Add digital ocean guide.

_data/master/navbars/reference.yml

@@ -85,6 +85,8 @@ toc:
   section:
     - title: Overview
       path: /reference/public-cloud/overview
+    - title: Digital Ocean
+      path: /reference/public-cloud/digital-ocean
 - title: Deploying on Private Cloud
   section:
     - title: Overview

master/reference/public-cloud/digital-ocean.md

@@ -0,0 +1,50 @@
+---
+title: Calico on Digital Ocean
+---
+
+Calico is designed to provide high performance massively scalable virtual
+networking for containers in public cloud environments such as Digital Ocean.
+
+Since Digital Ocean does not allow for BGP peering with the networking fabric,
+it must always be run with ipip enabled.
+
+## Why Use Calico with Digital Ocean
+
+Calico implements fine-grain policy for containers which dynamically applies to
+containers as they are launched.
+
+## How to Run Calico in Digital Ocean
+
+Digital Ocean offers two networking options for droplets:
+
+- Public Interface
+- Private Interface [Optional]
+
+Calico can be launched on either. We recommend running Calico on the optional
+private interface, as it improves security by ensuring
+calico services are not accessible by the wider internet. However, nodes in
+different Datacenter Regions will not have IP connectivity using their private
+address, and therefore will not be able to establish BGP sessions with one another.
+
+If you can run your entire Calico cluster in one Datacenter Region, launch
+calico on the Private Interface.
+
+If you cannot, set up a publicly accessible route reflector in each zone,
+or launch calico on the Public Interface.
+
+###### Enable Encapsulation
+
+On Digital Ocean, cross-host container-to-container traffic will travel over an
+L3 nexthop. Since Digital Ocean does not allow peering to the L3 hop, it will
+not know how to route this container traffic, and it will be dropped.
+
+To remedy this, enable [ipip encapsulation on the pool](#). This will wrap container
+traffic in the host's IP.
+
+###### Ensure Calico Chooses Correct IP
+
+Note that calicoctl's automatic ip detection will launch calico/node on the private
+address if the droplet is configured to have a private interface.
+
+If intend to launch Calico on the public interface, ensure you manually specify
+`--ip` when launching `calicoctl node run`.