Securing Microservice-to-Microservice Communication via WireGuard Kernel-Level Encryption in Cilium CNI — code snippets

snippet-1.yaml

# Cilium CNI Helm values.yaml for enabling kernel-level WireGuard encryption
encryption:
  enabled: true
  type: wireguard
  # Force the use of the native Linux kernel module instead of userspace BoringTun
  wireguard:
    userspace: false
    # Port must be exposed and accessible between all cluster nodes
    port: 51871
    # Auto-calculate MTU based on physical link overhead
    maxMTU: 1420

# Optional config adjustment: Disable tunnel protocol (like VXLAN) if running in a
# routed network environment (e.g. AWS VPC CNI / Azure CNI in native routing mode)
tunnel: "disabled"
ipam:
  mode: "kubernetes"

snippet-2.sh

# 1. Verify that the WireGuard kernel module is active on the host
lsmod | grep wireguard

# 2. Inspect the virtual interface details and packet statistics
ip -d link show cilium_wg0

# 3. View the active WireGuard peers, public keys, and handshakes
# Execute this within the cilium-agent pod to inspect keys
kubectl exec -n kube-system -c cilium-agent ds/cilium -- wg show cilium_wg0

snippet-3.yaml

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-backend-policy
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: backend-api
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: frontend-client
    toPorts:
    - ports:
      - port: "8080"
        protocol: TCP

snippet-4.sh

# 1. Trace internal eBPF events in real-time filtering for redirects to the wg interface
kubectl exec -n kube-system -c cilium-agent ds/cilium -- \
  cilium monitor --type trace | grep -E "to-overlay|to-endpoint"

# 2. Dump the BPF map containing node public keys and tunnel endpoints
kubectl exec -n kube-system -c cilium-agent ds/cilium -- \
  bpftool map dump name cilium_encrypt_state

snippet-5.yaml

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: cilium-wireguard-alerts
  namespace: monitoring
spec:
  groups:
  - name: cilium-wireguard
    rules:
    - alert: WireGuardHandshakeFailed
      expr: time() - cilium_wireguard_last_handshake_seconds > 300
      for: 5m
      labels:
        severity: critical
        tier: platform
      annotations:
        summary: "WireGuard tunnel handshake failed for peer {{ $labels.peer }}"
        description: "No WireGuard handshake has occurred for peer {{ $labels.peer }} on node {{ $labels.instance }} for over 5 minutes."

snippet-6.go

package main

import (
	"context"
	"net"
	"syscall"
	"time"
)

// NewTunedDialer creates a net.Dialer tuned for microservice tunnels with strict timeouts.
func NewTunedDialer() *net.Dialer {
	return &net.Dialer{
		Timeout:   3 * time.Second,
		KeepAlive: 30 * time.Second,
		Control: func(network, address string, c syscall.RawConn) error {
			return c.Control(func(fd uintptr) {
				// Force Path MTU Discovery (PMTUD) at the socket level
				// IP_MTU_DISCOVER socket option forces the kernel to respect DF (Don't Fragment) bit
				_ = syscall.SetsockoptInt(int(fd), syscall.IPPROTO_IP, syscall.IP_MTU_DISCOVER, syscall.IP_PMTUDISC_DO)
			})
		},
	}
}

snippet-7.sh

#!/usr/bin/env bash
# Debug MTU size between nodes/pods to prevent packet drops over WireGuard
TARGET_IP="10.244.2.82"

echo "Testing Path MTU (PMTU) to $TARGET_IP with Don't Fragment (DF) bit..."
for size in 1500 1460 1420 1400 1380; do
  # Calculate payload size: MTU - 28 (IP + ICMP headers)
  payload_size=$((size - 28))
  if ping -c 1 -M do -s $payload_size $TARGET_IP >/dev/null 2>&1; then
    echo "SUCCESS: Packet of size $size bytes passed through successfully."
    break
  else
    echo "FAILED: Packet of size $size bytes was dropped (fragmentation required)."
  fi
done