levaliciousandClaude Opus 5.5
9261a48983
images / images (push) Successful in 6m34s
The live run found ping from a member on one node failing right after a member on another node pinged the same host: busybox ping uses its PID as the ICMP echo identifier, containers' PIDs are small and alike, so both nodes' echoes reached the holder as the same connection, and the holder dropped the second as a collision (fail closed, as intended). NAT treats the echo identifier as ICMP's port, and iptables accepts a range for it: members' ICMP is now SNATed into the node's block like TCP, UDP and SCTP, so every node's pings are distinct on the holder. Replies follow the holder's tag as before. The end-to-end test's ping and traceroute pods run as root (the curl image's user cannot use raw sockets even with NET_RAW). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ
reweave
This is an effort to create a modern build environment for weave net, and simultaneously upgrade dependencies and the go compiler version.
This should solve some known problems, including:
- Incompatibility with some versions of CNI and containerd
- Vulnerabilities in the current weave images (2.8.1)
- Mismatch between the Docker Hub hosted weave:latest and weave:2.8.1 images
- Problems with multi-architecture images
The current focus of this effort is running weave net as a CNI plugin on Kubernetes. As such, other parts of weave net, such as the docker plugin, may receive less attention.
Tasks
Document the old build processOld build process documented in BUILDING-OLD.mdCreate a image scanning process and scan current imageImage scanning process created, scan reports generated for 2.8.1Create a new build processNew build process created, documented in BUILDING.mdBuild, generate and test current imagesBuilt and scanned v2.8.2-beta*Upgrade Go compiler versionGo version upgraded to 1.20- Scan images for CVEs
- While there are fixable CVEs:
- Upgrade dependencies using CVE list as guideline
- Build, generate new images, test
- Scan new images for CVEs After a few rounds of the above, several components have been upgraded (details in the CHANGELOG). This process will continue.