Calico Network Supports WireGuard Encryption

Calico supports WireGuard encryption for both IPv4 and IPv6 traffic, which can be independently enabled through parameters in the FelixConfiguration resource.

Installation Information

Installed by Default

Not Installed by Default

Glossary

Notes

1. When using the Calico network plugin and if WireGuard encryption is required, ensure that the natOutgoing parameter is set to true. By default, this parameter is correctly configured in Calico’s subnet when the cluster is created, so no additional configuration is needed.

2. WireGuard supports traffic encryption for both IPv4 and IPv6. If encryption is required for both IPv4 and IPv6 traffic, configurations must be made separately. For specific parameter configuration instructions, please refer to the Felix Configuration Guide , where wireguardEnabled and wireguardEnabledV6 parameters need to be configured.

3. If WireGuard is not installed by default on the system, refer to the WireGuard Installation Guide for manual installation. However, there may be cases where the manual installation of the WireGuard module fails.

4. Cross-node container network traffic will be encrypted. The encryption scope includes container networks from one host to another; communication between Pods within the same node and traffic between Pods and their residing node will not be encrypted.

Prerequisites

• WireGuard must be installed in advance on all nodes of the cluster. For details, please refer to the WireGuard Installation Documentation . Nodes without WireGuard installed do not support encryption.

Steps

1. Enable or disable IPv4 and IPv6 encryption.

   Note: The following commands must be executed in the CLI tool on the Master node where the nodes are located.

   • Enable IPv4 encryption only

     kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'

   • Enable IPv6 encryption only

     kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabledV6":true}}'

   • Enable both IPv4 and IPv6 encryption

     kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true,"wireguardEnabledV6":true}}'

   • Disable IPv4 and IPv6 encryption

     • Method 1: Execute the command in the CLI tool to disable encryption.

       kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":false,"wireguardEnabledV6":false}}'

     • Method 2: Modify the felixconfiguration configuration file to disable encryption.

       1. Execute the following command to open the felixconfiguration configuration file.

          kubectl get felixconfiguration -o yaml default

       2. Set the wireguardEnabled and wireguardEnabledV6 parameters to false to disable WireGuard encryption.

          apiVersion: crd.projectcalico.org/v1
          kind: FelixConfiguration
          metadata:
            annotations:
              projectcalico.org/metadata: '{"uid":"f5facabd-8304-46d6-81c1-f1816235b487","creationTimestamp":"2024-08-06T03:46:51Z"}'
            generation: 2
            name: default
            resourceVersion: "890216"
          spec:
            bpfLogLevel: ""
            floatingIPs: Disabled
            logSeverityScreen: Info
            reportingInterval: 0s
            wireguardEnabled: false        # Change to true to enable IPv4 encryption
            wireguardEnabledV6: false     # Change to true to enable IPv6 encryption

2. After the Calico WireGuard encryption configuration is completed, execute the following command to confirm the WireGuard encryption status. If IPv4 and IPv6 encryption are enabled, the presence of wireguardPublicKey or wireguardPublicKeyV6 under the Status field indicates successful activation; if IPv4 and IPv6 encryption are disabled, the absence of wireguardPublicKey or wireguardPublicKeyV6 in the corresponding fields indicates successful deactivation.

   calicoctl get node <NODE-NAME> -o yaml # Replace <NODE-NAME> with the node name.

   Output:

   Status:
       wireguardPublicKey: L/MUP9+Yxx/xxxxxxxxxxxx/xxxxxxxxxx =

Result Verification

This document uses IPv4 traffic verification as an example. IPv6 traffic verification is similar to IPv4 and will not be repeated here.

IPv4 Traffic Verification

1. After configuring WireGuard encryption, check the routing information to prioritize using the wireguard.cali interface for cross-node communication packet forwarding.

   root@test:~# ip rule   # View current routing rules
        0: from all lookup local
        99:  not from all fwmark 0x100000/0x100000 lookup 1    # For all packets not marked as 0x100000, use routing table 1 for routing lookup
        32766:  from all lookup main
        32767 :  from all lookup default
   
   root@test:~# ip route show table 1    # Display routing entries in routing table 1.
       10.3.138.0 dev wireguard.cali scope link
       10.3.138.0/26 dev wireguard.cali scope link
       throw 10.3.231.192
       10.3.236.128 dev wireguard.cali scope link     # Traffic to IP address 10.3.236.128 will be sent through the wireguard.cali interface
       10.3.236.128/26 dev wireguard.cali scope link
       throw 10.10.10.124/30
       10.10.10.200/30 dev wireguard.cali scope link
       throw 10.10.20.124/30
       10.10.20.200/30 dev wireguard.cali scope link
       throw
       10.13.138.0 dev wireguard.cali scope link
       10.13.138.0/26 dev wireguard.cali scope link
       throw 10.13.231.192/26
       10.13.236.128 dev wireguard.cali scope link
       10.13.236.128/26 dev wireguard.cali scope link
   
   root@test:~# ip r get 10.10.10.202    # Routing path from the current node to the target IP address 10.10.10.202
       10.10.10.202 dev wireguard.cali table 1 src 10.10.10.127 uid 0  cache   # When accessing the target IP address 10.10.10.202 from the current node, packets will be sent through the wireguard.cali interface, using routing table 1, and the source address will be set to 10.10.10.127
   
   
   root@test:~# ip route    # Display the main routing table
       default via 192.168.128.1 dev eth0 proto static
       10.3.138.0/26 via 10.3.138.0 dev vxlan.
       blackhole 10.3.231.193
       10.3.231.194
       10.3.231.195
       10.3.231.196
       10.3.231.197
       3.231.192/26 proto 80
       dev cali8dcd31cIdOO scope link
       dev cali3012b5b29b scope link
       dev calibeefea2ff87 scope link
       dev cali2b27d5e4053 scope link
       dev cali1a35dbdd639 scope link
       calico on link

2. Capture packets on the node to observe cross-node traffic.

   root@test:~# ip a s wireguard.cali    # View detailed information of the wireguard.cali network interface
       30: wireguard.cali: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1440 qdisc noqueue state UNKNOWN group default qlen 1000
       link/none
       inet 10.10.10.127/32 scope global wireguard.cali   # The IP address assigned to the wireguard.cali interface is 10.10.10.127
       valid_lft forever preferred_lft forever
   
   root@test:~# tcpdump -i wireguard.cali -nnve icmp   # Capture and display ICMP packets through wireguard.cali
       tcpdump: listening on wireguard.cali, link-type RAW (Raw IP), capture size 262144 bytes
       08:58:36.987559 ip: (tos 0x0, ttl 63, id 29731, offset 0, flags [DF], proto ICMP (1), length 84)
       10.10.10.125 > 10.10.10.202: ICMP echo request, id 1110, seq 0, length 64
       08:58:36.988683 ip: (tos 0x0, ttl 63, id 1800, offset 0, flags [none], proto ICMP (1), length 84)
       10.10.10.202 > 10.10.10.125: ICMP echo reply, id 1110, seq 0, length 64
       2 packets captured
       2 packets received by filter
       0 packets dropped by kernel

3. The test shows that IPv4 traffic is forwarded via the wireguard.cali interface.