Cilium Transparent Encryption

Related ticket: PLA-4576

Overview

Cilium supports transparent encryption of Cilium-managed host traffic and traffic between Cilium-managed endpoints using either IPsec or WireGuard.

Why WireGuard over IPsec?

We chose WireGuard for the following reasons:

1. Better Performance - WireGuard has lower CPU overhead and higher throughput compared to IPsec
2. Simpler Key Management - WireGuard handles key rotation automatically; no manual key management required
3. Node-to-Node Encryption - Encrypts traffic between all nodes (with automatic exclusion of control-plane nodes to ensure workers can always reach the Kubernetes API to update their WireGuard public keys)
4. Modern Codebase - Smaller attack surface with ~4,000 lines of code vs ~400,000 for IPsec

Prerequisites

• Linux kernel version >= 5.6 (for in-kernel WireGuard support)

Installation in Inference Clusters

Since Kommodity clusters are bootstrapped with Cilium already installed, we need to manage it via ArgoCD to enable encryption.

Step 1: Create the ArgoCD App Configuration

Create the app directory at environments/<env>-par02/infra/apps/cilium/ with a config.json that points to the same Helm chart repository and version as the pre-installed Cilium:

{
  "appName": "cilium",
  "releaseName": "cilium",
  "chart": {
    "repository": "https://helm.cilium.io",
    "name": "cilium",
    "tag": "1.18.4"
  },
  "destination": {
    "namespace": "kube-system"
  }
}

Important Notes:

• The repository must be an HTTPS URL (not OCI). If omitted, it defaults to OCI format.
• The releaseName and namespace must match the existing installation exactly.

Step 2: Configure Encryption Values

Add the encryption configuration to your values file (typically in config/services/cilium/base/values.yaml or environment-specific overrides):

encryption:
  enabled: true
  type: wireguard
  nodeEncryption: true
  strictMode:
    egress:
      enabled: true
      cidr: "100.65.0.0/16"  # Must match your Pod CIDR

Configuration Options:

Verification

Check WireGuard Status

Verify that WireGuard interfaces are created on each node:

# Check Cilium encryption status
kubectl -n kube-system exec -it ds/cilium -- cilium-dbg encrypt status

# Expected output should show:
# Encryption: Wireguard
# Wireguard:
#   Public key: <key>
#   Number of peers: <count>

Verify Node Keys

Each node should have a WireGuard public key annotation:

kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.annotations.network\.cilium\.io/wg-pub-key}{"\n"}{end}'

Test Encryption with Traffic Capture

# On a node, capture traffic on the WireGuard interface
tcpdump -i cilium_wg0 -n

# You should see encrypted traffic between pods/nodes

Disabling Node-to-Node Encryption (nodeEncryption)

On the Scaleway inference clusters (dev-par02, stg-par02, prd-par02) node-to-node (hostNetwork) encryption is disabled while pod-to-pod encryption remains active via strictMode.egress.cidr. The WireGuard crypto path is CPU-serialised per node pair and caps single-flow throughput at ~1.6 Gbps on H100 nodes, while the underlying Scaleway Private Network delivers ~8 Gbps. Disabling nodeEncryption lets hostNetwork workloads (notably Varehus, which uses hostNetwork: true) communicate with other nodes and egress the cluster at full line rate. All control-plane traffic (apiserver/etcd/kubelet/Talos) carries its own TLS/mTLS and is unaffected.

Related ticket: PLA-7554

References

• Cilium Encryption Documentation
• WireGuard Documentation
• Cilium WireGuard Troubleshooting