Enable IPsec encryption for east-west traffic

TechPreview

Note

Consider this section as part of Deploy an OpenStack cluster.

MOSK can encrypt tenant east-west traffic with Internet Protocol Security (IPsec) protocol so that communication between workloads on different compute nodes and gateways stays confidential in transit. strongSwan establishes and maintains those tunnels.

To encrypt the east-west tenant traffic, enable ipsec in the spec:features:neutron settings of the OpenStackDeployment CR:

spec:
  features:
    neutron:
      ipsec:
        enabled: true

Caution

Enabling IPsec adds extra headers to the tenant traffic. The header size varies depending on IPsec configuration.

Therefore, Mirantis recommends decreasing network MTU for virtual networks and reserve 73 bytes overhead for the worst-case scenario as described in Cisco documentation: Configuring IPsec VPN Fragmentation and MTU.