Securing Data-in-Transit with Wireguard for Kubernetes Cluster
summary
Combines WireGuard and Calico eBPF to encrypt inter-node Kubernetes traffic, using WireGuard’s kernel interface (about 4,000 lines of code) for high-throughput UDP tunnels; Calico Felix automates keypair creation, allowed-IPs updates and re-applies configuration on node restart so ephemeral pod IPs don’t break routing. Demo uses netcat and tcpdump: payloads appear in plaintext before enabling and vanish after a one-line command enables node-to-node encryption. Limits: kernel support required, multi-cluster and cross-OS compatibility, and encryption is per-node (not intra-node).
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:05Calico and Kubernetes
- 2:31WireGuard basics
- 4:17Why encryption for data-in-transit matters
- 5:41WireGuard in Kubernetes
- 10:54Manual setup challenges
- 12:20Automating with Calico Felix
- 13:25Live demo: WireGuard encryption
- 18:19Scalability for WireGuard
- 20:34WireGuard control options
- 22:44Calico security policies
- 24:15Resources and next steps
- 24:58Open source vs commercial
- 26:44Q&A
related talks
29mSecuring Data-in-Transit with Wireguard for Kubernetes Cluster
35mFull Mesh Encryption in Kubernetes with WireGuard and Calico
52mImplementing holistic security for containers and Kubernetes
33mBuilding HA Multi-Cloud Clusters Using WireGuard as a Network Overlay
14mBeyond Traditional VPNs: WireGuard Mesh Networking for Kubernetes with Tailscale
26mSimplify Networking in Kubernetes with Consul and Wireguard
23mContainer and Kubernetes security policy design: 10 critical best practices
40mSecuring User to Service Access in Kubernetes