Skip to content

Commit a0a42de

Browse files
jab-rhjab-rh
authored
Merge pull request #38819 from jboxman-rh/OSDOCS-2098
OSDOCS-2098: IPsec can be enabled at runtime
2 parents ebae29c + b823ee7 commit a0a42de

File tree

12 files changed

+159
-25
lines changed

12 files changed

+159
-25
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1134,8 +1134,8 @@ Topics:
11341134
File: rollback-to-openshift-sdn
11351135
- Name: Converting to IPv4/IPv6 dual stack networking
11361136
File: converting-to-dual-stack
1137-
- Name: IPsec encryption configuration
1138-
File: about-ipsec-ovn
1137+
- Name: Configuring IPsec encryption
1138+
File: configuring-ipsec-ovn
11391139
- Name: Configuring an egress firewall for a project
11401140
File: configuring-egress-firewall-ovn
11411141
- Name: Viewing an egress firewall for a project

‎modules/nw-operator-cr.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -270,7 +270,7 @@ ifndef::ibm-cloud[]
270270
|`object`
271271
|
272272
ifndef::operator[]
273-
Specify an empty object to enable IPsec encryption. This value cannot be changed after cluster installation.
273+
Specify an empty object to enable IPsec encryption.
274274
endif::operator[]
275275
ifdef::operator[]
276276
If the field is present, IPsec is enabled for the cluster.

‎modules/nw-ovn-ipsec-certificates.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
//
33
// * networking/ovn_kubernetes_network_provider/about-ipsec-ovn.adoc
44

5+
:_content-type: CONCEPT
56
[id="nw-ovn-ipsec-certificates_{context}"]
67
= Security certificate generation and rotation
78

‎modules/nw-ovn-ipsec-disable.adoc‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-ovn-ipsec-disable_{context}"]
7+
= Disabling IPsec encryption
8+
9+
As a cluster administrator, you can disable IPsec encryption only if you enabled IPsec after cluster installation.
10+
11+
[NOTE]
12+
====
13+
If you enabled IPsec when you installed your cluster, you cannot disable IPsec with this procedure.
14+
====
15+
16+
.Prerequisites
17+
18+
* Install the OpenShift CLI (`oc`).
19+
* Log in to the cluster with a user with `cluster-admin` privileges.
20+
21+
.Procedure
22+
23+
. To disable IPsec encryption, enter the following command:
24+
+
25+
[source,terminal]
26+
----
27+
$ oc patch networks.operator.openshift.io/cluster --type=json \
28+
-p='[{"op":"remove", "path":"/spec/defaultNetwork/ovnKubernetesConfig/ipsecConfig"}]'
29+
----
30+
31+
. Optional: You can increase the size of your cluster MTU by `46` bytes because there is no longer any overhead from the IPsec ESP header in IP packets.

‎modules/nw-ovn-ipsec-enable.adoc‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-ovn-ipsec-enable_{context}"]
7+
= Enabling IPsec encryption
8+
9+
As a cluster administrator, you can enable IPsec encryption after cluster installation.
10+
11+
.Prerequisites
12+
13+
* Install the OpenShift CLI (`oc`).
14+
* Log in to the cluster with a user with `cluster-admin` privileges.
15+
* You have reduced the size of your cluster MTU by `46` bytes to allow for the overhead of the IPsec ESP header.
16+
17+
.Procedure
18+
19+
* To enable IPsec encryption, enter the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc patch networks.operator.openshift.io/cluster --type=json \
24+
-p='[{"op":"remove", "path":"/spec/defaultNetwork/ovnKubernetesConfig/ipsecConfig"}]'
25+
----

‎modules/nw-ovn-ipsec-encryption.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
//
33
// * networking/ovn_kubernetes_network_provider/about-ipsec-ovn.adoc
44

5+
:_content-type: CONCEPT
56
[id="nw-ovn-ipsec-encryption_{context}"]
67
= Encryption protocol and tunnel mode for IPsec
78

‎modules/nw-ovn-ipsec-traffic.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
//
33
// * networking/ovn_kubernetes_network_provider/about-ipsec-ovn.adoc
44

5+
:_content-type: CONCEPT
56
[id="nw-ovn-ipsec-traffic_{context}"]
67
= Types of network traffic flows encrypted by IPsec
78

‎modules/nw-ovn-ipsec-verification.adoc‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/about-ipsec-ovn.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-ovn-ipsec-verification_{context}"]
7+
= Verifying that IPsec is enabled
8+
9+
As a cluster administrator, you can verify that IPsec is enabled.
10+
11+
.Verification
12+
13+
. To find the names of the OVN-Kubernetes control plane pods, enter the following command:
14+
+
15+
[source,terminal]
16+
----
17+
$ oc get pods -n openshift-ovn-kubernetes | grep ovnkube-master
18+
----
19+
+
20+
.Example output
21+
[source,terminal]
22+
----
23+
ovnkube-master-4496s 1/1 Running 0 6h39m
24+
ovnkube-master-d6cht 1/1 Running 0 6h42m
25+
ovnkube-master-skblc 1/1 Running 0 6h51m
26+
ovnkube-master-vf8rf 1/1 Running 0 6h51m
27+
ovnkube-master-w7hjr 1/1 Running 0 6h51m
28+
ovnkube-master-zsk7x 1/1 Running 0 6h42m
29+
----
30+
31+
. Verify that IPsec is enabled on your cluster:
32+
+
33+
[source,terminal]
34+
----
35+
$ oc -n openshift-ovn-kubernetes -c nbdb rsh ovnkube-master-<XXXXX> \
36+
ovn-nbctl --no-leader-only get nb_global . ipsec
37+
----
38+
+
39+
--
40+
where:
41+
42+
`<XXXXX>`:: Specifies the random sequence of letters for a pod from the previous step.
43+
--
44+
+
45+
.Example output
46+
[source,text]
47+
----
48+
true
49+
----

‎networking/ovn_kubernetes_network_provider/about-ipsec-ovn.adoc‎

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎networking/ovn_kubernetes_network_provider/about-ovn-kubernetes.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,5 @@ include::modules/nw-ovn-kuberentes-limitations.adoc[leveloffset=+1]
3232
* xref:../../networking/network_policy/about-network-policy.adoc#about-network-policy[About network policy]
3333
* xref:../../networking/network_policy/logging-network-policy.adoc#logging-network-policy[Logging network policy events]
3434
* xref:../../networking/ovn_kubernetes_network_provider/enabling-multicast.adoc#nw-ovn-kubernetes-enabling-multicast[Enabling multicast for a project]
35-
* xref:../../networking/ovn_kubernetes_network_provider/about-ipsec-ovn.adoc#about-ipsec-ovn[IPsec encryption configuration]
35+
* xref:../../networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc#configuring-ipsec-ovn[Configuring IPsec encryption]
3636
* xref:../../rest_api/operator_apis/network-operator-openshift-io-v1.adoc#network-operator-openshift-io-v1[Network [operator.openshift.io/v1\]]

0 commit comments

Comments
 (0)