Encrypting Traffic in Transit with Cilium: CCA practice questions

Cilium can transparently encrypt traffic between Cilium-managed endpoints on different nodes, without changes to the applications. Three mechanisms are available: IPsec, WireGuard and, as a beta, ztunnel. Encryption is enabled with encryption.enabled=true, and encryption.type selects the method; when the type is omitted it defaults to ipsec.

With IPsec, the key material is a pre-shared key that you store in a Kubernetes Secret called cilium-ipsec-keys, in the same namespace as Cilium. A missing or misplaced Secret is the first thing to check when agents fail to start after enabling it. Encrypted packets carry the Encapsulating Security Payload header, so a capture filtered on esp shows them. Keys are rotated by replacing the Secret with a higher key ID; old and new keys are used side by side during the transition, and in a Cluster Mesh every cluster must be rotated.

WireGuard needs no shared secret. Each agent generates its own key pair, publishes the public key in the network.cilium.io/wg-pub-key annotation of its CiliumNode object and builds tunnels to every other node over UDP port 51871 through the cilium_wg0 interface. In tunnel routing mode the packet is encapsulated twice, first by VXLAN or Geneve and then by WireGuard. Node-to-node encryption, set with encryption.nodeEncryption=true, extends protection to host traffic; control-plane nodes opt out by default so that a node with a new key can still reach the API server to publish it.

ztunnel takes a different approach: a per-node proxy provides Layer 4 mutual TLS, and namespaces are enrolled with the label io.cilium/mtls-enabled=true. Pod-level enrollment is not supported, both ends of a connection must be enrolled, and Cluster Mesh is not compatible with it today.

Some traffic is deliberately not encrypted. Packets between pods on the same node stay in the clear because they never leave the host. There is also a short window after a new endpoint appears on a remote node: until that information reaches the sender, Cilium treats the address as outside the cluster and sends it unencrypted. Restricting egress to world closes the window, and so does strict mode egress, which enforces encryption for a configured IPv4 pod CIDR. Strict mode ingress, available with WireGuard only, drops cluster-internal pod traffic that did not arrive through the tunnel.

Encryption is separate from authentication. Cilium mutual authentication verifies workload identities with SPIFFE, and the documentation says encryption has to be enabled as well to meet typical service-to-service security requirements.