Martynas Pumputis
7c39f96d08
The main difference between new and legacy (pre-1.7) netpol semantics
are the following:
* The DenyDefault ingress isolation annotation is obsoleted.
* Traffic is allowed to a pod if there are no netpol selecting
the pod.
See https://kubernetes.io/docs/api-reference/v1.6/#networkpolicyspec-v1beta1-extensions
vs https://kubernetes.io/docs/api-reference/v1.7/#networkpolicyspec-v1-networking
for more details.
weave-npc can operate either in the legacy or the new mode (default). To
use the legacy, pass "--use-legacy-netpol" arg when starting the npc.
In non-legacy mode we create for each Namespace a default-allow ipset
which stores IP addrs of such Pods which are not selected by any
NetworkPolicy.The ipsets are dst's in rules of the WEAVE-NPC-DEFAULT chain.
Weave Net - Weaving Containers into Applications
About Weaveworks
Weaveworks is the company that delivers the most productive way for developers to connect, observe and control Docker containers.
This repository contains Weave Net, the first product developed by Weaveworks, and with over 8 million downloads to date, enables you to get started with Docker clusters and portable apps in a fraction of the time compared with other solutions.
Weave Cloud:
Weave Cloud is software-as-a-service that simplifies deployment, monitoring and management for containers and microservices. It extends and complements popular orchestrators, and enables developers and DevOps to realize faster deployments, insightful monitoring, visualization and networking.
Weave Cloud is built using these Open Source projects: Weave Scope, a powerful container visualization tool that automatically maps Docker containers and their interactions, Weave Cortex, a horizontally-scalable version of Prometheus, and Weave Flux, a continuous deployment tool that works with Kubernetes.
Weave Net
Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. With Weave Net, portable microservices-based applications consisting of multiple containers can run anywhere: on one host, multiple hosts or even across cloud providers and data centers. Applications use the network just as if the containers were all plugged into the same network switch, without having to configure port mappings, ambassadors or links.
Services provided by application containers on the Weave network can be exposed to the outside world, regardless of where they are running. Similarly, existing internal systems can be opened to accept connections from application containers irrespective of their location.
Getting help
If you have any questions about, feedback for or a problem with Weave Net:
- Read the Weave Net docs.
- Invite yourself to the #weave-community slack channel.
- Ask a question on the #weave-community slack channel.
- Join the Weave User Group and get invited to online talks, hands-on training and meetups in your area.
- Send an email to weave-users@weave.works
- File an issue.
Your feedback is always welcome!