docker swarm encrypted overlay network doesn't work

[UchihaYuki]

Description

If I use unencrypted overlay networks, everything works.

After just changing networks from unencrypted to encrypted, things stopped working. I created the networks with the following command:

network create --attachable --driver overlay --opt encrypted <network_name>

The strange thing is encrypted overlay networks work on my local dev environment.

I use two VPSs in local dev, and three VPSs in production environment. All of them installed Ubuntu 20.04 with kernel 5.15.0-86-generic. Just in case it's caused by firewall in production environment, following are the ports I opened on production VPSs:

  tcp:
    - 22    # ssh
    - 80    # http
    - 443   # https
    - 2377  # docker swarm - cluster management communications
    - 7946  # docker swarm - communication among nodes
  udp:
    - 4789 # docker swarm - overlay network traffic
    - 7946 # docker swarm - communication among nodes

Reproduce

Can't reproduce easily. I use VPSs on Hetzner cloud.

Expected behavior

No response

docker version

Client: Docker Engine - Community
 Version:           24.0.2
 API version:       1.43
 Go version:        go1.20.4
 Git commit:        cb74dfc
 Built:             Thu May 25 21:52:22 2023
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          24.0.2
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.4
  Git commit:       659604f
  Built:            Thu May 25 21:52:22 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.21
  GitCommit:        3dce8eb055cbb6872793272b4f20ed16117344f8
 runc:
  Version:          1.1.7
  GitCommit:        v1.1.7-0-g860f061
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client: Docker Engine - Community
 Version:    24.0.2
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.10.5
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.18.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose
  scan: Docker Scan (Docker Inc.)
    Version:  v0.17.0
    Path:     /usr/libexec/docker/cli-plugins/docker-scan

Server:
 Containers: 12
  Running: 11
  Paused: 0
  Stopped: 1
 Images: 24
 Server Version: 24.0.2
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: active
  NodeID: sodkyrajy01jl9x5hq19lto6g
  Is Manager: true
  ClusterID: yq0iueui1b7t493wnkz7x49y0
  Managers: 1
  Nodes: 3
  Default Address Pool: 10.0.0.0/8
  SubnetSize: 24
  Data Path Port: 4789
  Orchestration:
   Task History Retention Limit: 5
  Raft:
   Snapshot Interval: 10000
   Number of Old Snapshots to Retain: 0
   Heartbeat Tick: 1
   Election Tick: 10
  Dispatcher:
   Heartbeat Period: 5 seconds
  CA Configuration:
   Expiry Duration: 3 months
   Force Rotate: 0
  Autolock Managers: false
  Root Rotation In Progress: false
  Node Address: 49.12.189.113
  Manager Addresses:
   49.12.189.113:2377
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 3dce8eb055cbb6872793272b4f20ed16117344f8
 runc version: v1.1.7-0-g860f061
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
 Kernel Version: 5.15.0-86-generic
 Operating System: Ubuntu 20.04.4 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.566GiB
 Name: makabaka-1-1
 ID: 6a7aa601-84be-4788-8635-1b1723a029fe
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

Additional Info

No response

[thaJeztah]

Copying my comment from your other ticket; docker/cli#4669 (comment)

I see you commented on moby/moby#43359 as well.

however, also make sure you are running an up-to-date version of the engine; it looks like you're running an older patch release (24.0.2), and there were some fixes in later patch-releases around networking (https://docs.docker.com/engine/release-notes/24.0/)

Can you verify if this issue reproduces with the latest patch releases of 24.0?

It's also worth running the check-config.sh script on those machines to check if something is possibly missing in the system's configuration; https://github.com/moby/moby/blob/master/contrib/check-config.sh

[UchihaYuki]

The result from running check-config.sh (I got the same result from my local environment, but encrypted network works there):

# ./check-config.sh 
warning: /proc/config.gz does not exist, searching other paths for kernel config ...
info: reading kernel config from /boot/config-5.15.0-86-generic ...

Generally Necessary:
- cgroup hierarchy: properly mounted [/sys/fs/cgroup]
- apparmor: enabled and tools installed
- CONFIG_NAMESPACES: enabled
- CONFIG_NET_NS: enabled
- CONFIG_PID_NS: enabled
- CONFIG_IPC_NS: enabled
- CONFIG_UTS_NS: enabled
- CONFIG_CGROUPS: enabled
- CONFIG_CGROUP_CPUACCT: enabled
- CONFIG_CGROUP_DEVICE: enabled
- CONFIG_CGROUP_FREEZER: enabled
- CONFIG_CGROUP_SCHED: enabled
- CONFIG_CPUSETS: enabled
- CONFIG_MEMCG: enabled
- CONFIG_KEYS: enabled
- CONFIG_VETH: enabled (as module)
- CONFIG_BRIDGE: enabled (as module)
- CONFIG_BRIDGE_NETFILTER: enabled (as module)
- CONFIG_IP_NF_FILTER: enabled (as module)
- CONFIG_IP_NF_MANGLE: enabled (as module)
- CONFIG_IP_NF_TARGET_MASQUERADE: enabled (as module)
- CONFIG_NETFILTER_XT_MATCH_ADDRTYPE: enabled (as module)
- CONFIG_NETFILTER_XT_MATCH_CONNTRACK: enabled (as module)
- CONFIG_NETFILTER_XT_MATCH_IPVS: enabled (as module)
- CONFIG_NETFILTER_XT_MARK: enabled (as module)
- CONFIG_IP_NF_NAT: enabled (as module)
- CONFIG_NF_NAT: enabled (as module)
- CONFIG_POSIX_MQUEUE: enabled
- CONFIG_CGROUP_BPF: enabled

Optional Features:
- CONFIG_USER_NS: enabled
- CONFIG_SECCOMP: enabled
- CONFIG_SECCOMP_FILTER: enabled
- CONFIG_CGROUP_PIDS: enabled
- CONFIG_MEMCG_SWAP: enabled
    (cgroup swap accounting is currently enabled)
- CONFIG_BLK_CGROUP: enabled
- CONFIG_BLK_DEV_THROTTLING: enabled
- CONFIG_CGROUP_PERF: enabled
- CONFIG_CGROUP_HUGETLB: enabled
- CONFIG_NET_CLS_CGROUP: enabled (as module)
- CONFIG_CGROUP_NET_PRIO: enabled
- CONFIG_CFS_BANDWIDTH: enabled
- CONFIG_FAIR_GROUP_SCHED: enabled
- CONFIG_IP_NF_TARGET_REDIRECT: enabled (as module)
- CONFIG_IP_VS: enabled (as module)
- CONFIG_IP_VS_NFCT: enabled
- CONFIG_IP_VS_PROTO_TCP: enabled
- CONFIG_IP_VS_PROTO_UDP: enabled
- CONFIG_IP_VS_RR: enabled (as module)
- CONFIG_SECURITY_SELINUX: enabled
- CONFIG_SECURITY_APPARMOR: enabled
- CONFIG_EXT4_FS: enabled
- CONFIG_EXT4_FS_POSIX_ACL: enabled
- CONFIG_EXT4_FS_SECURITY: enabled
- Network Drivers:
  - "overlay":
    - CONFIG_VXLAN: enabled (as module)
    - CONFIG_BRIDGE_VLAN_FILTERING: enabled
      Optional (for encrypted networks):
      - CONFIG_CRYPTO: enabled
      - CONFIG_CRYPTO_AEAD: enabled
      - CONFIG_CRYPTO_GCM: enabled
      - CONFIG_CRYPTO_SEQIV: enabled
      - CONFIG_CRYPTO_GHASH: enabled
      - CONFIG_XFRM: enabled
      - CONFIG_XFRM_USER: enabled (as module)
      - CONFIG_XFRM_ALGO: enabled (as module)
      - CONFIG_INET_ESP: enabled (as module)
      - CONFIG_NETFILTER_XT_MATCH_BPF: enabled (as module)
  - "ipvlan":
    - CONFIG_IPVLAN: enabled (as module)
  - "macvlan":
    - CONFIG_MACVLAN: enabled (as module)
    - CONFIG_DUMMY: enabled (as module)
  - "ftp,tftp client in container":
    - CONFIG_NF_NAT_FTP: enabled (as module)
    - CONFIG_NF_CONNTRACK_FTP: enabled (as module)
    - CONFIG_NF_NAT_TFTP: enabled (as module)
    - CONFIG_NF_CONNTRACK_TFTP: enabled (as module)
- Storage Drivers:
  - "btrfs":
    - CONFIG_BTRFS_FS: enabled (as module)
    - CONFIG_BTRFS_FS_POSIX_ACL: enabled
  - "overlay":
    - CONFIG_OVERLAY_FS: enabled (as module)
  - "zfs":
    - /dev/zfs: present
    - zfs command: missing
    - zpool command: missing

Limits:
- /proc/sys/kernel/keys/root_maxkeys: 1000000

Some other info:

# uname -a
Linux makabaka-1-1 5.15.0-86-generic #96~20.04.1-Ubuntu SMP Thu Sep 21 13:23:37 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.4 LTS
Release:        20.04
Codename:       focal

# docker version
Client: Docker Engine - Community
 Version:           24.0.7
 API version:       1.43
 Go version:        go1.20.10
 Git commit:        afdd53b
 Built:             Thu Oct 26 09:08:01 2023
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          24.0.7
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.10
  Git commit:       311b9ff
  Built:            Thu Oct 26 09:08:01 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.25
  GitCommit:        d8f198a4ed8892c764191ef7b3b06d8a2eeb5c7f
 runc:
  Version:          1.1.10
  GitCommit:        v1.1.10-0-g18a0cb0
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

# docker info
Client: Docker Engine - Community
 Version:    24.0.7
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.10.5
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.18.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose
  scan: Docker Scan (Docker Inc.)
    Version:  v0.17.0
    Path:     /usr/libexec/docker/cli-plugins/docker-scan

Server:
 Containers: 11
  Running: 11
  Paused: 0
  Stopped: 0
 Images: 24
 Server Version: 24.0.7
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: active
  NodeID: sodkyrajy01jl9x5hq19lto6g
  Is Manager: true
  ClusterID: yq0iueui1b7t493wnkz7x49y0
  Managers: 1
  Nodes: 3
  Default Address Pool: 10.0.0.0/8
  SubnetSize: 24
  Data Path Port: 4789
  Orchestration:
   Task History Retention Limit: 5
  Raft:
   Snapshot Interval: 10000
   Number of Old Snapshots to Retain: 0
   Heartbeat Tick: 1
   Election Tick: 10
  Dispatcher:
   Heartbeat Period: 5 seconds
  CA Configuration:
   Expiry Duration: 3 months
   Force Rotate: 0
  Autolock Managers: false
  Root Rotation In Progress: false
  Node Address: 49.12.189.113
  Manager Addresses:
   49.12.189.113:2377
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: d8f198a4ed8892c764191ef7b3b06d8a2eeb5c7f
 runc version: v1.1.10-0-g18a0cb0
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
 Kernel Version: 5.15.0-86-generic
 Operating System: Ubuntu 20.04.4 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.566GiB
 Name: makabaka-1-1
 ID: 6a7aa601-84be-4788-8635-1b1723a029fe
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

How I determine the encrypted overlay network doesn't work:
When I deploy portainer without encrypted overlay network, I can read networks and volumes info on all three nodes, but when I switch to encrypted overlay network, I can only read networks and volumes info on the node portainer is running on, and the speed of portainer UI is pretty slow.

[UchihaYuki]

You can see from the following picture that, the agents on other two nodes can't connect to portainer through encrypted network somehow:

[UchihaYuki]

But there is no problem on my local dev environment:

[UchihaYuki]

I don't see any error on logs of both portainer and portainer agents.

[UchihaYuki]

I repeated the same environment on DigitalOcean and got the same result:

Since I use ansible and terraform, the environment on DigitalOcean is pretty similar to Hetzner.

[UchihaYuki]

Following is a part of my docker-compose.yml file (I just want to show you that both agent and portainer are on the same encrypted overlay network):

x-extends: &extends
  file: ../common.yml
  service: common
  
services:
  agent:
    extends: *extends
    image: portainer/agent:2.16.2-alpine
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
    networks:
      - ${SLN_CODE}_portainer
    deploy:
      mode: global
      labels:
        - traefik.enable=false

  portainer:
    extends: *extends
    image: portainer/portainer-ce:2.16.2-alpine
    command:
      [
        "-H",
        "tcp://tasks.agent:9001",
        "--tlsskipverify",
        "--admin-password=${PORTAINER_ADMIN_PASSWORD}",
      ]
    networks:
      - ${SLN_CODE}_portainer
      - ${SLN_CODE}_traefik
    volumes:
      - portainer:/data
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: 
          - node.labels.${SLN_CODE}_portainer==true
      labels:
        - traefik.docker.network=${CLOUD_CODE}_traefik

        - traefik.http.routers.${SLN_CODE}_portainer.entrypoints=https
        - traefik.http.routers.${SLN_CODE}_portainer.rule=Host(`portainer.${BASE_DOMAIN}`)
        - traefik.http.routers.${SLN_CODE}_portainer.tls=true
        - traefik.http.routers.${SLN_CODE}_portainer.tls.certresolver=letsencrypt
        - traefik.http.routers.${SLN_CODE}_portainer.tls.domains[0].main=${BASE_DOMAIN}
        - traefik.http.routers.${SLN_CODE}_portainer.tls.domains[0].sans=*.${BASE_DOMAIN}
        - traefik.http.services.${SLN_CODE}_portainer.loadbalancer.server.port=9000

volumes:
  portainer:

networks:
  "${SLN_CODE}_portainer":
    external: true
  "${SLN_CODE}_traefik":
    external: true

[UchihaYuki]

After upgrading to 24.0.7, unencrypted overlay network on local dev environment suddenly doesn't work now:

But encrypted network still work.

In production environment, encrypted overlay network still doesn't work, but unencrypted network works.

[UchihaYuki]

I found a partial solution here:
https://serverfault.com/a/1103223
After changing the default port of overlay network from 4789 to 2266 (I also tried 49151), I got the following result:

	Local	Hetzner	DigitalOcean
encrypted	yes	no	no
unencrypted	yes	yes	yes

The reason it works in local might be because I also use VMs on ESXi.