Skip to content
This repository has been archived by the owner on Jun 20, 2024. It is now read-only.

show IP addresses in attach/expose/detach/hide #968

Merged
merged 3 commits into from
Jun 22, 2015
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 25 additions & 18 deletions site/features.md
Original file line number Diff line number Diff line change
Expand Up @@ -175,33 +175,44 @@ illustrate, we can achieve the same effect as the first example with

host1$ C=$(docker run -e WEAVE_CIDR=none -dti ubuntu)
host1$ weave attach $C
10.2.1.3

(Note that since we modified `DOCKER_HOST` to point to the proxy
earlier, we have to pass `-e WEAVE_CIDR=none` to start a container
that _doesn't_ get automatically attached to the weave network for the
purposes of this example.)

The output shows the IP address that got allocated, in this case on
the default subnet.

There is a matching `weave detach` command:

host1$ weave detach $C
10.2.1.3

You can detach a container from one application network and attach it
to another:

host1$ weave detach net:default $C
10.2.1.3
host1$ weave attach net:10.2.2.0/24 $C
10.2.2.3

or attach a container to multiple application networks, effectively
sharing it between applications:

host1$ weave attach net:default
10.2.1.3
host1$ weave attach net:10.2.2.0/24
10.2.2.3

Finally, multiple addresses can be attached or detached with a single
invocation:

host1$ weave attach net:default net:10.2.2.0/24 net:10.2.3.0/24 $C
10.2.1.3 10.2.2.3 10.2.3.1
host1$ weave detach net:default net:10.2.2.0/24 net:10.2.3.0/24 $C
10.2.1.3 10.2.2.3 10.2.3.1

### <a name="security"></a>Security

Expand Down Expand Up @@ -237,37 +248,36 @@ Let's say that in our example we want `$HOST2` to have access to the
application containers. On `$HOST2` we run

host2$ weave expose
10.2.1.132

(There is a corresponding 'hide' command to revert this step.)
This grants the host access to all application containers in the
default subnet. An IP address is allocated for that purpose, which is
returned. So now

Now, after finding allocated IPs via `weave ps`
host2$ ping 10.2.1.132

host2$ weave ps weave:expose
weave:expose 02:80:5c:02:f1:b2 10.2.1.132/24
will work, and, more interestingly, we can ping our `a1` application
container, which is residing on `$HOST1`, after finding its IP
address:

host1$ weave ps a1
a1 1e:88:d7:5b:77:68 10.2.1.2/24

this

host2$ ping 10.2.1.132

will work. And, more interestingly,

host2$ ping 10.2.1.2

will work too, which is talking to a container that resides on `$HOST1`.

Multiple subnet addresses can be exposed or hidden with a single
invocation:

host2$ weave expose net:default net:10.2.2.0/24
10.2.1.132 10.2.2.130
host2$ weave hide net:default net:10.2.2.0/24
10.2.1.132 10.2.2.130

Finally, exposed addresses can be added to weaveDNS by supplying a
fully-qualified domain name:

host2$ weave expose -h exposed.weave.local
10.2.1.132

### <a name="service-export"></a>Service export

Expand All @@ -283,6 +293,7 @@ First we need to expose the application network to `$HOST2`, as
explained [above](#host-network-integration), i.e.

host2$ weave expose
10.2.1.132

Then we add a NAT rule to route from the outside world to the
destination container service.
Expand Down Expand Up @@ -326,13 +337,11 @@ explained [above](#host-network-integration), this time on `$HOST1`,
i.e.

host1$ weave expose -h host1.weave.local
10.2.1.3

Then we add a NAT rule to route from the above IP to the destination
service.

host1$ weave ps weave:expose
weave:expose 66:46:f5:ac:7b:c9 10.2.1.3/24

host1$ iptables -t nat -A PREROUTING -p tcp -d 10.2.1.3 --dport 3322 \
-j DNAT --to-destination $HOST3:2211

Expand Down Expand Up @@ -376,14 +385,12 @@ weave via `$HOST1`. We can export it on `$HOST2` by first exposing the
application network with

host2$ weave expose
10.2.1.3

and then adding a NAT rule which routes traffic from the `$HOST2`
network (i.e. anything which can connect to `$HOST2`) to the service
endpoint in the weave network

host1$ weave ps weave:expose
weave:expose 66:46:f5:ac:7b:c9 10.2.1.3/24

host2$ iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 4433 \
-j DNAT --to-destination 10.2.1.3:3322

Expand Down
35 changes: 25 additions & 10 deletions test/500_weave_multi_cidr_test.sh
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,13 @@ assert_bridge_cidrs() {
assert "echo $BRIDGE_CIDRS" "$CIDRS"
}

assert_equal() {
result=$1
shift
expected="$@"
assert "echo $result" "$expected"
}

start_suite "Weave run/start/attach/detach/expose/hide with multiple cidr arguments"

# also check that these commands understand all address flavours
Expand All @@ -82,33 +89,41 @@ weave_on $HOST1 start 10.2.1.1/24 ip:10.2.2.1/24 net:10.2.3.
assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24 10.2.2.1/24 10.2.3.1/24

# Remove two of them
weave_on $HOST1 detach ip:10.2.2.1/24 net:10.2.3.0/24 $CID
IPS=$(weave_on $HOST1 detach ip:10.2.2.1/24 net:10.2.3.0/24 $CID)
assert_equal "$IPS" 10.2.2.1 10.2.3.1
assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24
# ...and the remaining one
weave_on $HOST1 detach 10.2.1.1/24 $CID
IPS=$(weave_on $HOST1 detach 10.2.1.1/24 $CID)
assert_equal "$IPS" 10.2.1.1
assert_ips_and_dns $HOST1 $CID $NAME.

# Put one back
weave_on $HOST1 attach 10.2.1.1/24 $CID
IPS=$(weave_on $HOST1 attach 10.2.1.1/24 $CID)
assert_equal "$IPS" 10.2.1.1
assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24
# ...and the remaining two
weave_on $HOST1 attach ip:10.2.2.1/24 net:10.2.3.0/24 $CID
IPS=$(weave_on $HOST1 attach ip:10.2.2.1/24 net:10.2.3.0/24 $CID)
assert_equal "$IPS" 10.2.2.1 10.2.3.1
assert_ips_and_dns $HOST1 $CID $NAME. 10.2.1.1/24 10.2.2.1/24 10.2.3.1/24

# Expose three cidrs
weave_on $HOST1 expose 10.2.1.2/24 ip:10.2.2.2/24 net:10.2.3.0/24
IPS=$(weave_on $HOST1 expose 10.2.1.2/24 ip:10.2.2.2/24 net:10.2.3.0/24)
assert_equal "$IPS" 10.2.1.2 10.2.2.2 10.2.3.2
assert_bridge_cidrs $HOST1 weave 10.2.1.2/24 10.2.2.2/24 10.2.3.2/24

# Hide two of them
weave_on $HOST1 hide ip:10.2.2.2/24 net:10.2.3.0/24
IPS=$(weave_on $HOST1 hide ip:10.2.2.2/24 net:10.2.3.0/24)
assert_equal "$IPS" 10.2.2.2 10.2.3.2
assert_bridge_cidrs $HOST1 weave 10.2.1.2/24
# ...and the remaining one
weave_on $HOST1 hide 10.2.1.2/24
IPS=$(weave_on $HOST1 hide 10.2.1.2/24)
assert_equal "$IPS" 10.2.1.2
assert_bridge_cidrs $HOST1 weave

# Now detach and run another container to check we have released IPs in IPAM
weave_on $HOST1 detach $CID
CID2=$(start_container $HOST1 net:10.2.3.0/24)
assert_container_cidrs $HOST1 $CID2 10.2.3.1/24
IPS=$(weave_on $HOST1 detach $CID)
assert_equal "$IPS" 10.2.3.1
CID2=$(start_container $HOST1 net:10.2.3.0/24)
assert_container_cidrs $HOST1 $CID2 10.2.3.1/24

end_suite
14 changes: 13 additions & 1 deletion weave
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ if [ "$1" = "run" ] ; then
collect_cidr_args "$@"
shift $CIDR_ARG_COUNT
CONTAINER=$(docker $DOCKER_CLIENT_ARGS run $DNS_ARGS -d "$@")
exec_remote attach $CIDR_ARGS --or-die $CONTAINER
exec_remote attach $CIDR_ARGS --or-die $CONTAINER >/dev/null
echo $CONTAINER
exit 0
elif [ "$1" != "--local" ] ; then
Expand Down Expand Up @@ -850,6 +850,14 @@ ipam_cidrs_or_die() {
fi
}

show_addrs() {
addrs=
for cidr in "$@" ; do
addrs="$addrs ${cidr%/*}"
done
echo $addrs
}

######################################################################
# weave proxy helpers
######################################################################
Expand Down Expand Up @@ -1170,6 +1178,7 @@ case "$COMMAND" in
ipam_cidrs$ATTACH_TYPE $CONTAINER $CIDR_ARGS
with_container_netns$ATTACH_TYPE $CONTAINER attach $ALL_CIDRS >/dev/null
when_dns_running with_container_fqdn $CONTAINER put_dns_fqdn $ALL_CIDRS
show_addrs $ALL_CIDRS
;;
detach)
collect_cidr_args "$@"
Expand All @@ -1182,6 +1191,7 @@ case "$COMMAND" in
for CIDR in $IPAM_CIDRS ; do
call_weave DELETE /ip/$CONTAINER/${CIDR%/*}
done
show_addrs $ALL_CIDRS
;;
dns-add)
collect_ip_args "$@"
Expand Down Expand Up @@ -1229,6 +1239,7 @@ case "$COMMAND" in
fi
fi
done
show_addrs $ALL_CIDRS
;;
hide)
collect_cidr_args "$@"
Expand All @@ -1246,6 +1257,7 @@ case "$COMMAND" in
for CIDR in $IPAM_CIDRS ; do
call_weave DELETE /ip/weave:expose/${CIDR%/*}
done
show_addrs $ALL_CIDRS
;;
stop)
[ $# -eq 0 ] || usage
Expand Down