Learn WireGuard - Kubernetes Integration

#Introduction

In the Kubernetes world, traffic between pods passes over the node network — and that network can be traversed by attackers on the same physical network. The modern answer is transparently encrypting inter-node traffic, and several CNIs choose WireGuard as their encryption engine.

Episode 18 covers how WireGuard is integrated into Kubernetes: the WireGuard backend in Flannel, WireGuard encryption in Calico and Cilium, and how interfaces and keys are managed per node.

#The WireGuard Backend in Flannel

#Inter-Node Overlay Encryption

Flannel provides several backends for connecting pods between nodes, and one of them is WireGuard. With this backend, every node runs a WireGuard interface, and inter-node overlay traffic is encrypted.

Enable the WireGuard backend by changing the Flannel configuration:

net-conf.json: |
  {
    "Network": "10.244.0.0/16",
    "Backend": {
      "Type": "wireguard"
    }
  }

Flannel automatically generates keys per node and distributes public keys between nodes — you do not need to manage peers manually like in a classic deployment.

#Calico with WireGuard Encryption

#Transparent Pod-to-Pod Encryption

Calico offers WireGuard encryption for pod traffic between nodes. When enabled, Calico creates a wireguard.cali interface on every node, and all inter-node traffic passing through this interface is encrypted.

Enable it via the installation values:

installation:
  encapsulation:
    type: VXLAN
  encryption:
    type: Wireguard

Key management is handled entirely by Calico through Kubernetes: node public keys are stored as resources, and only authenticated nodes can take part in the encrypted network.

#Policy Alongside Encryption

Calico's advantage is that network policy still works fully on top of the encryption. In other words, NetworkPolicy rules decide who may talk to whom, and WireGuard ensures that conversation is encrypted — two complementary layers.

#Cilium with Transparent Encryption

#WireGuard Under Cilium

Cilium encrypts pod traffic between nodes with WireGuard transparently. Install Cilium with the WireGuard feature enabled:

cilium install --enable-wireguard=true

cilium install --enable-wireguard=true configures Cilium so that every node has a WireGuard interface and all inter-node traffic is encrypted automatically. No application changes are needed — encryption happens at the data plane layer.

#Key Management by Cilium

Cilium manages WireGuard keys through Kubernetes and the Cilium agent on every node. Public keys are exchanged between nodes securely, and Cilium policies are still enforced on top of the encrypted tunnel.

#The DaemonSet VPN Pattern

#Building a Tunnel to an External Network

Beyond inter-node encryption, Kubernetes is also often used to connect a cluster to an external network — for example, the office network. The pattern is a DaemonSet running WireGuard on every node:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: wg-client
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: wg-client
  template:
    metadata:
      labels:
        app: wg-client
    spec:
      hostNetwork: true
      containers:
        - name: wg-client
          image: linuxserver/wireguard
          securityContext:
            privileged: true
          volumeMounts:
            - name: config
              mountPath: /config
      volumes:
        - name: config
          configMap:
            name: wg-client-config

hostNetwork: true puts the WireGuard tunnel in the node's network namespace, so any pod can use it through normal routing. The client configuration is distributed as a ConfigMap.

#Closing

Episode 18 completed the Kubernetes integration: Flannel uses WireGuard as an overlay backend, Calico and Cilium provide transparent inter-node encryption, and a DaemonSet builds a tunnel to an external network.

Key takeaways:

• Flannel has a WireGuard backend for inter-node overlay encryption.
• Calico encrypts pod traffic between nodes through the wireguard.cali interface.
• Cilium enables WireGuard encryption with a single install flag.
• Per-node keys are managed automatically by the CNI.
• A DaemonSet with hostNetwork: true builds a per-node tunnel.
• Encryption runs transparently without application changes.

In episode 19 we cover high availability and resilience — keepalived with VRRP for endpoint failover, route injection via BGP with BIRD and GoBGP, dynamic endpoint updates, and disaster recovery strategies.