Add release v2.6.2

send FastDatapathCryptoInitSARemote control message only if encryption is enabled

.ruby-version

@@ -1 +1 @@
-2.3.0
+2.6.2

CHANGELOG.md

@@ -1,3 +1,30 @@
+## Release 2.6.2
+
+This release fixes a regression found in 2.6.1 release and removes a possible case
+of CPU spinning when pcap is used in sleeve mode
+
+### Bug fixes
+
+* Weave Net can not be used in fastdp mode and always falls back to sleeve mode #3781, #3783
+* Restrict timeout value passed to pcap library to a value less than 2^31 microseconds to
+  prevent CPU spinning #3782
+
+## Release 2.6.1
+
+This release fixes a bug discovered since the release of Weave Net 2.6.0 and
+an improvement to support iptables 1.8
+
+### Bug fixes
+
+* Weave Net on node restart unable to form connections to peers and connections get stuck in
+  pending state and stops responding to API endpoint #3762 #3763
+
+### Other improvements
+
+* Weave Net Kubernetes images by default uses iptables 1.8 with legacy (netfilter) backend with
+  option to choose netfilter as backend #3465, #3747
+
+
 ## Release 2.6.0
 
 This release reduces CPU and memory usage in larger clusters, by

Makefile

@@ -25,7 +25,7 @@ ifeq ($(ARCH),amd64)
 	WEAVEEXEC_DOCKER_ARCH?=x86_64
 
 # The name of the alpine baseimage to use as the base for weave images
-	ALPINE_BASEIMAGE?=alpine:3.8
+	ALPINE_BASEIMAGE?=alpine:3.10
 
 # The extension for the made images
 # Specifying none means for example weaveworks/weave:latest

bin/provision_test_vms.sh

@@ -10,7 +10,7 @@ function signal_failure() {
 trap signal_failure ERR
 
 function install_terraform() {
-    curl -fsS https://releases.hashicorp.com/terraform/0.8.5/terraform_0.8.5_linux_amd64.zip | gunzip >terraform && chmod +x terraform && sudo mv terraform /usr/bin
+    curl -fsS https://releases.hashicorp.com/terraform/0.11.14/terraform_0.11.14_linux_amd64.zip | gunzip >terraform && chmod +x terraform && sudo mv terraform /usr/bin
 }
 
 function install_ansible() {

bin/release

@@ -93,6 +93,7 @@ build() {
     sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.7.yaml
     sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.8.yaml
     sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.9.yaml
+    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.11.yaml
     make SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER
 
     if make tests; then
@@ -189,6 +190,13 @@ draft() {
         --name "weave-daemonset-k8s-1.9.yaml" \
         --file "./prog/weave-kube/weave-daemonset-k8s-1.9.yaml"
  
+    github-release upload \
+        --user $GITHUB_USER \
+        --repo weave \
+        --tag $LATEST_TAG \
+        --name "weave-daemonset-k8s-1.11.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.11.yaml"
+
     echo "** Draft $TYPE $RELEASE_NAME $VERSION created at"
     echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
 }
@@ -304,6 +312,13 @@ publish() {
             --name "weave-daemonset-k8s-1.9.yaml" \
             --file "./prog/weave-kube/weave-daemonset-k8s-1.9.yaml"
 
+         github-release upload \
+            --user $GITHUB_USER \
+            --repo weave \
+            --tag latest_release \
+            --name "weave-daemonset-k8s-1.11.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.11.yaml"
+
         echo "** Release $RELEASE_NAME $VERSION published at"
         echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
         echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/latest_release"

net/ipsec/ipsec.go

@@ -85,7 +85,7 @@ func New(log *logrus.Logger) (*IPSec, error) {
 
 // InitSALocal initializes inbound ipsec from remotePeer and triggers
 // the initialization on remotePeer.
-func (ipsec *IPSec) InitSALocal(localPeer, remotePeer mesh.PeerName, connUID uint64, localIP, remoteIP net.IP, udpPort int, sessionKey *[32]byte, initRemote func([]byte) error) error {
+func (ipsec *IPSec) InitSALocal(localPeer, remotePeer mesh.PeerName, connUID uint64, localIP, remoteIP net.IP, udpPort int, sessionKey *[32]byte) ([]byte, error) {
 	// ID of inbound SPI
 	spiID := getSPIId(remotePeer, localPeer, connUID)
 
@@ -95,17 +95,17 @@ func (ipsec *IPSec) InitSALocal(localPeer, remotePeer mesh.PeerName, connUID uin
 	// Derive SA key
 	nonce, err := genNonce()
 	if err != nil {
-		return errors.Wrap(err, "generate nonce")
+		return nil, errors.Wrap(err, "generate nonce")
 	}
 	key, err := deriveKey(sessionKey[:], nonce, localPeer)
 	if err != nil {
-		return errors.Wrap(err, "derive key")
+		return nil, errors.Wrap(err, "derive key")
 	}
 
 	// Allocate SA
 	sa, err := netlink.XfrmStateAllocSpi(xfrmAllocSpiState(remoteIP, localIP))
 	if err != nil {
-		return errors.Wrap(err, fmt.Sprintf("ip xfrm state allocspi (in, %s, %s)", remoteIP, localIP))
+		return nil, errors.Wrap(err, fmt.Sprintf("ip xfrm state allocspi (in, %s, %s)", remoteIP, localIP))
 	}
 
 	// Use SPI generated by the kernel. The kernel ensures {dstIP, spi} to
@@ -117,28 +117,24 @@ func (ipsec *IPSec) InitSALocal(localPeer, remotePeer mesh.PeerName, connUID uin
 	// Create SA
 	if sa, err := xfrmState(remoteIP, localIP, spi, false, key); err == nil {
 		if err := netlink.XfrmStateUpdate(sa); err != nil {
-			return errors.Wrap(err, fmt.Sprintf("xfrm state update (in, %s, %s, 0x%x)", sa.Src, sa.Dst, sa.Spi))
+			return nil, errors.Wrap(err, fmt.Sprintf("xfrm state update (in, %s, %s, 0x%x)", sa.Src, sa.Dst, sa.Spi))
 		}
 	} else {
-		return errors.Wrap(err, "new xfrm state (in)")
+		return nil, errors.Wrap(err, "new xfrm state (in)")
 	}
 
 	// Install iptables rules
 	if err := ipsec.installDropNonEncrypted(localIP, remoteIP, udpPort, spi); err != nil {
-		return errors.Wrap(err, fmt.Sprintf("install protecting rules (%s, %s, %d, 0x%x)", localIP, remoteIP, udpPort, spi))
+		return nil, errors.Wrap(err, fmt.Sprintf("install protecting rules (%s, %s, %d, 0x%x)", localIP, remoteIP, udpPort, spi))
 	}
 
 	si := spiInfo{spi: spi, isDirOut: false}
 	ipsec.spiInfo[spiID] = si
 	ipsec.spis[spi] = &si
 
-	// Trigger the initialization on the remote peer
+	// Generate the message to trigger initialization on the remote peer
 	msg := &msgInitSARemote{nonce, spi}
-	if err := initRemote(msg.serialize()); err != nil {
+	return msg.serialize(), nil
-		return errors.Wrap(err, "send InitSARemote")
-	}
-
-	return nil
 }
 
 // InitSARemote initializes outbound ipsec to remotePeer.

prog/weave-kube/launch.sh

@@ -6,6 +6,34 @@ modprobe_safe() {
     modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
 }
 
+# Setup iptables backend to be legacy or nftable
+setup_iptables_backend() {
+    if [ -n "${IPTABLES_BACKEND}" ]; then
+      mode=$IPTABLES_BACKEND
+    else
+      # auto-detect if iptables backend mode to use if not specified explicitly
+      num_legacy_lines=$( (iptables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l)
+      num_nft_lines=$( (iptables-nft-save || true) 2>/dev/null | grep '^-' | wc -l)
+      if [ "${num_legacy_lines}" -ge 10 ]; then
+        mode="legacy"
+      else
+        if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then
+          mode="legacy"
+        else
+          mode="nft"
+        fi
+      fi
+    fi
+    if [ $mode = "nft" ]; then
+      rm /sbin/iptables
+      rm /sbin/iptables-save
+      rm /sbin/iptables-restore
+      ln -s /sbin/iptables-nft /sbin/iptables
+      ln -s /sbin/iptables-nft-save /sbin/iptables-save
+      ln -s /sbin/iptables-nft-restore /sbin/iptables-restore
+    fi
+}
+
 # Check whether xt_set actually exists
 xt_set_exists() {
     # Clean everything up in advance, in case there's leftovers
@@ -24,6 +52,8 @@ xt_set_exists() {
     [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
 }
 
+setup_iptables_backend
+
 # Default if not supplied - same as weave net default
 IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12}
 HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784}

prog/weave-kube/weave-daemonset-k8s-1.11.yaml

@@ -8,7 +8,7 @@ items:
       labels:
         name: weave-net
       namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
       name: weave-net
@@ -48,7 +48,7 @@ items:
         verbs:
         - patch
         - update
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRoleBinding
     metadata:
       name: weave-net
@@ -62,7 +62,7 @@ items:
       - kind: ServiceAccount
         name: weave-net
         namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: Role
     metadata:
       name: weave-net
@@ -85,7 +85,7 @@ items:
           - configmaps
         verbs:
           - create
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       name: weave-net
@@ -137,7 +137,7 @@ items:
                   port: 6784
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:
@@ -168,7 +168,7 @@ items:
 #npc-args
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:
@@ -176,6 +176,7 @@ items:
                   mountPath: /run/xtables.lock
                   readOnly: false
           hostNetwork: true
+          dnsPolicy: ClusterFirstWithHostNet
           hostPID: true
           restartPolicy: Always
           securityContext:

prog/weave-kube/weave-daemonset-k8s-1.6.yaml

@@ -117,7 +117,7 @@ items:
                   port: 6784
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:
@@ -144,7 +144,7 @@ items:
               imagePullPolicy: Always
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
           hostNetwork: true

prog/weave-kube/weave-daemonset-k8s-1.7.yaml

@@ -126,7 +126,7 @@ items:
                   port: 6784
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:
@@ -156,7 +156,7 @@ items:
               imagePullPolicy: Always
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:

prog/weave-kube/weave-daemonset-k8s-1.8.yaml

@@ -8,7 +8,7 @@ items:
       labels:
         name: weave-net
       namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
       name: weave-net
@@ -48,7 +48,7 @@ items:
         verbs:
         - patch
         - update
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRoleBinding
     metadata:
       name: weave-net
@@ -62,7 +62,7 @@ items:
       - kind: ServiceAccount
         name: weave-net
         namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: Role
     metadata:
       name: weave-net
@@ -85,7 +85,7 @@ items:
           - configmaps
         verbs:
           - create
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       name: weave-net
@@ -134,7 +134,7 @@ items:
                   port: 6784
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:
@@ -165,7 +165,7 @@ items:
 #npc-args
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:

prog/weave-kube/weave-daemonset-k8s-1.9.yaml

@@ -8,7 +8,7 @@ items:
       labels:
         name: weave-net
       namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
       name: weave-net
@@ -48,7 +48,7 @@ items:
         verbs:
         - patch
         - update
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRoleBinding
     metadata:
       name: weave-net
@@ -62,7 +62,7 @@ items:
       - kind: ServiceAccount
         name: weave-net
         namespace: kube-system
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: Role
     metadata:
       name: weave-net
@@ -85,7 +85,7 @@ items:
           - configmaps
         verbs:
           - create
-  - apiVersion: rbac.authorization.k8s.io/v1beta1
+  - apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       name: weave-net
@@ -137,7 +137,7 @@ items:
                   port: 6784
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:
@@ -168,7 +168,7 @@ items:
 #npc-args
               resources:
                 requests:
-                  cpu: 10m
+                  cpu: 50m
               securityContext:
                 privileged: true
               volumeMounts:

prog/weave-npc/launch.sh

@@ -2,5 +2,35 @@
 
 set -e
 
+# Setup iptables backend to be legacy or nftable
+setup_iptables_backend() {
+    if [ -n "${IPTABLES_BACKEND}" ]; then
+      mode=$IPTABLES_BACKEND
+    else
+      # auto-detect if iptables backend mode to use if not specified explicitly
+      num_legacy_lines=$( (iptables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l)
+      num_nft_lines=$( (iptables-nft-save || true) 2>/dev/null | grep '^-' | wc -l)
+      if [ "${num_legacy_lines}" -ge 10 ]; then
+        mode="legacy"
+      else
+        if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then
+          mode="legacy"
+        else
+          mode="nft"
+        fi
+      fi
+    fi
+    if [ $mode = "nft" ]; then
+      rm /sbin/iptables
+      rm /sbin/iptables-save
+      rm /sbin/iptables-restore
+      ln -s /sbin/iptables-nft /sbin/iptables
+      ln -s /sbin/iptables-nft-save /sbin/iptables-save
+      ln -s /sbin/iptables-nft-restore /sbin/iptables-restore
+    fi
+}
+
+setup_iptables_backend
+
 # Start weave-npc with any flags specified in $EXTRA_ARGS as well as any flags passed to this container (for backwards compatibility)
 exec /usr/bin/weave-npc $EXTRA_ARGS $@

router/fastdp.go

@@ -482,7 +482,7 @@ func (fastdp *FastDatapath) getVxlanVportID(udpPort int) (odp.VportID, error) {
 			// The netdev interface is down, so most likely bringing it up
 			// has failed due to the UDP port being in use.
 			if err := fastdp.dp.DeleteVport(vxlanVportID); err != nil {
-				log.Warning("Unable to remove vxlan vport %d: %s", vxlanVportID, err)
+				log.Warningf("Unable to remove vxlan vport %d: %s", vxlanVportID, err)
 			}
 			return 0, odp.NetlinkError(syscall.EADDRINUSE)
 		}
@@ -654,27 +654,26 @@ func (fwd *fastDatapathForwarder) logPrefix() string {
 
 func (fwd *fastDatapathForwarder) Confirm() {
 	fwd.lock.Lock()
-	defer fwd.lock.Unlock()
 
 	if fwd.confirmed {
 		log.Fatal(fwd.logPrefix(), "already confirmed")
 	}
 
+	var controlMsg []byte
 	if fwd.fastdp.ipsec != nil && fwd.sessionKey != nil {
 		fwd.isEncrypted = true
 		log.Info("Setting up IPsec between ", fwd.fastdp.localPeer, " and ", fwd.remotePeer)
-		err := fwd.fastdp.ipsec.InitSALocal(
+		var err error
+		controlMsg, err = fwd.fastdp.ipsec.InitSALocal(
 			fwd.fastdp.localPeer.Name, fwd.remotePeer.Name, fwd.connUID,
 			net.IP(fwd.localIP[:]), fwd.remoteAddr.IP,
 			fwd.remoteAddr.Port,
 			fwd.sessionKey,
-			func(msg []byte) error {
-				return fwd.sendControlMsg(FastDatapathCryptoInitSARemote, msg)
-			},
 		)
 		if err != nil {
 			log.Error(fwd.logPrefix(), "ipsec init SA local failed: ", err)
 			fwd.handleError(err)
+			fwd.lock.Unlock()
 			return
 		}
 	}
@@ -692,6 +691,17 @@ func (fwd *fastDatapathForwarder) Confirm() {
 	}
 
 	fwd.heartbeatTimeout = time.NewTimer(HeartbeatTimeout)
+
+	fwd.lock.Unlock() // unlock before calling send() which may block
+
+	if len(controlMsg) > 0 {
+		if err := fwd.sendControlMsg(FastDatapathCryptoInitSARemote, controlMsg); err != nil {
+			log.Error(fwd.logPrefix(), "ipsec send InitSARemote failed: ", err)
+			fwd.handleError(err)
+			return
+		}
+	}
+
 	go fwd.doHeartbeats()
 }
 

router/pcap.go

@@ -4,10 +4,14 @@ import (
 	"fmt"
 	"net"
 	"sync"
+	"time"
 
 	"github.com/google/gopacket/pcap"
 )
 
+// Must be less than 2^31 usec - see https://github.com/google/gopacket/issues/708
+const longTimeout = time.Duration(30 * time.Minute)
+
 type Pcap struct {
 	NonDiscardingFlowOp
 
@@ -77,7 +81,7 @@ func newPcapHandle(ifName string, promisc bool, snaplen int, bufSz int) (handle
 	if err = inactive.SetSnapLen(snaplen); err != nil {
 		return
 	}
-	if err = inactive.SetTimeout(MaxDuration); err != nil {
+	if err = inactive.SetTimeout(longTimeout); err != nil {
 		return
 	}
 	if err = inactive.SetImmediateMode(true); err != nil {

site/kubernetes/kube-addon.md

@@ -89,23 +89,18 @@ Kubernetes manages
 on each node, and only schedules pods to run on nodes that have enough
 free resources.
 
-The components of a typical Kubernetes installation (with the master
+In the example manifests we request 10% of a CPU, which will be enough
-node running etcd, scheduler, api-server, etc.) take up about 95% of a
+for small installations, but you should monitor how much it uses in
-CPU, which leaves little room to run anything else. For all of Weave
+your production clusters and adjust the requests to suit.
-Net's features to work, it must run on every node, including the
-master.
 
-The best way to resolve this issue is to use machines with at least
+We do not recommend that you set a CPU or memory _limit_ unless you
-two CPU cores. However if you are installing Kubernetes and Weave Net
+are very experienced in such matters, because the implementation of
-for the first time, you may not be aware of this requirement. For this
+limits in the Linux kernel sometimes behaves in a surprising way.
-reason, Weave Net launches as a DaemonSet with a specification that
-reserves at least 1% CPU for each container. This enables Weave Net to
-start up seamlessly on a single-CPU node.
 
-Depending on the workload, Weave Net may need more than 1% of the
+On a 1-node single-CPU cluster you may find Weave Net does not install
-CPU. The percentage set in the DaemonSet is the minimum and not a
+at all, because other Kubernetes components already take 95% of the
-limit. This minimum setting allows Weave Net to take advantage of
+CPU. The best way to resolve this issue is to use machines with at
-available CPU and "burst" above that limit if it needs to.
+least two CPU cores.
 
 ## <a name="eviction"></a>Pod Eviction
 
@@ -231,8 +226,7 @@ You may also set the `--log-level` flag to `warning` or `error` if you
 prefer to only log exceptional conditions.
 
 Many Kubernetes network issues occur at a higher level than Weave Net.
-The [Kubernetes Service Debugging Guide]
+The [Kubernetes Service Debugging Guide](https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/)
-(https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/)
 has a detailed step-by-step guide.
 
 Once it is up and running, the status of Weave Net can be checked by
@@ -384,7 +378,7 @@ The list of variables you can set is:
 * `CHECKPOINT_DISABLE` - if set to 1, disable checking for new Weave Net
   versions (default is blank, i.e. check is enabled)
 * `CONN_LIMIT` - soft limit on the number of connections between
-  peers. Defaults to 100.
+  peers. Defaults to 200.
 * `HAIRPIN_MODE` - Weave Net defaults to enabling hairpin on the bridge side of
   the `veth` pair for containers attached. If you need to disable hairpin, e.g. your
   kernel is one of those that can panic if hairpin is enabled, then you can disable it
@@ -412,6 +406,7 @@ The list of variables you can set is:
 * `NO_MASQ_LOCAL` - set to 1 to preserve the client source IP address when
   accessing Service annotated with `service.spec.externalTrafficPolicy=Local`.
   The feature works only with Weave IPAM (default).
+* `IPTABLES_BACKEND` - set to `nft` to use `nftables` backend for `iptables` (default is `iptables`) 
 
 Example:
 ```
@@ -458,3 +453,11 @@ You must pass the `password-secret` option as noted in the previous section to e
 A different option is to use `trusted-subnets` and whitelist only the subnets that host your k8s nodes. Mind that depending on your circumstances that might allow a malicious container running in your cluster to access the weave dataplane, still.
 
 Read on the [Securing Connections Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks/) document to see the alternatives.
+
+To improve security drop `CAP_NET_RAW` from pod capabilities: by default pods can forge packets from anywhere on the network, which enables attacks such as DNS spoofing.
+
+```
+     securityContext:
+       capabilities:
+         drop: ["NET_RAW"]
+```

site/tasks/ipam/manual-ip-address.md

@@ -13,7 +13,22 @@ Weave Net detects when a container has exited and releases its allocated address
 
 See the [Automatic IP Address Management](/site/tasks/ipam/ipam.md) and also an explanation of [the basics of IP addressing](/site/concepts/ip-addresses.md) for further details.
 
-Instead of allowing Weave Net to allocate IP addresses automatically (using IPAM), there may be instances where you need to control a particular container or a cluster by setting an IP address for it.  
+Instead of allowing Weave Net to allocate IP addresses automatically (using IPAM), there may be instances where you need to control a particular container or a cluster by setting an IP address for it.  The way to do this varies according to how containers are attached to Weave Net.
+
+## Manually specifying an IP address when using CNI
+
+The software making a call to CNI has to specify an allocator that allows static IPs.
+For instance the [static allocator](https://github.com/containernetworking/plugins/tree/master/plugins/ipam/static)
+
+(At the time of writing there is no straightforward way to ask Kubernetes to do this.)
+
+## Manually specifying an IP address when using the Weave Net Docker Plugin
+
+Docker has a flag `--ip` to specify an address, e.g.:
+
+    $ docker run --network=mynetwork --ip=172.18.0.22 ...
+
+## Manually specifying an IP address when using the Weave Net Docker Proxy
 
 You can specify an IP address and a network explicitly, using Classless Inter-Domain Routing or [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing).
 

test/run-integration-tests.sh

@@ -206,7 +206,8 @@ function set_hosts() {
 function provision_remotely() {
     case "$1" in
         on)
-            terraform apply -input=false -parallelism="$NUM_HOSTS" -var "app=$APP" -var "name=$NAME" -var "num_hosts=$NUM_HOSTS" "$DIR/../tools/provisioning/$2"
+            terraform init "$DIR/../tools/provisioning/gcp"
+            terraform apply -auto-approve -input=false -parallelism="$NUM_HOSTS" -var "app=$APP" -var "name=$NAME" -var "num_hosts=$NUM_HOSTS" "$DIR/../tools/provisioning/$2"
             local status=$?
             ssh_user=$(terraform output username)
             ssh_id_file=$(terraform output private_key_path)