SDN Encryption

[fdobrovolny]

This task is an epic grouping task related tasks to VP04 Lot 2.

As an SCS/OpenStack user, I want to have a built-in functionality in OpenStack which lets me encrypt network traffic using TLS and public or private CA. I want to get encryption on the following traffic types:

• East-West Traffic - internal OpenStack networks leveraging OVS/OVN, Neutron services. Scoped are VM to VM as well as Container originated traffic.
• API Traffic - internal and external traffic to network services on OpenStack via exposed APIs

Also, as OpenStack user I want to be able to leverage Smart-NIC, eBPF and Intel SGX technologies to increase network encryption performance via hardware acceleration.

Tasks

• https://github.com/SovereignCloudStack/issues/issues/440 - @MatusJenca2
• https://github.com/SovereignCloudStack/issues/issues/441 - @fdobrovolny
• https://github.com/SovereignCloudStack/issues/issues/442 - @akafazov
• https://github.com/SovereignCloudStack/issues/issues/443 - @ignatov17
• Compile research into Decision Record
• Prepare local env

Acceptance Criteria

• [ ] East-West and API traffics are encrypted via TLS
• [ ] Technical approach is documented via ADR and specifications
• [ ] Reference implementation is done via a Neutron plugin named SecuriNet
• [ ] Proposed approach has been shared and synced with the SCS community

Definition of Ready:

• [ ] User Story is small enough to be finished within one sprint
• [ ] User Story is clear and understood by the whole team
• [ ] Acceptance criteria are defined
• [ ] Acceptance criteria are clear and understood by the whole team

Definition of Done:

• [ ] All acceptance criteria are met
• [ ] Changes have been reviewed
• [ ] CI tests have run successfully
• [ ] Documentation has been updated
• [ ] Release Notes have been updated

[artificial-intelligence]

relevant patchset in kolla-ansible to support Let's Encrypt for HAProxy with internal/external API Endpoints: https://review.opendev.org/c/openstack/kolla-ansible/+/741340

[berendt]

https://github.com/osism/issues/issues/89 has to be worked on as well. At the moment it is not possible to use TLS on Memcached. Not sure if this is only a missing feature in Kolla or in OpenStack.