Cilium 1.18 changes the game for encrypted overlays by securing not just the payload, but the metadata too. This video shows how IPsec now encrypts VXLAN and Geneve headers, protecting security identities in multi-tenant environments. Today I'm going to talk about encrypted overlay, a new feature that came with Cilium 1.18. You might already know that Cilium can build network overlays using encapsulation protocols like VXLAN or Geneve between different nodes in your cluster, enabling pod-to-pod connectivity in your environment. When we do that, we actually carry the security identity of the source pod inside the VXLAN header. You might also know that Cilium can encrypt traffic between different pods, giving you data confidentiality and integrity. Now, prior to Cilium 1.18, what we would do is encrypt the original packet sent from the pod to the destination pod on a different node, and then encapsulate it and add the VXLAN header. The only problem with that was that the VXLAN header was not encrypted, so the security identity was still in the clear. It might have been a small risk that someone could visualize or maybe even spoof that source security identity. What we're doing in Cilium 1.18 and onward is encrypted overlay. Instead of encrypting the packet and then encapsulating the overlay, what we'll do is encapsulate the packet and then encrypt it. That means the VXLAN header, including the source security identity, is now encrypted, and obviously you won't be able to see it as it crosses the wire. We can see this in packet captures, and being a network nerd and a fan of Wireshark, I always like to verify and check packet captures. If you look at a packet capture in 1.17.0 using communication between pods on different nodes, I will see a VXLAN packet, and you can see that the VXLAN header is still in the clear. But I can also see that the inside packet is an IPsec packet. So you see an Encapsulating Security Payload packet, protocol 50, which is the ESP packet, and then the actual payload, which we can't see. So that was prior to Cilium 1.18. We had the secure packet encapsulated, but as I mentioned, the VXLAN header was still visible. In my packet capture again, for communication between two different nodes, you can see the IP addresses of my nodes here. The only thing I can see is the IPsec ESP packet. There's no VXLAN, because the whole packet has been encapsulated, and that gives me an extra bit of security. The VXLAN header can't be seen or modified, and it improves the overall security posture of Cilium when using encryption and network overlay. That's it for today. Thank you very much for watching.