overlay: Data plane encryption silently fails when separate data network is used
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2.2k
- Forks
- 875
- PR merge metrics
- No merged PRs in 30d
Description
Create a new swarm with separate control plane and data networks:
swarm-01:~$ docker swarm init --advertise-addr 10.0.10.1 --data-path-addr 10.0.11.1
Add a peer:
swarm-02:~$ docker swarm join --token <TOKEN> 10.0.10.1:2377 --data-path-addr 10.0.11.2
The VXLAN traffic will be between the data plane addresses (10.0.11.1 and 10.0.11.2), however the driver installs XFRM entires that include the local control plane IP rather than the local data plane IP: 10.0.10.1 <-> 10.0.11.2 and 10.0.11.2 <-> 10.0.10.1.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue by creating a swarm with separate control-plane and data-plane addresses, then inspect the XFRM entries installed for VXLAN traffic. Done means the entries use the data-plane addresses in both directions and data-plane encryption works without silently failing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100