3

I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states:

The nodes in a swarm use mutual Transport Layer Security (TLS) to authenticate, authorize, and encrypt the communications with other nodes in the swarm.

Looking at the image further down the documentation page, I suspect that actually only management plane communication

  • between Manager Nodes themselves and
  • between Manager Nodes and Worker Nodes

is secured. This would mean that I have to secure my communication by other means. Other sources (https://medium.com/lucjuggery/create-a-swarm-cluster-with-docker-1-12-swarm-mode-541449114c27, https://www.dasher.com/containers-os-virtualization-to-workload-virtualization/, https://collabnix.com/docker-1-12-swarm-mode-under-the-hood/, https://upcloud.com/community/tutorials/docker-swarm-orchestration/) say that communication between Worker Nodes is mutual TLS secured by default too. However, I can't see where these sources base this information on. To me it appears unfounded.

This leads me to the following questions: Is mutual TLS between nodes

  1. limited to management plane communication or
  2. is all communication between Worker Nodes secured too?

If 1., are there other means to easily secure my communication except building mutual TLS into my containers by myself?

D.O.
  • 600
  • 3
  • 9

1 Answers1

3

You are correct that it is only the management traffic that is encrypted by default.

There is an option with the overlay networks to enable IPSEC for application traffic, but it is not supported by windows nodes.

https://docs.docker.com/network/overlay/

Jack
  • 187
  • 1
  • 8
  • 'You are correct that it is only the management traffic that is encrypted by default.' Did you try it out? If not, what source do you have for that information? – D.O. Mar 03 '20 at 10:29
  • Read the link, particularly https://docs.docker.com/network/overlay/#encrypt-traffic-on-an-overlay-network – Jack Mar 03 '20 at 23:11