[CKNE Exam Prep] 4.2 — Implementing Node and Pod Level Encryption

In k8s, you can encrypt traffic at two layers. Cilium can do it at L3/L4 with WireGuard or IPsec, which is transparent to apps and needs no code changes.

Istio can do it at L7 with mTLS, which adds workload identity (SPIFFE) and authorization.

Encryption

Option 1: Wireguard (Pod + Node level)

• Supports pod <-> pod, and node <-> node (host network) traffic
• Prerequisites: kernel 5.6 or newer (or a WireGuard backport), and UDP 51871 open between all nodes.

  --set encryption.enabled=true \
  --set encryption.type=wireguard \
  --set encryption.nodeEncryption=true \
  --set encryption.strictMode.enabled=true \
  --set encryption.strictMode.cidr="10.0.0.0/8" \
  --set encryption.strictMode.allowRemoteNodeIdentities=true

• encryption.enabled and type=wireguard encrypt pod-to-pod traffic across nodes.
• nodeEncryption=true adds node-to-node and pod-to-node traffic. You
• strictMode drops any unencrypted pod traffic within that CIDR instead of silently sending it in cleartext. Set the CIDR to your pod CIDR.

then k -n kube-system rollout restart ds/cilium to apply changes

Validate:

kubectl -n kube-system exec ds/cilium -- cilium-dbg status | grep Encryption
# Encryption: Wireguard [NodeEncryption: Enabled, cilium_wg0 (Pubkey: ..., Port: 51871, Peers: N)]

kubectl -n kube-system exec ds/cilium -- cilium-dbg encrypt status

To confirm on the wire, run

Get Kyle Law’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

tcpdump -ni <primary host interface name, eg. enp1s0> udp port 51871

on a node while two pods on different nodes talk.

nginx → lxc → cilium_wg0 → [WireGuard encrypts] → enp1s0 → network
                                 ↑                   ↑
                      plaintext ends here    first time enp1s0
                                             touches the packet

You should see only WireGuard UDP, and tcpdump -ni eth0 tcp port <app-port> should show nothing crossing between nodes.

Related concepts:
VXLAN, pod traffic, NIC interfaces

TODO: further improve this with practical exercise

https://claude.ai/share/3773bc5e-7e4c-4eab-b293-656196584d84

Option 2: IPsec (pod-level only)

Use when you need FIPS-validated crypto or can’t run WireGuard.

(Author note: I don’t really feel like covering this section, kindly search yourself 😆)

Basically you need to generate a secret named cilium-ipsec-keys in kube-system namespace first, before changing encryption.type=ipsec on Cilium.

Option 3: Istio mTLS

For this, I’d cover in <4.4 — Implementing Pod-level Authentication and Authorization>

Yay, happy reading :)