This commit adds the possiblity of passing a comma separated list of network
names to the '-private-net' argument. Only networks with their names specified
are loaded in the pods network stack.
The network documentation has been updated accordingly.
When plugins exit with non-zero code, they now
print a JSON with the error info to stdout. This
will parse this output and report that error.
Partly fixes#953
As discovered in #851 - some of the CNI plugins (for example, veth)
relies on the supplied `CNI_NETNS` as a source of uniqueness for things
like entropy. In theory this is reasonable because network namespace
paths should be unique per-pod. However, in rkt, the stage1 init (which
executes the plugins) was passing a relative path from its cwd, rather
than an absolute path - for example, "netns" rather than
"/var/lib/rkt/pods/<uuid>/netns".
As a consequence of this, every network plugin was executed with the
same value for `CNI_NETNS`. This results in conflicts when e.g. every
veth plugin attempts to create an interface by the same name, since they
do a straightforward hash of `CNI_NETNS` to generate interface names.
This should be considered an interim solution until this is definitively
answered in the upstream CNI specification.
https://github.com/appc/cni/issues/5
rktRoot is misleading as the directory is really the root of a specific
pod. Also add a TODO note that this is currently only ever set to cwd
(i.e. "."), and hence necessitates relative paths.
If no ports are exposed, no corresponding iptables rules get installed.
Unfortunately, on the teardown path, there's no good way to test for
that or issue deletes that succeed if there's nothing to do. Therefore
it's better to just ignore these errors on the cleanup path.
Ports that were defined in app manifest can be
exposed via --port=name:host-port option on cmd line.
For example, given app manifest with ports entry:
{
"name": "http",
"port": 80,
"protocol": "tcp"
}
rkt run --private-net --port=http:8888 myapp.aci
will forward traffic from host's tcp port 8888 to
container's port 80.
Fixes#624
Since the spec requires AC_METADATA_URL env var,
well known IP is no longer needed. This removes
the iptables manipulation. Instead the IP address of the
host is passed in the AC_METADATA_URL. This host IP
is the address of the host end of the default veth.
This patch renames DirLock to FileLock (where a file can be a regular file or a
directory), adds a new LockType type to specify if the lock must be on a
directory or on a regular file and checks if the file is valid for the
requested type.
macvlan uses the specified host's interface to send the
packets. However macvlan will have its own MAC address
(randomly generated by the kernel) making it look like
yet another interface on the link.
Fixes#478
Before this patch, when withNetNS() returns with an error, the current
net namespace is undefined. In order to make the API more readable,
withNetNS() should always at least attempt to return in a defined
namespace used before being called, even in case of errors.
In practice, the only caller of withNetNS will handle the error case
correctly by calling Teardown() so there should be no functional changes
with this patch.
The user might modify or delete the net config
files while the container is running. This will
mess up the plugins on the teardown path. Copying
them into a the container directory and using them
from there should guard against that. It also lays
the foundation for GC to process unremoved files.
Take two at getting the spec vendored into Rocket with Godep.
Since actool is used during the construction of the stage1.aci, it
really needs to be vendored too to prevent any unexpected divergence
between whatever version the user happens to have in their PATH. Thus,
we introduce a silly dummy package (stage1/dummy.go) to coerce Godep
into vendoring actool. This also requires a slight rearrangement of the
appc repo, moving some functionality from actool itself into the aci
package.
- Convert ipamanager into IPAM plugin (static) that uses env
variables instead of cmd line args
- Make bridge and veth plugins call out to IPAM plugin
- Refacor code around the new IPAM plugins
- Move metadatasvc into rkt as a subcommand
- Add option to spawn metadatasvc from rkt run
- Register container with metadatasvc
- Removes anti-spoofing logic -- this belongs in the network plugin
Fixes#33
Simplifying the plugin interface. No more HTTP interface and plugin
configs. Plugin type maps to executable name in stage1 rootfs or
on host in a well known dir. Env vars are used for parameter passing
to the plugin. Also, default net conf is kept in stage1 rootfs to make
private networking work "out of the box".
The scheme of having a host veth not have an IP
and not be plugged into bridge does not work in
practice. This creates a true point-to-point link
between the container and the host.
This also sorts nets on filename during load so routes
get installed in well defined order. Additionally, it
no longer hard codes default net and assumes something
like 99-network.conf present to define default network.
Eugene Yakubovich