Proxy](/site/tasks/weave-docker-api/weave-docker-api.md)

site/tasks/weave-docker-api/using-proxy.md

@@ -10,7 +10,7 @@ modified to wait for the Weave network interface to become
 available.
 
 When they are started via the Weave Net proxy, containers are
-[automatically assigned IP addresses](/site/ipam.md) and connected to the
+[automatically assigned IP addresses](/site/tasks/ipam/ipam.md) and connected to the
 Weave network.
 
 ### Creating and Starting Containers with the Weave Net Proxy
@@ -55,7 +55,7 @@ route, add the `--no-multicast-route` flag to `weave launch`.
 
 ### Other Weave Proxy options
 
- * `--without-dns` -- stop telling containers to use [WeaveDNS](/site/weavedns.md)
+ * `--without-dns` -- stop telling containers to use [WeaveDNS](/site/tasks/weavedns/weavedns.md)
  * `--log-level=debug|info|warning|error` -- controls how much
    information to emit for debugging
  * `--no-restart` -- remove the default policy of `--restart=always`, if
@@ -70,5 +70,5 @@ If for some reason you need to disable the proxy, but still want to start other
 
 **See Also**
 
- * [Setting Up The Weave Docker API Proxy](/site/weave-docker-api.md)
+ * [Setting Up The Weave Docker API Proxy](/site/tasks/weave-docker-api/weave-docker-api.md)
- * [Securing Docker Communications With TLS](/site/weave-docker-api/securing-proxy.md)
+ * [Securing Docker Communications With TLS](/site/tasks/weave-docker-api/securing-proxy.md)

site/tasks/weave-docker-api/weave-docker-api.md

@@ -1,6 +1,6 @@
 ---
 title: Integrating Docker via the API Proxy
-menu_order: 50
+menu_order: 5
 search_type: Documentation
 ---
 
@@ -28,12 +28,12 @@ Docker containers are started with the --net flag, for example:
 
 Note that if a Docker container is started with the --net flag, then the Weave Docker API Proxy
 is automatically disabled and is not used to attach containers.
-See [Integrating Docker via the Network Plugin (Legacy)](/site/plugin.md) and
+See [Integrating Docker via the Network Plugin (Legacy)](/site/install/plugin/plugin.md) and
-[Integrating Docker via the Network Plugin (V2)](/site/plugin-v2.md).
+[Integrating Docker via the Network Plugin (V2)](/site/install/plugin/plugin-v2.md).
 
 **3.** Containers can also be attached to the Weave network with `weave attach` commands. This method also
 does not use the Weave Docker API Proxy.
-See [Dynamically Attaching and Detaching Containers](/site/using-weave/dynamically-attach-containers.md).
+See [Dynamically Attaching and Detaching Containers](/site/tasks/manage/dynamically-attach-containers.md).
 
 ### <a name="weave-api-proxy"></a>Setting Up The Weave Net Docker API Proxy
 
@@ -89,8 +89,8 @@ to the original settings prior to running `stop`.
 
 **See Also**
 
- * [Using The Weave Docker API Proxy](/site/weave-docker-api/using-proxy.md)
+ * [Using The Weave Docker API Proxy](/site/tasks/weave-docker-api/using-proxy.md)
- * [Securing Docker Communications With TLS](/site/weave-docker-api/securing-proxy.md)
+ * [Securing Docker Communications With TLS](/site/tasks/weave-docker-api/securing-proxy.md)
- * [Launching Containers With Weave Run (without the Proxy)](/site/weave-docker-api/launching-without-proxy.md)
+ * [Launching Containers With Weave Run (without the Proxy)](/site/tasks/weave-docker-api/launching-without-proxy.md)
 
 

site/tasks/weavedns.md

@@ -0,0 +1,5 @@
+---
+title: Managing WeaveDNS
+menu_order: 30
+search_type: Documentation
+---

site/tasks/weavedns/how-works-weavedns.md

@@ -43,6 +43,6 @@ $ sudo DOCKER_BRIDGE=someother weave attach ...
 
 **See Also**
 
- * [Using WeaveDNS](/site/weavedns.md)
+ * [Using WeaveDNS](/site/tasks/weavedns/weavedns.md)
- * [Load Balancing with weaveDNS](/site/weavedns/load-balance-fault-weavedns.md)
+ * [Load Balancing with weaveDNS](/site/tasks/weavedns/load-balance-fault-weavedns.md)
- * [Managing Domain Entries](/site/weavedns/managing-domains-weavedns.md)
+ * [Managing Domain Entries](/site/tasks/weavedns/managing-domains-weavedns.md)

site/tasks/weavedns/load-balance-fault-weavedns.md

@@ -10,7 +10,7 @@ It is permissible to register multiple containers with the same name:
 weaveDNS returns all addresses, in a random order, for each request.
 This provides a basic load balancing capability.
 
-Expanding the [overview example](/site/weavedns.md), let us start an additional `pingme` container on a second host, and then run
+Expanding the [overview example](/site/tasks/weavedns/weavedns.md), let us start an additional `pingme` container on a second host, and then run
 some ping tests.
 
 ```
@@ -49,11 +49,11 @@ WeaveDNS removes the addresses of any container that dies. This offers
 a simple way to implement redundancy. E.g. if in our example we stop
 one of the `pingme` containers and re-run the ping tests, eventually
 (within ~30s at most, since that is the weaveDNS
-[cache expiry time](/site/weavedns/managing-entries-weavedns.md#ttl)) we will only be hitting the address of the
+[cache expiry time](/site/tasks/weavedns/managing-entries-weavedns.md#ttl)) we will only be hitting the address of the
 container that is still alive.
 
 **See Also**
 
  * [How Weave Finds Containers](/site/how-works-weavedns.md)
- * [Managing Domains](/site/weavedns/managing-domains-weavedns.md)
+ * [Managing Domains](/site/tasks/weavedns/managing-domains-weavedns.md)
- * [Managing Domain Entries](/site/weavedns/managing-entries-weavedns.md)
+ * [Managing Domain Entries](/site/tasks/weavedns/managing-entries-weavedns.md)

site/tasks/weavedns/managing-domains-weavedns.md

@@ -12,7 +12,7 @@ The following topics are discussed:
 ## <a name="domain-search-path"></a>Configuring the domain search paths
 
 If you don't supply a domain search path (with `--dns-search=`), Weave
-Net (via the [proxy](/site/weave-docker-api.md) or via `weave attach`)
+Net (via the [proxy](/site/tasks/weave-docker-api/weave-docker-api.md) or via `weave attach`)
 tells a container to look for "bare" hostnames, like `pingme`, in its
 own domain (or in `weave.local` if it has no domain).
 
@@ -46,5 +46,5 @@ link-local as per [RFC6762](https://tools.ietf.org/html/rfc6762),
 
 
  * [How Weave Finds Containers](/site/how-works-weavedns.md)
- * [Load Balancing and Fault Resilience with WeaveDNS](/site/weavedns/load-balance-fault-weavedns.md)
+ * [Load Balancing and Fault Resilience with WeaveDNS](/site/tasks/weavedns/load-balance-fault-weavedns.md)
- * [Managing Domain Entries](/site/weavedns/managing-entries-weavedns.md)
+ * [Managing Domain Entries](/site/tasks/weavedns/managing-entries-weavedns.md)

site/tasks/weavedns/managing-entries-weavedns.md

@@ -78,6 +78,6 @@ weaveDNS instance will receive.
 
 **See Also**
 
- * [How Weave Finds Containers](/site/weavedns/how-works-weavedns.md)
+ * [How Weave Finds Containers](/site/tasks/weavedns/how-works-weavedns.md)
- * [Load Balancing and Fault Resilience with WeaveDNS](/site/weavedns/load-balance-fault-weavedns.md)
+ * [Load Balancing and Fault Resilience with WeaveDNS](/site/tasks/weavedns/load-balance-fault-weavedns.md)
- * [Managing Domains](/site/weavedns/managing-domains-weavedns.md)
+ * [Managing Domains](/site/tasks/weavedns/managing-domains-weavedns.md)

site/tasks/weavedns/weavedns.md

@@ -1,6 +1,6 @@
 ---
 title: Discovering Containers with WeaveDNS
-menu_order: 80
+menu_order: 5
 search_type: Documentation
 ---
 
@@ -45,5 +45,5 @@ disable weaveDNS itself, launch weave with the `--no-dns` option.
 
 **See Also**
 
- * [Integrating Docker via the API Proxy](/site/weave-docker-api.md)
+ * [Integrating Docker via the API Proxy](/site/tasks/weave-docker-api/weave-docker-api.md)
- * [Load Balancing and Fault Resilience with WeaveDNS](/site/weavedns/load-balance-fault-weavedns.md)
+ * [Load Balancing and Fault Resilience with WeaveDNS](/site/tasks/weavedns/load-balance-fault-weavedns.md)

site/troubleshooting.md

@@ -79,7 +79,7 @@ $ weave status
 ```
 
 The terms used here are explained further at
-[How Weave Net Works](/site/how-it-works.md).
+[How Weave Net Works](/site/concepts/how-it-works.md).
 
  * **Version** - shows the Weave Net version. If checkpoint is enabled (i.e.
 `CHECKPOINT_DISABLE` is not set), information about existence of a new version
@@ -95,11 +95,11 @@ can be overridden by using the `--nickname` argument at `weave
 launch`.
 
  * **Encryption** - indicates whether
-[encryption](/site/how-it-works/encryption.md) is in use for communication
+[encryption](/site/concepts/encryption.md) is in use for communication
 between peers.
 
  * **PeerDiscovery** - indicates whether
-[automatic peer discovery](/site/ipam/allocation-multi-ipam.md) is
+[automatic peer discovery](/site/tasks/ipam/allocation-multi-ipam.md) is
 enabled (which is the default).
 
  * **Targets** - are the number of hosts that the local Weave Router has been
@@ -286,7 +286,7 @@ on reboot. This can be disabled via:
 
 Note that the Weave Net router will create the `weave` network bridge
 if necessary when it restarts, and the [Weave Net Docker API
-Proxy](/site/weave-docker-api.md) will re-attach any application
+Proxy](/site/tasks/weave-docker-api/weave-docker-api.md) will re-attach any application
 containers that it originally attached to the Weave network when they
 restart.
 
@@ -307,5 +307,5 @@ and the container image versions as git hashes.
 
 **See Also**
 
- * [Troubleshooting IPAM](/site/ipam/troubleshooting-ipam.md)
+ * [Troubleshooting IPAM](/site/tasks/ipam/troubleshooting-ipam.md)
- * [Troubleshooting the Proxy](/site/weave-docker-api/using-proxy.md)
+ * [Troubleshooting the Proxy](/site/tasks/weave-docker-api/using-proxy.md)

site/weave-docker-api/troubleshooting-proxy.md

@@ -1,28 +0,0 @@
----
-title: Troubleshooting
-menu_order: 60
-search_type: Documentation
----
-
-The command
-
-    weave status
-
-reports on the current status of various Weave Net components, including
-the proxy, if it is running:
-
-```
-...
-        Service: proxy
-        Address: tcp://127.0.0.1:12375
-...
-```
-
-Information on the operation of the proxy can be obtained from the
-weaveproxy container logs using:
-
-    docker logs weaveproxy
-
-**See Also**
-
- * [Troubleshooting Weave](/site/troubleshooting.md)

test/090_docker_restart_policy_2_test.sh

@@ -12,7 +12,7 @@ assert_raises "check_restart $HOST1 weave"
 # in the old containers being removed and new ones created
 weave_on $HOST1 stop
 weave_on $HOST1 launch --no-restart
-assert "docker_on $HOST1 inspect -f '{{.HostConfig.RestartPolicy.Name}}' weave weaveproxy" "no"
+assert "docker_on $HOST1 inspect -f '{{.HostConfig.RestartPolicy.Name}}' weave" "no"
 assert_raises "! check_restart $HOST1 weave"
 
 # Relaunch to prevent the `weave stop` in `end_suite`

test/600_proxy_docker_py.sh

@@ -3,7 +3,7 @@
 
 . "$(dirname "$0")/config.sh"
 
-IMAGE="joffrey/docker-py:1.9.0-rc2"
+IMAGE="weaveworks/docker-py:1.9.0-prime"
 
 docker_py_test() {
     SHARD=$1

test/610_proxy_wait_for_weave_test.sh

@@ -46,6 +46,6 @@ assert "echo $((dirs_with_proxy-3))" $dirs_sans_proxy
 # Check errors are returned (when docker returns an error code)
 assert_raises "proxy docker_on $HOST1 run -e 'WEAVE_CIDR=10.2.1.3/24' $SMALL_IMAGE foo 2>&1 | grep 'exec: \"foo\": executable file not found in \$PATH'"
 # Check errors still happen when no command is specified
-assert_raises "proxy docker_on $HOST1 run -e 'WEAVE_CIDR=10.2.1.3/24' $SMALL_IMAGE 2>&1 | grep 'Error response from daemon: No command specified'"
+assert_raises "proxy docker_on $HOST1 run -e 'WEAVE_CIDR=10.2.1.3/24' weaveworks/no-cmd 2>&1 | grep 'Error response from daemon: No command specified'"
 
 end_suite

test/840_weave_kube_3_test.sh

@@ -94,6 +94,20 @@ spec:
       run: nettest
 EOF
 
+# Another policy, this time with no 'from' section, just to check that doesn't cause a crash
+run_on $HOST1 "$KUBECTL apply -f -" <<EOF
+apiVersion: extensions/v1beta1
+kind: NetworkPolicy
+metadata:
+  name: test840f
+spec:
+  ingress:
+  - {}
+  podSelector:
+    matchLabels:
+      run: norealpods
+EOF
+
 check_ready() {
     run_on $HOST1 "$KUBECTL get nodes | grep -c -w Ready | grep $NUM_HOSTS"
 }
@@ -135,6 +149,9 @@ assert_raises 'wait_for_x check_all_pods_communicate pods'
 # Check that a pod can contact the outside world
 assert_raises "$SSH $HOST1 $KUBECTL exec $podName -- $PING 8.8.8.8"
 
+# Check that our pods haven't crashed
+assert "$SSH $HOST1 $KUBECTL get pods -n kube-system -l name=weave-net | grep -c Running" 3
+
 tear_down_kubeadm
 
 # Destroy our test ipset, and implicitly check it is still there

test/850_plugin_v2_cross_hosts_2_test.sh

@@ -108,7 +108,7 @@ $SSH $HOST1<<EOF
     docker network create --driver="${PLUGIN_NAME}:latest" $NETWORK || true
     # Otherwise no containers will be scheduled on host2
     sleep 20
-    docker service create --name=$SERVICE --network=$NETWORK --replicas=2 nginx || true
+    docker service create --name=$SERVICE --network=$NETWORK --replicas=2 weaveworks/network-tester:latest || true
     journalctl -r -u docker.service -n30
 EOF