Skip to content
This repository was archived by the owner on Jun 20, 2024. It is now read-only.

Commit e91900c

Browse files
bborehambboreham
authored
Merge pull request #3880 from weaveworks/init-container
Kubernetes: move kernel and CNI setup to init container This allows the main container to run without write access to the host filesystem, except for two specific areas, thus trimming the attack surface. Also remove manifests for Kubernetes 1.6 and 1.7 to reduce maintenance load - they are ancient history.
2 parents d81e908 + fe61992 commit e91900c

10 files changed

+139
-490
lines changed

‎bin/release

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,6 @@ build() {
8989
## Inject the version numbers and build the distributables
9090
## (library versions?)
9191
sed -i.bak "/SCRIPT_VERSION=/ c\SCRIPT_VERSION=\"$VERSION\"" ./weave
92-
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.6.yaml
93-
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.7.yaml
9492
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.8.yaml
9593
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.9.yaml
9694
sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.11.yaml
@@ -162,20 +160,6 @@ draft() {
162160
--name "weave" \
163161
--file "./weave"
164162

165-
github-release upload \
166-
--user $GITHUB_USER \
167-
--repo weave \
168-
--tag $LATEST_TAG \
169-
--name "weave-daemonset-k8s-1.6.yaml" \
170-
--file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"
171-
172-
github-release upload \
173-
--user $GITHUB_USER \
174-
--repo weave \
175-
--tag $LATEST_TAG \
176-
--name "weave-daemonset-k8s-1.7.yaml" \
177-
--file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml"
178-
179163
github-release upload \
180164
--user $GITHUB_USER \
181165
--repo weave \
@@ -284,20 +268,6 @@ publish() {
284268
--name "weave" \
285269
--file "./weave"
286270

287-
github-release upload \
288-
--user $GITHUB_USER \
289-
--repo weave \
290-
--tag latest_release \
291-
--name "weave-daemonset-k8s-1.6.yaml" \
292-
--file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"
293-
294-
github-release upload \
295-
--user $GITHUB_USER \
296-
--repo weave \
297-
--tag latest_release \
298-
--name "weave-daemonset-k8s-1.7.yaml" \
299-
--file "./prog/weave-kube/weave-daemonset-k8s-1.7.yaml"
300-
301271
github-release upload \
302272
--user $GITHUB_USER \
303273
--repo weave \

‎prog/weave-kube/Dockerfile.template

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ LABEL maintainer="Weaveworks <[email protected]>" \
66
org.opencontainers.image.source="https://github.com/weaveworks/weave" \
77
org.opencontainers.image.vendor="Weaveworks"
88

9-
ADD ./launch.sh ./kube-utils /home/weave/
9+
ADD ./init.sh ./launch.sh ./kube-utils /home/weave/
1010
ENTRYPOINT ["/home/weave/launch.sh"]
1111

1212
# This label will change for every build, and should therefore be the last layer of the image:

‎prog/weave-kube/init.sh

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#!/bin/sh
2+
# Initialisation of Weave Net pod: check Linux settings and install CNI plugin
3+
4+
set -e
5+
6+
modprobe_safe() {
7+
modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
8+
}
9+
10+
# Check whether xt_set actually exists
11+
xt_set_exists() {
12+
# Clean everything up in advance, in case there's leftovers
13+
iptables -w -F WEAVE-KUBE-TEST 2>/dev/null || true
14+
iptables -w -X WEAVE-KUBE-TEST 2>/dev/null || true
15+
ipset destroy weave-kube-test 2>/dev/null || true
16+
17+
ipset create weave-kube-test hash:ip
18+
iptables -w -t filter -N WEAVE-KUBE-TEST
19+
if ! iptables -w -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
20+
NOT_EXIST=1
21+
fi
22+
iptables -w -F WEAVE-KUBE-TEST
23+
iptables -w -X WEAVE-KUBE-TEST
24+
ipset destroy weave-kube-test
25+
[ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
26+
}
27+
28+
# Default for network policy
29+
EXPECT_NPC=${EXPECT_NPC:-1}
30+
31+
# Ensure we have the required modules for NPC
32+
if [ "${EXPECT_NPC}" != "0" ]; then
33+
modprobe_safe br_netfilter
34+
modprobe_safe xt_set
35+
xt_set_exists
36+
fi
37+
38+
# kube-proxy requires that bridged traffic passes through netfilter
39+
if ! BRIDGE_NF_ENABLED=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables); then
40+
echo "Cannot detect bridge-nf support - network policy and iptables mode kubeproxy may not work reliably" >&2
41+
else
42+
if [ "$BRIDGE_NF_ENABLED" != "1" ]; then
43+
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
44+
fi
45+
fi
46+
47+
# This is where we expect the manifest to map host directories
48+
HOST_ROOT=${HOST_ROOT:-/host}
49+
50+
# Install CNI plugin binary to typical CNI bin location
51+
# with fall-back to CNI directory used by kube-up on GCI OS
52+
if ! mkdir -p $HOST_ROOT/opt/cni/bin ; then
53+
if mkdir -p $HOST_ROOT/home/kubernetes/bin ; then
54+
export WEAVE_CNI_PLUGIN_DIR=$HOST_ROOT/home/kubernetes/bin
55+
else
56+
echo "Failed to install the Weave CNI plugin" >&2
57+
exit 1
58+
fi
59+
fi
60+
mkdir -p $HOST_ROOT/etc/cni/net.d
61+
export HOST_ROOT
62+
/home/weave/weave --local setup-cni

‎prog/weave-kube/launch.sh

Lines changed: 3 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
#!/bin/sh
2+
# Launch of Weave Net pod - requires that init.sh has been run previously
23

34
set -e
45

5-
modprobe_safe() {
6-
modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
7-
}
6+
# If this is run from an older manifest, run the init script here
7+
[ "${INIT_CONTAINER}" = "true" ] || "$(dirname "$0")/init.sh"
88

99
# Setup iptables backend to be legacy or nftable
1010
setup_iptables_backend() {
@@ -34,24 +34,6 @@ setup_iptables_backend() {
3434
fi
3535
}
3636

37-
# Check whether xt_set actually exists
38-
xt_set_exists() {
39-
# Clean everything up in advance, in case there's leftovers
40-
iptables -w -F WEAVE-KUBE-TEST 2>/dev/null || true
41-
iptables -w -X WEAVE-KUBE-TEST 2>/dev/null || true
42-
ipset destroy weave-kube-test 2>/dev/null || true
43-
44-
ipset create weave-kube-test hash:ip
45-
iptables -w -t filter -N WEAVE-KUBE-TEST
46-
if ! iptables -w -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
47-
NOT_EXIST=1
48-
fi
49-
iptables -w -F WEAVE-KUBE-TEST
50-
iptables -w -X WEAVE-KUBE-TEST
51-
ipset destroy weave-kube-test
52-
[ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
53-
}
54-
5537
setup_iptables_backend
5638

5739
# Default if not supplied - same as weave net default
@@ -67,23 +49,6 @@ DB_PREFIX=${DB_PREFIX:-/weavedb/weave-net}
6749

6850
# Default for network policy
6951
EXPECT_NPC=${EXPECT_NPC:-1}
70-
NO_MASQ_LOCAL=${NO_MASQ_LOCAL:-1}
71-
72-
# Ensure we have the required modules for NPC
73-
if [ "${EXPECT_NPC}" != "0" ]; then
74-
modprobe_safe br_netfilter
75-
modprobe_safe xt_set
76-
xt_set_exists
77-
fi
78-
79-
# kube-proxy requires that bridged traffic passes through netfilter
80-
if ! BRIDGE_NF_ENABLED=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables); then
81-
echo "Cannot detect bridge-nf support - network policy and iptables mode kubeproxy may not work reliably" >&2
82-
else
83-
if [ "$BRIDGE_NF_ENABLED" != "1" ]; then
84-
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
85-
fi
86-
fi
8752

8853
STATUS_OPTS="--metrics-addr=$METRICS_ADDR"
8954
# --status-addr exposes internal information, so only turn it on if asked to.
@@ -160,20 +125,6 @@ post_start_actions() {
160125
sleep 1
161126
done
162127

163-
# Install CNI plugin binary to typical CNI bin location
164-
# with fall-back to CNI directory used by kube-up on GCI OS
165-
if ! mkdir -p $HOST_ROOT/opt/cni/bin ; then
166-
if mkdir -p $HOST_ROOT/home/kubernetes/bin ; then
167-
export WEAVE_CNI_PLUGIN_DIR=$HOST_ROOT/home/kubernetes/bin
168-
else
169-
echo "Failed to install the Weave CNI plugin" >&2
170-
exit 1
171-
fi
172-
fi
173-
mkdir -p $HOST_ROOT/etc/cni/net.d
174-
export HOST_ROOT
175-
/home/weave/weave --local setup-cni
176-
177128
# Attempt to run the reclaim process, but don't halt the script if it fails
178129
/home/weave/kube-utils -reclaim -node-name="$HOSTNAME" -peer-name="$PEERNAME" -log-level=debug || true
179130

@@ -190,7 +141,6 @@ post_start_actions &
190141

191142
/home/weave/weaver $EXTRA_ARGS --port=6783 $(router_bridge_opts) \
192143
--name="$PEERNAME" \
193-
--host-root=$HOST_ROOT \
194144
--http-addr=$HTTP_ADDR $STATUS_OPTS --docker-api='' --no-dns \
195145
--db-prefix="$DB_PREFIX" \
196146
--ipalloc-range=$IPALLOC_RANGE $NICKNAME_ARG \

‎prog/weave-kube/weave-daemonset-k8s-1.11.yaml

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -118,11 +118,34 @@ items:
118118
labels:
119119
name: weave-net
120120
spec:
121+
initContainers:
122+
- name: weave-init
123+
image: 'weaveworks/weave-kube:latest'
124+
imagePullPolicy: Always
125+
command:
126+
- /home/weave/init.sh
127+
env:
128+
securityContext:
129+
privileged: true
130+
volumeMounts:
131+
- name: cni-bin
132+
mountPath: /host/opt
133+
- name: cni-bin2
134+
mountPath: /host/home
135+
- name: cni-conf
136+
mountPath: /host/etc
137+
- name: lib-modules
138+
mountPath: /lib/modules
139+
- name: xtables-lock
140+
mountPath: /run/xtables.lock
141+
readOnly: false
121142
containers:
122143
- name: weave
123144
command:
124145
- /home/weave/launch.sh
125146
env:
147+
- name: INIT_CONTAINER
148+
value: "true"
126149
- name: HOSTNAME
127150
valueFrom:
128151
fieldRef:
@@ -143,16 +166,9 @@ items:
143166
volumeMounts:
144167
- name: weavedb
145168
mountPath: /weavedb
146-
- name: cni-bin
147-
mountPath: /host/opt
148-
- name: cni-bin2
149-
mountPath: /host/home
150-
- name: cni-conf
151-
mountPath: /host/etc
152169
- name: dbus
153170
mountPath: /host/var/lib/dbus
154-
- name: lib-modules
155-
mountPath: /lib/modules
171+
readOnly: true
156172
- name: xtables-lock
157173
mountPath: /run/xtables.lock
158174
readOnly: false

0 commit comments

Comments
 (0)