<html><body><p><font size="2">Hi, I joined the mailing list tonight and I've been struggling with getting Kubernetes to work with libreswan IPSec host to host encryption I spent many hours on this but I'm not an IPSec expert and maybe I'm missing something, such an iptables command or rule.</font><br><font size="2">I disabled the firewall.</font><br><br><font size="2">I think I set up everything properly and would to know if anyone sees a mistake or something missing</font><br><font size="2">I have 3 servers (not visible on the internet)</font><br><a href="http://hackrhnode121.rtp.raleigh.ibm.com/"><u><font size="2" color="#0000FF">hackrhnode121.rtp.raleigh.ibm.com</font></u></a><u><font size="2" color="#0000FF"><br></font></u><a href="http://hackrhnode122.rtp.raleigh.ibm.com/"><u><font size="2" color="#0000FF">hackrhnode122.rtp.raleigh.ibm.com</font></u></a><u><font size="2" color="#0000FF"><br></font></u><a href="http://hackrhnode123.rtp.raleigh.ibm.com/"><u><font size="2" color="#0000FF">hackrhnode123.rtp.raleigh.ibm.com</font></u></a><br><br><font size="2">Configured as</font><br><font size="2">hackrhnode121 = node 1 - Kubernetes master node (host 1 or node 1)</font><br><font size="2">hackrhnode122 = node 2 - Kubernetes worker node 1 (host 2 or node 2)</font><br><font size="2">hackrhnode123 = node 3 - Kubernetes worker node 3 (host 3 or node 3)</font><br><br><font size="2">I can set up encryption between the master node (host 1 or node 1) and the 1st worker node (host 2 or node 2) and things work fine. Meaning our application still works and Kubernetes is working fine</font><br><font size="2" color="#FF0000">While leaving host 1 to host 2 encryption enabled, when I set up encryption between nodes 2 & 3 our application breaks. </font><br><font size="2" color="#FF0000">When I disable the encryption between hosts 2 & 3 and reboot things are fine.</font><br><font size="2" color="#FF0000">Similarly if I leave encryption on between hosts 1 & 2 and enable it between 1 & 3, Kubernetes breaks again. </font><br><font size="2" color="#FF0000">When I say Kubernetes breaks, there is a command that lists all the Kubernetes pods (We have 4 pods) and the pods simply do not start up.</font><br><br><font size="2">In our case we have</font><br><font size="2">Red Hat 7.4</font><br><font size="2">Docker version 17.12.0-ce, build c97c6d6</font><br><font size="2">Kubernetes version 1.7.11 (we will move to 1.9.3)</font><br><br><br><font size="2">I mostly followed</font><br><a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-securing_virtual_private_networks#sec-Host-To-Host_VPN_Using_Libreswan"><font size="2">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-securing_virtual_private_networks#sec-Host-To-Host_VPN_Using_Libreswan</font></a><br><font size="2">I've done this a few times but things break after I encrypt nodes 2 & 3 (I rolled back this encryption between these 2 nodes)</font><br><br><br><font size="2">Here is my detailed documentation and verification (I hope this .txt file gets through).</font><br><br><i>(See attached file: commands-used-for-ipsec-rh-linux-kubernetes.txt)</i><br><br><font size="2">Thanks for any help and I'll take any suggestions</font><br><font size="2"><br>********<br>James Stroud<br>Financial Crimes Insight Team Lead<br> stroudj@us.ibm.com - cell # = (703) 965 4516 </font><br><br><br><BR>
</body></html>