Skip to content

Commit 5346e44

Browse files
jab-rhjab-rh
committed
OSDOCS-6863: IPsec N/S GA
- https://issues.redhat.com/browse/OSDOCS-6863 - https://issues.redhat.com/browse/OSDOCS-8133
1 parent c2de709 commit 5346e44

14 files changed

+357
-68
lines changed

‎modules/nw-modifying-operator-install-config.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ metadata:
8181
spec:
8282
defaultNetwork:
8383
ovnKubernetesConfig:
84-
ipsecConfig: {}
84+
ipsecConfig:
85+
mode: Full
8586
----
8687
--
8788

‎modules/nw-operator-cr.adoc

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -249,10 +249,10 @@ endif::operator[]
249249
|`object`
250250
|
251251
ifndef::operator[]
252-
Specify an empty object to enable IPsec encryption.
252+
Specify a configuration object for customizing the IPsec configuration.
253253
endif::operator[]
254254
ifdef::operator[]
255-
If the field is present, IPsec is enabled for the cluster.
255+
An object describing the IPsec mode for the cluster.
256256
endif::operator[]
257257

258258
|`policyAuditConfig`
@@ -336,6 +336,31 @@ If you set this field to `true`, you do not receive the performance benefits of
336336

337337
|====
338338

339+
[id="nw-operator-cr-ipsec_{context}"]
340+
.`ipsecConfig` object
341+
[cols=".^2,.^2,.^6a",options="header"]
342+
|====
343+
|Field|Type|Description
344+
345+
|`mode`
346+
|`string`
347+
a|Specifies the behavior of the IPsec implementation. Must be one of the following values:
348+
349+
--
350+
- `Disabled`: IPsec is not enabled on cluster nodes.
351+
- `External`: IPsec is enabled for network traffic with external hosts.
352+
- `Full`: IPsec is enabled for pod traffic and network traffic with external hosts.
353+
--
354+
355+
|====
356+
357+
358+
ifdef::operator[]
359+
[NOTE]
360+
====
361+
You can only change the configuration for your cluster network plugin during cluster installation, except for the `gatewayConfig` field that can be changed at runtime as a postinstallation activity.
362+
====
363+
endif::operator[]
339364

340365
.Example OVN-Kubernetes configuration with IPSec enabled
341366
[source,yaml]
@@ -345,7 +370,8 @@ defaultNetwork:
345370
ovnKubernetesConfig:
346371
mtu: 1400
347372
genevePort: 6081
348-
ipsecConfig: {}
373+
ipsecConfig:
374+
mode: Full
349375
----
350376
[IMPORTANT]
351377
====

‎modules/nw-ovn-ipsec-certificates.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Module included in the following assemblies:
22
//
3-
// * networking/ovn_kubernetes_network_provider/about-ipsec-ovn.adoc
3+
// * networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc
44

55
:_mod-docs-content-type: CONCEPT
66
[id="nw-ovn-ipsec-certificates_{context}"]

‎modules/nw-ovn-ipsec-disable.adoc

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,7 @@
66
[id="nw-ovn-ipsec-disable_{context}"]
77
= Disabling IPsec encryption
88

9-
As a cluster administrator, you can disable IPsec encryption only if you enabled IPsec after cluster installation.
10-
11-
[NOTE]
12-
====
13-
If you enabled IPsec when you installed your cluster, you cannot disable IPsec with this procedure.
14-
====
9+
As a cluster administrator, you can disable IPsec encryption.
1510

1611
.Prerequisites
1712

@@ -24,8 +19,14 @@ If you enabled IPsec when you installed your cluster, you cannot disable IPsec w
2419
+
2520
[source,terminal]
2621
----
27-
$ oc patch networks.operator.openshift.io/cluster --type=json \
28-
-p='[{"op":"remove", "path":"/spec/defaultNetwork/ovnKubernetesConfig/ipsecConfig"}]'
22+
$ oc patch networks.operator.openshift.io cluster --type=merge \
23+
-p '{
24+
"spec":{
25+
"defaultNetwork":{
26+
"ovnKubernetesConfig":{
27+
"ipsecConfig":{
28+
"mode":"Disabled"
29+
}}}}}'
2930
----
3031

3132
. Optional: You can increase the size of your cluster MTU by `46` bytes because there is no longer any overhead from the IPsec ESP header in IP packets.

‎modules/nw-ovn-ipsec-enable.adoc

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,16 @@
44

55
:_mod-docs-content-type: PROCEDURE
66
[id="nw-ovn-ipsec-enable_{context}"]
7-
= Enabling pod-to-pod IPsec encryption
7+
= Enabling IPsec encryption
88

9-
As a cluster administrator, you can enable pod-to-pod IPsec encryption after cluster installation.
9+
As a cluster administrator, you can enable pod-to-pod IPsec encryption and IPsec encryption between the cluster and external IPsec endpoints.
10+
11+
You can configure IPsec in either of the following modes:
12+
13+
- `Full`: Encryption for pod-to-pod and external traffic
14+
- `External`: Encryption for external traffic
15+
16+
If you need to configure encryption for external traffic in addition to pod-to-pod traffic, you must also complete the "Configuring IPsec encryption for external traffic" procedure.
1017

1118
.Prerequisites
1219

@@ -16,10 +23,24 @@ As a cluster administrator, you can enable pod-to-pod IPsec encryption after clu
1623
1724
.Procedure
1825

19-
* To enable IPsec encryption, enter the following command:
26+
. To enable IPsec encryption, enter the following command:
2027
+
2128
[source,terminal]
2229
----
2330
$ oc patch networks.operator.openshift.io cluster --type=merge \
24-
-p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"ipsecConfig":{ }}}}}'
31+
-p '{
32+
"spec":{
33+
"defaultNetwork":{
34+
"ovnKubernetesConfig":{
35+
"ipsecConfig":{
36+
"mode":<mode>
37+
}}}}}'
2538
----
39+
+
40+
where:
41+
+
42+
--
43+
`mode`:: Specify `External` to encrypt only traffic to external hosts or specify `Full` to encrypt pod to pod traffic and optionally traffic to external hosts. By default, IPsec is disabled.
44+
--
45+
46+
. Optional: If you need to encrypt traffic to external hosts, complete the "Configuring IPsec encryption for external traffic" procedure.

‎modules/nw-ovn-ipsec-encryption.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Module included in the following assemblies:
22
//
3-
// * networking/ovn_kubernetes_network_provider/about-ipsec-ovn.adoc
3+
// * networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc
44

55
:_mod-docs-content-type: CONCEPT
66
[id="nw-ovn-ipsec-encryption_{context}"]

‎modules/nw-ovn-ipsec-external.adoc

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="nw-ovn-ipsec-external_{context}"]
7+
= IPsec encryption for external traffic
8+
9+
{product-title} supports IPsec encryption for traffic to external hosts with TLS certificates that you must supply.
10+
11+
[id="supported-platforms_{context}"]
12+
== Supported platforms
13+
14+
This feature is supported on the following platforms:
15+
16+
- Bare metal
17+
- {gcp-first}
18+
- {rh-openstack-first}
19+
- {vmw-full}
20+
21+
[IMPORTANT]
22+
====
23+
If you have {op-system-base-full} worker nodes, these do not support IPsec encryption for external traffic.
24+
====
25+
26+
If your cluster uses hosted control planes for Red Hat {product-title}, configuring IPsec for encrypting traffic to external hosts is not supported.
27+
28+
[id="ipsec-external-limitations_{context}"]
29+
== Limitations
30+
31+
Ensure that the following prohibitions are observed:
32+
33+
* Certificate common names (CN) in the provided certificate bundle must not begin with the `ovs_` prefix, because this naming can conflict with pod-to-pod IPsec CN names in the Network Security Services (NSS) database of each node.

‎modules/nw-ovn-ipsec-north-south-disable.adoc

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-ovn-ipsec-north-south-disable_{context}"]
7+
= Disabling IPsec encryption for an external IPsec endpoint
8+
9+
As a cluster administrator, you can remove an existing IPsec tunnel to an external host.
10+
11+
.Prerequisites
12+
13+
* Install the {oc-first}.
14+
* You are logged in to the cluster as a user with `cluster-admin` privileges.
15+
* You enabled IPsec in either `Full` or `External` mode on your cluster.
16+
17+
.Procedure
18+
19+
. Create a file named `remove-ipsec-tunnel.yaml` with the following YAML:
20+
+
21+
[source,yaml]
22+
----
23+
kind: NodeNetworkConfigurationPolicy
24+
apiVersion: nmstate.io/v1
25+
metadata:
26+
name: <name>
27+
spec:
28+
nodeSelector:
29+
kubernetes.io/hostname: <node_name>
30+
desiredState:
31+
interfaces:
32+
- name: <tunnel_name>
33+
type: ipsec
34+
state: absent
35+
----
36+
+
37+
--
38+
where:
39+
40+
`name`:: Specifies a name for the node network configuration policy.
41+
`node_name`:: Specifies the name of the node where the IPsec tunnel that you want to remove exists.
42+
`tunnel_name`:: Specifies the interface name for the existing IPsec tunnel.
43+
--
44+
45+
. To remove the IPsec tunnel, enter the following command:
46+
+
47+
[source,terminal]
48+
----
49+
$ oc apply -f remove-ipsec-tunnel.yaml
50+
----

0 commit comments

Comments
 (0)