MACSEC communication between flannel nodes

[takuyaK8s]

I want to communicate between flannel nodes using MACSEC communication.
Is it correct to understand that MACSEC communication is a specification that requires communication in the same segment?
Also, if flannel is used with K8s, it will be a different segment, but is it possible to use the same segment?

[rbrtbnfgl]

How are you configuring MACSEC? Flannel configures VxLAN UDP tunnel to connect the pods on the different nodes. The tunnel is configured using the L3 addresses I think you can force the flannel L3 traffic to use the L2 MACSEC interface.

[takuyaK8s]

A virtual MACSEC interface is created in the Pod and MACSEC is installed in the Pod.
Communication between Pods is possible, but in the case of communication between nodes, the segments are different in Flannel 1, so communication is not possible.

[rbrtbnfgl]

when you are using the Vxlan tunnel I think you can't forward macsec packets. K8s uses different L3 networks for each node then macsec is limited only on the single node. If you want to enforce security on the communication between the node you should use Wireguard as backend.