Securing Data-in-Transit with Wireguard for Kubernetes Cluster
Talkat ContainerCon @ Open Source Summit Europe 2024 · on Wednesday, 2024-09-18· at 11:00· Room 0.14 (Level 0)·
summary
Calico uses WireGuard to encrypt inter‑node pod traffic by installing a kernel-space virtual network interface and distributing per-node keypairs and allowed‑IP lists via Felix so nodes have crypto key‑routing rather than per‑pod tunnels. WireGuard is ~4,000 lines, UDP‑based and performant; demo shows tcpdump readable payloads become unreadable after enabling encryption. A single-line command enables cluster‑wide WireGuard; challenges include kernel support, ephemeral pod IPs, node‑level (not intra‑node) encryption, and Typha for API scalability.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:05Calico and Kubernetes
- 2:31WireGuard basics
- 4:17Why encryption for data-in-transit matters
- 5:41WireGuard in Kubernetes
- 10:54Manual setup challenges
- 12:20Automating with Calico Felix
- 13:25Live demo: WireGuard encryption
- 18:19Scalability for WireGuard
- 20:34WireGuard control options
- 22:44Calico security policies
- 24:15Resources and next steps
- 24:58Open source vs commercial
- 26:44Q&A
related talks
29mSecuring Data-in-Transit with Wireguard for Kubernetes Cluster
35mFull Mesh Encryption in Kubernetes with WireGuard and Calico
52mImplementing holistic security for containers and Kubernetes
33mBuilding HA Multi-Cloud Clusters Using WireGuard as a Network Overlay
14mBeyond Traditional VPNs: WireGuard Mesh Networking for Kubernetes with Tailscale
26mSimplify Networking in Kubernetes with Consul and Wireguard
40mSecuring User to Service Access in Kubernetes
46mSemaphore