Add encryption to in-cluster pod traffic by knrt10 · Pull Request #911 · kinvolk/lokomotive

knrt10 · 2020-09-07T08:30:43Z

Calico v3.15+ support wireguard and if enabled it encrypts in-cluster
pod traffic across nodes.

Signed-off-by: knrt10 kautilya@kinvolk.io

Release Notes

delete default FelixConfiguration while upgrading from 0.4.1
network_mtu changed from CNI network MTU to Physical network MTU.
bpfLogLevel will be briefly set from Info to Off.
Following ports will be opened on all hosts for the upgrade time between calico chart upgrade and calico-host-protection chart:

  - 22/tcp
  - 68/udp
  - 179/tcp
  - 2379/tcp
  - 2380/tcp
  - 5473/tcp
  - 6443/tcp
  - 6666/tcp
  - 6667/tcp

assets/charts/control-plane/calico-host-protection/templates/host-protection.yaml

pkg/platform/packet/packet.go

assets/terraform-modules/aws/flatcar-linux/kubernetes/variables.tf

iaguis · 2020-09-07T12:07:42Z

We should also change the MTU size when enabling this as mentioned here.

Would encryption be picked up by the Calico chart on lokoctl apply? Would the MTU?

assets/charts/control-plane/calico/templates/felixconfig.yaml

assets/charts/control-plane/calico/values.yaml

docs/configuration-reference/platforms/aks.md

invidian · 2020-09-07T13:23:46Z

Would encryption be picked up by the Calico chart on lokoctl apply? Would the MTU?

If encryption is enabled and Calico does not align MTU by default, then I guess we can do it automatically?

invidian

Looking good.

docs/configuration-reference/platforms/aws.md

assets/terraform-modules/packet/flatcar-linux/kubernetes/bootkube.tf

assets/charts/control-plane/calico/templates/felixconfig.yaml

invidian

Just one more question, as I'm not sure if we don't change the existing behavior with failsafe ports.

assets/charts/control-plane/calico/values.yaml

johananl · 2020-09-28T17:18:16Z

I think we should make it a habit to include a "how to test" section in PRs. I just tried using this feature using Flatcar stable which doesn't work because the kernel is too old.

johananl

The encryption seems to work fine provided that you don't use stable. Nice job @knrt10.

I've left a couple of comments.

docs/configuration-reference/platforms/packet.md

pkg/platform/baremetal/template.go

assets/terraform-modules/aws/flatcar-linux/kubernetes/variables.tf

assets/terraform-modules/bootkube/conditional.tf

assets/terraform-modules/bootkube/resources/charts/calico.yaml

assets/terraform-modules/bootkube/variables.tf

pkg/platform/aws/template.go

docs/configuration-reference/platforms/aws.md

assets/terraform-modules/aws/flatcar-linux/kubernetes/variables.tf

pkg/platform/aws/template.go

pkg/platform/aws/aws.go

Felixconfig should be part of calico charts and not calico-host-protection. This change is required for encrypting in-cluster pod traffic. This also introduces failsafeInboundHostPorts as a variable. Signed-off-by: knrt10 <kautilya@kinvolk.io>

invidian

Just some last nits, otherwise LGTM.

assets/terraform-modules/aws/flatcar-linux/kubernetes/variables.tf

pkg/platform/platform.go

assets/charts/control-plane/calico/templates/config.yaml

Previously we used CNI network MTU in terraform, but now using default as Physical network MTU. Signed-off-by: knrt10 <kautilya@kinvolk.io>

Signed-off-by: knrt10 <kautilya@kinvolk.io>

Calico v3.15+ support WireGuard and if enabled it encrypts in-cluster pod traffic across nodes. Signed-off-by: knrt10 <kautilya@kinvolk.io>

Signed-off-by: knrt10 <kautilya@kinvolk.io>

invidian

Just some commit structure nits, no blockers from merging really.

Nice work @knrt10, LGTM ✔️

invidian · 2020-09-30T13:48:41Z

docs/configuration-reference/platforms/aws.md


  disk_iops = var.disk_iops

-  network_mtu = 1480


I think this commit could be merged with the one changing the code.

invidian · 2020-09-30T13:49:20Z

docs/configuration-reference/platforms/aws.md


  enable_tls_bootstrap = true

+  encrypt_pod_traffic = true


Docs can be committed with the implementation.

iaguis

LGTM. We should mention in the release notes that we've changed the meaning of the network_mtu parameter.

knrt10 · 2020-09-30T18:33:34Z

Thank you all for the reviews. Merging now.

docs/configuration-reference/platforms/packet.md

knrt10 requested a review from invidian September 7, 2020 08:30

invidian reviewed Sep 7, 2020

View reviewed changes

assets/charts/control-plane/calico-host-protection/templates/host-protection.yaml Outdated Show resolved Hide resolved

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch from 6cd5126 to beb2608 Compare September 7, 2020 09:01

knrt10 changed the title ~~Add encryption to cluster traffic~~ Add encryption to in-cluster pod traffic Sep 7, 2020

knrt10 linked an issue Sep 7, 2020 that may be closed by this pull request

Consider encrypting in-cluster traffic #10

Closed

knrt10 requested review from johananl and surajssd as code owners September 7, 2020 09:39

knrt10 requested review from iaguis and removed request for johananl and surajssd September 7, 2020 09:40

invidian suggested changes Sep 7, 2020

View reviewed changes

pkg/platform/packet/packet.go Outdated Show resolved Hide resolved

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch 2 times, most recently from a58f31e to 8b50f72 Compare September 7, 2020 11:59

johananl reviewed Sep 7, 2020

View reviewed changes

assets/terraform-modules/aws/flatcar-linux/kubernetes/variables.tf Outdated Show resolved Hide resolved

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch from 8b50f72 to 7f07add Compare September 7, 2020 12:24

invidian suggested changes Sep 7, 2020

View reviewed changes

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch from 7f07add to 51687a4 Compare September 7, 2020 12:49

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch 5 times, most recently from c526052 to 2239711 Compare September 8, 2020 12:30

knrt10 requested a review from invidian September 8, 2020 12:51

invidian suggested changes Sep 8, 2020

View reviewed changes

docs/configuration-reference/platforms/aws.md Show resolved Hide resolved

assets/terraform-modules/packet/flatcar-linux/kubernetes/bootkube.tf Show resolved Hide resolved

assets/charts/control-plane/calico/templates/felixconfig.yaml Show resolved Hide resolved

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch from 2239711 to ef0e9bb Compare September 8, 2020 14:10

knrt10 requested a review from invidian September 8, 2020 14:11

invidian reviewed Sep 8, 2020

View reviewed changes

assets/charts/control-plane/calico/values.yaml Outdated Show resolved Hide resolved

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch from ef0e9bb to ed891c6 Compare September 8, 2020 14:56

johananl reviewed Sep 28, 2020

View reviewed changes

knrt10 dismissed stale reviews from ipochi and invidian via cab4983 September 29, 2020 07:03

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch from 6cef80f to cab4983 Compare September 29, 2020 07:03

knrt10 requested review from invidian and ipochi September 29, 2020 07:05

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch 2 times, most recently from be1b98d to e4758b4 Compare September 30, 2020 06:55

knrt10 requested a review from johananl September 30, 2020 06:56

invidian suggested changes Sep 30, 2020

View reviewed changes

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch 2 times, most recently from db862da to 7cb540b Compare September 30, 2020 11:22

knrt10 requested a review from invidian September 30, 2020 11:23

Refactored felix config

4216f9c

Felixconfig should be part of calico charts and not calico-host-protection. This change is required for encrypting in-cluster pod traffic. This also introduces failsafeInboundHostPorts as a variable. Signed-off-by: knrt10 <kautilya@kinvolk.io>

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch 2 times, most recently from 844d1ca to a5a5eb4 Compare September 30, 2020 12:19

invidian suggested changes Sep 30, 2020

View reviewed changes

assets/terraform-modules/aws/flatcar-linux/kubernetes/variables.tf Outdated Show resolved Hide resolved

pkg/platform/platform.go Outdated Show resolved Hide resolved

assets/charts/control-plane/calico/templates/config.yaml Outdated Show resolved Hide resolved

knrt10 added 5 commits September 30, 2020 18:31

Change network_mtu to physical network

51af87f

Previously we used CNI network MTU in terraform, but now using default as Physical network MTU. Signed-off-by: knrt10 <kautilya@kinvolk.io>

Platforms: update docs for network_mtu

7257e8b

Signed-off-by: knrt10 <kautilya@kinvolk.io>

Add in-cluster pod encryption

77744ae

Calico v3.15+ support WireGuard and if enabled it encrypts in-cluster pod traffic across nodes. Signed-off-by: knrt10 <kautilya@kinvolk.io>

Add docs for encrypt_pod_traffic for platforms

5214527

Signed-off-by: knrt10 <kautilya@kinvolk.io>

Add license for packet_test

7f891d8

Signed-off-by: knrt10 <kautilya@kinvolk.io>

knrt10 force-pushed the knrt10/encypting-cluster-traffic branch from a5a5eb4 to 7f891d8 Compare September 30, 2020 13:04

knrt10 requested a review from invidian September 30, 2020 13:05

invidian approved these changes Sep 30, 2020

View reviewed changes

iaguis approved these changes Sep 30, 2020

View reviewed changes

knrt10 merged commit 2d55a8b into master Sep 30, 2020

arianvp reviewed Oct 29, 2020

View reviewed changes

docs/configuration-reference/platforms/packet.md Show resolved Hide resolved

Conversation

knrt10 commented Sep 7, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

iaguis commented Sep 7, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

invidian commented Sep 7, 2020

Uh oh!

invidian left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

invidian left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

johananl commented Sep 28, 2020

Uh oh!

johananl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

invidian left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

invidian left a comment

Choose a reason for hiding this comment

Uh oh!

invidian Sep 30, 2020

Choose a reason for hiding this comment

Uh oh!

invidian Sep 30, 2020

Choose a reason for hiding this comment

Uh oh!

iaguis left a comment

Choose a reason for hiding this comment

Uh oh!

knrt10 commented Sep 30, 2020

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

knrt10 commented Sep 7, 2020 •

edited

Loading