Skip to main content
This guide demonstrates how to enable and verify IPsec encryption between pods using Cilium. We’ll use a simple three-node cluster (control-plane, worker1, worker2) connected via a single router. The workflow:
  • Deploy pods on worker1 and worker2.
  • Generate pod-to-pod traffic (ICMP/HTTP).
  • Capture traffic on the router before enabling encryption (unencrypted).
  • Enable Cilium encryption (IPsec).
  • Capture traffic again (encrypted) and verify in Wireshark.
  • Inspect node host interfaces to understand encapsulation addresses.
Topology (logical):
A simple network diagram showing three machines (control-plane, worker1, worker2), each with an ens33 interface and IPs 192.168.146.130, 192.168.211.128, and 192.168.44.128 respectively. They are linked to a central router/switch with interfaces ens37, ens39, ens38 (IPs .129 on each corresponding subnet).
Overview of steps
  • Verify pods are scheduled and reachable across nodes.
  • Capture unencrypted traffic on the router (validate visibility).
  • Add IPsec keys as a Kubernetes secret.
  • Enable encryption in the Cilium Helm values and upgrade.
  • Restart Cilium components, validate encryption status.
  • Capture encrypted traffic and inspect with Wireshark.
  • Inspect cilium_host addresses on nodes to understand outer IPs.
Quick reference — tools used Initial verification — pods and basic pod-to-pod traffic
  1. Confirm pods are running and which nodes they are on:
  1. Generate basic traffic from a pod on worker1 to a pod on worker2 (ICMP example):
Capturing unencrypted traffic on the router Run tcpdump on the router interface connected to the cluster (ens38 in this demo). Save to unencrypted.pcap. Packet capture requires elevated privileges.
Run tcpdump with sudo if you get “Operation not permitted” — packet capture needs root privileges.
Open unencrypted.pcap in Wireshark. With encryption disabled you will observe pod-to-pod traffic in cleartext for non-encrypted protocols (ICMP, HTTP). Note that application protocols using their own encryption (TLS) remain encrypted at the application layer — you will see TLS records but not the decrypted payload.
Screenshot of a Wireshark packet-capture window showing a list of network packets (TCP/TLS/HTTP/ICMP) with packet details and a hex/ASCII payload pane. A highlighted HTTP GET /hello request and various TLS and ICMP entries are visible.
Example Wireshark lines (cleartext example):
You can expand a frame to view ICMP or HTTP payload in hex/ASCII to confirm visibility when encryption is not enabled. Enable IPsec encryption in Cilium Cilium supports IPsec or WireGuard for node-to-node encryption. The following demonstrates enabling IPsec.
  1. Create the Kubernetes secret containing IPsec keys in kube-system. The key entry format:
key-id rfc4106(gcm(aes)) <PSK-in-hex> <key-size-in-bits> Generate a 16-byte (128-bit) key as an example and create the secret:
Verify the secret exists:
Keep IPsec keys secret and manage them securely. Use appropriate key lengths for your security requirements (e.g., 256-bit where needed).
  1. Edit the Cilium Helm values (values.yaml) to enable encryption. Set the encryption block like:
(If you prefer WireGuard, set type: wireguard and provide keys in the expected format.)
  1. Upgrade the Cilium chart and restart Cilium components:
Wait for pods to restart and become Ready. Verify the kube-system Cilium pods are running:
  1. Confirm Cilium reports encryption is active from a Cilium agent pod:
(Replace cilium-7f68t with a real pod name from your environment.) Capture and inspect encrypted traffic
  1. Generate traffic again from the same pod but use a larger ICMP payload so encrypted packets are easier to spot (e.g., -s 1300):
Note: Place the -s option before the destination IP.
  1. On the router capture encrypted traffic to encrypted.pcap:
  1. Open encrypted.pcap in Wireshark. With Cilium IPsec enabled you should no longer see ICMP or HTTP payloads in cleartext for inter-node pod flows. Instead, you will typically see:
  • Encapsulating Security Payload (ESP) frames (the encrypted inner payload).
  • Possibly additional encapsulation like VXLAN + ESP depending on Cilium configuration.
  • Large frame sizes due to encapsulation overhead.
Example encrypted-frame excerpt:
You should see ESP where the inner protocol (ICMP/HTTP) is not visible — the payload is encrypted and Wireshark cannot display inner protocol fields. Why captures show cilium_host (node) IPs as outer addresses When Cilium encrypts node-to-node traffic it encapsulates pod IPs inside an outer packet that uses node-local Cilium host addresses. Each node typically has a cilium_host interface with a /32 address reserved for encapsulation. For example:
Worker2 will have its own cilium_host (e.g., 10.0.2.104/32). On the wire you will therefore see outer source/destination addresses set to these host addresses and ESP as the protocol; the inner (encrypted) packet contains the original pod IPs and payload. Recap and key takeaways
  • Before enabling Cilium encryption, router captures show pod payloads (ICMP, HTTP) in cleartext.
  • After enabling Cilium IPsec, inter-node traffic is encapsulated and encrypted — Wireshark shows ESP (and possibly VXLAN) and you cannot read the inner ICMP/HTTP payloads from the router capture.
  • Cilium uses node-local host interfaces (cilium_host) for outer addresses; the receiving node decrypts and forwards the inner pod traffic to the destination pod.
  • Use IPsec or WireGuard depending on your operational and performance requirements.
Links and references

Watch Video