Red Hat OpenShift Container Platform

Enabling IPsec encryption

To enable pod-to-pod and external IPsec encryption in Red Hat OpenShift Container Platform, you can patch the cluster Network custom resource and set ipsecConfig mode to Full or External.

Full: Encryption for pod-to-pod and external traffic
External: Encryption for external traffic

If you configure IPsec in Full mode, you must also complete the "Configuring IPsec encryption for external traffic" procedure.

If you enabled IPsec in Full mode, as a cluster administrator you can configure options for the mode by adding the full schema to networks.operator.openshift.io. The full schema supports the encapsulation parameter. You can use this parameter to configure network address translation-traversal (NAT-T) encapsulation for IPsec traffic. The encapsulation parameter supports the following values:

Auto is the default value and enables UDP encapsulation when libreswan detects network address translation (NAT) packets in traffic within a node.
Always enables UDP encapsulation for all traffic types available in a node. This option does not rely upon libreswan to detect NAT packets in a node.

Prerequisites

Install the OpenShift CLI (oc).
You are logged in to the cluster as a user with cluster-admin privileges.
You have reduced the size of your cluster MTU by 46 bytes to allow for the overhead of the IPsec ESP header.

Procedure

To enable IPsec encryption, enter the following command:

$ oc patch networks.operator.openshift.io cluster --type=merge -p \
  '{
  "spec":{
    "defaultNetwork":{
      "ovnKubernetesConfig":{
        "ipsecConfig":{
          "mode":"<mode>"
        }}}}}'

where:

spec.defaultNetwork.ovnKubernetesConfig.ipsecConfig.mode

Specifies External to encrypt traffic to external hosts or Full to encrypt pod-to-pod traffic and, optionally, traffic to external hosts. By default, IPsec is disabled.

Example configuration that has IPsec enabled in Full mode and encapsulation set to Always

$ oc patch networks.operator.openshift.io cluster --type=merge -p \
  '{
  "spec":{
    "defaultNetwork":{
      "ovnKubernetesConfig":{
        "ipsecConfig":{
          "mode":"Full",
          "full":{
            "encapsulation": "Always"
          }}}}}}'

Encrypt external traffic with IPsec by completing the "Configuring IPsec encryption for external traffic" procedure.

Verification

To find the names of the OVN-Kubernetes data plane pods, enter the following command:

$ oc get pods -n openshift-ovn-kubernetes -l=app=ovnkube-node

Example output

ovnkube-node-5xqbf                       8/8     Running   0              28m
ovnkube-node-6mwcx                       8/8     Running   0              29m
ovnkube-node-ck5fr                       8/8     Running   0              31m
ovnkube-node-fr4ld                       8/8     Running   0              26m
ovnkube-node-wgs4l                       8/8     Running   0              33m
ovnkube-node-zfvcl                       8/8     Running   0              34m
...

Verify that you enabled IPsec on your cluster by running the following command:

As a cluster administrator, you can verify that you enabled IPsec between pods on your cluster when you configured IPsec in Full mode. This step does not verify whether IPsec is working between your cluster and external hosts.

$ oc -n openshift-ovn-kubernetes rsh ovnkube-node-<XXXXX> ovn-nbctl --no-leader-only get nb_global . ipsec

where:

<XXXXX>: Specifies the random sequence of letters for a pod from an earlier step.

Successful output from the command shows the status as true.