Encryption

Cilium is able to encrypt traffic between pods on different nodes, but does not encrypt traffic between pods on the same node (which makes complete sense). Cilium supports ipsec and wireguard

To enable ipsec encryption

• You need to first create a secret for the keys
  • $ kubectl create -n kube-system secret generic cilium-ipsec-keys \ --from-literal=keys="3+ rfc4106(gcm(aes)) $(dd if=/dev/urandom count=20 bs=1 2> /dev/null | xxd -p -c 64) 128"
  • OR using the cilium cli $ cilium encrypt create-key --auth-algo rfc4106-gcm-aes
• Then enable encryption.enabled=true helm value and optionally set
• Restart the agent ds and operator deployment

Enable Wireguard Encryption

• Then enable encryption.enabled=true and encryption.type=wireguard helm value
• Restart the agent ds and operator deployment

Check encryption status

λ homelab (main) $ k exec -it cilium-pr52d -- cilium-dbg encrypt status
Encryption: Disabled