Add release v2.5.2

return error in case Weave CNI plug-in fails to perform CmdDel

CHANGELOG.md

@@ -1,3 +1,40 @@
+
+## Release 2.5.2
+
+This release fixes several bugs causing inconsistencies in IPAM and fixes a 
+panic in daemon that reclaims and forgets deleted nodes in Kubernetes clusters.
+
+### Bug fixes
+
+* leaking IP addresses in IPAM when weave-net hangs or restarting #3587, #3638
+* Panic in kube-utils after config map update error resulting in reclaim daemon
+  not performing weave forget on deleted node #3613, #3623
+* preventing inconsistent IPAM entries and resolving the conflict in case of
+  conflict during IPAM ring merge #3629, #3635, #3632, #3444
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/79?closed=1)
+
+
+## Release 2.5.1
+
+This release fixes bugs reported for 2.5 release and small improvements.
+
+### Bug fixes
+
+* prevent warnings in kernal logs due to use of physdev model for
+  non-bridged traffic #3449, #3453
+* Check and report the error occurred while getting the list of Kubernetes 
+  peers #3581, #3582
+
+### Other improvements
+
+* Update Ruby version to match Weaveworks website #3458
+* Fix the link to "Troubleshooting the Kubernetes Addon" section in the docs #3461
+* Document concept of connection limit in Weave #3395, #3413
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/77?closed=1)
+
+
 ## Release 2.5.0
 
 This release adds support for Kubernetes `hostPort` mapping (#3016,#3356)

docs/release-process.md

@@ -154,6 +154,7 @@ Weave Net is [available in Docker Store](https://store.docker.com/plugins/weave-
 * Go to "_Plans & Pricing_" > "_Free Tier_".
 * Under "_Source Repositories & Tags_", click on "_Add Source_", select "_net-plugin_" under "_Repository_" and the version to release under "_Tag_".
 * Under "_Resources_" > "_Installation Instructions_", update the lines containing `export NET_VERSION=<version>`.
+* Click "_Save_"
 * Click "_Submit For Review_". You should see a message like: "_Your product has been submitted for approval. [...] We'll be in touch with next steps soon!_".
 * You should receive an email saying:
 
@@ -177,6 +178,8 @@ Weave Net is [available in Docker Store](https://store.docker.com/plugins/weave-
   https://checkpoint-api.weave.works/admin
 * File a PR to update the version of the daemonset at
   https://github.com/kubernetes/kops/tree/master/upup/models/cloudup/resources/addons/networking.weave
+  and kops/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go
+  and kops/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml
 
 ## Troubleshooting
 

ipam/allocator.go

@@ -910,6 +910,7 @@ func (alloc *Allocator) donateSpace(r address.Range, to mesh.PeerName) {
 	alloc.debugln("Giving range", chunk, "to", to)
 	alloc.ring.GrantRangeToHost(chunk.Start, chunk.End, to)
 	alloc.persistRing()
+	alloc.gossip.GossipBroadcast(alloc.Gossip())
 }
 
 func (alloc *Allocator) assertInvariants() {

ipam/ring/ring.go

@@ -565,7 +565,9 @@ func (r *Ring) Transfer(from, to mesh.PeerName) []address.Range {
 	for i, entry := range r.Entries {
 		if entry.Peer == from {
 			entry.Peer = to
-			entry.Version++
+			// bump version by large value so that transfer of range takes precedence (if there is any conflict in merging entry)
+			// over other opertaions on the entry that increments the version
+			entry.Version = entry.Version + 100
 			newRanges = append(newRanges, address.Range{Start: entry.Token, End: r.Entries.entry(i + 1).Token})
 		}
 	}

plugin/net/cni.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"strings"
 
 	"github.com/containernetworking/cni/pkg/ipam"
 	"github.com/containernetworking/cni/pkg/skel"
@@ -206,7 +207,13 @@ func (c *CNIPlugin) CmdDel(args *skel.CmdArgs) error {
 		err = ipam.ExecDel(conf.IPAM.Type, args.StdinData)
 	}
 	if err != nil {
+		if strings.Contains(err.Error(), fmt.Sprintf("Delete: no addresses for %s", args.ContainerID)) {
+			// ignore the error in the case where there are no IP addresses associated with container
+			fmt.Fprintln(os.Stderr, "weave-cni:", fmt.Sprintf("Delete: no addresses for %s", args.ContainerID))
+			return nil
+		}
 		logOnStderr(fmt.Errorf("unable to release IP address: %s", err))
+		return err
 	}
 	return nil
 }

prog/kube-utils/annotations.go

@@ -96,33 +96,33 @@ func (cml *configMapAnnotations) GetAnnotation(key string) (string, bool) {
 }
 
 func (cml *configMapAnnotations) UpdateAnnotation(key, value string) (err error) {
-	if cml.cm == nil {
+	if cml.cm == nil || cml.cm.Annotations == nil {
 		return errors.New("endpoint not initialized, call Init first")
 	}
 	// speculatively change the state, then replace with whatever comes back
-	// from Update(), which will be the latest on the server whatever happened
+	// from Update(), which will be the latest on the server, or nil if error
 	cml.cm.Annotations[cleanKey(key)] = value
 	cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Update(cml.cm)
 	return err
 }
 
 func (cml *configMapAnnotations) RemoveAnnotation(key string) (err error) {
-	if cml.cm == nil {
+	if cml.cm == nil || cml.cm.Annotations == nil {
 		return errors.New("endpoint not initialized, call Init first")
 	}
 	// speculatively change the state, then replace with whatever comes back
-	// from Update(), which will be the latest on the server whatever happened
+	// from Update(), which will be the latest on the server, or nil if error
 	delete(cml.cm.Annotations, cleanKey(key))
 	cml.cm, err = cml.Client.ConfigMaps(cml.Namespace).Update(cml.cm)
 	return err
 }
 
 func (cml *configMapAnnotations) RemoveAnnotationsWithValue(valueToRemove string) (err error) {
-	if cml.cm == nil {
+	if cml.cm == nil || cml.cm.Annotations == nil {
 		return errors.New("endpoint not initialized, call Init first")
 	}
 	// speculatively change the state, then replace with whatever comes back
-	// from Update(), which will be the latest on the server whatever happened
+	// from Update(), which will be the latest on the server, or nil if error
 	for key, value := range cml.cm.Annotations {
 		if value == valueToRemove {
 			delete(cml.cm.Annotations, key) // don't need to clean this key as it came from the map

prog/kube-utils/main.go

@@ -83,6 +83,9 @@ func reclaimRemovedPeers(kube kubernetes.Interface, cml *configMapAnnotations, m
 			return err
 		}
 		nodes, err := getKubePeers(kube, true)
+		if err != nil {
+			return err
+		}
 		nodeSet := make(map[string]struct{}, len(nodes))
 		for _, node := range nodes {
 			nodeSet[node.name] = struct{}{}
@@ -112,7 +115,7 @@ func reclaimRemovedPeers(kube kubernetes.Interface, cml *configMapAnnotations, m
 				common.Log.Warnln("[kube-peers] not removing myself", peer)
 				continue
 			}
-			changed, err := reclaimPeer(weave, cml, storedPeerList, peer.PeerName, myPeerName)
+			changed, err := reclaimPeer(weave, cml, peer.PeerName, myPeerName)
 			if err != nil {
 				return err
 			}
@@ -132,11 +135,16 @@ func reclaimRemovedPeers(kube kubernetes.Interface, cml *configMapAnnotations, m
 // actions the reclaim.
 // Return a bool to show whether we attempted to change anything,
 // and an error if something went wrong.
-func reclaimPeer(weave weaveClient, cml *configMapAnnotations, storedPeerList *peerList, peerName string, myPeerName string) (changed bool, err error) {
+func reclaimPeer(weave weaveClient, cml *configMapAnnotations, peerName string, myPeerName string) (changed bool, err error) {
 	common.Log.Debugln("[kube-peers] Preparing to remove disappeared peer", peerName)
 	okToRemove := false
 	nonExistentPeer := false
 
+	// Re-read status from Kubernetes; speculative updates may leave it un-set
+	if err := cml.Init(); err != nil {
+		return false, err
+	}
+
 	// 3. Check if there is an existing annotation with key X
 	existingAnnotation, found := cml.GetAnnotation(KubePeersPrefix + peerName)
 	if found {
@@ -145,6 +153,10 @@ func reclaimPeer(weave weaveClient, cml *configMapAnnotations, storedPeerList *p
 		if existingAnnotation == myPeerName {
 			okToRemove = true
 		} else {
+			storedPeerList, err := cml.GetPeerList()
+			if err != nil {
+				return false, err
+			}
 			// handle an edge case where peer claimed to own the action to reclaim but no longer
 			// exists hence lock persists foever
 			if !storedPeerList.contains(existingAnnotation) {
@@ -294,9 +306,6 @@ func main() {
 		}
 		return
 	}
-	if err != nil {
-		common.Log.Fatalf("[kube-peers] Could not get peers: %v", err)
-	}
 	if justReclaim {
 		cml := newConfigMapAnnotations(configMapNamespace, configMapName, c)
 
@@ -313,6 +322,9 @@ func main() {
 		return
 	}
 	peers, err := getKubePeers(c, false)
+	if err != nil {
+		common.Log.Fatalf("[kube-peers] Could not get peers: %v", err)
+	}
 	for _, node := range peers {
 		fmt.Println(node.addr)
 	}

prog/kube-utils/peerlist_test.go

@@ -137,9 +137,10 @@ func TestPeerListFuzz(t *testing.T) {
 		found := storedPeerList.contains(peerName(i))
 		require.True(t, found, "peer %d not found in stored list", i)
 
-		_, err = reclaimPeer(mockWeave{}, cml, storedPeerList, peerName(i), fmt.Sprintf("deleter-%d", i))
+		_, err = reclaimPeer(mockWeave{}, cml, peerName(i), fmt.Sprintf("deleter-%d", i))
 		require.NoError(t, err)
 
+		require.NoError(t, cml.Init())
 		storedPeerList, err = cml.GetPeerList()
 		require.NoError(t, err)
 		stateLock.Lock()

prog/weave-npc/main.go

@@ -128,7 +128,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 
 	// If the destination address is not any of the local pods, let it through
 	if err := ipt.Append(npc.TableFilter, npc.MainChain,
-		"-m", "physdev", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil {
+		"-m", "physdev", "--physdev-is-bridged", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil {
 		return err
 	}
 
@@ -150,8 +150,8 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	// Egress rules:
 	//
 	// -A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j ACCEPT
-	// -A WEAVE-NPC-EGRESS -m physdev --physdev-in=vethwe-bridge -j RETURN
-	// -A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
+	// -A WEAVE-NPC-EGRESS -m physdev --physdev-in vethwe-bridge --physdev-is-bridged -j RETURN
+	// -A WEAVE-NPC-EGRESS -m addrtype --dst-type LOCAL -j RETURN
 	// -A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
 	// -A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
 	// -A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j NFLOG --nflog-group 86
@@ -171,7 +171,10 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 
 	ruleSpecs := [][]string{
 		{"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"},
-		{"-m", "physdev", "--physdev-in=" + bridgePortName, "-j", "RETURN"},
+		// skip running through egress network policies for the traffic not coming from local pods
+		{"-m", "physdev", "--physdev-is-bridged", "--physdev-in=" + bridgePortName, "-j", "RETURN"},
+		// skip running through egress network policies for the traffic bound for IP address assigned for the bridge
+		{"-m", "addrtype", "--dst-type", "LOCAL", "-j", "RETURN"},
 	}
 	if allowMcast {
 		ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"})

site/concepts/network-topology.md

@@ -142,6 +142,15 @@ is not reachable, then the packet is dropped.  For most protocols
 (for example, TCP), the transmission will be retried a short time later, by
 which time the topology should have updated.
 
+#### <a name="connection-limit"></a>Connection Limit
+
+In a fully connected mesh of N peers, this would mean N^2 connections. To constrain the resource consumption and 
+communication between the peers and complexity of route calculation there is a configurable upper limit on the 
+maximum number of connections that a peer can make to the remote peers. There is safe default value (100) which works
+for most deployment. However if you would like to increase the number of peers, you should be able to explicitly override the
+default value by passing the value through `connlimit` flag for e.g.`weave launch --connlimit=100`. If you are using Weave with
+Kubernetes using [Kubernetes Addon](/site/kubernetes/kube-addon.md) then you can set CONN_LIMIT environment variable to set
+the connection limit.
 
 **See Also**
 

site/kubernetes/kube-addon.md

@@ -209,10 +209,10 @@ ask for the logs like this:
 $ kubectl logs -n kube-system weave-net-1jkl6 weave
 ```
 
-For easier viewing, pipe the output into a file , especially if
+For easier viewing, pipe the output into a file, especially if
 it is long.
 
-By default log level of `weave` container is set to `info` level. If you wish to see more detailed logs you can set the desired log level for the `-log-level` flag through the `EXTRA_ARGS` environment variable for the `weave` container in the weave-net daemon set. Add environment variable as below.
+By default log level of `weave` container is set to `info` level. If you wish to see more detailed logs you can set the desired log level for the `--log-level` flag through the `EXTRA_ARGS` environment variable for the `weave` container in the weave-net daemon set. Add environment variable as below.
 
 ```yaml
       containers:
@@ -224,6 +224,9 @@ By default log level of `weave` container is set to `info` level. If you wish to
           value: --log-level=debug
 ```
 
+You may also set the `--log-level` flag to `warning` or `error` if you
+prefer to only log exceptional conditions.
+
 Many Kubernetes network issues occur at a higher level than Weave Net.
 The [Kubernetes Service Debugging Guide]
 (https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/)
@@ -376,7 +379,7 @@ The list of variables you can set is:
 * `CHECKPOINT_DISABLE` - if set to 1, disable checking for new Weave Net
   versions (default is blank, i.e. check is enabled)
 * `CONN_LIMIT` - soft limit on the number of connections between
-  peers. Defaults to 30.
+  peers. Defaults to 100.
 * `HAIRPIN_MODE` - Weave Net defaults to enabling hairpin on the bridge side of
   the `veth` pair for containers attached. If you need to disable hairpin, e.g. your
   kernel is one of those that can panic if hairpin is enabled, then you can disable it

site/troubleshooting.md

@@ -332,6 +332,6 @@ and the container image versions as git hashes.
 
 **See Also**
 
- * [Troubleshooting the Kubernetes Addon](/site/kubernetes/kube-addon/#troubleshooting)
+ * [Troubleshooting the Kubernetes Addon](/site/kubernetes/kube-addon.md#troubleshooting)
  * [Troubleshooting IPAM](/site/tasks/ipam/troubleshooting-ipam.md)
  * [Troubleshooting the Proxy](/site/tasks/weave-docker-api/using-proxy.md)

testing/kubernetes/testing/fixture.go

@@ -110,10 +110,6 @@ func ObjectReaction(tracker ObjectTracker) testing.ReactionFunc {
 			}
 			err = tracker.Update(gvr, action.GetObject(), ns)
 			if err != nil {
-				if errors.IsConflict(err) { // return the currently-stored version of the object
-					obj, _ := tracker.Get(gvr, ns, objMeta.GetName())
-					return true, obj, err
-				}
 				return true, nil, err
 			}
 			obj, err := tracker.Get(gvr, ns, objMeta.GetName())