Add release v2.8.1

Merge pull request #3886 from avestuk/add-etc-machine-id-mount
Update daemonset manifest to mount /etc/machine-id
2021-01-25 10:55:30 +00:00 · 2021-01-22 14:21:16 +00:00 · 2021-01-22 12:50:08 +00:00 · 2021-01-21 18:00:26 +00:00 · 2021-01-19 17:22:47 +00:00 · 2021-01-18 14:51:21 +00:00
4026 changed files with 1102934 additions and 2756 deletions
@@ -0,0 +1,123 @@
+version: 2
+defaults: &defaults
+  docker:
+    - image: weaveworks/weavebuild:master-1dfe1f3b
+  working_directory: /go/src/github.com/weaveworks/weave
+
+jobs:
+  lint:
+    <<: *defaults
+    steps:
+      - checkout
+      - run: git submodule update --init
+      - run: make DEBUG=1 BUILD_IN_CONTAINER=false lint
+
+  unit-test:
+    <<: *defaults
+    parallelism: 2
+    steps:
+      - checkout
+      - run: COVERDIR=test/coverage make BUILD_IN_CONTAINER=false tests
+      - persist_to_workspace:
+          root: .
+          paths:
+          - test/coverage
+
+  build:
+    <<: *defaults
+    steps:
+      - checkout
+      - setup_remote_docker
+      - run: git submodule update --init
+      - run: make COVERAGE=true BUILD_IN_CONTAINER=false SUDO= exes all
+      - persist_to_workspace:
+          root: .
+          paths:
+          - weave.tar.gz
+          - tools/runner/runner
+          - test/tls/tls
+
+  smoke-tests:
+    machine:
+      image: circleci/classic:201709-01
+    working_directory: /home/circleci/src/github.com/weaveworks/weave
+    environment:
+      SRCDIR: /home/circleci/src/github.com/weaveworks/weave
+      CIRCLE_ARTIFACTS: /tmp/artifacts
+    parallelism: 2
+    steps:
+      - checkout
+      - run: mkdir $CIRCLE_ARTIFACTS
+      - run: git submodule update --init
+      - attach_workspace:
+          at: .
+      # kick off creation of test VMs
+      - run: bin/provision_test_vms.sh
+      # when VMs are ready, copy built software to them
+      - run: bin/circle-test-pre
+      - run:
+          command: bin/circle-test-smoke
+          no_output_timeout: 360s
+      # Destroy testing VMs:
+      - run:
+          command: bin/circle-destroy-vms
+          background: true
+      - persist_to_workspace:
+          root: .
+          paths:
+          - test/coverage
+      - store_artifacts:
+          path: /tmp/artifacts
+
+  gen-coverage:
+    <<: *defaults
+    environment:
+      CIRCLE_ARTIFACTS: /tmp/artifacts
+    steps:
+      - checkout
+      - run: mkdir $CIRCLE_ARTIFACTS
+      - attach_workspace:
+          at: .
+      - run: cd test; ./gen_coverage_reports.sh
+      - run: goveralls -repotoken $COVERALLS_REPO_TOKEN -coverprofile=test/profile.cov -service=circleci
+      - run: cp test/coverage.* $CIRCLE_ARTIFACTS
+      - store_artifacts:
+          path: /tmp/artifacts
+
+  deploy:
+    <<: *defaults
+    steps:
+      - checkout
+      - setup_remote_docker
+      # Register qemu hooks, rebuild without coverage and push to dockerhub
+      - deploy:
+          command: |
+            docker login -u $DOCKER_USER -p $DOCKER_PASS
+            docker run --rm --privileged multiarch/qemu-user-static:register --reset
+            wget https://github.com/estesp/manifest-tool/releases/download/v0.8.0/manifest-tool-linux-amd64
+            chmod +x manifest-tool-linux-amd64
+            make clean-bin
+            make publish MANIFEST_TOOL_CMD=./manifest-tool-linux-amd64 UPDATE_LATEST=latest-only SUDO= BUILD_IN_CONTAINER=false
+
+workflows:
+  version: 2
+  build_test:
+    jobs:
+      - lint
+      - unit-test
+      - build
+      - smoke-tests:
+          requires:
+            - lint
+            - unit-test
+            - build
+      - gen-coverage:
+          requires:
+            - unit-test
+            - smoke-tests
+      - deploy:
+          requires:
+            - smoke-tests
+          filters:
+            branches:
+              only: master
@@ -46,8 +46,8 @@ prog/weavewait/weavewait_noop
 prog/weavewait/weavewait_nomcast
 prog/weaveutil/weaveutil
 prog/*/Dockerfile.weaveworks
-prog/kube-peers/kube-peers
-prog/weave-kube/kube-peers
+prog/kube-utils/kube-utils
+prog/weave-kube/kube-utils
 prog/weave-npc/weave-npc
 prog/plugin/plugin
 testing/cover/cover
@@ -68,6 +68,7 @@ test/tls/tls
 test/tls/*.pem
 test/coverage
 test/coverage.*
+test/images/network-tester/webserver
 *qemu-*-static
 terraform.tfstate
 terraform.tfstate.backup
@@ -1,180 +1,3 @@
 [submodule "tools"]
 	path = tools
 	url = https://github.com/weaveworks/build-tools
-[submodule "vendor/github.com/vishvananda/netlink"]
-	path = vendor/github.com/vishvananda/netlink
-	url = https://github.com/vishvananda/netlink.git
-[submodule "vendor/github.com/gorilla/mux"]
-	path = vendor/github.com/gorilla/mux
-	url = https://github.com/gorilla/mux.git
-[submodule "vendor/github.com/gorilla/context"]
-	path = vendor/github.com/gorilla/context
-	url = https://github.com/gorilla/context.git
-[submodule "vendor/github.com/google/gopacket"]
-	path = vendor/github.com/google/gopacket
-	url = https://github.com/google/gopacket.git
-[submodule "vendor/github.com/weaveworks/go-odp"]
-	path = vendor/github.com/weaveworks/go-odp
-	url = https://github.com/weaveworks/go-odp.git
-[submodule "vendor/github.com/opencontainers/runc"]
-	path = vendor/github.com/opencontainers/runc
-	url = https://github.com/opencontainers/runc.git
-[submodule "vendor/github.com/fsouza/go-dockerclient"]
-	path = vendor/github.com/fsouza/go-dockerclient
-	url = https://github.com/fsouza/go-dockerclient.git
-[submodule "vendor/github.com/docker/libnetwork"]
-	path = vendor/github.com/docker/libnetwork
-	url = https://github.com/docker/libnetwork.git
-[submodule "vendor/github.com/docker/docker"]
-	path = vendor/github.com/docker/docker
-	url = https://github.com/docker/docker.git
-[submodule "vendor/github.com/Sirupsen/logrus"]
-	path = vendor/github.com/Sirupsen/logrus
-	url = https://github.com/Sirupsen/logrus.git
-[submodule "vendor/github.com/andybalholm/go-bit"]
-	path = vendor/github.com/andybalholm/go-bit
-	url = https://github.com/andybalholm/go-bit.git
-[submodule "vendor/github.com/miekg/dns"]
-	path = vendor/github.com/miekg/dns
-	url = https://github.com/miekg/dns.git
-[submodule "vendor/github.com/stretchr/testify"]
-	path = vendor/github.com/stretchr/testify
-	url = https://github.com/stretchr/testify.git
-[submodule "vendor/golang.org/x/crypto"]
-	path = vendor/golang.org/x/crypto
-	url = https://github.com/golang/crypto.git
-[submodule "vendor/github.com/docker/machine"]
-	path = vendor/github.com/docker/machine
-	url = https://github.com/docker/machine.git
-[submodule "vendor/github.com/weaveworks/mesh"]
-	path = vendor/github.com/weaveworks/mesh
-	url = https://github.com/weaveworks/mesh
-[submodule "vendor/github.com/vishvananda/netns"]
-	path = vendor/github.com/vishvananda/netns
-	url = https://github.com/vishvananda/netns.git
-[submodule "vendor/github.com/boltdb/bolt"]
-	path = vendor/github.com/boltdb/bolt
-	url = https://github.com/boltdb/bolt
-[submodule "vendor/github.com/weaveworks/go-checkpoint"]
-	path = vendor/github.com/weaveworks/go-checkpoint
-	url = https://github.com/weaveworks/go-checkpoint
-[submodule "vendor/github.com/hashicorp/go-cleanhttp"]
-	path = vendor/github.com/hashicorp/go-cleanhttp
-	url = http://github.com/hashicorp/go-cleanhttp
-[submodule "vendor/github.com/coreos/go-iptables"]
-	path = vendor/github.com/coreos/go-iptables
-	url = https://github.com/coreos/go-iptables
-[submodule "vendor/github.com/pkg/profile"]
-	path = vendor/github.com/pkg/profile
-	url = https://github.com/pkg/profile
-[submodule "vendor/github.com/j-keck/arping"]
-	path = vendor/github.com/j-keck/arping
-	url = https://github.com/j-keck/arping
-[submodule "vendor/github.com/aws/aws-sdk-go"]
-	path = vendor/github.com/aws/aws-sdk-go
-	url = https://github.com/aws/aws-sdk-go
-[submodule "vendor/golang.org/x/sys"]
-	path = vendor/golang.org/x/sys
-	url = https://go.googlesource.com/sys
-[submodule "vendor/github.com/beorn7/perks"]
-	path = vendor/github.com/beorn7/perks
-	url = https://github.com/beorn7/perks
-[submodule "vendor/github.com/prometheus/procfs"]
-	path = vendor/github.com/prometheus/procfs
-	url = https://github.com/prometheus/procfs
-[submodule "vendor/github.com/prometheus/client_golang"]
-	path = vendor/github.com/prometheus/client_golang
-	url = https://github.com/prometheus/client_golang
-[submodule "vendor/github.com/prometheus/client_model"]
-	path = vendor/github.com/prometheus/client_model
-	url = https://github.com/prometheus/client_model
-[submodule "vendor/github.com/prometheus/common"]
-	path = vendor/github.com/prometheus/common
-	url = https://github.com/prometheus/common
-[submodule "vendor/github.com/golang/protobuf"]
-	path = vendor/github.com/golang/protobuf
-	url = https://github.com/golang/protobuf
-[submodule "vendor/github.com/matttproud/golang_protobuf_extensions"]
-	path = vendor/github.com/matttproud/golang_protobuf_extensions
-	url = https://github.com/matttproud/golang_protobuf_extensions
-[submodule "vendor/k8s.io/client-go"]
-	path = vendor/k8s.io/client-go
-	url = https://github.com/kubernetes/client-go
-[submodule "vendor/github.com/pkg/errors"]
-	path = vendor/github.com/pkg/errors
-	url = https://github.com/pkg/errors
-[submodule "vendor/github.com/spf13/cobra"]
-	path = vendor/github.com/spf13/cobra
-	url = https://github.com/spf13/cobra
-[submodule "vendor/github.com/spf13/plag"]
-	path = vendor/github.com/spf13/plag
-	url = https://github.com/spf13/pflag
-[submodule "vendor/github.com/spf13/pflag"]
-	path = vendor/github.com/spf13/pflag
-	url = https://github.com/spf13/pflag
-[submodule "vendor/github.com/mgutz/ansi"]
-	path = vendor/github.com/mgutz/ansi
-	url = https://github.com/mgutz/ansi
-[submodule "vendor/github.com/estesp/manifest-tool"]
-	path = vendor/github.com/estesp/manifest-tool
-	url = https://github.com/estesp/manifest-tool
-[submodule "vendor/github.com/weaveworks/common"]
-	path = vendor/github.com/weaveworks/common
-	url = https://github.com/weaveworks/common
-[submodule "vendor/github.com/containernetworking/cni"]
-	path = vendor/github.com/containernetworking/cni
-	url = https://github.com/containernetworking/cni
-[submodule "vendor/google.golang.org/grpc"]
-	path = vendor/google.golang.org/grpc
-	url = https://github.com/grpc/grpc-go
-[submodule "vendor/github.com/docker/go-units"]
-	path = vendor/github.com/docker/go-units
-	url = https://github.com/docker/go-units
-[submodule "vendor/golang.org/x/net"]
-	path = vendor/golang.org/x/net
-	url = https://github.com/golang/net
-[submodule "vendor/k8s.io/api"]
-	path = vendor/k8s.io/api
-	url = https://github.com/kubernetes/api
-[submodule "vendor/k8s.io/apimachinery"]
-	path = vendor/k8s.io/apimachinery
-	url = https://github.com/kubernetes/apimachinery
-[submodule "vendor/github.com/PuerkitoBio/purell"]
-	path = vendor/github.com/PuerkitoBio/purell
-	url = https://github.com/PuerkitoBio/purell
-[submodule "vendor/github.com/PuerkitoBio/urlesc"]
-	path = vendor/github.com/PuerkitoBio/urlesc
-	url = https://github.com/PuerkitoBio/urlesc
-[submodule "vendor/github.com/emicklei/go-restful"]
-	path = vendor/github.com/emicklei/go-restful
-	url = https://github.com/emicklei/go-restful
-[submodule "vendor/github.com/go-openapi/jsonpointer"]
-	path = vendor/github.com/go-openapi/jsonpointer
-	url = https://github.com/go-openapi/jsonpointer
-[submodule "vendor/github.com/go-openapi/jsonreference"]
-	path = vendor/github.com/go-openapi/jsonreference
-	url = https://github.com/go-openapi/jsonreference
-[submodule "vendor/github.com/go-openapi/spec"]
-	path = vendor/github.com/go-openapi/spec
-	url = https://github.com/go-openapi/spec
-[submodule "vendor/github.com/go-openapi/swag"]
-	path = vendor/github.com/go-openapi/swag
-	url = https://github.com/go-openapi/swag
-[submodule "vendor/github.com/golang/glog"]
-	path = vendor/github.com/golang/glog
-	url = https://github.com/golang/glog
-[submodule "vendor/github.com/google/gofuzz"]
-	path = vendor/github.com/google/gofuzz
-	url = https://github.com/google/gofuzz
-[submodule "vendor/github.com/mailru/easyjson"]
-	path = vendor/github.com/mailru/easyjson
-	url = https://github.com/mailru/easyjson
-[submodule "vendor/k8s.io/kube-openapi"]
-	path = vendor/k8s.io/kube-openapi
-	url = https://github.com/kubernetes/kube-openapi
-[submodule "vendor/golang.org/x/text"]
-	path = vendor/golang.org/x/text
-	url = https://go.googlesource.com/text
-[submodule "vendor/gopkg.in/yaml.v2"]
-	path = vendor/gopkg.in/yaml.v2
-	url = https://gopkg.in/yaml.v2
@@ -4,7 +4,6 @@
 # avoid breaking the build on make lint:
 bin/circle-deploy-issues
 bin/circle-deploy-master
-bin/circle-teardown-pre
 bin/circle-test-teardown
 bin/circle-test-unit
 bin/install-wordepress
@@ -1 +1 @@
-2.3.0
+2.6.2
@@ -1,3 +1,322 @@
+## Release 2.8.1
+
+Fixes a problem introduced in 2.8.0 for machines whose ID is in /etc/machine-id #3886
+Many thanks to contributor @avestuk for this fix.
+
+Also move Kubernetes API calls out of Weave Net daemon #3885
+- this reduces the size of the 'weaver' binary and stops it crashing when run on 32-bit ARM.
+
+## Release 2.8.0
+
+This release makes some important changes to trim the "attack surface" of the
+Kubernetes install, and improves a couple of reported issues.
+
+* Workaround to fix ipset conflict with iptables #3851, #3882
+* Kubernetes: move kernel and CNI setup to init container #3880
+* For K8s, stop running in host PID namespace #3876
+* NetworkPolicy: avoid logging dropped packets that were not actually dropped #3852
+* Build with Go version 1.15.6 #3883
+
+Many thanks to contributors @drigz, @KevDBG and @NeonSludge.
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/87?closed=1)
+
+## Release 2.7.0
+
+This release improves resiliency in a number of areas,
+and extends the Prometheus metrics exported by Weave Net.
+
+Change in behaviour: on Kubernetes, the client source IP is preserved 
+when calling from a pod to a service.
+This feature, introduced in version 2.4.0 and previously turned on by 
+setting `NO_MASQ_LOCAL=1` is now on by default. #3389, #3756
+
+### Features
+
+* Reload router iptables rules if they get cleared, e.g. when firewalld restarts. #3802
+  (weave-npc rules are not reloaded)
+* Add new `type` and `encryption` labels to `weave_connections` metric #3788, #3789
+* Weave Net now exports Go metrics for heap size, garbage collection, etc. #3838
+* Register container name and its network aliases with weaveDNS #3084, #3090
+* Make DNS listen address configurable #1770, #3231
+
+### Bug fixes
+
+* weave-npc could crash if you deleted a Kubernetes Namespace containing pods #3833, #3836
+* Ensure that weave-npc exits and restarts if it crashes #3764, #3792, #3841
+* Avoid weave-kube failing on startup due to iptables lock #3828, #3835
+
+### Build and test
+
+* Reduce size of containers (weaveworks/weave goes from 99MB to 83MB) #3624, #3726
+* Weave Net is now built with Go 1.14.4, which should improve performance #3838
+* CI tests are now run against Docker 19.03.1, Kubernetes 1.14.0 #3687
+
+Many thanks to contributors @berlic, @gobomb, @hairyhenderson, @naemono, @nesc58
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/81?closed=1)
+
+
+## Release 2.6.5
+
+Fixes a bug that would leak memory every time a fast-datapath connection
+was stopped. #3808
+Also avoid a crash when the machine has ipv6 disabled. #3815
+
+
+## Release 2.6.4
+
+Improves the iptables rule added in 2.6.3 to block just the Weave Net
+control port and avoid blocking other uses of 127.0.0.1.	#3811
+
+
+## Release 2.6.3
+
+This release has a couple of security improvements, and some other fixes.
+
+* Block non-local traffic to the Weave control port	#3805
+* Tell Linux not to accept router advisory messages	#3801
+* Network Policy Controller: add a metric to show errors while operating	#3804
+* Network Policy Controller: don't treat named port as a fatal error	#3790
+
+## Release 2.6.2
+
+This release fixes a regression found in 2.6.1 release and removes a possible case
+of CPU spinning when pcap is used in sleeve mode
+
+### Bug fixes
+
+* Weave Net can not be used in fastdp mode and always falls back to sleeve mode #3781, #3783
+* Restrict timeout value passed to pcap library to a value less than 2^31 microseconds to
+  prevent CPU spinning #3782
+
+## Release 2.6.1
+
+This release fixes a bug discovered since the release of Weave Net 2.6.0 and
+an improvement to support iptables 1.8
+
+### Bug fixes
+
+* Weave Net on node restart unable to form connections to peers and connections get stuck in
+  pending state and stops responding to API endpoint #3762 #3763
+
+### Other improvements
+
+* Weave Net Kubernetes images by default uses iptables 1.8 with legacy (netfilter) backend with
+  option to choose netfilter as backend #3465, #3747
+
+
+## Release 2.6.0
+
+This release reduces CPU and memory usage in larger clusters, by
+sending notifications to a smaller set of peers and coalescing updates
+to reduce topology recalculation. #3715, #3732
+
+The default soft limit on connections has been raised from 100 to 200.
+
+### Bug fixes
+
+* Fix a race condition in Kubernetes addon when reclaiming IP
+  addresses after node deletion #3724, #3716
+* Buffer events so Docker won't drop them, and Weave Net can clean up
+  after dead containers #3432, #3705
+* Weave reconnect occasionally fails after network interface
+  disconnect #3666, #3669, #3676
+* Ingress NetworkPolicy would accepts all traffic when specifying both
+  IPBlock and port #3653, #3654
+
+### Kubernetes improvements
+
+* Support both podSelector and namespaceSelector in NetworkPolicy #3312, #3647
+* Only add default-drop egress rule if network policies are in use #3639
+* Manifests use 'apps/v1' rather than deprecated 'apps/v1beta1' #3660
+* Avoid Weave Net pods being evicted by setting priorityClassName: system-node-critical #3697
+* Manifests use recommended DNS policy ClusterFirstWithHostNet #3692
+* Weave Net now tolerates 'NoExecute' taint #3655
+* Allow extra arguments to NetworkPolicy controller to be set in an environment variable #3683
+* Stop reporting a failure to connect to self #3454, #3585
+* Minor reduction in log noise when reclaiming IPs #3710
+
+### Other improvements
+
+* Avoid isolating nodes which have restarted by automatically
+  repairing inconsistencies in IP allocation data #1962, #3637, #3708
+* Build Weave Net for the s390x architecture #3685
+* When a IP address is requested that may be in use, make several
+  attempts to claim it before returning an error #3725
+* Improve logging for IP allocation updates #3627, #3630
+* Improve 'expecting PMTU update' log message on initial connection #3603
+
+### Build and test
+
+* Shut down Kubernetes on node when testing node deletion #3716
+* Update the base 'Alpine' container image to version 3.8 #3701
+* Update Go to version 1.13.3 #3712
+* Update gopacket library #3590
+* Pin busybox version to 1.28 to avoid CI failure in Python test #3689
+* Remove obsolete weave-daemonset.yaml file #3674
+
+Thanks to contributors @christian-2, @hpdvanwyk, @guirish, @kitt1987,
+@mmerrill3, @Pensu, @scritchley, @sidharthsurana, @tanishq-dubey
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/78?closed=1)
+
+
+## Release 2.5.2
+
+This release fixes several bugs causing inconsistencies in IPAM and fixes a 
+panic in daemon that reclaims and forgets deleted nodes in Kubernetes clusters.
+
+### Bug fixes
+
+* leaking IP addresses in IPAM when weave-net hangs or restarting #3587, #3638
+* Panic in kube-utils after config map update error resulting in reclaim daemon
+  not performing weave forget on deleted node #3613, #3623
+* preventing inconsistent IPAM entries and resolving the conflict in case of
+  conflict during IPAM ring merge #3629, #3635, #3632, #3444
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/79?closed=1)
+
+
+## Release 2.5.1
+
+This release fixes bugs reported for 2.5 release and small improvements.
+
+### Bug fixes
+
+* prevent warnings in kernal logs due to use of physdev model for
+  non-bridged traffic #3449, #3453
+* Check and report the error occurred while getting the list of Kubernetes 
+  peers #3581, #3582
+
+### Other improvements
+
+* Update Ruby version to match Weaveworks website #3458
+* Fix the link to "Troubleshooting the Kubernetes Addon" section in the docs #3461
+* Document concept of connection limit in Weave #3395, #3413
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/77?closed=1)
+
+
+## Release 2.5.0
+
+This release adds support for Kubernetes `hostPort` mapping (#3016,#3356)
+and the `ipBlock` NetworkPolicy feature (#3168,#3367)
+
+### Bug fixes
+
+* Fix a crash at start-up on Docker for Mac #3405, #3408
+* Network policy: block ingress traffic when no namespaceSelector or
+  podSelector is specified #3347
+* Reclaim IP addresses which are locked by a non-existent peer #3386, #3416
+* Fix a crash when blank IP data was loaded #3067, #3415
+
+### Other improvements
+
+* If a connection is downgraded to the slower "sleeve" mode, Weave Net
+  will now periodically try to upgrade it to "fast datapath" again. #1737, #3385
+* Reclaim removed Kubernetes nodes' IP space when they are deleted,
+  rather than on next restart #3372, #3399
+* Replace Kubernetes livenessProbe with readinessProbe, so the pod is
+  not killed if it runs slowly #3471, #3421
+* In Kubernetes NetworkPolicy controller, remove the need to maintain
+  a set of local pod IP addresses #3344, #3423
+* Don't crash on Kubernetes named port in NetworkPolicy, just report as unsupported #3375
+* Ensure the `weave` network bridge is accessible on Linux kernels
+  older than 3.14 #3442, #3297, #3239
+* Better reporting in the logs if the `weave` network device is in the Down state #3133, #3381
+* Change log-level to debug of calls through the Docker proxy, to reduce noise #3439
+* Add `--without-masquerade` option to `weave expose`, so external
+  services can see the original container IP address #3388
+* Include Kubernetes cluster information in checkpoint call #3324,#3431
+* Bump go-odp dependency, so that `fastdp` works on the 4.19 kernel #3430
+
+### Build and Testing
+
+* CI builds on master branch now publish images for all platforms
+* Fix golint path and use https for download of libpcap #3435
+* Update Kubernetes client-go to v8.0.0, removing code licenced under LGPL3 #3358,#3366
+* Migrate CircleCI to V2, which is much faster #3255,#3270
+
+### External Contributors
+
+Thanks to the following contributors:
+
+* @Ashiroq
+* @leprechau
+* @lkpdn
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/74?closed=1)
+
+
+## Release 2.4.1
+
+This release fixes several bugs causing inconsistencies in IPAM for
+Kubernetes users whose clusters scale up and down over time.
+
+### Bug fixes
+
+* Nodes unable to connect after Kubernetes addon erroneously reclaimed
+  node without any IP addresses #3392, #3393
+* Kubernetes addon could have run out of free IP addresses after nodes
+  are deleted #3384, #3400
+* Kubernetes addon had reduced free IP addresses due to not reclaiming
+  IP addresses when node name is re-used #3397
+
+### Other improvements
+
+* Support `--label` in `WEAVE_DOCKER_ARGS` when starting Weave #3370,#3371
+* Add missing `--token` argument in help for `weave launch` #3226, #3379
+* Print defunct processes after smoke-tests #3362
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/75?closed=1)
+
+
+## Release 2.4.0
+
+This release introduces a support for Kubernetes Egress Network Policy (#2624, #3313)
+and adds a mechanism for preserving the client source IP address to enable
+`externalTrafficPolicy: Local` on Kubernetes (#2924, #3298).
+
+### Bug fixes
+
+* Increase the ipset list size which prevents weave-npc from crashing on older
+  kernels when more than eight Kubernetes Namespaces are used (#3289, #3305).
+* Avoid a possible livelock when reclaiming IP address space in weave-kube (#3317).
+* Ensure `xtables.lock` is mounted as a file so that kube-proxy can take the lock
+  if it has started after Weave Net (#3351, #3353).
+* Upgrade the CNI plugin symlinks only if the plugin has changed (#3337, #3345).
+
+### Other improvements
+
+* Manipulate the Kubernetes node status `NetworkUnavailable` so that Pods can be
+  scheduled on nodes when the GCE cloud provider is in use (#3249, #3307, #3332, #3334).
+* Refrain from creating a subprocess for configuring a network interface in
+  a container network namespace (#3291).
+* Protect against handling the CNI plugin request with the host namespace which
+  prevents Weave Net from misconfiguring the host network (#3206, #3346).
+* Weave Net can be run on minikube VM (#3124).
+* Add `org.opencontainers.image.*` labels to Dockerfiles to improve association
+  of the container images with git revisions (#3299).
+* Improve the error message when running `weave reset` on Kubernetes (#3319).
+
+### Build and Testing
+
+* Use `dep` instead of `git submodules` for managing external packages (#3268).
+* Fix usage of `manifest-tool` in Makefile (#3320).
+* Update Kubernetes to 1.11 for the integration tests (#3340).
+
+### External Contributors
+
+Thanks to the following contributors:
+
+* @kitt1987
+* @louismunro
+* @Nodraak
+* @stevenjohnstone
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/73?closed=1)
+
 ## Release 2.3.0

 ### Security fixes
@@ -24,6 +24,25 @@ taking the time to read this guide.
 * Keep pull requests small so core developers can review them quickly.
 * Keep each pull request focused on a specific topic.  If you have two things to change, create two pull requests. This helps reviewers to understand the meat of your contribution.

+## Managing Vendored Dependencies
+
+We copy all Go dependencies into the `vendor` subdirectory and use
+[`dep`](https://github.com/golang/dep) to manage them.
+
+If you add a dependency in the code, run `dep ensure` to include it in
+the config and vendor dir. Same if you remove a dependency from the code.
+
+To update a single dependency run `dep ensure -update github.com/foo/bar`
+
+To override `dep`'s choice of library version, you can add
+[rules](https://golang.github.io/dep/docs/daily-dep.html#rule-changes-in-gopkgtoml).
+Please add a comment saying why the override is necessary and when it can be
+removed.
+
+These operations result in staged but uncommitted changes to your
+branch; you will need to commit them as normal. Execute them in the
+root of your checkout.
+
 ## Workflow
 See [WorkingOnWeave](https://github.com/weaveworks/weave/wiki/WorkingOnWeave)

@@ -1,5 +0,0 @@
-This file lists all individuals having contributed content to the
-repository.
-
-Matthew Sackman <matthew@wellquite.org>
-Matthias Radestock <matthias.radestock@gmail.com>
@@ -0,0 +1,175 @@
+./test/assert.sh is a copy of
+
+	https://github.com/lehmannro/assert.sh/blob/master/assert.sh
+
+Since it was imported from its original source, it has only received
+cosmetic modifications. As it is licensed under the LGPL-3, here's the
+license text in its entirety:
+
+
+
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.
@@ -1,3 +1,3 @@
-DOCKER_VERSION=17.06
-KUBERNETES_VERSION=1.10.0
-KUBERNETES_CNI_VERSION=0.6.0
+DOCKER_VERSION=19.03.1
+KUBERNETES_VERSION=1.14.0
+KUBERNETES_CNI_VERSION=0.7.5
@@ -0,0 +1,34 @@
+# Pin to version before sctp was added, because latest libnetwork is
+# incompatible with latest sctp
+[[constraint]]
+  name = "github.com/docker/libnetwork"
+  revision = "119badbd"
+
+# Encourage dep not to use the docker-1.9 version
+[[constraint]]
+  name = "github.com/fsouza/go-dockerclient"
+  version = "1"
+
+# Use recent version: last tagged version is years old
+[[constraint]]
+  branch = "master"
+  name = "github.com/prometheus/client_golang"
+
+# For compatibility with fsouza/go-dockerclient
+[[constraint]]
+  branch = "master"
+  name = "github.com/docker/docker"
+
+# Most recent release tag is incompatible with docker/docker; see https://github.com/docker/distribution/issues/2503
+[[override]]
+  branch = "master"
+  name = "github.com/docker/distribution"
+
+# v8.0.0 removes juju/ratelimit licensed under LGPL3
+[[constraint]]
+  name = "k8s.io/client-go"
+  revision = "v8.0.0"
+
+[prune]
+  go-tests = true
+  unused-packages = true
@@ -17,15 +17,15 @@ QEMU_VERSION=v2.7.0

 # A list of all supported architectures here. Should be named as Go is naming platforms
 # All supported architectures must have an "ifeq" block below that customizes the parameters
-ALL_ARCHITECTURES=amd64 arm arm64 ppc64le
-ML_PLATFORMS=linux/amd64,linux/arm,linux/arm64,linux/ppc64le
+ALL_ARCHITECTURES=amd64 arm arm64 ppc64le s390x
+ML_PLATFORMS=linux/amd64,linux/arm,linux/arm64,linux/ppc64le,linux/s390x

 ifeq ($(ARCH),amd64)
 # The architecture to use when downloading the docker binary
 	WEAVEEXEC_DOCKER_ARCH?=x86_64

 # The name of the alpine baseimage to use as the base for weave images
-	ALPINE_BASEIMAGE?=alpine:3.6
+	ALPINE_BASEIMAGE?=alpine:3.10

 # The extension for the made images
 # Specifying none means for example weaveworks/weave:latest
@@ -42,7 +42,7 @@ ifeq ($(ARCH),arm)
 	WEAVEEXEC_DOCKER_ARCH?=armel

 # Using the (semi-)official alpine image
-	ALPINE_BASEIMAGE?=arm32v6/alpine:3.6
+	ALPINE_BASEIMAGE?=arm32v6/alpine:3.8

 # arm images have the -arm suffix, for instance weaveworks/weave-arm:latest
 	ARCH_EXT?=-arm
@@ -62,7 +62,7 @@ ifeq ($(ARCH),arm64)
 	WEAVEEXEC_DOCKER_ARCH?=armel

 # Using the (semi-)official alpine image
-	ALPINE_BASEIMAGE?=arm64v8/alpine:3.6
+	ALPINE_BASEIMAGE?=arm64v8/alpine:3.8

 # arm64 images have the -arm64 suffix, for instance weaveworks/weave-arm64:latest
 	ARCH_EXT?=-arm64
@@ -82,7 +82,7 @@ ifeq ($(ARCH),ppc64le)
 	WEAVEEXEC_DOCKER_ARCH?=ppc64le

 # Using the (semi-)official alpine image
-	ALPINE_BASEIMAGE?=ppc64le/alpine:3.6
+	ALPINE_BASEIMAGE?=ppc64le/alpine:3.8

 # ppc64le images have the -ppc64le suffix, for instance weaveworks/weave-ppc64le:latest
 	ARCH_EXT?=-ppc64le
@@ -97,10 +97,31 @@ ifeq ($(ARCH),ppc64le)
 # Tell the gcc linker to search for libpcap here
 	CGO_LDFLAGS="-L/usr/local/lib/$(CC)"
 endif
+ifeq ($(ARCH),s390x)
+# The architecture to use when downloading the docker binary
+	WEAVEEXEC_DOCKER_ARCH?=s390x
+
+# Using the (semi-)official alpine image
+	ALPINE_BASEIMAGE?=s390x/alpine:3.6
+
+# s390x images have the -s390x suffix, for instance weaveworks/weave-s390x:latest
+	ARCH_EXT?=-s390x
+
+# The name of the gcc binary
+	CC=s390x-linux-gnu-gcc
+
+# The architecture name to use when downloading a prebuilt QEMU binary
+	QEMUARCH=s390x
+
+# In the weaveworks/build image; libpcap libraries for s390x are placed here
+# Tell the gcc linker to search for libpcap here
+	CGO_LDFLAGS="-L/usr/local/lib/$(CC)"
+endif

 # The name of the user that this Makefile should produce image artifacts for. Can/should be overridden
 DOCKERHUB_USER?=weaveworks
 # The default version that's chosen when pushing the images. Can/should be overridden
+GIT_REVISION=$(shell git rev-parse HEAD)
 WEAVE_VERSION?=git-$(shell git rev-parse --short=12 HEAD)
 # Docker Store does not allow the "latest" tag.
 NET_PLUGIN_LATEST=latest_release
@@ -108,20 +129,20 @@ NET_PLUGIN_LATEST=latest_release
 # Paths to all relevant binaries that should be compiled
 WEAVER_EXE=prog/weaver/weaver
 SIGPROXY_EXE=prog/sigproxy/sigproxy
-KUBEPEERS_EXE=prog/kube-peers/kube-peers
+KUBEUTILS_EXE=prog/kube-utils/kube-utils
 WEAVENPC_EXE=prog/weave-npc/weave-npc
 WEAVEWAIT_EXE=prog/weavewait/weavewait
 WEAVEWAIT_NOOP_EXE=prog/weavewait/weavewait_noop
 WEAVEWAIT_NOMCAST_EXE=prog/weavewait/weavewait_nomcast
 WEAVEUTIL_EXE=prog/weaveutil/weaveutil
 RUNNER_EXE=tools/runner/runner
-MANIFEST_TOOL_DIR=vendor/github.com/estesp/manifest-tool
-MANIFEST_TOOL_EXE=$(MANIFEST_TOOL_DIR)/manifest-tool
+# Get this from https://github.com/estesp/manifest-tool/releases
+MANIFEST_TOOL_CMD=manifest-tool
 TEST_TLS_EXE=test/tls/tls
 NETWORKTESTER_EXE=test/images/network-tester/webserver

 # All binaries together in a list
-EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(KUBEPEERS_EXE) $(WEAVENPC_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(RUNNER_EXE) $(TEST_TLS_EXE) $(MANIFEST_TOOL_EXE) $(NETWORKTESTER_EXE)
+EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(KUBEUTILS_EXE) $(WEAVENPC_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(RUNNER_EXE) $(TEST_TLS_EXE) $(NETWORKTESTER_EXE)

 # These stamp files are used to mark the current state of the build; whether an image has been built or not
 BUILD_UPTODATE=.build.uptodate
@@ -155,18 +176,11 @@ PUSH_ML=push_ml_weave push_ml_weaveexec push_ml_weave-kube push_ml_weave-npc

 WEAVE_EXPORT=weave$(ARCH_EXT).tar.gz

-NETGO_CHECK=@strings $@ | grep cgo_stub\\\.go >/dev/null || { \
-	rm $@; \
-	echo "\nYour go standard library was built without the 'netgo' build tag."; \
-	echo "To fix that, run"; \
-	echo "    sudo go clean -i net"; \
-	echo "    sudo go install -tags netgo std"; \
-	false; \
-}
 # The flags we are passing to go build. -extldflags -static for making a static binary, 
-# -linkmode external for linking external C libraries into the binary, -X main.version for telling the
-# Go binary which version it is, -tags netgo for enforcing the native Go DNS resolver
-BUILD_FLAGS=-i -ldflags "-linkmode external -extldflags -static -X main.version=$(WEAVE_VERSION)" -tags netgo
+# -X main.version for telling the Go binary which version it is,
+# -s -w drop symbol tables used by debuggers (not Go's internal symbol info)
+# -tags "osusergo netgo" to use native Go UID and DNS implementations
+BUILD_FLAGS=-ldflags "-extldflags -static -X main.version=$(WEAVE_VERSION) -s -w" -tags "osusergo netgo"

 PACKAGE_BASE=$(shell go list -e ./)

@@ -179,11 +193,10 @@ $(WEAVER_EXE): api/*.go plugin/*.go plugin/*/*
 $(WEAVER_EXE):  proxy/*.go
 $(WEAVEUTIL_EXE): prog/weaveutil/*.go net/*.go plugin/net/*.go plugin/ipam/*.go db/*.go
 $(SIGPROXY_EXE): prog/sigproxy/*.go
-$(KUBEPEERS_EXE): prog/kube-peers/*.go
+$(KUBEUTILS_EXE): prog/kube-utils/*.go
 $(WEAVENPC_EXE): prog/weave-npc/*.go npc/*.go npc/*/*.go
 $(TEST_TLS_EXE): test/tls/*.go
 $(RUNNER_EXE): tools/runner/*.go
-$(MANIFEST_TOOL_EXE): $(MANIFEST_TOOL_DIR)/*.go
 $(WEAVEWAIT_NOOP_EXE): prog/weavewait/*.go
 $(WEAVEWAIT_EXE): prog/weavewait/*.go net/*.go
 $(WEAVEWAIT_NOMCAST_EXE): prog/weavewait/*.go net/*.go
@@ -196,13 +209,8 @@ ifeq ($(BUILD_IN_CONTAINER),true)
 # This make target compiles all binaries inside of the weaveworks/build container
 # It bind-mounts the source into the container and passes all important variables
 exes $(EXES) tests lint: $(BUILD_UPTODATE)
-	git submodule update --init
-# Containernetworking has another copy of vishvananda/netlink which leads to duplicate definitions
-	-@rm -r vendor/github.com/containernetworking/cni/vendor
-	@mkdir -p $(shell pwd)/.pkg
 	$(SUDO) docker run $(RM) $(RUN_FLAGS) \
 	    -v $(shell pwd):/go/src/github.com/weaveworks/weave \
-		-v $(shell pwd)/.pkg:/go/pkg \
 		-e GOARCH=$(ARCH) -e CGO_ENABLED=1 -e GOOS=linux -e CIRCLECI -e CIRCLE_BUILD_NUM -e CIRCLE_NODE_TOTAL -e CIRCLE_NODE_INDEX -e COVERDIR -e SLOW -e DEBUG \
 		$(BUILD_IMAGE) COVERAGE=$(COVERAGE) WEAVE_VERSION=$(WEAVE_VERSION) CC=$(CC) QEMUARCH=$(QEMUARCH) CGO_LDFLAGS=$(CGO_LDFLAGS) $@
 	touch $@
@@ -218,23 +226,19 @@ ifeq ($(COVERAGE),true)
 else
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
 endif
-	$(NETGO_CHECK)

-$(WEAVEUTIL_EXE) $(KUBEPEERS_EXE) $(WEAVENPC_EXE) $(NETWORKTESTER_EXE):
+$(WEAVEUTIL_EXE) $(KUBEUTILS_EXE) $(WEAVENPC_EXE) $(NETWORKTESTER_EXE):
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
-	$(NETGO_CHECK)

 $(WEAVEWAIT_EXE):
-	go build $(BUILD_FLAGS) -tags "netgo iface mcast" -o $@ ./$(@D)
-	$(NETGO_CHECK)
+	go build $(BUILD_FLAGS) -tags "osusergo netgo iface mcast" -o $@ ./$(@D)

 $(WEAVEWAIT_NOMCAST_EXE):
-	go build $(BUILD_FLAGS) -tags "netgo iface" -o $@ ./$(@D)
-	$(NETGO_CHECK)
+	go build $(BUILD_FLAGS) -tags "osusergo netgo iface" -o $@ ./$(@D)

 # These programs need a separate rule as they fail the netgo check in
 # the main build stanza due to not importing net package
-$(SIGPROXY_EXE) $(TEST_TLS_EXE) $(WEAVEWAIT_NOOP_EXE) $(RUNNER_EXE) $(MANIFEST_TOOL_EXE):
+$(SIGPROXY_EXE) $(TEST_TLS_EXE) $(WEAVEWAIT_NOOP_EXE) $(RUNNER_EXE):
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)

 tests:
@@ -247,8 +251,9 @@ endif

 # This rule makes sure the build image is up-to-date.
 # It also makes sure the multiarch hooks are reqistered in the kernel so the QEMU emulation works
-$(BUILD_UPTODATE): build/*
+$(BUILD_UPTODATE): build/* tools/.git
 	$(SUDO) docker build -t $(BUILD_IMAGE) build/
+	$(SUDO) docker tag $(BUILD_IMAGE) $(BUILD_IMAGE):$(shell tools/image-tag)
 	$(SUDO) docker run --rm --privileged multiarch/qemu-user-static:register --reset
 	touch $@

@@ -274,7 +279,7 @@ endif
 $(WEAVER_UPTODATE): prog/weaver/Dockerfile.$(DOCKERHUB_USER) $(WEAVER_EXE) weave $(WEAVEUTIL_EXE)
 	cp $(WEAVEUTIL_EXE) prog/weaver/weaveutil
 	cp weave prog/weaver/weave
-	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -f prog/weaver/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVER_IMAGE) prog/weaver
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build --build-arg=revision=$(GIT_REVISION) -f prog/weaver/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVER_IMAGE) prog/weaver
 	touch $@

 $(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) prog/weaveexec/symlink $(SIGPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVER_UPTODATE)
@@ -282,7 +287,7 @@ $(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) prog/weaveexe
 	cp $(WEAVEWAIT_EXE) prog/weaveexec/weavewait
 	cp $(WEAVEWAIT_NOOP_EXE) prog/weaveexec/weavewait_noop
 	cp $(WEAVEWAIT_NOMCAST_EXE) prog/weaveexec/weavewait_nomcast
-	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -f prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVEEXEC_IMAGE) prog/weaveexec
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build --build-arg=revision=$(GIT_REVISION) -f prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVEEXEC_IMAGE) prog/weaveexec
 	touch $@

 # Builds Docker plugin.
@@ -302,17 +307,17 @@ $(PLUGIN_UPTODATE): prog/net-plugin/launch.sh prog/net-plugin/config.json $(WEAV
 	$(SUDO) docker plugin create $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST) prog/net-plugin
 	touch $@

-$(WEAVEKUBE_UPTODATE): prog/weave-kube/Dockerfile.$(DOCKERHUB_USER) prog/weave-kube/launch.sh $(KUBEPEERS_EXE) $(WEAVER_UPTODATE)
-	cp $(KUBEPEERS_EXE) prog/weave-kube/
-	$(SUDO) docker build -f prog/weave-kube/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVEKUBE_IMAGE) prog/weave-kube
+$(WEAVEKUBE_UPTODATE): prog/weave-kube/Dockerfile.$(DOCKERHUB_USER) prog/weave-kube/launch.sh $(KUBEUTILS_EXE) $(WEAVER_UPTODATE)
+	cp $(KUBEUTILS_EXE) prog/weave-kube/
+	$(SUDO) docker build --build-arg=revision=$(GIT_REVISION) -f prog/weave-kube/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVEKUBE_IMAGE) prog/weave-kube
 	touch $@

 $(WEAVENPC_UPTODATE): prog/weave-npc/Dockerfile.$(DOCKERHUB_USER) $(WEAVENPC_EXE) prog/weave-npc/ulogd.conf
-	$(SUDO) docker build -f prog/weave-npc/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVENPC_IMAGE) prog/weave-npc
+	$(SUDO) docker build --build-arg=revision=$(GIT_REVISION) -f prog/weave-npc/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVENPC_IMAGE) prog/weave-npc
 	touch $@

 $(WEAVEDB_UPTODATE): prog/weavedb/Dockerfile
-	$(SUDO) docker build -t $(WEAVEDB_IMAGE) prog/weavedb
+	$(SUDO) docker build --build-arg=revision=$(GIT_REVISION) -t $(WEAVEDB_IMAGE) prog/weavedb
 	touch $@

 $(NETWORKTESTER_UPTODATE): test/images/network-tester/Dockerfile $(NETWORKTESTER_EXE)
@@ -322,7 +327,7 @@ $(NETWORKTESTER_UPTODATE): test/images/network-tester/Dockerfile $(NETWORKTESTER
 $(WEAVE_EXPORT): $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE)
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker save $(addsuffix :latest,$(IMAGES)) | gzip > $@

-tools/.git $(MANIFEST_TOOL_DIR)/.git:
+tools/.git:
 	git submodule update --init

 # CODE FOR PUBLISHING THE IMAGES
@@ -378,13 +383,13 @@ endif

 # This target pushes a manifest list; it takes one parameter, the image name.
 # The variable UPDATE_LATEST controls whether it updates the versioned tag and/or the latest tag
-$(PUSH_ML): push_ml_%: $(MANIFEST_TOOL_EXE)
+$(PUSH_ML): push_ml_%:
 ifneq ($(UPDATE_LATEST),latest-only)
-	$(MANIFEST_TOOL_EXE) push from-args --platforms $(ML_PLATFORMS) --template $(DOCKERHUB_USER)/$*-ARCH:$(WEAVE_VERSION) --target $(DOCKERHUB_USER)/$*:$(WEAVE_VERSION)
+	$(MANIFEST_TOOL_CMD) push from-args --platforms $(ML_PLATFORMS) --template $(DOCKERHUB_USER)/$*-ARCH:$(WEAVE_VERSION) --target $(DOCKERHUB_USER)/$*:$(WEAVE_VERSION)
 endif
 ifneq ($(UPDATE_LATEST),false)
 # Push the manifest list to :latest as well
-	$(MANIFEST_TOOL_EXE) push from-args --platforms $(ML_PLATFORMS) --template $(DOCKERHUB_USER)/$*-ARCH:latest --target $(DOCKERHUB_USER)/$*:latest
+	$(MANIFEST_TOOL_CMD) push from-args --platforms $(ML_PLATFORMS) --template $(DOCKERHUB_USER)/$*-ARCH:latest --target $(DOCKERHUB_USER)/$*:latest
 endif

 clean-work-dir:
@@ -394,15 +399,14 @@ clean-bin:
 	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(IMAGES)
 	find prog -type f -name "Dockerfile.*" -not -name "Dockerfile.template" -print | xargs rm -f
 	find prog -type f -name "*qemu-*" -print | xargs rm -f
-	rm -rf $(EXES) $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE) weave*.tar.gz .pkg
+	go clean ./...
+	rm -rf $(EXES) $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE) weave*.tar.gz .cache

 clean: clean-bin clean-work-dir
 	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(BUILD_IMAGE)
-	rm -rf test/tls/*.pem test/coverage.* test/coverage $(BUILD_UPTODATE) $(MANIFEST_TOOL_EXE)
+	rm -rf test/tls/*.pem test/coverage.* test/coverage $(BUILD_UPTODATE)

 build:
-	$(SUDO) go clean -i net
-	$(SUDO) go install -tags netgo std
 	$(MAKE)

 run-smoketests: all testrunner
@@ -7,12 +7,11 @@

 # About Weaveworks

-[Weaveworks](https://www.weave.works) is the company that delivers the most productive way for developers to connect, observe and control
-Docker containers.
+[Weaveworks](https://www.weave.works) is the company that delivers the most productive way for developers to connect, observe and control Docker containers.

-This repository contains [Weave Net](https://www.weave.works/products/weave-net/), the first product developed by Weaveworks, and with over 8 million downloads to date, enables you to get started with Docker clusters and portable apps in a fraction of the time compared with other solutions.
+This repository contains [Weave Net](https://www.weave.works/products/weave-net/), the first product developed by Weaveworks, with over 8 million downloads to date. Weave Net enables you to get started with Docker clusters and portable apps in a fraction of the time required by other solutions.

-## Weave Cloud: 
+## Weave Cloud:

 [Weave Cloud](https://www.weave.works/product/cloud/) is software-as-a-service that simplifies deployment, monitoring and management for containers and microservices. It extends and complements popular orchestrators, and enables developers and DevOps to realize faster deployments, insightful monitoring, visualization and networking.

@@ -29,11 +28,10 @@ Services provided by application containers on the Weave network can be exposed
 If you have any questions about, feedback for or a problem with Weave Net:

 - Read [the Weave Net docs](https://www.weave.works/docs/net/latest/overview).
- Invite yourself to the <a href="https://weaveworks.github.io/community-slack/" target="_blank"> #weave-community </a> slack channel.
- Ask a question on the <a href="https://weave-community.slack.com/messages/general/"> #weave-community</a> slack channel.
+- Invite yourself to the <a href="https://slack.weave.works/" target="_blank">Weave Users Slack</a>.
+  - The channel for contributors and developers of Weave Net is [#net-dev](https://weave-community.slack.com/messages/net-dev/).
 - Join the <a href="https://www.meetup.com/pro/Weave/"> Weave User Group </a> and get invited to online talks, hands-on training and meetups in your area.
- Send an email to <a href="mailto:weave-users@weave.works">weave-users@weave.works</a>
- <a href="https://github.com/weaveworks/weave/issues/new">File an issue.</a>
+- [File an issue](https://github.com/weaveworks/weave/issues/new).

 Your feedback is always welcome!

@@ -0,0 +1,14 @@
+# Security Policy
+
+At Weaveworks we take security very seriously, and value our close relationship with members of the security community.
+
+## Supported Versions
+
+As an Open Source project, only the latest code has all fixes and security patches.
+If you require a higher level of commitment, please [contact Weaveworks](https://www.weave.works/contact/) to discuss.
+
+## Reporting a Vulnerability
+
+To submit a security bug report please e-mail us at security@weave.works.
+
+We also operate a Bug Bounty programme; see https://www.weave.works/bug-bounty/
@@ -0,0 +1,17 @@
+# Use of vendored code in Weave Net
+
+Weave Net is licensed under the [Apache 2.0 license](LICENSE).
+
+Some vendored code is under different licenses though, all of them ship the
+entire license text they are under.
+
+- https://github.com/weaveworks/go-checkpoint
+  can be found in the ./vendor/ directory, is under MPL-2.0.
+
+- Pulled in by dependencies are  
+  https://github.com/hashicorp/golang-lru (MPL-2.0)  
+  https://github.com/hashicorp/go-cleanhttp (MPL-2.0)  
+  https://github.com/opencontainers/go-digest (docs are under CC by-sa 4.0)
+
+[One file used in tests](COPYING.LGPL-3) is under LGPL-3, that's why we ship
+the license text in this repository.
@@ -3,6 +3,7 @@ package api
 import (
 	"fmt"
 	"net"
+	"net/url"
 )

 // Expose calls the router to assign the given IP addr to the weave bridge.
@@ -10,3 +11,9 @@ func (client *Client) Expose(ipAddr *net.IPNet) error {
 	_, err := client.httpVerb("POST", fmt.Sprintf("/expose/%s", ipAddr), nil)
 	return err
 }
+
+// ReplacePeers replace the current set of peers
+func (client *Client) ReplacePeers(peers []string) error {
+	_, err := client.httpVerb("POST", "/connect", url.Values{"replace": {"true"}, "peer": peers})
+	return err
+}
@@ -1,17 +0,0 @@
-#!/bin/bash
-
-set -e
-
-source "$STATE"
-
-if [ -n "$TEST_AND_PUBLISH" ]; then
-    cd "$SRCDIR"
-    git submodule update --init
-    cd "$SRCDIR/build"
-    ../tools/rebuild-image weaveworks/weavebuild . Dockerfile build.sh
-    touch "$SRCDIR/.build.uptodate"
-    sudo chown -R ubuntu /usr/local/go
-    cd "$SRCDIR"
-    make testrunner
-    make COVERAGE=true RM= exes all
-fi
@@ -1,36 +0,0 @@
-#!/bin/bash
-
-set -e
-
-echo "TEST_AND_PUBLISH=1" >"$STATE"
-
-# Avoid doing a full build if we can.  Note if the PR doesn't exist
-# when the build is kicked off, we can't run this check so we do a
-# full build.  Subsequent pushes to the same branch will have the desired behaviour
-if [ -n "$CI_PULL_REQUEST" -a "$CI_PULL_REQUEST" = "$CI_PULL_REQUESTS" ]; then
-    if PR=$(echo "$CI_PULL_REQUEST" | grep -oP '(?<=^https://github.com/weaveworks/weave/pull/)[0-9]+$'); then
-        echo "GH_PR=$PR" >>"$STATE"
-        if FILES=$(curl -s "https://api.github.com/repos/weaveworks/weave/pulls/$PR/files" | jq -r '.[]|.filename'); then
-            echo "PR touches [$FILES]"
-            if ! echo "$FILES" | grep -v ^site/; then
-                echo "PR contains site changes only - skipping tests"
-                echo "TEST_AND_PUBLISH=" >>"$STATE"
-            else
-                echo "PR contains non-site changes - running tests"
-            fi
-        else
-            echo "Unable to get files for PR $PR" >&2
-        fi
-    else
-        echo "Unable to extract PR number from $CI_PULL_REQUEST" >&2
-    fi
-fi
-
-source "$STATE"
-
-mkdir -p "$(dirname "$SRCDIR")" && cp -r "$(pwd)/" "$SRCDIR"
-
-if [ -n "$TEST_AND_PUBLISH" ]; then
-    cd "$SRCDIR"
-    git submodule update --init
-fi
@@ -2,12 +2,7 @@

 set -e

-source "$STATE"
-
-if [ -n "$TEST_AND_PUBLISH" ] ; then
-    docker login -e $DOCKER_EMAIL -u $DOCKER_USER -p $DOCKER_PASS
-    cd $SRCDIR
-    make clean-bin
-    # CircleCI doesn't let us install the qemu module to do ARM docker builds
-    make publish ALL_ARCHITECTURES=amd64 UPDATE_LATEST=latest-only
-fi
+docker login -u $DOCKER_USER -p $DOCKER_PASS
+make clean-bin
+# CircleCI doesn't let us install the qemu module to do ARM docker builds
+make publish ALL_ARCHITECTURES=amd64 UPDATE_LATEST=latest-only SUDO= BUILD_IN_CONTAINER=false
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -e
+
+source "$SRCDIR/bin/circle-env"
+cd "$SRCDIR/test"
+./run-integration-tests.sh destroy
@@ -0,0 +1,11 @@
+# Set environment variables here because CircleCI can't expand $FOO in 'env' section
+
+export PATH="$PATH:$HOME/.local/bin:/opt/google-cloud-sdk/bin"
+export CLOUDSDK_CORE_DISABLE_PROMPTS=1
+# Base name of VMs for integration tests:
+export NAME=test-$CIRCLE_BUILD_NUM-$CIRCLE_NODE_INDEX
+export TEST_VMS_PROV_AND_CONF_LOCK_FILE=$CIRCLE_ARTIFACTS/test_vms_provisioned_and_configured.txt
+export TEST_VMS_READY_LOCK_FILE=$CIRCLE_ARTIFACTS/test_vms_ready.txt
+# Google Cloud Platorm images for integration tests:
+export USE_IMAGE=1
+export DISK_NAME_PREFIX=test-$CIRCLE_BUILD_NUM-0
@@ -1,13 +0,0 @@
-#!/bin/bash
-
-set -e
-
-source "$STATE"
-
-if [ -n "$TEST_AND_PUBLISH" ] ; then
-    if [ "$CIRCLE_NODE_INDEX" = "0" ] ; then
-        go get github.com/mattn/goveralls
-        goveralls -repotoken $COVERALLS_REPO_TOKEN -coverprofile=$SRCDIR/test/profile.cov -service=circleci
-        cd $SRCDIR/test; cp coverage.* $CIRCLE_ARTIFACTS
-    fi
-fi
@@ -9,22 +9,21 @@ function signal_failure() {
 }
 trap signal_failure ERR

-source "$STATE"
 source "$(dirname "$0")/wait_for.sh"

-if [ -n "$TEST_AND_PUBLISH" ]; then
-    [ -n "$SECRET_KEY" ] || {
-        echo "Cannot run smoke tests: no secret key"
-        exit 1
-    }
+[ -n "$SECRET_KEY" ] || {
+    echo "Cannot run smoke tests: no secret key"
+    exit 1
+}

-    # Provisioning from image typically take 90 seconds, 
-    # but if we are creating a GCP image, it can take more than 10 minutes:
-    wait_for 900 "$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+source "$SRCDIR/bin/circle-env"

-    # Upload built binaries to testing VMs:
-    cd "$SRCDIR/test" # Ensures we generate Terraform state files in the right folder, for later use by integration tests.
-    ./run-integration-tests.sh setup >>"$TEST_VMS_SETUP_OUTPUT_FILE" 2>&1
-    echo "OK" >"$TEST_VMS_READY_LOCK_FILE"
-    echo "Test VMs now ready. $(date)." >>"$TEST_VMS_SETUP_OUTPUT_FILE"
-fi
+# Provisioning from image typically take 90 seconds, 
+# but if we are creating a GCP image, it can take more than 10 minutes:
+wait_for 900 "$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+
+# Upload built binaries to testing VMs:
+cd "$SRCDIR/test" # Ensures we generate Terraform state files in the right folder, for later use by integration tests.
+./run-integration-tests.sh setup
+echo "OK" >"$TEST_VMS_READY_LOCK_FILE"
+echo "Test VMs now ready. $(date)."
@@ -2,22 +2,21 @@

 set -e

-source "$STATE"
 source "$(dirname "$0")/wait_for.sh"

-if [ -n "$TEST_AND_PUBLISH" ]; then
-    [ -n "$SECRET_KEY" ] || {
-        echo "Cannot run smoke tests: no secret key"
-        exit 1
-    }
+[ -n "$SECRET_KEY" ] || {
+    echo "Cannot run smoke tests: no secret key"
+    exit 1
+}

-    # Provisioning from image typically take 90 seconds, 
-    # but if we are creating a GCP image, it can take more than 10 minutes:
-    wait_for 900 "$TEST_VMS_READY_LOCK_FILE"
+source "$SRCDIR/bin/circle-env"

-    # Run integration tests:
-    export COVERAGE=true
-    export WEAVE_NET_SANITY_CHECKS_FILES="$CIRCLE_ARTIFACTS/weave_net_sanity_check_*.log"
-    cd "$SRCDIR/test" # Ensures we generate code coverage files in the right folder, and use the Terraform state of previously provisionned VMs.
-    ./run-integration-tests.sh test
-fi
+# Provisioning from image typically take 90 seconds, 
+# but if we are creating a GCP image, it can take more than 10 minutes:
+wait_for 900 "$TEST_VMS_READY_LOCK_FILE"
+
+# Run integration tests:
+export COVERAGE=true
+export WEAVE_NET_SANITY_CHECKS_FILES="$CIRCLE_ARTIFACTS/weave_net_sanity_check_*.log"
+cd "$SRCDIR/test" # Ensures we generate code coverage files in the right folder, and use the Terraform state of previously provisionned VMs.
+./run-integration-tests.sh test
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-set -e
-
-source "$STATE"
-
-if [ -n "$TEST_AND_PUBLISH" ] ; then
-    cd $SRCDIR/test
-    test "$CIRCLE_NODE_INDEX" != "0" || (cd $SRCDIR/test; ./gen_coverage_reports.sh)
-fi
@@ -1,11 +0,0 @@
-#!/bin/bash
-
-set -e
-
-source "$STATE"
-
-if [ -n "$TEST_AND_PUBLISH" ] ; then
-    cd $SRCDIR
-    make DEBUG=1 lint
-    COVERDIR=test/coverage make RM= tests
-fi
@@ -9,35 +9,24 @@ function signal_failure() {
 }
 trap signal_failure ERR

-source "$STATE"
-
 function install_terraform() {
-    curl -fsS https://releases.hashicorp.com/terraform/0.8.5/terraform_0.8.5_linux_amd64.zip | gunzip >terraform && chmod +x terraform && sudo mv terraform /usr/bin
+    curl -fsS https://releases.hashicorp.com/terraform/0.11.14/terraform_0.11.14_linux_amd64.zip | gunzip >terraform && chmod +x terraform && sudo mv terraform /usr/bin
 }

-function install_ansible() {
-    sudo apt-get update || true
-    sudo apt-get install -qq -y python-pip python-dev libffi-dev libssl-dev \
-        && pip install --user -U setuptools cffi \
-        && pip install --user ansible
-    export PATH="$PATH:$HOME/.local/bin"
+[ -n "$SECRET_KEY" ] || {
+    echo "Cannot run smoke tests: no secret key"
+    exit 1
 }

-if [ -n "$TEST_AND_PUBLISH" ]; then
-    [ -n "$SECRET_KEY" ] || {
-        echo "Cannot run smoke tests: no secret key"
-        exit 1
-    }
+source "$SRCDIR/bin/circle-env"

-    install_terraform >>"$TEST_VMS_SETUP_OUTPUT_FILE" 2>&1
-    install_ansible >>"$TEST_VMS_SETUP_OUTPUT_FILE" 2>&1
+install_terraform

-    # Only attempt to create GCP image in first container, wait for it to be created otherwise:
-    [ "$CIRCLE_NODE_INDEX" != "0" ] && export CREATE_IMAGE=0
+# Only attempt to create GCP image in first container, wait for it to be created otherwise:
+[ "$CIRCLE_NODE_INDEX" != "0" ] && export CREATE_IMAGE=0

-    # Provision and configure testing VMs:
-    cd "$SRCDIR/test" # Ensures we generate Terraform state files in the right folder, for later use by integration tests.
-    ./run-integration-tests.sh configure >>"$TEST_VMS_SETUP_OUTPUT_FILE" 2>&1
-    echo "OK" >"$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
-    echo "Test VMs now provisioned and configured. $(date)." >>"$TEST_VMS_SETUP_OUTPUT_FILE"
-fi
+# Provision and configure testing VMs:
+cd "$SRCDIR/test" # Ensures we generate Terraform state files in the right folder, for later use by integration tests.
+./run-integration-tests.sh configure
+echo "OK" >"$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+echo "Test VMs now provisioned and configured. $(date)."
@@ -89,9 +89,9 @@ build() {
    ## Inject the version numbers and build the distributables
    ## (library versions?)
    sed -i.bak "/SCRIPT_VERSION=/ c\SCRIPT_VERSION=\"$VERSION\"" ./weave
-    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset.yaml
-    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.6.yaml
-    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.7.yaml
+    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.8.yaml
+    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.9.yaml
+    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.11.yaml
    make SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER

    if make tests; then
@@ -164,22 +164,22 @@ draft() {
        --user $GITHUB_USER \
        --repo weave \
        --tag $LATEST_TAG \
-        --name "weave-daemonset.yaml" \
-        --file "./prog/weave-kube/weave-daemonset.yaml"
+        --name "weave-daemonset-k8s-1.8.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.8.yaml"

    github-release upload \
        --user $GITHUB_USER \
        --repo weave \
        --tag $LATEST_TAG \
-        --name "weave-daemonset-k8s-1.6.yaml" \
-        --file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"
-
+        --name "weave-daemonset-k8s-1.9.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.9.yaml"
+ 
    github-release upload \
        --user $GITHUB_USER \
        --repo weave \
        --tag $LATEST_TAG \
-        --name "weave-daemonset-k8s-1.7.yaml" \
-        --file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml"
+        --name "weave-daemonset-k8s-1.11.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.11.yaml"

    echo "** Draft $TYPE $RELEASE_NAME $VERSION created at"
    echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
@@ -272,22 +272,22 @@ publish() {
            --user $GITHUB_USER \
            --repo weave \
            --tag latest_release \
-            --name "weave-daemonset.yaml" \
-            --file "./prog/weave-kube/weave-daemonset.yaml"
+            --name "weave-daemonset-k8s-1.8.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.8.yaml"

-        github-release upload \
+         github-release upload \
            --user $GITHUB_USER \
            --repo weave \
            --tag latest_release \
-            --name "weave-daemonset-k8s-1.6.yaml" \
-            --file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"
+            --name "weave-daemonset-k8s-1.9.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.9.yaml"

-        github-release upload \
+         github-release upload \
            --user $GITHUB_USER \
            --repo weave \
            --tag latest_release \
-            --name "weave-daemonset-k8s-1.7.yaml" \
-            --file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml"
+            --name "weave-daemonset-k8s-1.11.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.11.yaml"

        echo "** Release $RELEASE_NAME $VERSION published at"
        echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
@@ -16,6 +16,6 @@ wait_for() {
        if ! ((i % 10)); then echo "[$i seconds]: Waiting for $lock_file to be created..."; fi
        sleep 1
    done
-    echo "Timed out waiting for test VMs to be ready. See details in: $TEST_VMS_SETUP_OUTPUT_FILE" >&2
+    echo "Timed out waiting for test VMs to be ready." >&2
    return 1
 }
@@ -1,4 +1,4 @@
-FROM golang:1.10.1-stretch
+FROM golang:1.15.6-buster

 # Support Raspberry Pi 2 and newer
 ENV GOARM 7
@@ -7,25 +7,25 @@ ENV GOARM 7
 ENV DEB_CROSSPLATFORMS \
 	armhf \
 	arm64 \
-	ppc64el
+	ppc64el \
+	s390x

 # The go platforms we are supporting to cross-compile
 ENV GO_CROSSPLATFORMS \
 	linux/arm \
 	linux/arm64 \
-	linux/ppc64le
+	linux/ppc64le \
+	linux/s390x

 # The names of the gcc cross-compilers we have installed
 ENV GCC_CROSSCOMPILERS \
 	arm-linux-gnueabihf \
 	aarch64-linux-gnu \
-	powerpc64le-linux-gnu
+	powerpc64le-linux-gnu \
+	s390x-linux-gnu

-# Temporarily add the Debian repositories, because we're going to install gcc cross-compilers from there
 # Install the build-essential and crossbuild-essential-ARCH packages
-RUN echo "deb http://emdebian.org/tools/debian/ jessie main" > /etc/apt/sources.list.d/cgocrosscompiling.list \
-  && curl http://emdebian.org/tools/debian/emdebian-toolchain-archive.key | apt-key add - \
-  && for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done \
+RUN for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done \
  && apt-get update \
  && apt-get install -y build-essential \
  && for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done \
@@ -50,31 +50,20 @@ RUN curl -fsSLo shfmt https://github.com/mvdan/sh/releases/download/v1.3.0/shfmt

 # Install common Go tools
 RUN go get \
-	github.com/golang/lint/golint \
+    github.com/weaveworks/build-tools/cover \
+    github.com/mattn/goveralls \
+	golang.org/x/lint/golint \
 	github.com/fzipp/gocyclo \
 	github.com/fatih/hclfmt \
 	github.com/client9/misspell/cmd/misspell

-# First clean, because we're gonna rebuild the std both with -race enabled and disabled
-# Running go install std twice is intentional and required, as content is written in two different directories
-# (/usr/local/go/pkg/linux_amd64 vs /usr/local/go/pkg/linux_amd64_race)
-# The other architectures do not have support for -race
-RUN go clean -i net \
-	&& go install -tags netgo std \
-	&& go install -race -tags netgo std
-
-# Prebuild std for the other architectures
-RUN for platform in ${GO_CROSSPLATFORMS}; do \
-		GOOS=${platform%/*} GOARCH=${platform##*/} \
-			go install -tags netgo std; done
-
 # Allow full write access to the Go folders for anyone
 RUN chmod -R a+w /usr/local/go

 # The libpcap version from Debian packages is 1.6.2, matching that version here although newer versions of libpcap have been released
 # We have to cross-compile the libpcap library for the new architectures, that's what we're doing here
 ENV LIBPCAP_CROSS_VERSION=1.6.2
-RUN curl -sSL http://www.tcpdump.org/release/libpcap-${LIBPCAP_CROSS_VERSION}.tar.gz | tar -xz \
+RUN curl -sSL https://www.tcpdump.org/release/libpcap-${LIBPCAP_CROSS_VERSION}.tar.gz | tar -xz \
 	&& cd libpcap-${LIBPCAP_CROSS_VERSION} \
 	&& for crosscompiler in ${GCC_CROSSCOMPILERS}; do \
 		CC=${crosscompiler}-gcc ac_cv_linux_vers=2 ./configure --host=${crosscompiler} --with-pcap=linux \
@@ -86,5 +75,8 @@ RUN curl -sSL http://www.tcpdump.org/release/libpcap-${LIBPCAP_CROSS_VERSION}.ta
 		&& ln -sf libpcap.so.${MAJOR_VER} /usr/local/lib/libpcap.so \
 		&& make clean; done

+# Install Docker
+RUN curl -fsSL https://get.docker.com | VERSION=18.06.0-ce /bin/sh
+
 COPY build.sh /
 ENTRYPOINT ["sh", "/build.sh"]
@@ -0,0 +1 @@
+bab3b4d04263479b3d9f85cf59bd0cad1f2b434f29856b2204f8288f2f3598e4  qemu-s390x-static
@@ -1,66 +0,0 @@
-general:
-  branches:
-    ignore:
-      - gh\-pages
-
-machine:
-  pre:
-    - curl -sSL https://s3.amazonaws.com/circle-downloads/install-circleci-docker.sh | bash -s -- 1.10.0
-  services:
-    - docker
-  environment:
-    GOPATH: /home/ubuntu:$GOPATH
-    SRCDIR: /home/ubuntu/src/github.com/weaveworks/weave
-    PATH: $PATH:$HOME/.local/bin:/opt/google-cloud-sdk/bin
-    CLOUDSDK_CORE_DISABLE_PROMPTS: 1
-    STATE: /home/ubuntu/state.env
-    # Base name of VMs for integration tests:
-    NAME: test-$CIRCLE_BUILD_NUM-$CIRCLE_NODE_INDEX
-    TEST_VMS_SETUP_OUTPUT_FILE: $CIRCLE_ARTIFACTS/test_vms_setup_output.txt
-    TEST_VMS_PROV_AND_CONF_LOCK_FILE: $CIRCLE_ARTIFACTS/test_vms_provisioned_and_configured.txt
-    TEST_VMS_READY_LOCK_FILE: $CIRCLE_ARTIFACTS/test_vms_ready.txt
-    # Google Cloud Platorm images for integration tests:
-    USE_IMAGE: 1
-    DISK_NAME_PREFIX: test-$CIRCLE_BUILD_NUM-0
-
-dependencies:
-  cache_directories:
-    - "~/docker"
-  post:
-    - bin/circle-dependencies-post-sources
-    # Provision & configure testing VMs:
-    - "while [ ! -d $SRCDIR ]; do sleep 1; done; $SRCDIR/bin/provision_test_vms.sh":
-        parallel: true
-        background: true
-    - bin/circle-dependencies-post
-
-test:
-  pre:
-    - "$SRCDIR/bin/circle-test-pre":
-        parallel: true
-        background: true
-  override:
-    - "$SRCDIR/bin/circle-test-unit":
-        parallel: true
-    - "$SRCDIR/bin/circle-test-smoke":
-        parallel: true
-        timeout: 300
-  post:
-    - "$SRCDIR/bin/circle-test-teardown":
-        parallel: true
-
-teardown:
-  pre:
-    # Destroy testing VMs:
-    - "cd $SRCDIR/test && ./run-integration-tests.sh destroy":
-        parallel: true
-        background: true
-    - "$SRCDIR/bin/circle-teardown-pre":
-        parallel: true
-
-deployment:
-  master:
-    branch: master
-    owner: weaveworks
-    commands:
-      - "$SRCDIR/bin/circle-deploy-master"
@@ -0,0 +1,12 @@
+package chains
+
+const (
+	MainChain    = "WEAVE-NPC"
+	DefaultChain = "WEAVE-NPC-DEFAULT"
+	IngressChain = "WEAVE-NPC-INGRESS"
+
+	EgressChain        = "WEAVE-NPC-EGRESS"
+	EgressDefaultChain = "WEAVE-NPC-EGRESS-DEFAULT"
+	EgressCustomChain  = "WEAVE-NPC-EGRESS-CUSTOM"
+	EgressMarkChain    = "WEAVE-NPC-EGRESS-ACCEPT"
+)
@@ -99,7 +99,9 @@ func (c *Client) AddObserver(ob ContainerObserver) error {
 		pending := make(pendingStarts)
 		retryInterval := InitialInterval
 		for {
-			events := make(chan *docker.APIEvents)
+			// Use a buffered chan so the client library can run ahead of the listener
+			// - Docker will drop an event if it is not collected quickly enough.
+			events := make(chan *docker.APIEvents, 1024)
 			if err := c.AddEventListener(events); err != nil {
 				c.errorf("Unable to add listener to Docker API: %s - retrying in %ds", err, retryInterval/time.Second)
 			} else {
@@ -231,7 +233,7 @@ func (c *Client) EnsureNetwork(networkName, driver, subnet string, options map[s
 			Name:           networkName,
 			CheckDuplicate: true,
 			Driver:         driver,
-			IPAM: docker.IPAMOptions{
+			IPAM: &docker.IPAMOptions{
 				Driver: driver,
 				Config: []docker.IPAMConfig{{Subnet: subnet}},
 			},
@@ -6,7 +6,7 @@ import (
 	"log"
 	"strings"

-	"github.com/Sirupsen/logrus"
+	"github.com/sirupsen/logrus"
 )

 type textFormatter struct {
@@ -54,6 +54,12 @@ func SetLogLevel(levelname string) {
 	Log.Level = level
 }

+func CheckError(e error) {
+	if e != nil {
+		Log.Error(e)
+	}
+}
+
 func CheckFatal(e error) {
 	if e != nil {
 		Log.Fatal(e)
@@ -35,21 +35,21 @@ weave-kube is an image with the weave binaries and a wrapper script installed. I

 1. Setting up the weave network
 2. Connecting to peers
-3. Copy the weave CNI-compatible binary plugin `weaveutil` to `/opt/cni/bin/weave-net` and weave config in `/etc/cni/net.d/10-weave.conf`
+3. Copy the weave CNI-compatible binary plugin `weaveutil` to `/opt/cni/bin/weave-net` and weave config in `/etc/cni/net.d/10-weave.conflist`
 4. Running the weave network policy controller (weave-npc) to implement kubernetes' `NetworkPolicy`

 Once installation is complete, each network-relevant change in a container leads `kubelet` to:

 1. Set certain environment variables to configure the CNI plugin, mostly related to the container ID
 2. Launch `/opt/cni/bin/weave-net`
-3. Pass the CNI config - the contents of `/etc/cni/net.d/10-weave.conf` to `weave-net`
+3. Pass the CNI config - the contents of `/etc/cni/net.d/10-weave.conflist` to `weave-net`

 Thus, when each container is changed, and `kubelet` calls weave as a CNI plugin, it really just is launching `weaveutil` as `weave-net`.

 The installation and setup of all of the above - and therefore the entrypoint to the weave-kube image - is the script `prog/weave-kube/launch.sh`. `launch.sh` does the following:

 1. Read configuration variables from the environment. When the documentation for `weave-kube` describes configuring the weave network by changing the environment variables in the daemonset in the `.yml` file, `launch.sh` reads these environment variables.
-2. Set up the config file at `/etc/cni/net.d/10-weave.conf`
+2. Set up the config file at `/etc/cni/net.d/10-weave.conflist`
 3. Run the `weave` initialization script
 4. Run `weaver` with the correct configuration passed as command-line options

@@ -64,7 +64,7 @@ To add new options to how weave should run with each invocation, you would do th
 5. Add a command-line option `--option` to `weaveutil` or `weaver` as appropriate.
 6. If the option can be configured for CNI:
    * have `prog/weave-kube/launch.sh` read it as an environment variable and set inside
-    * set a default for the environment variable in `prog/weave-kube/weave-daemonset-k8s-1.6.yaml` and `weave-daemonset.yaml`
+    * set a default for the environment variable in `prog/weave-kube/weave-daemonset-k8s-N.N.yaml`
    * if it should be set via `weaver` globally on its one-time initialization invocation, pass it on in `launch.sh`
-    * if it needs to be set via `weaveutil` on each invocation of `weave-net`, have `launch.sh` save it as an option in the CNI config file `/etc/cni/net.d/10-weave.conf` and then have the CNI code in `plugin/net/cni.go` in `weaveutil` read it and use where appropriate
+    * if it needs to be set via `weaveutil` on each invocation of `weave-net`, have `launch.sh` save it as an option in the CNI config file `/etc/cni/net.d/10-weave.conflist` and then have the CNI code in `plugin/net/cni.go` in `weaveutil` read it and use where appropriate
 7. Document it!
@@ -0,0 +1,33 @@
+# Source IP addr of packet sent to k8s Service
+
+## Setup
+
+* Weave Net: v2.2.1.
+* Kubernetes: v1.10.0.
+* kube-proxy: iptables/ipvs mode with `--masquerade-all=false` and `--cluster-cidr` unspecified(default kubeadm options).
+* Hosts: `h1` and `h2`.
+
+## Source IP
+
+\# | Src         | Target            | Dst    | Src IP           | `-j WEAVE-NPC`
+---|-------------|-------------------|--------|------------------|--------------
+1  | Pod_h1      | ip(Pod_h2)        | Pod_h2 | ip(Pod_h1)       | OK
+2  | h1          | ClusterIP         | Pod_h1 | ip(weave_h1)     | **NOK**
+3  | h1          | ClusterIP         | Pod_h2 | ip(weave_h1)     | OK
+4  | Pod_h1      | ClusterIP         | Pod_h1 | ip(Pod_h1)       | OK
+5  | Pod_h1      | ClusterIP         | Pod_h2 | ip(weave_h1)     | OK
+6  | h1          | ip(h1):NodePort   | Pod_h1 | ip(weave_h1)     | **NOK**
+7  | h1          | ip(h1):NodePort   | Pod_h2 | ip(weave_h1)     | OK
+8  | h1          | ip(h2):NodePort   | Pod_h1 | ip(weave_h2)     | OK
+9  | h1          | ip(h2):NodePort   | Pod_h2 | ip(weave_h2)     | ??? Can't reproduce
+10 | Pod_h1      | ip(h1):NodePort   | Pod_h1 | ip(weave_h1)     | **NOK**
+11 | Pod_h1      | ip(h1):NodePort   | Pod_h2 | ip(weave_h1)     | OK
+12 | Pod_h1      | ip(h2):NodePort   | Pod_h1 | ip(weave_h2)     | OK
+13 | Pod_h1      | ip(h2):NodePort   | Pod_h2 | ip(weave_h2)     | OK
+
+Remarks:
+
+* **Src IP** is of a packet which is captured on the weave bridge.
+* **-j WEAVE-NPC** - whether a packet enters the `filter/WEAVE-NPC` iptables chain (OK = NetworkPolicy is enforced as required).
+* **Pod_h1** - a Pod running on the `h1` host.
+* **ip(weave_h1)** - IP addr of the weave bridge on the `h1` host.
@@ -3,6 +3,7 @@

 * Up-to-date versions of `git`, `go` etc
 * Install GitHub release tool `go get github.com/weaveworks/github-release`
+* Install manifest tool `go get github.com/estesp/manifest-tool`
 * Create a [github token for
  github-release](https://help.github.com/articles/creating-an-access-token-for-command-line-use/); select the `repo` OAuth scope; set and export `$GITHUB_TOKEN` with this value

@@ -127,6 +128,22 @@ Finally, for **Mainline** releases only:

 * Images tagged `latest` are updated on DockerHub

+Now, you can validate whether images were published for all platforms:
+
+    # Required platforms for each image:
+    grep '^ML_PLATFORMS=' Makefile
+
+    # Published platforms per image:
+    for img in $(grep '^PUBLISH=' Makefile); do
+        img="weaveworks/$(echo $img | cut -d_ -f2):${TAG#v}"
+        platforms=$(manifest-tool \
+                inspect --raw "$img" | \
+                jq '.[].Platform | .os + "/" +.architecture' | \
+                tr '\n' ' ')
+        echo "$img: $platforms"
+    done
+
+
 ### Docker Store

 Weave Net is [available in Docker Store](https://store.docker.com/plugins/weave-net-plugin) and should also be released there.
@@ -138,6 +155,7 @@ Weave Net is [available in Docker Store](https://store.docker.com/plugins/weave-
 * Go to "_Plans & Pricing_" > "_Free Tier_".
 * Under "_Source Repositories & Tags_", click on "_Add Source_", select "_net-plugin_" under "_Repository_" and the version to release under "_Tag_".
 * Under "_Resources_" > "_Installation Instructions_", update the lines containing `export NET_VERSION=<version>`.
+* Click "_Save_"
 * Click "_Submit For Review_". You should see a message like: "_Your product has been submitted for approval. [...] We'll be in touch with next steps soon!_".
 * You should receive an email saying:

@@ -161,6 +179,8 @@ Weave Net is [available in Docker Store](https://store.docker.com/plugins/weave-
  https://checkpoint-api.weave.works/admin
 * File a PR to update the version of the daemonset at
  https://github.com/kubernetes/kops/tree/master/upup/models/cloudup/resources/addons/networking.weave
+  and kops/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go
+  and kops/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml

 ## Troubleshooting

@@ -9,7 +9,9 @@ destroyed automatically in response to Pod, Namespace and
 NetworkPolicy object updates from the k8s API server:

 * A `hash:ip` set per namespace, containing the IP addresses of all
-  pods in that namespace
+  pods in that namespace for which default ingress is allowed
+* A `hash:ip` set per namespace, containing the IP addresses of all
+  pods in that namespace for which default egress is allowed  
 * A `list:set` per distinct (across all network policies in all
  namespaces) namespace selector mentioned in a network policy,
  containing the names of any of the above hash:ip sets whose
@@ -18,6 +20,9 @@ NetworkPolicy object updates from the k8s API server:
  containing network policy's namespace) pod selector mentioned in a
  network policy, containing the IP addresses of all pods in the
  namespace whose labels match that selector
+* A `hash:net` set for each distinct (within the scope of the
+  containing network policy's namespace) `except` list of CIDR's mentioned in
+  the network policies

 IPsets are implemented by the kernel module `xt_set`, without which
 weave-npc will not work.
@@ -38,11 +43,21 @@ hashing to avoid clashes.

 # iptables chains

-The policy controller maintains two iptables chains in response to
-changes to pods, namespaces and network policies. One chain contains
-the ingress rules that implement the network policy specifications,
-and the other is used to bypass the ingress rules for namespaces which
-have an ingress isolation policy of `DefaultAllow`.
+The policy controller maintains several iptables chains in response to
+changes to pods, namespaces and network policies. 
+
+## Static `WEAVE-NPC` chain
+
+`WEAVE-NPC` chain contains static rules to ACCEPT traffic that is `RELATED,ESTABLISHED`
+and run `NEW` traffic through `WEAVE-NPC-DEFAULT` followed by `WEAVE-NPC-INGRESS` chains 
+
+Static configuration:
+
+```
+iptables -A WEAVE-NPC -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A WEAVE-NPC -m state --state NEW -j WEAVE-NPC-DEFAULT
+iptables -A WEAVE-NPC -m state --state NEW -j WEAVE-NPC-INGRESS
+```

 ## Dynamically maintained `WEAVE-NPC-DEFAULT` chain

@@ -63,23 +78,58 @@ For each namespace network policy ingress rule peer/port combination:
 iptables -A WEAVE-NPC-INGRESS -p $PROTO [-m set --match-set $SRCSET] -m set --match-set $DSTSET --dport $DPORT -j ACCEPT
 ```

-## Static `WEAVE-NPC` chain
+## Static `WEAVE-NPC-EGRESS` chain
+
+`WEAVE-NPC-EGRESS` chain contains static rules to ACCEPT traffic that is `RELATED,ESTABLISHED`
+and run `NEW` traffic through `WEAVE-NPC-EGRESS-DEFAULT` followed by `WEAVE-NPC-EGRESS-CUSTOM` chains 

 Static configuration:

 ```
-iptables -A WEAVE-NPC -m state --state RELATED,ESTABLISHED -j ACCEPT
-iptables -A WEAVE-NPC -m state --state NEW -j WEAVE-NPC-DEFAULT
-iptables -A WEAVE-NPC -m state --state NEW -j WEAVE-NPC-INGRESS
+iptables -A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
+iptables -A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
+iptables -A WEAVE-NPC-EGRESS -m mark ! --mark 0x40000/0x40000 -j DROP
 ```

+## Dynamically maintained `WEAVE-NPC-EGRESS-DEFAULT` chain
+
+The policy controller maintains a rule in this chain for every
+namespace whose egress isolation policy is `DefaultAllow`. The
+purpose of this rule is simply to ACCEPT any traffic originating from such namespace before it reaches the egress chain.
+
+```
+iptables -A WEAVE-NPC-EGRESS-DEFAULT -m set --match-set $NSIPSET src -j WEAVE-NPC-EGRESS-ACCEPT
+iptables -A WEAVE-NPC-EGRESS-DEFAULT -m set --match-set $NSIPSET src -j RETURN
+```
+
+## Static `WEAVE-NPC-EGRESS-ACCEPT` chain
+
+`WEAVE-NPC-EGRESS-ACCEPTS` chain contains static rules to mark traffic
+
+Static configuration:
+
+```
+iptables -A WEAVE-NPC-EGRESS-ACCEPT -j MARK --set-xmark 0x40000/0x40000
+```
+
+## Dynamically maintained `WEAVE-NPC-EGRESS-CUSTOM` chain
+
+For each namespace network policy egress rule peer/port combination:
+
+```
+iptables -A WEAVE-NPC-EGRESS-CUSTOM -p $PROTO [-m set --match-set $SRCSET] -m set --match-set $DSTSET --dport $DPORT -j ACCEPT
+```
+
+
 # Steering traffic into the policy engine

 To direct traffic into the policy engine:

 ```
-iptables -A FORWARD -o weave -m physdev ! --physdev-out vethwe-bridge -j WEAVE-NPC
-iptables -A FORWARD -o weave -m physdev ! --physdev-out vethwe-bridge -j DROP
+iptables -A INPUT -i weave -j WEAVE-NPC-EGRESS
+iptables -A FORWARD -i weave -j WEAVE-NPC-EGRESS
+iptables -A FORWARD -o weave -j WEAVE-NPC
 ```

 Note this only affects traffic which egresses the bridge on a physical
@@ -0,0 +1,65 @@
+module github.com/weaveworks/weave
+
+go 1.14
+
+require (
+	github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 // indirect
+	github.com/Microsoft/go-winio v0.4.7 // indirect
+	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
+	github.com/andybalholm/go-bit v0.0.0-20150501193155-34813fe0e46a
+	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
+	github.com/aws/aws-sdk-go v1.13.22
+	github.com/boltdb/bolt v1.3.1
+	github.com/containerd/continuity v0.0.0-20180322171221-3e8f2ea4b190 // indirect
+	github.com/containernetworking/cni v0.5.2
+	github.com/coreos/go-iptables v0.3.0
+	github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible // indirect
+	github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible
+	github.com/docker/go-connections v0.3.0 // indirect
+	github.com/docker/go-units v0.3.2 // indirect
+	github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b
+	github.com/docker/machine v0.14.0
+	github.com/fsouza/go-dockerclient v1.2.0
+	github.com/go-ini/ini v1.33.0 // indirect
+	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
+	github.com/google/go-cmp v0.5.1 // indirect
+	github.com/google/gopacket v1.1.16
+	github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f // indirect
+	github.com/gorilla/mux v1.6.1
+	github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
+	github.com/hashicorp/go-cleanhttp v0.0.0-20171218145408-d5fe4b57a186 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56
+	github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8 // indirect
+	github.com/mattn/go-colorable v0.0.9 // indirect
+	github.com/mattn/go-isatty v0.0.3 // indirect
+	github.com/mdlayher/raw v0.0.0-20181016155347-fa5ef3332ca9 // indirect
+	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b
+	github.com/miekg/dns v1.0.4
+	github.com/onsi/ginkgo v1.14.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0-rc1 // indirect
+	github.com/opencontainers/image-spec v1.0.1 // indirect
+	github.com/opencontainers/runc v0.1.1 // indirect
+	github.com/opencontainers/selinux v1.6.0 // indirect
+	github.com/pkg/errors v0.9.1
+	github.com/pkg/profile v1.2.1
+	github.com/prometheus/client_golang v1.7.1
+	github.com/sirupsen/logrus v1.4.2
+	github.com/smartystreets/goconvey v1.6.4 // indirect
+	github.com/spf13/cobra v0.0.1
+	github.com/stretchr/testify v1.4.0
+	github.com/vishvananda/netlink v1.0.0
+	github.com/vishvananda/netns v0.0.0-20171111001504-be1fbeda1936
+	github.com/weaveworks/common v0.0.0-20180321110636-ebab3a78900a
+	github.com/weaveworks/go-checkpoint v0.0.0-20170503165305-ebbb8b0518ab
+	github.com/weaveworks/go-odp v0.0.0-20181017121109-6b0aa22550d9
+	github.com/weaveworks/mesh v0.0.0-20191105120815-58dbcc3e8e63
+	golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975
+	golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1
+	golang.org/x/tools v0.0.0-20190328211700-ab21143f2384
+	gopkg.in/ini.v1 v1.57.0 // indirect
+	gotest.tools v2.2.0+incompatible // indirect
+	k8s.io/api v0.18.6
+	k8s.io/apimachinery v0.18.6
+	k8s.io/client-go v0.18.6
+)
@@ -0,0 +1,411 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
+github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
+github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
+github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
+github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
+github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/Microsoft/go-winio v0.4.7 h1:vOvDiY/F1avSWlCWiKJjdYKz2jVjTK3pWPHndeG4OAY=
+github.com/Microsoft/go-winio v0.4.7/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
+github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/andybalholm/go-bit v0.0.0-20150501193155-34813fe0e46a h1:yE4/B7ng2G9tr5DdT/x2bj3u6p3Rze2Ha/61eChret8=
+github.com/andybalholm/go-bit v0.0.0-20150501193155-34813fe0e46a/go.mod h1:xPmFQkJW5/HS/ZMM6soMdODwdIOO9zs3yAhksnFQJE0=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/aws/aws-sdk-go v1.13.22 h1:S18o71mCjRUw9bZzw61k2xjZx3/XtzwJKdAXx5CUf6s=
+github.com/aws/aws-sdk-go v1.13.22/go.mod h1:ZRmQr0FajVIyZ4ZzBYKG5P3ZqPz9IHG41ZoMu1ADI3k=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973 h1:xJ4a3vCFaGF/jqvzLMYoU8P317H5OQ+Via4RmuPwCS0=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
+github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
+github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
+github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/containerd/continuity v0.0.0-20180322171221-3e8f2ea4b190 h1:xySrq2Xw0gX07PHM/LS8kuGpRd3hKDz+0/QvIJRILYk=
+github.com/containerd/continuity v0.0.0-20180322171221-3e8f2ea4b190/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
+github.com/containernetworking/cni v0.5.2 h1:/nFPNGJQu4yiNvXxH31qL05FIyGG5Y/p0YxuUutl+PE=
+github.com/containernetworking/cni v0.5.2/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
+github.com/coreos/go-iptables v0.3.0 h1:UTQkjHl9rPwwtXZhXbY3T932cV9aUnKlSsZ7YGfJVXM=
+github.com/coreos/go-iptables v0.3.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible h1:W1rhCpxfWMU0CaZSFWpmWfmB68zYZVksig+VC1ZbgI4=
+github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible h1:C81UCfrC3AgecXLr1vYezUVtYqTPlizDRO67F/lRU2U=
+github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.3.0 h1:3lOnM9cSzgGwx8VfK/NGOW5fLQ0GjIlCkaktF+n1M6o=
+github.com/docker/go-connections v0.3.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-units v0.3.2 h1:Kjm80apys7gTtfVmCvVY8gwu10uofaFSrmAKOVrtueE=
+github.com/docker/go-units v0.3.2/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b h1:u7WZJnaLG9o39ZmpCJEwuFM6nCBuUQL0y/AbyE5sbaM=
+github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b/go.mod h1:93m0aTqz6z+g32wla4l4WxTrdtvBRmVzYRkYvasA5Z8=
+github.com/docker/machine v0.14.0 h1:7zMwMAz0XbL27Q4NPqtW7I0wuhOaGFpq5WfvrUfZROM=
+github.com/docker/machine v0.14.0/go.mod h1:I8mPNDeK1uH+JTcUU7X0ZW8KiYz0jyAgNaeSJ1rCfDI=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/evanphx/json-patch v4.2.0+incompatible h1:fUDGZCv/7iAN7u0puUVhvKCcsR6vRfwrJatElLBEf0I=
+github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsouza/go-dockerclient v1.2.0 h1:lmjnUbZFR+De5PfuXCk62hAIlkokNtD9CaGPR8Iu5UU=
+github.com/fsouza/go-dockerclient v1.2.0/go.mod h1:KpcjM623fQYE9MZiTGzKhjfxXAV9wbyX2C1cyRHfhl0=
+github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-ini/ini v1.33.0 h1:/0Y2X+/6jgfPYl2LOihvxikDfznXMufz0Zkr3mW+7Zg=
+github.com/go-ini/ini v1.33.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gogo/protobuf v1.1.1 h1:72R+M5VuhED/KujmZVcIquuo8mBgX4oVda//DQb3PXo=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
+github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1 h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
+github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gopacket v1.1.16 h1:u6Afvia5C5srlLcbTwpHaFW918asLYPxieziOaWwz8M=
+github.com/google/gopacket v1.1.16/go.mod h1:UCLx9mCmAwsVbn6qQl1WIEt2SO7Nd2fD0th1TBAsqBw=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/googleapis/gnostic v0.1.0 h1:rVsPeBmXbYv4If/cumu1AzZPwV58q433hvONV1UEZoI=
+github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f h1:9oNbS1z4rVpbnkHBdPZU4jo9bSmrLpII768arSyMFgk=
+github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/mux v1.6.1 h1:KOwqsTYZdeuMacU7CxjMNYEKeBvLbxW+psodrbcEa3A=
+github.com/gorilla/mux v1.6.1/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
+github.com/gotestyourself/gotestyourself v2.2.0+incompatible h1:AQwinXlbQR2HvPjQZOmDhRqsv5mZf+Jb1RnSLxcqZcI=
+github.com/gotestyourself/gotestyourself v2.2.0+incompatible/go.mod h1:zZKM6oeNM8k+FRljX1mnzVYeS8wiGgQyvST1/GafPbY=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 h1:pdN6V1QBWetyv/0+wjACpqVH+eVULgEjkurDLq3goeM=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/hashicorp/go-cleanhttp v0.0.0-20171218145408-d5fe4b57a186 h1:URgjUo+bs1KwatoNbwG0uCO4dHN4r1jsp4a5AGgHRjo=
+github.com/hashicorp/go-cleanhttp v0.0.0-20171218145408-d5fe4b57a186/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56 h1:742eGXur0715JMq73aD95/FU0XpVKXqNuTnEfXsLOYQ=
+github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8 h1:12VvqtR6Aowv3l/EQUlocDHW2Cp4G9WJVH7uyH8QFJE=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.10 h1:Kz6Cvnvv2wGdaG/V8yMvfkmNiXq9Ya2KUv4rouJJr68=
+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.3 h1:ns/ykhmWi7G9O+8a448SecJU3nSMBXJfqQkl0upE1jI=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mdlayher/raw v0.0.0-20181016155347-fa5ef3332ca9 h1:tOtO8DXiNGj9NshRKHWiZuGlSldPFzFCFYhNtsKTBCs=
+github.com/mdlayher/raw v0.0.0-20181016155347-fa5ef3332ca9/go.mod h1:rC/yE65s/DoHB6BzVOUBNYBGTg772JVytyAytffIZkY=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
+github.com/miekg/dns v1.0.4 h1:Ec3LTJwwzqT1++63P12fhtdEbQhtPE7TBdD6rlhqrMM=
+github.com/miekg/dns v1.0.4/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA=
+github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2iki3E3Ii+WN7gQ=
+github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
+github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/runc v0.1.1 h1:GlxAyO6x8rfZYN9Tt0Kti5a/cP41iuiO2yYT0IJGY8Y=
+github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
+github.com/opencontainers/selinux v1.6.0 h1:+bIAS/Za3q5FTwWym4fTB0vObnfCf3G/NC7K6Jx62mY=
+github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.2.1 h1:F++O52m40owAmADcojzM+9gyjmMOY/T4oYJkgFDH8RE=
+github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.7.1 h1:NTGy1Ja9pByO+xAeH/qiWnLrKtr3hJPNjaVUwnjpdpA=
+github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
+github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.10.0 h1:RyRA7RzGXQZiW+tGMr7sxa85G1z0yOpM1qq5c8lNawc=
+github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.1.3 h1:F0+tqvhOksq22sc6iCHF5WGlWjdwj92p0udFh1VFBS8=
+github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
+github.com/spf13/cobra v0.0.1 h1:zZh3X5aZbdnoj+4XkaBxKfhO4ot82icYdhhREIAXIj8=
+github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/vishvananda/netlink v1.0.0 h1:bqNY2lgheFIu1meHUFSH3d7vG93AFyqg3oGbJCOJgSM=
+github.com/vishvananda/netlink v1.0.0/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
+github.com/vishvananda/netns v0.0.0-20171111001504-be1fbeda1936 h1:J9gO8RJCAFlln1jsvRba/CWVUnMHwObklfxxjErl1uk=
+github.com/vishvananda/netns v0.0.0-20171111001504-be1fbeda1936/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
+github.com/weaveworks/common v0.0.0-20180321110636-ebab3a78900a h1:dIOYWkmKCq9tU3DY96p1D/8xXFWkqt9Jd1ipu6sTLSk=
+github.com/weaveworks/common v0.0.0-20180321110636-ebab3a78900a/go.mod h1:pSm+0KR57BG3pvGoJWFXJSAC7+sEPewcvdt5StevL3A=
+github.com/weaveworks/go-checkpoint v0.0.0-20170503165305-ebbb8b0518ab h1:mW+hgchD9qUUBqnuaDBj7BkcpFPk/FxeFcUFI5lvvUw=
+github.com/weaveworks/go-checkpoint v0.0.0-20170503165305-ebbb8b0518ab/go.mod h1:qkbvw5GPibQ/Nf7IZJL0UoLwmJ6858b4S/hUWRd+cH4=
+github.com/weaveworks/go-odp v0.0.0-20181017121109-6b0aa22550d9 h1:7OqrOqOJkneFGUT7CoR3uZnZP3ZyuUtzWNfv7GIc3RE=
+github.com/weaveworks/go-odp v0.0.0-20181017121109-6b0aa22550d9/go.mod h1:6/WClQKiVm/SQf6WJXv49l+9K9ONE2U8DYpeXEk3X7k=
+github.com/weaveworks/mesh v0.0.0-20191105120815-58dbcc3e8e63 h1:s0fUBZ8Vhtc3ruFmLIr3qVTQUb/j6ySkPLHoKKitHeM=
+github.com/weaveworks/mesh v0.0.0-20191105120815-58dbcc3e8e63/go.mod h1:RZebXKv56dax5zXcLIJZm1Awk28sx0XODXF94Z8WssY=
+github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243 h1:R43TdZy32XXSXjJn7M/HhALJ9imq6ztLnChfYJpVDnM=
+github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc h1:c0o/qxkaO2LF5t6fQrT4b5hzyggAkLLlCUjqfRxd8Q4=
+golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 h1:/Tl7pH94bvbAAHBdZJT947M/+gp0+CqQXDtMRC0fseo=
+golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 h1:AeiKBIuRw3UomYXSbLy0Mc2dDLfdtbT/IVn4keq83P0=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200519105757-fe76b779f299 h1:DYfZAGf2WMFjMxbgTjaC+2HC7NkNAQs+6Q8b9WEB/F4=
+golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 h1:ogLJMz+qpzav7lGMh10LMvAkM/fAoGlaiiHYiFYdm80=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384 h1:TFlARGu6Czu1z7q93HTxcP1P+/ZFC/IKythI5RzrnRg=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/ini.v1 v1.57.0 h1:9unxIsFcTt4I55uWluz+UmL95q4kdJ0buvQ1ZIqVQww=
+gopkg.in/ini.v1 v1.57.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/api v0.18.6 h1:osqrAXbOQjkKIWDTjrqxWQ3w0GkKb1KA1XkUGHHYpeE=
+k8s.io/api v0.18.6/go.mod h1:eeyxr+cwCjMdLAmr2W3RyDI0VvTawSg/3RFFBEnmZGI=
+k8s.io/apimachinery v0.18.6 h1:RtFHnfGNfd1N0LeSrKCUznz5xtUP1elRGvHJbL3Ntag=
+k8s.io/apimachinery v0.18.6/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
+k8s.io/client-go v0.18.6 h1:I+oWqJbibLSGsZj8Xs8F0aWVXJVIoUHWaaJV3kUN/Zw=
+k8s.io/client-go v0.18.6/go.mod h1:/fwtGLjYMS1MaM5oi+eXhKwG+1UHidUEXRh6cNsdO0Q=
+k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
+k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
+k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6 h1:Oh3Mzx5pJ+yIumsAD0MOECPVeXsVot0UkiaCGVyfGQY=
+k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
+k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89 h1:d4vVOjXm687F1iLSP2q3lyPPuyvTUt3aVoBpi2DqRsU=
+k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
+sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
+sigs.k8s.io/structured-merge-diff/v3 v3.0.0 h1:dOmIZBMfhcHS09XZkMyUgkq5trg3/jRyJYFZUiaOp8E=
+sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
@@ -74,6 +74,7 @@ type Allocator struct {
 	isKnownPeer       func(mesh.PeerName) bool
 	quorum            func() uint
 	now               func() time.Time
+	tracker           tracker.LocalRangeTracker
 }

 // PreClaims are IP addresses discovered before we could initialize IPAM
@@ -130,6 +131,7 @@ func NewAllocator(config Config) *Allocator {
 		quorum:      config.Quorum,
 		dead:        make(map[string]time.Time),
 		now:         time.Now,
+		tracker:     config.Tracker,
 	}

 	alloc.pendingClaims = make([]operation, len(config.PreClaims))
@@ -205,21 +207,6 @@ func (alloc *Allocator) doOperation(op operation, ops *[]operation) {
 	}
 }

-// Given an operation, remove it from the pending queue
-//  Note the op may not be on the queue; it may have
-//  already succeeded.  If it is on the queue, we call
-//  cancel on it, allowing callers waiting for the resultChans
-//  to unblock.
-func (alloc *Allocator) cancelOp(opToCancel operation, ops *[]operation) {
-	for i, op := range *ops {
-		if op == opToCancel {
-			*ops = append((*ops)[:i], (*ops)[i+1:]...)
-			op.Cancel()
-			break
-		}
-	}
-}
-
 // Cancel all operations in a queue
 func (alloc *Allocator) cancelOps(ops *[]operation) {
 	for _, op := range *ops {
@@ -273,7 +260,7 @@ func (alloc *Allocator) spaceRequestDenied(sender mesh.PeerName, r address.Range
 	for i := 0; i < len(alloc.pendingClaims); {
 		claim := alloc.pendingClaims[i].(*claim)
 		if r.Contains(claim.cidr.Addr) {
-			claim.deniedBy(alloc, sender)
+			claim.deniedBy(alloc, sender, nil)
 			alloc.pendingClaims = append(alloc.pendingClaims[:i], alloc.pendingClaims[i+1:]...)
 			continue
 		}
@@ -812,6 +799,16 @@ func (alloc *Allocator) sendRingUpdate(dest mesh.PeerName) {
 	alloc.gossip.GossipUnicast(dest, msg)
 }

+func (alloc *Allocator) hasAllocations(rs []address.Range) bool {
+	for _, r := range rs {
+		alloc.debugf("hasAllocations: %v %v vs %v", r, alloc.space.NumFreeAddressesInRange(r), r.Size())
+		if alloc.space.NumFreeAddressesInRange(r) != r.Size() {
+			return true
+		}
+	}
+	return false
+}
+
 func (alloc *Allocator) update(sender mesh.PeerName, msg []byte) error {
 	reader := bytes.NewReader(msg)
 	decoder := gob.NewDecoder(reader)
@@ -830,7 +827,7 @@ func (alloc *Allocator) update(sender mesh.PeerName, msg []byte) error {
 	// If someone sent us a ring, merge it into ours. Note this will move us
 	// out of the awaiting-consensus state if we didn't have a ring already.
 	case data.Ring != nil:
-		updated, err := alloc.ring.Merge(*data.Ring)
+		updated, err := alloc.ring.Merge(*data.Ring, alloc.hasAllocations)
 		switch err {
 		case nil:
 			if updated {
@@ -908,6 +905,7 @@ func (alloc *Allocator) donateSpace(r address.Range, to mesh.PeerName) {
 	alloc.debugln("Giving range", chunk, "to", to)
 	alloc.ring.GrantRangeToHost(chunk.Start, chunk.End, to)
 	alloc.persistRing()
+	alloc.gossip.GossipBroadcast(alloc.Gossip())
 }

 func (alloc *Allocator) assertInvariants() {
@@ -983,7 +981,7 @@ func (alloc *Allocator) loadPersistedData() bool {
 		alloc.persistOwned()
 	}

-	if !nameFound || !ringFound {
+	if !nameFound || !ringFound || persistedRing == nil || persistedRing.Empty() {
 		overwritePersisted("No valid persisted data")
 		return false
 	}
@@ -17,8 +17,6 @@ import (

 const (
 	testStart1 = "10.0.1.0"
-	testStart2 = "10.0.2.0"
-	testStart3 = "10.0.3.0"
 )

 func returnFalse() bool { return false }
@@ -12,6 +12,7 @@ import (

 type claim struct {
 	resultChan       chan<- error
+	tryCount         int
 	ident            string       // a container ID, something like "weave:expose", or api.NoContainerID
 	cidr             address.CIDR // single address being claimed
 	isContainer      bool         // true if ident is a container ID
@@ -19,6 +20,8 @@ type claim struct {
 	hasBeenCancelled func() bool
 }

+const maxTryCount = 5
+
 // Send an error (or nil for success) back to caller listening on resultChan
 func (c *claim) sendResult(result error) {
 	// Make sure we only send a result once, since listener stops listening after that
@@ -40,6 +43,8 @@ func (c *claim) Try(alloc *Allocator) bool {
 		return true
 	}

+	c.tryCount++
+
 	addOwned := func() {
 		if c.ident == api.NoContainerID {
 			alloc.addOwned(c.cidr.Addr.String(), c.cidr, c.isContainer)
@@ -90,8 +95,10 @@ func (c *claim) Try(alloc *Allocator) bool {
 			if c.noErrorOnUnknown {
 				alloc.infof("Claim %s for %s: %s; will try later.", c.cidr, c.ident, err)
 				c.sendResult(nil)
-			} else { // just tell the user they can't do this.
-				c.deniedBy(alloc, owner)
+			} else if c.tryCount > maxTryCount {
+				// give up, tell the user they can't do this
+				c.deniedBy(alloc, owner, err)
+				return true
 			}
 		}
 		return false
@@ -128,12 +135,16 @@ func (c *claim) Try(alloc *Allocator) bool {
 	return true
 }

-func (c *claim) deniedBy(alloc *Allocator, owner mesh.PeerName) {
+func (c *claim) deniedBy(alloc *Allocator, owner mesh.PeerName, err error) {
 	name, found := alloc.nicknames[owner]
 	if found {
 		name = " (" + name + ")"
 	}
-	c.sendResult(fmt.Errorf("address %s is owned by other peer %s%s", c.cidr.String(), owner, name))
+	reason := ""
+	if err != nil {
+		reason = fmt.Sprintf(" - %s", err)
+	}
+	c.sendResult(fmt.Errorf("address %s is owned by other peer %s%s%s", c.cidr.String(), owner, name, reason))
 }

 func (c *claim) Cancel() {
@@ -1,6 +1,7 @@
 package ipam

 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -41,7 +42,7 @@ func writeAddresses(w http.ResponseWriter, cidrs []address.CIDR) {
 	}
 }

-func hasBeenCancelled(dockerCli *docker.Client, closedChan <-chan bool, ident string, checkAlive bool) func() bool {
+func hasBeenCancelled(dockerCli *docker.Client, closedChan <-chan struct{}, ident string, checkAlive bool) func() bool {
 	return func() bool {
 		select {
 		case <-closedChan:
@@ -63,9 +64,9 @@ func cancellationErr(w http.ResponseWriter, err error) bool {
 	return false
 }

-func (alloc *Allocator) handleHTTPAllocate(dockerCli *docker.Client, w http.ResponseWriter, ident string, checkAlive bool, subnet address.CIDR) {
+func (alloc *Allocator) handleHTTPAllocate(ctx context.Context, dockerCli *docker.Client, w http.ResponseWriter, ident string, checkAlive bool, subnet address.CIDR) {
 	addr, err := alloc.Allocate(ident, subnet, checkAlive,
-		hasBeenCancelled(dockerCli, w.(http.CloseNotifier).CloseNotify(), ident, checkAlive))
+		hasBeenCancelled(dockerCli, ctx.Done(), ident, checkAlive))
 	if err != nil {
 		if !cancellationErr(w, err) {
 			badRequest(w, err)
@@ -75,9 +76,9 @@ func (alloc *Allocator) handleHTTPAllocate(dockerCli *docker.Client, w http.Resp
 	fmt.Fprintf(w, "%s/%d", addr, subnet.PrefixLen)
 }

-func (alloc *Allocator) handleHTTPClaim(dockerCli *docker.Client, w http.ResponseWriter, ident string, cidr address.CIDR, checkAlive, noErrorOnUnknown bool) {
+func (alloc *Allocator) handleHTTPClaim(ctx context.Context, dockerCli *docker.Client, w http.ResponseWriter, ident string, cidr address.CIDR, checkAlive, noErrorOnUnknown bool) {
 	err := alloc.Claim(ident, cidr, checkAlive, noErrorOnUnknown,
-		hasBeenCancelled(dockerCli, w.(http.CloseNotifier).CloseNotify(), ident, checkAlive))
+		hasBeenCancelled(dockerCli, ctx.Done(), ident, checkAlive))
 	if err != nil {
 		if !cancellationErr(w, err) {
 			badRequest(w, fmt.Errorf("Unable to claim: %s", err))
@@ -88,7 +89,7 @@ func (alloc *Allocator) handleHTTPClaim(dockerCli *docker.Client, w http.Respons
 }

 // HandleHTTP wires up ipams HTTP endpoints to the provided mux.
-func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CIDR, tracker string, dockerCli *docker.Client) {
+func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CIDR, dockerCli *docker.Client) {
 	router.Methods("GET").Path("/ipinfo/defaultsubnet").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprintf(w, "%s", defaultSubnet)
 	})
@@ -99,7 +100,7 @@ func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CID
 			ident := vars["id"]
 			checkAlive := r.FormValue("check-alive") == "true"
 			noErrorOnUnknown := r.FormValue("noErrorOnUnknown") == "true"
-			alloc.handleHTTPClaim(dockerCli, w, ident, cidr, checkAlive, noErrorOnUnknown)
+			alloc.handleHTTPClaim(r.Context(), dockerCli, w, ident, cidr, checkAlive, noErrorOnUnknown)
 		}
 	})

@@ -164,13 +165,13 @@ func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CID
 	router.Methods("POST").Path("/ip/{id}/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
 		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"], true); ok {
-			alloc.handleHTTPAllocate(dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", subnet)
+			alloc.handleHTTPAllocate(r.Context(), dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", subnet)
 		}
 	})

 	router.Methods("POST").Path("/ip/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
-		alloc.handleHTTPAllocate(dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", defaultSubnet)
+		alloc.handleHTTPAllocate(r.Context(), dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", defaultSubnet)
 	})

 	router.Methods("DELETE").Path("/ip/{id}/{ip}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -199,6 +200,10 @@ func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CID
 	})

 	router.Methods("GET").Path("/ipinfo/tracker").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprintf(w, tracker)
+		tracker := ""
+		if alloc.tracker != nil {
+			tracker = alloc.tracker.String()
+		}
+		fmt.Fprintln(w, tracker)
 	})
 }
@@ -1,6 +1,7 @@
 package ipam

 import (
+	"context"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -43,7 +44,7 @@ func listenHTTP(alloc *Allocator, subnet address.CIDR) int {
 	router.HandleFunc("/status", func(w http.ResponseWriter, r *http.Request) {
 		io.WriteString(w, fmt.Sprintln(alloc))
 	})
-	alloc.HandleHTTP(router, subnet, "", nil)
+	alloc.HandleHTTP(router, subnet, nil)

 	httpListener, err := net.Listen("tcp", ":0")
 	if err != nil {
@@ -132,7 +133,7 @@ func TestBadHttp(t *testing.T) {
 	// Verb that's not handled
 	resp, err := doHTTP("HEAD", fmt.Sprintf("http://localhost:%d/ip/%s/%s", port, containerID, testAddr1))
 	require.NoError(t, err)
-	require.Equal(t, http.StatusNotFound, resp.StatusCode, "http response")
+	require.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode, "http response")
 	// Mis-spelled URL
 	resp, err = doHTTP("POST", fmt.Sprintf("http://localhost:%d/xip/%s/", port, containerID))
 	require.NoError(t, err)
@@ -158,11 +159,13 @@ func TestHTTPCancel(t *testing.T) {

 	// Ask the http server for a new address
 	req, _ := http.NewRequest("POST", allocURL(port, testCIDR1, containerID), nil)
+	ctx, cancel := context.WithCancel(context.Background())
+	req = req.WithContext(ctx)
 	// On another goroutine, wait for a bit then cancel the request
 	go func() {
 		time.Sleep(100 * time.Millisecond)
 		common.Log.Debug("Cancelling allocate")
-		http.DefaultTransport.(*http.Transport).CancelRequest(req)
+		cancel()
 	}()

 	res, _ := http.DefaultClient.Do(req)
@@ -56,16 +56,6 @@ func (m *Model) addLink(a, b *TestNode) {
 	m.readyLinks = append(m.readyLinks, &ab, &ba)
 }

-func (m *Model) linkExists(a, b *TestNode) bool {
-	for _, l := range a.links {
-		if l.to == b {
-			return true
-		}
-	}
-
-	return false
-}
-
 type TestParams struct {
 	// Number of nodes
 	nodeCount uint
@@ -1,6 +1,7 @@
 package ring

 import (
+	"fmt"
 	"sort"

 	"github.com/weaveworks/mesh"
@@ -25,6 +26,7 @@ func (e *entry) Equal(e2 *entry) bool {
 func (e *entry) update(peername mesh.PeerName, free address.Count) {
 	e.Peer = peername
 	e.Version++
+	common.Log.Debugln(fmt.Sprintf("Updating ring token=%s current peer=%s updated peer=%s new version=%s", e.Token, e.Peer, peername, fmt.Sprint(e.Version)))
 	e.Free = free
 }

@@ -213,7 +213,7 @@ func (r *Ring) GrantRangeToHost(start, end address.Address, peer mesh.PeerName)

 // Merge the given ring into this ring and indicate whether this ring
 // got updated as a result.
-func (r *Ring) Merge(gossip Ring) (bool, error) {
+func (r *Ring) Merge(gossip Ring, hasAllocations func(r []address.Range) bool) (bool, error) {
 	r.assertInvariants()
 	defer r.trackUpdates()()

@@ -238,12 +238,22 @@ func (r *Ring) Merge(gossip Ring) (bool, error) {
 		return false, ErrDifferentRange
 	}

-	result, updated, err := r.Entries.merge(gossip.Entries, r.Peer)
+	result, updated, err := r.Entries.merge(gossip.Entries, r.Peer, r, hasAllocations)

 	if err != nil {
 		return false, err
 	}

+	// reset the free space for entries if there is invalid free space
+	// due to accepting an unexpected update from the peers
+	for i := 0; i < len(result); i++ {
+		distance := r.distance(result.entry(i).Token, result.entry(i+1).Token)
+		if result.entry(i).Peer == r.Peer && result.entry(i).Free > distance {
+			// case that can arise when a range that we own that got split and had no allocations
+			result.entry(i).Free = distance
+		}
+	}
+
 	if err := r.checkEntries(result); err != nil {
 		return false, fmt.Errorf("Merge of incoming data causes: %s", err)
 	}
@@ -260,7 +270,7 @@ func (r *Ring) Merge(gossip Ring) (bool, error) {
 // entries belonging to ourPeer. Returns the merged entries and an
 // indication whether the merge resulted in any changes, i.e. the
 // result differs from the original.
-func (es entries) merge(other entries, ourPeer mesh.PeerName) (result entries, updated bool, err error) {
+func (es entries) merge(other entries, ourPeer mesh.PeerName, r *Ring, hasAllocations func(r []address.Range) bool) (result entries, updated bool, err error) {
 	var mine, theirs *entry
 	var previousOwner *mesh.PeerName
 	addToResult := func(e entry) { result = append(result, &e) }
@@ -274,6 +284,7 @@ func (es entries) merge(other entries, ourPeer mesh.PeerName) (result entries, u
 	var i, j int
 	for i < len(es) && j < len(other) {
 		mine, theirs = es[i], other[j]
+		common.Log.Debugf("[ring %s]: Merge mine.Token=%s theirs.Token=%s mine.Peer=%s theirs.Peer=%s mine.Version=%v theirs.Version=%v", ourPeer, mine.Token, theirs.Token, mine.Peer, theirs.Peer, mine.Version, theirs.Version)
 		switch {
 		case mine.Token < theirs.Token:
 			addToResult(*mine)
@@ -282,8 +293,11 @@ func (es entries) merge(other entries, ourPeer mesh.PeerName) (result entries, u
 		case mine.Token > theirs.Token:
 			// insert, checking that a range owned by us hasn't been split
 			if previousOwner != nil && *previousOwner == ourPeer && theirs.Peer != ourPeer {
-				err = errEntryInMyRange(theirs)
-				return
+				// check we have no allocations in the range that got split
+				if hasAllocations(r.makeRanges(theirs.Token, mine.Token)) {
+					err = errEntryInMyRange(theirs)
+					return
+				}
 			}
 			addTheirs(*theirs)
 			j++
@@ -292,17 +306,44 @@ func (es entries) merge(other entries, ourPeer mesh.PeerName) (result entries, u
 			switch {
 			case mine.Version >= theirs.Version:
 				if mine.Version == theirs.Version && !mine.Equal(theirs) {
-					err = errInconsistentEntry(mine, theirs)
-					return
+					if mine.Peer == ourPeer {
+						// if we own the entry and has allocations
+						if hasAllocations(r.makeRanges(theirs.Token, es.entry(i+1).Token)) {
+							err = errInconsistentEntry(mine, theirs)
+							return
+						}
+					}
+					// tie-break here, pick the entry with the highest free count
+					if mine.Free >= theirs.Free {
+						addToResult(*mine)
+						previousOwner = &mine.Peer
+					} else {
+						addTheirs(*theirs)
+					}
+				} else {
+					addToResult(*mine)
+					previousOwner = &mine.Peer
 				}
-				addToResult(*mine)
-				previousOwner = &mine.Peer
 			case mine.Version < theirs.Version:
-				if mine.Peer == ourPeer { // We shouldn't receive updates to our own tokens
-					err = errNewerVersion(mine, theirs)
-					return
+				if mine.Peer == ourPeer {
+					// We received update to our own tokens accept the received entry
+					// if either it belongs to a different peer and we do not have allocations
+					// in the range effectively given away, or it belongs to our own peer, in
+					// which case we should set our version to the one received plus one,
+					// effectively imposing our existing entry.
+					if theirs.Peer != ourPeer && !hasAllocations(r.makeRanges(mine.Token, es.entry(i+1).Token)) {
+						common.Log.Infof("ring: repair inconsistent data by accepting token %v from %v - no allocations up to %v", theirs.Token, theirs.Peer, es.entry(i+1).Token)
+						addTheirs(*theirs)
+					} else if theirs.Peer == ourPeer {
+						mine.Version = theirs.Version + 1
+						addToResult(*mine)
+					} else {
+						err = errNewerVersion(mine, theirs)
+						return
+					}
+				} else {
+					addTheirs(*theirs)
 				}
-				addTheirs(*theirs)
 			}
 			i++
 			j++
@@ -334,6 +375,11 @@ func (r *Ring) Empty() bool {
 	return len(r.Entries) == 0
 }

+// convenience function to normalise a single range that may span zero
+func (r *Ring) makeRanges(start, end address.Address) []address.Range {
+	return r.splitRangesOverZero([]address.Range{{Start: start, End: end}})
+}
+
 // Given a slice of ranges which are all in the right order except
 // possibly the last one spans zero, fix that up and return the slice
 func (r *Ring) splitRangesOverZero(ranges []address.Range) []address.Range {
@@ -384,10 +430,7 @@ type RangeInfo struct {

 func (r *Ring) AllRangeInfo() (result []RangeInfo) {
 	for i, entry := range r.Entries {
-		nextEntry := r.Entries.entry(i + 1)
-		ranges := []address.Range{{Start: entry.Token, End: nextEntry.Token}}
-		ranges = r.splitRangesOverZero(ranges)
-		for _, r := range ranges {
+		for _, r := range r.makeRanges(entry.Token, r.Entries.entry(i+1).Token) {
 			result = append(result, RangeInfo{entry.Peer, r, entry.Version})
 		}
 	}
@@ -485,6 +528,7 @@ func (r *Ring) ReportFree(freespace map[address.Address]address.Count) (updated

 		entries[i].Free = free
 		entries[i].Version++
+		common.Log.Debugf("[ring %s]: ReportFree token=%s peer=%s version=%v", r.Peer, entries[i].Token, entries[i].Peer, entries[i].Version)
 		updated = true
 	}
 	return
@@ -516,7 +560,7 @@ func (r *Ring) ChoosePeersToAskForSpace(start, end address.Address) []mesh.PeerN
 			break
 		}
 		// Ignore ranges with no free space
-		if entry.Free <= 0 {
+		if entry.Free == 0 {
 			continue
 		}

@@ -565,7 +609,10 @@ func (r *Ring) Transfer(from, to mesh.PeerName) []address.Range {
 	for i, entry := range r.Entries {
 		if entry.Peer == from {
 			entry.Peer = to
-			entry.Version++
+			// bump version by large value so that transfer of range takes precedence (if there is any conflict in merging entry)
+			// over other opertaions on the entry that increments the version
+			entry.Version = entry.Version + 100
+			common.Log.Debugf("[ring %s]: Transfer token=%s from=%s to=%s version=%v", r.Peer, entry.Token, from, to, entry.Version)
 			newRanges = append(newRanges, address.Range{Start: entry.Token, End: r.Entries.entry(i + 1).Token})
 		}
 	}
@@ -32,7 +32,27 @@ func ParseIP(s string) address.Address {
 }

 func merge(r1, r2 *Ring) error {
-	_, err := r1.Merge(*r2)
+	distance := func(start, end address.Address) address.Count {
+		if end > start {
+			return address.Count(end - start)
+		}
+		return address.Count((r1.End - start) + (end - r1.Start))
+	}
+	check := func(rs []address.Range) bool {
+		for _, r := range rs {
+			size := distance(r.Start, r.End)
+			entry, found := r1.Entries.get(r.Start)
+			if !found {
+				continue
+			}
+			if entry.Free < size {
+				return true
+			}
+		}
+		return false
+	}
+
+	_, err := r1.Merge(*r2, check)
 	return err
 }

@@ -219,6 +239,61 @@ func TestMergeSimple(t *testing.T) {
 	require.Equal(t, ring2.Entries, ring1.Entries)
 }

+func TestMergeWithConflicts(t *testing.T) {
+
+	// received update to entry with a token and version identical to an entry we have
+	// but but holding different content, if there are no allocations, resolve the
+	// conflict by picking entry one with high free count
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 256, Version: 1}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}}
+	require.NoError(t, merge(ring1, ring2))
+
+	// received update to entry with a token and version identical to an entry we have
+	// but but holding different content, if there are allocations, then reject the received
+	// entry
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 128, Version: 1}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}}
+	require.Error(t, merge(ring1, ring2), "Expected error")
+
+	// received an entry with update to one of our own tokens and with new version,
+	// accept the received entry if its still going to belong to us
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Version: 1}}
+	require.NoError(t, merge(ring1, ring2))
+
+	// received an entry with update to one of our own tokens and with new version,
+	// but belongs to a different peer, accept the received entry if we do not
+	// have allocations in the range
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 256}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}}
+	require.NoError(t, merge(ring1, ring2))
+
+	// received an entry with update to one of our own tokens and with new version,
+	// reject received entry if we have allocations in the range
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 128}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Version: 1}}
+	require.Error(t, merge(ring1, ring2), "Expected error")
+
+	// we receive an entry that splits one of our ranges, giving some of it
+	// away to another peer. accept the entry provided that we have no allocations
+	// in the range that got given away.
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 256, Version: 1}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Free: 128, Version: 2}, {Token: middle, Peer: peer2name, Free: 128}}
+	require.NoError(t, merge(ring1, ring2))
+}
+
 func TestMergeErrors(t *testing.T) {
 	// Cannot Merge in an invalid ring
 	ring1 := NewRing(start, end, peer1name)
@@ -231,13 +306,6 @@ func TestMergeErrors(t *testing.T) {
 	ring2.Entries = []*entry{}
 	require.True(t, merge(ring1, ring2) == ErrDifferentRange, "Expected ErrDifferentRange")

-	// Cannot Merge newer version of entry I own
-	ring2 = NewRing(start, end, peer2name)
-	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
-	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Version: 1}}
-	fmt.Println(merge(ring1, ring2))
-	require.Error(t, merge(ring1, ring2), "Expected error")
-
 	// Cannot Merge two entries with same version but different hosts
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
 	ring2.Entries = []*entry{{Token: start, Peer: peer2name}}
@@ -73,7 +73,7 @@ func TestLowlevel(t *testing.T) {

 	// test Donate when addresses are scarce
 	s = New()
-	r, ok = s.Donate(address.NewRange(0, 1000))
+	_, ok = s.Donate(address.NewRange(0, 1000))
 	require.True(t, !ok, "donate on empty space should fail")
 	s.Add(0, 3)
 	require.NoError(t, s.Claim(0))
@@ -81,7 +81,7 @@ func TestLowlevel(t *testing.T) {
 	r, ok = s.Donate(address.NewRange(0, 1000))
 	require.True(t, ok, "donate")
 	require.Equal(t, address.NewRange(1, 1), r, "donate")
-	r, ok = s.Donate(address.NewRange(0, 1000))
+	_, ok = s.Donate(address.NewRange(0, 1000))
 	require.True(t, !ok, "donate should fail")
 }

@@ -24,14 +24,6 @@ func (m *mockMessage) String() string {
 	return fmt.Sprintf("-> %s [%x]", m.dst, m.buf)
 }

-func toStringArray(messages []mockMessage) []string {
-	out := make([]string, len(messages))
-	for i := range out {
-		out[i] = messages[i].String()
-	}
-	return out
-}
-
 type mockGossipComms struct {
 	sync.RWMutex
 	*testing.T
@@ -65,6 +57,9 @@ func (m *mockGossipComms) GossipBroadcast(update mesh.GossipData) {
 	}
 }

+func (m *mockGossipComms) GossipNeighbourSubset(update mesh.GossipData) {
+	m.GossipBroadcast(update)
+}
 func equalByteBuffer(a, b []byte) bool {
 	if len(a) != len(b) {
 		return false
@@ -97,14 +92,6 @@ func (m *mockGossipComms) GossipUnicast(dstPeerName mesh.PeerName, buf []byte) e
 	return nil
 }

-func ExpectMessage(alloc *Allocator, dst string, msgType byte, buf []byte) {
-	m := alloc.gossip.(*mockGossipComms)
-	dstPeerName, _ := mesh.PeerNameFromString(dst)
-	m.Lock()
-	m.messages = append(m.messages, mockMessage{dstPeerName, msgType, buf})
-	m.Unlock()
-}
-
 func ExpectBroadcastMessage(alloc *Allocator, buf []byte) {
 	m := alloc.gossip.(*mockGossipComms)
 	m.Lock()
@@ -205,15 +192,6 @@ func AssertNothingSent(t *testing.T, ch <-chan bool) {
 	}
 }

-func AssertNothingSentErr(t *testing.T, ch <-chan error) {
-	select {
-	case val := <-ch:
-		require.FailNow(t, fmt.Sprintf("Unexpected value on channel: %v", val))
-	default:
-		// no message received
-	}
-}
-
 func makeNetworkOfAllocators(size int, cidr string, preClaims ...[]PreClaim) ([]*Allocator, *gossip.TestRouter, address.CIDR) {
 	gossipRouter := gossip.NewTestRouter(0.0)
 	allocs := make([]*Allocator, size)
@@ -84,7 +84,7 @@ func NewAWSVPCTracker(bridgeName string) (*AWSVPCTracker, error) {
 func (t *AWSVPCTracker) HandleUpdate(prevRanges, currRanges []address.Range, local bool) error {
 	t.debugf("replacing %q by %q; local(%t)", prevRanges, currRanges, local)

-	prev, curr := removeCommon(address.NewCIDRs(merge(prevRanges)), address.NewCIDRs(merge(currRanges)))
+	prev, curr := address.RemoveCommon(address.NewCIDRs(address.Merge(prevRanges)), address.NewCIDRs(address.Merge(currRanges)))

 	// It might make sense to do the removal first and then add entries
 	// because of the 50 routes limit. However, in such case a container might
@@ -123,6 +123,10 @@ func (t *AWSVPCTracker) HandleUpdate(prevRanges, currRanges []address.Range, loc
 	return nil
 }

+func (t *AWSVPCTracker) String() string {
+	return "awsvpc"
+}
+
 func (t *AWSVPCTracker) createVPCRoute(cidr string) (*ec2.CreateRouteOutput, error) {
 	route := &ec2.CreateRouteInput{
 		RouteTableId:         &t.routeTableID,
@@ -232,47 +236,6 @@ func (t *AWSVPCTracker) infof(fmt string, args ...interface{}) {

 // Helpers

-// merge merges adjacent range entries.
-// The given slice has to be sorted in increasing order.
-func merge(r []address.Range) []address.Range {
-	var merged []address.Range
-
-	for i := range r {
-		if prev := len(merged) - 1; prev >= 0 && merged[prev].End == r[i].Start {
-			merged[prev].End = r[i].End
-		} else {
-			merged = append(merged, r[i])
-		}
-	}
-
-	return merged
-}
-
-// removeCommon filters out CIDR ranges which are contained in both a and b slices.
-// Both slices have to be sorted in increasing order.
-func removeCommon(a, b []address.CIDR) (newA, newB []address.CIDR) {
-	i, j := 0, 0
-
-	for i < len(a) && j < len(b) {
-		switch {
-		case a[i].Start() < b[j].Start() || a[i].End() < b[j].End():
-			newA = append(newA, a[i])
-			i++
-		case a[i].Start() > b[j].Start() || a[i].End() > b[j].End():
-			newB = append(newB, b[j])
-			j++
-		default:
-			i++
-			j++
-		}
-
-	}
-	newA = append(newA, a[i:]...)
-	newB = append(newB, b[j:]...)
-
-	return
-}
-
 func parseCIDR(cidr string) (*net.IPNet, error) {
 	ip, ipnet, err := net.ParseCIDR(cidr)
 	if err != nil {
@@ -1,52 +0,0 @@
-package tracker
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/weaveworks/weave/net/address"
-)
-
-var (
-	r0to127     = cidr("10.0.0.0", "10.0.0.127")
-	r128to255   = cidr("10.0.0.128", "10.0.0.255")
-	r0to255     = cidr("10.0.0.0", "10.0.0.255")
-	r1dot0to255 = cidr("10.0.1.0", "10.0.1.255")
-	r2dot0to255 = cidr("10.0.2.0", "10.0.2.255")
-)
-
-func TestRemoveCommon(t *testing.T) {
-	a := []address.CIDR{r0to127, r1dot0to255}
-	b := []address.CIDR{r1dot0to255, r2dot0to255}
-	newA, newB := removeCommon(a, b)
-	require.Equal(t, []address.CIDR{r0to127}, newA)
-	require.Equal(t, []address.CIDR{r2dot0to255}, newB)
-}
-
-func TestMerge(t *testing.T) {
-	ranges := []address.Range{
-		r0to127.Range(),
-		r128to255.Range(),
-		r2dot0to255.Range(),
-	}
-	require.Equal(t, []address.Range{r0to255.Range(), r2dot0to255.Range()}, merge(ranges))
-}
-
-// Helper
-
-// TODO(mp) DRY with helpers of other tests.
-
-func ip(s string) address.Address {
-	addr, _ := address.ParseIP(s)
-	return addr
-}
-
-// [start; end]
-func cidr(start, end string) address.CIDR {
-	c := address.Range{Start: ip(start), End: ip(end) + 1}.CIDRs()
-	if len(c) != 1 {
-		panic("invalid cidr")
-	}
-	return c[0]
-}
@@ -17,4 +17,7 @@ type LocalRangeTracker interface {
 	// The local parameter indicates whether the ranges belong to the peer
 	// by which the method is called.
 	HandleUpdate(prevRanges, currRanges []address.Range, local bool) error
+
+	// String returns the tracker name
+	String() string
 }
@@ -90,7 +90,7 @@ type DNSServer struct {
 	ns      *Nameserver
 	domain  string
 	ttl     uint32
-	address string
+	address string // listen address and port, e.g. 1.2.3.4:53

 	servers   []*dns.Server
 	upstream  Upstream
@@ -99,6 +99,10 @@ type DNSServer struct {
 }

 func NewDNSServer(ns *Nameserver, domain, address string, upstream Upstream, ttl uint32, clientTimeout time.Duration) (*DNSServer, error) {
+	if _, _, err := net.SplitHostPort(address); err != nil {
+		return nil, fmt.Errorf("invalid DNS listen address %q: %v", address, err)
+	}
+
 	s := &DNSServer{
 		ns:        ns,
 		domain:    dns.Fqdn(domain),
@@ -41,9 +41,7 @@ func TestTruncation(t *testing.T) {
 	defer dnsserver.Stop()

 	// Add 100 mappings to nameserver
-	addrs := []address.Address{}
 	for i := address.Address(0); i < 100; i++ {
-		addrs = append(addrs, i)
 		nameserver.AddEntry("foo.weave.local.", "", mesh.UnknownPeerName, i)
 	}

@@ -3,6 +3,7 @@ package nameserver
 import (
 	"encoding/json"
 	"fmt"
+	"net"
 	"net/http"

 	"github.com/gorilla/mux"
@@ -84,3 +85,13 @@ func (n *Nameserver) HandleHTTP(router *mux.Router, dockerCli *docker.Client) {
 		}
 	})
 }
+
+func (d *DNSServer) HandleHTTP(router *mux.Router) {
+	router.Methods("GET").Path("/dns-address-port").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, d.address)
+	})
+	router.Methods("GET").Path("/dns-address").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		host, _, _ := net.SplitHostPort(d.address) // address is validated in NewDNSServer()
+		fmt.Fprint(w, host)
+	})
+}
@@ -0,0 +1,42 @@
+package address
+
+// Merge merges adjacent range entries.
+// The given slice has to be sorted in increasing order.
+func Merge(r []Range) []Range {
+	var merged []Range
+
+	for i := range r {
+		if prev := len(merged) - 1; prev >= 0 && merged[prev].End == r[i].Start {
+			merged[prev].End = r[i].End
+		} else {
+			merged = append(merged, r[i])
+		}
+	}
+
+	return merged
+}
+
+// RemoveCommon filters out CIDR ranges which are contained in both a and b slices.
+// Both slices have to be sorted in increasing order.
+func RemoveCommon(a, b []CIDR) (newA, newB []CIDR) {
+	i, j := 0, 0
+
+	for i < len(a) && j < len(b) {
+		switch {
+		case a[i].Start() < b[j].Start() || a[i].End() < b[j].End():
+			newA = append(newA, a[i])
+			i++
+		case a[i].Start() > b[j].Start() || a[i].End() > b[j].End():
+			newB = append(newB, b[j])
+			j++
+		default:
+			i++
+			j++
+		}
+
+	}
+	newA = append(newA, a[i:]...)
+	newB = append(newB, b[j:]...)
+
+	return
+}
@@ -0,0 +1,43 @@
+package address
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	r0to127     = cidr2("10.0.0.0", "10.0.0.127")
+	r128to255   = cidr2("10.0.0.128", "10.0.0.255")
+	r0to255     = cidr2("10.0.0.0", "10.0.0.255")
+	r1dot0to255 = cidr2("10.0.1.0", "10.0.1.255")
+	r2dot0to255 = cidr2("10.0.2.0", "10.0.2.255")
+)
+
+func TestRemoveCommon(t *testing.T) {
+	a := []CIDR{r0to127, r1dot0to255}
+	b := []CIDR{r1dot0to255, r2dot0to255}
+	newA, newB := RemoveCommon(a, b)
+	require.Equal(t, []CIDR{r0to127}, newA)
+	require.Equal(t, []CIDR{r2dot0to255}, newB)
+}
+
+func TestMerge(t *testing.T) {
+	ranges := []Range{
+		r0to127.Range(),
+		r128to255.Range(),
+		r2dot0to255.Range(),
+	}
+	require.Equal(t, []Range{r0to255.Range(), r2dot0to255.Range()}, Merge(ranges))
+}
+
+// Helper
+
+// [start; end]
+func cidr2(start, end string) CIDR {
+	c := Range{Start: ip(start), End: ip(end) + 1}.CIDRs()
+	if len(c) != 1 {
+		panic("invalid cidr")
+	}
+	return c[0]
+}
@@ -10,7 +10,7 @@ import (
 // Configure the ARP cache parameters for the given interface.  This
 // makes containers react more quickly to a change in the MAC address
 // associated with an IP address.
-func ConfigureARPCache(procPath, name string) error {
+func configureARPCache(procPath, name string) error {
 	if err := sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/base_reachable_time", name), "5"); err != nil {
 		return err
 	}
@@ -41,3 +41,11 @@ func sysctl(procPath, variable, value string) error {

 	return nil
 }
+
+func sysctlIfExists(procPath, variable, value string) error {
+	err := sysctl(procPath, variable, value)
+	if err != nil && os.IsNotExist(err) {
+		err = nil // ignore 'not found' errors
+	}
+	return err
+}
@@ -5,13 +5,18 @@ import (
 	"io/ioutil"
 	"net"
 	"path/filepath"
+	"syscall"

-	"github.com/Sirupsen/logrus"
 	"github.com/coreos/go-iptables/iptables"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 	"github.com/vishvananda/netlink"

+	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/common/chains"
 	"github.com/weaveworks/weave/common/odp"
+	"github.com/weaveworks/weave/net/address"
+	"github.com/weaveworks/weave/net/ipset"
 )

 /* This code implements three possible configurations to connect
@@ -47,18 +52,19 @@ datapath of old kernel versions (https://github.com/weaveworks/weave/issues/1577
 */

 const (
-	WeaveBridgeName = "weave"
-	DatapathName    = "datapath"
-	DatapathIfName  = "vethwe-datapath"
-	BridgeIfName    = "vethwe-bridge"
-	PcapIfName      = "vethwe-pcap"
+	WeaveBridgeName  = "weave"
+	DatapathName     = "datapath"
+	DatapathIfName   = "vethwe-datapath"
+	BridgeIfName     = "vethwe-bridge"
+	PcapIfName       = "vethwe-pcap"
+	NoMasqLocalIpset = ipset.Name("weaver-no-masq-local")
 )

 type Bridge interface {
-	init(config *BridgeConfig) error // create and initialise bridge device(s)
-	attach(veth *netlink.Veth) error // attach veth to bridge
-	IsFastdp() bool                  // does this bridge use fastdp?
-	String() string                  // human-readable type string
+	init(procPath string, config *BridgeConfig) error // create and initialise bridge device(s)
+	attach(veth *netlink.Veth) error                  // attach veth to bridge
+	IsFastdp() bool                                   // does this bridge use fastdp?
+	String() string                                   // human-readable type string
 }

 // Used to indicate a fallback to the Bridge type
@@ -213,6 +219,8 @@ type BridgeConfig struct {
 	MTU              int
 	Mac              string
 	Port             int
+	ControlPort      string
+	NoMasqLocal      bool
 }

 func (config *BridgeConfig) configuredBridgeType() Bridge {
@@ -226,7 +234,7 @@ func (config *BridgeConfig) configuredBridgeType() Bridge {
 	}
 }

-func EnsureBridge(procPath string, config *BridgeConfig, log *logrus.Logger) (Bridge, error) {
+func EnsureBridge(procPath string, config *BridgeConfig, log *logrus.Logger, ips ipset.Interface) (Bridge, error) {
 	existingBridgeType, err := ExistingBridgeType(config.WeaveBridgeName, config.DatapathName)
 	if err != nil {
 		return nil, err
@@ -241,7 +249,7 @@ func EnsureBridge(procPath string, config *BridgeConfig, log *logrus.Logger) (Br
 	}

 	for {
-		if err := bridgeType.init(config); err != nil {
+		if err := bridgeType.init(procPath, config); err != nil {
 			if errors.Cause(err) == errBridgeNotSupported {
 				log.Warnf("Skipping bridge creation of %q due to: %s", bridgeType, err)
 				bridgeType = bridgeImpl{}
@@ -252,7 +260,7 @@ func EnsureBridge(procPath string, config *BridgeConfig, log *logrus.Logger) (Br
 		break
 	}

-	if err := configureIPTables(config); err != nil {
+	if err := ConfigureIPTables(config, ips); err != nil {
 		return bridgeType, errors.Wrap(err, "configuring iptables")
 	}

@@ -270,15 +278,27 @@ func EnsureBridge(procPath string, config *BridgeConfig, log *logrus.Logger) (Br
 			return bridgeType, errors.Wrap(err, "setting proxy_arp")
 		}
 	}
+	// No ipv6 router advertisments please
+	if err := sysctlIfExists(procPath, "net/ipv6/conf/"+config.WeaveBridgeName+"/accept_ra", "0"); err != nil {
+		return bridgeType, errors.Wrap(err, "setting accept_ra to 0")
+	}

 	if err := linkSetUpByName(config.WeaveBridgeName); err != nil {
 		return bridgeType, err
 	}

-	if err := ConfigureARPCache(procPath, config.WeaveBridgeName); err != nil {
+	if err := monitorInterface(config.WeaveBridgeName, log); err != nil {
+		return bridgeType, err
+	}
+
+	if err := configureARPCache(procPath, config.WeaveBridgeName); err != nil {
 		return bridgeType, errors.Wrapf(err, "configuring ARP cache on bridge %q", config.WeaveBridgeName)
 	}

+	if err := Reexpose(config, log); err != nil {
+		return bridgeType, err
+	}
+
 	return bridgeType, nil
 }

@@ -290,7 +310,10 @@ func (b bridgeImpl) initPrep(config *BridgeConfig) error {

 	linkAttrs := netlink.NewLinkAttrs()
 	linkAttrs.Name = config.WeaveBridgeName
-	linkAttrs.HardwareAddr = mac
+	// NB: Do not set MAC addr when creating the bridge, set it manually
+	// afterwards instead. Otherwise, on an older than 3.14 kernel FDB
+	// entry won't be created which results in containers not being able to
+	// reach the bridge w/o promiscuous mode.
 	if config.MTU == 0 {
 		config.MTU = 65535
 	}
@@ -323,11 +346,11 @@ func (b bridgeImpl) initPrep(config *BridgeConfig) error {
 	return nil
 }

-func (b bridgeImpl) init(config *BridgeConfig) error {
+func (b bridgeImpl) init(procPath string, config *BridgeConfig) error {
 	if err := b.initPrep(config); err != nil {
 		return err
 	}
-	if _, err := CreateAndAttachVeth(BridgeIfName, PcapIfName, config.WeaveBridgeName, config.MTU, true, false, func(veth netlink.Link) error {
+	if _, err := CreateAndAttachVeth(procPath, BridgeIfName, PcapIfName, config.WeaveBridgeName, config.MTU, true, false, func(veth netlink.Link) error {
 		return netlink.LinkSetUp(veth)
 	}); err != nil {
 		return errors.Wrap(err, "creating pcap veth pair")
@@ -339,7 +362,7 @@ func (b bridgeImpl) init(config *BridgeConfig) error {
 	return nil
 }

-func (f fastdpImpl) init(config *BridgeConfig) error {
+func (f fastdpImpl) init(procPath string, config *BridgeConfig) error {
 	odpSupported, err := odp.CreateDatapath(f.datapathName)
 	if !odpSupported {
 		msg := ""
@@ -370,14 +393,14 @@ func (f fastdpImpl) init(config *BridgeConfig) error {
 	return nil
 }

-func (bf bridgedFastdpImpl) init(config *BridgeConfig) error {
-	if err := bf.fastdpImpl.init(config); err != nil {
+func (bf bridgedFastdpImpl) init(procPath string, config *BridgeConfig) error {
+	if err := bf.fastdpImpl.init(procPath, config); err != nil {
 		return err
 	}
 	if err := bf.bridgeImpl.initPrep(config); err != nil {
 		return err
 	}
-	if _, err := CreateAndAttachVeth(BridgeIfName, DatapathIfName, config.WeaveBridgeName, config.MTU, true, false, func(veth netlink.Link) error {
+	if _, err := CreateAndAttachVeth(procPath, BridgeIfName, DatapathIfName, config.WeaveBridgeName, config.MTU, true, false, func(veth netlink.Link) error {
 		if err := netlink.LinkSetUp(veth); err != nil {
 			return errors.Wrapf(err, "setting link up on %q", veth.Attrs().Name)
 		}
@@ -404,10 +427,40 @@ func (f fastdpImpl) attach(veth *netlink.Veth) error {
 	return odp.AddDatapathInterfaceIfNotExist(f.datapathName, veth.Attrs().Name)
 }

-func configureIPTables(config *BridgeConfig) error {
+// ResetIPTables resets IPTables in case they're in a strange state from a previous run.
+func ResetIPTables(config *BridgeConfig, ips ipset.Interface) error {
 	ipt, err := iptables.New()
 	if err != nil {
-		return errors.Wrap(err, "creating iptables object")
+		return errors.Wrap(err, "creating iptables object while resetting")
+	}
+
+	if !config.NPC {
+		// Create/Flush a chain for allowing ingress traffic when the bridge is exposed
+		if err := ipt.ClearChain("filter", "WEAVE-EXPOSE"); err != nil {
+			return errors.Wrap(err, "failed to clear/create filter/WEAVE-EXPOSE chain")
+		}
+	}
+
+	if err := ipt.ClearChain("nat", "WEAVE"); err != nil {
+		return errors.Wrap(err, "failed to clear/create nat/WEAVE chain")
+	}
+
+	if config.NoMasqLocal {
+		ips := ipset.New(common.LogLogger(), 0)
+		_ = ips.Destroy(NoMasqLocalIpset)
+		if err := ips.Create(NoMasqLocalIpset, ipset.HashNet); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// ConfigureIPTables idempotently configures all the iptables!
+func ConfigureIPTables(config *BridgeConfig, ips ipset.Interface) error {
+	ipt, err := iptables.New()
+	if err != nil {
+		return errors.Wrap(err, "creating iptables object while configuring")
 	}

 	// The order among weave filter/FORWARD rules is important!
@@ -443,15 +496,40 @@ func configureIPTables(config *BridgeConfig) error {
 		}
 	}

+	if config.ControlPort != "" {
+		if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "--dport", config.ControlPort,
+			"-m", "addrtype", "!", "--src-type", "LOCAL",
+			"-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED",
+			"-m", "comment", "--comment", "Block non-local access to Weave Net control port",
+			"-j", "DROP"); err != nil {
+			return err
+		}
+	}
+	// Remove the rule from Weave Net 2.6.3 which dropped too much.
+	_ = ipt.Delete("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP")
+
 	if config.NPC {
-		// Steer traffic via the NPC
-		_ = ipt.NewChain("filter", "WEAVE-NPC") // ignore error because it might already exist
-		// If WEAVE-NPC chain doesn't exist then creating a rule in the chain will fail
+		// Steer traffic via the NPC.
+
+		if err = ensureChains(ipt, "filter", chains.MainChain, chains.EgressChain); err != nil {
+			return err
+		}
+
+		// Steer egress traffic destined to local node.
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", chains.EgressChain); err != nil {
+			return err
+		}
 		fwdRules = append(fwdRules,
 			[][]string{
+				// Might include ingress traffic which is fine as long as we do not
+				// ACCEPT in WEAVE-NPC-EGRESS chain
+				{"-i", config.WeaveBridgeName,
+					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
+					"-j", chains.EgressChain},
+				// The following rules are for ingress NPC processing
 				{"-o", config.WeaveBridgeName,
 					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
-					"-j", "WEAVE-NPC"},
+					"-j", chains.MainChain},
 				{"-o", config.WeaveBridgeName, "-m", "state", "--state", "NEW", "-j", "NFLOG", "--nflog-group", "86"},
 				{"-o", config.WeaveBridgeName, "-j", "DROP"},
 			}...)
@@ -462,8 +540,11 @@ func configureIPTables(config *BridgeConfig) error {
 	}

 	if !config.NPC {
-		// Create a chain for allowing ingress traffic when the bridge is exposed
-		_ = ipt.NewChain("filter", "WEAVE-EXPOSE")
+		// Create/Flush a chain for allowing ingress traffic when the bridge is exposed
+		if err := ensureChains(ipt, "filter", "WEAVE-EXPOSE"); err != nil {
+			return errors.Wrap(err, "failed to ensure existence of filter/WEAVE-EXPOSE chain")
+		}
+
 		fwdRules = append(fwdRules, []string{"-o", config.WeaveBridgeName, "-j", "WEAVE-EXPOSE"})
 	}

@@ -476,13 +557,70 @@ func configureIPTables(config *BridgeConfig) error {
 		return err
 	}

-	// create a chain for masquerading
-	//
-	// NB: we do not clear the chain to preserve existing rules
-	// inserted by "weave expose".
-	_ = ipt.NewChain("nat", "WEAVE")
+	// Create a chain for masquerading
+	if err := ensureChains(ipt, "nat", "WEAVE"); err != nil {
+		return errors.Wrap(err, "failed to ensure existence of nat/WEAVE chain")
+	}
+	if err := ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE"); err != nil {
+		return err
+	}

-	return ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE")
+	// For the cases where the weave bridge is the default gateway for
+	// containers (e.g. Kubernetes): In `ResetIPTables` (which we assume
+	// to have been called at this point) we create an ipset to store CIDRs
+	// allocated by IPAM for local containers.
+	// In the case of Kubernetes, external traffic sent to these CIDRs
+	// avoids SNAT'ing so that NodePort with `"externalTrafficPolicy":"Local"`
+	// would receive packets with correct src IP addr.
+	if config.NoMasqLocal {
+		if err := ipt.AppendUnique("nat", "WEAVE",
+			"-m", "set", "--match-set", string(NoMasqLocalIpset), "dst",
+			"-m", "comment", "--comment", "Prevent SNAT to locally running containers",
+			"-j", "RETURN"); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+type NoMasqLocalTracker struct {
+	ips   ipset.Interface
+	owner ipset.UID
+}
+
+func NewNoMasqLocalTracker(ips ipset.Interface) *NoMasqLocalTracker {
+	return &NoMasqLocalTracker{
+		ips:   ips,
+		owner: ipset.UID("0"), // dummy ipset owner
+	}
+}
+
+func (t *NoMasqLocalTracker) String() string {
+	return "no-masq-local"
+}
+
+func (t *NoMasqLocalTracker) HandleUpdate(prevRanges, currRanges []address.Range, local bool) error {
+	if !local {
+		return nil
+	}
+
+	prev, curr := address.RemoveCommon(
+		address.NewCIDRs(address.Merge(prevRanges)),
+		address.NewCIDRs(address.Merge(currRanges)))
+
+	for _, cidr := range curr {
+		if err := t.ips.AddEntry(t.owner, NoMasqLocalIpset, cidr.String(), ""); err != nil {
+			return err
+		}
+	}
+	for _, cidr := range prev {
+		if err := t.ips.DelEntry(t.owner, NoMasqLocalIpset, cidr.String()); err != nil {
+			return err
+		}
+	}
+
+	return nil
 }

 func linkSetUpByName(linkName string) error {
@@ -493,39 +631,49 @@ func linkSetUpByName(linkName string) error {
 	return netlink.LinkSetUp(link)
 }

-// ensureRulesAtTop ensures the presence of given iptables rules.
-//
-// If any rule from the list is missing, the function deletes all given
-// rules and re-inserts them at the top of the chain to ensure the order of the rules.
-func ensureRulesAtTop(table, chain string, rulespecs [][]string, ipt *iptables.IPTables) error {
-	allFound := true
-
-	for _, rs := range rulespecs {
-		found, err := ipt.Exists(table, chain, rs...)
-		if err != nil {
-			return errors.Wrapf(err, "ipt.Exists(%s, %s, %s)", table, chain, rs)
-		}
-		if !found {
-			allFound = false
-			break
-		}
+func Reexpose(config *BridgeConfig, log *logrus.Logger) error {
+	// Get existing IP addrs of the weave bridge.
+	// If the bridge hasn't been exposed, then this functions does nothing.
+	//
+	// Ideally, we should consult IPAM for IP addrs allocated to "weave:expose",
+	// but we don't want to introduce dependency on IPAM, as weave should be able
+	// to run w/o IPAM.
+	link, err := netlink.LinkByName(config.WeaveBridgeName)
+	if err != nil {
+		return errors.Wrapf(err, "cannot find bridge %q", config.WeaveBridgeName)
+	}
+	addrs, err := netlink.AddrList(link, netlink.FAMILY_V4)
+	if err != nil {
+		return errors.Wrapf(err, "cannot list IPv4 addrs of bridge %q", config.WeaveBridgeName)
 	}

-	// All rules exist, do nothing.
-	if allFound {
-		return nil
-	}
-
-	for pos, rs := range rulespecs {
-		// If any is missing, then delete all, as we need to preserve the order of
-		// given rules. Ignore errors, as rule might not exist.
-		if !allFound {
-			ipt.Delete(table, chain, rs...)
-		}
-		if err := ipt.Insert(table, chain, pos+1, rs...); err != nil {
-			return errors.Wrapf(err, "ipt.Append(%s, %s, %s)", table, chain, rs)
+	for _, addr := range addrs {
+		log.Infof("Re-exposing %s on bridge %q", addr.IPNet, config.WeaveBridgeName)
+		if err := Expose(config.WeaveBridgeName, addr.IPNet, config.AWSVPC, config.NPC, false); err != nil {
+			return errors.Wrapf(err, "unable to re-expose %s on bridge: %q", addr.IPNet, config.WeaveBridgeName)
 		}
 	}

 	return nil
 }
+
+func monitorInterface(ifaceName string, log *logrus.Logger) error {
+	_, err := netlink.LinkByName(ifaceName)
+	if err != nil {
+		return fmt.Errorf("Unable to find link %q: %s", ifaceName, err)
+	}
+
+	updatesChannel := make(chan netlink.LinkUpdate)
+	if err := netlink.LinkSubscribe(updatesChannel, nil); err != nil {
+		return errors.Wrapf(err, "error monitoring link %q for UP/DOWN notifications", ifaceName)
+	}
+
+	go func() {
+		for update := range updatesChannel {
+			if update.Link.Attrs().Name == ifaceName && update.IfInfomsg.Flags&syscall.IFF_UP == 0 {
+				log.Errorf("Interface %q which needs to be in UP state for Weave functioning is found to be in DOWN state", ifaceName)
+			}
+		}
+	}()
+	return nil
+}
@@ -18,7 +18,8 @@ import (
 // * "ipAddr" - IP addr to be assigned to the bridge.
 // * "removeDefaultRoute" - whether to remove a default route installed by the kernel (used only in the AWSVPC mode).
 // * "npc" - whether is Weave NPC running.
-func Expose(bridgeName string, ipAddr *net.IPNet, removeDefaultRoute, npc bool) error {
+// * "skipNAT" - whether to skip adding iptables NAT rules
+func Expose(bridgeName string, ipAddr *net.IPNet, removeDefaultRoute, npc bool, skipNAT bool) error {
 	ipt, err := iptables.New()
 	if err != nil {
 		return errors.Wrap(err, "iptables.New")
@@ -29,8 +30,10 @@ func Expose(bridgeName string, ipAddr *net.IPNet, removeDefaultRoute, npc bool)
 		return errors.Wrap(err, "addBridgeIPAddr")
 	}

-	if err := exposeNAT(ipt, cidr); err != nil {
-		return errors.Wrap(err, "exposeNAT")
+	if !skipNAT {
+		if err := exposeNAT(ipt, cidr); err != nil {
+			return errors.Wrap(err, "exposeNAT")
+		}
 	}

 	if !npc {
@@ -100,13 +103,8 @@ func addNatRule(ipt *iptables.IPTables, rulespec ...string) error {
 	// Loop until we get an exit code other than "temporarily unavailable"
 	for {
 		if err := ipt.AppendUnique("nat", "WEAVE", rulespec...); err != nil {
-			if ierr, ok := err.(*iptables.Error); ok {
-				if status, ok := ierr.ExitError.Sys().(syscall.WaitStatus); ok {
-					// (magic exit code 4 found in iptables source code; undocumented)
-					if status.ExitStatus() == 4 {
-						continue
-					}
-				}
+			if isResourceError(err) {
+				continue
 			}
 			return err
 		}
@@ -12,9 +12,9 @@ import (
 	"sync"
 	"syscall"

-	"github.com/Sirupsen/logrus"
 	"github.com/coreos/go-iptables/iptables"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 	"github.com/vishvananda/netlink"
 	"golang.org/x/crypto/hkdf"

@@ -85,7 +85,7 @@ func New(log *logrus.Logger) (*IPSec, error) {

 // InitSALocal initializes inbound ipsec from remotePeer and triggers
 // the initialization on remotePeer.
-func (ipsec *IPSec) InitSALocal(localPeer, remotePeer mesh.PeerName, connUID uint64, localIP, remoteIP net.IP, udpPort int, sessionKey *[32]byte, initRemote func([]byte) error) error {
+func (ipsec *IPSec) InitSALocal(localPeer, remotePeer mesh.PeerName, connUID uint64, localIP, remoteIP net.IP, udpPort int, sessionKey *[32]byte) ([]byte, error) {
 	// ID of inbound SPI
 	spiID := getSPIId(remotePeer, localPeer, connUID)

@@ -95,17 +95,17 @@ func (ipsec *IPSec) InitSALocal(localPeer, remotePeer mesh.PeerName, connUID uin
 	// Derive SA key
 	nonce, err := genNonce()
 	if err != nil {
-		return errors.Wrap(err, "generate nonce")
+		return nil, errors.Wrap(err, "generate nonce")
 	}
 	key, err := deriveKey(sessionKey[:], nonce, localPeer)
 	if err != nil {
-		return errors.Wrap(err, "derive key")
+		return nil, errors.Wrap(err, "derive key")
 	}

 	// Allocate SA
 	sa, err := netlink.XfrmStateAllocSpi(xfrmAllocSpiState(remoteIP, localIP))
 	if err != nil {
-		return errors.Wrap(err, fmt.Sprintf("ip xfrm state allocspi (in, %s, %s)", remoteIP, localIP))
+		return nil, errors.Wrap(err, fmt.Sprintf("ip xfrm state allocspi (in, %s, %s)", remoteIP, localIP))
 	}

 	// Use SPI generated by the kernel. The kernel ensures {dstIP, spi} to
@@ -117,28 +117,24 @@ func (ipsec *IPSec) InitSALocal(localPeer, remotePeer mesh.PeerName, connUID uin
 	// Create SA
 	if sa, err := xfrmState(remoteIP, localIP, spi, false, key); err == nil {
 		if err := netlink.XfrmStateUpdate(sa); err != nil {
-			return errors.Wrap(err, fmt.Sprintf("xfrm state update (in, %s, %s, 0x%x)", sa.Src, sa.Dst, sa.Spi))
+			return nil, errors.Wrap(err, fmt.Sprintf("xfrm state update (in, %s, %s, 0x%x)", sa.Src, sa.Dst, sa.Spi))
 		}
 	} else {
-		return errors.Wrap(err, "new xfrm state (in)")
+		return nil, errors.Wrap(err, "new xfrm state (in)")
 	}

 	// Install iptables rules
 	if err := ipsec.installDropNonEncrypted(localIP, remoteIP, udpPort, spi); err != nil {
-		return errors.Wrap(err, fmt.Sprintf("install protecting rules (%s, %s, %d, 0x%x)", localIP, remoteIP, udpPort, spi))
+		return nil, errors.Wrap(err, fmt.Sprintf("install protecting rules (%s, %s, %d, 0x%x)", localIP, remoteIP, udpPort, spi))
 	}

 	si := spiInfo{spi: spi, isDirOut: false}
 	ipsec.spiInfo[spiID] = si
 	ipsec.spis[spi] = &si

-	// Trigger the initialization on the remote peer
+	// Generate the message to trigger initialization on the remote peer
 	msg := &msgInitSARemote{nonce, spi}
-	if err := initRemote(msg.serialize()); err != nil {
-		return errors.Wrap(err, "send InitSARemote")
-	}
-
-	return nil
+	return msg.serialize(), nil
 }

 // InitSARemote initializes outbound ipsec to remotePeer.
@@ -223,9 +219,19 @@ func (ipsec *IPSec) Destroy(localPeer, remotePeer mesh.PeerName, connUID uint64,

 	if outSPIInfo, ok := ipsec.spiInfo[outSPIID]; ok {
 		ipsec.log.Infof("ipsec: destroy: out %s -> %s 0x%x", localIP, remoteIP, outSPIInfo.spi)
-
-		if err := netlink.XfrmPolicyDel(xfrmPolicy(localIP, remoteIP, outSPIInfo.spi)); err != nil {
-			ipsec.log.Warnf("ipsec: xfrm policy del (%s, %s, 0x%x) failed: %s", localIP, remoteIP, outSPIInfo.spi, err)
+		policy, err := netlink.XfrmPolicyGet(xfrmPolicy(localIP, remoteIP, outSPIInfo.spi))
+		if err != nil {
+			ipsec.log.Warnf("ipsec: xfrm policy get (%s, %s, 0x%x) failed: %s", localIP, remoteIP, outSPIInfo.spi, err)
+		} else {
+			if len(policy.Tmpls) == 1 {
+				if policy.Tmpls[0].Spi == int(outSPIInfo.spi) {
+					if err := netlink.XfrmPolicyDel(xfrmPolicy(localIP, remoteIP, outSPIInfo.spi)); err != nil {
+						ipsec.log.Warnf("ipsec: xfrm policy del (%s, %s, 0x%x) failed: %s", localIP, remoteIP, outSPIInfo.spi, err)
+					}
+				} else {
+					ipsec.log.Debugf("ipsec: xfrm not my policy (%s, %s, 0x%x) got 0x%x ", localIP, remoteIP, outSPIInfo.spi, policy.Tmpls[0].Spi)
+				}
+			}
 		}

 		outSA := &netlink.XfrmState{
@@ -424,14 +430,6 @@ func (ipsec *IPSec) removeDropNonEncrypted(srcIP, dstIP net.IP, udpPort int, inS
 	return ipsec.resetRules(rules, true)
 }

-func (ipsec *IPSec) removeDropNonEncryptedInbound(srcIP, dstIP net.IP, inSPI SPI) error {
-	r := ruleMarkInboundESP(srcIP, dstIP, inSPI)
-	if err := ipsec.ipt.Delete(r.table, r.chain, r.rulespec...); err != nil {
-		return errors.Wrap(err, fmt.Sprintf("iptables delete unique (%s, %s, %s)", r.table, r.chain, r.rulespec))
-	}
-	return nil
-}
-
 // xfrm

 func xfrmAllocSpiState(srcIP, dstIP net.IP) *netlink.XfrmState {
@@ -1,28 +1,37 @@
 package ipset

 import (
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
 	"log"
 	"os/exec"
 	"strings"
+	"time"

 	"github.com/pkg/errors"
-	"k8s.io/apimachinery/pkg/types"
 )

 type Name string

 type Type string

+type UID string
+
 const (
 	ListSet = Type("list:set")
 	HashIP  = Type("hash:ip")
+	HashNet = Type("hash:net")
+
+	DestroyRetrySleepMs = 100
 )

 type Interface interface {
 	Create(ipsetName Name, ipsetType Type) error
-	AddEntry(user types.UID, ipsetName Name, entry string, comment string) error
-	DelEntry(user types.UID, ipsetName Name, entry string) error
-	Exist(user types.UID, ipsetName Name, entry string) bool
+	AddEntry(user UID, ipsetName Name, entry string, comment string) error
+	DelEntry(user UID, ipsetName Name, entry string) error
+	EntryExists(user UID, ipsetName Name, entry string) bool
+	Exists(ipsetName Name) (bool, error)
 	Flush(ipsetName Name) error
 	Destroy(ipsetName Name) error

@@ -40,22 +49,31 @@ type entryKey struct {
 type ipset struct {
 	*log.Logger
 	enableComments bool
+	maxListSize    int
 	// List of users per ipset entry. User is either a namespace or a pod.
 	// There might be multiple users for the same ipset & entry pair because
 	// events from k8s API server might be out of order causing duplicate IPs:
 	// https://github.com/weaveworks/weave/issues/2792.
-	users map[entryKey]map[types.UID]struct{}
+	users map[entryKey]map[UID]struct{}
 }

-func New(logger *log.Logger) Interface {
+func New(logger *log.Logger, maxListSize int) Interface {
 	ips := &ipset{
 		Logger:         logger,
 		enableComments: true,
-		users:          make(map[entryKey]map[types.UID]struct{}),
+		maxListSize:    maxListSize,
+		users:          make(map[entryKey]map[UID]struct{}),
 	}

 	// Check for comment support
-	testIpsetName := Name("weave-test-comment")
+
+	// To prevent from a race when more than one process check for the support
+	// we append a random nonce to the test ipset name. The final name is
+	// shorter than 31 chars (max ipset name).
+	nonce := make([]byte, 4)
+	rand.Read(nonce)
+	testIpsetName := Name("weave-test-comment" + hex.EncodeToString(nonce))
+
 	// Clear it out if it already exists
 	_ = ips.Destroy(testIpsetName)
 	// Test for comment support
@@ -71,13 +89,16 @@ func New(logger *log.Logger) Interface {

 func (i *ipset) Create(ipsetName Name, ipsetType Type) error {
 	args := []string{"create", string(ipsetName), string(ipsetType)}
+	if ipsetType == ListSet && i.maxListSize > 0 {
+		args = append(args, "size", fmt.Sprintf("%d", i.maxListSize))
+	}
 	if i.enableComments {
 		args = append(args, "comment")
 	}
 	return doExec(args...)
 }

-func (i *ipset) AddEntry(user types.UID, ipsetName Name, entry string, comment string) error {
+func (i *ipset) AddEntry(user UID, ipsetName Name, entry string, comment string) error {
 	i.Logger.Printf("adding entry %s to %s of %s", entry, ipsetName, user)

 	if !i.addUser(user, ipsetName, entry) { // already in the set
@@ -93,7 +114,7 @@ func (i *ipset) AddEntry(user types.UID, ipsetName Name, entry string, comment s
 	return doExec(args...)
 }

-func (i *ipset) DelEntry(user types.UID, ipsetName Name, entry string) error {
+func (i *ipset) DelEntry(user UID, ipsetName Name, entry string) error {
 	i.Logger.Printf("deleting entry %s from %s of %s", entry, ipsetName, user)

 	if !i.delUser(user, ipsetName, entry) { // still needed
@@ -105,28 +126,52 @@ func (i *ipset) DelEntry(user types.UID, ipsetName Name, entry string) error {
 	return doExec("del", string(ipsetName), entry)
 }

-func (i *ipset) Exist(user types.UID, ipsetName Name, entry string) bool {
+func (i *ipset) EntryExists(user UID, ipsetName Name, entry string) bool {
 	return i.existUser(user, ipsetName, entry)
 }

+// Dummy way to check whether a given ipset exists.
+func (i *ipset) Exists(name Name) (bool, error) {
+	sets, err := i.List(string(name))
+	if err != nil {
+		return false, err
+	}
+	for _, s := range sets {
+		if s == name {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 func (i *ipset) Flush(ipsetName Name) error {
 	i.removeSetFromUsers(ipsetName)
 	return doExec("flush", string(ipsetName))
 }

 func (i *ipset) FlushAll() error {
-	i.users = make(map[entryKey]map[types.UID]struct{})
+	i.users = make(map[entryKey]map[UID]struct{})
 	return doExec("flush")
 }

 func (i *ipset) Destroy(ipsetName Name) error {
 	i.removeSetFromUsers(ipsetName)
-	return doExec("destroy", string(ipsetName))
+	err := doExec("destroy", string(ipsetName))
+	if err != nil {
+		time.Sleep(DestroyRetrySleepMs * time.Millisecond)
+		return doExec("destroy", string(ipsetName))
+	}
+	return err
 }

 func (i *ipset) DestroyAll() error {
-	i.users = make(map[entryKey]map[types.UID]struct{})
-	return doExec("destroy")
+	i.users = make(map[entryKey]map[UID]struct{})
+	err := doExec("destroy")
+	if err != nil {
+		time.Sleep(DestroyRetrySleepMs * time.Millisecond)
+		return doExec("destroy")
+	}
+	return err
 }

 // Fetch a list of all existing sets with a given prefix
@@ -148,12 +193,12 @@ func (i *ipset) List(prefix string) ([]Name, error) {
 }

 // Returns true if entry does not exist in ipset (entry has to be inserted into ipset).
-func (i *ipset) addUser(user types.UID, ipsetName Name, entry string) bool {
+func (i *ipset) addUser(user UID, ipsetName Name, entry string) bool {
 	k := entryKey{ipsetName, entry}
 	add := false

 	if i.users[k] == nil {
-		i.users[k] = make(map[types.UID]struct{})
+		i.users[k] = make(map[UID]struct{})
 	}
 	if len(i.users[k]) == 0 {
 		add = true
@@ -164,7 +209,7 @@ func (i *ipset) addUser(user types.UID, ipsetName Name, entry string) bool {
 }

 // Returns true if user is the last owner of entry (entry has to be removed from ipset).
-func (i *ipset) delUser(user types.UID, ipsetName Name, entry string) bool {
+func (i *ipset) delUser(user UID, ipsetName Name, entry string) bool {
 	k := entryKey{ipsetName, entry}

 	oneLeft := len(i.users[k]) == 1
@@ -177,7 +222,7 @@ func (i *ipset) delUser(user types.UID, ipsetName Name, entry string) bool {
 	return oneLeft && (len(i.users[k]) == 0)
 }

-func (i *ipset) existUser(user types.UID, ipsetName Name, entry string) bool {
+func (i *ipset) existUser(user UID, ipsetName Name, entry string) bool {
 	_, ok := i.users[entryKey{ipsetName, entry}][user]
 	return ok
 }
@@ -0,0 +1,226 @@
+package net
+
+import (
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/coreos/go-iptables/iptables"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	utilwait "k8s.io/apimachinery/pkg/util/wait"
+)
+
+// AddChainWithRules creates a chain and appends given rules to it.
+//
+// If the chain exists, but its rules are not the same as the given ones, the
+// function will flush the chain and then will append the rules.
+func AddChainWithRules(ipt *iptables.IPTables, table, chain string, rulespecs [][]string) error {
+	if err := ensureChains(ipt, table, chain); err != nil {
+		return err
+	}
+
+	currRuleSpecs, err := ipt.List(table, chain)
+	if err != nil {
+		return errors.Wrapf(err, "iptables -S. table: %q, chain: %q", table, chain)
+	}
+
+	// First returned rule is "-N $(chain)", so ignore it
+	currRules := strings.Join(currRuleSpecs[1:], "\n")
+	rules := make([]string, 0)
+	for _, r := range rulespecs {
+		rules = append(rules, strings.Join(r, " "))
+	}
+	reqRules := strings.Join(rules, "\n")
+
+	if currRules == reqRules {
+		return nil
+	}
+
+	if err := ipt.ClearChain(table, chain); err != nil {
+		return err
+	}
+
+	for _, r := range rulespecs {
+		if err := ipt.Append(table, chain, r...); err != nil {
+			return errors.Wrapf(err, "iptables -A. table: %q, chain: %q, rule: %s", table, chain, r)
+		}
+	}
+
+	return nil
+}
+
+// ensureChains creates given chains if they do not exist.
+func ensureChains(ipt *iptables.IPTables, table string, chains ...string) error {
+	existingChains, err := ipt.ListChains(table)
+	if err != nil {
+		return errors.Wrapf(err, "ipt.ListChains(%s)", table)
+	}
+	chainMap := make(map[string]struct{})
+	for _, c := range existingChains {
+		chainMap[c] = struct{}{}
+	}
+
+	for _, c := range chains {
+		if _, found := chainMap[c]; !found {
+			if err := ipt.NewChain(table, c); err != nil {
+				return errors.Wrapf(err, "ipt.NewChain(%s, %s)", table, c)
+			}
+		}
+	}
+
+	return nil
+}
+
+// ensureRulesAtTop ensures the presence of given iptables rules.
+//
+// If any rule from the list is missing, the function deletes all given
+// rules and re-inserts them at the top of the chain to ensure the order of the rules.
+func ensureRulesAtTop(table, chain string, rulespecs [][]string, ipt *iptables.IPTables) error {
+	allFound := true
+
+	for _, rs := range rulespecs {
+		found, err := ipt.Exists(table, chain, rs...)
+		if err != nil {
+			return errors.Wrapf(err, "ipt.Exists(%s, %s, %s)", table, chain, rs)
+		}
+		if !found {
+			allFound = false
+			break
+		}
+	}
+
+	// All rules exist, do nothing.
+	if allFound {
+		return nil
+	}
+
+	for pos, rs := range rulespecs {
+		// If any is missing, then delete all, as we need to preserve the order of
+		// given rules. Ignore errors, as rule might not exist.
+		if !allFound {
+			ipt.Delete(table, chain, rs...)
+		}
+		if err := ipt.Insert(table, chain, pos+1, rs...); err != nil {
+			return errors.Wrapf(err, "ipt.Append(%s, %s, %s)", table, chain, rs)
+		}
+	}
+
+	return nil
+}
+
+func chainExists(ipt *iptables.IPTables, table string, chain string) (bool, error) {
+	existingChains, err := ipt.ListChains(table)
+	if err != nil {
+		return false, errors.Wrapf(err, "ipt.ListChains(%s)", table)
+	}
+	chainMap := make(map[string]struct{})
+	for _, c := range existingChains {
+		chainMap[c] = struct{}{}
+	}
+
+	_, found := chainMap[chain]
+	return found, nil
+}
+
+const (
+	// Max time we wait for an iptables flush to complete after we notice it has started
+	iptablesFlushTimeout = 5 * time.Second
+	// How often we poll while waiting for an iptables flush to complete
+	iptablesFlushPollTime = 100 * time.Millisecond
+)
+
+// MonitorForIptablesFlush periodically checks for a canary chain in iptables. If this canary chain goes missing it calls the reloadFunc.
+// This is a more efficient way of detecting whether firewalld or another process has been removing rules that we rely on.
+// The reloadFunc can then check whether other chains that should exist are still there, fix things and restore the canary.
+func MonitorForIptablesFlush(log *logrus.Logger, canary string, tables []string, reloadFunc func(), interval time.Duration, stopCh <-chan struct{}) {
+	ipt, err := iptables.New()
+	if err != nil {
+		log.Errorf("creating iptables object while initializing iptable Monitoring %s", err)
+		return
+	}
+
+	for {
+		_ = PollImmediateUntil(interval, func() (bool, error) {
+			for _, table := range tables {
+				if err := ensureChains(ipt, table, canary); err != nil {
+					log.Warningf("Could not set up iptables canary %s/%s: %v", table, canary, err)
+					return false, nil
+				}
+			}
+			return true, nil
+		}, stopCh)
+
+		// Poll until stopCh is closed or iptables is flushed
+		err = utilwait.PollUntil(interval, func() (bool, error) {
+			if exists, err := chainExists(ipt, tables[0], canary); exists {
+				return false, nil
+			} else if isResourceError(err) {
+				log.Warningf("Could not check for iptables canary %s/%s: %v", tables[0], canary, err)
+				return false, nil
+			}
+			log.Infof("iptables canary %s/%s deleted", tables[0], canary)
+
+			// Wait for the other canaries to be deleted too before returning
+			// so we don't start reloading too soon.
+			err := utilwait.PollImmediate(iptablesFlushPollTime, iptablesFlushTimeout, func() (bool, error) {
+				for i := 1; i < len(tables); i++ {
+					if exists, err := chainExists(ipt, tables[i], canary); exists || isResourceError(err) {
+						return false, nil
+					}
+				}
+				return true, nil
+			})
+			if err != nil {
+				log.Warning("Inconsistent iptables state detected.")
+			}
+			return true, nil
+		}, stopCh)
+
+		if err != nil {
+			// stopCh was closed
+			for _, table := range tables {
+				_ = ipt.DeleteChain(table, canary)
+			}
+			return
+		}
+
+		log.Infof("Reloading after iptables flush")
+		reloadFunc()
+	}
+}
+
+const iptablesStatusResourceProblem = 4
+
+// isResourceError returns true if the error indicates that iptables ran into a "resource
+// problem" and was unable to attempt the request. In particular, this will be true if it
+// times out trying to get the iptables lock.
+func isResourceError(err error) bool {
+	if ierr, ok := err.(*iptables.Error); ok {
+		if status, ok := ierr.ExitError.Sys().(syscall.WaitStatus); ok {
+			return status.ExitStatus() == iptablesStatusResourceProblem
+		}
+	}
+
+	return false
+}
+
+// PollImmediateUntil tries a condition func until it returns true, an error or stopCh is closed.
+//
+// PollImmediateUntil runs the 'condition' before waiting for the interval.
+// 'condition' will always be invoked at least once.
+func PollImmediateUntil(interval time.Duration, condition utilwait.ConditionFunc, stopCh <-chan struct{}) error {
+	done, err := condition()
+	if err != nil {
+		return err
+	}
+	if done {
+		return nil
+	}
+	select {
+	case <-stopCh:
+		return utilwait.ErrWaitTimeout
+	default:
+		return utilwait.PollUntil(interval, condition, stopCh)
+	}
+}
@@ -1,11 +1,9 @@
 package net

 import (
-	"encoding/json"
 	"fmt"
 	"net"
 	"os"
-	"strconv"

 	"github.com/vishvananda/netlink"
 	"github.com/vishvananda/netns"
@@ -17,7 +15,7 @@ type Dev struct {
 	CIDRs []*net.IPNet     `json:"CIDRs,omitempty"`
 }

-func LinkToNetDev(link netlink.Link) (Dev, error) {
+func linkToNetDev(link netlink.Link) (Dev, error) {
 	addrs, err := netlink.AddrList(link, netlink.FAMILY_V4)
 	if err != nil {
 		return Dev{}, err
@@ -90,16 +88,30 @@ func GetNetDevsByVethPeerIds(processID int, peerIDs []int) ([]Dev, error) {
 		return nil, nil
 	}

+	// convert list of peerIDs into a map for faster lookup
+	indexes := make(map[int]struct{})
+	for _, id := range peerIDs {
+		indexes[id] = struct{}{}
+	}
+
 	var netdevs []Dev
-	peersStr := make([]string, len(peerIDs))
-	for i, id := range peerIDs {
-		peersStr[i] = strconv.Itoa(id)
-	}
-	nds, err := WithNetNSByPid(processID, "list-netdevs", peersStr...)
-	if err != nil {
-		return nil, fmt.Errorf("list-netdevs failed: %s", err)
-	}
-	err = json.Unmarshal(nds, &netdevs)
+	err = WithNetNS(netnsContainer, func() error {
+		links, err := netlink.LinkList()
+		if err != nil {
+			return err
+		}
+
+		for _, link := range links {
+			if _, found := indexes[link.Attrs().Index]; found {
+				netdev, err := linkToNetDev(link)
+				if err != nil {
+					return err
+				}
+				netdevs = append(netdevs, netdev)
+			}
+		}
+		return nil
+	})

 	return netdevs, err
 }
@@ -112,5 +124,5 @@ func GetBridgeNetDev(bridgeName string) (Dev, error) {
 		return Dev{}, err
 	}

-	return LinkToNetDev(link)
+	return linkToNetDev(link)
 }
@@ -1,10 +1,10 @@
+// +build go1.10
+
 package net

 import (
-	"bytes"
 	"errors"
 	"fmt"
-	"os/exec"
 	"path/filepath"
 	"runtime"

@@ -14,19 +14,7 @@ import (

 var ErrLinkNotFound = errors.New("Link not found")

-// NB: The following function is unsafe, because:
-//     - It changes a network namespace (netns) of an OS thread which runs
-//       the function. During execution, the Go runtime might clone a new OS thread
-//       for scheduling other go-routines, thus they might end up running in
-//       a "wrong" netns.
-//     - runtime.LockOSThread does not guarantee that a spawned go-routine on
-//       the locked thread will be run by it. Thus, the work function is
-//       not allowed to spawn any go-routine which is dependent on the given netns.
-
-//     Please see https://github.com/weaveworks/weave/issues/2388#issuecomment-228365069
-//     for more details and make sure that you understand the implications before
-//     using the function!
-func WithNetNSUnsafe(ns netns.NsHandle, work func() error) error {
+func WithNetNS(ns netns.NsHandle, work func() error) error {
 	runtime.LockOSThread()
 	defer runtime.UnlockOSThread()

@@ -45,8 +33,8 @@ func WithNetNSUnsafe(ns netns.NsHandle, work func() error) error {
 	return err
 }

-func WithNetNSLinkUnsafe(ns netns.NsHandle, ifName string, work func(link netlink.Link) error) error {
-	return WithNetNSUnsafe(ns, func() error {
+func WithNetNSLink(ns netns.NsHandle, ifName string, work func(link netlink.Link) error) error {
+	return WithNetNS(ns, func() error {
 		link, err := netlink.LinkByName(ifName)
 		if err != nil {
 			if err.Error() == errors.New("Link not found").Error() {
@@ -58,32 +46,18 @@ func WithNetNSLinkUnsafe(ns netns.NsHandle, ifName string, work func(link netlin
 	})
 }

-var WeaveUtilCmd = "weaveutil"
-
-// A safe version of WithNetNS* which creates a process executing
-// "nsenter --net=<ns-path> weaveutil <cmd> [args]".
-func WithNetNS(nsPath string, cmd string, args ...string) ([]byte, error) {
-	var stdout, stderr bytes.Buffer
-
-	args = append([]string{"--net=" + nsPath, WeaveUtilCmd, cmd}, args...)
-	c := exec.Command("nsenter", args...)
-	c.Stdout = &stdout
-	c.Stderr = &stderr
-	if err := c.Run(); err != nil {
-		return nil, fmt.Errorf("%s: %s", string(stderr.Bytes()), err)
+func WithNetNSByPath(path string, work func() error) error {
+	ns, err := netns.GetFromPath(path)
+	if err != nil {
+		return err
 	}
-
-	return stdout.Bytes(), nil
-}
-
-func WithNetNSByPid(pid int, cmd string, args ...string) ([]byte, error) {
-	return WithNetNS(NSPathByPid(pid), cmd, args...)
+	return WithNetNS(ns, work)
 }

 func NSPathByPid(pid int) string {
-	return NSPathByPidWithRoot("/", pid)
+	return NSPathByPidWithProc("/proc", pid)
 }

-func NSPathByPidWithRoot(root string, pid int) string {
-	return filepath.Join(root, fmt.Sprintf("/proc/%d/ns/net", pid))
+func NSPathByPidWithProc(procPath string, pid int) string {
+	return filepath.Join(procPath, fmt.Sprint(pid), "/ns/net")
 }
@@ -13,7 +13,7 @@ import (
 )

 // create and attach a veth to the Weave bridge
-func CreateAndAttachVeth(name, peerName, bridgeName string, mtu int, keepTXOn bool, errIfLinkExist bool, init func(peer netlink.Link) error) (*netlink.Veth, error) {
+func CreateAndAttachVeth(procPath, name, peerName, bridgeName string, mtu int, keepTXOn bool, errIfLinkExist bool, init func(peer netlink.Link) error) (*netlink.Veth, error) {
 	bridge, err := netlink.LinkByName(bridgeName)
 	if err != nil {
 		return nil, fmt.Errorf(`bridge "%s" not present; did you launch weave?`, bridgeName)
@@ -49,6 +49,13 @@ func CreateAndAttachVeth(name, peerName, bridgeName string, mtu int, keepTXOn bo
 	if err := bridgeType.attach(veth); err != nil {
 		return cleanup("attaching veth %q to %q: %s", name, bridgeName, err)
 	}
+	// No ipv6 router advertisments please
+	if err := sysctlIfExists(procPath, "net/ipv6/conf/"+name+"/accept_ra", "0"); err != nil {
+		return cleanup("setting accept_ra to 0: %s", err)
+	}
+	if err := sysctlIfExists(procPath, "net/ipv6/conf/"+peerName+"/accept_ra", "0"); err != nil {
+		return cleanup("setting accept_ra to 0: %s", err)
+	}
 	if !bridgeType.IsFastdp() && !keepTXOn {
 		if err := EthtoolTXOff(veth.PeerName); err != nil {
 			return cleanup(`unable to set tx off on %q: %s`, peerName, err)
@@ -104,11 +111,17 @@ const (
 )

 func interfaceExistsInNamespace(netNSPath string, ifName string) bool {
-	_, err := WithNetNS(netNSPath, "check-iface", ifName)
+	err := WithNetNSByPath(netNSPath, func() error {
+		_, err := netlink.LinkByName(ifName)
+		return err
+	})
 	return err == nil
 }

 func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMulticastRoute bool, cidrs []*net.IPNet, keepTXOn bool, hairpinMode bool) error {
+	// AttachContainer expects to be called in host pid namespace
+	const procPath = "/proc"
+
 	ns, err := netns.GetFromPath(netNSPath)
 	if err != nil {
 		return err
@@ -121,11 +134,13 @@ func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMult
 			id = id[:maxIDLen] // trim passed ID if too long
 		}
 		name, peerName := vethPrefix+"pl"+id, vethPrefix+"pg"+id
-		veth, err := CreateAndAttachVeth(name, peerName, bridgeName, mtu, keepTXOn, true, func(veth netlink.Link) error {
+		veth, err := CreateAndAttachVeth(procPath, name, peerName, bridgeName, mtu, keepTXOn, true, func(veth netlink.Link) error {
 			if err := netlink.LinkSetNsFd(veth, int(ns)); err != nil {
 				return fmt.Errorf("failed to move veth to container netns: %s", err)
 			}
-			if _, err := WithNetNS(netNSPath, "setup-iface", peerName, ifName); err != nil {
+			if err := WithNetNS(ns, func() error {
+				return setupIface(procPath, peerName, ifName)
+			}); err != nil {
 				return fmt.Errorf("error setting up interface: %s", err)
 			}
 			return nil
@@ -139,19 +154,16 @@ func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMult

 	}

-	args := []string{ifName, fmt.Sprintf("%t", withMulticastRoute)}
-	for _, cidr := range cidrs {
-		args = append(args, cidr.String())
-	}
-	if _, err := WithNetNS(netNSPath, "setup-iface-addrs", args...); err != nil {
+	if err := WithNetNSLink(ns, ifName, func(veth netlink.Link) error {
+		return setupIfaceAddrs(veth, withMulticastRoute, cidrs)
+	}); err != nil {
 		return fmt.Errorf("error setting up interface addresses: %s", err)
 	}
 	return nil
 }

-// SetupIfaceAddrs is the implementation of the 'setup-iface-addrs' call above,
-// running in another process in the container's netns
-func SetupIfaceAddrs(veth netlink.Link, withMulticastRoute bool, cidrs []*net.IPNet) error {
+// setupIfaceAddrs expects to be called in the container's netns
+func setupIfaceAddrs(veth netlink.Link, withMulticastRoute bool, cidrs []*net.IPNet) error {
 	newAddresses, err := AddAddresses(veth, cidrs)
 	if err != nil {
 		return err
@@ -203,9 +215,8 @@ func SetupIfaceAddrs(veth netlink.Link, withMulticastRoute bool, cidrs []*net.IP
 	return nil
 }

-// SetupIface is the implementation of the 'setup-iface' call above,
-// running in another process in the container's netns
-func SetupIface(ifaceName, newIfName string) error {
+// setupIface expects to be called in the container's netns
+func setupIface(procPath, ifaceName, newIfName string) error {
 	ipt, err := iptables.New()
 	if err != nil {
 		return err
@@ -218,15 +229,32 @@ func SetupIface(ifaceName, newIfName string) error {
 	if err := netlink.LinkSetName(link, newIfName); err != nil {
 		return err
 	}
-	// This is only called by AttachContainer which is only called in host pid namespace
-	if err := ConfigureARPCache("/proc", newIfName); err != nil {
+	if err := configureARPCache(procPath, newIfName); err != nil {
 		return err
 	}
 	return ipt.Append("filter", "INPUT", "-i", newIfName, "-d", "224.0.0.0/4", "-j", "DROP")
 }

-// NB: This function can be used only by a process that terminates immediately
-//     after calling the function as it changes netns via WithNetNSLinkUnsafe.
+// configureARP is a helper for the Docker plugin which doesn't set the addresses itself
+func ConfigureARP(prefix, procPath string) error {
+	links, err := netlink.LinkList()
+	if err != nil {
+		return err
+	}
+	for _, link := range links {
+		ifName := link.Attrs().Name
+		if strings.HasPrefix(ifName, prefix) {
+			configureARPCache(procPath, ifName)
+			if addrs, err := netlink.AddrList(link, netlink.FAMILY_V4); err == nil {
+				for _, addr := range addrs {
+					arping.GratuitousArpOverIfaceByName(addr.IPNet.IP, ifName)
+				}
+			}
+		}
+	}
+	return nil
+}
+
 func DetachContainer(netNSPath, id, ifName string, cidrs []*net.IPNet) error {
 	ns, err := netns.GetFromPath(netNSPath)
 	if err != nil {
@@ -239,7 +267,7 @@ func DetachContainer(netNSPath, id, ifName string, cidrs []*net.IPNet) error {
 		return err
 	}

-	return WithNetNSLinkUnsafe(ns, ifName, func(veth netlink.Link) error {
+	return WithNetNSLink(ns, ifName, func(veth netlink.Link) error {
 		existingAddrs, err := netlink.AddrList(veth, netlink.FAMILY_V4)
 		if err != nil {
 			return fmt.Errorf("failed to get IP address for %q: %v", veth.Attrs().Name, err)
@@ -4,173 +4,190 @@ import (
 	"fmt"

 	apiv1 "k8s.io/api/core/v1"
-	extnapi "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"

-	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/net/ipset"
 )

-// analysePolicyLegacy is used to analyse extensions/v1beta1/NetworkPolicy (legacy) and
-// implements pre-1.7 k8s netpol semantics, whilst analysePolicy - networking.k8s.io/v1/NetworkPolicy
-// and 1.7 semantics.
-
-func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) (
-	rules map[string]*ruleSpec,
-	nsSelectors, podSelectors map[string]*selectorSpec,
-	err error) {
-
-	nsSelectors = make(map[string]*selectorSpec)
-	podSelectors = make(map[string]*selectorSpec)
-	rules = make(map[string]*ruleSpec)
-
-	dstSelector, err := newSelectorSpec(&policy.Spec.PodSelector, true, ns.name, ipset.HashIP)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	podSelectors[dstSelector.key] = dstSelector
-
-	for _, ingressRule := range policy.Spec.Ingress {
-		if ingressRule.Ports != nil && len(ingressRule.Ports) == 0 {
-			// Ports is empty, this rule matches no ports (no traffic matches).
-			continue
-		}
-
-		if ingressRule.From != nil && len(ingressRule.From) == 0 {
-			// From is empty, this rule matches no sources (no traffic matches).
-			continue
-		}
-
-		if ingressRule.From == nil {
-			// From is not provided, this rule matches all sources (traffic not restricted by source).
-			if ingressRule.Ports == nil {
-				// Ports is not provided, this rule matches all ports (traffic not restricted by port).
-				rule := newRuleSpec(nil, nil, dstSelector, nil)
-				rules[rule.key] = rule
-			} else {
-				// Ports is present and contains at least one item, then this rule allows traffic
-				// only if the traffic matches at least one port in the ports list.
-				withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) {
-					rule := newRuleSpec(&proto, nil, dstSelector, &port)
-					rules[rule.key] = rule
-				})
-			}
-		} else {
-			// From is present and contains at least on item, this rule allows traffic only if the
-			// traffic matches at least one item in the from list.
-			for _, peer := range ingressRule.From {
-				var srcSelector *selectorSpec
-				if peer.PodSelector != nil {
-					srcSelector, err = newSelectorSpec(peer.PodSelector, false, ns.name, ipset.HashIP)
-					if err != nil {
-						return nil, nil, nil, err
-					}
-					podSelectors[srcSelector.key] = srcSelector
-				}
-				if peer.NamespaceSelector != nil {
-					srcSelector, err = newSelectorSpec(peer.NamespaceSelector, false, "", ipset.ListSet)
-					if err != nil {
-						return nil, nil, nil, err
-					}
-					nsSelectors[srcSelector.key] = srcSelector
-				}
-
-				if ingressRule.Ports == nil {
-					// Ports is not provided, this rule matches all ports (traffic not restricted by port).
-					rule := newRuleSpec(nil, srcSelector, dstSelector, nil)
-					rules[rule.key] = rule
-				} else {
-					// Ports is present and contains at least one item, then this rule allows traffic
-					// only if the traffic matches at least one port in the ports list.
-					withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) {
-						rule := newRuleSpec(&proto, srcSelector, dstSelector, &port)
-						rules[rule.key] = rule
-					})
-				}
-			}
-		}
-	}
-
-	return rules, nsSelectors, podSelectors, nil
-}
-
 func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 	rules map[string]*ruleSpec,
-	nsSelectors, podSelectors map[string]*selectorSpec,
+	nsSelectors, podSelectors, namespacedPodSelectors map[string]*selectorSpec,
+	ipBlocks map[string]*ipBlockSpec,
 	err error) {

 	nsSelectors = make(map[string]*selectorSpec)
 	podSelectors = make(map[string]*selectorSpec)
+	namespacedPodSelectors = make(map[string]*selectorSpec)
+
+	ipBlocks = make(map[string]*ipBlockSpec)
 	rules = make(map[string]*ruleSpec)
+	policyTypes := make([]policyType, 0)

+	for _, pt := range policy.Spec.PolicyTypes {
+		if pt == networkingv1.PolicyTypeIngress {
+			policyTypes = append(policyTypes, policyTypeIngress)
+		}
+		if pt == networkingv1.PolicyTypeEgress {
+			policyTypes = append(policyTypes, policyTypeEgress)
+		}
+	}
 	// If empty, matches all pods in a namespace
-	dstSelector, err := newSelectorSpec(&policy.Spec.PodSelector, true, ns.name, ipset.HashIP)
+	targetSelector, err := newSelectorSpec(&policy.Spec.PodSelector, nil, policyTypes, ns.name, ipset.HashIP)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, nil, nil, nil, err
 	}

-	// To prevent dstSelector being overwritten by a subsequent selector with
+	// To prevent targetSelector being overwritten by a subsequent selector with
 	// the same key, addIfNotExist MUST be used when adding to podSelectors.
-	// Otherwise, dstSelector' "dst" property might be lost resulting in
-	// an invalid content of the "default-allow" ipset.
-	addIfNotExist(dstSelector, podSelectors)
+	// Otherwise, policyTypes of the selector might be lost resulting in
+	// an invalid content in any "default-allow" ipset.
+	addIfNotExist(targetSelector, podSelectors)

-	// If ingress is empty then this NetworkPolicy does not allow any traffic
-	if policy.Spec.Ingress == nil || len(policy.Spec.Ingress) == 0 {
-		return
-	}
+	// If ingress is empty then this NetworkPolicy does not allow any ingress traffic
+	if policy.Spec.Ingress != nil && len(policy.Spec.Ingress) != 0 {
+		for _, ingressRule := range policy.Spec.Ingress {
+			// If Ports is empty or missing, this rule matches all ports
+			allPorts := ingressRule.Ports == nil || len(ingressRule.Ports) == 0
+			// If From is empty or missing, this rule matches all sources
+			allSources := ingressRule.From == nil || len(ingressRule.From) == 0

-	for _, ingressRule := range policy.Spec.Ingress {
-		// If Ports is empty or missing, this rule matches all ports
-		allPorts := ingressRule.Ports == nil || len(ingressRule.Ports) == 0
-		// If From is empty or missing, this rule matches all sources
-		allSources := ingressRule.From == nil || len(ingressRule.From) == 0
-
-		if allSources {
-			if allPorts {
-				rule := newRuleSpec(nil, nil, dstSelector, nil)
-				rules[rule.key] = rule
-			} else {
-				withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) {
-					rule := newRuleSpec(&proto, nil, dstSelector, &port)
-					rules[rule.key] = rule
-				})
-			}
-		} else {
-			for _, peer := range ingressRule.From {
-				var srcSelector *selectorSpec
-
-				// NetworkPolicyPeer describes a peer to allow traffic from.
-				// Exactly one of its fields must be specified.
-				if peer.PodSelector != nil {
-					srcSelector, err = newSelectorSpec(peer.PodSelector, false, ns.name, ipset.HashIP)
-					if err != nil {
-						return nil, nil, nil, err
-					}
-					addIfNotExist(srcSelector, podSelectors)
-
-				} else if peer.NamespaceSelector != nil {
-					srcSelector, err = newSelectorSpec(peer.NamespaceSelector, false, "", ipset.ListSet)
-					if err != nil {
-						return nil, nil, nil, err
-					}
-					nsSelectors[srcSelector.key] = srcSelector
+			if !allPorts {
+				if err = checkForNamedPorts(ingressRule.Ports); err != nil {
+					return nil, nil, nil, nil, nil, fmt.Errorf("named ports in network policies is not supported yet. "+
+						"Rejecting network policy: %s from further processing. "+err.Error(), policy.Name)
 				}
-
+			}
+			if allSources {
 				if allPorts {
-					rule := newRuleSpec(nil, srcSelector, dstSelector, nil)
+					rule := newRuleSpec(policyTypeIngress, nil, nil, targetSelector, nil)
 					rules[rule.key] = rule
 				} else {
 					withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) {
-						rule := newRuleSpec(&proto, srcSelector, dstSelector, &port)
+						rule := newRuleSpec(policyTypeIngress, &proto, nil, targetSelector, &port)
 						rules[rule.key] = rule
 					})
 				}
+			} else {
+				for _, peer := range ingressRule.From {
+					var srcSelector *selectorSpec
+					var srcRuleHost ruleHost
+
+					// NetworkPolicyPeer describes a peer to allow traffic from.
+					if peer.PodSelector != nil && peer.NamespaceSelector != nil {
+						srcSelector, err = newSelectorSpec(peer.PodSelector, peer.NamespaceSelector, nil, "", ipset.HashIP)
+						if err != nil {
+							return nil, nil, nil, nil, nil, err
+						}
+						addIfNotExist(srcSelector, namespacedPodSelectors)
+						srcRuleHost = srcSelector
+					} else if peer.PodSelector != nil {
+						srcSelector, err = newSelectorSpec(peer.PodSelector, nil, nil, ns.name, ipset.HashIP)
+						if err != nil {
+							return nil, nil, nil, nil, nil, err
+						}
+						addIfNotExist(srcSelector, podSelectors)
+						srcRuleHost = srcSelector
+					} else if peer.NamespaceSelector != nil {
+						srcSelector, err = newSelectorSpec(nil, peer.NamespaceSelector, nil, "", ipset.ListSet)
+						if err != nil {
+							return nil, nil, nil, nil, nil, err
+						}
+						nsSelectors[srcSelector.key] = srcSelector
+						srcRuleHost = srcSelector
+					} else if peer.IPBlock != nil {
+						ipBlock := newIPBlockSpec(peer.IPBlock, ns.name)
+						ipBlocks[ipBlock.key] = ipBlock
+						srcRuleHost = ipBlock
+					}
+
+					if allPorts {
+						rule := newRuleSpec(policyTypeIngress, nil, srcRuleHost, targetSelector, nil)
+						rules[rule.key] = rule
+					} else {
+						withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) {
+							rule := newRuleSpec(policyTypeIngress, &proto, srcRuleHost, targetSelector, &port)
+							rules[rule.key] = rule
+						})
+					}
+				}
 			}
 		}
 	}

-	return rules, nsSelectors, podSelectors, nil
+	// If egress is empty then this NetworkPolicy does not allow any egress traffic
+	if policy.Spec.Egress != nil && len(policy.Spec.Egress) != 0 {
+		for _, egressRule := range policy.Spec.Egress {
+			// If Ports is empty or missing, this rule matches all ports
+			allPorts := egressRule.Ports == nil || len(egressRule.Ports) == 0
+			// If To is empty or missing, this rule matches all destinations
+			allDestinations := egressRule.To == nil || len(egressRule.To) == 0
+
+			if !allPorts {
+				if err = checkForNamedPorts(egressRule.Ports); err != nil {
+					return nil, nil, nil, nil, nil, fmt.Errorf("named ports in network policies is not supported yet. "+
+						"Rejecting network policy: %s from further processing. "+err.Error(), policy.Name)
+				}
+			}
+			if allDestinations {
+				if allPorts {
+					rule := newRuleSpec(policyTypeEgress, nil, targetSelector, nil, nil)
+					rules[rule.key] = rule
+				} else {
+					withNormalisedProtoAndPort(egressRule.Ports, func(proto, port string) {
+						rule := newRuleSpec(policyTypeEgress, &proto, targetSelector, nil, &port)
+						rules[rule.key] = rule
+					})
+				}
+			} else {
+				for _, peer := range egressRule.To {
+					var dstSelector *selectorSpec
+					var dstRuleHost ruleHost
+
+					// NetworkPolicyPeer describes a peer to allow traffic to.
+					if peer.PodSelector != nil && peer.NamespaceSelector != nil {
+						dstSelector, err = newSelectorSpec(peer.PodSelector, peer.NamespaceSelector, nil, "", ipset.HashIP)
+						if err != nil {
+							return nil, nil, nil, nil, nil, err
+						}
+						addIfNotExist(dstSelector, namespacedPodSelectors)
+						dstRuleHost = dstSelector
+					} else if peer.PodSelector != nil {
+						dstSelector, err = newSelectorSpec(peer.PodSelector, nil, nil, ns.name, ipset.HashIP)
+						if err != nil {
+							return nil, nil, nil, nil, nil, err
+						}
+						addIfNotExist(dstSelector, podSelectors)
+						dstRuleHost = dstSelector
+
+					} else if peer.NamespaceSelector != nil {
+						dstSelector, err = newSelectorSpec(nil, peer.NamespaceSelector, nil, "", ipset.ListSet)
+						if err != nil {
+							return nil, nil, nil, nil, nil, err
+						}
+						nsSelectors[dstSelector.key] = dstSelector
+						dstRuleHost = dstSelector
+					} else if peer.IPBlock != nil {
+						ipBlock := newIPBlockSpec(peer.IPBlock, ns.name)
+						ipBlocks[ipBlock.key] = ipBlock
+						dstRuleHost = ipBlock
+					}
+
+					if allPorts {
+						rule := newRuleSpec(policyTypeEgress, nil, targetSelector, dstRuleHost, nil)
+						rules[rule.key] = rule
+					} else {
+						withNormalisedProtoAndPort(egressRule.Ports, func(proto, port string) {
+							rule := newRuleSpec(policyTypeEgress, &proto, targetSelector, dstRuleHost, &port)
+							rules[rule.key] = rule
+						})
+					}
+				}
+			}
+		}
+	}
+
+	return rules, nsSelectors, podSelectors, namespacedPodSelectors, ipBlocks, nil
 }

 func addIfNotExist(s *selectorSpec, ss map[string]*selectorSpec) {
@@ -179,12 +196,6 @@ func addIfNotExist(s *selectorSpec, ss map[string]*selectorSpec) {
 	}
 }

-func withNormalisedProtoAndPortLegacy(npps []extnapi.NetworkPolicyPort, f func(proto, port string)) {
-	for _, npp := range npps {
-		f(proto(npp.Protocol), port(npp.Port))
-	}
-}
-
 func withNormalisedProtoAndPort(npps []networkingv1.NetworkPolicyPort, f func(proto, port string)) {
 	for _, npp := range npps {
 		f(proto(npp.Protocol), port(npp.Port))
@@ -216,3 +227,12 @@ func port(p *intstr.IntOrString) string {

 	return port
 }
+
+func checkForNamedPorts(ports []networkingv1.NetworkPolicyPort) error {
+	for _, npProtocolPort := range ports {
+		if npProtocolPort.Port != nil && npProtocolPort.Port.Type == intstr.String {
+			return fmt.Errorf("named port %s in network policy", port(npProtocolPort.Port))
+		}
+	}
+	return nil
+}
@@ -2,10 +2,7 @@ package npc

 const (
 	TableFilter = "filter"
-
-	MainChain    = "WEAVE-NPC"
-	DefaultChain = "WEAVE-NPC-DEFAULT"
-	IngressChain = "WEAVE-NPC-INGRESS"
+	EgressMark  = "0x40000/0x40000"

 	IpsetNamePrefix = "weave-"

@@ -1,30 +1,35 @@
 package npc

 import (
+	"context"
+	"fmt"
 	"sync"

 	"github.com/pkg/errors"
 	coreapi "k8s.io/api/core/v1"
 	extnapi "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"

 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/common/chains"
+	"github.com/weaveworks/weave/net/ipset"
 	"github.com/weaveworks/weave/npc/iptables"
 )

 type NetworkPolicyController interface {
-	AddNamespace(ns *coreapi.Namespace) error
-	UpdateNamespace(oldObj, newObj *coreapi.Namespace) error
-	DeleteNamespace(ns *coreapi.Namespace) error
+	AddNamespace(ctx context.Context, ns *coreapi.Namespace) error
+	UpdateNamespace(ctx context.Context, oldObj, newObj *coreapi.Namespace) error
+	DeleteNamespace(ctx context.Context, ns *coreapi.Namespace) error

-	AddPod(obj *coreapi.Pod) error
-	UpdatePod(oldObj, newObj *coreapi.Pod) error
-	DeletePod(obj *coreapi.Pod) error
+	AddPod(ctx context.Context, obj *coreapi.Pod) error
+	UpdatePod(ctx context.Context, oldObj, newObj *coreapi.Pod) error
+	DeletePod(ctx context.Context, obj *coreapi.Pod) error

-	AddNetworkPolicy(obj interface{}) error
-	UpdateNetworkPolicy(oldObj, newObj interface{}) error
-	DeleteNetworkPolicy(obj interface{}) error
+	AddNetworkPolicy(ctx context.Context, obj interface{}) error
+	UpdateNetworkPolicy(ctx context.Context, oldObj, newObj interface{}) error
+	DeleteNetworkPolicy(ctx context.Context, obj interface{}) error
 }

 type controller struct {
@@ -32,34 +37,34 @@ type controller struct {

 	nodeName string // my node name

-	ipt iptables.Interface
-	ips ipset.Interface
-
-	nss         map[string]*ns // ns name -> ns struct
-	nsSelectors *selectorSet   // selector string -> nsSelector
-
-	legacy bool // use legacy network policy semantics (k8s pre-1.7)
+	ipt                    iptables.Interface
+	ips                    ipset.Interface
+	clientset              kubernetes.Interface
+	nss                    map[string]*ns // ns name -> ns struct
+	nsSelectors            *selectorSet   // selector string -> nsSelector
+	namespacedPodSelectors *selectorSet
+	defaultEgressDrop      bool // flag to track if base iptable rule to drop egress traffic is added or not
 }

-func New(nodeName string, legacy bool, ipt iptables.Interface, ips ipset.Interface) NetworkPolicyController {
+func New(nodeName string, ipt iptables.Interface, ips ipset.Interface, clientset kubernetes.Interface) NetworkPolicyController {
 	c := &controller{
-		nodeName: nodeName,
-		legacy:   legacy,
-		ipt:      ipt,
-		ips:      ips,
-		nss:      make(map[string]*ns)}
+		nodeName:  nodeName,
+		ipt:       ipt,
+		ips:       ips,
+		clientset: clientset,
+		nss:       make(map[string]*ns)}

-	doNothing := func(*selector) error { return nil }
+	doNothing := func(*selector, policyType) error { return nil }
 	c.nsSelectors = newSelectorSet(ips, c.onNewNsSelector, doNothing, doNothing)
-
+	c.namespacedPodSelectors = newSelectorSet(ips, c.onNewNamespacePodsSelector, doNothing, doNothing)
 	return c
 }

 func (npc *controller) onNewNsSelector(selector *selector) error {
 	for _, ns := range npc.nss {
-		if ns.namespace != nil {
-			if selector.matches(ns.namespace.ObjectMeta.Labels) {
-				if err := selector.addEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
+		if ns.namespaceUID != "" {
+			if selector.matchesNamespaceSelector(ns.namespaceLabels) {
+				if err := selector.addEntry(ns.namespaceUID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
 					return err
 				}
 			}
@@ -68,10 +73,32 @@ func (npc *controller) onNewNsSelector(selector *selector) error {
 	return nil
 }

-func (npc *controller) withNS(name string, f func(ns *ns) error) error {
+func (npc *controller) onNewNamespacePodsSelector(selector *selector) error {
+	for _, ns := range npc.nss {
+		if ns.namespaceUID != "" && len(ns.pods) > 0 {
+			for _, pod := range ns.pods {
+				if hasIP(pod) {
+					if selector.matchesNamespacedPodSelector(pod.ObjectMeta.Labels, ns.namespaceLabels) {
+						if err := selector.addEntry(uid(pod), pod.Status.PodIP, podComment(pod)); err != nil {
+							return err
+						}
+
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (npc *controller) withNS(ctx context.Context, name string, f func(ns *ns) error) error {
 	ns, found := npc.nss[name]
 	if !found {
-		newNs, err := newNS(name, npc.nodeName, npc.legacy, npc.ipt, npc.ips, npc.nsSelectors)
+		namespace, err := npc.clientset.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
+		if err != nil {
+			return err
+		}
+		newNs, err := newNS(name, npc.nodeName, npc.ipt, npc.ips, npc.nsSelectors, npc.namespacedPodSelectors, namespace)
 		if err != nil {
 			return err
 		}
@@ -90,52 +117,70 @@ func (npc *controller) withNS(name string, f func(ns *ns) error) error {
 	return nil
 }

-func (npc *controller) AddPod(obj *coreapi.Pod) error {
+func (npc *controller) AddPod(ctx context.Context, obj *coreapi.Pod) error {
 	npc.Lock()
 	defer npc.Unlock()

 	common.Log.Debugf("EVENT AddPod %s", js(obj))
-	return npc.withNS(obj.ObjectMeta.Namespace, func(ns *ns) error {
+	return npc.withNS(ctx, obj.ObjectMeta.Namespace, func(ns *ns) error {
 		return errors.Wrap(ns.addPod(obj), "add pod")
 	})
 }

-func (npc *controller) UpdatePod(oldObj, newObj *coreapi.Pod) error {
+func (npc *controller) UpdatePod(ctx context.Context, oldObj, newObj *coreapi.Pod) error {
 	npc.Lock()
 	defer npc.Unlock()

 	common.Log.Debugf("EVENT UpdatePod %s %s", js(oldObj), js(newObj))
-	return npc.withNS(oldObj.ObjectMeta.Namespace, func(ns *ns) error {
+	return npc.withNS(ctx, oldObj.ObjectMeta.Namespace, func(ns *ns) error {
 		return errors.Wrap(ns.updatePod(oldObj, newObj), "update pod")
 	})
 }

-func (npc *controller) DeletePod(obj *coreapi.Pod) error {
+func (npc *controller) DeletePod(ctx context.Context, obj *coreapi.Pod) error {
 	npc.Lock()
 	defer npc.Unlock()

 	common.Log.Debugf("EVENT DeletePod %s", js(obj))
-	return npc.withNS(obj.ObjectMeta.Namespace, func(ns *ns) error {
+	return npc.withNS(ctx, obj.ObjectMeta.Namespace, func(ns *ns) error {
 		return errors.Wrap(ns.deletePod(obj), "delete pod")
 	})
 }

-func (npc *controller) AddNetworkPolicy(obj interface{}) error {
+func (npc *controller) AddNetworkPolicy(ctx context.Context, obj interface{}) error {
 	npc.Lock()
 	defer npc.Unlock()

+	// lazily add default rule to drop egress traffic only when network policies are applied
+	if !npc.defaultEgressDrop {
+		egressNetworkPolicy, err := isEgressNetworkPolicy(obj)
+		if err != nil {
+			return err
+		}
+		if egressNetworkPolicy {
+			if err := npc.ipt.Append(TableFilter, chains.EgressChain,
+				"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", EgressMark, "-j", "NFLOG", "--nflog-group", "86"); err != nil {
+				return fmt.Errorf("Failed to add iptable egress log rule: %w", err)
+			}
+			if err := npc.ipt.Append(TableFilter, chains.EgressChain,
+				"-m", "mark", "!", "--mark", EgressMark, "-j", "DROP"); err != nil {
+				return fmt.Errorf("Failed to add iptable rule to drop egress traffic from the pods by default due to %s", err.Error())
+			}
+			npc.defaultEgressDrop = true
+		}
+	}
+
 	nsName, err := nsName(obj)
 	if err != nil {
 		return err
 	}
-
 	common.Log.Infof("EVENT AddNetworkPolicy %s", js(obj))
-	return npc.withNS(nsName, func(ns *ns) error {
+	return npc.withNS(ctx, nsName, func(ns *ns) error {
 		return errors.Wrap(ns.addNetworkPolicy(obj), "add network policy")
 	})
 }

-func (npc *controller) UpdateNetworkPolicy(oldObj, newObj interface{}) error {
+func (npc *controller) UpdateNetworkPolicy(ctx context.Context, oldObj, newObj interface{}) error {
 	npc.Lock()
 	defer npc.Unlock()

@@ -145,12 +190,12 @@ func (npc *controller) UpdateNetworkPolicy(oldObj, newObj interface{}) error {
 	}

 	common.Log.Infof("EVENT UpdateNetworkPolicy %s %s", js(oldObj), js(newObj))
-	return npc.withNS(nsName, func(ns *ns) error {
+	return npc.withNS(ctx, nsName, func(ns *ns) error {
 		return errors.Wrap(ns.updateNetworkPolicy(oldObj, newObj), "update network policy")
 	})
 }

-func (npc *controller) DeleteNetworkPolicy(obj interface{}) error {
+func (npc *controller) DeleteNetworkPolicy(ctx context.Context, obj interface{}) error {
 	npc.Lock()
 	defer npc.Unlock()

@@ -160,37 +205,37 @@ func (npc *controller) DeleteNetworkPolicy(obj interface{}) error {
 	}

 	common.Log.Infof("EVENT DeleteNetworkPolicy %s", js(obj))
-	return npc.withNS(nsName, func(ns *ns) error {
+	return npc.withNS(ctx, nsName, func(ns *ns) error {
 		return errors.Wrap(ns.deleteNetworkPolicy(obj), "delete network policy")
 	})
 }

-func (npc *controller) AddNamespace(obj *coreapi.Namespace) error {
+func (npc *controller) AddNamespace(ctx context.Context, obj *coreapi.Namespace) error {
 	npc.Lock()
 	defer npc.Unlock()

 	common.Log.Infof("EVENT AddNamespace %s", js(obj))
-	return npc.withNS(obj.ObjectMeta.Name, func(ns *ns) error {
+	return npc.withNS(ctx, obj.ObjectMeta.Name, func(ns *ns) error {
 		return errors.Wrap(ns.addNamespace(obj), "add namespace")
 	})
 }

-func (npc *controller) UpdateNamespace(oldObj, newObj *coreapi.Namespace) error {
+func (npc *controller) UpdateNamespace(ctx context.Context, oldObj, newObj *coreapi.Namespace) error {
 	npc.Lock()
 	defer npc.Unlock()

 	common.Log.Infof("EVENT UpdateNamespace %s %s", js(oldObj), js(newObj))
-	return npc.withNS(oldObj.ObjectMeta.Name, func(ns *ns) error {
+	return npc.withNS(ctx, oldObj.ObjectMeta.Name, func(ns *ns) error {
 		return errors.Wrap(ns.updateNamespace(oldObj, newObj), "update namespace")
 	})
 }

-func (npc *controller) DeleteNamespace(obj *coreapi.Namespace) error {
+func (npc *controller) DeleteNamespace(ctx context.Context, obj *coreapi.Namespace) error {
 	npc.Lock()
 	defer npc.Unlock()

 	common.Log.Infof("EVENT DeleteNamespace %s", js(obj))
-	return npc.withNS(obj.ObjectMeta.Name, func(ns *ns) error {
+	return npc.withNS(ctx, obj.ObjectMeta.Name, func(ns *ns) error {
 		return errors.Wrap(ns.deleteNamespace(obj), "delete namespace")
 	})
 }
@@ -205,3 +250,28 @@ func nsName(obj interface{}) (string, error) {

 	return "", errInvalidNetworkPolicyObjType
 }
+
+func isEgressNetworkPolicy(obj interface{}) (bool, error) {
+	if policy, ok := obj.(*networkingv1.NetworkPolicy); ok {
+		if len(policy.Spec.PolicyTypes) > 0 {
+			for _, policyType := range policy.Spec.PolicyTypes {
+				if policyType == networkingv1.PolicyTypeEgress {
+					return true, nil
+				}
+			}
+		}
+		if policy.Spec.Egress != nil {
+			return true, nil
+		}
+		return false, nil
+	}
+	return false, errInvalidNetworkPolicyObjType
+}
+
+func uid(pod *coreapi.Pod) ipset.UID {
+	return ipset.UID(pod.UID)
+}
+
+func nsuid(ns *coreapi.Namespace) ipset.UID {
+	return ipset.UID(ns.UID)
+}
@@ -1,23 +1,27 @@
 package npc

 import (
+	"context"
+	"fmt"
 	"log"
+	"strings"
 	"testing"

 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
-	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/common/chains"
+	"github.com/weaveworks/weave/net/ipset"
 	coreapi "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/client-go/kubernetes/fake"
 )

 type mockSet struct {
 	name    ipset.Name
 	setType ipset.Type
-	subSets map[string]map[types.UID]bool
+	subSets map[string]map[ipset.UID]bool
 }

 type mockIPSet struct {
@@ -32,17 +36,17 @@ func (i *mockIPSet) Create(ipsetName ipset.Name, ipsetType ipset.Type) error {
 	if _, ok := i.sets[string(ipsetName)]; ok {
 		return errors.Errorf("ipset %s already exists", ipsetName)
 	}
-	i.sets[string(ipsetName)] = mockSet{name: ipsetName, setType: ipsetType, subSets: make(map[string]map[types.UID]bool)}
+	i.sets[string(ipsetName)] = mockSet{name: ipsetName, setType: ipsetType, subSets: make(map[string]map[ipset.UID]bool)}
 	return nil
 }

-func (i *mockIPSet) AddEntry(user types.UID, ipsetName ipset.Name, entry string, comment string) error {
+func (i *mockIPSet) AddEntry(user ipset.UID, ipsetName ipset.Name, entry string, comment string) error {
 	log.Printf("adding entry %s to %s for %s", entry, ipsetName, user)
 	if _, ok := i.sets[string(ipsetName)]; !ok {
 		return errors.Errorf("%s does not exist", entry)
 	}
 	if i.sets[string(ipsetName)].subSets[entry] == nil {
-		i.sets[string(ipsetName)].subSets[entry] = make(map[types.UID]bool)
+		i.sets[string(ipsetName)].subSets[entry] = make(map[ipset.UID]bool)
 	}
 	if _, ok := i.sets[string(ipsetName)].subSets[entry][user]; ok {
 		return errors.Errorf("user %s already owns entry %s", user, entry)
@@ -52,7 +56,7 @@ func (i *mockIPSet) AddEntry(user types.UID, ipsetName ipset.Name, entry string,
 	return nil
 }

-func (i *mockIPSet) DelEntry(user types.UID, ipsetName ipset.Name, entry string) error {
+func (i *mockIPSet) DelEntry(user ipset.UID, ipsetName ipset.Name, entry string) error {
 	log.Printf("deleting entry %s from %s for %s", entry, ipsetName, user)
 	if _, ok := i.sets[string(ipsetName)]; !ok {
 		return errors.Errorf("ipset %s does not exist", ipsetName)
@@ -69,12 +73,17 @@ func (i *mockIPSet) DelEntry(user types.UID, ipsetName ipset.Name, entry string)
 	return nil
 }

-func (i *mockIPSet) Exist(user types.UID, ipsetName ipset.Name, entry string) bool {
+func (i *mockIPSet) EntryExists(user ipset.UID, ipsetName ipset.Name, entry string) bool {
 	_, ok := i.sets[string(ipsetName)].subSets[entry][user]
 	return ok
 }

-func (i *mockIPSet) entryExists(ipsetName ipset.Name, entry string) bool {
+func (i *mockIPSet) Exists(ipsetName ipset.Name) (bool, error) {
+	_, ok := i.sets[string(ipsetName)]
+	return ok, nil
+}
+
+func (i *mockIPSet) entriesExist(ipsetName ipset.Name, entry string) bool {
 	return len(i.sets[string(ipsetName)].subSets[entry]) > 0
 }

@@ -103,18 +112,46 @@ func (i *mockIPSet) List(prefix string) ([]ipset.Name, error) {
 }

 type mockIPTables struct {
+	rules map[string]map[string]struct{} // chain -> rulespec -> struct{}
+}
+
+func newMockIPTables() *mockIPTables {
+	return &mockIPTables{rules: make(map[string]map[string]struct{})}
 }

 func (ipt *mockIPTables) Append(table, chain string, rulespec ...string) error {
+	if table != TableFilter {
+		return fmt.Errorf("invalid table: %q", table)
+	}
+
+	if _, found := ipt.rules[chain]; !found {
+		ipt.rules[chain] = make(map[string]struct{})
+	}
+
+	rule := strings.Join(rulespec, " ")
+	if _, found := ipt.rules[chain][rule]; found {
+		return fmt.Errorf("rule already exists. chain: %q, rule: %q", chain, rule)
+	}
+
+	ipt.rules[chain][rule] = struct{}{}
+
 	return nil
 }

 func (ipt *mockIPTables) Delete(table, chain string, rulespec ...string) error {
+	rule := strings.Join(rulespec, " ")
+
+	if _, found := ipt.rules[chain][rule]; !found {
+		return fmt.Errorf("rule does not exist. chain: %q rule: %q", chain, rule)
+	}
+
+	delete(ipt.rules[chain], rule)
+
 	return nil
 }

 func (ipt *mockIPTables) Insert(table, chain string, pos int, rulespec ...string) error {
-	return nil
+	return errors.New("Not Implemented")
 }

 func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
@@ -124,6 +161,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
 	sourceNamespace := &coreapi.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "source",
+			UID:  "source",
 			Labels: map[string]string{
 				"app": "source",
 			},
@@ -133,6 +171,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
 	destinationNamespace := &coreapi.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "destination",
+			UID:  "destination",
 		},
 	}

@@ -144,6 +183,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
 			Namespace: "destination",
 		},
 		Spec: networkingv1.NetworkPolicySpec{
+			PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress},
 			Ingress: []networkingv1.NetworkPolicyIngressRule{
 				{
 					From: []networkingv1.NetworkPolicyPeer{
@@ -167,53 +207,61 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {

 	// Namespaces first
 	m := newMockIPSet()
-	controller := New("foo", false, &mockIPTables{}, &m)
+	client := fake.NewSimpleClientset()
+	ctx := context.Background()
+	controller := New("foo", newMockIPTables(), &m, client)
+	client.CoreV1().Namespaces().Create(ctx, sourceNamespace, metav1.CreateOptions{})
+	client.CoreV1().Namespaces().Create(ctx, destinationNamespace, metav1.CreateOptions{})

 	const (
 		selectorIPSetName = "weave-I239Zp%sCvoVt*D6u=A!2]YEk"
 		sourceIPSetName   = "weave-HboJG1fGgG]/SR%k9H#hv5e96"
 	)

-	controller.AddNamespace(sourceNamespace)
-	controller.AddNamespace(destinationNamespace)
+	controller.AddNamespace(ctx, sourceNamespace)
+	controller.AddNamespace(ctx, destinationNamespace)

-	controller.AddNetworkPolicy(networkPolicy)
+	controller.AddNetworkPolicy(ctx, networkPolicy)

 	require.Equal(t, true, len(m.sets[selectorIPSetName].subSets[sourceIPSetName]) > 0)

 	// NetworkPolicy first
 	m = newMockIPSet()
-	controller = New("foo", false, &mockIPTables{}, &m)
+	controller = New("foo", newMockIPTables(), &m, &fake.Clientset{})

-	controller.AddNetworkPolicy(networkPolicy)
+	controller.AddNetworkPolicy(ctx, networkPolicy)

-	controller.AddNamespace(sourceNamespace)
-	controller.AddNamespace(destinationNamespace)
+	controller.AddNamespace(ctx, sourceNamespace)
+	controller.AddNamespace(ctx, destinationNamespace)

 	require.Equal(t, true, len(m.sets[selectorIPSetName].subSets[sourceIPSetName]) > 0)
 }

-// Tests default-allow ipset behavior when running in non-legacy mode.
+// Tests default-allow ipset behavior
 func TestDefaultAllow(t *testing.T) {
 	const (
-		defaultAllowIPSetName = "weave-E.1.0W^NGSp]0_t5WwH/]gX@L"
-		fooPodIP              = "10.32.0.10"
-		barPodIP              = "10.32.0.11"
-		barPodNewIP           = "10.32.0.12"
+		ingressDefaultAllowIPSetName = "weave-;rGqyMIl1HN^cfDki~Z$3]6!N"
+		egressDefaultAllowIPSetName  = "weave-s_+ChJId4Uy_$}G;WdH|~TK)I"
+		fooPodIP                     = "10.32.0.10"
+		barPodIP                     = "10.32.0.11"
+		barPodNewIP                  = "10.32.0.12"
 	)

 	m := newMockIPSet()
-	controller := New("bar", false, &mockIPTables{}, &m)
+	controller := New("bar", newMockIPTables(), &m, &fake.Clientset{})

+	ctx := context.Background()
 	defaultNamespace := &coreapi.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "default",
+			UID:  "default",
 		},
 	}
-	controller.AddNamespace(defaultNamespace)
+	controller.AddNamespace(ctx, defaultNamespace)

 	// Should create an ipset for default-allow
-	require.Contains(t, m.sets, defaultAllowIPSetName)
+	require.Contains(t, m.sets, ingressDefaultAllowIPSetName)
+	require.Contains(t, m.sets, egressDefaultAllowIPSetName)

 	podFoo := &coreapi.Pod{
 		ObjectMeta: metav1.ObjectMeta{
@@ -222,10 +270,11 @@ func TestDefaultAllow(t *testing.T) {
 			Name:      "foo",
 			Labels:    map[string]string{"run": "foo"}},
 		Status: coreapi.PodStatus{PodIP: fooPodIP}}
-	controller.AddPod(podFoo)
+	controller.AddPod(ctx, podFoo)

 	// Should add the foo pod to default-allow
-	require.True(t, m.entryExists(defaultAllowIPSetName, fooPodIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, fooPodIP))
+	require.True(t, m.entriesExist(egressDefaultAllowIPSetName, fooPodIP))

 	podBar := &coreapi.Pod{
 		ObjectMeta: metav1.ObjectMeta{
@@ -235,11 +284,13 @@ func TestDefaultAllow(t *testing.T) {
 			Labels:    map[string]string{"run": "bar"}},
 		Status: coreapi.PodStatus{PodIP: barPodIP}}
 	podBarNoIP := &coreapi.Pod{ObjectMeta: podBar.ObjectMeta}
-	controller.AddPod(podBarNoIP)
-	controller.UpdatePod(podBarNoIP, podBar)
+	controller.AddPod(ctx, podBarNoIP)
+
+	controller.UpdatePod(ctx, podBarNoIP, podBar)

 	// Should add the bar pod to default-allow
-	require.True(t, m.entryExists(defaultAllowIPSetName, barPodIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, barPodIP))
+	require.True(t, m.entriesExist(egressDefaultAllowIPSetName, barPodIP))

 	// Allow access from the bar pod to the foo pod
 	netpol := &networkingv1.NetworkPolicy{
@@ -248,6 +299,10 @@ func TestDefaultAllow(t *testing.T) {
 			Namespace: "default",
 		},
 		Spec: networkingv1.NetworkPolicySpec{
+			PolicyTypes: []networkingv1.PolicyType{
+				networkingv1.PolicyTypeIngress,
+				networkingv1.PolicyTypeEgress,
+			},
 			PodSelector: metav1.LabelSelector{MatchLabels: map[string]string{"run": "foo"}},
 			Ingress: []networkingv1.NetworkPolicyIngressRule{{
 				From: []networkingv1.NetworkPolicyPeer{{
@@ -256,67 +311,85 @@ func TestDefaultAllow(t *testing.T) {
 					},
 				}},
 			}},
+			Egress: []networkingv1.NetworkPolicyEgressRule{{
+				To: []networkingv1.NetworkPolicyPeer{{
+					IPBlock: &networkingv1.IPBlock{CIDR: "192.168.48.0/24"},
+				}},
+			}},
 		},
 	}
-	controller.AddNetworkPolicy(netpol)
+	controller.AddNetworkPolicy(ctx, netpol)

 	// Should remove the foo pod from default-allow as the netpol selects it
-	require.False(t, m.entryExists(defaultAllowIPSetName, fooPodIP))
-	require.True(t, m.entryExists(defaultAllowIPSetName, barPodIP))
+	require.False(t, m.entriesExist(ingressDefaultAllowIPSetName, fooPodIP))
+	require.False(t, m.entriesExist(egressDefaultAllowIPSetName, fooPodIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, barPodIP))
+	require.True(t, m.entriesExist(egressDefaultAllowIPSetName, barPodIP))

 	podBarWithNewIP := *podBar
 	podBarWithNewIP.Status.PodIP = barPodNewIP
-	controller.UpdatePod(podBar, &podBarWithNewIP)
+	controller.UpdatePod(ctx, podBar, &podBarWithNewIP)

 	// Should update IP addr of the bar pod in default-allow
-	require.False(t, m.entryExists(defaultAllowIPSetName, barPodIP))
-	require.True(t, m.entryExists(defaultAllowIPSetName, barPodNewIP))
+	require.False(t, m.entriesExist(ingressDefaultAllowIPSetName, barPodIP))
+	require.False(t, m.entriesExist(egressDefaultAllowIPSetName, barPodIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, barPodNewIP))
+	require.True(t, m.entriesExist(egressDefaultAllowIPSetName, barPodNewIP))

-	controller.UpdatePod(&podBarWithNewIP, podBarNoIP)
+	controller.UpdatePod(ctx, &podBarWithNewIP, podBarNoIP)
 	// Should remove the bar pod from default-allow as it does not have any IP addr
-	require.False(t, m.entryExists(defaultAllowIPSetName, barPodNewIP))
+	require.False(t, m.entriesExist(ingressDefaultAllowIPSetName, barPodNewIP))
+	require.False(t, m.entriesExist(egressDefaultAllowIPSetName, barPodNewIP))

 	podFooWithNewLabel := *podFoo
 	podFooWithNewLabel.ObjectMeta.Labels = map[string]string{"run": "new-foo"}
-	controller.UpdatePod(podFoo, &podFooWithNewLabel)
+	controller.UpdatePod(ctx, podFoo, &podFooWithNewLabel)

 	// Should bring back the foo pod to default-allow as it does not match dst of any netpol
-	require.True(t, m.entryExists(defaultAllowIPSetName, fooPodIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, fooPodIP))
+	require.True(t, m.entriesExist(egressDefaultAllowIPSetName, fooPodIP))

-	controller.UpdatePod(&podFooWithNewLabel, podFoo)
+	controller.UpdatePod(ctx, &podFooWithNewLabel, podFoo)
 	// Should remove from default-allow as it matches the netpol after the update
-	require.False(t, m.entryExists(defaultAllowIPSetName, fooPodIP))
+	require.False(t, m.entriesExist(ingressDefaultAllowIPSetName, fooPodIP))
+	require.False(t, m.entriesExist(egressDefaultAllowIPSetName, fooPodIP))

-	controller.DeleteNetworkPolicy(netpol)
+	controller.DeleteNetworkPolicy(ctx, netpol)
 	// Should bring back the foo pod to default-allow as no netpol selects it
-	require.True(t, m.entryExists(defaultAllowIPSetName, fooPodIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, fooPodIP))
+	require.True(t, m.entriesExist(egressDefaultAllowIPSetName, fooPodIP))

-	controller.DeletePod(podFoo)
+	controller.DeletePod(ctx, podFoo)
 	// Should remove foo pod from default-allow
-	require.False(t, m.entryExists(defaultAllowIPSetName, fooPodIP))
+	require.False(t, m.entriesExist(ingressDefaultAllowIPSetName, fooPodIP))
+	require.False(t, m.entriesExist(egressDefaultAllowIPSetName, fooPodIP))

-	controller.DeleteNamespace(defaultNamespace)
+	controller.DeleteNamespace(ctx, defaultNamespace)
 	// Should remove default ipset
-	require.NotContains(t, m.sets, defaultAllowIPSetName)
-
+	require.NotContains(t, m.sets, ingressDefaultAllowIPSetName)
+	require.NotContains(t, m.sets, egressDefaultAllowIPSetName)
 }

 func TestOutOfOrderPodEvents(t *testing.T) {
 	const (
-		defaultAllowIPSetName = "weave-E.1.0W^NGSp]0_t5WwH/]gX@L"
-		runBarIPSetName       = "weave-bZ~x=yBgzH)Ht()K*Uv3z{M]Y"
-		podIP                 = "10.32.0.10"
+		ingressDefaultAllowIPSetName = "weave-;rGqyMIl1HN^cfDki~Z$3]6!N"
+		runBarIPSetName              = "weave-bZ~x=yBgzH)Ht()K*Uv3z{M]Y"
+		podIP                        = "10.32.0.10"
 	)

 	m := newMockIPSet()
-	controller := New("qux", false, &mockIPTables{}, &m)
+	client := fake.NewSimpleClientset()
+	controller := New("qux", newMockIPTables(), &m, client)
+	ctx := context.Background()

 	defaultNamespace := &coreapi.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "default",
+			UID:  "default",
 		},
 	}
-	controller.AddNamespace(defaultNamespace)
+	client.CoreV1().Namespaces().Create(ctx, defaultNamespace, metav1.CreateOptions{})
+	controller.AddNamespace(ctx, defaultNamespace)

 	podFoo := &coreapi.Pod{
 		ObjectMeta: metav1.ObjectMeta{
@@ -325,10 +398,10 @@ func TestOutOfOrderPodEvents(t *testing.T) {
 			Name:      "foo",
 			Labels:    map[string]string{"run": "foo"}},
 		Status: coreapi.PodStatus{PodIP: podIP}}
-	controller.AddPod(podFoo)
+	controller.AddPod(ctx, podFoo)

 	// Should be in default-allow as no netpol selects podFoo
-	require.True(t, m.entryExists(defaultAllowIPSetName, podIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, podIP))

 	netpol := &networkingv1.NetworkPolicy{
 		ObjectMeta: metav1.ObjectMeta{
@@ -336,6 +409,7 @@ func TestOutOfOrderPodEvents(t *testing.T) {
 			Namespace: "default",
 		},
 		Spec: networkingv1.NetworkPolicySpec{
+			PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress},
 			PodSelector: metav1.LabelSelector{MatchLabels: map[string]string{"run": "foo"}},
 			Ingress: []networkingv1.NetworkPolicyIngressRule{{
 				From: []networkingv1.NetworkPolicyPeer{{
@@ -346,10 +420,10 @@ func TestOutOfOrderPodEvents(t *testing.T) {
 			}},
 		},
 	}
-	controller.AddNetworkPolicy(netpol)
+	controller.AddNetworkPolicy(ctx, netpol)

 	// Shouldn't be in default-allow as netpol above selects podFoo
-	require.False(t, m.entryExists(defaultAllowIPSetName, podIP))
+	require.False(t, m.entriesExist(ingressDefaultAllowIPSetName, podIP))

 	podBar := &coreapi.Pod{
 		ObjectMeta: metav1.ObjectMeta{
@@ -358,46 +432,50 @@ func TestOutOfOrderPodEvents(t *testing.T) {
 			Name:      "bar",
 			Labels:    map[string]string{"run": "bar"}},
 		Status: coreapi.PodStatus{PodIP: podIP}}
-	controller.AddPod(podBar)
+	controller.AddPod(ctx, podBar)

 	// Should be in default-allow as no netpol selects podBar
-	require.True(t, m.entryExists(defaultAllowIPSetName, podIP))
-	require.True(t, m.Exist(podBar.ObjectMeta.UID, defaultAllowIPSetName, podIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, podIP))
+	require.True(t, m.EntryExists(uid(podBar), ingressDefaultAllowIPSetName, podIP))
 	// Should be in run=bar ipset
-	require.True(t, m.entryExists(runBarIPSetName, podIP))
+	require.True(t, m.entriesExist(runBarIPSetName, podIP))

-	controller.DeletePod(podFoo)
+	controller.DeletePod(ctx, podFoo)
 	// Multiple duplicate events should not affect npc state
-	controller.DeletePod(podFoo)
-	controller.DeletePod(podFoo)
+	controller.DeletePod(ctx, podFoo)
+	controller.DeletePod(ctx, podFoo)

 	// Should be in default-allow as no netpol selects podBar and podFoo removal
 	// should not affect podBar in default-allow
-	require.True(t, m.entryExists(defaultAllowIPSetName, podIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, podIP))

-	controller.DeletePod(podBar)
+	controller.DeletePod(ctx, podBar)

 	// Should remove from default-allow and run=bar ipsets
-	require.Equal(t, 0, len(m.sets[defaultAllowIPSetName].subSets))
-	require.False(t, m.entryExists(runBarIPSetName, podIP))
+	require.Equal(t, 0, len(m.sets[ingressDefaultAllowIPSetName].subSets))
+	require.False(t, m.entriesExist(runBarIPSetName, podIP))
 }

 // Test case for https://github.com/weaveworks/weave/issues/3222
-func TestNewDstSelector(t *testing.T) {
+func TestNewTargetSelector(t *testing.T) {
 	const (
-		defaultAllowIPSetName = "weave-E.1.0W^NGSp]0_t5WwH/]gX@L"
-		podIP                 = "10.32.0.10"
+		ingressDefaultAllowIPSetName = "weave-;rGqyMIl1HN^cfDki~Z$3]6!N"
+		podIP                        = "10.32.0.10"
 	)

 	m := newMockIPSet()
-	controller := New("baz", false, &mockIPTables{}, &m)
+	client := fake.NewSimpleClientset()
+	controller := New("baz", newMockIPTables(), &m, client)
+	ctx := context.Background()

 	defaultNamespace := &coreapi.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "default",
+			UID:  "default",
 		},
 	}
-	controller.AddNamespace(defaultNamespace)
+	client.CoreV1().Namespaces().Create(ctx, defaultNamespace, metav1.CreateOptions{})
+	controller.AddNamespace(ctx, defaultNamespace)

 	podFoo := &coreapi.Pod{
 		ObjectMeta: metav1.ObjectMeta{
@@ -406,9 +484,9 @@ func TestNewDstSelector(t *testing.T) {
 			Name:      "foo",
 			Labels:    map[string]string{"run": "foo"}},
 		Status: coreapi.PodStatus{PodIP: podIP}}
-	controller.AddPod(podFoo)
+	controller.AddPod(ctx, podFoo)

-	require.True(t, m.entryExists(defaultAllowIPSetName, podIP))
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, podIP))

 	netpolBar := &networkingv1.NetworkPolicy{
 		ObjectMeta: metav1.ObjectMeta{
@@ -417,6 +495,7 @@ func TestNewDstSelector(t *testing.T) {
 			Namespace: "default",
 		},
 		Spec: networkingv1.NetworkPolicySpec{
+			PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress},
 			PodSelector: metav1.LabelSelector{},
 			Ingress: []networkingv1.NetworkPolicyIngressRule{{
 				From: []networkingv1.NetworkPolicyPeer{{
@@ -425,10 +504,10 @@ func TestNewDstSelector(t *testing.T) {
 			}},
 		},
 	}
-	controller.AddNetworkPolicy(netpolBar)
+	controller.AddNetworkPolicy(ctx, netpolBar)

-	// netpolBar dst selector selects podFoo
-	require.False(t, m.entryExists(defaultAllowIPSetName, podIP))
+	// netpolBar target selector selects podFoo
+	require.False(t, m.entriesExist(ingressDefaultAllowIPSetName, podIP))

 	netpolFoo := &networkingv1.NetworkPolicy{
 		ObjectMeta: metav1.ObjectMeta{
@@ -437,6 +516,7 @@ func TestNewDstSelector(t *testing.T) {
 			Namespace: "default",
 		},
 		Spec: networkingv1.NetworkPolicySpec{
+			PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress},
 			PodSelector: metav1.LabelSelector{},
 			Ingress: []networkingv1.NetworkPolicyIngressRule{{
 				From: []networkingv1.NetworkPolicyPeer{{
@@ -445,12 +525,188 @@ func TestNewDstSelector(t *testing.T) {
 			}},
 		},
 	}
-	controller.AddNetworkPolicy(netpolFoo)
+	controller.AddNetworkPolicy(ctx, netpolFoo)

-	controller.DeleteNetworkPolicy(netpolBar)
-	// netpolFoo dst-selects podFoo
-	require.False(t, m.entryExists(defaultAllowIPSetName, podIP))
-	controller.DeleteNetworkPolicy(netpolFoo)
-	// No netpol dst-selects podFoo
-	require.True(t, m.entryExists(defaultAllowIPSetName, podIP))
+	controller.DeleteNetworkPolicy(ctx, netpolBar)
+	// netpolFoo target-selects podFoo
+	require.False(t, m.entriesExist(ingressDefaultAllowIPSetName, podIP))
+	controller.DeleteNetworkPolicy(ctx, netpolFoo)
+	// No netpol target-selects podFoo
+	require.True(t, m.entriesExist(ingressDefaultAllowIPSetName, podIP))
+}
+
+func TestEgressPolicyWithIPBlock(t *testing.T) {
+	const (
+		fooPodIP                    = "10.32.0.10"
+		exceptIPSetName             = "weave-j:W$5om!$8JS})buYAD7q^#sX"
+		exceptIPSetNameInNonDefault = "weave-|*P{aL2C@#N/1IZ!IvQItv_pt"
+	)
+
+	m := newMockIPSet()
+	ipt := newMockIPTables()
+	client := fake.NewSimpleClientset()
+	controller := New("foo", ipt, &m, client)
+	ctx := context.Background()
+
+	defaultNamespace := &coreapi.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "default",
+			UID:  "default",
+		},
+	}
+	nonDefaultNamespace := &coreapi.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "non-default",
+			UID:  "non-default",
+		},
+	}
+	client.CoreV1().Namespaces().Create(ctx, defaultNamespace, metav1.CreateOptions{})
+	client.CoreV1().Namespaces().Create(ctx, nonDefaultNamespace, metav1.CreateOptions{})
+
+	netpolFoo := &networkingv1.NetworkPolicy{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       "netpol-foo",
+			Name:      "allow-from-bar-to-foo",
+			Namespace: "default",
+		},
+		Spec: networkingv1.NetworkPolicySpec{
+			PolicyTypes: []networkingv1.PolicyType{
+				networkingv1.PolicyTypeEgress,
+			},
+			PodSelector: metav1.LabelSelector{MatchLabels: map[string]string{"run": "bar"}},
+			Egress: []networkingv1.NetworkPolicyEgressRule{{
+				To: []networkingv1.NetworkPolicyPeer{{
+					IPBlock: &networkingv1.IPBlock{
+						CIDR: "192.168.48.0/24",
+						Except: []string{
+							"192.168.48.1/32",
+							"192.168.48.2/32",
+						},
+					},
+				}},
+			}},
+		},
+	}
+	err := controller.AddNetworkPolicy(ctx, netpolFoo)
+	require.NoError(t, err)
+
+	require.Equal(t, 2, len(m.sets[exceptIPSetName].subSets))
+	require.True(t, m.entriesExist(exceptIPSetName, "192.168.48.1/32"))
+	require.True(t, m.entriesExist(exceptIPSetName, "192.168.48.2/32"))
+
+	// Each egress rule is represented as two iptables rules (-J MARK and -J RETURN).
+	require.Equal(t, 2, len(ipt.rules[chains.EgressCustomChain]))
+	for rule := range ipt.rules[chains.EgressCustomChain] {
+		require.Contains(t, rule, "-d 192.168.48.0/24 -m set ! --match-set "+exceptIPSetName+" dst")
+	}
+
+	// Check that we create a new ipset for the ipBlock bellow. An ipset with the
+	// same content already exists (created by netpolFoo), but we need to create
+	// a new one, as netpolBar is in a different namespace and weave-npc does
+	// object refcounting only within namespace boundaries.
+	netpolBar := &networkingv1.NetworkPolicy{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       "netpol-foo-bar",
+			Name:      "allow-from-bar-to-foo-in-non-default",
+			Namespace: "non-default",
+		},
+		Spec: networkingv1.NetworkPolicySpec{
+			PolicyTypes: []networkingv1.PolicyType{
+				networkingv1.PolicyTypeEgress,
+			},
+			PodSelector: metav1.LabelSelector{MatchLabels: map[string]string{"run": "bar"}},
+			Egress: []networkingv1.NetworkPolicyEgressRule{{
+				To: []networkingv1.NetworkPolicyPeer{{
+					IPBlock: &networkingv1.IPBlock{
+						CIDR: "192.168.48.0/24",
+						Except: []string{
+							"192.168.48.1/32",
+							"192.168.48.2/32",
+						},
+					},
+				}},
+			}},
+		},
+	}
+	err = controller.AddNetworkPolicy(ctx, netpolBar)
+	require.NoError(t, err)
+	require.Equal(t, 2, len(m.sets[exceptIPSetNameInNonDefault].subSets))
+}
+
+// Test case for https://github.com/weaveworks/weave/issues/3653
+func TestIngressPolicyWithIPBlockAndPortSpecified(t *testing.T) {
+	const (
+		barPodIP        = "10.32.0.11"
+		runBarIPSetName = "weave-bZ~x=yBgzH)Ht()K*Uv3z{M]Y"
+	)
+
+	m := newMockIPSet()
+	ipt := newMockIPTables()
+	client := fake.NewSimpleClientset()
+	controller := New("any", ipt, &m, client)
+	ctx := context.Background()
+
+	defaultNamespace := &coreapi.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "default",
+			UID:  "default",
+		},
+	}
+
+	client.CoreV1().Namespaces().Create(ctx, defaultNamespace, metav1.CreateOptions{})
+
+	podBar := &coreapi.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       "bar",
+			Namespace: "default",
+			Name:      "bar",
+			Labels:    map[string]string{"run": "bar"}},
+		Status: coreapi.PodStatus{PodIP: barPodIP}}
+	controller.AddPod(ctx, podBar)
+	defer controller.DeletePod(ctx, podBar)
+
+	portProtocol := coreapi.ProtocolTCP
+	port := intstr.FromInt(80)
+	netpolicty := &networkingv1.NetworkPolicy{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       "ipblock-bar",
+			Name:      "allow-ipblock-to-bar",
+			Namespace: "default",
+		},
+		Spec: networkingv1.NetworkPolicySpec{
+			PolicyTypes: []networkingv1.PolicyType{
+				networkingv1.PolicyTypeIngress,
+			},
+			PodSelector: metav1.LabelSelector{MatchLabels: podBar.Labels},
+			Ingress: []networkingv1.NetworkPolicyIngressRule{
+				{
+					Ports: []networkingv1.NetworkPolicyPort{
+						{
+							Protocol: &portProtocol,
+							Port:     &port,
+						},
+					},
+					From: []networkingv1.NetworkPolicyPeer{
+						{
+							IPBlock: &networkingv1.IPBlock{
+								CIDR: "192.168.48.4/32",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	err := controller.AddNetworkPolicy(ctx, netpolicty)
+	require.NoError(t, err)
+	defer controller.DeleteNetworkPolicy(ctx, netpolicty)
+
+	require.Equal(t, 1, len(m.sets[runBarIPSetName].subSets))
+	require.True(t, m.entriesExist(runBarIPSetName, barPodIP))
+
+	require.Equal(t, 1, len(ipt.rules[chains.IngressChain]))
+	for rule := range ipt.rules[chains.IngressChain] {
+		require.Contains(t, rule, "-s 192.168.48.4/32 -m set --match-set "+runBarIPSetName+" dst --dport 80")
+	}
 }
@@ -0,0 +1,115 @@
+package npc
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	networkingv1 "k8s.io/api/networking/v1"
+
+	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/net/ipset"
+)
+
+type ipBlockSpec struct {
+	key       string
+	ipsetName ipset.Name // ipset for storing excepted CIDRs
+	ipBlock   *networkingv1.IPBlock
+	nsName    string // Namespace name
+}
+
+func newIPBlockSpec(ipb *networkingv1.IPBlock, nsName string) *ipBlockSpec {
+	spec := &ipBlockSpec{ipBlock: ipb, nsName: nsName}
+
+	if len(ipb.Except) > 0 {
+		sort.Strings(ipb.Except)
+		spec.key = strings.Join(ipb.Except, " ")
+		spec.ipsetName = ipset.Name(IpsetNamePrefix + shortName(nsName+":"+"ipblock-except:"+spec.key))
+	}
+
+	return spec
+}
+
+func (spec *ipBlockSpec) getRuleSpec(src bool) ([]string, string) {
+	dir, dirOpt := "dst", "-d"
+	if src {
+		dir, dirOpt = "src", "-s"
+	}
+
+	if spec.key == "" {
+		rule := []string{dirOpt, spec.ipBlock.CIDR}
+		comment := fmt.Sprintf("cidr: %s", spec.ipBlock.CIDR)
+		return rule, comment
+	}
+
+	rule := []string{dirOpt, spec.ipBlock.CIDR,
+		"-m", "set", "!", "--match-set", string(spec.ipsetName), dir}
+	comment := fmt.Sprintf("cidr: %s except [%s]", spec.ipBlock.CIDR, spec.key)
+	return rule, comment
+}
+
+type ipBlockSet struct {
+	ips   ipset.Interface
+	users map[string]map[ipset.UID]struct{}
+}
+
+func newIPBlockSet(ips ipset.Interface) *ipBlockSet {
+	return &ipBlockSet{
+		ips:   ips,
+		users: make(map[string]map[ipset.UID]struct{}),
+	}
+}
+
+func (s *ipBlockSet) deprovision(user ipset.UID, current, desired map[string]*ipBlockSpec) error {
+	for key, spec := range current {
+		if key == "" {
+			continue
+		}
+
+		if _, found := desired[key]; !found {
+			delete(s.users[key], user)
+			if len(s.users[key]) == 0 {
+				common.Log.Infof("destroying ipset: %#v", spec)
+				if err := s.ips.Destroy(spec.ipsetName); err != nil {
+					return err
+				}
+
+				delete(s.users, key)
+			}
+		}
+	}
+
+	return nil
+}
+
+func (s *ipBlockSet) provision(user ipset.UID, current, desired map[string]*ipBlockSpec) (err error) {
+	for key, spec := range desired {
+		if key == "" {
+			// No need to provision an ipBlock with empty list of excepted CIDRs
+			// (i.e. no ipset is needed for the related iptables rule).
+			continue
+		}
+
+		if _, found := current[key]; !found {
+			if _, found := s.users[key]; !found {
+				common.Log.Infof("creating ipset: %#v", spec)
+				if err := s.ips.Create(spec.ipsetName, ipset.HashNet); err != nil {
+					return err
+				}
+
+				// TODO(brb) Pass comment to ips.Create instead.
+				comment := "excepted from " + spec.ipBlock.CIDR
+				for _, cidr := range spec.ipBlock.Except {
+					if err = s.ips.AddEntry(user, spec.ipsetName, cidr, comment); err != nil {
+						return err
+					}
+				}
+
+				s.users[key] = make(map[ipset.UID]struct{})
+			}
+			s.users[key][user] = struct{}{}
+		}
+	}
+
+	return nil
+}
@@ -22,6 +22,12 @@ var (
 		},
 		[]string{"protocol", "dport"},
 	)
+	PolicyEnforcementErrors = prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Name: "weavenpc_policy_enforcement_errors",
+			Help: "Errors occured in enforcing the network policies.",
+		},
+	)
 )

 func gatherMetrics() {
@@ -95,6 +101,9 @@ func Start(addr string) error {
 	if err := prometheus.Register(blockedConnections); err != nil {
 		return err
 	}
+	if err := prometheus.Register(PolicyEnforcementErrors); err != nil {
+		return err
+	}

 	http.Handle("/metrics", promhttp.Handler())

@@ -1,7 +1,6 @@
 package npc

 import (
-	"encoding/json"
 	"errors"
 	"fmt"

@@ -9,11 +8,11 @@ import (
 	extnapi "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/uuid"

 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/common/chains"
+	"github.com/weaveworks/weave/net/ipset"
 	"github.com/weaveworks/weave/npc/iptables"
 )

@@ -23,56 +22,66 @@ type ns struct {
 	ipt iptables.Interface // interface to iptables
 	ips ipset.Interface    // interface to ipset

-	name      string                     // k8s Namespace name
-	nodeName  string                     // my node name
-	namespace *coreapi.Namespace         // k8s Namespace object
-	pods      map[types.UID]*coreapi.Pod // k8s Pod objects by UID
-	policies  map[types.UID]interface{}  // k8s NetworkPolicy objects by UID
+	name            string                     // k8s Namespace name
+	nodeName        string                     // my node name
+	namespaceUID    ipset.UID                  // k8s Namespace UID
+	namespaceLabels map[string]string          // k8s Namespace labels
+	pods            map[ipset.UID]*coreapi.Pod // k8s Pod objects by UID
+	policies        map[ipset.UID]interface{}  // k8s NetworkPolicy objects by UID

-	uid     types.UID     // surrogate UID to own allPods selector
+	uid     ipset.UID     // surrogate UID to own allPods selector
 	allPods *selectorSpec // hash:ip ipset of all pod IPs in this namespace

-	// stores IP addrs of pods which are not selected by any dst podSelector of
-	// any netpol; used only in non-legacy mode and is used as a dst in
-	// the WEAVE-NPC-DEFAULT iptables chain.
-	defaultAllowIPSet ipset.Name
+	// stores IP addrs of pods which are not selected by any target podSelector of
+	// any netpol; used as a target in the WEAVE-NPC-{INGRESS,EGRESS}-DEFAULT
+	// iptables chains.
+	ingressDefaultAllowIPSet ipset.Name
+	egressDefaultAllowIPSet  ipset.Name

-	nsSelectors  *selectorSet
-	podSelectors *selectorSet
-	rules        *ruleSet
-
-	legacy bool
+	nsSelectors             *selectorSet // reference to global selectorSet that is shared across the `ns`. Used to represent all pods in the matching namespaces
+	podSelectors            *selectorSet // used to represent the matching pods in namespace respresented by this `ns`
+	namespacedPodsSelectors *selectorSet // reference to global selectorSet that is shared across the `ns`. Used to represent matching pods in matching namespace
+	ipBlocks                *ipBlockSet
+	rules                   *ruleSet
 }

-func newNS(name, nodeName string, legacy bool, ipt iptables.Interface, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) {
-	allPods, err := newSelectorSpec(&metav1.LabelSelector{}, false, name, ipset.HashIP)
+func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, nsSelectors *selectorSet, namespacedPodsSelectors *selectorSet, namespaceObj *coreapi.Namespace) (*ns, error) {
+	allPods, err := newSelectorSpec(&metav1.LabelSelector{}, nil, nil, name, ipset.HashIP)
 	if err != nil {
 		return nil, err
 	}

 	ns := &ns{
-		ipt:         ipt,
-		ips:         ips,
-		name:        name,
-		nodeName:    nodeName,
-		pods:        make(map[types.UID]*coreapi.Pod),
-		policies:    make(map[types.UID]interface{}),
-		uid:         uuid.NewUUID(),
-		allPods:     allPods,
-		nsSelectors: nsSelectors,
-		rules:       newRuleSet(ipt),
-		legacy:      legacy}
-
-	ns.podSelectors = newSelectorSet(ips, ns.onNewPodSelector, ns.onNewDstPodSelector, ns.onDestroyDstPodSelector)
-
-	if !legacy {
-		defaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("default-allow:"+name))
-		if err := ips.Create(defaultAllowIPSet, ipset.HashIP); err != nil {
-			return nil, err
-		}
-		ns.defaultAllowIPSet = defaultAllowIPSet
+		ipt:                     ipt,
+		ips:                     ips,
+		name:                    name,
+		namespaceUID:            nsuid(namespaceObj),
+		namespaceLabels:         namespaceObj.ObjectMeta.Labels,
+		nodeName:                nodeName,
+		pods:                    make(map[ipset.UID]*coreapi.Pod),
+		policies:                make(map[ipset.UID]interface{}),
+		uid:                     ipset.UID(uuid.NewUUID()),
+		allPods:                 allPods,
+		nsSelectors:             nsSelectors,
+		namespacedPodsSelectors: namespacedPodsSelectors,
+		ipBlocks:                newIPBlockSet(ips),
+		rules:                   newRuleSet(ipt),
 	}

+	ns.podSelectors = newSelectorSet(ips, ns.onNewPodSelector, ns.onNewTargetPodSelector, ns.onDestroyTargetPodSelector)
+
+	ingressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("ingress-default-allow:"+name))
+	if err := ips.Create(ingressDefaultAllowIPSet, ipset.HashIP); err != nil {
+		return nil, err
+	}
+	ns.ingressDefaultAllowIPSet = ingressDefaultAllowIPSet
+
+	egressDefaultAllowIPSet := ipset.Name(IpsetNamePrefix + shortName("egress-default-allow:"+name))
+	if err := ips.Create(egressDefaultAllowIPSet, ipset.HashIP); err != nil {
+		return nil, err
+	}
+	ns.egressDefaultAllowIPSet = egressDefaultAllowIPSet
+
 	if err := ns.podSelectors.provision(ns.uid, nil, map[string]*selectorSpec{ns.allPods.key: ns.allPods}); err != nil {
 		return nil, err
 	}
@@ -81,7 +90,7 @@ func newNS(name, nodeName string, legacy bool, ipt iptables.Interface, ips ipset
 }

 func (ns *ns) empty() bool {
-	return len(ns.pods) == 0 && len(ns.policies) == 0 && ns.namespace == nil
+	return len(ns.pods) == 0 && len(ns.policies) == 0 && ns.namespaceUID == ""
 }

 func (ns *ns) destroy() error {
@@ -91,8 +100,8 @@ func (ns *ns) destroy() error {
 func (ns *ns) onNewPodSelector(selector *selector) error {
 	for _, pod := range ns.pods {
 		if hasIP(pod) {
-			if selector.matches(pod.ObjectMeta.Labels) {
-				if err := selector.addEntry(pod.ObjectMeta.UID, pod.Status.PodIP, podComment(pod)); err != nil {
+			if selector.matchesPodSelector(pod.ObjectMeta.Labels) {
+				if err := selector.addEntry(uid(pod), pod.Status.PodIP, podComment(pod)); err != nil {
 					return err
 				}

@@ -102,16 +111,13 @@ func (ns *ns) onNewPodSelector(selector *selector) error {
 	return nil
 }

-func (ns *ns) onNewDstPodSelector(selector *selector) error {
-	if ns.legacy {
-		return nil
-	}
-
+func (ns *ns) onNewTargetPodSelector(selector *selector, policyType policyType) error {
 	for _, pod := range ns.pods {
 		if hasIP(pod) {
 			// Remove the pod from default-allow if dst podselector matches the pod
-			if selector.matches(pod.ObjectMeta.Labels) {
-				if err := ns.ips.DelEntry(pod.ObjectMeta.UID, ns.defaultAllowIPSet, pod.Status.PodIP); err != nil {
+			ipset := ns.defaultAllowIPSetName(policyType)
+			if selector.matchesPodSelector(pod.ObjectMeta.Labels) {
+				if err := ns.ips.DelEntry(uid(pod), ipset, pod.Status.PodIP); err != nil {
 					return err
 				}
 			}
@@ -121,15 +127,11 @@ func (ns *ns) onNewDstPodSelector(selector *selector) error {
 	return nil
 }

-func (ns *ns) onDestroyDstPodSelector(selector *selector) error {
-	if ns.legacy {
-		return nil
-	}
-
+func (ns *ns) onDestroyTargetPodSelector(selector *selector, policyType policyType) error {
 	for _, pod := range ns.pods {
 		if hasIP(pod) {
-			if selector.matches(pod.ObjectMeta.Labels) {
-				if err := ns.addToDefaultAllowIfNoMatching(pod); err != nil {
+			if selector.matchesPodSelector(pod.ObjectMeta.Labels) {
+				if err := ns.addToDefaultAllowIfNoMatching(pod, policyType); err != nil {
 					return err
 				}
 			}
@@ -139,107 +141,107 @@ func (ns *ns) onDestroyDstPodSelector(selector *selector) error {
 	return nil
 }

-// Add pod IP addr to default-allow ipset if there are no matching dst selectors
-func (ns *ns) addToDefaultAllowIfNoMatching(pod *coreapi.Pod) error {
+// Add pod IP addr to default-allow ipset if there are no matching target selectors
+func (ns *ns) addToDefaultAllowIfNoMatching(pod *coreapi.Pod, policyType policyType) error {
 	found := false
 	// TODO(mp) optimize (avoid iterating over selectors) by ref counting IP addrs.
 	for _, s := range ns.podSelectors.entries {
-		if ns.podSelectors.dstSelectorExist(s) && s.matches(pod.ObjectMeta.Labels) {
+		if ns.podSelectors.targetSelectorExist(s, policyType) && s.matchesPodSelector(pod.ObjectMeta.Labels) {
 			found = true
 			break
 		}
 	}
 	if !found {
-		if err := ns.ips.AddEntry(pod.ObjectMeta.UID, ns.defaultAllowIPSet, pod.Status.PodIP, podComment(pod)); err != nil {
+		ipset := ns.defaultAllowIPSetName(policyType)
+		if err := ns.ips.AddEntry(uid(pod), ipset, pod.Status.PodIP, podComment(pod)); err != nil {
 			return err
 		}
 	}
 	return nil
 }

-func (ns *ns) checkLocalPod(obj *coreapi.Pod) bool {
-	if obj.Spec.NodeName != ns.nodeName {
-		return false
-	}
-	return true
-}
-
 func (ns *ns) addPod(obj *coreapi.Pod) error {
-	ns.pods[obj.ObjectMeta.UID] = obj
+	ns.pods[uid(obj)] = obj

 	if !hasIP(obj) {
 		return nil
 	}

-	if ns.checkLocalPod(obj) {
-		ns.ips.AddEntry(obj.ObjectMeta.UID, LocalIpset, obj.Status.PodIP, podComment(obj))
-	}
-
-	found, err := ns.podSelectors.addToMatching(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
+	foundIngress, foundEgress, err := ns.podSelectors.addToMatchingPodSelector(uid(obj), obj.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
 	if err != nil {
 		return err
 	}
-	// If there are no matching dst selectors, add the pod to default-allow
-	if !ns.legacy && !found {
-		if err := ns.ips.AddEntry(obj.ObjectMeta.UID, ns.defaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil {
+	// If there are no matching target selectors, add the pod to default-allow
+	if !foundIngress {
+		if err := ns.ips.AddEntry(uid(obj), ns.ingressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil {
 			return err
 		}
 	}
+	if !foundEgress {
+		if err := ns.ips.AddEntry(uid(obj), ns.egressDefaultAllowIPSet, obj.Status.PodIP, podComment(obj)); err != nil {
+			return err
+		}
+	}
+
+	err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(uid(obj), obj.ObjectMeta.Labels, ns.namespaceLabels, obj.Status.PodIP, podComment(obj))
+	if err != nil {
+		return err
+	}

 	return nil
 }

 func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
-	delete(ns.pods, oldObj.ObjectMeta.UID)
-	ns.pods[newObj.ObjectMeta.UID] = newObj
+	delete(ns.pods, uid(oldObj))
+	ns.pods[uid(newObj)] = newObj

 	if !hasIP(oldObj) && !hasIP(newObj) {
 		return nil
 	}

 	if hasIP(oldObj) && !hasIP(newObj) {
-		if ns.checkLocalPod(oldObj) {
-			ns.ips.DelEntry(oldObj.ObjectMeta.UID, LocalIpset, oldObj.Status.PodIP)
+		if err := ns.ips.DelEntry(uid(oldObj), ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
+			return err
+		}
+		if err := ns.ips.DelEntry(uid(oldObj), ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
+			return err
+		}
+		if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(uid(oldObj), oldObj.ObjectMeta.Labels, ns.namespaceLabels, oldObj.Status.PodIP); err != nil {
+			return err
 		}

-		if !ns.legacy {
-			if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.defaultAllowIPSet, oldObj.Status.PodIP); err != nil {
-				return err
-			}
-		}
-
-		return ns.podSelectors.delFromMatching(oldObj.ObjectMeta.UID, oldObj.ObjectMeta.Labels, oldObj.Status.PodIP)
+		return ns.podSelectors.delFromMatchingPodSelector(uid(oldObj), oldObj.ObjectMeta.Labels, oldObj.Status.PodIP)
 	}

 	if !hasIP(oldObj) && hasIP(newObj) {
-		if ns.checkLocalPod(newObj) {
-			ns.ips.AddEntry(newObj.ObjectMeta.UID, LocalIpset, newObj.Status.PodIP, podComment(newObj))
-		}
-		found, err := ns.podSelectors.addToMatching(newObj.ObjectMeta.UID, newObj.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
+		foundIngress, foundEgress, err := ns.podSelectors.addToMatchingPodSelector(uid(newObj), newObj.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
 		if err != nil {
 			return err
 		}

-		if !ns.legacy && !found {
-			if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.defaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil {
+		if !foundIngress {
+			if err := ns.ips.AddEntry(uid(newObj), ns.ingressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil {
 				return err
 			}
 		}
+		if !foundEgress {
+			if err := ns.ips.AddEntry(uid(newObj), ns.egressDefaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil {
+				return err
+			}
+		}
+		err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(uid(newObj), newObj.ObjectMeta.Labels, ns.namespaceLabels, newObj.Status.PodIP, podComment(newObj))
+		if err != nil {
+			return err
+		}

 		return nil
 	}

-	if !ns.legacy &&
-		oldObj.Status.PodIP != newObj.Status.PodIP &&
-		ns.ips.Exist(oldObj.ObjectMeta.UID, ns.defaultAllowIPSet, oldObj.Status.PodIP) {
-		// Instead of iterating over all selectors we check whether old pod IP
-		// has been inserted into default-allow ipset to decide whether the IP
-		// in the ipset has to be updated.
-
-		if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.defaultAllowIPSet, oldObj.Status.PodIP); err != nil {
+	if oldObj.Status.PodIP != newObj.Status.PodIP {
+		if err := ns.updateDefaultAllowIPSetEntry(oldObj, newObj, ns.ingressDefaultAllowIPSet); err != nil {
 			return err
 		}
-		if err := ns.ips.AddEntry(newObj.ObjectMeta.UID, ns.defaultAllowIPSet, newObj.Status.PodIP, podComment(newObj)); err != nil {
+		if err := ns.updateDefaultAllowIPSetEntry(oldObj, newObj, ns.egressDefaultAllowIPSet); err != nil {
 			return err
 		}
 	}
@@ -248,32 +250,43 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 		oldObj.Status.PodIP != newObj.Status.PodIP {

 		for _, ps := range ns.podSelectors.entries {
-			oldMatch := ps.matches(oldObj.ObjectMeta.Labels)
-			newMatch := ps.matches(newObj.ObjectMeta.Labels)
+			oldMatch := ps.matchesPodSelector(oldObj.ObjectMeta.Labels)
+			newMatch := ps.matchesPodSelector(newObj.ObjectMeta.Labels)
 			if oldMatch == newMatch && oldObj.Status.PodIP == newObj.Status.PodIP {
 				continue
 			}
 			if oldMatch {
-				if err := ps.delEntry(oldObj.ObjectMeta.UID, oldObj.Status.PodIP); err != nil {
+				if err := ps.delEntry(uid(oldObj), oldObj.Status.PodIP); err != nil {
 					return err
 				}
 			}
 			if newMatch {
-				if err := ps.addEntry(newObj.ObjectMeta.UID, newObj.Status.PodIP, podComment(newObj)); err != nil {
+				if err := ps.addEntry(uid(newObj), newObj.Status.PodIP, podComment(newObj)); err != nil {
 					return err
 				}
 			}

-			if !ns.legacy && ns.podSelectors.dstSelectorExist(ps) {
-				switch {
-				case !oldMatch && newMatch:
-					if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.defaultAllowIPSet, oldObj.Status.PodIP); err != nil {
-						return err
-					}
-				case oldMatch && !newMatch:
-					if err := ns.addToDefaultAllowIfNoMatching(newObj); err != nil {
-						return err
-					}
+			if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeIngress); err != nil {
+				return err
+			}
+			if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeEgress); err != nil {
+				return err
+			}
+		}
+		for _, ps := range ns.namespacedPodsSelectors.entries {
+			oldMatch := ps.matchesNamespacedPodSelector(oldObj.ObjectMeta.Labels, ns.namespaceLabels)
+			newMatch := ps.matchesNamespacedPodSelector(newObj.ObjectMeta.Labels, ns.namespaceLabels)
+			if oldMatch == newMatch && oldObj.Status.PodIP == newObj.Status.PodIP {
+				continue
+			}
+			if oldMatch {
+				if err := ps.delEntry(uid(oldObj), oldObj.Status.PodIP); err != nil {
+					return err
+				}
+			}
+			if newMatch {
+				if err := ps.addEntry(uid(newObj), newObj.Status.PodIP, podComment(newObj)); err != nil {
+					return err
 				}
 			}
 		}
@@ -282,30 +295,49 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 	return nil
 }

+func (ns *ns) addOrRemoveToDefaultAllowIPSet(ps *selector, oldObj, newObj *coreapi.Pod, oldMatch, newMatch bool, policyType policyType) error {
+	ipset := ns.defaultAllowIPSetName(policyType)
+	if ns.podSelectors.targetSelectorExist(ps, policyType) {
+		switch {
+		case !oldMatch && newMatch:
+			if err := ns.ips.DelEntry(uid(oldObj), ipset, oldObj.Status.PodIP); err != nil {
+				return err
+			}
+		case oldMatch && !newMatch:
+			if err := ns.addToDefaultAllowIfNoMatching(newObj, policyType); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
 func (ns *ns) deletePod(obj *coreapi.Pod) error {
-	delete(ns.pods, obj.ObjectMeta.UID)
+	delete(ns.pods, uid(obj))

 	if !hasIP(obj) {
 		return nil
 	}

-	if ns.checkLocalPod(obj) {
-		ns.ips.DelEntry(obj.ObjectMeta.UID, LocalIpset, obj.Status.PodIP)
+	if err := ns.ips.DelEntry(uid(obj), ns.ingressDefaultAllowIPSet, obj.Status.PodIP); err != nil {
+		return err
 	}
-
-	if !ns.legacy {
-		if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.defaultAllowIPSet, obj.Status.PodIP); err != nil {
-			return err
-		}
+	if err := ns.ips.DelEntry(uid(obj), ns.egressDefaultAllowIPSet, obj.Status.PodIP); err != nil {
+		return err
 	}
-
-	return ns.podSelectors.delFromMatching(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP)
+	if err := ns.podSelectors.delFromMatchingPodSelector(uid(obj), obj.ObjectMeta.Labels, obj.Status.PodIP); err != nil {
+		return err
+	}
+	if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(uid(obj), obj.ObjectMeta.Labels, ns.namespaceLabels, obj.Status.PodIP); err != nil {
+		return err
+	}
+	return nil
 }

 func (ns *ns) addNetworkPolicy(obj interface{}) error {
 	// Analyse policy, determine which rules and ipsets are required

-	uid, rules, nsSelectors, podSelectors, err := ns.analyse(obj)
+	uid, rules, nsSelectors, podSelectors, namespacedPodsSelectors, ipBlocks, err := ns.analyse(obj)
 	if err != nil {
 		return err
 	}
@@ -317,16 +349,22 @@ func (ns *ns) addNetworkPolicy(obj interface{}) error {
 	if err := ns.podSelectors.provision(uid, nil, podSelectors); err != nil {
 		return err
 	}
+	if err := ns.namespacedPodsSelectors.provision(uid, nil, namespacedPodsSelectors); err != nil {
+		return err
+	}
+	if err := ns.ipBlocks.provision(uid, nil, ipBlocks); err != nil {
+		return err
+	}
 	return ns.rules.provision(uid, nil, rules)
 }

 func (ns *ns) updateNetworkPolicy(oldObj, newObj interface{}) error {
 	// Analyse the old and the new policy so we can determine differences
-	oldUID, oldRules, oldNsSelectors, oldPodSelectors, err := ns.analyse(oldObj)
+	oldUID, oldRules, oldNsSelectors, oldPodSelectors, oldNamespacedPodsSelectors, oldIPBlocks, err := ns.analyse(oldObj)
 	if err != nil {
 		return err
 	}
-	newUID, newRules, newNsSelectors, newPodSelectors, err := ns.analyse(newObj)
+	newUID, newRules, newNsSelectors, newPodSelectors, newNamespacedPodsSelectors, newIPBlocks, err := ns.analyse(newObj)
 	if err != nil {
 		return err
 	}
@@ -344,18 +382,30 @@ func (ns *ns) updateNetworkPolicy(oldObj, newObj interface{}) error {
 	if err := ns.podSelectors.deprovision(oldUID, oldPodSelectors, newPodSelectors); err != nil {
 		return err
 	}
+	if err := ns.namespacedPodsSelectors.deprovision(oldUID, oldNamespacedPodsSelectors, newNamespacedPodsSelectors); err != nil {
+		return err
+	}
+	if err := ns.ipBlocks.deprovision(oldUID, oldIPBlocks, newIPBlocks); err != nil {
+		return err
+	}
 	if err := ns.nsSelectors.provision(oldUID, oldNsSelectors, newNsSelectors); err != nil {
 		return err
 	}
 	if err := ns.podSelectors.provision(oldUID, oldPodSelectors, newPodSelectors); err != nil {
 		return err
 	}
+	if err := ns.namespacedPodsSelectors.provision(oldUID, oldNamespacedPodsSelectors, newNamespacedPodsSelectors); err != nil {
+		return err
+	}
+	if err := ns.ipBlocks.provision(oldUID, oldIPBlocks, newIPBlocks); err != nil {
+		return err
+	}
 	return ns.rules.provision(oldUID, oldRules, newRules)
 }

 func (ns *ns) deleteNetworkPolicy(obj interface{}) error {
 	// Analyse network policy to free resources
-	uid, rules, nsSelectors, podSelectors, err := ns.analyse(obj)
+	uid, rules, nsSelectors, podSelectors, namespacedPodsSelectors, ipBlocks, err := ns.analyse(obj)
 	if err != nil {
 		return err
 	}
@@ -369,88 +419,108 @@ func (ns *ns) deleteNetworkPolicy(obj interface{}) error {
 	if err := ns.nsSelectors.deprovision(uid, nsSelectors, nil); err != nil {
 		return err
 	}
-	return ns.podSelectors.deprovision(uid, podSelectors, nil)
-}
-
-func bypassRule(nsIpsetName ipset.Name, namespace string) []string {
-	return []string{"-m", "set", "--match-set", string(nsIpsetName), "dst", "-j", "ACCEPT", "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace}
-}
-
-func (ns *ns) ensureBypassRule() error {
-	var ipset ipset.Name
-	if ns.legacy {
-		ipset = ns.allPods.ipsetName
-	} else {
-		ipset = ns.defaultAllowIPSet
+	if err := ns.podSelectors.deprovision(uid, podSelectors, nil); err != nil {
+		return err
+	}
+	if err := ns.namespacedPodsSelectors.deprovision(uid, namespacedPodsSelectors, nil); err != nil {
+		return err
+	}
+	if err := ns.ipBlocks.deprovision(uid, ipBlocks, nil); err != nil {
+		return err
 	}

-	common.Log.Debugf("ensuring rule for DefaultAllow in namespace: %s, set %s", ns.name, ipset)
-	return ns.ipt.Append(TableFilter, DefaultChain, bypassRule(ipset, ns.name)...)
+	return nil
 }

-func (ns *ns) deleteBypassRule() error {
-	var ipset ipset.Name
-	if ns.legacy {
-		ipset = ns.allPods.ipsetName
-	} else {
-		ipset = ns.defaultAllowIPSet
-	}
+func (ns *ns) updateDefaultAllowIPSetEntry(oldObj, newObj *coreapi.Pod, ipsetName ipset.Name) error {
+	// Instead of iterating over all selectors we check whether old pod IP
+	// has been inserted into default-allow ipset to decide whether the IP
+	// in the ipset has to be updated.
+	if ns.ips.EntryExists(uid(oldObj), ipsetName, oldObj.Status.PodIP) {

-	common.Log.Debugf("removing default rule in namespace: %s, set %s", ns.name, ipset)
-	return ns.ipt.Delete(TableFilter, DefaultChain, bypassRule(ipset, ns.name)...)
-}
-
-func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
-	ns.namespace = obj
-
-	// Insert a rule to bypass policies if namespace is DefaultAllow
-	if !ns.isDefaultDeny(obj) {
-		if err := ns.ensureBypassRule(); err != nil {
+		if err := ns.ips.DelEntry(uid(oldObj), ipsetName, oldObj.Status.PodIP); err != nil {
+			return err
+		}
+		if err := ns.ips.AddEntry(uid(newObj), ipsetName, newObj.Status.PodIP, podComment(newObj)); err != nil {
 			return err
 		}
 	}
+	return nil
+}
+
+func bypassRules(namespace string, ingress, egress ipset.Name) map[string][][]string {
+	return map[string][][]string{
+		chains.DefaultChain: {
+			{"-m", "set", "--match-set", string(ingress), "dst", "-j", "ACCEPT",
+				"-m", "comment", "--comment", "DefaultAllow ingress isolation for namespace: " + namespace},
+		},
+		chains.EgressDefaultChain: {
+			{"-m", "set", "--match-set", string(egress), "src", "-j", chains.EgressMarkChain,
+				"-m", "comment", "--comment", "DefaultAllow egress isolation for namespace: " + namespace},
+			{"-m", "set", "--match-set", string(egress), "src", "-j", "RETURN",
+				"-m", "comment", "--comment", "DefaultAllow egress isolation for namespace: " + namespace},
+		},
+	}
+}
+
+func (ns *ns) ensureBypassRules() error {
+	for chain, rules := range bypassRules(ns.name, ns.ingressDefaultAllowIPSet, ns.egressDefaultAllowIPSet) {
+		for _, rule := range rules {
+			common.Log.Debugf("adding rule for DefaultAllow in namespace: %s, chain: %s, %s", ns.name, chain, rule)
+			if err := ns.ipt.Append(TableFilter, chain, rule...); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (ns *ns) deleteBypassRules() error {
+	for chain, rules := range bypassRules(ns.name, ns.ingressDefaultAllowIPSet, ns.egressDefaultAllowIPSet) {
+		for _, rule := range rules {
+			common.Log.Debugf("removing rule for DefaultAllow in namespace: %s, chain: %s, %s", ns.name, chain, rule)
+			if err := ns.ipt.Delete(TableFilter, chain, rule...); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
+	ns.namespaceUID = ipset.UID(obj.ObjectMeta.UID)
+	ns.namespaceLabels = obj.ObjectMeta.Labels
+
+	// Insert a rule to bypass policies
+	if err := ns.ensureBypassRules(); err != nil {
+		return err
+	}

 	// Add namespace ipset to matching namespace selectors
-	_, err := ns.nsSelectors.addToMatching(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, string(ns.allPods.ipsetName), namespaceComment(ns))
+	err := ns.nsSelectors.addToMatchingNamespaceSelector(nsuid(obj), obj.ObjectMeta.Labels, string(ns.allPods.ipsetName), namespaceComment(ns))
 	return err
 }

 func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
-	ns.namespace = newObj
-
-	// Update bypass rule if ingress default has changed
-	oldDefaultDeny := ns.isDefaultDeny(oldObj)
-	newDefaultDeny := ns.isDefaultDeny(newObj)
-
-	if oldDefaultDeny != newDefaultDeny {
-		common.Log.Infof("namespace DefaultDeny changed from %t to %t", oldDefaultDeny, newDefaultDeny)
-		if oldDefaultDeny {
-			if err := ns.ensureBypassRule(); err != nil {
-				return err
-			}
-		}
-		if newDefaultDeny {
-			if err := ns.deleteBypassRule(); err != nil {
-				return err
-			}
-		}
-	}
-
 	// Re-evaluate namespace selector membership if labels have changed
 	if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) {
+		ns.namespaceLabels = newObj.ObjectMeta.Labels
+
 		for _, selector := range ns.nsSelectors.entries {
-			oldMatch := selector.matches(oldObj.ObjectMeta.Labels)
-			newMatch := selector.matches(newObj.ObjectMeta.Labels)
+			oldMatch := selector.matchesNamespaceSelector(oldObj.ObjectMeta.Labels)
+			newMatch := selector.matchesNamespaceSelector(newObj.ObjectMeta.Labels)
 			if oldMatch == newMatch {
 				continue
 			}
 			if oldMatch {
-				if err := selector.delEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName)); err != nil {
+				if err := selector.delEntry(ns.namespaceUID, string(ns.allPods.ipsetName)); err != nil {
 					return err
 				}
 			}
 			if newMatch {
-				if err := selector.addEntry(ns.namespace.ObjectMeta.UID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
+				if err := selector.addEntry(ns.namespaceUID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
 					return err
 				}
 			}
@@ -461,51 +531,29 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
 }

 func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error {
-	ns.namespace = nil
+	ns.namespaceUID = ""

 	// Remove bypass rule
-	if !ns.isDefaultDeny(obj) {
-		if err := ns.deleteBypassRule(); err != nil {
-			return err
-		}
+	if err := ns.deleteBypassRules(); err != nil {
+		return err
 	}

 	// Remove namespace ipset from any matching namespace selectors
-	err := ns.nsSelectors.delFromMatching(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, string(ns.allPods.ipsetName))
+	err := ns.nsSelectors.delFromMatchingNamespaceSelector(nsuid(obj), obj.ObjectMeta.Labels, string(ns.allPods.ipsetName))
 	if err != nil {
 		return err
 	}

-	if !ns.legacy {
-		return ns.ips.Destroy(ns.defaultAllowIPSet)
+	if err := ns.ips.Destroy(ns.ingressDefaultAllowIPSet); err != nil {
+		return err
+	}
+	if err := ns.ips.Destroy(ns.egressDefaultAllowIPSet); err != nil {
+		return err
 	}

 	return nil
 }

-func (ns *ns) isDefaultDeny(namespace *coreapi.Namespace) bool {
-	nnpJSON, found := namespace.ObjectMeta.Annotations["net.beta.kubernetes.io/network-policy"]
-	if !found {
-		return false
-	}
-
-	if !ns.legacy {
-		common.Log.Warn("DefaultDeny annotation is supported only in legacy mode (--use-legacy-netpol)")
-		return false
-	}
-
-	var nnp NamespaceNetworkPolicy
-	if err := json.Unmarshal([]byte(nnpJSON), &nnp); err != nil {
-		common.Log.Warn("Ignoring network policy annotation: unmarshal failed:", err)
-		// If we can't understand the annotation, behave as if it isn't present
-		return false
-	}
-
-	return nnp.Ingress != nil &&
-		nnp.Ingress.Isolation != nil &&
-		*(nnp.Ingress.Isolation) == DefaultDeny
-}
-
 func hasIP(pod *coreapi.Pod) bool {
 	// Ensure pod isn't dead, has an IP address and isn't sharing the host network namespace
 	return pod.Status.Phase != "Succeeded" && pod.Status.Phase != "Failed" &&
@@ -532,17 +580,26 @@ func podComment(pod *coreapi.Pod) string {
 	return fmt.Sprintf("namespace: %s, pod: %s", pod.ObjectMeta.Namespace, pod.ObjectMeta.Name)
 }

+func (ns *ns) defaultAllowIPSetName(pt policyType) ipset.Name {
+	ipset := ns.ingressDefaultAllowIPSet
+	if pt == policyTypeEgress {
+		ipset = ns.egressDefaultAllowIPSet
+	}
+	return ipset
+}
+
 func (ns *ns) analyse(obj interface{}) (
-	uid types.UID,
+	uid ipset.UID,
 	rules map[string]*ruleSpec,
-	nsSelectors, podSelectors map[string]*selectorSpec,
+	nsSelectors, podSelectors, namespacedPodsSelectors map[string]*selectorSpec,
+	ipBlocks map[string]*ipBlockSpec,
 	err error) {

 	switch p := obj.(type) {
 	case *extnapi.NetworkPolicy:
-		uid = p.ObjectMeta.UID
+		uid = ipset.UID(p.ObjectMeta.UID)
 	case *networkingv1.NetworkPolicy:
-		uid = p.ObjectMeta.UID
+		uid = ipset.UID(p.ObjectMeta.UID)
 	default:
 		err = errInvalidNetworkPolicyObjType
 		return
@@ -550,16 +607,9 @@ func (ns *ns) analyse(obj interface{}) (
 	ns.policies[uid] = obj

 	// Analyse policy, determine which rules and ipsets are required
-	if ns.legacy {
-		rules, nsSelectors, podSelectors, err = ns.analysePolicyLegacy(obj.(*extnapi.NetworkPolicy))
-		if err != nil {
-			return
-		}
-	} else {
-		rules, nsSelectors, podSelectors, err = ns.analysePolicy(obj.(*networkingv1.NetworkPolicy))
-		if err != nil {
-			return
-		}
+	rules, nsSelectors, podSelectors, namespacedPodsSelectors, ipBlocks, err = ns.analysePolicy(obj.(*networkingv1.NetworkPolicy))
+	if err != nil {
+		return
 	}

 	return
@@ -2,66 +2,104 @@ package npc

 import (
 	"fmt"
+	"reflect"
 	"strings"

-	"k8s.io/apimachinery/pkg/types"
-
 	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/common/chains"
+	"github.com/weaveworks/weave/net/ipset"
 	"github.com/weaveworks/weave/npc/iptables"
 )

-type ruleSpec struct {
-	key  string
-	args []string
+type ruleHost interface {
+	// getRuleSpec returns source or destination specification and comment which
+	// are used in an iptables rule.
+	//
+	// If src=true then the rulespec is for source, otherwise - for destination.
+	getRuleSpec(src bool) ([]string, string)
 }

-func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, dstPort *string) *ruleSpec {
+type ruleSpec struct {
+	key        string
+	args       []string
+	policyType policyType
+}
+
+func newRuleSpec(policyType policyType, proto *string, srcHost, dstHost ruleHost, dstPort *string) *ruleSpec {
 	args := []string{}
 	if proto != nil {
 		args = append(args, "-p", *proto)
 	}
 	srcComment := "anywhere"
-	if srcHost != nil {
-		args = append(args, "-m", "set", "--match-set", string(srcHost.ipsetName), "src")
-		if srcHost.nsName != "" {
-			srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key)
-		} else {
-			srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key)
-		}
+	if srcHost != nil && !reflect.ValueOf(srcHost).IsNil() {
+		rule, comment := srcHost.getRuleSpec(true)
+		args = append(args, rule...)
+		srcComment = comment
 	}
 	dstComment := "anywhere"
-	if dstHost != nil {
-		args = append(args, "-m", "set", "--match-set", string(dstHost.ipsetName), "dst")
-		dstComment = fmt.Sprintf("pods: namespace: %s, selector: %s", dstHost.nsName, dstHost.key)
+	if dstHost != nil && !reflect.ValueOf(dstHost).IsNil() {
+		rule, comment := dstHost.getRuleSpec(false)
+		args = append(args, rule...)
+		dstComment = comment
 	}
 	if dstPort != nil {
 		args = append(args, "--dport", *dstPort)
 	}
-	args = append(args, "-j", "ACCEPT")
-	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment))
+	// NOTE: if you remove the comment bellow, then embed `policyType` into `key`.
+	// Otherwise, the rule won't be provisioned if it exists for other policy type.
+	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s (%s)", srcComment, dstComment, policyTypeStr(policyType)))
 	key := strings.Join(args, " ")

-	return &ruleSpec{key, args}
+	return &ruleSpec{key, args, policyType}
+}
+
+func (spec *ruleSpec) iptChain() string {
+	if spec.policyType == policyTypeEgress {
+		return chains.EgressCustomChain
+	}
+	return chains.IngressChain
+}
+
+func (spec *ruleSpec) iptRuleSpecs() [][]string {
+	if spec.policyType == policyTypeIngress {
+		rule := make([]string, len(spec.args))
+		copy(rule, spec.args)
+		rule = append(rule, "-j", "ACCEPT")
+		return [][]string{rule}
+	}
+
+	// policyTypeEgress
+	ruleMark := make([]string, len(spec.args))
+	copy(ruleMark, spec.args)
+	ruleMark = append(ruleMark, "-j", chains.EgressMarkChain)
+	ruleReturn := make([]string, len(spec.args))
+	copy(ruleReturn, spec.args)
+	ruleReturn = append(ruleReturn, "-j", "RETURN")
+	return [][]string{ruleMark, ruleReturn}
 }

 type ruleSet struct {
 	ipt   iptables.Interface
-	users map[string]map[types.UID]struct{}
+	users map[string]map[ipset.UID]struct{}
 }

 func newRuleSet(ipt iptables.Interface) *ruleSet {
-	return &ruleSet{ipt, make(map[string]map[types.UID]struct{})}
+	return &ruleSet{ipt, make(map[string]map[ipset.UID]struct{})}
 }

-func (rs *ruleSet) deprovision(user types.UID, current, desired map[string]*ruleSpec) error {
+func (rs *ruleSet) deprovision(user ipset.UID, current, desired map[string]*ruleSpec) error {
 	for key, spec := range current {
 		if _, found := desired[key]; !found {
 			delete(rs.users[key], user)
 			if len(rs.users[key]) == 0 {
-				common.Log.Infof("deleting rule: %v", spec.args)
-				if err := rs.ipt.Delete(TableFilter, IngressChain, spec.args...); err != nil {
-					return err
+				chain := spec.iptChain()
+				for _, rule := range spec.iptRuleSpecs() {
+					common.Log.Infof("deleting rule %v from %q chain", rule, chain)
+					if err := rs.ipt.Delete(TableFilter, chain, rule...); err != nil {
+						return err
+					}
 				}
+
 				delete(rs.users, key)
 			}
 		}
@@ -70,15 +108,18 @@ func (rs *ruleSet) deprovision(user types.UID, current, desired map[string]*rule
 	return nil
 }

-func (rs *ruleSet) provision(user types.UID, current, desired map[string]*ruleSpec) error {
+func (rs *ruleSet) provision(user ipset.UID, current, desired map[string]*ruleSpec) error {
 	for key, spec := range desired {
 		if _, found := current[key]; !found {
 			if _, found := rs.users[key]; !found {
-				common.Log.Infof("adding rule: %v", spec.args)
-				if err := rs.ipt.Append(TableFilter, IngressChain, spec.args...); err != nil {
-					return err
+				chain := spec.iptChain()
+				for _, rule := range spec.iptRuleSpecs() {
+					common.Log.Infof("adding rule %v to %q chain", rule, chain)
+					if err := rs.ipt.Append(TableFilter, chain, rule...); err != nil {
+						return err
+					}
 				}
-				rs.users[key] = make(map[types.UID]struct{})
+				rs.users[key] = make(map[ipset.UID]struct{})
 			}
 			rs.users[key][user] = struct{}{}
 		}
@@ -9,7 +9,7 @@ func TestRegressionHandleNil3095(t *testing.T) {
 	// Test for handling nil values
 	// https://github.com/weaveworks/weave/issues/3095

-	rs := newRuleSpec(nil, nil, nil, nil)
+	rs := newRuleSpec(policyTypeIngress, nil, nil, nil, nil)

 	require.NotEqual(t, rs.key, "")

@@ -1,34 +1,49 @@
 package npc

 import (
+	"fmt"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/types"

 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/net/ipset"
 )

 type selectorSpec struct {
-	key      string          // string representation (for hash keying/equality comparison)
-	selector labels.Selector // k8s Selector object (for matching)
-	dst      bool            // destination selector
+	key               string          // string representation (for hash keying/equality comparison)
+	podSelector       labels.Selector // k8s Selector object (for matching pods)
+	namespaceSelector labels.Selector // k8s Selector object (for matching namespaces)
+	policyTypes       []policyType    // If non-empty, then selectorSpec is a target selector for given policyTypes.

 	ipsetType ipset.Type // type of ipset to provision
 	ipsetName ipset.Name // generated ipset name
 	nsName    string     // Namespace name
 }

-func newSelectorSpec(json *metav1.LabelSelector, dst bool, nsName string, ipsetType ipset.Type) (*selectorSpec, error) {
-	selector, err := metav1.LabelSelectorAsSelector(json)
-	if err != nil {
-		return nil, err
+func newSelectorSpec(podJSON *metav1.LabelSelector, namespaceJSON *metav1.LabelSelector, policyType []policyType, nsName string, ipsetType ipset.Type) (*selectorSpec, error) {
+	var podSelector, namespaceSelector labels.Selector
+	var err error
+	var key string
+	if namespaceJSON != nil {
+		namespaceSelector, err = metav1.LabelSelectorAsSelector(namespaceJSON)
+		if err != nil {
+			return nil, err
+		}
+		key = namespaceSelector.String()
+	}
+	if podJSON != nil {
+		podSelector, err = metav1.LabelSelectorAsSelector(podJSON)
+		if err != nil {
+			return nil, err
+		}
+		key = key + podSelector.String()
 	}
-	key := selector.String()
 	return &selectorSpec{
-		key:      key,
-		selector: selector,
-		dst:      dst,
+		key:               key,
+		podSelector:       podSelector,
+		namespaceSelector: namespaceSelector,
+		policyTypes:       policyType,
 		// We prefix the selector string with the namespace name when generating
 		// the shortname because you can specify the same selector in multiple
 		// namespaces - we need those to map to distinct ipsets
@@ -37,72 +52,124 @@ func newSelectorSpec(json *metav1.LabelSelector, dst bool, nsName string, ipsetT
 		nsName:    nsName}, nil
 }

+func (spec *selectorSpec) getRuleSpec(src bool) ([]string, string) {
+	dir := "dst"
+	if src {
+		dir = "src"
+	}
+	rule := []string{"-m", "set", "--match-set", string(spec.ipsetName), dir}
+
+	var comment string
+	if spec.nsName != "" {
+		comment = fmt.Sprintf("pods: namespace: %s, selector: %s", spec.nsName, spec.key)
+	} else {
+		comment = fmt.Sprintf("namespaces: selector: %s", spec.key)
+	}
+
+	return rule, comment
+}
+
 type selector struct {
 	ips  ipset.Interface
 	spec *selectorSpec
 }

-func (s *selector) matches(labelMap map[string]string) bool {
-	return s.spec.selector.Matches(labels.Set(labelMap))
+func (s *selector) matchesPodSelector(podsLabelMap map[string]string) bool {
+	return s.spec.podSelector.Matches(labels.Set(podsLabelMap))
 }

-func (s *selector) addEntry(user types.UID, entry string, comment string) error {
+func (s *selector) matchesNamespaceSelector(namespaceLabelMap map[string]string) bool {
+	return s.spec.namespaceSelector.Matches(labels.Set(namespaceLabelMap))
+}
+
+func (s *selector) matchesNamespacedPodSelector(podsLabelMap, namespaceLabelMap map[string]string) bool {
+	return s.spec.podSelector.Matches(labels.Set(podsLabelMap)) && s.spec.namespaceSelector.Matches(labels.Set(namespaceLabelMap))
+}
+
+func (s *selector) addEntry(user ipset.UID, entry string, comment string) error {
 	return s.ips.AddEntry(user, s.spec.ipsetName, entry, comment)
 }

-func (s *selector) delEntry(user types.UID, entry string) error {
+func (s *selector) delEntry(user ipset.UID, entry string) error {
 	return s.ips.DelEntry(user, s.spec.ipsetName, entry)
 }

 type selectorFn func(selector *selector) error
+type selectorWithPolicyTypeFn func(selector *selector, policyType policyType) error

 type selectorSet struct {
 	ips           ipset.Interface
 	onNewSelector selectorFn

-	// invoked after dst selector has been provisioned for the first time
-	onNewDstSelector selectorFn
-	// invoked after the last instance of dst selector has been deprovisioned
-	onDestroyDstSelector selectorFn
+	// invoked after target selector has been provisioned for the first time
+	onNewTargetSelector selectorWithPolicyTypeFn
+	// invoked after the last instance of target selector has been deprovisioned
+	onDestroyTargetSelector selectorWithPolicyTypeFn

-	users   map[string]map[types.UID]struct{} // list of users per selector
+	users   map[string]map[ipset.UID]struct{} // list of users per selector
 	entries map[string]*selector

-	// We need to keep track of dst selector instances to be able to invoke
-	// onNewDstSelector and onDestroyDstSelector callbacks at the right time;
-	// selectorSpec.Key -> count
-	dstSelectorsCount map[string]int
+	// We need to keep track of target selector instances to be able to invoke
+	// onNewTargetSelector and onDestroyTargetSelector callbacks at the right time;
+	// selectorSpec.Key -> policyType -> count
+	targetSelectorsCount map[string]map[policyType]int
 }

-func newSelectorSet(ips ipset.Interface, onNewSelector, onNewDstSelector selectorFn, onDestroyDstSelector selectorFn) *selectorSet {
+func newSelectorSet(ips ipset.Interface, onNewSelector selectorFn, onNewTargetSelector, onDestroyTargetSelector selectorWithPolicyTypeFn) *selectorSet {
 	return &selectorSet{
-		ips:                  ips,
-		onNewSelector:        onNewSelector,
-		onNewDstSelector:     onNewDstSelector,
-		onDestroyDstSelector: onDestroyDstSelector,
-		users:                make(map[string]map[types.UID]struct{}),
+		ips:                     ips,
+		onNewSelector:           onNewSelector,
+		onNewTargetSelector:     onNewTargetSelector,
+		onDestroyTargetSelector: onDestroyTargetSelector,
+		users:                make(map[string]map[ipset.UID]struct{}),
 		entries:              make(map[string]*selector),
-		dstSelectorsCount:    make(map[string]int)}
+		targetSelectorsCount: make(map[string]map[policyType]int)}
 }

-func (ss *selectorSet) addToMatching(user types.UID, labelMap map[string]string, entry string, comment string) (bool, error) {
-	found := false
+func (ss *selectorSet) addToMatchingPodSelector(user ipset.UID, podLabelsMap map[string]string, entry string, comment string) (bool, bool, error) {
+	foundIngress := false
+	foundEgress := false
 	for _, s := range ss.entries {
-		if s.matches(labelMap) {
-			if ss.dstSelectorExist(s) {
-				found = true
+		if s.matchesPodSelector(podLabelsMap) {
+			if ss.targetSelectorExist(s, policyTypeIngress) {
+				foundIngress = true
+			}
+			if ss.targetSelectorExist(s, policyTypeEgress) {
+				foundEgress = true
 			}
 			if err := s.addEntry(user, entry, comment); err != nil {
-				return found, err
+				return foundIngress, foundEgress, err
 			}
 		}
 	}
-	return found, nil
+	return foundIngress, foundEgress, nil
 }

-func (ss *selectorSet) delFromMatching(user types.UID, labelMap map[string]string, entry string) error {
+func (ss *selectorSet) addToMatchingNamespaceSelector(user ipset.UID, namespaceLabelsMap map[string]string, entry string, comment string) error {
 	for _, s := range ss.entries {
-		if s.matches(labelMap) {
+		if s.matchesNamespaceSelector(namespaceLabelsMap) {
+			if err := s.addEntry(user, entry, comment); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (ss *selectorSet) addToMatchingNamespacedPodSelector(user ipset.UID, podLabelsMap map[string]string, namespaceLabelsMap map[string]string, entry string, comment string) error {
+	for _, s := range ss.entries {
+		if s.matchesNamespacedPodSelector(podLabelsMap, namespaceLabelsMap) {
+			if err := s.addEntry(user, entry, comment); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (ss *selectorSet) delFromMatchingPodSelector(user ipset.UID, podLabelsMap map[string]string, entry string) error {
+	for _, s := range ss.entries {
+		if s.matchesPodSelector(podLabelsMap) {
 			if err := s.delEntry(user, entry); err != nil {
 				return err
 			}
@@ -111,11 +178,33 @@ func (ss *selectorSet) delFromMatching(user types.UID, labelMap map[string]strin
 	return nil
 }

-func (ss *selectorSet) dstSelectorExist(s *selector) bool {
-	return ss.dstSelectorsCount[s.spec.key] > 0
+func (ss *selectorSet) delFromMatchingNamespaceSelector(user ipset.UID, namespaceLabelsMap map[string]string, entry string) error {
+	for _, s := range ss.entries {
+		if s.matchesNamespaceSelector(namespaceLabelsMap) {
+			if err := s.delEntry(user, entry); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
 }

-func (ss *selectorSet) deprovision(user types.UID, current, desired map[string]*selectorSpec) error {
+func (ss *selectorSet) delFromMatchingNamespacedPodSelector(user ipset.UID, podLabelsMap map[string]string, namespaceLabelsMap map[string]string, entry string) error {
+	for _, s := range ss.entries {
+		if s.matchesNamespacedPodSelector(podLabelsMap, namespaceLabelsMap) {
+			if err := s.delEntry(user, entry); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (ss *selectorSet) targetSelectorExist(s *selector, policyType policyType) bool {
+	return ss.targetSelectorsCount[s.spec.key][policyType] > 0
+}
+
+func (ss *selectorSet) deprovision(user ipset.UID, current, desired map[string]*selectorSpec) error {
 	for key, spec := range current {
 		if _, found := desired[key]; !found {
 			delete(ss.users[key], user)
@@ -129,20 +218,21 @@ func (ss *selectorSet) deprovision(user types.UID, current, desired map[string]*
 				delete(ss.users, key)
 			}

-			if spec.dst {
-				ss.dstSelectorsCount[key]--
-				if ss.dstSelectorsCount[key] == 0 {
-					if err := ss.onDestroyDstSelector(&selector{ss.ips, spec}); err != nil {
+			for _, policyType := range spec.policyTypes {
+				ss.targetSelectorsCount[key][policyType]--
+				if ss.targetSelectorsCount[key][policyType] == 0 {
+					if err := ss.onDestroyTargetSelector(&selector{ss.ips, spec}, policyType); err != nil {
 						return err
 					}
 				}
+				// TODO(brb) delete(...)
 			}
 		}
 	}
 	return nil
 }

-func (ss *selectorSet) provision(user types.UID, current, desired map[string]*selectorSpec) error {
+func (ss *selectorSet) provision(user ipset.UID, current, desired map[string]*selectorSpec) error {
 	for key, spec := range desired {
 		if _, found := current[key]; !found {
 			selector := &selector{ss.ips, spec}
@@ -155,15 +245,18 @@ func (ss *selectorSet) provision(user types.UID, current, desired map[string]*se
 				if err := ss.onNewSelector(selector); err != nil {
 					return err
 				}
-				ss.users[key] = make(map[types.UID]struct{})
+				ss.users[key] = make(map[ipset.UID]struct{})
 				ss.entries[key] = selector
 			}
 			ss.users[key][user] = struct{}{}

-			if spec.dst {
-				ss.dstSelectorsCount[key]++
-				if ss.dstSelectorsCount[key] == 1 {
-					if err := ss.onNewDstSelector(selector); err != nil {
+			for _, pt := range spec.policyTypes {
+				if _, found := ss.targetSelectorsCount[key]; !found {
+					ss.targetSelectorsCount[key] = make(map[policyType]int)
+				}
+				ss.targetSelectorsCount[key][pt]++
+				if ss.targetSelectorsCount[key][pt] == 1 {
+					if err := ss.onNewTargetSelector(selector, pt); err != nil {
 						return err
 					}
 				}
@@ -0,0 +1,15 @@
+package npc
+
+type policyType byte
+
+const (
+	policyTypeIngress policyType = iota
+	policyTypeEgress
+)
+
+func policyTypeStr(policyType policyType) string {
+	if policyType == policyTypeEgress {
+		return "egress"
+	}
+	return "ingress"
+}
@@ -110,6 +110,10 @@ func (i *Ipam) ReleaseAddress(poolID string, address net.IP) error {
 	return i.weave.ReleaseIPsFor(address.String())
 }

+func (i *Ipam) IsBuiltIn() bool {
+	return false
+}
+
 // Functions required by ipamapi "contract" but not actually used.

 func (i *Ipam) DiscoverNew(discoverapi.DiscoveryType, interface{}) error {
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"strings"

 	"github.com/containernetworking/cni/pkg/ipam"
 	"github.com/containernetworking/cni/pkg/skel"
@@ -117,6 +118,16 @@ func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error {
 	}
 	defer ns.Close()

+	hostNs, err := netns.Get()
+	if err != nil {
+		return fmt.Errorf("error accessing host network namespace: %s", err)
+	}
+	defer hostNs.Close()
+
+	if ns.Equal(hostNs) {
+		return fmt.Errorf("can not specify host network namespace as network namespace to which container should be added")
+	}
+
 	id := args.ContainerID
 	if len(id) < 5 {
 		data := make([]byte, 5)
@@ -130,7 +141,7 @@ func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error {
 	if err := weavenet.AttachContainer(args.Netns, id, args.IfName, conf.BrName, conf.MTU, false, []*net.IPNet{&ip.Address}, false, conf.HairpinMode); err != nil {
 		return err
 	}
-	if err := weavenet.WithNetNSLinkUnsafe(ns, args.IfName, func(link netlink.Link) error {
+	if err := weavenet.WithNetNSLink(ns, args.IfName, func(link netlink.Link) error {
 		return setupRoutes(link, args.IfName, ip.Address, ip.Gateway, result.Routes)
 	}); err != nil {
 		return fmt.Errorf("error setting up routes: %s", err)
@@ -177,7 +188,13 @@ func (c *CNIPlugin) CmdDel(args *skel.CmdArgs) error {

 	// As of CNI 0.3 spec, runtimes can send blank if they just want the address deallocated
 	if args.Netns != "" {
-		if _, err = weavenet.WithNetNS(args.Netns, "del-iface", args.IfName); err != nil {
+		if err = weavenet.WithNetNSByPath(args.Netns, func() error {
+			link, err := netlink.LinkByName(args.IfName)
+			if err != nil {
+				return err
+			}
+			return netlink.LinkDel(link)
+		}); err != nil {
 			// We log the error and carry on instead of returning nil, as there may still be resources to free in IPAM.
 			logOnStderr(fmt.Errorf("error removing interface %q: %s", args.IfName, err))
 		}
@@ -190,7 +207,13 @@ func (c *CNIPlugin) CmdDel(args *skel.CmdArgs) error {
 		err = ipam.ExecDel(conf.IPAM.Type, args.StdinData)
 	}
 	if err != nil {
+		if strings.Contains(err.Error(), fmt.Sprintf("Delete: no addresses for %s", args.ContainerID)) {
+			// ignore the error in the case where there are no IP addresses associated with container
+			fmt.Fprintln(os.Stderr, "weave-cni:", fmt.Sprintf("Delete: no addresses for %s", args.ContainerID))
+			return nil
+		}
 		logOnStderr(fmt.Errorf("unable to release IP address: %s", err))
+		return err
 	}
 	return nil
 }
@@ -39,9 +39,10 @@ type driver struct {
 	// used only by plugin-v2
 	forceMulticast bool
 	networks       map[string]network
+	procPath       string
 }

-func New(client *docker.Client, weave *weaveapi.Client, name, scope string, dns, isPluginV2, forceMulticast bool) (skel.Driver, error) {
+func New(client *docker.Client, weave *weaveapi.Client, name, scope string, dns, isPluginV2, forceMulticast bool, procPath string) (skel.Driver, error) {
 	driver := &driver{
 		name:       name,
 		scope:      scope,
@@ -51,6 +52,7 @@ func New(client *docker.Client, weave *weaveapi.Client, name, scope string, dns,
 		// make sure that it's used only by plugin-v2
 		forceMulticast: isPluginV2 && forceMulticast,
 		networks:       make(map[string]network),
+		procPath:       procPath,
 	}

 	// Do not start watcher in the case of plugin v2, which prevents us from
@@ -134,7 +136,7 @@ func (driver *driver) CreateEndpoint(create *api.CreateEndpointRequest) (*api.Cr

 	// create veths. note we assume endpoint IDs are unique in the first 9 chars
 	name, peerName := vethPair(create.EndpointID)
-	if _, err := weavenet.CreateAndAttachVeth(name, peerName, weavenet.WeaveBridgeName, 0, false, true, nil); err != nil {
+	if _, err := weavenet.CreateAndAttachVeth(driver.procPath, name, peerName, weavenet.WeaveBridgeName, 0, false, true, nil); err != nil {
 		return nil, driver.error("JoinEndpoint", "%s", err)
 	}

@@ -29,6 +29,12 @@ func (w *watcher) ContainerStarted(id string) {
 		w.driver.warn("ContainerStarted", "error inspecting container %s: %s", id, err)
 		return
 	}
+
+	domain, err := w.weave.DNSDomain()
+	if err != nil {
+		w.driver.warn("ContainerStarted", "unable to get weave dns domain: %s", err)
+	}
+
 	// check that it's on our network
 	for _, net := range info.NetworkSettings.Networks {
 		network, err := w.driver.findNetworkInfo(net.NetworkID)
@@ -39,17 +45,28 @@ func (w *watcher) ContainerStarted(id string) {
 		if network.isOurs {
 			if w.driver.dns {
 				fqdn := fmt.Sprintf("%s.%s", info.Config.Hostname, info.Config.Domainname)
-				if err := w.weave.RegisterWithDNS(id, fqdn, net.IPAddress); err != nil {
-					w.driver.warn("ContainerStarted", "unable to register %s with weaveDNS: %s", id, err)
+
+				aliases := make([]string, 0, len(net.Aliases)+2)
+				aliases = append(aliases, fqdn)
+
+				if len(domain) > 0 && len(info.Name) > 1 && info.Name[0] == '/' {
+					name := fmt.Sprintf("%s.%s", info.Name[1:], domain)
+					aliases = append(aliases, name)
+				}
+
+				aliases = append(aliases, net.Aliases...)
+
+				for _, alias := range aliases {
+					w.driver.debug("ContainerStarted", "going to register %s with weaveDNS", alias)
+					if err := w.weave.RegisterWithDNS(id, alias, net.IPAddress); err != nil {
+						w.driver.warn("ContainerStarted", "unable to register %s with weaveDNS: %s", id, err)
+					}
 				}
 			}
-			rootDir := "/"
-			if w.driver.isPluginV2 {
-				// We bind mount host's /proc to /host/proc for plugin-v2
-				rootDir = "/host"
-			}
-			netNSPath := weavenet.NSPathByPidWithRoot(rootDir, info.State.Pid)
-			if _, err := weavenet.WithNetNS(netNSPath, "configure-arp", weavenet.VethName, rootDir); err != nil {
+			netNSPath := weavenet.NSPathByPidWithProc(w.driver.procPath, info.State.Pid)
+			if err := weavenet.WithNetNSByPath(netNSPath, func() error {
+				return weavenet.ConfigureARP(weavenet.VethName, w.driver.procPath)
+			}); err != nil {
 				w.driver.warn("ContainerStarted", "unable to configure interfaces: %s", err)
 			}
 		}
@@ -32,6 +32,7 @@ type Config struct {
 	EnableV2Multicast bool
 	DNS               bool
 	DefaultSubnet     string
+	ProcPath          string // path to reach host /proc filesystem
 }

 type Plugin struct {
@@ -62,7 +63,7 @@ func (plugin *Plugin) run(dockerClient *docker.Client, weave *weaveapi.Client, r
 	endChan := make(chan error, 1)

 	if plugin.Socket != "" {
-		globalListener, err := listenAndServe(dockerClient, weave, plugin.Socket, endChan, "global", false, plugin.DNS, plugin.EnableV2, plugin.EnableV2Multicast)
+		globalListener, err := listenAndServe(dockerClient, weave, plugin.Socket, endChan, "global", false, plugin.DNS, plugin.EnableV2, plugin.EnableV2Multicast, plugin.ProcPath)
 		if err != nil {
 			return err
 		}
@@ -70,7 +71,7 @@ func (plugin *Plugin) run(dockerClient *docker.Client, weave *weaveapi.Client, r
 		defer globalListener.Close()
 	}
 	if plugin.MeshSocket != "" {
-		meshListener, err := listenAndServe(dockerClient, weave, plugin.MeshSocket, endChan, "local", true, plugin.DNS, plugin.EnableV2, plugin.EnableV2Multicast)
+		meshListener, err := listenAndServe(dockerClient, weave, plugin.MeshSocket, endChan, "local", true, plugin.DNS, plugin.EnableV2, plugin.EnableV2Multicast, plugin.ProcPath)
 		if err != nil {
 			return err
 		}
@@ -87,7 +88,7 @@ func (plugin *Plugin) run(dockerClient *docker.Client, weave *weaveapi.Client, r
 	return <-endChan
 }

-func listenAndServe(dockerClient *docker.Client, weave *weaveapi.Client, address string, endChan chan<- error, scope string, withIpam, dns bool, isPluginV2, forceMulticast bool) (net.Listener, error) {
+func listenAndServe(dockerClient *docker.Client, weave *weaveapi.Client, address string, endChan chan<- error, scope string, withIpam, dns bool, isPluginV2, forceMulticast bool, procPath string) (net.Listener, error) {
 	var name string
 	if isPluginV2 {
 		name = pluginV2Name
@@ -95,7 +96,7 @@ func listenAndServe(dockerClient *docker.Client, weave *weaveapi.Client, address
 		name = pluginNameFromAddress(address)
 	}

-	d, err := netplugin.New(dockerClient, weave, name, scope, dns, isPluginV2, forceMulticast)
+	d, err := netplugin.New(dockerClient, weave, name, scope, dns, isPluginV2, forceMulticast, procPath)
 	if err != nil {
 		return nil, err
 	}
@@ -201,24 +201,6 @@ func (listener *listener) leaveEndpoint(w http.ResponseWriter, r *http.Request)
 	emptyOrErrorResponse(w, listener.d.LeaveEndpoint(&l))
 }

-func (listener *listener) discoverNew(w http.ResponseWriter, r *http.Request) {
-	var disco api.DiscoveryNotification
-	if err := json.NewDecoder(r.Body).Decode(&disco); err != nil {
-		sendError(w, "Could not decode JSON encoded payload", http.StatusBadRequest)
-		return
-	}
-	emptyOrErrorResponse(w, listener.d.DiscoverNew(&disco))
-}
-
-func (listener *listener) discoverDelete(w http.ResponseWriter, r *http.Request) {
-	var disco api.DiscoveryNotification
-	if err := json.NewDecoder(r.Body).Decode(&disco); err != nil {
-		sendError(w, "Could not decode JSON encoded payload", http.StatusBadRequest)
-		return
-	}
-	emptyOrErrorResponse(w, listener.d.DiscoverDelete(&disco))
-}
-
 // ===

 func (listener *listener) getIpamCapabilities(w http.ResponseWriter, r *http.Request) {
@@ -1,236 +0,0 @@
-/*
-Package main deals with weave-net peers on the cluster.
-
-This involves peer management, such as getting the latest peers or removing defunct peers from the cluster
-*/
-package main
-
-import (
-	"flag"
-	"fmt"
-	"net"
-	"os"
-
-	api "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/rest"
-
-	weaveapi "github.com/weaveworks/weave/api"
-	"github.com/weaveworks/weave/common"
-)
-
-type nodeInfo struct {
-	name string
-	addr string
-}
-
-// return the IP addresses of all nodes in the cluster
-func getKubePeers(c *kubernetes.Clientset) ([]nodeInfo, error) {
-	nodeList, err := c.CoreV1().Nodes().List(api.ListOptions{})
-	if err != nil {
-		return nil, err
-	}
-	addresses := make([]nodeInfo, 0, len(nodeList.Items))
-	for _, peer := range nodeList.Items {
-		var internalIP, externalIP string
-		for _, addr := range peer.Status.Addresses {
-			// Check it's a valid ipv4 address
-			ip := net.ParseIP(addr.Address)
-			if ip == nil || ip.To4() == nil {
-				continue
-			}
-			if addr.Type == "InternalIP" {
-				internalIP = ip.To4().String()
-			} else if addr.Type == "ExternalIP" {
-				externalIP = ip.To4().String()
-			}
-		}
-
-		// Fallback for cases where a Node has an ExternalIP but no InternalIP
-		if internalIP != "" {
-			addresses = append(addresses, nodeInfo{name: peer.Name, addr: internalIP})
-		} else if externalIP != "" {
-			addresses = append(addresses, nodeInfo{name: peer.Name, addr: externalIP})
-		}
-	}
-	return addresses, nil
-}
-
-const (
-	configMapName      = "weave-net"
-	configMapNamespace = "kube-system"
-)
-
-// update the list of all peers that have gone through this code path
-func addMyselfToPeerList(cml *configMapAnnotations, c *kubernetes.Clientset, peerName, name string) (*peerList, error) {
-	var list *peerList
-	err := cml.LoopUpdate(func() error {
-		var err error
-		list, err = cml.GetPeerList()
-		if err != nil {
-			return err
-		}
-		if !list.contains(peerName) {
-			list.add(peerName, name)
-			err = cml.UpdatePeerList(*list)
-			if err != nil {
-				return err
-			}
-		}
-		return nil
-	})
-	return list, err
-}
-
-func checkIamInPeerList(cml *configMapAnnotations, c *kubernetes.Clientset, peerName string) (bool, error) {
-	if err := cml.Init(); err != nil {
-		return false, err
-	}
-	list, err := cml.GetPeerList()
-	if err != nil {
-		return false, err
-	}
-	common.Log.Debugf("[kube-peers] Checking peer %q against list %v", peerName, list)
-	return list.contains(peerName), nil
-}
-
-// For each of those peers that is no longer listed as a node by
-// Kubernetes, remove it from Weave IPAM
-func reclaimRemovedPeers(weave *weaveapi.Client, cml *configMapAnnotations, nodes []nodeInfo, myPeerName string) error {
-	for {
-		if err := cml.Init(); err != nil {
-			return err
-		}
-		// 1. Compare peers stored in the peerList against all peers reported by k8s now.
-		storedPeerList, err := cml.GetPeerList()
-		if err != nil {
-			return err
-		}
-		peerMap := make(map[string]peerInfo, len(storedPeerList.Peers))
-		for _, peer := range storedPeerList.Peers {
-			peerMap[peer.NodeName] = peer
-		}
-		for _, node := range nodes {
-			delete(peerMap, node.name)
-		}
-		common.Log.Debugln("[kube-peers] Nodes that have disappeared:", peerMap)
-		if len(peerMap) == 0 {
-			break
-		}
-		// 2. Loop for each X in the first set and not in the second - we wish to remove X from our data structures
-		for _, peer := range peerMap {
-			common.Log.Debugln("[kube-peers] Preparing to remove disappeared peer", peer)
-			okToRemove := false
-			// 3. Check if there is an existing annotation with key X
-			if existingAnnotation, found := cml.GetAnnotation(KubePeersPrefix + peer.PeerName); found {
-				common.Log.Debugln("[kube-peers] Existing annotation", existingAnnotation)
-				// 4.   If annotation already contains my identity, ok;
-				if existingAnnotation == myPeerName {
-					okToRemove = true
-				}
-			} else {
-				// 5.   If non-existent, write an annotation with key X and contents "my identity"
-				common.Log.Debugln("[kube-peers] Noting I plan to remove ", peer.PeerName)
-				if err := cml.UpdateAnnotation(KubePeersPrefix+peer.PeerName, myPeerName); err == nil {
-					okToRemove = true
-				} else {
-					common.Log.Debugln("[kube-peers] error from UpdateAnnotation: ", err)
-				}
-			}
-			if okToRemove {
-				// 6.   If step 4 or 5 succeeded, rmpeer X
-				result, err := weave.RmPeer(peer.PeerName)
-				common.Log.Infof("[kube-peers] rmpeer of %s: %s", peer.PeerName, result)
-				if err != nil {
-					return err
-				}
-				cml.LoopUpdate(func() error {
-					// 7aa.   Remove any annotations Z* that have contents X
-					if err := cml.RemoveAnnotationsWithValue(peer.PeerName); err != nil {
-						return err
-					}
-					// 7a.    Remove X from peerList
-					storedPeerList.remove(peer.PeerName)
-					if err := cml.UpdatePeerList(*storedPeerList); err != nil {
-						return err
-					}
-					// 7b.    Remove annotation with key X
-					return cml.RemoveAnnotation(KubePeersPrefix + peer.PeerName)
-				})
-			}
-			// 8.   If step 5 failed due to optimistic lock conflict, stop: someone else is handling X
-
-			// Step 3-5 is to protect against two simultaneous rmpeers of X
-			// Step 4 is to pick up again after a restart between step 5 and step 7b
-			// If the peer doing the reclaim disappears between steps 5 and 7a, then someone will clean it up in step 7aa
-			// If peer doing the reclaim disappears forever between 7a and 7b then we get a dangling annotation
-			// This should be sufficiently rare that we don't care.
-		}
-
-		// 9. Go back to step 1 until there is no difference between the two sets
-	}
-	// Question: Should we narrow step 2 by checking against Weave Net IPAM?
-	// i.e. If peer X owns any address space and is marked unreachable, we want to rmpeer X
-	return nil
-}
-
-func main() {
-	var (
-		justReclaim bool
-		justCheck   bool
-		peerName    string
-		nodeName    string
-		logLevel    string
-	)
-	flag.BoolVar(&justReclaim, "reclaim", false, "reclaim IP space from dead peers")
-	flag.BoolVar(&justCheck, "check-peer-new", false, "return success if peer name is not stored in annotation")
-	flag.StringVar(&peerName, "peer-name", "unknown", "name of this Weave Net peer")
-	flag.StringVar(&nodeName, "node-name", "unknown", "name of this Kubernetes node")
-	flag.StringVar(&logLevel, "log-level", "info", "logging level (debug, info, warning, error)")
-	flag.Parse()
-
-	common.SetLogLevel(logLevel)
-	config, err := rest.InClusterConfig()
-	if err != nil {
-		common.Log.Fatalf("[kube-peers] Could not get cluster config: %v", err)
-	}
-	c, err := kubernetes.NewForConfig(config)
-	if err != nil {
-		common.Log.Fatalf("[kube-peers] Could not make Kubernetes connection: %v", err)
-	}
-	if justCheck {
-		cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
-		exists, err := checkIamInPeerList(cml, c, peerName)
-		if err != nil {
-			common.Log.Fatalf("[kube-peers] Could not check peer list: %v", err)
-		}
-		if exists {
-			os.Exit(9)
-		} else {
-			os.Exit(0)
-		}
-	}
-	peers, err := getKubePeers(c)
-	if err != nil {
-		common.Log.Fatalf("[kube-peers] Could not get peers: %v", err)
-	}
-	if justReclaim {
-		cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
-
-		list, err := addMyselfToPeerList(cml, c, peerName, nodeName)
-		if err != nil {
-			common.Log.Fatalf("[kube-peers] Could not update peer list: %v", err)
-		}
-		common.Log.Infoln("[kube-peers] Added myself to peer list", list)
-
-		weave := weaveapi.NewClient(os.Getenv("WEAVE_HTTP_ADDR"), common.Log)
-		err = reclaimRemovedPeers(weave, cml, peers, peerName)
-		if err != nil {
-			common.Log.Fatalf("[kube-peers] Error while reclaiming space: %v", err)
-		}
-		return
-	}
-	for _, node := range peers {
-		fmt.Println(node.addr)
-	}
-}
@@ -2,13 +2,11 @@
 In order to keep track of active weave peers, we use annotations on the Kubernetes cluster.

 Kubernetes uses etcd to distribute and synchronise these annotations so we don't have to.
-
-This module deals with operations on the peerlist backed by Kubernetes' annotation mechanism.
 */
 package main

 import (
-	"encoding/json"
+	"context"
 	"log"
 	"time"

@@ -29,43 +27,11 @@ type configMapAnnotations struct {
 	cm            *v1.ConfigMap
 }

-func newConfigMapAnnotations(ns string, configMapName string, clientset *kubernetes.Clientset) *configMapAnnotations {
+func newConfigMapAnnotations(ns string, configMapName string, c kubernetes.Interface) *configMapAnnotations {
 	return &configMapAnnotations{
 		Namespace:     ns,
 		ConfigMapName: configMapName,
-		Client:        clientset.CoreV1(),
-	}
-}
-
-type peerList struct {
-	Peers []peerInfo
-}
-
-type peerInfo struct {
-	PeerName string // Weave internal unique ID
-	NodeName string // Kubernetes node name
-}
-
-func (pl peerList) contains(peerName string) bool {
-	for _, peer := range pl.Peers {
-		if peer.PeerName == peerName {
-			return true
-		}
-	}
-	return false
-}
-
-func (pl *peerList) add(peerName string, name string) {
-	pl.Peers = append(pl.Peers, peerInfo{PeerName: peerName, NodeName: name})
-}
-
-func (pl *peerList) remove(peerNameToRemove string) {
-	for i := 0; i < len(pl.Peers); {
-		if pl.Peers[i].PeerName == peerNameToRemove {
-			pl.Peers = append(pl.Peers[:i], pl.Peers[i+1:]...)
-		} else {
-			i++
-		}
+		Client:        c.CoreV1(),
 	}
 }

@@ -73,29 +39,31 @@ const (
 	retryPeriod  = time.Second * 2
 	jitterFactor = 1.0

+	progName = "kube-peers.weave.works"
 	// Prefix all our annotation keys with this string so they don't clash with anyone else's
-	KubePeersPrefix = "kube-peers.weave.works/"
+	KubePeersPrefix = progName + "/"
 	// KubePeersAnnotationKey is the default annotation key
 	KubePeersAnnotationKey = KubePeersPrefix + "peers"
 )

 func (cml *configMapAnnotations) Init() error {
+	ctx := context.Background()
 	for {
 		// Since it's potentially racy to GET, then CREATE if not found, we wrap in a check loop
 		// so that if the configmap is created after our GET but before or CREATE, we'll gracefully
 		// re-try to get the configmap.
 		var err error
-		cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Get(cml.ConfigMapName, api.GetOptions{})
+		cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Get(ctx, cml.ConfigMapName, api.GetOptions{})
 		if err != nil {
 			if !kubeErrors.IsNotFound(err) {
 				return errors.Wrapf(err, "Unable to fetch ConfigMap %s/%s", cml.Namespace, cml.ConfigMapName)
 			}
-			cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Create(&v1.ConfigMap{
+			cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Create(ctx, &v1.ConfigMap{
 				ObjectMeta: api.ObjectMeta{
 					Name:      cml.ConfigMapName,
 					Namespace: cml.Namespace,
 				},
-			})
+			}, api.CreateOptions{FieldManager: progName})
 			if err != nil {
 				if kubeErrors.IsAlreadyExists(err) {
 					continue
@@ -111,27 +79,6 @@ func (cml *configMapAnnotations) Init() error {
 	return nil
 }

-func (cml *configMapAnnotations) GetPeerList() (*peerList, error) {
-	var record peerList
-	if cml.cm == nil {
-		return nil, errors.New("endpoint not initialized, call Init first")
-	}
-	if recordBytes, found := cml.cm.Annotations[KubePeersAnnotationKey]; found {
-		if err := json.Unmarshal([]byte(recordBytes), &record); err != nil {
-			return nil, err
-		}
-	}
-	return &record, nil
-}
-
-func (cml *configMapAnnotations) UpdatePeerList(list peerList) error {
-	recordBytes, err := json.Marshal(list)
-	if err != nil {
-		return err
-	}
-	return cml.UpdateAnnotation(KubePeersAnnotationKey, string(recordBytes))
-}
-
 // Clean up a string so it meets the Kubernetes requiremements for Annotation keys:
 // name part must consist of alphanumeric characters, '-', '_' or '.', and must
 // start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc')
@@ -151,40 +98,40 @@ func (cml *configMapAnnotations) GetAnnotation(key string) (string, bool) {
 	return value, ok
 }

-func (cml *configMapAnnotations) UpdateAnnotation(key, value string) (err error) {
-	if cml.cm == nil {
+func (cml *configMapAnnotations) UpdateAnnotation(ctx context.Context, key, value string) (err error) {
+	if cml.cm == nil || cml.cm.Annotations == nil {
 		return errors.New("endpoint not initialized, call Init first")
 	}
 	// speculatively change the state, then replace with whatever comes back
-	// from Update(), which will be the latest on the server whatever happened
+	// from Update(), which will be the latest on the server, or nil if error
 	cml.cm.Annotations[cleanKey(key)] = value
-	cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Update(cml.cm)
+	cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Update(ctx, cml.cm, api.UpdateOptions{FieldManager: progName})
 	return err
 }

-func (cml *configMapAnnotations) RemoveAnnotation(key string) (err error) {
-	if cml.cm == nil {
+func (cml *configMapAnnotations) RemoveAnnotation(ctx context.Context, key string) (err error) {
+	if cml.cm == nil || cml.cm.Annotations == nil {
 		return errors.New("endpoint not initialized, call Init first")
 	}
 	// speculatively change the state, then replace with whatever comes back
-	// from Update(), which will be the latest on the server whatever happened
+	// from Update(), which will be the latest on the server, or nil if error
 	delete(cml.cm.Annotations, cleanKey(key))
-	cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Update(cml.cm)
+	cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Update(ctx, cml.cm, api.UpdateOptions{FieldManager: progName})
 	return err
 }

-func (cml *configMapAnnotations) RemoveAnnotationsWithValue(valueToRemove string) (err error) {
-	if cml.cm == nil {
+func (cml *configMapAnnotations) RemoveAnnotationsWithValue(ctx context.Context, valueToRemove string) (err error) {
+	if cml.cm == nil || cml.cm.Annotations == nil {
 		return errors.New("endpoint not initialized, call Init first")
 	}
 	// speculatively change the state, then replace with whatever comes back
-	// from Update(), which will be the latest on the server whatever happened
+	// from Update(), which will be the latest on the server, or nil if error
 	for key, value := range cml.cm.Annotations {
 		if value == valueToRemove {
 			delete(cml.cm.Annotations, key) // don't need to clean this key as it came from the map
 		}
 	}
-	cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Update(cml.cm)
+	cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Update(ctx, cml.cm, api.UpdateOptions{FieldManager: progName})
 	return err
 }

@@ -0,0 +1,30 @@
+// Adapted from k8s.io/client-go/kubernetes/fake to use a modified ObjectTracker
+package main
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/kubernetes/fake"
+	"k8s.io/client-go/testing"
+
+	weavetracker "github.com/weaveworks/weave/testing/kubernetes/testing"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+func NewSimpleClientset(objects ...runtime.Object) *fake.Clientset {
+	o := weavetracker.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	ret := fake.Clientset{}
+	ret.AddReactor("*", "*", weavetracker.ObjectReaction(o))
+	ret.AddWatchReactor("*", testing.DefaultWatchReactor(watch.NewFake(), nil))
+
+	return &ret
+}
@@ -0,0 +1,412 @@
+/*
+Package main deals with weave-net peers on the cluster.
+
+This involves peer management, such as getting the latest peers or removing defunct peers from the cluster
+*/
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"math/rand"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/vishvananda/netlink"
+	"golang.org/x/sys/unix"
+	api "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+
+	weaveapi "github.com/weaveworks/weave/api"
+	"github.com/weaveworks/weave/common"
+)
+
+type nodeInfo struct {
+	name string
+	addr string
+}
+
+// return the IP addresses of all nodes in the cluster
+func getKubePeers(c kubernetes.Interface, includeWithNoIPAddr bool) ([]nodeInfo, error) {
+	ctx := context.Background()
+	nodeList, err := c.CoreV1().Nodes().List(ctx, api.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+	addresses := make([]nodeInfo, 0, len(nodeList.Items))
+	for _, peer := range nodeList.Items {
+		var internalIP, externalIP string
+		for _, addr := range peer.Status.Addresses {
+			// Check it's a valid ipv4 address
+			ip := net.ParseIP(addr.Address)
+			if ip == nil || ip.To4() == nil {
+				continue
+			}
+			if addr.Type == "InternalIP" {
+				internalIP = ip.To4().String()
+			} else if addr.Type == "ExternalIP" {
+				externalIP = ip.To4().String()
+			}
+		}
+
+		// Fallback for cases where a Node has an ExternalIP but no InternalIP
+		if internalIP != "" {
+			// exclude self from the list of peers this node will peer with
+			if isLocalNodeIP(internalIP) {
+				continue
+			}
+			addresses = append(addresses, nodeInfo{name: peer.Name, addr: internalIP})
+		} else if externalIP != "" {
+			addresses = append(addresses, nodeInfo{name: peer.Name, addr: externalIP})
+		} else if includeWithNoIPAddr {
+			addresses = append(addresses, nodeInfo{name: peer.Name, addr: ""})
+		}
+	}
+	return addresses, nil
+}
+
+// returns true if given IP matches with one of the local IP's
+func isLocalNodeIP(ip string) bool {
+	addrs, err := netlink.AddrList(nil, unix.AF_INET)
+	if err != nil {
+		return false
+	}
+	for _, addr := range addrs {
+		if addr.Peer.IP.String() == ip {
+			return true
+		}
+	}
+	return false
+}
+
+// (minimal, incomplete) interface so weaver can be mocked for testing.
+type weaveClient interface {
+	RmPeer(peerName string) (string, error)
+}
+
+// For each of those peers that is no longer listed as a node by
+// Kubernetes, remove it from Weave IPAM
+func reclaimRemovedPeers(kube kubernetes.Interface, cml *configMapAnnotations, myPeerName, myNodeName string) error {
+	weave := weaveapi.NewClient(os.Getenv("WEAVE_HTTP_ADDR"), common.Log)
+	for loopsWhenNothingChanged := 0; loopsWhenNothingChanged < 3; loopsWhenNothingChanged++ {
+		// 1. Compare peers stored in the peerList against all peers reported by k8s now.
+		storedPeerList, err := getRefreshedPeerList(cml)
+		if err != nil {
+			return err
+		}
+		nodes, err := getKubePeers(kube, true)
+		if err != nil {
+			return err
+		}
+		nodeSet := make(map[string]struct{}, len(nodes))
+		for _, node := range nodes {
+			nodeSet[node.name] = struct{}{}
+		}
+		peerMap := make(map[string]peerInfo, len(storedPeerList.Peers))
+		for _, peer := range storedPeerList.Peers {
+			if peer.PeerName != myPeerName {
+				peerMap[peer.PeerName] = peer
+			}
+		}
+		// remove entries from the peer map that are current nodes
+		for key, peer := range peerMap {
+			if _, found := nodeSet[peer.NodeName]; found {
+				// unless they have a duplicate of my NodeName but are not me
+				if peer.NodeName == myNodeName && peer.PeerName != myPeerName {
+					continue
+				}
+				delete(peerMap, key)
+			}
+		}
+		// so the remainder is everything we want to clean up
+		common.Log.Debugln("[kube-peers] Nodes that have disappeared:", peerMap)
+		if len(peerMap) == 0 {
+			break
+		}
+		// 2. Loop for each X in the first set and not in the second - we wish to remove X from our data structures
+		for _, peer := range peerMap {
+			if peer.PeerName == myPeerName { // Don't remove myself.
+				common.Log.Warnln("[kube-peers] not removing myself", peer)
+				continue
+			}
+			changed, err := reclaimPeer(weave, cml, peer.PeerName, myPeerName)
+			if err != nil {
+				return err
+			}
+			if changed {
+				loopsWhenNothingChanged = 0
+			}
+		}
+
+		// 9. Go back to step 1 until there is no difference between the two sets
+		// (or we hit the counter that says we've been round the loop 3 times and nothing happened)
+	}
+	return nil
+}
+
+// Attempt to reclaim the IP addresses owned by peerName, using the
+// Kubernetes api-server as a point of consensus so that only one peer
+// actions the reclaim.
+// Return a bool to show whether we attempted to change anything,
+// and an error if something went wrong.
+func reclaimPeer(weave weaveClient, cml *configMapAnnotations, peerName string, myPeerName string) (changed bool, err error) {
+	ctx := context.Background()
+	common.Log.Debugln("[kube-peers] Preparing to remove disappeared peer", peerName)
+	okToRemove := false
+	nonExistentPeer := false
+
+	// Re-read status from Kubernetes; speculative updates may leave it un-set
+	if err := cml.Init(); err != nil {
+		return false, err
+	}
+
+	// 3. Check if there is an existing annotation with key X
+	existingAnnotation, found := cml.GetAnnotation(KubePeersPrefix + peerName)
+	if found {
+		common.Log.Debugln("[kube-peers] Existing annotation", existingAnnotation)
+		// 4.   If annotation already contains my identity, ok;
+		if existingAnnotation == myPeerName {
+			okToRemove = true
+		} else {
+			storedPeerList, err := cml.GetPeerList()
+			if err != nil {
+				return false, err
+			}
+			// handle an edge case where peer claimed to own the action to reclaim but no longer
+			// exists hence lock persists foever
+			if !storedPeerList.contains(existingAnnotation) {
+				nonExistentPeer = true
+				common.Log.Debugln("[kube-peers] Existing annotation", existingAnnotation, " has a non-existent peer so owning the reclaim action")
+			}
+		}
+	}
+	if !found || nonExistentPeer {
+		// 5.   If non-existent, write an annotation with key X and contents "my identity"
+		common.Log.Debugln("[kube-peers] Noting I plan to remove ", peerName)
+		if err := cml.UpdateAnnotation(ctx, KubePeersPrefix+peerName, myPeerName); err == nil {
+			okToRemove = true
+		} else {
+			common.Log.Errorln("[kube-peers] error from UpdateAnnotation: ", err)
+		}
+	}
+	if !okToRemove {
+		return false, nil
+	}
+	// 6.   If step 4 or 5 succeeded, rmpeer X
+	// we will try once more to see if the peerName has been removed from the annotation
+	// by another weave pod
+	storedPeerList, err := getRefreshedPeerList(cml)
+	if storedPeerList.contains(peerName) {
+		result, err := weave.RmPeer(peerName)
+		common.Log.Infof("[kube-peers] rmpeer of %s: %s", peerName, result)
+		if err != nil {
+			return false, err
+		}
+	}
+	err = cml.LoopUpdate(func() error {
+		// 7aa.   Remove any annotations Z* that have contents X
+		if err := cml.RemoveAnnotationsWithValue(ctx, peerName); err != nil {
+			return err
+		}
+		// 7a.    Remove X from peerList
+		storedPeerList, err := cml.GetPeerList()
+		if err != nil {
+			return err
+		}
+		if storedPeerList.contains(peerName) {
+			storedPeerList.remove(peerName)
+			if err := cml.UpdatePeerList(ctx, *storedPeerList); err != nil {
+				return err
+			}
+		} else {
+			common.Log.Infof("[kube-peers] annotation was removed already for %s", peerName)
+		}
+		// 7b.    Remove annotation with key X
+		return cml.RemoveAnnotation(ctx, KubePeersPrefix+peerName)
+	})
+	// 8.   If step 5 failed due to optimistic lock conflict, stop: someone else is handling X
+
+	// Step 3-5 is to protect against two simultaneous rmpeers of X
+	// Step 4 is to pick up again after a restart between step 5 and step 7b
+	// If the peer doing the reclaim disappears between steps 5 and 7a, then someone will clean it up in step 7aa
+	// If peer doing the reclaim disappears forever between 7a and 7b then we get a dangling annotation
+	// This should be sufficiently rare that we don't care.
+
+	// Question: Should we narrow step 2 by checking against Weave Net IPAM?
+	// i.e. If peer X owns any address space and is marked unreachable, we want to rmpeer X
+	return true, err
+}
+
+// resetPeers replaces the peers list with current set of peers
+func resetPeers(kube kubernetes.Interface) error {
+	nodes, err := getKubePeers(kube, false)
+	if err != nil {
+		return err
+	}
+	peerList := make([]string, 0)
+	for _, node := range nodes {
+		peerList = append(peerList, node.addr)
+	}
+	weave := weaveapi.NewClient(os.Getenv("WEAVE_HTTP_ADDR"), common.Log)
+	err = weave.ReplacePeers(peerList)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// regiesters with Kubernetes API server for node delete events. Node delete event handler
+// invokes reclaimRemovedPeers to remove it from IPAM so that IP space is reclaimed
+func registerForNodeUpdates(client *kubernetes.Clientset, stopCh <-chan struct{}, nodeName, peerName string) {
+	informerFactory := informers.NewSharedInformerFactory(client, 0)
+	nodeInformer := informerFactory.Core().V1().Nodes().Informer()
+	common.Log.Debugln("registering for updates for node delete events")
+	nodeInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		DeleteFunc: func(obj interface{}) {
+			var name string
+			if apiObj, ok := obj.(api.Object); ok {
+				name = apiObj.GetName()
+			} else {
+				name = fmt.Sprintf("%#v", obj)
+			}
+			common.Log.Debugln("Delete event for", name)
+			// add random delay to avoid all nodes acting on node delete event at the same
+			// time leading to contention to use `weave-net` configmap
+			r := rand.Intn(5000)
+			time.Sleep(time.Duration(r) * time.Millisecond)
+
+			cml := newConfigMapAnnotations(configMapNamespace, configMapName, client)
+			err := reclaimRemovedPeers(client, cml, peerName, nodeName)
+			if err != nil {
+				common.Log.Fatalf("[kube-peers] Error while reclaiming space: %v", err)
+			}
+			err = resetPeers(client)
+			if err != nil {
+				common.Log.Fatalf("[kube-peers] Error resetting peer list: %v", err)
+			}
+		},
+	})
+	informerFactory.WaitForCacheSync(stopCh)
+	informerFactory.Start(stopCh)
+}
+
+// getRefreshedPeerList will fetch the latest peer list from the config map annotation
+func getRefreshedPeerList(cml *configMapAnnotations) (*peerList, error) {
+	if err := cml.Init(); err != nil {
+		return nil, err
+	}
+	storedPeerList, err := cml.GetPeerList()
+	if err != nil {
+		return nil, err
+	}
+	return storedPeerList, nil
+}
+
+func main() {
+	var (
+		justReclaim       bool
+		justCheck         bool
+		justSetNodeStatus bool
+		justVersion       bool
+		justUID           bool
+		peerName          string
+		nodeName          string
+		logLevel          string
+		runReclaimDaemon  bool
+	)
+	flag.BoolVar(&justReclaim, "reclaim", false, "reclaim IP space from dead peers")
+	flag.BoolVar(&runReclaimDaemon, "run-reclaim-daemon", false, "run background process that reclaim IP space from dead peers ")
+	flag.BoolVar(&justCheck, "check-peer-new", false, "return success if peer name is not stored in annotation")
+	flag.BoolVar(&justSetNodeStatus, "set-node-status", false, "set NodeNetworkUnavailable to false")
+	flag.BoolVar(&justVersion, "print-k8s-version", false, "print the Kubernetes version and exit")
+	flag.BoolVar(&justUID, "print-uid", false, "print a UID for this installation and exit")
+	flag.StringVar(&peerName, "peer-name", "unknown", "name of this Weave Net peer")
+	flag.StringVar(&nodeName, "node-name", "unknown", "name of this Kubernetes node")
+	flag.StringVar(&logLevel, "log-level", "info", "logging level (debug, info, warning, error)")
+	flag.Parse()
+
+	common.SetLogLevel(logLevel)
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		common.Log.Fatalf("[kube-peers] Could not get cluster config: %v", err)
+	}
+	c, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		common.Log.Fatalf("[kube-peers] Could not make Kubernetes connection: %v", err)
+	}
+	if justCheck {
+		cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
+		exists, err := checkIamInPeerList(cml, c, peerName)
+		if err != nil {
+			common.Log.Fatalf("[kube-peers] Could not check peer list: %v", err)
+		}
+		if exists {
+			os.Exit(9)
+		} else {
+			os.Exit(0)
+		}
+	}
+	if justSetNodeStatus {
+		err := setNodeNetworkUnavailableFalse(c, nodeName)
+		if err != nil {
+			common.Log.Fatalf("[kube-peers] could not set node status: %v", err)
+		}
+		return
+	}
+	if justReclaim {
+		cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
+
+		list, err := addMyselfToPeerList(cml, c, peerName, nodeName)
+		if err != nil {
+			common.Log.Fatalf("[kube-peers] Could not update peer list: %v", err)
+		}
+		common.Log.Infoln("[kube-peers] Added myself to peer list", list)
+
+		err = reclaimRemovedPeers(c, cml, peerName, nodeName)
+		if err != nil {
+			common.Log.Fatalf("[kube-peers] Error while reclaiming space: %v", err)
+		}
+		return
+	}
+	if justVersion {
+		k8sVersion, err := c.Discovery().ServerVersion()
+		if err != nil {
+			common.Log.Fatalf("[kube-peers] Could not get Kubernetes version: %v", err)
+		}
+		fmt.Println(k8sVersion.String())
+	}
+	if justUID {
+		// use UID of `weave-net` configmap as unique ID of the Kubernetes cluster
+		cm, err := c.CoreV1().ConfigMaps(configMapNamespace).Get(context.Background(), configMapName, api.GetOptions{})
+		if err != nil {
+			common.Log.Fatalf("Unable to fetch ConfigMap %s/%s to infer unique cluster ID", configMapNamespace, configMapName)
+		}
+		fmt.Println(cm.ObjectMeta.UID)
+	}
+	if runReclaimDaemon {
+		// Handle SIGINT and SIGTERM
+		ch := make(chan os.Signal, 1)
+		signal.Notify(ch, syscall.SIGINT, syscall.SIGTERM)
+		stopCh := make(chan struct{})
+		rand.Seed(time.Now().UnixNano())
+		registerForNodeUpdates(c, stopCh, nodeName, peerName)
+		<-ch
+		close(stopCh)
+		return
+	}
+
+	peers, err := getKubePeers(c, false)
+	if err != nil {
+		common.Log.Fatalf("[kube-peers] Could not get peers: %v", err)
+	}
+	for _, node := range peers {
+		fmt.Println(node.addr)
+	}
+}
@@ -0,0 +1,30 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+// based on k8s.io/kubernetes/pkg/controller/nodeipam/ipam/adapter.go
+func setNodeNetworkUnavailableFalse(c kubernetes.Interface, nodeName string) error {
+	condition := v1.NodeCondition{
+		Type:               v1.NodeNetworkUnavailable,
+		Status:             v1.ConditionFalse,
+		Reason:             "WeaveIsUp",
+		Message:            "Weave pod has set this",
+		LastTransitionTime: metav1.Now(),
+		LastHeartbeatTime:  metav1.Now(),
+	}
+	raw, err := json.Marshal(&[]v1.NodeCondition{condition})
+	if err != nil {
+		return err
+	}
+	patch := []byte(fmt.Sprintf(`{"status":{"conditions":%s}}`, raw))
+	_, err = c.CoreV1().Nodes().PatchStatus(context.Background(), nodeName, patch)
+	return err
+}
@@ -0,0 +1,105 @@
+/*
+This module deals with operations on the peerlist backed by Kubernetes' annotation mechanism.
+*/
+package main
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pkg/errors"
+	"k8s.io/client-go/kubernetes"
+
+	"github.com/weaveworks/weave/common"
+)
+
+const (
+	configMapName      = "weave-net"
+	configMapNamespace = "kube-system"
+)
+
+type peerList struct {
+	Peers []peerInfo
+}
+
+type peerInfo struct {
+	PeerName string // Weave internal unique ID
+	NodeName string // Kubernetes node name
+}
+
+func (pl *peerList) contains(peerName string) bool {
+	for _, peer := range pl.Peers {
+		if peer.PeerName == peerName {
+			return true
+		}
+	}
+	return false
+}
+
+func (pl *peerList) add(peerName string, name string) {
+	pl.Peers = append(pl.Peers, peerInfo{PeerName: peerName, NodeName: name})
+}
+
+func (pl *peerList) remove(peerNameToRemove string) {
+	for i := 0; i < len(pl.Peers); {
+		if pl.Peers[i].PeerName == peerNameToRemove {
+			pl.Peers = append(pl.Peers[:i], pl.Peers[i+1:]...)
+		} else {
+			i++
+		}
+	}
+}
+
+func (cml *configMapAnnotations) GetPeerList() (*peerList, error) {
+	var record peerList
+	if cml.cm == nil {
+		return nil, errors.New("endpoint not initialized, call Init first")
+	}
+	if recordBytes, found := cml.cm.Annotations[KubePeersAnnotationKey]; found {
+		if err := json.Unmarshal([]byte(recordBytes), &record); err != nil {
+			return nil, err
+		}
+	}
+	return &record, nil
+}
+
+func (cml *configMapAnnotations) UpdatePeerList(ctx context.Context, list peerList) error {
+	recordBytes, err := json.Marshal(list)
+	if err != nil {
+		return err
+	}
+	return cml.UpdateAnnotation(ctx, KubePeersAnnotationKey, string(recordBytes))
+}
+
+// update the list of all peers that have gone through this code path
+func addMyselfToPeerList(cml *configMapAnnotations, c kubernetes.Interface, peerName, name string) (*peerList, error) {
+	var list *peerList
+	err := cml.LoopUpdate(func() error {
+		var err error
+		list, err = cml.GetPeerList()
+		if err != nil {
+			return err
+		}
+		if !list.contains(peerName) {
+			list.add(peerName, name)
+			err = cml.UpdatePeerList(context.Background(), *list)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	return list, err
+}
+
+func checkIamInPeerList(cml *configMapAnnotations, c kubernetes.Interface, peerName string) (bool, error) {
+	if err := cml.Init(); err != nil {
+		return false, err
+	}
+	list, err := cml.GetPeerList()
+	if err != nil {
+		return false, err
+	}
+	common.Log.Debugf("[kube-peers] Checking peer %q against list %v", peerName, list)
+	return list.contains(peerName), nil
+}
@@ -0,0 +1,183 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	peerName1 = "01:00:00:00:00:00"
+	peerName2 = "02:00:00:00:00:00"
+	peerName3 = "03:00:00:00:00:00"
+	nodeName1 = "fake-node-1"
+	nodeName2 = "fake-node-2"
+)
+
+func TestPeerListBasic(t *testing.T) {
+	c := NewSimpleClientset()
+
+	cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
+	err := cml.Init()
+	require.NoError(t, err)
+
+	list1, err := addMyselfToPeerList(cml, c, peerName1, nodeName1)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(list1.Peers))
+	list2, err := addMyselfToPeerList(cml, c, peerName2, nodeName2)
+	require.NoError(t, err)
+	require.Equal(t, 2, len(list2.Peers))
+
+	check1, err := checkIamInPeerList(cml, c, peerName1)
+	require.NoError(t, err)
+	require.Equal(t, true, check1)
+	check3, err := checkIamInPeerList(cml, c, peerName3)
+	require.NoError(t, err)
+	require.Equal(t, false, check3)
+
+	storedPeerList, err := cml.GetPeerList()
+	require.NoError(t, err)
+
+	storedPeerList.remove(peerName1)
+	require.Equal(t, 1, len(storedPeerList.Peers))
+	err = cml.UpdatePeerList(context.Background(), *storedPeerList)
+	require.NoError(t, err)
+	check1, err = checkIamInPeerList(cml, c, peerName1)
+	require.NoError(t, err)
+	require.Equal(t, false, check1)
+}
+
+// Run function _f_ _iterations_ times, in _concurrency_
+// number of goroutines
+func doConcurrentIterations(iterations, concurrency int, f func(int)) {
+	iterationsPerThread := iterations / concurrency
+
+	wg := sync.WaitGroup{}
+	for i := 0; i < concurrency; i++ {
+		wg.Add(1)
+		go func(j int) {
+			defer wg.Done()
+			for k := 0; k < iterationsPerThread; k++ {
+				f((j * iterationsPerThread) + k)
+			}
+		}(i)
+	}
+	wg.Wait()
+}
+
+func TestPeerListFuzz(t *testing.T) {
+	rand.Seed(time.Now().UnixNano())
+	const (
+		testIters   = 1000
+		maxNodes    = 100
+		concurrency = 5
+	)
+	peerName := func(i int) string { return fmt.Sprintf("%02d:00:00:02:00:00", i) }
+	nodeName := func(i int) string { return fmt.Sprintf("node%d", i) }
+
+	stateLock := sync.Mutex{}
+	nodes := []int{}
+	nodeMap := map[int]bool{} // true if an operation is pending
+
+	c := NewSimpleClientset()
+
+	addNode := func() {
+		i := rand.Intn(maxNodes)
+		// add to test state first, then to Kubernetes
+		stateLock.Lock()
+		pending, found := nodeMap[i]
+		if !found {
+			nodes = append(nodes, i)
+		}
+		nodeMap[i] = true
+		stateLock.Unlock()
+		if pending { // someone else is adding or deleting this node
+			return
+		}
+
+		cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
+		err := cml.Init()
+		require.NoError(t, err)
+		_, err = addMyselfToPeerList(cml, c, peerName(i), nodeName(i))
+		require.NoError(t, err)
+
+		stateLock.Lock()
+		nodeMap[i] = false
+		stateLock.Unlock()
+	}
+
+	removeNode := func() {
+		stateLock.Lock()
+		if len(nodes) == 0 { // can't remove if there aren't any nodes
+			stateLock.Unlock()
+			return
+		}
+		pos := rand.Intn(len(nodes))
+		i := nodes[pos]
+		if pending, found := nodeMap[i]; found {
+			if pending {
+				stateLock.Unlock()
+				return // someone else is adding or deleting this node
+			}
+			nodeMap[i] = true
+		} else {
+			t.Errorf("missing entry from node map: %d", i)
+		}
+		stateLock.Unlock()
+
+		// remove from Kubernetes first, then from test state
+		cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
+		require.NoError(t, cml.Init())
+		storedPeerList, err := cml.GetPeerList()
+		require.NoError(t, err)
+		found := storedPeerList.contains(peerName(i))
+		require.True(t, found, "peer %d not found in stored list", i)
+
+		_, err = reclaimPeer(mockWeave{}, cml, peerName(i), fmt.Sprintf("deleter-%d", i))
+		require.NoError(t, err)
+
+		require.NoError(t, cml.Init())
+		storedPeerList, err = cml.GetPeerList()
+		require.NoError(t, err)
+		stateLock.Lock()
+		delete(nodeMap, i)
+		for pos = 0; pos < len(nodes); pos++ {
+			if nodes[pos] == i {
+				// Remove item from list by swapping it with last and reducing slice length by 1
+				nodes[pos] = nodes[len(nodes)-1]
+				nodes = nodes[:len(nodes)-1]
+				break
+			}
+		}
+		stateLock.Unlock()
+	}
+
+	doConcurrentIterations(testIters, concurrency, func(iteration int) {
+		r := rand.Float32()
+		switch {
+		case 0.0 <= r && r < 0.4:
+			addNode()
+
+		case (0.4 <= r && r < 0.8):
+			removeNode()
+		}
+	})
+
+	cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
+	err := cml.Init()
+	require.NoError(t, err)
+	storedPeerList, err := cml.GetPeerList()
+	require.NoError(t, err)
+	require.Equal(t, len(storedPeerList.Peers), len(nodes))
+}
+
+type mockWeave struct{}
+
+func (mockWeave) RmPeer(peerName string) (string, error) {
+	return "", nil
+}
@@ -1,3 +1,14 @@
 FROM DOCKERHUB_USER/weaveARCH_EXT
-ADD ./launch.sh ./kube-peers /home/weave/
+
+# These labels are pretty static, and can therefore be added early on:
+LABEL maintainer="Weaveworks <help@weave.works>" \
+      org.opencontainers.image.title="weave-kube" \
+      org.opencontainers.image.source="https://github.com/weaveworks/weave" \
+      org.opencontainers.image.vendor="Weaveworks"
+
+ADD ./init.sh ./launch.sh ./kube-utils /home/weave/
 ENTRYPOINT ["/home/weave/launch.sh"]
+
+# This label will change for every build, and should therefore be the last layer of the image:
+ARG revision
+LABEL org.opencontainers.image.revision="${revision}"
@@ -0,0 +1,64 @@
+#!/bin/sh
+# Initialisation of Weave Net pod: check Linux settings and install CNI plugin
+
+set -e
+
+modprobe_safe() {
+    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
+}
+
+# Check whether xt_set actually exists
+xt_set_exists() {
+    # Clean everything up in advance, in case there's leftovers
+    iptables -w -F WEAVE-KUBE-TEST 2>/dev/null || true
+    iptables -w -X WEAVE-KUBE-TEST 2>/dev/null || true
+    ipset destroy weave-kube-test 2>/dev/null || true
+
+    ipset create weave-kube-test hash:ip
+    iptables -w -t filter -N WEAVE-KUBE-TEST
+    if ! iptables -w -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
+        NOT_EXIST=1
+    fi
+    iptables -w -F WEAVE-KUBE-TEST
+    iptables -w -X WEAVE-KUBE-TEST
+    # delay to allow kernel to clean up - see https://github.com/weaveworks/weave/issues/3847
+    sleep 1
+    ipset destroy weave-kube-test
+    [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
+}
+
+# Default for network policy
+EXPECT_NPC=${EXPECT_NPC:-1}
+
+# Ensure we have the required modules for NPC
+if [ "${EXPECT_NPC}" != "0" ]; then
+    modprobe_safe br_netfilter
+    modprobe_safe xt_set
+    xt_set_exists
+fi
+
+# kube-proxy requires that bridged traffic passes through netfilter
+if ! BRIDGE_NF_ENABLED=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables); then
+    echo "Cannot detect bridge-nf support - network policy and iptables mode kubeproxy may not work reliably" >&2
+else
+    if [ "$BRIDGE_NF_ENABLED" != "1" ]; then
+        echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
+    fi
+fi
+
+# This is where we expect the manifest to map host directories
+HOST_ROOT=${HOST_ROOT:-/host}
+
+# Install CNI plugin binary to typical CNI bin location
+# with fall-back to CNI directory used by kube-up on GCI OS
+if ! mkdir -p $HOST_ROOT/opt/cni/bin ; then
+    if mkdir -p $HOST_ROOT/home/kubernetes/bin ; then
+        export WEAVE_CNI_PLUGIN_DIR=$HOST_ROOT/home/kubernetes/bin
+    else
+        echo "Failed to install the Weave CNI plugin" >&2
+        exit 1
+    fi
+fi
+mkdir -p $HOST_ROOT/etc/cni/net.d
+export HOST_ROOT
+/home/weave/weave --local setup-cni
@@ -1,35 +1,47 @@
 #!/bin/sh
+# Launch of Weave Net pod - requires that init.sh has been run previously

 set -e

-modprobe_safe() {
-    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
-}
+# If this is run from an older manifest, run the init script here
+[ "${INIT_CONTAINER}" = "true" ] || "$(dirname "$0")/init.sh"

-# Check whether xt_set actually exists
-xt_set_exists() {
-    # Clean everything up in advance, in case there's leftovers
-    iptables -F WEAVE-KUBE-TEST 2>/dev/null || true
-    iptables -X WEAVE-KUBE-TEST 2>/dev/null || true
-    ipset destroy weave-kube-test 2>/dev/null || true
-
-    ipset create weave-kube-test hash:ip
-    iptables -t filter -N WEAVE-KUBE-TEST
-    if ! iptables -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
-        NOT_EXIST=1
+# Setup iptables backend to be legacy or nftable
+setup_iptables_backend() {
+    if [ -n "${IPTABLES_BACKEND}" ]; then
+      mode=$IPTABLES_BACKEND
+    else
+      # auto-detect if iptables backend mode to use if not specified explicitly
+      num_legacy_lines=$( (iptables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l)
+      num_nft_lines=$( (iptables-nft-save || true) 2>/dev/null | grep '^-' | wc -l)
+      if [ "${num_legacy_lines}" -ge 10 ]; then
+        mode="legacy"
+      else
+        if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then
+          mode="legacy"
+        else
+          mode="nft"
+        fi
+      fi
+    fi
+    if [ $mode = "nft" ]; then
+      rm /sbin/iptables
+      rm /sbin/iptables-save
+      rm /sbin/iptables-restore
+      ln -s /sbin/iptables-nft /sbin/iptables
+      ln -s /sbin/iptables-nft-save /sbin/iptables-save
+      ln -s /sbin/iptables-nft-restore /sbin/iptables-restore
    fi
-    iptables -F WEAVE-KUBE-TEST
-    iptables -X WEAVE-KUBE-TEST
-    ipset destroy weave-kube-test
-    [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
 }

+setup_iptables_backend
+
 # Default if not supplied - same as weave net default
 IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12}
 HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784}
 METRICS_ADDR=${WEAVE_METRICS_ADDR:-0.0.0.0:6782}
 HOST_ROOT=${HOST_ROOT:-/host}
-CONN_LIMIT=${CONN_LIMIT:-100}
+CONN_LIMIT=${CONN_LIMIT:-200}
 DB_PREFIX=${DB_PREFIX:-/weavedb/weave-net}

 # Check if the IP range overlaps anything existing on the host
@@ -38,22 +50,6 @@ DB_PREFIX=${DB_PREFIX:-/weavedb/weave-net}
 # Default for network policy
 EXPECT_NPC=${EXPECT_NPC:-1}

-# Ensure we have the required modules for NPC
-if [ "${EXPECT_NPC}" != "0" ]; then
-    modprobe_safe br_netfilter
-    modprobe_safe xt_set
-    xt_set_exists
-fi
-
-# kube-proxy requires that bridged traffic passes through netfilter
-if ! BRIDGE_NF_ENABLED=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables); then
-    echo "Cannot detect bridge-nf support - network policy and iptables mode kubeproxy may not work reliably" >&2
-else
-    if [ "$BRIDGE_NF_ENABLED" != "1" ]; then
-        echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
-    fi
-fi
-
 STATUS_OPTS="--metrics-addr=$METRICS_ADDR"
 # --status-addr exposes internal information, so only turn it on if asked to.
 if [ -n "${WEAVE_STATUS_ADDR}" ]; then
@@ -66,6 +62,11 @@ if [ "${EXPECT_NPC}" = "0" ]; then
    WEAVE_NPC_OPTS=""
 fi

+NO_MASQ_LOCAL_OPT="--no-masq-local"
+if [ "${NO_MASQ_LOCAL}" = "0" ]; then
+    NO_MASQ_LOCAL_OPT=""
+fi
+
 # Kubernetes sets HOSTNAME to the host's hostname
 # when running a pod in host namespace.
 NICKNAME_ARG=""
@@ -80,7 +81,7 @@ router_bridge_opts() {
 }

 if [ -z "$KUBE_PEERS" ]; then
-    if ! KUBE_PEERS=$(/home/weave/kube-peers) || [ -z "$KUBE_PEERS" ]; then
+    if ! KUBE_PEERS=$(/home/weave/kube-utils); then
        echo Failed to get peers >&2
        exit 1
    fi
@@ -105,7 +106,7 @@ fi
 if [ -f ${DB_PREFIX}data.db ]; then
    if /usr/bin/weaveutil get-db-flag "$DB_PREFIX" peer-reclaim >/dev/null ; then
        # If this peer name is not stored in the list then we were removed by another peer.
-        if /home/weave/kube-peers -check-peer-new -peer-name="$PEERNAME" -log-level=debug ; then
+        if /home/weave/kube-utils -check-peer-new -peer-name="$PEERNAME" -log-level=debug ; then
            # In order to avoid a CRDT clash, clean up
            echo "Peer not in list; removing persisted data" >&2
            rm -f ${DB_PREFIX}data.db
@@ -117,6 +118,10 @@ fi
 # weaver is running as the DB can only be opened by one process at a time
 /usr/bin/weaveutil set-db-flag "$DB_PREFIX" peer-reclaim ok

+# couple more variables
+WEAVE_KUBERNETES_VERSION=$(/home/weave/kube-utils -print-k8s-version)
+WEAVE_KUBERNETES_UID=$(/home/weave/kube-utils -print-uid)
+
 post_start_actions() {
    # Wait for weave process to become responsive
    while true ; do
@@ -124,37 +129,28 @@ post_start_actions() {
        sleep 1
    done

-    # Install CNI plugin binary to typical CNI bin location
-    # with fall-back to CNI directory used by kube-up on GCI OS
-    if ! mkdir -p $HOST_ROOT/opt/cni/bin ; then
-        if mkdir -p $HOST_ROOT/home/kubernetes/bin ; then
-            export WEAVE_CNI_PLUGIN_DIR=$HOST_ROOT/home/kubernetes/bin
-        else
-            echo "Failed to install the Weave CNI plugin" >&2
-            exit 1
-        fi
-    fi
-    mkdir -p $HOST_ROOT/etc/cni/net.d
-    export HOST_ROOT
-    /home/weave/weave --local setup-cni
-
    # Attempt to run the reclaim process, but don't halt the script if it fails
-    /home/weave/kube-peers -reclaim -node-name="$HOSTNAME" -peer-name="$PEERNAME" -log-level=debug || true
+    /home/weave/kube-utils -reclaim -node-name="$HOSTNAME" -peer-name="$PEERNAME" -log-level=debug || true

    # Expose the weave network so host processes can communicate with pods
    /home/weave/weave --local expose $WEAVE_EXPOSE_IP
+
+    # Mark network as up
+    /home/weave/kube-utils -set-node-status -node-name="$HOSTNAME"
+
+    /home/weave/kube-utils -run-reclaim-daemon -node-name="$HOSTNAME" -peer-name="$PEERNAME" -log-level=debug&
 }

 post_start_actions &

 /home/weave/weaver $EXTRA_ARGS --port=6783 $(router_bridge_opts) \
     --name="$PEERNAME" \
-     --host-root=$HOST_ROOT \
     --http-addr=$HTTP_ADDR $STATUS_OPTS --docker-api='' --no-dns \
     --db-prefix="$DB_PREFIX" \
     --ipalloc-range=$IPALLOC_RANGE $NICKNAME_ARG \
     --ipalloc-init $IPALLOC_INIT \
     --conn-limit=$CONN_LIMIT \
     $WEAVE_NPC_OPTS \
+     $NO_MASQ_LOCAL_OPT \
     "$@" \
     $KUBE_PEERS
@@ -0,0 +1,237 @@
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+      namespace: kube-system
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRole
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+    rules:
+      - apiGroups:
+          - ''
+        resources:
+          - pods
+          - namespaces
+          - nodes
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+          - extensions
+        resources:
+          - networkpolicies
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+          - 'networking.k8s.io'
+        resources:
+          - networkpolicies
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+        - ''
+        resources:
+        - nodes/status
+        verbs:
+        - patch
+        - update
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+    roleRef:
+      kind: ClusterRole
+      name: weave-net
+      apiGroup: rbac.authorization.k8s.io
+    subjects:
+      - kind: ServiceAccount
+        name: weave-net
+        namespace: kube-system
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+      name: weave-net
+      namespace: kube-system
+      labels:
+        name: weave-net
+    rules:
+      - apiGroups:
+          - ''
+        resources:
+          - configmaps
+        resourceNames:
+          - weave-net
+        verbs:
+          - get
+          - update
+      - apiGroups:
+          - ''
+        resources:
+          - configmaps
+        verbs:
+          - create
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+      name: weave-net
+      namespace: kube-system
+      labels:
+        name: weave-net
+    roleRef:
+      kind: Role
+      name: weave-net
+      apiGroup: rbac.authorization.k8s.io
+    subjects:
+      - kind: ServiceAccount
+        name: weave-net
+        namespace: kube-system
+  - apiVersion: apps/v1
+    kind: DaemonSet
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+      namespace: kube-system
+    spec:
+      # Wait 5 seconds to let pod connect before rolling next pod
+      selector:
+        matchLabels:
+          name: weave-net
+      minReadySeconds: 5
+      template:
+        metadata:
+          labels:
+            name: weave-net
+        spec:
+          initContainers:
+            - name: weave-init
+              image: 'weaveworks/weave-kube:latest'
+              imagePullPolicy: Always
+              command:
+                - /home/weave/init.sh
+              env:
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: cni-bin
+                  mountPath: /host/opt
+                - name: cni-bin2
+                  mountPath: /host/home
+                - name: cni-conf
+                  mountPath: /host/etc
+                - name: lib-modules
+                  mountPath: /lib/modules
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
+          containers:
+            - name: weave
+              command:
+                - /home/weave/launch.sh
+              env:
+                - name: INIT_CONTAINER
+                  value: "true"
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
+              image: 'weaveworks/weave-kube:latest'
+              imagePullPolicy: Always
+              readinessProbe:
+                httpGet:
+                  host: 127.0.0.1
+                  path: /status
+                  port: 6784
+              resources:
+                requests:
+                  cpu: 50m
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: weavedb
+                  mountPath: /weavedb
+                - name: dbus
+                  mountPath: /host/var/lib/dbus
+                  readOnly: true
+                - mountPath: /host/etc/machine-id
+                  name: cni-machine-id
+                  readOnly: true
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
+            - name: weave-npc
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
+              image: 'weaveworks/weave-npc:latest'
+              imagePullPolicy: Always
+#npc-args
+              resources:
+                requests:
+                  cpu: 50m
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
+          hostNetwork: true
+          dnsPolicy: ClusterFirstWithHostNet
+          hostPID: false
+          restartPolicy: Always
+          securityContext:
+            seLinuxOptions: {}
+          serviceAccountName: weave-net
+          tolerations:
+            - effect: NoSchedule
+              operator: Exists
+            - effect: NoExecute
+              operator: Exists
+          volumes:
+            - name: weavedb
+              hostPath:
+                path: /var/lib/weave
+            - name: cni-bin
+              hostPath:
+                path: /opt
+            - name: cni-bin2
+              hostPath:
+                path: /home
+            - name: cni-conf
+              hostPath:
+                path: /etc
+            - name: cni-machine-id
+              hostPath:
+                path: /etc/machine-id
+            - name: dbus
+              hostPath:
+                path: /var/lib/dbus
+            - name: lib-modules
+              hostPath:
+                path: /lib/modules
+            - name: xtables-lock
+              hostPath:
+                path: /run/xtables.lock
+                type: FileOrCreate
+          priorityClassName: system-node-critical
+      updateStrategy:
+        type: RollingUpdate
@@ -8,7 +8,7 @@ items:
      labels:
        name: weave-net
      namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: weave-net
@@ -41,7 +41,14 @@ items:
          - get
          - list
          - watch
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+      - apiGroups:
+        - ''
+        resources:
+        - nodes/status
+        verbs:
+        - patch
+        - update
+  - apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: weave-net
@@ -55,7 +62,7 @@ items:
      - kind: ServiceAccount
        name: weave-net
        namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      name: weave-net
@@ -78,7 +85,7 @@ items:
          - configmaps
        verbs:
          - create
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: weave-net
@@ -108,11 +115,34 @@ items:
          labels:
            name: weave-net
        spec:
+          initContainers:
+            - name: weave-init
+              image: 'weaveworks/weave-kube:latest'
+              imagePullPolicy: Always
+              command:
+                - /home/weave/init.sh
+              env:
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: cni-bin
+                  mountPath: /host/opt
+                - name: cni-bin2
+                  mountPath: /host/home
+                - name: cni-conf
+                  mountPath: /host/etc
+                - name: lib-modules
+                  mountPath: /lib/modules
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
          containers:
            - name: weave
              command:
                - /home/weave/launch.sh
              env:
+                - name: INIT_CONTAINER
+                  value: "true"
                - name: HOSTNAME
                  valueFrom:
                    fieldRef:
@@ -120,30 +150,25 @@ items:
                      fieldPath: spec.nodeName
              image: 'weaveworks/weave-kube:latest'
              imagePullPolicy: Always
-              livenessProbe:
+              readinessProbe:
                httpGet:
                  host: 127.0.0.1
                  path: /status
                  port: 6784
-                initialDelaySeconds: 30
              resources:
                requests:
-                  cpu: 10m
+                  cpu: 50m
              securityContext:
                privileged: true
              volumeMounts:
                - name: weavedb
                  mountPath: /weavedb
-                - name: cni-bin
-                  mountPath: /host/opt
-                - name: cni-bin2
-                  mountPath: /host/home
-                - name: cni-conf
-                  mountPath: /host/etc
                - name: dbus
                  mountPath: /host/var/lib/dbus
-                - name: lib-modules
-                  mountPath: /lib/modules
+                  readOnly: true
+                - mountPath: /host/etc/machine-id
+                  name: cni-machine-id
+                  readOnly: true
                - name: xtables-lock
                  mountPath: /run/xtables.lock
                  readOnly: false
@@ -159,7 +184,7 @@ items:
 #npc-args
              resources:
                requests:
-                  cpu: 10m
+                  cpu: 50m
              securityContext:
                privileged: true
              volumeMounts:
@@ -167,7 +192,7 @@ items:
                  mountPath: /run/xtables.lock
                  readOnly: false
          hostNetwork: true
-          hostPID: true
+          hostPID: false
          restartPolicy: Always
          securityContext:
            seLinuxOptions: {}
@@ -175,6 +200,8 @@ items:
          tolerations:
            - effect: NoSchedule
              operator: Exists
+            - effect: NoExecute
+              operator: Exists
          volumes:
            - name: weavedb
              hostPath:
@@ -188,6 +215,9 @@ items:
            - name: cni-conf
              hostPath:
                path: /etc
+            - name: cni-machine-id
+              hostPath:
+                path: /etc/machine-id
            - name: dbus
              hostPath:
                path: /var/lib/dbus
@@ -197,5 +227,6 @@ items:
            - name: xtables-lock
              hostPath:
                path: /run/xtables.lock
+                type: FileOrCreate
      updateStrategy:
        type: RollingUpdate
@@ -8,7 +8,7 @@ items:
      labels:
        name: weave-net
      namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: weave-net
@@ -33,7 +33,22 @@ items:
          - get
          - list
          - watch
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+      - apiGroups:
+          - 'networking.k8s.io'
+        resources:
+          - networkpolicies
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+        - ''
+        resources:
+        - nodes/status
+        verbs:
+        - patch
+        - update
+  - apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: weave-net
@@ -47,13 +62,13 @@ items:
      - kind: ServiceAccount
        name: weave-net
        namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
-      name: weave-net-kube-peer
+      name: weave-net
      namespace: kube-system
      labels:
-        name: weave-net-kube-peer
+        name: weave-net
    rules:
      - apiGroups:
          - ''
@@ -70,22 +85,22 @@ items:
          - configmaps
        verbs:
          - create
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
-      name: weave-net-kube-peer
+      name: weave-net
      namespace: kube-system
      labels:
-        name: weave-net-kube-peer
+        name: weave-net
    roleRef:
      kind: Role
-      name: weave-net-kube-peer
+      name: weave-net
      apiGroup: rbac.authorization.k8s.io
    subjects:
      - kind: ServiceAccount
        name: weave-net
        namespace: kube-system
-  - apiVersion: extensions/v1beta1
+  - apiVersion: apps/v1
    kind: DaemonSet
    metadata:
      name: weave-net
@@ -93,16 +108,44 @@ items:
        name: weave-net
      namespace: kube-system
    spec:
+      # Wait 5 seconds to let pod connect before rolling next pod
+      selector:
+        matchLabels:
+          name: weave-net
+      minReadySeconds: 5
      template:
        metadata:
          labels:
            name: weave-net
        spec:
+          initContainers:
+            - name: weave-init
+              image: 'weaveworks/weave-kube:latest'
+              imagePullPolicy: Always
+              command:
+                - /home/weave/init.sh
+              env:
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: cni-bin
+                  mountPath: /host/opt
+                - name: cni-bin2
+                  mountPath: /host/home
+                - name: cni-conf
+                  mountPath: /host/etc
+                - name: lib-modules
+                  mountPath: /lib/modules
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
          containers:
            - name: weave
              command:
                - /home/weave/launch.sh
              env:
+                - name: INIT_CONTAINER
+                  value: "true"
                - name: HOSTNAME
                  valueFrom:
                    fieldRef:
@@ -110,30 +153,28 @@ items:
                      fieldPath: spec.nodeName
              image: 'weaveworks/weave-kube:latest'
              imagePullPolicy: Always
-              livenessProbe:
+              readinessProbe:
                httpGet:
                  host: 127.0.0.1
                  path: /status
                  port: 6784
-                initialDelaySeconds: 30
              resources:
                requests:
-                  cpu: 10m
+                  cpu: 50m
              securityContext:
                privileged: true
              volumeMounts:
                - name: weavedb
                  mountPath: /weavedb
-                - name: cni-bin
-                  mountPath: /host/opt
-                - name: cni-bin2
-                  mountPath: /host/home
-                - name: cni-conf
-                  mountPath: /host/etc
                - name: dbus
                  mountPath: /host/var/lib/dbus
-                - name: lib-modules
-                  mountPath: /lib/modules
+                  readOnly: true
+                - mountPath: /host/etc/machine-id
+                  name: cni-machine-id
+                  readOnly: true
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
            - name: weave-npc
              env:
                - name: HOSTNAME
@@ -143,13 +184,19 @@ items:
                      fieldPath: spec.nodeName
              image: 'weaveworks/weave-npc:latest'
              imagePullPolicy: Always
+#npc-args
              resources:
                requests:
-                  cpu: 10m
+                  cpu: 50m
              securityContext:
                privileged: true
+              volumeMounts:
+                - name: xtables-lock
+                  mountPath: /run/xtables.lock
+                  readOnly: false
          hostNetwork: true
-          hostPID: true
+          dnsPolicy: ClusterFirstWithHostNet
+          hostPID: false
          restartPolicy: Always
          securityContext:
            seLinuxOptions: {}
@@ -157,6 +204,8 @@ items:
          tolerations:
            - effect: NoSchedule
              operator: Exists
+            - effect: NoExecute
+              operator: Exists
          volumes:
            - name: weavedb
              hostPath:
@@ -170,11 +219,18 @@ items:
            - name: cni-conf
              hostPath:
                path: /etc
+            - name: cni-machine-id
+              hostPath:
+                path: /etc/machine-id
            - name: dbus
              hostPath:
                path: /var/lib/dbus
            - name: lib-modules
              hostPath:
                path: /lib/modules
+            - name: xtables-lock
+              hostPath:
+                path: /run/xtables.lock
+                type: FileOrCreate
      updateStrategy:
        type: RollingUpdate
@@ -1 +1 @@
 .3.0
 .6.2
				`@@ -0,0 +1 @@`
				`bab3b4d04263479b3d9f85cf59bd0cad1f2b434f29856b2204f8288f2f3598e4 qemu-s390x-static`