Introduction Hi, welcome to this short video on Cilium WireGuard and a new feature that arrived in Cilium 1.14: support for Layer 7 policies. WireGuard in Cilium is used to encrypt traffic inside your cluster, including pod-to-pod and pod-to-node traffic. It has been around since version 1.10 and has become a popular way to encrypt traffic in transit within Kubernetes environments. One of the limitations in earlier releases was that WireGuard could not be combined with Layer 7 visibility and Layer 7 policy enforcement. That meant you could not use Hubble for Layer 7 visibility or apply Layer 7 network policies for protocols like HTTP, Kafka, or DNS when WireGuard was enabled. Policy configuration That restriction is removed in Cilium 1.14. To show that, I first install a version before 1.14 and enable WireGuard. During installation, the logs tell us very clearly that the Layer 7 proxy is disabled due to WireGuard encryption. I then verify this using the Star Wars demo, which many of you will already know. In that demo, we deploy an HTTP-aware Layer 7 network policy. The policy filters based on labels, HTTP method, and HTTP path. The policy applies cleanly from the Kubernetes perspective, but if I inspect the Cilium agent logs, I can see that the Layer 7 components are not actually active, so the policy cannot be enforced properly. Install transparent encryption In other words, even though the policy object exists, it is not operational because the Layer 7 proxy cannot run alongside WireGuard in those older releases. Deploy transparent encryption Next I install Cilium 1.14, again with WireGuard enabled. This time, after the installation completes, I redeploy the Star Wars demo and apply the same Layer 7 network policy. Now if I inspect the Cilium agent logs, there are no issues. Envoy is deployed correctly, because we need Envoy to enforce Layer 7 policies, and the policy is successfully loaded. This time the traffic is denied exactly the way we expect. The policy only allows traffic to the safe path, and requests to the restricted path are blocked. That shows that WireGuard encryption and Layer 7 policy enforcement now work together properly in Cilium 1.14. Conclusion This removes one of the major restrictions that previously existed around using WireGuard with Cilium. So if you want to encrypt traffic inside your cluster, there is now no reason to avoid WireGuard just because you also need Layer 7 policy enforcement and observability. Thanks very much for watching.