WireGuard Improvement in 1.14 - Support for L7 Policies

In this video, learn about a new Cilium 1.14 feature - support for WireGuard alongside L7 Network Policies!

7:46

Introduction

Hi, welcome to this short video on Cilium WireGuard and a new feature that arrived in Cilium 1.14: support for Layer 7 policies.

WireGuard in Cilium is used to encrypt traffic inside your cluster, including pod-to-pod and pod-to-node traffic. It has been around since version 1.10 and has become a popular way to encrypt traffic in transit within Kubernetes environments.

One of the limitations in earlier releases was that WireGuard could not be combined with Layer 7 visibility and Layer 7 policy enforcement. That meant you could not use Hubble for Layer 7 visibility or apply Layer 7 network policies for protocols like HTTP, Kafka, or DNS when WireGuard was enabled.

Policy configuration

That restriction is removed in Cilium 1.14. To show that, I first install a version before 1.14 and enable WireGuard. During installation, the logs tell us very clearly that the Layer 7 proxy is disabled due to WireGuard encryption.

I then verify this using the Star Wars demo, which many of you will already know. In that demo, we deploy an HTTP-aware Layer 7 network policy. The policy filters based on labels, HTTP method, and HTTP path. The policy applies cleanly from the Kubernetes perspective, but if I inspect the Cilium agent logs, I can see that the Layer 7 components are not actually active, so the policy cannot be enforced properly.

Install transparent encryption

In other words, even though the policy object exists, it is not operational because the Layer 7 proxy cannot run alongside WireGuard in those older releases.

Deploy transparent encryption

Next I install Cilium 1.14, again with WireGuard enabled. This time, after the installation completes, I redeploy the Star Wars demo and apply the same Layer 7 network policy.

Now if I inspect the Cilium agent logs, there are no issues. Envoy is deployed correctly, because we need Envoy to enforce Layer 7 policies, and the policy is successfully loaded.

This time the traffic is denied exactly the way we expect. The policy only allows traffic to the safe path, and requests to the restricted path are blocked. That shows that WireGuard encryption and Layer 7 policy enforcement now work together properly in Cilium 1.14.

Conclusion

This removes one of the major restrictions that previously existed around using WireGuard with Cilium. So if you want to encrypt traffic inside your cluster, there is now no reason to avoid WireGuard just because you also need Layer 7 policy enforcement and observability.

Thanks very much for watching.

  • Nico Vibert, Principal Technical Marketing Engineer

    Nico Vibert is a Principal Technical Marketing Engineer at Isovalent, the company behind the open-source cloud-native solution Cilium. Prior to joining Isovalent, Nico worked in many different roles - operations and support, design and architecture, and technical pre-sales - at companies such as HashiCorp, VMware, and Cisco. In his current role, Nico focuses primarily on creating content to make networking a more approachable field and regularly speaks at events like KubeCon and Cisco Live. Nico has held over 15 networking certifications, including the Cisco Certified Internetwork Expert CCIE (# 22990). Nico is the co-author of the "Cilium: Up and Running" O'Reilly book and is the Lead Subject Matter Expert on the Cilium Certified Associate (CCA) certification.

July 18, 2023