Add release v2.3.0

Only expose metrics by default in weave-kube

CHANGELOG.md

@@ -1,3 +1,22 @@
+## Release 2.3.0
+
+### Security fixes
+
+* By default, do not expose Weave "/status" and "/report" to all (0.0.0.0) when
+  running on Kubernetes #3271
+
+### Other improvements
+
+* Increase the default connection limit for Weave peers (from 30 to 100) when
+running on Kubernetes, so that more peers could directly connect #3265
+
+## Build and test
+
+* Build Weave Net with Go 1.10.1 #3273
+* Run integration tests against Kubernetes 1.10.0 #3266
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/70?closed=1)
+
 ## Release 2.2.1
 
 ### Bug fixes

DEPENDENCIES

@@ -1,3 +1,3 @@
 DOCKER_VERSION=17.06
-KUBERNETES_VERSION=1.9.2
+KUBERNETES_VERSION=1.10.0
 KUBERNETES_CNI_VERSION=0.6.0

build/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.8.1
+FROM golang:1.10.1-stretch
 
 # Support Raspberry Pi 2 and newer
 ENV GOARM 7

docs/release-process.md

@@ -127,6 +127,28 @@ Finally, for **Mainline** releases only:
 
 * Images tagged `latest` are updated on DockerHub
 
+### Docker Store
+
+Weave Net is [available in Docker Store](https://store.docker.com/plugins/weave-net-plugin) and should also be released there.
+
+* Go to https://store.docker.com/ and log in.
+* Go to "[_Publish_](https://store.docker.com/publisher/center)".
+* Under "_My Products_", select "_owners (weaveworks)_". Weave Net should be listed among our products.
+* Click "_Actions_" > "_Edit Product_".
+* Go to "_Plans & Pricing_" > "_Free Tier_".
+* Under "_Source Repositories & Tags_", click on "_Add Source_", select "_net-plugin_" under "_Repository_" and the version to release under "_Tag_".
+* Under "_Resources_" > "_Installation Instructions_", update the lines containing `export NET_VERSION=<version>`.
+* Click "_Submit For Review_". You should see a message like: "_Your product has been submitted for approval. [...] We'll be in touch with next steps soon!_".
+* You should receive an email saying:
+
+> This email confirms that we received your submission on \<date\> of Weave Net to the Docker Store.
+>
+> We're reviewing your submission to ensure that it meets our [security guidelines](https://success.docker.com/Store#Security_and_Audit_Policies) and complies with our [best practices](https://success.docker.com/Store#Create_Great_Content). Don't worry! We'll let you know if there's anything you need to change before we publish your submission. You should hear back from us within the next 14 days.
+> 
+> Thanks for submitting your content to the Docker Store!
+
+* Hope Docker eventually performs the release or contacts us. If nothing happens within 14 days, contact their support team: publisher-support@docker.com.
+
 ### Finish up
 
 * If not on master, merge branch into master and push to GitHub.

ipam/testutils_test.go

@@ -117,7 +117,7 @@ func CheckAllExpectedMessagesSent(allocs ...*Allocator) {
 		m := alloc.gossip.(*mockGossipComms)
 		m.RLock()
 		if len(m.messages) > 0 {
-			require.FailNow(m, fmt.Sprintf("%s: Gossip message(s) not sent as expected: \n%x", m.name, m.messages))
+			require.FailNow(m, fmt.Sprintf("%s: Gossip message(s) not sent as expected: \n%v", m.name, m.messages))
 		}
 		m.RUnlock()
 	}

prog/weave-kube/launch.sh

@@ -27,9 +27,9 @@ xt_set_exists() {
 # Default if not supplied - same as weave net default
 IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12}
 HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784}
-STATUS_ADDR=${WEAVE_STATUS_ADDR:-0.0.0.0:6782}
+METRICS_ADDR=${WEAVE_METRICS_ADDR:-0.0.0.0:6782}
 HOST_ROOT=${HOST_ROOT:-/host}
-CONN_LIMIT=${CONN_LIMIT:-30}
+CONN_LIMIT=${CONN_LIMIT:-100}
 DB_PREFIX=${DB_PREFIX:-/weavedb/weave-net}
 
 # Check if the IP range overlaps anything existing on the host
@@ -54,6 +54,12 @@ else
     fi
 fi
 
+STATUS_OPTS="--metrics-addr=$METRICS_ADDR"
+# --status-addr exposes internal information, so only turn it on if asked to.
+if [ -n "${WEAVE_STATUS_ADDR}" ]; then
+    STATUS_OPTS="$STATUS_OPTS --status-addr=$WEAVE_STATUS_ADDR"
+fi
+
 # Default is that npc will be running; allow caller to override
 WEAVE_NPC_OPTS="--expect-npc"
 if [ "${EXPECT_NPC}" = "0" ]; then
@@ -144,7 +150,7 @@ post_start_actions &
 /home/weave/weaver $EXTRA_ARGS --port=6783 $(router_bridge_opts) \
      --name="$PEERNAME" \
      --host-root=$HOST_ROOT \
-     --http-addr=$HTTP_ADDR --status-addr=$STATUS_ADDR --docker-api='' --no-dns \
+     --http-addr=$HTTP_ADDR $STATUS_OPTS --docker-api='' --no-dns \
      --db-prefix="$DB_PREFIX" \
      --ipalloc-range=$IPALLOC_RANGE $NICKNAME_ARG \
      --ipalloc-init $IPALLOC_INIT \

prog/weaver/main.go

@@ -155,6 +155,7 @@ func main() {
 		noDiscovery        bool
 		httpAddr           string
 		statusAddr         string
+		metricsAddr        string
 		ipamConfig         ipamConfig
 		dockerAPI          string
 		peers              []string
@@ -192,6 +193,7 @@ func main() {
 	mflag.IntVar(&bridgeConfig.MTU, []string{"-mtu"}, 0, "MTU size")
 	mflag.StringVar(&httpAddr, []string{"-http-addr"}, "", "address to bind HTTP interface to (disabled if blank, absolute path indicates unix domain socket)")
 	mflag.StringVar(&statusAddr, []string{"-status-addr"}, "", "address to bind status+metrics interface to (disabled if blank, absolute path indicates unix domain socket)")
+	mflag.StringVar(&metricsAddr, []string{"-metrics-addr"}, "", "address to bind metrics interface to (disabled if blank, absolute path indicates unix domain socket)")
 	mflag.StringVar(&ipamConfig.Mode, []string{"-ipalloc-init"}, "", "allocator initialisation strategy (consensus, seed or observer)")
 	mflag.StringVar(&ipamConfig.IPRangeCIDR, []string{"-ipalloc-range"}, "", "IP address range reserved for automatic allocation, in CIDR notation")
 	mflag.StringVar(&ipamConfig.IPSubnetCIDR, []string{"-ipalloc-default-subnet"}, "", "subnet to allocate within by default, in CIDR notation")
@@ -474,10 +476,17 @@ func main() {
 		muxRouter.Methods("GET").Path("/metrics").Handler(metricsHandler(router, allocator, ns, dnsserver))
 		statusMux := http.NewServeMux()
 		statusMux.Handle("/", muxRouter)
-		Log.Println("Listening for metrics requests on", statusAddr)
+		Log.Println("Listening for status+metrics requests on", statusAddr)
 		go listenAndServeHTTP(statusAddr, statusMux)
 	}
 
+	if metricsAddr != "" {
+		metricsMux := http.NewServeMux()
+		metricsMux.Handle("/metrics", metricsHandler(router, allocator, ns, dnsserver))
+		Log.Println("Listening for metrics requests on", metricsAddr)
+		go listenAndServeHTTP(metricsAddr, metricsMux)
+	}
+
 	if plugin != nil {
 		go plugin.Start(httpAddr, dockerCli, waitReady.Add())
 	}

site/building.md

@@ -6,27 +6,28 @@ search_type: Documentation
 You only need to build Weave Net if you want to work on the Weave Net codebase
 (or you just enjoy building software).
 
-Apart from the `weave` shell script, weave is delivered as a set of
+Apart from the `weave` shell script, Weave Net is delivered as a set of
 container images.  There is no distribution-specific packaging, so in
 principle it shouldn't matter which Linux distribution you build
 under.  But naturally, Docker is a prerequisite (version 1.6.0 or
 later).
 
 The only way to build is by using the the build container; the
-Makefile is setup to make this transparent.  This method is
+`Makefile` is setup to make this transparent.  This method is
 documented below, and can be run directly on your machine or using
 a Vagrant VM.
 
 ## <a name="ubuntu"></a>Building directly on your machine
 
 The weave git repository should be cloned into
-`$GOPATH/src/github.com/weaveworks/weave`, in accordance with [the go
+`$GOPATH/src/github.com/weaveworks/weave`, in accordance with [the Go
 workspace conventions](https://golang.org/doc/code.html#Workspaces):
 
 ```
 $ WEAVE=github.com/weaveworks/weave
 $ git clone https://$WEAVE $GOPATH/src/$WEAVE
 $ cd $GOPATH/src/$WEAVE
+$ git submodule update --init
 ```
 
 Next install Docker if you haven't already, by following the instructions
@@ -44,7 +45,7 @@ On a fresh repository, the Makefile will do the following:
 - build the weave components in the build container
 - package them into two Docker images (`weaveworks/weave`,
 `weaveworks/weaveexec`)
-- Exported these images as `weave.tar.gz`
+- export these images as `weave.tar.gz`.
 
 The first two steps may take a while - don't worry, they are
 are cached and should not need to be redone very often.
@@ -63,18 +64,19 @@ First, check out the code:
 ```
 $ git clone https://github.com/weaveworks/weave
 $ cd weave
+$ git submodule update --init
 ```
 
-The `Vagrantfile` in the top directory constructs a VM that has
+The `Vagrantfile` in the top directory constructs a VM that has:
 
- * docker installed
- * go tools installed
- * weave dependencies installed
- * $GOPATH set to ~
+ * Docker installed
+ * Go tools installed
+ * Weave's dependencies installed
+ * `$GOPATH` set to `~`
  * the local working directory mapped as a synced folder into the
-   right place in $GOPATH
+   right place in `$GOPATH`.
 
-Once you are in the working directory you can issue
+Once you are in the working directory you can issue:
 
 ```
 $ vagrant up
@@ -86,7 +88,7 @@ installation is done just once). The working directory is sync'ed with
 use git and so on in the regular filesystem.
 
 To build and run the code, you need to use the VM. To log in and build
-the weave image, do
+the weave image, do:
 
 ```
 $ vagrant ssh
@@ -94,7 +96,7 @@ vm$ cd src/github.com/weaveworks/weave
 vm$ make
 ```
 
-The Docker daemon is also running in this VM, so you can then do
+The Docker daemon is also running in this VM, so you can then do:
 
 ```
 vm$ sudo ./weave launch
@@ -104,7 +106,7 @@ vm$ sudo docker ps
 and so on.
 
 If you are looking to just do a build and not run anything on this VM,
-you can do so with
+you can do so with:
 
 ```
 $ vagrant ssh -c 'make -C src/github.com/weaveworks/weave'
@@ -112,7 +114,7 @@ $ vagrant ssh -c 'make -C src/github.com/weaveworks/weave'
 
 you should then find a `weave.tar.gz` container snapshot tarball in the
 top-level directory. You can use that snapshot with `docker load`
-against a different host, e.g.
+against a different host, e.g.:
 
 ```
 $ export DOCKER_HOST=tcp://<HOST:PORT>

site/faq.md

@@ -40,6 +40,18 @@ A simple way to accomplish this would be to run Weave on the host and then run,
 Yet another option is to expose a port from the container on host B and then connect to it. You can read about exposing ports in [Exporting Services](/site/tasks/manage/service-management.md#exporting).
 
 
+<a name="duplicate-peer"></a>
+**Q: Why am I seeing "peer names collision" and failed connections?**
+
+This sometimes happens when machines are cloned; we require each
+machine in your cluster to have a unique identity.
+
+For more information see [Peer Names](/site/operational-guide/concepts.md#peer-name).
+
+Depending on your Linux distribution you may need to [set up
+machine-id](https://www.freedesktop.org/software/systemd/man/machine-id.html)
+or [generate a dbus id](https://dbus.freedesktop.org/doc/dbus-uuidgen.1.html).
+
 <a name="duplicate-ip"></a>
 **Q: Why am I seeing the same IP address assigned to two different containers on different hosts?**
 

site/kubernetes/kube-addon.md

@@ -346,6 +346,10 @@ The list of variables you can set is:
 * `WEAVE_EXPOSE_IP` - set the IP address used as a gateway from the
   Weave network to the host network - this is useful if you are
   configuring the addon as a static pod.
+* `WEAVE_METRICS_ADDR` - address and port that the Weave Net
+  daemon will serve Prometheus-style metrics on (defaults to 0.0.0.0:6782)
+* `WEAVE_STATUS_ADDR` - address and port that the Weave Net
+  daemon will serve status requests on (defaults to disabled)
 * `WEAVE_MTU` - Weave Net defaults to 1376 bytes, but you can set a
   smaller size if your underlying network has a tighter limit, or set
   a larger size for better performance if your network supports jumbo

site/tasks/manage/metrics.md

@@ -10,9 +10,6 @@ controller](/site/kubernetes/kube-addon.md#npc).
 
 ### Router Metrics
 
-The endpoint address is `localhost:6782`; the following metrics are
-exposed:
-
 * `weave_connections` - Number of peer-to-peer connections.
 * `weave_connection_terminations_total` - Number of peer-to-peer
   connections terminated.
@@ -25,27 +22,35 @@ exposed:
 * `weave_ipam_pending_allocates` - Number of pending allocates.
 * `weave_ipam_pending_claims` - Number of pending claims.
 
-#### Publish Router Metrics Endpoint
-
-By default, when started via `weave launch`, weave listens on its local
-interface to serve metrics. To publish your metrics throughout your cluster,
-e.g. if your prometheus server is installed on a different host machine,
-you need to set `WEAVE_STATUS_ADDR` to your corresponding IP and port.
-Default port is 6782.
-
-`WEAVE_STATUS_ADDR=X.X.X.X:PORT`
-
-You can set `WEAVE_STATUS_ADDR=0.0.0.0:6782` to listen on all interfaces,
-but be aware, this may expose your metrics to the public internet.
-
 ### Kubernetes Network Policy Controller Metrics
 
-The endpoint address is `localhost:6781`; the following metric is
+The following metric is
 exposed:
 
 * `weavenpc_blocked_connections_total` - Connection attempts blocked
   by policy controller.
 
+### Metrics Endpoint Addresses
+
+When installed as a Kubernetes Addon, the router listens for metrics
+requests on 0.0.0.0:6782 and the Network Policy Controller listens on
+0.0.0.0:6781. No other requests are served on these endpoints.
+
+>Note: If your Kubernetes hosts are exposed to the public internet
+then these metrics endpoints will also be exposed.
+
+When started via `weave launch`, by default weave listens on its local
+interface to serve metrics and other read-only status requests. To
+publish your metrics throughout your cluster, you can set
+`WEAVE_STATUS_ADDR`:
+
+`WEAVE_STATUS_ADDR=X.X.X.X:PORT`
+
+Set it to an empty string to disable.
+
+You can also pass the parameter `--metrics-addr=X.X.X.X:PORT` to
+`weave launch` to specify an address to listen for metrics only.
+
 # Static Configuration for Weave Net
 
 The following YAML fragment can be used in your Prometheus configuration to

test/840_weave_kube_3_test.sh

@@ -34,11 +34,10 @@ docker_on $HOST1 run --rm --privileged --net=host --entrypoint=/usr/sbin/ipset w
 
 # kubeadm init upgrades to latest Kubernetes version by default, therefore we try to lock the version using the below option:
 k8s_version="$(run_on $HOST1 "kubelet --version" | grep -oP "(?<=Kubernetes )v[\d\.\-beta]+")"
-k8s_version_option="$([[ "$k8s_version" > "v1.6" ]] && echo "kubernetes-version" || echo "use-kubernetes-version")"
 
 for host in $HOSTS; do
     if [ $host = $HOST1 ] ; then
-	run_on $host "sudo systemctl start kubelet && sudo kubeadm init --$k8s_version_option=$k8s_version --token=$TOKEN --pod-network-cidr=$WEAVE_NETWORK"
+	run_on $host "sudo systemctl start kubelet && sudo kubeadm init --kubernetes-version=$k8s_version --token=$TOKEN --pod-network-cidr=$WEAVE_NETWORK"
     else
 	run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN --discovery-token-unsafe-skip-ca-verification $HOST1IP:$KUBE_PORT"
     fi

test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh

@@ -38,11 +38,10 @@ function setup_kubernetes_cluster {
 
     # kubeadm init upgrades to latest Kubernetes version by default, therefore we try to lock the version using the below option:
     k8s_version="$(run_on $HOST1 "kubelet --version" | grep -oP "(?<=Kubernetes )v[\d\.\-beta]+")"
-    k8s_version_option="$([[ "$k8s_version" > "v1.6" ]] && echo "kubernetes-version" || echo "use-kubernetes-version")"
 
     for host in $HOSTS; do
         if [ $host = $HOST1 ] ; then
-        run_on $host "sudo systemctl start kubelet && sudo kubeadm init --$k8s_version_option=$k8s_version --token=$TOKEN"
+        run_on $host "sudo systemctl start kubelet && sudo kubeadm init --kubernetes-version=$k8s_version --token=$TOKEN"
         else
         run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN --discovery-token-unsafe-skip-ca-verification $HOST1IP:$KUBE_PORT"
         fi

vagrant-common.rb

@@ -16,7 +16,7 @@ def ansibleize(h)
 end
 
 def get_go_version_from_build_dockerfile()
-  go_regexp = /FROM golang:(\S*).*?/
+  go_regexp = /FROM golang:([\d\.]*).*?/
   dockerfile_path = File.expand_path(File.join(File.dirname(__FILE__), 'build', 'Dockerfile'))
   go_version = File.readlines(dockerfile_path).select { |line| line.match(go_regexp) }.first.match(go_regexp).captures.first
   if go_version.nil?