Epic: support encryption-less connections between clusters

[skitt]

What would you like to be added:

Support for unencrypted connections between clusters.

Why is this needed:

All current cable drivers involve encrypting content, which is great for privacy but involves some overhead. On private connections, it would be useful to enable unencrypted connections, for example using IP-on-IP or VxLAN.

Work items:

• Enhancement proposal: Write an enhancement proposal for un-encrypted vxlan tunnels #1313
• New cable driver : Un-Encrypted vxlan tunnel between clusters #1149
• CI: Add CI For un-encrypted tunnels #1148
• Deployment (Operator, subctl) : Subctl/Operator support for vxlan cable driver submariner-operator#1101
• Deployment (helm) : helm support for vxlan cable driver submariner-charts#116
• Metrics : vxlan cable driver metrics needs to be exported #1150
• Docs: Update docs with vxlan cable driver support submariner-website#450

[nyechiel]

Per further discussion, IPsec VPN without encryption is also a good option we should consider. This boils down to supporting different config options per cable driver which is a subset of submariner-io/enhancements#67

[nyechiel]

Per conversation with Paul Wouters (Libreswan maintainer), these are some options to consider:

1. Null encryption mode: https://github.com/libreswan/libreswan/tree/main/testing/pluto/ikev2-67-esp-null-iperf
2. Null encryption and null authentication mode: https://github.com/libreswan/libreswan/tree/main/testing/pluto/ikev2-algo-15-esp-null-none

Generally, with modern NICs/CPUs, setting ESP to null is not recommend; aes_gcm128 is the most efficient option, and should result in same throughput as esp-null. Here is the relevant GCM RFC for more context: https://tools.ietf.org/html/rfc4106

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[nyechiel]

bump

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[skitt]

This is still relevant.

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[tpantelis]

bump