Cilium
Hard
Security
How are encryption keys distributed when Cilium's transparent encryption uses WireGuard, compared with IPsec?
Select your answer:
Show answer and explanation
Answer: WireGuard: per-node keys shared via CiliumNode. IPsec: a key in a Secret
Explanation
For WireGuard, each node creates a key pair and announces its public key in the network.cilium.io/wg-pub-key annotation on its CiliumNode resource. Peers read it from there, so there's no shared secret to manage. IPsec mode reads its keys from a Secret, usually cilium-ipsec-keys, which you create and rotate yourself.
More hard Cilium questions
- Which command lists only the flows that Cilium dropped, for example because of a network policy?
- How can you roll out a new Cilium network policy without risking dropped traffic?
- You want a Cilium policy that limits which traffic can reach the Kubernetes nodes themselves. Which resource and selector do you use?
- Which of these is required to connect two clusters with Cilium ClusterMesh?
- How do you make a Service load-balance across all clusters in a Cilium ClusterMesh?
- How does Cilium's Bandwidth Manager enforce the kubernetes.io/egress-bandwidth annotation on a pod?