2 lines
3.6 KiB
HTML
2 lines
3.6 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 23: Cilium WireGuard encryption</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0023 · 35 minutes · Minimize Microservice Vulnerabilities</p><h1>Encrypt Pod-to-Pod traffic with Cilium WireGuard</h1><p class="lede">NetworkPolicy controls who may communicate. Transparent encryption controls whether traffic can be read while it travels between nodes. They solve different security problems and commonly work together.</p><div class="callout"><strong>Exam reflex:</strong> identify the encryption scope before enabling options. Default WireGuard encryption protects traffic between Cilium-managed Pods on different nodes; node-to-node encryption is a separate option and is not required here.</div><h2>Timed task: 25 minutes</h2><p>Read <code>lab/lesson-23-cilium-scenario.md</code>. Create <code>lab/lesson-23-answer.md</code> with these four items:</p><ol><li>One exact <code>helm upgrade</code> command that retains the existing release values while enabling transparent WireGuard encryption for Cilium 1.19.6.</li><li>The required firewall change, including protocol and port.</li><li>Two preflight checks you would run before changing the cluster.</li><li>Two post-change validation commands, and what each confirms.</li></ol><p>Do not enable node-to-node encryption. Do not propose IPsec, a CNI change, or CNI-chaining MTU settings; the scenario does not require them.</p><h2>Expected reasoning</h2><p>For this scenario, WireGuard’s required Helm options enable transparent encryption and select the WireGuard implementation. The nodes must reach one another on WireGuard’s UDP port <code>51871</code>. WireGuard keys are generated per node and distributed through Cilium’s Kubernetes resources; do not create a shared Kubernetes Secret for them.</p><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>Does Cilium WireGuard encrypt traffic between two Pods that are scheduled on the same node?</p><label><input type="radio" name="q" value="no">No. Same-node traffic is not encrypted by the inter-node WireGuard tunnel.</label><label><input type="radio" name="q" value="yes">Yes. Every Pod-to-Pod packet always enters a WireGuard tunnel.</label><label><input type="radio" name="q" value="policy">Only if a NetworkPolicy allows it.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use Cilium’s official <a href="https://docs.cilium.io/en/stable/security/network/encryption-wireguard/">WireGuard transparent encryption</a> guide. Confirm the Helm settings, kernel prerequisite, port, scope, and validation procedure.</p><h2>What to send me</h2><p>Paste your four-item rollout note. I’ll review it one issue at a time, without giving the next answer early.</p><footer>Previous: <a href="0022-kube-apiserver-hardening.html">API server hardening</a> · CKS domain: Minimize Microservice Vulnerabilities</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='no'){f.textContent='Correct. Inter-node encryption does not add protection for traffic that never leaves the node.';f.className='feedback good';}else{f.textContent='Not quite. WireGuard encrypts traffic travelling between nodes; same-node traffic does not use that tunnel.';f.className='feedback bad';}}</script></body></html>
|