---
title: "Encrypt in-cluster pod traffic"
description: "Turn on WireGuard encryption between pods on a Calico Open Source cluster for state-of-the-art cryptographic protection of in-cluster traffic."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico/latest/network-policy/encrypt-cluster-pod-traffic"
---

# Encrypt in-cluster pod traffic

## Big picture

Enable WireGuard to secure on-the-wire, in-cluster pod traffic in a Calico cluster.

## Value

When this feature is enabled, Calico automatically creates and manages WireGuard tunnels between nodes providing transport-level security for inter-node, in-cluster pod traffic. WireGuard provides [formally verified](https://www.wireguard.com/formal-verification/) secure and [performant tunnels](https://www.wireguard.com/performance/) without any specialized hardware. For a deep dive in to WireGuard implementation, see this [white paper](https://www.wireguard.com/papers/wireguard.pdf).

# Concepts

## About WireGuard

Calico supports both inter-node pod traffic, and inter-node, host-network traffic. Because Calico is not implemented using a sidecar, traffic is not encrypted for the full journey from one pod to another; traffic is only encrypted on the host-to-host portion of the journey. Though there is unencrypted traffic between the host-to-pod portion of the journey, attackers cannot easily intercept this traffic. To intercept the unencrypted traffic, they would need root access to the node.

Calico supports WireGuard encryption for both IPv4 and IPv6 traffic. You can enable traffic independently using parameters in the FelixConfiguration resource:

- `wireguardEnabled` - enables encrypting IPv4 traffic over an IPv4 underlay network
- `wireguardEnabledV6` - enables encrypting IPv6 traffic over an IPv6 underlay network

## Before you begin...

**Terminology**

- Inter-node pod traffic: Traffic leaving a pod from one node destined to a pod on another node
- Inter-node, host-network traffic: traffic generated by the node itself or a host-networked-pod destined to another node or host-networked-pod
- Same-node pod traffic: Traffic between pods on the same node

**Supported encryption**

- Inter-node pod traffic: IPv4 only
- Inter-node, host-network traffic, IPv4/IPv6: supported only on managed clusters deployed on EKS and AKS

**Unsupported**

- Encrypted same-node pod traffic
- GKE
- Using your own custom keys to encrypt traffic

**Required**

- On all nodes in the cluster that you want to participate in Calico encryption, verify that the operating system(s) on the nodes are [installed with WireGuard](https://www.wireguard.com/install/).

  > **SECONDARY:** Some node operating systems do not support WireGuard, or do not have it installed by default. Enabling Calico WireGuard encryption does not require all nodes to be installed with WireGuard. However, traffic to or from a node that does not have WireGuard installed will not be encrypted.

- IP addresses for every node in the cluster. This is required to establish secure tunnels between the nodes. Calico can automatically do this using [IP autodetection methods](https://docs.tigera.io/calico/latest/networking/ipam/ip-autodetection.md).

## How to

- [Install WireGuard](#install-wireguard)
- [Enable WireGuard for a cluster](#enable-wireguard-for-a-cluster)
- [Disable WireGuard for an individual node](#disable-wireguard-for-an-individual-node)
- [Verify configuration](#verify-configuration)
- [Disable WireGuard for a cluster](#disable-wireguard-for-a-cluster)

### Install WireGuard

WireGuard is included in Linux 5.6+ kernels, and has been backported to earlier Linux kernels in some Linux distributions.

Install WireGuard on cluster nodes using [instructions for your operating system](https://www.wireguard.com/install/). Note that you may need to reboot your nodes after installing WireGuard to make the kernel modules available on your system.

Use the following instructions for these platforms that are not listed on the WireGuard installation page, before proceeding to [enabling WireGuard](#enable-wireguard-for-a-cluster).

<!-- tabs -->

**Tab: EKS**

To install WireGuard on the default Amazon Machine Image (AMI):

```bash
   sudo yum install kernel-devel-`uname -r` -y
   sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm -y
   sudo curl -o /etc/yum.repos.d/jdoss-wireguard-epel-7.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
   sudo yum install wireguard-dkms wireguard-tools -y
```

**Tab: AKS**

AKS cluster nodes run Ubuntu with a kernel that has WireGuard installed already, so there is no manual installation required.

**Tab: OpenShift**

To install WireGuard for OpenShift v4.8:

1. Install requirements:

   - [CoreOS Butane](https://coreos.github.io/butane/getting-started/)
   - [OpenShift CLI](https://docs.openshift.com/container-platform/4.2/cli_reference/openshift_cli/getting-started-cli.html)

2. Download and configure the tools needed for kmods.

```bash
FAKEROOT=$(mktemp -d)
git clone https://github.com/tigera/kmods-via-containers
cd kmods-via-containers
make install FAKEROOT=${FAKEROOT}
cd ..
git clone https://github.com/tigera/kvc-wireguard-kmod
cd kvc-wireguard-kmod
make install FAKEROOT=${FAKEROOT}
cd ..
```

1. Configure/edit `${FAKEROOT}/root/etc/kvc/wireguard-kmod.conf`.

   a. You must then set the URLs for the `KERNEL_CORE_RPM`, `KERNEL_DEVEL_RPM` and `KERNEL_MODULES_RPM` packages in the conf file `$FAKEROOT/etc/kvc/wireguard-kmod.conf`. Obtain copies for `kernel-core`, `kernel-devel`, and `kernel-modules` rpms from [RedHat Access](https://access.redhat.com/downloads/content/package-browser) and host it in an http file server that is reachable by your OCP workers.

   b. For help configuring `kvc-wireguard-kmod/wireguard-kmod.conf` and WireGuard version to kernel version compatibility, see the [kvc-wireguard-kmod README file](https://github.com/tigera/kvc-wireguard-kmod#quick-config-variables-guide).

2. Get RHEL Entitlement data from your own RHEL8 system from a host in your cluster.

   ```bash
   tar -czf subs.tar.gz /etc/pki/entitlement/ /etc/rhsm/ /etc/yum.repos.d/redhat.repo
   ```

3. Copy the `subs.tar.gz` file to your workspace and then extract the contents using the following command.

   ```bash
   tar -x -C ${FAKEROOT}/root -f subs.tar.gz
   ```

4. Transpile your machine config using [CoreOS Butane](https://coreos.github.io/butane/getting-started/).

   ```bash
   cd kvc-wireguard-kmod
   make ignition FAKEROOT=${FAKEROOT} > mc-wg.yaml
   ```

5. With the KUBECONFIG set for your cluster, run the following command to apply the MachineConfig which will install WireGuard across your cluster.

   ```bash
   oc create -f mc-wg.yaml
   ```

<!-- /tabs -->

### Enable WireGuard for a cluster

<!-- tabs -->

**Tab: Operator**

Enable IPv4 WireGuard encryption across all the nodes using the following command.

```bash
kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
```

Enable IPv6 WireGuard encryption across all the nodes using the following command.

```bash
kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabledV6":true}}'
```

To enable both IPv4 and IPv6 WireGuard encryption across all the nodes, use the following command.

```bash
kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true,"wireguardEnabledV6":true}}'
```

**Tab: Manifest**

Enable IPv4 WireGuard encryption across all the nodes using the following command.

```bash
calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
```

Enable IPv6 WireGuard encryption across all the nodes using the following command.

```bash
calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabledV6":true}}'
```

To enable both IPv4 and IPv6 WireGuard encryption across all the nodes, use the following command.

```bash
calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true,"wireguardEnabledV6":true}}'
```

**Perform the next step for EKS and AKS clusters only, and only if your cluster is using the cloud provider CNI plugin and not Calico CNI.** Enable WireGuard encryption for inter-node, host-network traffic using the following command.

```bash
calicoctl patch felixconfiguration default --type='merge' -p '{"spec": {"wireguardHostEncryptionEnabled": true}}'
```

<!-- /tabs -->

For OpenShift, add the Felix configuration with WireGuard enabled [under custom resources](https://docs.tigera.io/calico/latest/getting-started/kubernetes/openshift/installation.md#optionally-provide-additional-configuration).

> **SECONDARY:** The above command can be used to change other WireGuard attributes. For a list of other WireGuard parameters and configuration evaluation, see the [Felix configuration](https://docs.tigera.io/calico/latest/reference/resources/felixconfig.md#felix-configuration-definition).

We recommend that you review and modify the MTU used by Calico networking when WireGuard is enabled to increase network performance. Follow the instructions in the [Configure MTU to maximize network performance](https://docs.tigera.io/calico/latest/networking/configuring/mtu.md) guide to set the MTU to a value appropriate for your network.

### Disable WireGuard for an individual node

To disable WireGuard on a specific node with WireGuard installed, modify the node-specific Felix configuration. e.g., to turn off encryption for traffic on node `my-node`, use the following command. This command disables WireGuard for both IPv4 and IPv6, modify it accordingly if disabling only either IP version:

```bash
cat <<EOF | kubectl apply -f -
apiVersion: projectcalico.org/v3
kind: FelixConfiguration
metadata:
  name: node.my-node
spec:
  logSeverityScreen: Info
  reportingInterval: 0s
  wireguardEnabled: false
  wireguardEnabledV6: false
EOF
```

With the above command, Calico will not encrypt any of the traffic to or from node `my-node`.

To enable encryption for IPv4 and IPv6 inter-node pod traffic on node `my-node` again, patch this node's FelixConfiguration (modify accordingly if only dealing with IPv4 or IPv6):

```bash
calicoctl patch felixconfiguration node.my-node --type='merge' -p '{"spec":{"wireguardEnabled":true,"wireguardEnabledV6":true}}'
```

### Verify configuration

To verify that the nodes are configured for WireGuard encryption, check the node status set by Felix using `calicoctl`. For example:

```bash
     calicoctl get node <NODE-NAME> -o yaml
   ...
   status:
     ...
     wireguardPublicKey: jlkVyQYooZYzI2wFfNhSZez5eWh44yfq1wKVjLvSXgY=
     wireguardPublicKeyV6: hTnWXGM4qk/Z8fQgyGFdpPd4qM9QGR2ey30s31yC6g4=
     ...
```

### Disable WireGuard for a cluster

To disable WireGuard on all nodes modify the default Felix configuration. For example:

```bash
  calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":false,"wireguardEnabledV6":false}}'
```

## Additional resources

- [Secure Calico component communications](https://docs.tigera.io/calico/latest/network-policy/comms.md)
- [Configure MTU to maximize network performance](https://docs.tigera.io/calico/latest/networking/configuring/mtu.md)
- [Hands-on workshop: Learn how to implement node-to-node encryption with WireGuard](https://www.tigera.io/tutorials/?_sf_s=WireGuard)