|
| 1 | +// Module included in the following assemblies: |
| 2 | +// |
| 3 | +// * networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc |
| 4 | + |
| 5 | +:_content-type: PROCEDURE |
| 6 | +[id="nw-ovn-ipsec-north-south-enable_{context}"] |
| 7 | += Enabling IPsec encryption for external IPsec endpoints |
| 8 | + |
| 9 | +// This procedure requests installing Butane to prepare the machine config |
| 10 | + |
| 11 | +As a cluster administrator, you can enable IPsec encryption between the cluster and external IPsec endpoints. Because this procedure uses Butane to create machine configs, you must have the `butane` command installed. |
| 12 | + |
| 13 | +[NOTE] |
| 14 | +==== |
| 15 | +After you apply the machine config, the Machine Config Operator reboots affected nodes in your cluster to rollout the new machine config. |
| 16 | +==== |
| 17 | + |
| 18 | +.Prerequisites |
| 19 | + |
| 20 | +* Install the {oc-first}. |
| 21 | +* You are logged in to the cluster as a user with `cluster-admin` privileges. |
| 22 | +* You have reduced the size of your cluster MTU by `46` bytes to allow for the overhead of the IPsec ESP header. |
| 23 | +* You have installed the `butane` utility. |
| 24 | +* You have an existing PKCS#12 certificate for the IPsec endpoint and a CA cert in PEM format. |
| 25 | +
|
| 26 | +.Procedure |
| 27 | + |
| 28 | +As a cluster administrator, you can enable IPsec support for external IPsec endpoints. |
| 29 | + |
| 30 | +. Create an IPsec configuration file named `ipsec-endpoint-config.conf`. The configuration is consumed in the next step. For more information, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/securing_networks/configuring-a-vpn-with-ipsec_securing-networks#configuring-a-vpn-with-ipsec_securing-networks[Libreswan as an IPsec VPN implementation]. |
| 31 | + |
| 32 | +. Provide the following certificate files to add to the Network Security Services (NSS) database on each host. These files are imported as part of the Butane configuration in subsequent steps. |
| 33 | ++ |
| 34 | +-- |
| 35 | +* `left_server.p12`: The certificate bundle for the IPsec endpoints |
| 36 | +* `ca.pem`: The certificate authority that you signed your certificates with |
| 37 | +-- |
| 38 | + |
| 39 | +. Create a machine config to apply the IPsec configuration to your cluster by using the following two steps: |
| 40 | + |
| 41 | +.. To add the IPsec configuration, create Butane config files for the control plane and worker nodes with the following contents: |
| 42 | ++ |
| 43 | +[source,terminal,subs="attributes+"] |
| 44 | +---- |
| 45 | +$ for role in master worker; do |
| 46 | + cat >> "99-ipsec-$\{role}-endpoint-config.bu" <<-EOF |
| 47 | + variant: openshift |
| 48 | + version: {product-version}.0 |
| 49 | + metadata: |
| 50 | + name: 99-$\{role}-import-certs-enable-svc-os-ext |
| 51 | + labels: |
| 52 | + machineconfiguration.openshift.io/role: $role |
| 53 | + openshift: |
| 54 | + extensions: |
| 55 | + - ipsec |
| 56 | + systemd: |
| 57 | + units: |
| 58 | + - name: ipsec-import.service |
| 59 | + enabled: true |
| 60 | + contents: | |
| 61 | + [Unit] |
| 62 | + Description=Import external certs into ipsec NSS |
| 63 | + Before=ipsec.service |
| 64 | + |
| 65 | + [Service] |
| 66 | + Type=oneshot |
| 67 | + ExecStart=/usr/local/bin/ipsec-addcert.sh |
| 68 | + RemainAfterExit=false |
| 69 | + StandardOutput=journal |
| 70 | +
|
| 71 | + [Install] |
| 72 | + WantedBy=multi-user.target |
| 73 | + - name: ipsecenabler.service |
| 74 | + enabled: true |
| 75 | + contents: | |
| 76 | + [Service] |
| 77 | + Type=oneshot |
| 78 | + ExecStart=systemctl enable --now ipsec.service |
| 79 | +
|
| 80 | + [Install] |
| 81 | + WantedBy=multi-user.target |
| 82 | + storage: |
| 83 | + files: |
| 84 | + - path: /etc/pki/certs/ca.pem |
| 85 | + mode: 0400 |
| 86 | + overwrite: true |
| 87 | + contents: |
| 88 | + local: ca.pem |
| 89 | + - path: /etc/pki/certs/left_server.p12 |
| 90 | + mode: 0400 |
| 91 | + overwrite: true |
| 92 | + contents: |
| 93 | + local: left_server.p12 |
| 94 | + - path: /usr/local/bin/ipsec-addcert.sh |
| 95 | + mode: 0740 |
| 96 | + overwrite: true |
| 97 | + contents: |
| 98 | + inline: | |
| 99 | + #!/bin/bash -e |
| 100 | + echo "importing cert to NSS" |
| 101 | + certutil -A -n "CA" -t "CT,C,C" -d /var/lib/ipsec/nss/ -i /etc/pki/certs/ca.pem |
| 102 | + pk12util -W "" -i /etc/pki/certs/left_server.p12 -d /var/lib/ipsec/nss/ |
| 103 | + certutil -M -n "left_server" -t "u,u,u" -d /var/lib/ipsec/nss/ |
| 104 | +EOF |
| 105 | +done |
| 106 | +---- |
| 107 | + |
| 108 | +.. To transform the Butane files that you created in the previous step into machine configs, enter the following command: |
| 109 | ++ |
| 110 | +[source,terminal] |
| 111 | +---- |
| 112 | +$ for role in master worker; do |
| 113 | + butane 99-ipsec-${role}-endpoint-config.bu -o ./99-ipsec-$role-endpoint-config.yaml |
| 114 | +done |
| 115 | +---- |
| 116 | + |
| 117 | +. To apply the machine configs to your cluster, enter the following command: |
| 118 | ++ |
| 119 | +[source,terminal] |
| 120 | +---- |
| 121 | +$ for role in master worker; do |
| 122 | + oc apply -f 99-ipsec-${role}-endpoint-config.yaml |
| 123 | +done |
| 124 | +---- |
| 125 | ++ |
| 126 | +[IMPORTANT] |
| 127 | +==== |
| 128 | +As the Machine Config Operator (MCO) updates machines in each machine config pool, it reboots each node one by one. You must wait until all the nodes are updated before external IPsec connectivity is available. |
| 129 | +==== |
| 130 | + |
| 131 | +. Check the machine config pool status by entering the following command: |
| 132 | ++ |
| 133 | +[source,terminal] |
| 134 | +---- |
| 135 | +$ oc get mcp |
| 136 | +---- |
| 137 | ++ |
| 138 | +A successfully updated node has the following status: `UPDATED=true`, `UPDATING=false`, `DEGRADED=false`. |
| 139 | ++ |
| 140 | +[NOTE] |
| 141 | +==== |
| 142 | +By default, the MCO updates one machine per pool at a time, causing the total time the migration takes to increase with the size of the cluster. |
| 143 | +==== |
0 commit comments