Add release v2.0.5

Remove explicit error check at end of functions to placate lint

CHANGELOG.md

@@ -1,3 +1,39 @@
+## Release 2.0.5
+
+Bug fixes
+
+* Fix /etc/hosts inside containers so the container's name resolves to
+  its Weave Net address #3136,#3138
+* New weave-kube config for Kubernetes 1.7 and 1.8 which resolves an
+  intermittent conflict with kube-proxy that could break Weave Net
+  until reboot #2998,#3134
+* Remove persistence file in `weave reset` when using Docker plugin V2 #3103,#3114
+
+Build and test
+
+* Some trivial changes to placate go-lint #3137
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/63?closed=1).
+
+
+## Release 2.0.4
+
+Bug fixes
+
+* weave-npc failed on Centos 7, due to older 'ipset' version in kernel #3099,#3100
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/62?closed=1).
+
+
+## Release 2.0.3
+
+Bug fixes
+
+* Weave-npc would crash on a policy with no 'from' part - regression introduced in 2.0.2 #3095,#3096,#3097
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/61?closed=1).
+
+
 ## Release 2.0.2
 
 Bug fixes and minor improvements

bin/release

@@ -91,6 +91,7 @@ build() {
     sed -i "/SCRIPT_VERSION=/ c\SCRIPT_VERSION=\"$VERSION\"" ./weave
     sed -i -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset.yaml
     sed -i -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.6.yaml
+    sed -i -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.7.yaml
     make SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER
 
     if make tests; then
@@ -173,6 +174,13 @@ draft() {
         --name "weave-daemonset-k8s-1.6.yaml" \
         --file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"
 
+    github-release upload \
+        --user $GITHUB_USER \
+        --repo weave \
+        --tag $LATEST_TAG \
+        --name "weave-daemonset-k8s-1.7.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml"
+
     echo "** Draft $TYPE $RELEASE_NAME $VERSION created at"
     echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
 }
@@ -274,6 +282,13 @@ publish() {
             --name "weave-daemonset-k8s-1.6.yaml" \
             --file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"
 
+        github-release upload \
+            --user $GITHUB_USER \
+            --repo weave \
+            --tag latest_release \
+            --name "weave-daemonset-k8s-1.7.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml"
+
         echo "** Release $RELEASE_NAME $VERSION published at"
         echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
         echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/latest_release"

net/arp.go

@@ -17,10 +17,7 @@ func ConfigureARPCache(procPath, name string) error {
 	if err := sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/delay_first_probe_time", name), "2"); err != nil {
 		return err
 	}
-	if err := sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/ucast_solicit", name), "1"); err != nil {
-		return err
-	}
-	return nil
+	return sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/ucast_solicit", name), "1")
 }
 
 func sysctl(procPath, variable, value string) error {

net/bridge.go

@@ -383,11 +383,7 @@ func (bf bridgedFastdpImpl) init(config *BridgeConfig) error {
 		return errors.Wrap(err, "creating bridged fastdp veth pair")
 	}
 
-	if err := linkSetUpByName(bf.datapathName); err != nil {
-		return err
-	}
-
-	return nil
+	return linkSetUpByName(bf.datapathName)
 }
 
 func (b bridgeImpl) attach(veth *netlink.Veth) error {
@@ -473,11 +469,7 @@ func configureIPTables(config *BridgeConfig) error {
 	if err = ipt.ClearChain("nat", "WEAVE"); err != nil {
 		return errors.Wrap(err, "clearing WEAVE chain")
 	}
-	if err = ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE"); err != nil {
-		return err
-	}
-
-	return nil
+	return ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE")
 }
 
 func linkSetUpByName(linkName string) error {

net/ipsec/ipsec.go

@@ -421,10 +421,7 @@ func (ipsec *IPSec) installDropNonEncrypted(srcIP, dstIP net.IP, udpPort int, in
 
 func (ipsec *IPSec) removeDropNonEncrypted(srcIP, dstIP net.IP, udpPort int, inSPI SPI) error {
 	rules := rulesDropNonEncrypted(srcIP, dstIP, udpPort, inSPI)
-	if err := ipsec.resetRules(rules, true); err != nil {
-		return err
-	}
-	return nil
+	return ipsec.resetRules(rules, true)
 }
 
 func (ipsec *IPSec) removeDropNonEncryptedInbound(srcIP, dstIP net.IP, inSPI SPI) error {

net/veth.go

@@ -218,11 +218,7 @@ func SetupIface(ifaceName, newIfName string) error {
 	if err := ConfigureARPCache("/proc", newIfName); err != nil {
 		return err
 	}
-	if err := ipt.Append("filter", "INPUT", "-i", newIfName, "-d", "224.0.0.0/4", "-j", "DROP"); err != nil {
-		return err
-	}
-
-	return nil
+	return ipt.Append("filter", "INPUT", "-i", newIfName, "-d", "224.0.0.0/4", "-j", "DROP")
 }
 
 // NB: This function can be used only by a process that terminates immediately
@@ -332,8 +328,5 @@ func ExposeNAT(ipnet net.IPNet) error {
 	if err := addNatRule(ipt, "-d", cidr, "!", "-s", cidr, "-j", "MASQUERADE"); err != nil {
 		return err
 	}
-	if err := addNatRule(ipt, "-s", cidr, "!", "-d", cidr, "-j", "MASQUERADE"); err != nil {
-		return err
-	}
-	return nil
+	return addNatRule(ipt, "-s", cidr, "!", "-d", cidr, "-j", "MASQUERADE")
 }

npc/ipset/ipset.go

@@ -33,14 +33,33 @@ type Interface interface {
 type ipset struct {
 	refCount
 	*log.Logger
+	enableComments bool
 }
 
 func New(logger *log.Logger) Interface {
-	return &ipset{refCount: newRefCount(), Logger: logger}
+	ips := &ipset{refCount: newRefCount(), Logger: logger, enableComments: true}
+
+	// Check for comment support
+	testIpsetName := Name("weave-test-comment")
+	// Clear it out if it already exists
+	_ = ips.Destroy(testIpsetName)
+	// Test for comment support
+	if err := ips.Create(testIpsetName, HashIP); err != nil {
+		ips.Logger.Printf("failed to create %s; disabling comment support", testIpsetName)
+		ips.enableComments = false
+	}
+	// If it was created, destroy it
+	_ = ips.Destroy(testIpsetName)
+
+	return ips
 }
 
 func (i *ipset) Create(ipsetName Name, ipsetType Type) error {
-	return doExec("create", string(ipsetName), string(ipsetType), "comment")
+	args := []string{"create", string(ipsetName), string(ipsetType)}
+	if i.enableComments {
+		args = append(args, "comment")
+	}
+	return doExec(args...)
 }
 
 func (i *ipset) AddEntry(ipsetName Name, entry string, comment string) error {
@@ -48,7 +67,11 @@ func (i *ipset) AddEntry(ipsetName Name, entry string, comment string) error {
 	if i.inc(ipsetName, entry) > 1 { // already in the set
 		return nil
 	}
-	return doExec("add", string(ipsetName), entry, "comment", comment)
+	args := []string{"add", string(ipsetName), entry}
+	if i.enableComments {
+		args = append(args, "comment", comment)
+	}
+	return doExec(args...)
 }
 
 func (i *ipset) DelEntry(ipsetName Name, entry string) error {

npc/namespace.go

@@ -65,10 +65,7 @@ func (ns *ns) empty() bool {
 }
 
 func (ns *ns) destroy() error {
-	if err := ns.podSelectors.deprovision(ns.uid, map[string]*selectorSpec{ns.allPods.key: ns.allPods}, nil); err != nil {
-		return err
-	}
-	return nil
+	return ns.podSelectors.deprovision(ns.uid, map[string]*selectorSpec{ns.allPods.key: ns.allPods}, nil)
 }
 
 func (ns *ns) onNewPodSelector(selector *selector) error {
@@ -180,11 +177,7 @@ func (ns *ns) addNetworkPolicy(obj *extnapi.NetworkPolicy) error {
 	if err := ns.podSelectors.provision(obj.ObjectMeta.UID, nil, podSelectors); err != nil {
 		return err
 	}
-	if err := ns.rules.provision(obj.ObjectMeta.UID, nil, rules); err != nil {
-		return err
-	}
-
-	return nil
+	return ns.rules.provision(obj.ObjectMeta.UID, nil, rules)
 }
 
 func (ns *ns) updateNetworkPolicy(oldObj, newObj *extnapi.NetworkPolicy) error {
@@ -217,11 +210,7 @@ func (ns *ns) updateNetworkPolicy(oldObj, newObj *extnapi.NetworkPolicy) error {
 	if err := ns.podSelectors.provision(oldObj.ObjectMeta.UID, oldPodSelectors, newPodSelectors); err != nil {
 		return err
 	}
-	if err := ns.rules.provision(oldObj.ObjectMeta.UID, oldRules, newRules); err != nil {
-		return err
-	}
-
-	return nil
+	return ns.rules.provision(oldObj.ObjectMeta.UID, oldRules, newRules)
 }
 
 func (ns *ns) deleteNetworkPolicy(obj *extnapi.NetworkPolicy) error {
@@ -240,11 +229,7 @@ func (ns *ns) deleteNetworkPolicy(obj *extnapi.NetworkPolicy) error {
 	if err := ns.nsSelectors.deprovision(obj.ObjectMeta.UID, nsSelectors, nil); err != nil {
 		return err
 	}
-	if err := ns.podSelectors.deprovision(obj.ObjectMeta.UID, podSelectors, nil); err != nil {
-		return err
-	}
-
-	return nil
+	return ns.podSelectors.deprovision(obj.ObjectMeta.UID, podSelectors, nil)
 }
 
 func bypassRule(nsIpsetName ipset.Name, namespace string) []string {

npc/rule.go

@@ -20,23 +20,25 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds
 	if proto != nil {
 		args = append(args, "-p", *proto)
 	}
+	srcComment := "anywhere"
 	if srcHost != nil {
 		args = append(args, "-m", "set", "--match-set", string(srcHost.ipsetName), "src")
+		if srcHost.nsName != "" {
+			srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key)
+		} else {
+			srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key)
+		}
 	}
+	dstComment := "anywhere"
 	if dstHost != nil {
 		args = append(args, "-m", "set", "--match-set", string(dstHost.ipsetName), "dst")
+		dstComment = fmt.Sprintf("pods: namespace: %s, selector: %s", dstHost.nsName, dstHost.key)
 	}
 	if dstPort != nil {
 		args = append(args, "--dport", *dstPort)
 	}
 	args = append(args, "-j", "ACCEPT")
-	srcComment := ""
-	if srcHost.nsName != "" {
-		srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key)
-	} else {
-		srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key)
-	}
-	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> namespace: %s, key: %s", srcComment, dstHost.nsName, dstHost.key))
+	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment))
 	key := strings.Join(args, " ")
 
 	return &ruleSpec{key, args}

npc/rule_test.go

@@ -0,0 +1,16 @@
+package npc
+
+import (
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestRegressionHandleNil3095(t *testing.T) {
+	// Test for handling nil values
+	// https://github.com/weaveworks/weave/issues/3095
+
+	rs := newRuleSpec(nil, nil, nil, nil)
+
+	require.NotEqual(t, rs.key, "")
+
+}

prog/weave-kube/weave-daemonset-k8s-1.7.yaml

@@ -0,0 +1,152 @@
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+      namespace: kube-system
+  - apiVersion: rbac.authorization.k8s.io/v1beta1
+    kind: ClusterRole
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+    rules:
+      - apiGroups:
+          - ''
+        resources:
+          - pods
+          - namespaces
+          - nodes
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+          - extensions
+        resources:
+          - networkpolicies
+        verbs:
+          - get
+          - list
+          - watch
+  - apiVersion: rbac.authorization.k8s.io/v1beta1
+    kind: ClusterRoleBinding
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+    roleRef:
+      kind: ClusterRole
+      name: weave-net
+      apiGroup: rbac.authorization.k8s.io
+    subjects:
+      - kind: ServiceAccount
+        name: weave-net
+        namespace: kube-system
+  - apiVersion: extensions/v1beta1
+    kind: DaemonSet
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+      namespace: kube-system
+    spec:
+      template:
+        metadata:
+          labels:
+            name: weave-net
+        spec:
+          containers:
+            - name: weave
+              command:
+                - /home/weave/launch.sh
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
+              image: 'weaveworks/weave-kube:latest'
+              imagePullPolicy: Always
+              livenessProbe:
+                httpGet:
+                  host: 127.0.0.1
+                  path: /status
+                  port: 6784
+                initialDelaySeconds: 30
+              resources:
+                requests:
+                  cpu: 10m
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: weavedb
+                  mountPath: /weavedb
+                - name: cni-bin
+                  mountPath: /host/opt
+                - name: cni-bin2
+                  mountPath: /host/home
+                - name: cni-conf
+                  mountPath: /host/etc
+                - name: dbus
+                  mountPath: /host/var/lib/dbus
+                - name: lib-modules
+                  mountPath: /lib/modules
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
+            - name: weave-npc
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
+              image: 'weaveworks/weave-npc:latest'
+              imagePullPolicy: Always
+              resources:
+                requests:
+                  cpu: 10m
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
+          hostNetwork: true
+          hostPID: true
+          restartPolicy: Always
+          securityContext:
+            seLinuxOptions: {}
+          serviceAccountName: weave-net
+          tolerations:
+            - effect: NoSchedule
+              operator: Exists
+          volumes:
+            - name: weavedb
+              hostPath:
+                path: /var/lib/weave
+            - name: cni-bin
+              hostPath:
+                path: /opt
+            - name: cni-bin2
+              hostPath:
+                path: /home
+            - name: cni-conf
+              hostPath:
+                path: /etc
+            - name: dbus
+              hostPath:
+                path: /var/lib/dbus
+            - name: lib-modules
+              hostPath:
+                path: /lib/modules
+            - name: xtables-lock
+              hostPath:
+                path: /run/xtables.lock
+      updateStrategy:
+        type: RollingUpdate

prog/weave-npc/main.go

@@ -50,11 +50,7 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}
 
-	if err := ipt.ClearChain(npc.TableFilter, npc.MainChain); err != nil {
-		return err
-	}
-
-	return nil
+	return ipt.ClearChain(npc.TableFilter, npc.MainChain)
 }
 
 func resetIPSets(ips ipset.Interface) error {
@@ -116,12 +112,8 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	if err := ips.Create(npc.LocalIpset, ipset.HashIP); err != nil {
 		return err
 	}
-	if err := ipt.Append(npc.TableFilter, npc.MainChain,
-		"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil {
-		return err
-	}
-
-	return nil
+	return ipt.Append(npc.TableFilter, npc.MainChain,
+		"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT")
 }
 
 func root(cmd *cobra.Command, args []string) {

proxy/hosts.go

@@ -20,8 +20,7 @@ func (proxy *Proxy) RewriteEtcHosts(hostsPath, fqdn string, ips []*net.IPNet, ex
 	contents := buf.String()
 	cmdLine := fmt.Sprintf("echo '%s' > %s && rm -f %s && echo '%s' > %s", contents, mntHosts, mntHosts, contents, mntHosts)
 	mounts := []string{hostsPathDir + ":" + mnt}
-	proxy.runTransientContainer([]string{"sh"}, []string{"-c", cmdLine}, mounts)
-	return nil
+	return proxy.runTransientContainer([]string{"sh"}, []string{"-c", cmdLine}, mounts)
 }
 
 // we assume (for compatibility with the weave script) that fqdn has a dot

proxy/proxy.go

@@ -330,11 +330,7 @@ func copyOwnerAndPermissions(from, to string) error {
 		return nil
 	}
 
-	if err = os.Chown(to, int(moreStat.Uid), int(moreStat.Gid)); err != nil {
-		return err
-	}
-
-	return nil
+	return os.Chown(to, int(moreStat.Uid), int(moreStat.Gid))
 }
 
 func (proxy *Proxy) listen(protoAndAddr string) (net.Listener, string, error) {
@@ -510,7 +506,10 @@ func (proxy *Proxy) attach(containerID string) error {
 		if container.HostConfig != nil {
 			extraHosts = container.HostConfig.ExtraHosts
 		}
-		proxy.RewriteEtcHosts(container.HostsPath, fqdn, ips, extraHosts)
+		if err := proxy.RewriteEtcHosts(container.HostsPath, fqdn, ips, extraHosts); err != nil {
+			Log.Errorf("Error from rewriting container's /etc/hosts: %s", err)
+			// carry on since the original /etc/hosts is good enough in most cases
+		}
 	}
 
 	pid := container.State.Pid
@@ -684,6 +683,7 @@ func (proxy *Proxy) runTransientContainer(entrypoint, cmd, binds []string) (err
 		env = append(env, fmt.Sprintf("%s=%s", "WEAVE_DEBUG", val))
 	}
 
+	Log.Debugf("Running image %q; entrypoint=%q; cmd=%q; binds=%q", proxy.Image, entrypoint, fmt.Sprintf("%.72s", cmd), binds)
 	var container *docker.Container
 	container, err = proxy.client.CreateContainer(docker.CreateContainerOptions{
 		Config: &docker.Config{

site/concepts/ip-addresses.md

@@ -32,7 +32,7 @@ You can of course also manually change the IP of any given container or subnet o
 ### IP Address Notation in Weave
 
 In the IP address `10.4.2.6/8`, the network prefix is the first 8 bits
-- `10`. Written out in full, that network is `10.0.0.0/8`.
+\- `10`. Written out in full, that network is `10.0.0.0/8`.
 
 The most common prefix lengths are 8, 16 and 24, but there is nothing
 stopping you using a /9 network or a /26. For example, `6.250.3.1/9` is on the

site/install/plugin/plugin-v2.md

@@ -78,3 +78,4 @@ Or to start a container:
 
  * [Integrating Docker via the Network Plugin (Legacy)](/site/install/plugin/plugin.md)
  * [How the Weave Network Plugins Work](/site/install/plugin/plugin-how-it-works.md)
+ * [Troubleshooting the V2 plugin](/site/troubleshooting.md#v2plugin)

site/kubernetes/kube-addon.md

@@ -12,8 +12,9 @@ The following topics are discussed:
  * [CPU and Memory Requirements](#resources)
  * [Pod Eviction](#eviction)
 * [Network Policy Controller](#npc)
+* [Troubleshooting](#troubleshooting)
  * [Troubleshooting Blocked Connections](#blocked-connections)
- * [Changing Configuration Options](#configuration-options)
+* [Changing Configuration Options](#configuration-options)
 
 
 ## <a name="install"></a> Installation
@@ -83,8 +84,8 @@ and so you will need to perform the procedure manually:
 * Apply the updated addon manifest `kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"`
 * Kill each Weave Net pod with `kubectl delete` and then wait for it to reboot before moving on to the next pod.
 
-**Note:** If you delete all Weave Net pods at the same time they will
-  lose track of IP address range ownership, possibly leading to
+**Note:** In versions prior to Weave Net 2.0, deleting all Weave Net pods at the same time
+  will result in them losing track of IP address range ownership, possibly leading to
   duplicate IP addresses if you then start a new copy of Weave Net.
 
 ## <a name="resources"></a>CPU and Memory Requirements
@@ -163,6 +164,80 @@ definition](http://kubernetes.io/docs/api-reference/extensions/v1beta1/definitio
   all multicast traffic) by adding `--allow-mcast=false` as an
   argument to `weave-npc` in the YAML configuration.
 
+## <a name="troubleshooting"></a> Troubleshooting
+
+The status of Weave Net can be checked by running its CLI commands. This can be done in various ways:
+
+1\. [Install the `weave` script](/site/installing-weave.md) and run:
+
+```
+$ weave status
+        Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29)
+
+        Service: router
+       Protocol: weave 1..2
+           Name: 42:8e:e8:c4:52:1b(host-0)
+     Encryption: disabled
+  PeerDiscovery: enabled
+        Targets: 3
+    Connections: 3 (2 established, 1 failed)
+          Peers: 3 (with 6 established connections)
+ TrustedSubnets: none
+
+        Service: ipam
+         Status: ready
+          Range: 10.32.0.0/12
+  DefaultSubnet: 10.32.0.0/12
+```
+
+2\. If you don't want to install additional software onto your hosts, run via `kubectl` commands, which produce the exact same outcome as the previous example:
+
+```
+### Identify the Weave Net pods:
+
+$ kubectl get pods -n kube-system -l name=weave-net -o wide
+NAME              READY  STATUS   RESTARTS  AGE  IP           NODE
+weave-net-1jkl6   2/2    Running  0         1d   10.128.0.4   host-0
+weave-net-bskbv   2/2    Running  0         1d   10.128.0.5   host-1
+weave-net-m4x1b   2/2    Running  0         1d   10.128.0.6   host-2
+```
+
+The above shows all Weave Net pods available in your cluster.
+You can see Kubernetes has deployed one Weave Net pod per host, in order to interconnect all hosts.
+
+You then need to:
+ - choose which pod you want to run your command from (in most cases it doesn't matter
+   which one you pick so just pick the first one, e.g. pod `weave-net-1jkl6` here)
+ - use `kubectl exec` to run the `weave status` command
+ - specify the absolute path `/home/weave/weave` and add `--local` because it's running inside a container
+
+```
+$ kubectl exec -n kube-system weave-net-1jkl6 -c weave -- /home/weave/weave --local status
+
+        Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29)
+
+        Service: router
+       Protocol: weave 1..2
+           Name: 42:8e:e8:c4:52:1b(host-0)
+     Encryption: disabled
+  PeerDiscovery: enabled
+        Targets: 3
+    Connections: 3 (2 established, 1 failed)
+          Peers: 3 (with 6 established connections)
+ TrustedSubnets: none
+
+        Service: ipam
+         Status: ready
+          Range: 10.32.0.0/12
+  DefaultSubnet: 10.32.0.0/12
+```
+
+3\. Finally you could also use [Weave Cloud](https://cloud.weave.works/) and monitor all your pods, including Weave Net's ones, from there.
+
+![Weave Net status screen in Weave Cloud](weave-cloud-net-status.png)
+
+For more information see [What is Weave Cloud?](https://www.weave.works/docs/cloud/latest/overview/)
+
 ### <a name="blocked-connections"></a> Troubleshooting Blocked Connections
 
 If you suspect that legitimate traffic is being blocked by the Weave Network Policy Controller, the first thing to do is check the `weave-npc` container's logs.
@@ -195,7 +270,7 @@ TCP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC.
 UDP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC.
 ```
 
-### <a name="configuration-options"></a> Changing Configuration Options
+## <a name="configuration-options"></a> Changing Configuration Options
 
 #### Using `cloud.weave.works`
 
@@ -277,72 +352,3 @@ For example,
             - name: IPALLOC_RANGE
               value: 10.0.0.0/16
 ```
-
-## <a name="operations"></a> Operations
-
-When using the Kubernetes addon, Weave Net's peers are managed via Kubernetes and very little effort should be required from your end to operate your network.
-
-However, should you need it, you can still run `weave` CLI commands to, for example, confirm Weave Net' status. This can be done in various ways:
-
-1. You could [install the `weave` script](/site/installing-weave.md) and run the same commands you would run without Kubernetes:
-
-```
-$ weave status
-        Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29)
-
-        Service: router
-       Protocol: weave 1..2
-           Name: 42:8e:e8:c4:52:1b(host-0)
-     Encryption: disabled
-  PeerDiscovery: enabled
-        Targets: 3
-    Connections: 3 (2 established, 1 failed)
-          Peers: 3 (with 6 established connections)
- TrustedSubnets: none
-
-        Service: ipam
-         Status: ready
-          Range: 10.32.0.0/12
-  DefaultSubnet: 10.32.0.0/12
-```
-
-2. If you do not want to install anything else on your hosts, you can use the following `kubectl` commands, which will produce the exact same outcome as the previous example:
-
-```
-### Identify the Weave Net pods:
-
-$ kubectl get pods --all-namespaces -o wide | grep weave
-kube-system  weave-net-1jkl6  2/2  Running  0  1d  10.128.0.4  host-0
-kube-system  weave-net-bskbv  2/2  Running  0  1d  10.128.0.5  host-1
-kube-system  weave-net-m4x1b  2/2  Running  0  1d  10.128.0.6  host-2
-
-### The above shows all Weave Net pods available in your cluster.
-### You can see Kubernetes has deployed one Weave Net pod per host, in order to interconnect all hosts.
-
-### You then need to:
-### - choose which pod you want to run your command from (e.g.: here, pod weave-net-1jkl6, running on host-0), and
-### - make sure you pass --local to weave, in addition to your command:
-
-$ kubectl exec -n kube-system weave-net-1jkl6 -- /home/weave/weave --local status
-Defaulting container name to weave.
-Use 'kubectl describe pod/weave-net-1jkl6' to see all of the containers in this pod.
-
-        Version: 2.0.1 (up to date; next check at 2017/07/10 13:49:29)
-
-        Service: router
-       Protocol: weave 1..2
-           Name: 42:8e:e8:c4:52:1b(host-0)
-     Encryption: disabled
-  PeerDiscovery: enabled
-        Targets: 3
-    Connections: 3 (2 established, 1 failed)
-          Peers: 3 (with 6 established connections)
- TrustedSubnets: none
-
-        Service: ipam
-         Status: ready
-          Range: 10.32.0.0/12
-  DefaultSubnet: 10.32.0.0/12
-```
-
-3. Finally you could also use [Weave Cloud](https://cloud.weave.works/) and monitor all your pods, including Weave Net's ones, from there.

site/troubleshooting.md

@@ -14,6 +14,7 @@ search_type: Documentation
    - [List attached containers](#list-attached-containers)
  * [Stopping Weave](#stop)
  * [Reboots](#reboots)
+ * [Troubleshooting the V2 plugin](#v2plugin)
  * [Snapshot Releases](#snapshots)
 
 ## <a name="diagnostics"></a>Basic Diagnostics
@@ -284,11 +285,32 @@ on reboot. This can be disabled via:
 
     weave launch --no-restart
 
-Note that the Weave Net router will create the `weave` network bridge
-if necessary when it restarts, and the [Weave Net Docker API
-Proxy](/site/tasks/weave-docker-api/weave-docker-api.md) will re-attach any application
-containers that it originally attached to the Weave network when they
-restart.
+Note that the Weave Net router creates the `weave` network bridge if
+necessary when it restarts. The [Weave Net Docker API
+Proxy](/site/tasks/weave-docker-api/weave-docker-api.md) then
+re-attaches any application containers that it originally attached to
+the Weave network when they restart.
+
+## <a name="v2plugin"></a>Troubleshooting the V2 plugin
+
+If Weave Net is installed via `docker plugin install`, download the
+`weave` script to run `weave status`, `weave ps` or `weave report` as
+above.  Install Weave Net by following the [install
+instructions](/site/install/installing-weave.md).
+
+Docker "v2" plugins do run as containers, but at a lower level within
+the Docker environment.  Because of this, you cannot view them with
+`docker ps`, `docker inspect`, etc.
+
+Do not run `weave launch`, `weave stop` or similar commands when using
+this plugin; use the `docker plugin` commands instead.  You can run
+`weave reset`, but only after disabling the plugin via `docker plugin disable`.
+
+Diagnostic logs from the plugin go to the same place as the Docker
+daemon, which will depend on your Linux install. For example, if it
+uses `systemd`, then do this to view the Docker and plugin logs:
+
+    sudo journalctl -u docker
 
 ## <a name="snapshots"></a>Snapshot Releases
 

test/840_weave_kube_3_test.sh

@@ -47,7 +47,7 @@ fi
 # Ensure Kubernetes uses locally built container images and inject code coverage environment variable (or do nothing depending on $COVERAGE):
 sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \
     -e "s%env:%$COVERAGE_ARGS%" \
-    "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.6.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -"
+    "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.7.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -"
 
 sleep 5
 
@@ -94,6 +94,20 @@ spec:
       run: nettest
 EOF
 
+# Another policy, this time with no 'from' section, just to check that doesn't cause a crash
+run_on $HOST1 "$KUBECTL apply -f -" <<EOF
+apiVersion: extensions/v1beta1
+kind: NetworkPolicy
+metadata:
+  name: test840f
+spec:
+  ingress:
+  - {}
+  podSelector:
+    matchLabels:
+      run: norealpods
+EOF
+
 check_ready() {
     run_on $HOST1 "$KUBECTL get nodes | grep -c -w Ready | grep $NUM_HOSTS"
 }
@@ -135,6 +149,9 @@ assert_raises 'wait_for_x check_all_pods_communicate pods'
 # Check that a pod can contact the outside world
 assert_raises "$SSH $HOST1 $KUBECTL exec $podName -- $PING 8.8.8.8"
 
+# Check that our pods haven't crashed
+assert "$SSH $HOST1 $KUBECTL get pods -n kube-system -l name=weave-net | grep -c Running" 3
+
 tear_down_kubeadm
 
 # Destroy our test ipset, and implicitly check it is still there

weave

@@ -1278,6 +1278,7 @@ launch() {
         -e WEAVE_DEBUG \
         -e WEAVE_HTTP_ADDR \
         -e WEAVE_PASSWORD \
+        -e EXEC_IMAGE=$EXEC_IMAGE \
         -e CHECKPOINT_DISABLE \
         $WEAVE_DOCKER_ARGS \
         $IMAGE \
@@ -1580,7 +1581,9 @@ case "$COMMAND" in
         protect_against_docker_hang
         VOLUME_CONTAINERS=$(docker ps -qa --filter label=weavevolumes)
         [ -n "$VOLUME_CONTAINERS" ] && docker rm -v $VOLUME_CONTAINERS  >/dev/null 2>&1 || true
+        # weave-kube and v2-plugin put this file in different places; remove either
         rm -f $HOST_ROOT/var/lib/weave/weave-netdata.db >/dev/null 2>&1 || true
+        rm -f $HOST_ROOT/var/lib/weave/weavedata.db     >/dev/null 2>&1 || true
         destroy_bridge
         for LOCAL_IFNAME in $(ip link show | grep v${CONTAINER_IFNAME}pl | cut -d ' ' -f 2 | tr -d ':') ; do
             ip link del ${LOCAL_IFNAME%@*} >/dev/null 2>&1 || true