Merge pull request #3022 from alvistack/weave-2.4.0

weave: Upgrade to 2.4.0

README.md

@@ -100,7 +100,7 @@ Supported Components
     -   [cilium](https://github.com/cilium/cilium) v1.0.0-rc8
     -   [contiv](https://github.com/contiv/install) v1.1.7
     -   [flanneld](https://github.com/coreos/flannel) v0.10.0
-    -   [weave](https://github.com/weaveworks/weave) v2.3.0
+    -   [weave](https://github.com/weaveworks/weave) v2.4.0
 -   Application
     -   [cephfs-provisioner](https://github.com/kubernetes-incubator/external-storage) v1.1.0-k8s1.10
     -   [cert-manager](https://github.com/jetstack/cert-manager) v0.4.0

inventory/sample/group_vars/k8s-cluster.yml

@@ -67,25 +67,21 @@ kube_users:
 # Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
 kube_network_plugin: calico
 
-# weave's network password for encryption
+# Weave deployment
-# if null then no network encryption
+# weave_password: ~
-# you can use --extra-vars to pass the password in command line
+# weave_checkpoint_disable: false
-weave_password: EnterPasswordHere
+# weave_conn_limit: 100
-
+# weave_hairpin_mode: true
-# Weave uses consensus mode by default
+# weave_ipalloc_range: {{ kube_pods_subnet }}
-# Enabling seed mode allow to dynamically add or remove hosts
+# weave_expect_npc: {{ enable_network_policy }}
-# https://www.weave.works/docs/net/latest/ipam/
+# weave_kube_peers: ~
-weave_mode_seed: false
+# weave_ipalloc_init: ~
-
+# weave_expose_ip: ~
-# This two variable are automatically changed by the weave's role, do not manually change these values
+# weave_metrics_addr: ~
-# To reset values :
+# weave_status_addr: ~
-# weave_seed: uninitialized
+# weave_mtu: 1376
-# weave_peers: uninitialized
+# weave_no_masq_local: true
-weave_seed: uninitialized
+# weave_extra_args: ~
-weave_peers: uninitialized
-
-# Set the MTU of Weave (default 1376, Jumbo Frames: 8916)
-weave_mtu: 1376
 
 # Enable kubernetes network policies
 enable_network_policy: false

roles/download/defaults/main.yml

@@ -37,7 +37,7 @@ calico_rr_version: "v0.4.2"
 flannel_version: "v0.10.0"
 flannel_cni_version: "v0.3.0"
 vault_version: 0.10.1
-weave_version: 2.3.0
+weave_version: "2.4.0"
 pod_infra_version: 3.0
 contiv_version: 1.1.7
 cilium_version: "v1.0.0-rc8"

roles/kubernetes-apps/network_plugin/weave/tasks/main.yml

@@ -1,4 +1,5 @@
 ---
+
 - name: Weave | Start Resources
   kube:
     name: "weave-net"
@@ -9,13 +10,12 @@
     state: "latest"
   when: inventory_hostname == groups['kube-master'][0]
 
-- name: "Weave | wait for weave to become available"
+- name: Weave | Wait for Weave to become available
   uri:
     url: http://127.0.0.1:6784/status
     return_content: yes
   register: weave_status
   retries: 180
   delay: 5
-  until: "{{ weave_status.status == 200 and
+  until: "{{ weave_status.status == 200 and 'Status: ready' in weave_status.content }}"
-    'Status: ready' in weave_status.content }}"
   when: inventory_hostname == groups['kube-master'][0]

roles/network_plugin/weave/defaults/main.yml

@@ -1,29 +1,58 @@
 ---
-# Limits
-weave_memory_limits: 400M
-weave_cpu_limits: 300m
-weave_memory_requests: 64M
-weave_cpu_requests: 10m
 
-# This two variable are automatically changed by the weave's role, do not manually change these values
+# Weave's network password for encryption, if null then no network encryption.
-# To reset values :
+weave_password: ~
-# weave_seed: unset
-# weave_peers: unset
-weave_seed: uninitialized
-weave_peers: uninitialized
 
-# weave's network password for encryption
+# If set to 1, disable checking for new Weave Net versions (default is blank,
-# if null then no network encryption
+# i.e. check is enabled)
-# you can use --extra-vars to pass the password in command line
+weave_checkpoint_disable: false
-weave_password: EnterPasswordHere
 
-# Weave uses consensus mode by default
+# Soft limit on the number of connections between peers. Defaults to 100.
-# Enabling seed mode allow to dynamically add or remove hosts
+weave_conn_limit: 100
-# https://www.weave.works/docs/net/latest/ipam/
-weave_mode_seed: false
 
-# Set the MTU of Weave (default 1376, Jumbo Frames: 8916)
+# Weave Net defaults to enabling hairpin on the bridge side of the veth pair
+# for containers attached. If you need to disable hairpin, e.g. your kernel is
+# one of those that can panic if hairpin is enabled, then you can disable it by
+# setting `HAIRPIN_MODE=false`.
+weave_hairpin_mode: true
+
+# The range of IP addresses used by Weave Net and the subnet they are placed in
+# (CIDR format; default 10.32.0.0/12)
+weave_ipalloc_range: "{{ kube_pods_subnet }}"
+
+# Set to 0 to disable Network Policy Controller (default is on)
+weave_expect_npc: "{{ enable_network_policy }}"
+
+# List of addresses of peers in the Kubernetes cluster (default is to fetch the
+# list from the api-server)
+weave_kube_peers: ~
+
+# Set the initialization mode of the IP Address Manager (defaults to consensus
+# amongst the KUBE_PEERS)
+weave_ipalloc_init: ~
+
+# Set the IP address used as a gateway from the Weave network to the host
+# network - this is useful if you are configuring the addon as a static pod.
+weave_expose_ip: ~
+
+# Address and port that the Weave Net daemon will serve Prometheus-style
+# metrics on (defaults to 0.0.0.0:6782)
+weave_metrics_addr: ~
+
+# Address and port that the Weave Net daemon will serve status requests on
+# (defaults to disabled)
+weave_status_addr: ~
+
+# Weave Net defaults to 1376 bytes, but you can set a smaller size if your
+# underlying network has a tighter limit, or set a larger size for better
+# performance if your network supports jumbo frames (e.g. 8916)
 weave_mtu: 1376
 
-# this variable is use in seed mode
+# Set to 1 to preserve the client source IP address when accessing Service
-weave_ip_current_cluster: "{% for host in groups['k8s-cluster'] %}{{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}{% if not loop.last %} {% endif %}{% endfor %}"
+# annotated with `service.spec.externalTrafficPolicy=Local`. The feature works
+# only with Weave IPAM (default).
+weave_no_masq_local: true
+
+# Extra variables that passing to launch.sh, useful for enabling seed mode, see
+# https://www.weave.works/docs/net/latest/tasks/ipam/ipam/
+weave_extra_args: ~

roles/network_plugin/weave/tasks/main.yml

@@ -1,12 +1,4 @@
 ---
-- import_tasks: seed.yml
-  when: weave_mode_seed
-
-- name: template weavenet conflist
-  template:
-    src: 00-weave.conflist.j2
-    dest: /etc/cni/net.d/00-weave.conflist
-    owner: kube
 
 - name: Weave | Copy cni plugins from hyperkube
   command: "{{ docker_bin_dir }}/docker run --rm -v /opt/cni/bin:/cnibindir {{ hyperkube_image_repo }}:{{ hyperkube_image_tag }} /bin/cp -rf /opt/cni/bin/. /cnibindir/"
@@ -19,9 +11,12 @@
     - hyperkube
     - upgrade
 
-- name: Weave | Create weave-net manifest
+- name: Weave | Create manifest
   template:
     src: weave-net.yml.j2
     dest: "{{ kube_config_dir }}/weave-net.yml"
-    mode: 0640
+
-  register: weave_manifest
+- name: Weave | Fix nodePort for Weave
+  template:
+    src: 00-weave.conflist.j2
+    dest: /etc/cni/net.d/00-weave.conflist

roles/network_plugin/weave/tasks/seed.yml

@@ -1,56 +0,0 @@
----
-- name: Weave seed | Set seed if first time
-  set_fact:
-    seed: '{% for host in groups["k8s-cluster"] %}{{ hostvars[host]["ansible_default_ipv4"]["macaddress"] }}{% if not loop.last %},{% endif %}{% endfor %}'
-  when: "weave_seed == 'uninitialized'"
-  run_once: true
-  tags:
-    - confweave
-
-- name: Weave seed | Set seed if not first time
-  set_fact:
-    seed: '{{ weave_seed }}'
-  when: "weave_seed != 'uninitialized'"
-  run_once: true
-  tags:
-    - confweave
-
-- name: Weave seed | Set peers if fist time
-  set_fact:
-    peers: '{{ weave_ip_current_cluster }}'
-  when: "weave_peers == 'uninitialized'"
-  run_once: true
-  tags:
-    - confweave
-
-- name: Weave seed | Set peers if existing peers
-  set_fact:
-    peers: '{{ weave_peers }}{% for ip in weave_ip_current_cluster.split(" ") %}{% if ip not in weave_peers.split(" ") %} {{ ip }}{% endif %}{% endfor %}'
-  when: "weave_peers != 'uninitialized'"
-  run_once: true
-  tags:
-    - confweave
-
-- name: Weave seed | Save seed
-  lineinfile:
-    dest: "{{ inventory_dir }}/group_vars/k8s-cluster.yml"
-    state: present
-    regexp: '^weave_seed:'
-    line: 'weave_seed: {{ seed }}'
-  become: no
-  delegate_to: 127.0.0.1
-  run_once: true
-  tags:
-    - confweave
-
-- name: Weave seed | Save peers
-  lineinfile:
-    dest: "{{ inventory_dir }}/group_vars/k8s-cluster.yml"
-    state: present
-    regexp: '^weave_peers:'
-    line: 'weave_peers: {{ peers }}'
-  become: no
-  delegate_to: 127.0.0.1
-  run_once: true
-  tags:
-    - confweave

roles/network_plugin/weave/templates/weave-net.yml.j2

@@ -15,7 +15,6 @@ items:
       name: weave-net
       labels:
         name: weave-net
-      namespace: kube-system
     rules:
       - apiGroups:
           - ''
@@ -35,13 +34,19 @@ items:
           - get
           - list
           - watch
+      - apiGroups:
+          - ''
+        resources:
+          - nodes/status
+        verbs:
+          - patch
+          - update
   - apiVersion: rbac.authorization.k8s.io/v1beta1
     kind: ClusterRoleBinding
     metadata:
       name: weave-net
       labels:
         name: weave-net
-      namespace: kube-system
     roleRef:
       kind: ClusterRole
       name: weave-net
@@ -94,7 +99,6 @@ items:
       name: weave-net
       labels:
         name: weave-net
-        version: v{{ weave_version }}
       namespace: kube-system
     spec:
       minReadySeconds: 5
@@ -106,31 +110,56 @@ items:
           containers:
             - name: weave
               command:
-{% if weave_mode_seed == true %}
-                - /bin/sh
-                - -c
-                - export EXTRA_ARGS=--name=$(cat /sys/class/net/{{ ansible_default_ipv4['interface'] }}/address) && /home/weave/launch.sh
-{% else %}
                 - /home/weave/launch.sh
-{% endif %}
               env:
                 - name: HOSTNAME
                   valueFrom:
                     fieldRef:
                       apiVersion: v1
                       fieldPath: spec.nodeName
-                - name: WEAVE_MTU
-                  value: "{{ weave_mtu }}"
-                - name: IPALLOC_RANGE
-                  value: {{ kube_pods_subnet }}
-{% if weave_mode_seed == true %}
-                - name: KUBE_PEERS
-                  value: {{ peers }}
-                - name: IPALLOC_INIT
-                  value: seed={{ seed }}
-{% endif %}
                 - name: WEAVE_PASSWORD
-                  value: {{ weave_password }}
+                  valueFrom:
+                    secretKeyRef:
+                      name: weave-net
+                      key: WEAVE_PASSWORD
+                - name: CHECKPOINT_DISABLE
+                  value: "{{ weave_checkpoint_disable | bool | int }}"
+                - name: CONN_LIMIT
+                  value: "{{ weave_conn_limit | int }}"
+                - name: HAIRPIN_MODE
+                  value: "{{ weave_hairpin_mode | bool }}"
+                - name: IPALLOC_RANGE
+                  value: "{{ weave_ipalloc_range }}"
+                - name: EXPECT_NPC
+                  value: "{{ weave_expect_npc | bool | int }}"
+{% if weave_kube_peers %}
+                - name: KUBE_PEERS
+                  value: "{{ weave_kube_peers }}"
+{% endif %}
+{% if weave_ipalloc_init %}
+                - name: IPALLOC_INIT
+                  value: "{{ weave_ipalloc_init }}"
+{% endif %}
+{% if weave_expose_ip %}
+                - name: WEAVE_EXPOSE_IP
+                  value: "{{ weave_expose_ip }}"
+{% endif %}
+{% if weave_metrics_addr %}
+                - name: WEAVE_METRICS_ADDR
+                  value: "{{ weave_metrics_addr }}"
+{% endif %}
+{% if weave_status_addr %}
+                - name: WEAVE_STATUS_ADDR
+                  value: "{{ weave_status_addr }}"
+{% endif %}
+                - name: WEAVE_MTU
+                  value: "{{ weave_mtu | int }}"
+                - name: NO_MASQ_LOCAL
+                  value: "{{ weave_no_masq_local | bool | int }}"
+{% if weave_extra_args %}
+                - name: EXTRA_ARGS
+                  value: "{{ weave_extra_args }}"
+{% endif %}
               image: {{ weave_kube_image_repo }}:{{ weave_kube_image_tag }}
               imagePullPolicy: {{ k8s_image_pull_policy }}
               livenessProbe:
@@ -141,11 +170,7 @@ items:
                 initialDelaySeconds: 30
               resources:
                 requests:
-                  cpu: {{ weave_cpu_requests }}
+                  cpu: 10m
-                  memory: {{ weave_memory_requests }}
-                limits:
-                  cpu: {{ weave_cpu_limits }}
-                  memory: {{ weave_memory_limits }}
               securityContext:
                 privileged: true
               volumeMounts:
@@ -175,11 +200,7 @@ items:
               imagePullPolicy: {{ k8s_image_pull_policy }}
               resources:
                 requests:
-                  cpu: {{ weave_cpu_requests }}
+                  cpu: 10m
-                  memory: {{ weave_memory_requests }}
-                limits:
-                  cpu: {{ weave_cpu_limits }}
-                  memory: {{ weave_memory_limits }}
               securityContext:
                 privileged: true
               volumeMounts:
@@ -216,7 +237,15 @@ items:
             - name: xtables-lock
               hostPath:
                 path: /run/xtables.lock
+                type: FileOrCreate
       updateStrategy:
         rollingUpdate:
           maxUnavailable: {{ serial | default('20%') }}
         type: RollingUpdate
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: weave-net
+      namespace: kube-system
+    data:
+      WEAVE_PASSWORD: "{{ weave_password | default("") | b64encode }}"