Learn Cilium - Encryption & Zero Trust Networking

#Introduction

Imagine a cluster where inter-node traffic flows in plaintext across the physical network — anyone who can access that network can read all communication between pods. Episode 14 closes this gap with transparent encryption: Cilium encrypts inter-node traffic without changing your workloads, images, or application code at all.

Cilium supports two implementations: WireGuard — native and modern, and IPsec — the classic, more widely known approach. We will look at how to enable both, how to verify them with Hubble and cilium encrypt status, and how this completes the zero trust strategy that started with identity in episode 5.

The most common question about encryption is performance: how much overhead do you pay? The answer depends on the implementation and the hardware, but it is generally far smaller than people fear. Because encryption runs in the kernel, its overhead can be measured directly by comparing cilium connectivity test results before and after enabling it.

#Native, Transparent WireGuard

WireGuard is a modern VPN protocol that Cilium implements directly as part of the dataplane. WireGuard works at the kernel level with high speed and audited cryptography. "Native" means it is integrated into Cilium's data path; "transparent" means pods do not need to know their traffic is encrypted — applications still talk to their destination IPs as usual.

Enable WireGuard encryption at install or upgrade time:

helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --set encryption.enabled=true \
  --set encryption.type=wireguard

--set encryption.enabled=true enables encryption and encryption.type=wireguard selects the implementation. After the upgrade, Cilium automatically builds WireGuard tunnels between nodes that load eBPF programs.

#When WireGuard Applies

WireGuard in Cilium works at the node-to-node level: all inter-node traffic is encrypted, including traffic between pods on different nodes. Traffic within the same node (pod to pod on the same node) never crosses the network, so it does not need encryption. This is why total encrypted traffic is usually smaller than total cluster traffic — and that is exactly as it should be.

It is also worth understanding that Cilium WireGuard is not a manual tunnel. Cilium manages the WireGuard interface automatically: creating, configuring, and removing connections between nodes without any intervention from you. You only need to enable the feature; day-to-day operations are handled by the agent.

#IPsec

IPsec is the older, more widely known alternative. Cilium supports IPsec with ES (Encryption on the datapath) implemented in the kernel. IPsec suits environments already familiar with the protocol, or those with compliance requirements that mandate IPsec.

Enabling IPsec is similar, just with a different type:

helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --set encryption.enabled=true \
  --set encryption.type=ipsec

encryption.type=ipsec selects the IPsec path. Note that IPsec generally adds slightly higher overhead than WireGuard because of its more complex cryptographic flow. For performance and simplicity, WireGuard is usually the better choice.

If you choose IPsec, pay attention to key management. Cilium manages IPsec keys through a Kubernetes secret, and key rotation is part of routine operations that must be planned. WireGuard, by contrast, does not require the same kind of key management because it uses per-node public keys managed automatically by Cilium.

#Transparent Encryption for Workloads

This is what makes the feature so valuable: no changes on the workload side. Pods need no certificates, no TLS configuration, no restart with a new image. Encryption happens at the node level: packets leaving the source node are already encrypted, and are decrypted when they arrive at the destination node. From the pod's point of view, communication still looks like ordinary plaintext traffic.

This differs from mTLS in a service mesh (episode 15), which works at the application level and requires a proxy. Cilium encryption protects all inter-node traffic — including traffic that does not pass through a proxy — at a much lower overhead cost.

Another point worth making clear: encryption protects data in transit between nodes, but it does not replace TLS between services. Traffic between two pods on the same node is not encrypted by WireGuard, and traffic coming in from the internet must still be secured with ordinary TLS. Cilium encryption is the foundation layer, while application TLS is the layer on top.

#Verification with Hubble and cilium encrypt status

To prove that encryption is active, run the status command:

cilium encrypt status

cilium encrypt status shows the active encryption mode and the number of WireGuard interfaces (or the IPsec status). If it shows the number of connected nodes, inter-node encryption is up and running.

On the observability side, Hubble marks encrypted traffic with a special flag. Observe inter-node flows:

hubble observe --type trace --since 10m

hubble observe --type trace --since 10m shows trace flows; encrypted lines will show an encrypted flag in the info section. To compare the performance impact, run cilium connectivity test once with and once without encryption — the throughput difference gives you a picture of encryption's cost in your cluster.

To monitor encryption health over the long term, integrate the output of cilium encrypt status into your monitoring. A number of WireGuard interfaces that does not match the number of nodes is an early sign of trouble — for example, a new node that has not built its tunnel yet. A simple alert like this can save you from traffic silently running in plaintext.

#Choosing Between WireGuard and IPsec

The decision between WireGuard and IPsec is usually driven by two things: compliance requirements and your team's operations. Let's compare them directly:

The table above is a starting point, not a final decision. Measure for yourself in your cluster: enable WireGuard, run cilium connectivity test, note the throughput, do the same for IPsec, and compare. Numbers from your own measurements are always more valuable than estimates from documentation.

For IPsec, make sure the key secret is managed correctly:

kubectl get secret -n kube-system cilium-ipsec-keys
kubectl get secret -n kube-system cilium-ipsec-keys -o yaml | grep -c keys

kubectl get secret -n kube-system cilium-ipsec-keys shows the secret Cilium uses for IPsec. If the secret is missing or incomplete, IPsec encryption will not run even if encryption.type=ipsec is configured. Key rotation is done by updating the secret and then restarting the agent — schedule it as routine operations.

One last note that is often forgotten: when you add a new node to a cluster that already encrypts, that node automatically joins the WireGuard mesh. There are no extra manual steps. This is why many teams choose WireGuard for clusters that keep growing — its operational scalability costs almost nothing extra.

#Closing

Key takeaways:

• Transparent encryption protects inter-node traffic without changing workloads.
• WireGuard is the native, modern option and is generally faster.
• IPsec is the classic alternative for compliance needs.
• encryption.enabled=true and encryption.type are configured via Helm.
• cilium encrypt status proves encryption is active.
• Hubble marks encrypted flows for observability.

In the next episode 15, we will cover the Cilium service mesh and the Gateway API — a sidecarless architecture based on Envoy and ztunnel, identity-based mTLS, L7 routing, HTTPRoute and TLSRoute implementations, and integration with existing clusters. This is where Cilium's networking, security, and observability come together into a complete platform.