Skip to content
This repository was archived by the owner on Jun 20, 2024. It is now read-only.

Commit e91900c

Browse files
bborehambboreham
authoredJan 14, 2021
Merge pull request #3880 from weaveworks/init-container
Kubernetes: move kernel and CNI setup to init container This allows the main container to run without write access to the host filesystem, except for two specific areas, thus trimming the attack surface. Also remove manifests for Kubernetes 1.6 and 1.7 to reduce maintenance load - they are ancient history.
·
v2.8.1latest_release
2 parents d81e908 + fe61992 commit e91900c

10 files changed

+139
-490
lines changed
 

‎bin/release

-30
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,6 @@ build() {
8989
## Inject the version numbers and build the distributables
9090
## (library versions?)
9191
sed -i.bak "/SCRIPT_VERSION=/ c\SCRIPT_VERSION=\"$VERSION\"" ./weave
92-
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.6.yaml
93-
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.7.yaml
9492
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.8.yaml
9593
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.9.yaml
9694
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.11.yaml
@@ -162,20 +160,6 @@ draft() {
162160
--name "weave" \
163161
--file "./weave"
164162

165-
github-release upload \
166-
--user $GITHUB_USER \
167-
--repo weave \
168-
--tag $LATEST_TAG \
169-
--name "weave-daemonset-k8s-1.6.yaml" \
170-
--file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"
171-
172-
github-release upload \
173-
--user $GITHUB_USER \
174-
--repo weave \
175-
--tag $LATEST_TAG \
176-
--name "weave-daemonset-k8s-1.7.yaml" \
177-
--file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml"
178-
179163
github-release upload \
180164
--user $GITHUB_USER \
181165
--repo weave \
@@ -284,20 +268,6 @@ publish() {
284268
--name "weave" \
285269
--file "./weave"
286270

287-
github-release upload \
288-
--user $GITHUB_USER \
289-
--repo weave \
290-
--tag latest_release \
291-
--name "weave-daemonset-k8s-1.6.yaml" \
292-
--file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"
293-
294-
github-release upload \
295-
--user $GITHUB_USER \
296-
--repo weave \
297-
--tag latest_release \
298-
--name "weave-daemonset-k8s-1.7.yaml" \
299-
--file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml"
300-
301271
github-release upload \
302272
--user $GITHUB_USER \
303273
--repo weave \

‎prog/weave-kube/Dockerfile.template

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ LABEL maintainer="Weaveworks <help@weave.works>" \
66
org.opencontainers.image.source="https://github.com/weaveworks/weave" \
77
org.opencontainers.image.vendor="Weaveworks"
88

9-
ADD ./launch.sh ./kube-utils /home/weave/
9+
ADD ./init.sh ./launch.sh ./kube-utils /home/weave/
1010
ENTRYPOINT ["/home/weave/launch.sh"]
1111

1212
# This label will change for every build, and should therefore be the last layer of the image:

‎prog/weave-kube/init.sh

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#!/bin/sh
2+
# Initialisation of Weave Net pod: check Linux settings and install CNI plugin
3+
4+
set -e
5+
6+
modprobe_safe() {
7+
modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
8+
}
9+
10+
# Check whether xt_set actually exists
11+
xt_set_exists() {
12+
# Clean everything up in advance, in case there's leftovers
13+
iptables -w -F WEAVE-KUBE-TEST 2>/dev/null || true
14+
iptables -w -X WEAVE-KUBE-TEST 2>/dev/null || true
15+
ipset destroy weave-kube-test 2>/dev/null || true
16+
17+
ipset create weave-kube-test hash:ip
18+
iptables -w -t filter -N WEAVE-KUBE-TEST
19+
if ! iptables -w -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
20+
NOT_EXIST=1
21+
fi
22+
iptables -w -F WEAVE-KUBE-TEST
23+
iptables -w -X WEAVE-KUBE-TEST
24+
ipset destroy weave-kube-test
25+
[ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
26+
}
27+
28+
# Default for network policy
29+
EXPECT_NPC=${EXPECT_NPC:-1}
30+
31+
# Ensure we have the required modules for NPC
32+
if [ "${EXPECT_NPC}" != "0" ]; then
33+
modprobe_safe br_netfilter
34+
modprobe_safe xt_set
35+
xt_set_exists
36+
fi
37+
38+
# kube-proxy requires that bridged traffic passes through netfilter
39+
if ! BRIDGE_NF_ENABLED=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables); then
40+
echo "Cannot detect bridge-nf support - network policy and iptables mode kubeproxy may not work reliably" >&2
41+
else
42+
if [ "$BRIDGE_NF_ENABLED" != "1" ]; then
43+
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
44+
fi
45+
fi
46+
47+
# This is where we expect the manifest to map host directories
48+
HOST_ROOT=${HOST_ROOT:-/host}
49+
50+
# Install CNI plugin binary to typical CNI bin location
51+
# with fall-back to CNI directory used by kube-up on GCI OS
52+
if ! mkdir -p $HOST_ROOT/opt/cni/bin ; then
53+
if mkdir -p $HOST_ROOT/home/kubernetes/bin ; then
54+
export WEAVE_CNI_PLUGIN_DIR=$HOST_ROOT/home/kubernetes/bin
55+
else
56+
echo "Failed to install the Weave CNI plugin" >&2
57+
exit 1
58+
fi
59+
fi
60+
mkdir -p $HOST_ROOT/etc/cni/net.d
61+
export HOST_ROOT
62+
/home/weave/weave --local setup-cni

‎prog/weave-kube/launch.sh

+3-53
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
#!/bin/sh
2+
# Launch of Weave Net pod - requires that init.sh has been run previously
23

34
set -e
45

5-
modprobe_safe() {
6-
modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
7-
}
6+
# If this is run from an older manifest, run the init script here
7+
[ "${INIT_CONTAINER}" = "true" ] || "$(dirname "$0")/init.sh"
88

99
# Setup iptables backend to be legacy or nftable
1010
setup_iptables_backend() {
@@ -34,24 +34,6 @@ setup_iptables_backend() {
3434
fi
3535
}
3636

37-
# Check whether xt_set actually exists
38-
xt_set_exists() {
39-
# Clean everything up in advance, in case there's leftovers
40-
iptables -w -F WEAVE-KUBE-TEST 2>/dev/null || true
41-
iptables -w -X WEAVE-KUBE-TEST 2>/dev/null || true
42-
ipset destroy weave-kube-test 2>/dev/null || true
43-
44-
ipset create weave-kube-test hash:ip
45-
iptables -w -t filter -N WEAVE-KUBE-TEST
46-
if ! iptables -w -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
47-
NOT_EXIST=1
48-
fi
49-
iptables -w -F WEAVE-KUBE-TEST
50-
iptables -w -X WEAVE-KUBE-TEST
51-
ipset destroy weave-kube-test
52-
[ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
53-
}
54-
5537
setup_iptables_backend
5638

5739
# Default if not supplied - same as weave net default
@@ -67,23 +49,6 @@ DB_PREFIX=${DB_PREFIX:-/weavedb/weave-net}
6749

6850
# Default for network policy
6951
EXPECT_NPC=${EXPECT_NPC:-1}
70-
NO_MASQ_LOCAL=${NO_MASQ_LOCAL:-1}
71-
72-
# Ensure we have the required modules for NPC
73-
if [ "${EXPECT_NPC}" != "0" ]; then
74-
modprobe_safe br_netfilter
75-
modprobe_safe xt_set
76-
xt_set_exists
77-
fi
78-
79-
# kube-proxy requires that bridged traffic passes through netfilter
80-
if ! BRIDGE_NF_ENABLED=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables); then
81-
echo "Cannot detect bridge-nf support - network policy and iptables mode kubeproxy may not work reliably" >&2
82-
else
83-
if [ "$BRIDGE_NF_ENABLED" != "1" ]; then
84-
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
85-
fi
86-
fi
8752

8853
STATUS_OPTS="--metrics-addr=$METRICS_ADDR"
8954
# --status-addr exposes internal information, so only turn it on if asked to.
@@ -160,20 +125,6 @@ post_start_actions() {
160125
sleep 1
161126
done
162127

163-
# Install CNI plugin binary to typical CNI bin location
164-
# with fall-back to CNI directory used by kube-up on GCI OS
165-
if ! mkdir -p $HOST_ROOT/opt/cni/bin ; then
166-
if mkdir -p $HOST_ROOT/home/kubernetes/bin ; then
167-
export WEAVE_CNI_PLUGIN_DIR=$HOST_ROOT/home/kubernetes/bin
168-
else
169-
echo "Failed to install the Weave CNI plugin" >&2
170-
exit 1
171-
fi
172-
fi
173-
mkdir -p $HOST_ROOT/etc/cni/net.d
174-
export HOST_ROOT
175-
/home/weave/weave --local setup-cni
176-
177128
# Attempt to run the reclaim process, but don't halt the script if it fails
178129
/home/weave/kube-utils -reclaim -node-name="$HOSTNAME" -peer-name="$PEERNAME" -log-level=debug || true
179130

@@ -190,7 +141,6 @@ post_start_actions &
190141

191142
/home/weave/weaver $EXTRA_ARGS --port=6783 $(router_bridge_opts) \
192143
--name="$PEERNAME" \
193-
--host-root=$HOST_ROOT \
194144
--http-addr=$HTTP_ADDR $STATUS_OPTS --docker-api='' --no-dns \
195145
--db-prefix="$DB_PREFIX" \
196146
--ipalloc-range=$IPALLOC_RANGE $NICKNAME_ARG \

‎prog/weave-kube/weave-daemonset-k8s-1.11.yaml

+24-8
Original file line numberDiff line numberDiff line change
@@ -118,11 +118,34 @@ items:
118118
labels:
119119
name: weave-net
120120
spec:
121+
initContainers:
122+
- name: weave-init
123+
image: 'weaveworks/weave-kube:latest'
124+
imagePullPolicy: Always
125+
command:
126+
- /home/weave/init.sh
127+
env:
128+
securityContext:
129+
privileged: true
130+
volumeMounts:
131+
- name: cni-bin
132+
mountPath: /host/opt
133+
- name: cni-bin2
134+
mountPath: /host/home
135+
- name: cni-conf
136+
mountPath: /host/etc
137+
- name: lib-modules
138+
mountPath: /lib/modules
139+
- name: xtables-lock
140+
mountPath: /run/xtables.lock
141+
readOnly: false
121142
containers:
122143
- name: weave
123144
command:
124145
- /home/weave/launch.sh
125146
env:
147+
- name: INIT_CONTAINER
148+
value: "true"
126149
- name: HOSTNAME
127150
valueFrom:
128151
fieldRef:
@@ -143,16 +166,9 @@ items:
143166
volumeMounts:
144167
- name: weavedb
145168
mountPath: /weavedb
146-
- name: cni-bin
147-
mountPath: /host/opt
148-
- name: cni-bin2
149-
mountPath: /host/home
150-
- name: cni-conf
151-
mountPath: /host/etc
152169
- name: dbus
153170
mountPath: /host/var/lib/dbus
154-
- name: lib-modules
155-
mountPath: /lib/modules
171+
readOnly: true
156172
- name: xtables-lock
157173
mountPath: /run/xtables.lock
158174
readOnly: false

‎prog/weave-kube/weave-daemonset-k8s-1.6.yaml

-181
This file was deleted.

‎prog/weave-kube/weave-daemonset-k8s-1.7.yaml

-200
This file was deleted.

‎prog/weave-kube/weave-daemonset-k8s-1.8.yaml

+24-8
Original file line numberDiff line numberDiff line change
@@ -115,11 +115,34 @@ items:
115115
labels:
116116
name: weave-net
117117
spec:
118+
initContainers:
119+
- name: weave-init
120+
image: 'weaveworks/weave-kube:latest'
121+
imagePullPolicy: Always
122+
command:
123+
- /home/weave/init.sh
124+
env:
125+
securityContext:
126+
privileged: true
127+
volumeMounts:
128+
- name: cni-bin
129+
mountPath: /host/opt
130+
- name: cni-bin2
131+
mountPath: /host/home
132+
- name: cni-conf
133+
mountPath: /host/etc
134+
- name: lib-modules
135+
mountPath: /lib/modules
136+
- name: xtables-lock
137+
mountPath: /run/xtables.lock
138+
readOnly: false
118139
containers:
119140
- name: weave
120141
command:
121142
- /home/weave/launch.sh
122143
env:
144+
- name: INIT_CONTAINER
145+
value: "true"
123146
- name: HOSTNAME
124147
valueFrom:
125148
fieldRef:
@@ -140,16 +163,9 @@ items:
140163
volumeMounts:
141164
- name: weavedb
142165
mountPath: /weavedb
143-
- name: cni-bin
144-
mountPath: /host/opt
145-
- name: cni-bin2
146-
mountPath: /host/home
147-
- name: cni-conf
148-
mountPath: /host/etc
149166
- name: dbus
150167
mountPath: /host/var/lib/dbus
151-
- name: lib-modules
152-
mountPath: /lib/modules
168+
readOnly: true
153169
- name: xtables-lock
154170
mountPath: /run/xtables.lock
155171
readOnly: false

‎prog/weave-kube/weave-daemonset-k8s-1.9.yaml

+24-8
Original file line numberDiff line numberDiff line change
@@ -118,11 +118,34 @@ items:
118118
labels:
119119
name: weave-net
120120
spec:
121+
initContainers:
122+
- name: weave-init
123+
image: 'weaveworks/weave-kube:latest'
124+
imagePullPolicy: Always
125+
command:
126+
- /home/weave/init.sh
127+
env:
128+
securityContext:
129+
privileged: true
130+
volumeMounts:
131+
- name: cni-bin
132+
mountPath: /host/opt
133+
- name: cni-bin2
134+
mountPath: /host/home
135+
- name: cni-conf
136+
mountPath: /host/etc
137+
- name: lib-modules
138+
mountPath: /lib/modules
139+
- name: xtables-lock
140+
mountPath: /run/xtables.lock
141+
readOnly: false
121142
containers:
122143
- name: weave
123144
command:
124145
- /home/weave/launch.sh
125146
env:
147+
- name: INIT_CONTAINER
148+
value: "true"
126149
- name: HOSTNAME
127150
valueFrom:
128151
fieldRef:
@@ -143,16 +166,9 @@ items:
143166
volumeMounts:
144167
- name: weavedb
145168
mountPath: /weavedb
146-
- name: cni-bin
147-
mountPath: /host/opt
148-
- name: cni-bin2
149-
mountPath: /host/home
150-
- name: cni-conf
151-
mountPath: /host/etc
152169
- name: dbus
153170
mountPath: /host/var/lib/dbus
154-
- name: lib-modules
155-
mountPath: /lib/modules
171+
readOnly: true
156172
- name: xtables-lock
157173
mountPath: /run/xtables.lock
158174
readOnly: false

‎test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ function setup_kubernetes_cluster {
5050
# Ensure Kubernetes uses locally built container images and inject code coverage environment variable (or do nothing depending on $COVERAGE):
5151
sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \
5252
-e "s%env:%$COVERAGE_ARGS%" \
53-
"$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.7.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -"
53+
"$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.11.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -"
5454
}
5555

5656
function force_drop_node {

0 commit comments

Comments
 (0)
This repository has been archived.