Lesson 0023 · 35 minutes · Minimize Microservice Vulnerabilities

Encrypt Pod-to-Pod traffic with Cilium WireGuard

NetworkPolicy controls who may communicate. Transparent encryption controls whether traffic can be read while it travels between nodes. They solve different security problems and commonly work together.

Exam reflex: identify the encryption scope before enabling options. Default WireGuard encryption protects traffic between Cilium-managed Pods on different nodes; node-to-node encryption is a separate option and is not required here.

Timed task: 25 minutes

Read lab/lesson-23-cilium-scenario.md. Create lab/lesson-23-answer.md with these four items:

  1. One exact helm upgrade command that retains the existing release values while enabling transparent WireGuard encryption for Cilium 1.19.6.
  2. The required firewall change, including protocol and port.
  3. Two preflight checks you would run before changing the cluster.
  4. Two post-change validation commands, and what each confirms.

Do not enable node-to-node encryption. Do not propose IPsec, a CNI change, or CNI-chaining MTU settings; the scenario does not require them.

Expected reasoning

For this scenario, WireGuard’s required Helm options enable transparent encryption and select the WireGuard implementation. The nodes must reach one another on WireGuard’s UDP port 51871. WireGuard keys are generated per node and distributed through Cilium’s Kubernetes resources; do not create a shared Kubernetes Secret for them.

Retrieval check

Question

Does Cilium WireGuard encrypt traffic between two Pods that are scheduled on the same node?

Documentation target

Use Cilium’s official WireGuard transparent encryption guide. Confirm the Helm settings, kernel prerequisite, port, scope, and validation procedure.

What to send me

Paste your four-item rollout note. I’ll review it one issue at a time, without giving the next answer early.