Learn Calico - Advanced Encryption & Network Security

#Introduction

Network policy controls who can talk to whom, but it does not protect the content of the conversation. On an untrusted physical or cloud network, traffic between nodes can be intercepted. Episode 15 closes this gap with WireGuard: end-to-end encryption for node-to-node traffic managed directly by Calico.

Complete network security is the combination of three things: authentication (who), authorization (what they may do), and confidentiality (the content stays encrypted). Policy handles the first two; WireGuard completes the last one.

#WireGuard in Calico

#What WireGuard Hardens

WireGuard encrypts traffic between two Calico nodes. Every pod packet that crosses a node — pod-to-pod, pod-to-node, or pod-to-external — is wrapped in a WireGuard tunnel using modern cryptography. This is extremely useful on untrusted networks, for example between clouds or on operator networks.

#Enabling WireGuard

WireGuard is enabled through FelixConfiguration:

kubectl patch felixconfiguration default --type merge \
  -p '{"spec":{"wireguardEnabled":true}}'

If you are using encapsulation mode (episode 9), WireGuard can be enabled for both:

kubectl patch felixconfiguration default --type merge \
  -p '{"spec":{"wireguardEnabled":true,"wireguardEnabledVXLAN":true}}'

wireguardEnabledVXLAN: true encrypts the VXLAN tunnel. Without this flag, only non-encapsulated traffic is encrypted.

#Verifying the Interface

Once enabled, each node gets a WireGuard interface:

kubectl exec -n calico-system ds/calico-node -- ip link show wg-calico
calicoctl get felixconfiguration default -o yaml | grep -i wireguard

The wg-calico interface appearing on every node means encryption is active. Grepping for "wireguard" in the configuration shows the status of all related options.

#WireGuard and Encapsulation

#Two Tunnel Layers

When IPIP or VXLAN is active and WireGuard is on, pod packets go through two layers of wrapping: first encapsulation (for routing), then WireGuard (for encryption). Header overhead increases, but security is layered. On networks already encrypted by the platform, this second layer can be turned off to save MTU and CPU.

#MTU After Encryption

WireGuard adds around 60 bytes of header. Adjust the MTU so packets are not fragmented:

kubectl patch felixconfiguration default --type merge \
  -p '{"spec":{"wireguardMTU":1340}}'

wireguardMTU: 1340 accounts for the WireGuard header plus the tunnel, a common figure on 1500 MTU networks. If applications start seeing slow or broken connections, MTU is the first suspect.

#Layered Security Posture

#Three Layers of Defense

A mature posture combines three layers:

• Network layer: L3/L4 policy — default deny, microsegmentation (episode 13).
• Host layer: HostEndpoint, locked-down management ports (episode 14).
• Workload layer: per-application policy, tier labels, ALP L7 (episode 12).

#Security Matrix for Production Clusters

The table below summarizes the controls that should be in place:

Area              Control                          Episode
Default deny      GlobalNetworkPolicy all()        6
Microsegmentation NetworkPolicy per tier           13
Node              HostEndpoint + locked ports      14
Encryption        WireGuard node-to-node           15
Egress            EgressGatewayPolicy              10
DNS/L7            FQDN + ALP                       11-12

Go through each one against your cluster; whatever is missing is your next priority.

#A Safe Rollout Order

Applying security in stages avoids service disruption:

calicoctl get globalnetworkpolicy -o wide
kubectl patch felixconfiguration default --type merge \
  -p '{"spec":{"wireguardEnabled":true}}'
kubectl get tigerastatus | grep -iE "calico-node|felix"
kubectl get pods -A | grep -v Running | head

Enable one control per change, verify no workload is down, then move on to the next control. kubectl get pods -A | grep -v Running is a fast alarm for detecting damage.

#Verifying End-to-End Encryption

#Proving Packets Are Encrypted

The most convincing method: capture packets on the wire and check whether the original contents are visible:

kubectl exec -n calico-system ds/calico-node -- sh -c \
  "tcpdump -i any -c 20 -n port 51820 2>/dev/null | head"

Calico's default WireGuard port is 51820. If inter-node traffic flows on this port, encryption is active. Without WireGuard, pod packets are visible in plaintext on the network.

#Checking Per-Interface Statistics

kubectl exec -n calico-system ds/calico-node -- sh -c \
  "cat /sys/class/net/wg-calico/statistics/rx_bytes"

A number that keeps growing means encrypted traffic is flowing.

#Wrap-Up

Episode 15 completes the third pillar of network security: WireGuard encrypts node-to-node traffic, the MTU is tuned for the tunnel layers, and a layered security posture unifies network, host, and workload.

Key takeaways:

• WireGuard adds confidentiality; policy still handles authorization.
• Enable it via wireguardEnabled and wireguardEnabledVXLAN in FelixConfiguration.
• The wg-calico interface and port 51820 are signs encryption is active.
• WireGuard plus encapsulation adds overhead; adjust wireguardMTU.
• A mature posture = network + host + workload, all three running.
• Apply controls one at a time and watch for alarms at each step.

Next, in episode 16, we cover multi-cluster and federation — BGP peering between clusters, the cross-cluster security model, and how to manage global policy consistently across distributed clusters.