Skip to content

Commit

Permalink
Review.
Browse files Browse the repository at this point in the history
  • Loading branch information
ozdanborne committed Dec 9, 2016
1 parent b14b52d commit 51287fb
Showing 1 changed file with 8 additions and 8 deletions.
16 changes: 8 additions & 8 deletions master/reference/public-cloud/digital-ocean.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,32 +7,32 @@ networking for containers in public cloud environments such as Digital Ocean.

## How to Run Calico in Digital Ocean

Digital Ocean offers two networking options for droplets.
Calico can be launched on either:
Digital Ocean offers two networking options for droplets:

- Public Interface
- Private Interface [Optional]
- Private Interface

Calico can be launched on either.
We recommend running Calico on the private interface, as it enhances security by
ensuring Calico services are not accessible from the wider internet.

However, hosts in different Datacenter Regions will not have IP connectivity with one
another on their private address, and therefore will not be able to establish
BGP sessions with one another. For mluti-region digital ocean clusters,
another through their private address, and therefore will not be able to establish
BGP sessions with one another. For mluti-region Digital Ocean clusters,
bind Calico to the public interface.

###### Enable Encapsulation

In Digital Ocean, cross-host container-to-container traffic will travel over an
L3 hop. Since Digital Ocean does not allow peering to the L3 hop, it will
In Digital Ocean, cross-host container-to-container traffic will travel over at least one
L3 hop. Since Digital Ocean does not allow peering to its networking fabric, it will
not know how to route this container traffic, and will drop it.

To remedy this, Calico can encapsulate container traffic with the IP so that the
networking fabric never sees the container IPs, allowing standard routing to
take over. Turn on traffic encapsulation in pool settings by enabling:

- `ipip` for container-to-container traffic.
- `nat-outgoing` for container-to-ec2-instance traffic.
- `nat-outgoing` for container-to-droplet traffic.

See [pool configuration]({{site.baseurl}}/{{page.version}}/reference/calicoctl/resources/ippool) for information on how to enable this for IP pools.

Expand Down

0 comments on commit 51287fb

Please sign in to comment.