From Eventual to Strict Encryption – Securing Cilium’s WireGuard Encryption - Leonard Cohnen
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2023-11-09

From Eventual to Strict Encryption – Securing Cilium’s WireGuard Encryption - Leonard Cohnen, Edgeless Systems

Cilium's routing and encryption decisions are based upon endpoint identities. Those identities are distributes via Kubernetes CRDs. If an application sends traffic to another pod inside the cluster, it is only encrypted if the destination's identity has propagated to the node on which the application runs. Depending on the configuration this could result in Pod-to-Pod traffic being sent unencrypted over the wire for multiple seconds. To mitigate this issue we developed and upstreamed a new WireGuard strict mode which we'll present in this talk.