Prepare PoC of Node to Node encryption using OVN in testbed

[fdobrovolny]

Epic #531

This approach has been selected based on the finding of #536

As an SCS Developer, I want to make a PoC of node-to-node IPSec encryption using OVN in the testbed so that I can validate this proposal.

Definition of Ready:

• User Story is small enough to be finished within one sprint
• User Story is clear and understood by the whole team
• Acceptance criteria are defined
• Acceptance criteria are clear and understood by the whole team

Definition of Done:

• All acceptance criteria are met
• Changes have been reviewed
• CI tests have run successfully
• Documentation has been updated
• Release Notes have been updated

[MatusJenca2]

Update:
I have build a kolla test environment for this issue.
It's a an ansible playbook, that allows you to spawn kolla in both aio and multinode modes on your local machine using libvirt.

It's available in my personal repo.

A needed image is uploaded to gx-scs.sovereignit.cloud it is community visible under id b336de0c-0bc3-47c0-ace9-cd11f4102b69. I will upload it to Swift in the future.

[fdobrovolny]

Following a discussion on VPTG and subsequent talks with Dominik and the team, we determined that our initial solution was viable. It was deemed unfeasible for inclusion in ansible kolla upstream. We then considered using the IPSEC functionality in OVN as a more integrable alternative for Ansible Kolla. However, this still involves installing OVS-IPSec packages on each server, which may also be problematic for upstream acceptance. Thanks to Matus's assistance with the development environment, I changed the solution from the ground up to utilize OVN services for upstream integration. I have established a working setup with OVN that is manually configured with IPSec. I am now exploring a proof of concept to automate this setup using Ansible and investigating its compatibility with the broader OpenStack ecosystem. I haven't found any documentation showing someone implementing this deployment.

[berendt]

Following a discussion on VPTG and subsequent talks with Dominik and the team, we determined that our initial solution was viable. It was deemed unfeasible for inclusion in ansible kolla upstream. We then considered using the IPSEC functionality in OVN as a more integrable alternative for Ansible Kolla. However, this still involves installing OVS-IPSec packages on each server, which may also be problematic for upstream acceptance. Thanks to Matus's assistance with the development environment, I changed the solution from the ground up to utilize OVN services for upstream integration. I have established a working setup with OVN that is manually configured with IPSec. I am now exploring a proof of concept to automate this setup using Ansible and investigating its compatibility with the broader OpenStack ecosystem. I haven't found any documentation showing someone implementing this deployment.

Should be no problem to install the openvswitch-ipsec package inside the openvswitch container images.

[berendt]

Update: I have build a kolla test environment for this issue. It's a an ansible playbook, that allows you to spawn kolla in both aio and multinode modes on your local machine using libvirt.

It's available in my personal repo.

I like this one. Can we adapt this as e.g. kolla-development-environment?

[fdobrovolny]

Update: I have build a kolla test environment for this issue. It's a an ansible playbook, that allows you to spawn kolla in both aio and multinode modes on your local machine using libvirt.
It's available in my personal repo.

I like this one. Can we adapt this as e.g. kolla-development-environment?

It would need a bit more love and polishing to be publicly usable, but why not? We wanted to put it into Matus space as it was more of a playground for us so far, and Matus wants to extend it to be optionally deployable to OpenStack for bigger tests when the local machine is not enough. But I'm personally running on my machine 1 control plane and 3 compute nodes, and it helps me a lot with the development.