Cilium: Up and Running

Chapter 14. Transparent Encryption

Cilium’s Transparent Encryption feature is capable of encrypting traffic as it transits between Cilium managed endpoints. It’s called transparent because it is not visible to the pods on each end and requires no coordination from the workloads themselves. Cilium encrypts packets as they leave the source node and decrypts them as they enter the destination node. It handles all aspects of the process, including key distribution and management.

Transparent Encryption can use either WireGuard or IPsec as the underlying encryption technology. Both of these are industry-standard encapsulation methods. We’ll use WireGuard in this chapter, but IPsec has similar concepts and the same flows are encrypted with both. IPsec mode takes more work to set up, requiring the administrator to create shared secrets and configure encryption algorithms, but if you have regulatory reasons to require specific algorithms or key lengths it may be an attractive alternative to WireGuard’s automatic configuration.

You can find all the YAML manifests you will use in this chapter, along with several convenient scripts, in the chapter14 directory of the book’s GitHub repository.

Use Cases

The two primary use cases for Transparent Encryption are to meet a compliance requirement for in-flight encryption or as part of an overall security posture. The two motivations often coexist. We recommend keeping focused on what you are specifically protecting against instead of enabling ...