Introduction Today I'm going to talk about Isovalent Enterprise for Cilium and a new feature called selective encryption. By default, traffic inside your Kubernetes cluster is typically not encrypted. Sometimes people deploy a service mesh for that, or they use Cilium, which already supports IPsec and WireGuard. The problem is that those options are usually all or nothing: you either encrypt all the traffic or none of it. Sometimes you only want to encrypt traffic for a particular application, maybe for regulatory reasons, and you don't want to encrypt everything because encryption always comes with overhead. Per-flow selective encryption overview With this new feature, we're able to selectively encrypt specific traffic based on metadata labels. Let's look at the demo environment. We're running Isovalent Enterprise for Cilium. This is an enterprise-only feature coming in 1.16, and we have four nodes with pods running on different nodes. We'll show connectivity between pods on different nodes while sniffing traffic on the WireGuard interface to see whether it is being encrypted. We start by curling from the client to the nginx server. Traffic is flowing correctly, but we don't see anything on the WireGuard interface because we haven't applied our selective encryption policy yet. Deploy per-flow selective encryption The encryption policy looks a bit like a network policy. You can select which traffic it applies to, which endpoints it applies to, and which namespace it applies to. In this case, it's for our client in the default namespace with specific labels, and we're only encrypting TCP port 80 traffic to the nginx server with specific labels in that namespace. So let's apply the policy. We run the command again and it's still successful, but we still don't see any traffic on the WireGuard interface. Why? Because we haven't applied the correct label to our client yet. Policy configuration The client doesn't have the kind equals client label, so the traffic doesn't match the Isovalent encryption policy. Once we add that label and run the traffic again, we can see it appear in the tcpdump output on the WireGuard interface. So this gives us a new way to selectively encrypt traffic between two pods, as long as they're on different nodes, using Isovalent Enterprise for Cilium and the selective encryption feature. That's all for today. Thank you very much for watching, and I will see you in the next one.