Rancher: [Request?] - network overlay plugin framework, support alternate overlays

[guruvan]

IPsec is hard ;) and beyond many (most?) administrators to diagnose errors. Rancher's managed networking mostly "just works" but renders hosts unusable on failure.

From the number of related issues I see, is very difficult for many people to diagnose, let alone fix. I have been able to resolve issues on some hosts, and had to simply remove others. In some cases, removing a host, or changing IP addresses is not feasible as a workaround or fix.

IPSec is also incompatible with some network topologies. Some ISP networks will provide NAT that assigns IP:port pairs on a per port basis, causing packets to arrive from different IP addresses on ports 4500 and 500

Many users will interconnect datacenters over an encrypted vpn or other overlay - using IPSec on top of this encrypted overlay is top heavy and redundant.

Simpler overlay networking maybe desired by some. I have seen request for vlan or vxlan configurations.
My own preference would be for cjdns to provide the overlay (via ipv6) as this is encrypted, and handles full mesh routing, and ipv4 tunnels. I'm sure that others might prefer openvpn, or other techniques.

Because there are so many various desired topologies, user-configurable/user-written network overlay drivers maybe quite desirable, a plugin type framework could allow users to create their own as desired.

Plugin framework is a little above my go-fu, but plugins could be fairly simple to write. (simpler than diagnosing IPSec issues! :)

[setiseta]

And its very slow.
In my test Setup i lose 90% Performance. (Iperf host to host ~1gbit, iperf docker to docker ~ 100mbit)
My case is to just connect docker hosts in the same network. so its overkill to connect them with ipsec.

What about supporting weave? Its fast in the same network and can be configured to encrypt / secure if it connects over untrusted networks.

[leodotcloud]

I just joined a few weeks back to work on networking stuff. There will be some enhancements in the upcoming releases. Please stay tuned, we are definitely listening.

[leodotcloud]

As I mentioned here: https://github.com/rancher/rancher/issues/4752#issuecomment-256132736, we have plans to support other networking plugins like Calico, Weave. We are also working on providing VXLAN as an alternative to IPSec: https://github.com/leodotcloud/rancher-net/commit/0b48924a152662eb55a6c3cb1bb3b69c7b748f59.

This request is in pipeline, hence closing this issue.