With IPsec enabled, all pod-to-pod network traffic between nodes on the OVN-Kubernetes cluster network is encrypted with IPsec Transport mode.
IPsec is disabled by default. It can be enabled either during or after installing the cluster. For information about cluster installation, see OpenShift Container Platform installation overview. If you need to enable IPsec after cluster installation, you must first resize your cluster MTU to account for the overhead of the IPsec ESP IP header.
The following documentation describes how to enable and disable IPSec after cluster installation.
You have decreased the size of the cluster MTU by 46
bytes to allow for the additional overhead of the IPsec ESP header. For more information on resizing the MTU that your cluster uses, see Changing the MTU for the cluster network.
With IPsec enabled, only the following network traffic flows between pods are encrypted:
Traffic between pods on different nodes on the cluster network
Traffic from a pod on the host network to a pod on the cluster network
The following traffic flows are not encrypted:
Traffic between pods on the same node on the cluster network
Traffic between pods on the host network
Traffic from a pod on the cluster network to a pod on the host network
The encrypted and unencrypted flows are illustrated in the following diagram:
You must configure the network connectivity between machines to allow OpenShift Container Platform cluster components to communicate. Each machine must be able to resolve the hostnames of all other machines in the cluster.
Protocol | Port | Description |
---|---|---|
UDP |
|
IPsec IKE packets |
|
IPsec NAT-T packets |
|
ESP |
N/A |
IPsec Encapsulating Security Payload (ESP) |
The encrypt cipher used is AES-GCM-16-256
. The integrity check value (ICV) is 16
bytes. The key length is 256
bits.
The IPsec mode used is Transport mode, a mode that encrypts end-to-end communication by adding an Encapsulated Security Payload (ESP) header to the IP header of the original packet and encrypts the packet data. OpenShift Container Platform does not currently use or support IPsec Tunnel mode for pod-to-pod communication.
The Cluster Network Operator (CNO) generates a self-signed X.509 certificate authority (CA) that is used by IPsec for encryption. Certificate signing requests (CSRs) from each node are automatically fulfilled by the CNO.
The CA is valid for 10 years. The individual node certificates are valid for 5 years and are automatically rotated after 4 1/2 years elapse.
As a cluster administrator, you can enable IPsec encryption after cluster installation.
Install the OpenShift CLI (oc
).
Log in to the cluster with a user with cluster-admin
privileges.
You have reduced the size of your cluster MTU by 46
bytes to allow for the overhead of the IPsec ESP header.
To enable IPsec encryption, enter the following command:
$ oc patch networks.operator.openshift.io cluster --type=merge \
-p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"ipsecConfig":{ }}}}}'
To find the names of the OVN-Kubernetes control plane pods, enter the following command:
$ oc get pods -l app=ovnkube-master -n openshift-ovn-kubernetes
NAME READY STATUS RESTARTS AGE
ovnkube-master-fvtnh 6/6 Running 0 122m
ovnkube-master-hsgmm 6/6 Running 0 122m
ovnkube-master-qcmdc 6/6 Running 0 122m
Verify that IPsec is enabled on your cluste by running the following command:
$ oc -n openshift-ovn-kubernetes rsh ovnkube-master-<XXXXX> \
ovn-nbctl --no-leader-only get nb_global . ipsec
where:
<XXXXX>
Specifies the random sequence of letters for a pod from the previous step.
true
As a cluster administrator, you can disable IPsec encryption only if you enabled IPsec after cluster installation.
Install the OpenShift CLI (oc
).
Log in to the cluster with a user with cluster-admin
privileges.
To disable IPsec encryption, enter the following command:
$ oc patch networks.operator.openshift.io/cluster --type=json \
-p='[{"op":"remove", "path":"/spec/defaultNetwork/ovnKubernetesConfig/ipsecConfig"}]'
Optional: You can increase the size of your cluster MTU by 46
bytes because there is no longer any overhead from the IPsec ESP header in IP packets.
Verify that IPsec is disabled on your cluster:
$ oc -n openshift-ovn-kubernetes -c nbdb rsh ovnkube-master-<XXXXX> \
ovn-nbctl --no-leader-only get nb_global . ipsec
where:
<XXXXX>
Specifies the random sequence of letters for a pod from the previous step.
false