mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Ben Duncan
261b695e53
The VPC networking guide had no mention of IPsec, so an operator reading it had no way to discover that the geneve overlay is encrypted by default or what turning that off is worth. Add a section covering the default-on posture, the topologies where disabling is and is not appropriate, the measured cost on the ConnectX-5 reference cluster, and the full procedure. Correct the performance-tuning guide's claim that a manual "ovn-nbctl set NB_Global . ipsec=false" is transient because the daemon reconciles it. That holds for the enable direction only: ReconcileOVNIPSec returns early when IPsec is disabled, so it stops requesting encryption but never clears NB_Global.ipsec or other_config:ipsec_encapsulation. Both are left reading true, which makes the control plane disagree with the config. Document the manual steps as a required complement to the config change.