Full Mesh Encryption in Kubernetes with WireGuard and Calico
summary
Calico configures WireGuard interfaces per node and maps WireGuard peers to nodes and allowed IPs to pod IPs to create an eventual-consistent host-to-host encrypted mesh; setup happens by patching the Felix CRD to enable with one command. WireGuard runs in Linux 5.6+ and uses the wg tool; results show about a 30% CPU increase but roughly 6x throughput versus IPsec. Known limits: same-node pod traffic stays unencrypted, IPv6 and preflight checks are incomplete, and a few race conditions remain.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:17Agenda
- 2:27Encryption in Kubernetes
- 4:34Service Mesh
- 5:29No Service Mesh
- 5:55Calico
- 7:27Calico Architecture
- 9:02WireGuard
- 13:26Calico and WireGuard
- 16:58Summary
- 18:50WireGuard AKS
- 21:21Ease of Configuration
- 22:15Performance
- 24:15Future work
- 27:53QA
related talks
29mSecuring Data-in-Transit with Wireguard for Kubernetes Cluster- 29mSecuring Data-in-Transit with Wireguard for Kubernetes Cluster
52mImplementing holistic security for containers and Kubernetes
14mBeyond Traditional VPNs: WireGuard Mesh Networking for Kubernetes with Tailscale
26mSimplify Networking in Kubernetes with Consul and Wireguard
33mBuilding HA Multi-Cloud Clusters Using WireGuard as a Network Overlay
23mContainer and Kubernetes security policy design: 10 critical best practices
46mSemaphore