Weave v1.1.0

Highlights

• weave launch now launches all weave components, simplifying
  startup.
• weave status has been completely revamped, with a much improved
  presentation of the information, and the option to select and output
  data in JSON.
• weaveDNS has been rewritten and embedded in the router. The new
  implementation simplifies configuration, improves performance, and
  provides fault resilience for services.
• the weave Docker API proxy now provides an even more seamless user
  experience, and enables easier integration of weave with other
  systems such as kubernetes.
• many usability improvements
• a few minor bug fixes, including a couple of security
  vulnerabilities

More details below and in the change log.

Installation & Upgrading

Follow the installation instructions to install this latest release of weave.

If upgrading from weave 1.0.x, note that a cluster can be upgraded incrementally, with some caveats:

• Any installation using weaveDNS will experience a rolling partition
  of name resolution functionality, i.e. containers only see names
  belonging to containers on weave peers with the same version.

• weave launch now launches all weave components, including
  weaveDNS and the proxy.
  For weaveDNS, if the existing installation was

  • launching weaveDNS without any options, then no action is
    required, since the weave launch-dns and weave stop-dns
    commands still exist but are no-ops,
  • launching weaveDNS with options, then these need to be moved to
    the weave launch invocation,
  • not launching weaveDNS, then you may want to disable it with the
    --no-dns option to weave launch, though generally this should
    not be necessary.

  For the proxy, if the existing installation was

  • launching the proxy without any options, then remove the weave launch-proxy invocation and instead just invoke weave launch
  • launching the proxy with options, then you need to launch the router and proxy separately, supplying the proxy options to the latter, i.e. weave launch-router && weave launch-proxy <options>,
  • not launching the proxy, then you may want to only launch the router (and embedded weaveDNS) with weave launch-router, though typically running weave launch instead is fine, since launching the proxy is harmless.

• The default IP address allocation range has changed from
  10.128.0.0/10 to 10.32.0.0/12. If you are using weave's IP
  address allocator, and are not explicitly specifying a range (with
  -iprange), then you need to force weave
  to use the old range by specifying --ipalloc-range=10.128.0.0/10.

• weave proxy-env|proxy-config are deprecated in favour of weave env|config. The former still work but will display a deprecation
  warning when invoked, so you should update any scripts to use the
  new commands.

• The proxy now listens on a unix domain socket instead of TCP/IP if that is how the launching environment connects to the Docker daemon. This is reflected in weave env|config, so any local code/scripts using those to configure their connection to the proxy should be unaffected. However, if you have code/scripts that have the proxy's TCP/IP endpoint hard-coded, then you may need to force the proxy to listen on the TCP/IP, as it did previously, by launching it with weave launch-proxy -H tcp://0.0.0.0:12375. Note that this potentially opens a security vulnerability, which is why it is no longer the default behaviour. Consider a) switching to unix domain sockets, if you are connecting to the proxy locally, b) restricting the network interfaces/IP addresses by supplying something other than 0.0.0.0, or c) switching to TLS.

• weaveDNS has far fewer options than previously. The removed options do not make sense in the new implementation and are unlikely to have been used in many installations, but if they were, simply removing them should be safe in most setups.

• A number of options have been renamed. The old names still work but
  you should update any scripts to use the new ones.

Changes

Command Line Interface

• make weave launch launch the router, weaveDNS and the proxy. As a
  result weave startup is simpler than
  ever. In
  situations where special configuration of the proxy is required, the
  router and proxy can be launched separately with weave launch-router and weave launch-proxy. #382/#962/#1009/#1011/#1012, #1043/#1072
• completely revamp weave status.
  The main command now shows a much more concise and readable summary,
  which, for example, makes it easier to spot connectivity
  issues. Sub-commands provide additional information, which is better
  presented and more informative than was previously the case. And
  weave report produces a status report in JSON format, with the
  ability to select specific pieces of information with a
  template. #1025/#1141/#1027/#908/#1248, #1315, #1328/#1335, #1185/#1283
• improve consistency in command line option naming. Long options
  start with two hyphens, the --<option>= notation is supported, and
  multi-word options are hyphenated. Also, all DNS options now start
  with --dns-. All old option names have been retained for backward
  compatibility; their usage results in a deprecation warning in the
  logs. #602/#1084, #1087/#1096
• log a more helpful error when an invalid flag is specified in weave launch. #1321/#1324
• output weave usage message on stderr instead stdout, thus preventing
  odd behaviour for the likes of eval $(weave env) when the command
  is mistyped. #1082/#1092
• add --init-peer-count to usage output, from which it was
  missing. #1041/#1045.
• make weave --help|help work even when we cannot communicate with
  Docker. #1322/#1325
• reduce start-up time of weave launch. #992/#993
• introduce --log-level option for better control over log
  levels. #329/#1057
• improve Docker version compatibility checking, preventing misleading
  error messages. #576/#1297/#1298/#1326
• improve download times by re-arranging the layers of the weavexec
  image. #1170

Docker API proxy

• enable listening on a unix domain socket, and do so automatically if
  the launching environment connects to the Docker daemon that way. This
  simplifies configuration and also prevents weakening of Docker access security. #1003/#1026, #1055/#1099
• rename --no-default-ipam option to --no-default-ipalloc. The
  former still works but will log a deprecation warning. #1040/#1048
• remove -D option since it wasn't doing anything useful. #972/#978
• replace weave proxy-env|proxy-config with weave env|config. The former still work but will display a deprecation
  warning when invoked. #1014/#1080/#1081
• introduce weave env --restore,
  which restores the environment modified with weave env. This would
  typically be invoked just prior to weave stop|reset. #1288/#1327
• introduce rewriting of /etc/hosts so that hostname -i returns the weave IP
  instead of Docker IP. hostname -i, and its equivalent system call,
  is invoked by some clustered applications like cassandra and consul;
  this change gets them to operate over the weave
  network by default. The feature can be disabled with the
  --no-rewrite-hosts proxy
  option. #68/#1079, #1252/#1265, #1373/#1375
• add --rewrite-inspect
  flag to
  make docker inspect return the weave network settings (such as the
  container's weave IP address) instead of the Docker settings. This
  is useful for integration of weave with systems such as kubernetes
  that depend on the docker inspect output. #117/#212/#1199/#1222/#1376, #1390/#1391
• attach containers to the weave network by default unless they were started with
  --net=host or --net=container:.... In particular, containers
  started with --net=none now get attached. #1302/#1303
• permit (the equivalent of) --net=container:(another container with weave networking) to be specified at container start
  time. Previously this would hang. Note that specifying a network
  mode that way is a backward compatibility feature of the Docker
  Remote API; normally the mode is set during container creation. So
  this did not affect the Docker CLI and most other systems, but did
  cause problems when integrating weave with Kubernetes. #1258/#1314
• handle chunked responses correctly. Failure to do so was causing
  errors when some Docker API clients, though not the Docker CLI, were
  pointed at the proxy. #1103/#1110/#1112, #1257/#1259
• do not disable restart policies, or stomp on the --volume-driver
  option, of containers started via the proxy. #1209/#1314, #1378
• eliminate a very rare race condition that could cause container
  start to hang. #1300/#1314
• improve logging of errors and warnings. #1056/#1067, #1310

Router

• prevent repeated connection attempts from peers to themselves, which
  could result in a lot of log noise and some performance
  degradation. #1305/#1318
• weave attach|detach
  and weave expose|hide
  now output the IP addresses involved. #954/#968
• eliminate a DoS vector which could allow an attacker to trigger an
  out-of-memory crash by injecting certain mal-formed weave protocol
  packets. This is now no longer possible on encrypted weave networks
  without knowledge of the password. #912/#1098
• prevent exposure of potentially sensitive information to an attacker
  during the connection establishment on an encrypted weave
  network. Note that no sensitive information is exposed by existing
  versions of the weave protocol, so this is merely guarding against
  potential future vulnerability. #1029/#1098
• seed the random number generator properly. Lack of that could in
  some rare circumstances cause IP address allocation to take a long
  time. #1004/#1068
• replace gob with length-prefix encoding in the outermost protocol
  framing. This improves performance of the codec slightly. #1189

Naming and Discovery (weaveDNS)

• replace mDNS with gossip and embed weaveDNS in the router. This
  simplifies configuration since weaveDNS now has far fewer options and no longer needs to be
  launched separately and require an IP address/subnet. It also makes
  name resolution much more efficient and accurate (the
  addition/removal of entries is now visible near
  instantaneously). #826/#833/#840/#841/#842/#843/#741/#944/#1065, #1151/#1155, #1168/#1173, #1156/#1176, #1180, #1193, #1177/#1195, #1181/#1183, #1158/#1190/#1197, #1215/#1225, #1218, #1203/#1224, #1275/#1277, #1281/#1282, #1306/#1307, #1332/#1334/#1344/#1345/#1348, #1347/#1354, #1362/#1363, #1357/#1358
• name resolution now returns all matching
  records,
  in random order, instead of just a single randomly selected
  record. This provides basic fault resilience, allowing applications
  to iterate over the returned answers until they find an operational
  server. #338, #583, #733, #1245/#1256
• weave status dns now lists all DNS records, system-wide, not
  just the ones for local containers. #645
• resolve unqualified names in the weaveDNS domain, so on systems with
  broken DNS resolvers, such as those based on musl/busybox/alpine,
  ping foo now works (previously only ping foo.weave.local
  did). #987/#1050/#1133/#1065
• introduce fine-grained control over the automatic derivation of
  container hostnames from container
  names. This
  is especially useful in scenarios where the container name in turn
  is the result of some derivation, as for example happens in Amazon
  ECS and Kubernetes. #1018/#1126, #1381/#1384
• introduce weave dns-lookup
  for resolving names in weaveDNS from the host. This is useful for
  scripting application deployments and, in conjunction with weave expose, for accessing containers from the host. #1028/#1135
• permit invocation of weave dns-add|dns-remove
  without any IP address(es), which is useful for adding/removing
  extra names for a container. #1369/#1377/#1379
• permit weaveDNS to appear in the host's /etc/resolv.conf;
  previously this could result in query cycles and
  crashes. #1343/#1355
• warn when firewall rules - in particular those inserted by
  firewalld - will interfere with name resolution. #1266/#1349
• prevent potential message ID clashes when performing concurrent
  recursive queries, which could result in the answers to clients
  getting mixed up. #1113/#1142

IP Address Allocator

• The default IP address allocation range has been changed from
  10.128.0.0/10 to 10.32.0.0/12 to avoid clashes with subnets used
  by some cloud platforms like Digital Ocean and GCE. #1036/#1070
• The -iprange and -ipsubnet options have been renamed to
  --ipalloc-range and --ipalloc-default-subnet, to make their
  purpose clearer. The old names have been retained for backward
  compatibility; their usage results in a deprecation warning in the
  logs. #1035
• prevent weave launch from failing when weave expose had
  previously been run with automatic IP address
  allocation. #1076/#1249/#1090, #1320
• prevent delays of up to 30 seconds when first allocating an IP
  address in a partially connected weave network with intermediate
  peers that have IP allocation disabled. #1118/#1149
• cope with more situations of restarting weave when there are running
  containers with automatically allocated IP addresses. In particular
  stopping all peers and then restarting them in a different order now
  works. #1150/#1159, #1243/#1268
• permit manual allocation in the IP allocation
  range. This
  results in a warning if the chosen address has already been
  allocated. #687/#598/#1200, #1030/#1228/#1380, #1380
• improve a number of warning and error
  messages. #437/#480/#1053, #1034, #1128/#1174, #1317

Build & Test

• replace homegrown go testing library with
  testify. #358/#955
• produce coverage reports from integration tests, combine them with
  unit test coverage, and do all this automatically, in
  CircleCI. #673/#1105, #1115, #1220/#1221, #1154/#1230, #1146/#1198
• significantly reduce test execution time and resource
  usage. #1120, #1169/#1236, #1239/#1242/#1263, #1234/#1235, #1125/#1138/#1144, #1214, #1123, #1227, #1370
• add a number of integration tests, expanding test
  coverage. #1117, #1121, #1247, #1166
• add race detector to unit tests. #998
• pre-fetch Docker images required for testing, for earlier and more
  obvious reporting of fetch failures, and more consistent test
  execution times. #989
• fetch go test dependencies, preventing spurious test compilation
  failures. #1015
• fix some breakages in integration tests when run on OSX. #1069
• fetch go packages from github instead of google code, since the
  latter is going away. #1059/#1060
• increase flexibility of release script, supporting non-mainline
  releases. #880/#909/#1372, #1383/#1387
• miscellaneous improvements: #994, #999, #1240, #1250, #1246, #1075, #1331

Improvements "under the hood"

• replace homegrown go logging library with
  logrus, and direct all log
  messages to stderr. #664/#1039/#1044
• make container aliveness check part of the IPAM/DNS APIs rather than
  applying a heuristic. #971/#1073
• output json status based on 'Accept' header instead of requiring
  separate endpoint. #1063/#1077
• label weave infrastructure containers with
  works.weave.role=system. #1290
• apply some refactoring for simplification, extraction of common code
  and better readability. #997, #1016, #1095,#1289, #1101, #1219, #1254