support wireguard encryption #654

hown3d · 2025-11-05T09:50:57Z

How to categorize this PR?

/area networking
/kind enhancement

What this PR does / why we need it:
Adds support for Cilium's wireguard encryption mode

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

Allow configuration of Cilium's wireguard encryption

gardener-prow · 2025-11-05T09:51:01Z

@hown3d: The label(s) kind/todo cannot be applied, because the repository doesn't have them.

In response to this:

How to categorize this PR?

/area networking
/kind TODO

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

gardener-prow · 2025-11-05T09:51:05Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign domdom82 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gardener-prow · 2025-11-05T09:51:08Z

Hi @hown3d. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

hown3d · 2025-11-05T09:51:53Z

/cc @modzilla99

gardener-prow · 2025-11-05T09:51:56Z

@hown3d: GitHub didn't allow me to request PR reviews from the following users: modzilla99.

Note that only gardener members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @modzilla99

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

hown3d · 2025-11-07T10:45:35Z

/kind enhancement

axel7born · 2025-11-12T13:34:33Z

/ok-to-test

axel7born · 2025-11-12T14:07:17Z

/test pull-extension-networking-cilium-e2e-kind

charts/internal/cilium/charts/config/templates/configmap.yaml

axel7born · 2025-11-14T10:04:38Z

/test pull-extension-networking-cilium-e2e-kind

test/e2e/force_delete_test.go

axel7born · 2025-11-20T07:10:45Z

charts/internal/cilium/charts/config/templates/configmap.yaml

 {{- end }}

 {{- if .Values.global.encryption.enabled }}
+{{- if eq .Values.global.encryption.mode "ipsec" }}


Should we really include ipsec? Did you test it?
Last time I tested, I didn't get it to work in a real cluster. Though, I didn't spend time to debug.
At least, we should document, how to create the required secret.
I would prefer, to omit the ipsec part for now.

I would agree to take smaller steps and only add wg for now. Also I could not find a test for ipsec in this PR.

axel7born · 2025-11-20T07:12:46Z

@hown3d Could you add a small section to the usage docs?

domdom82 · 2025-11-20T08:20:34Z

charts/internal/cilium/values.yaml

-    # keys
-    secretName: cilium-ipsec-keys
+    # Encryption method. Can be either ipsec or wireguard.
+    mode: ipsec


You're adding ipsec mode encryption as an option but I can't find a test for it. Please add an e2e test for the ipsec option or drop it and keep only wireguard.

I will remove the IPsec mode from the NetworkConfig API. All of these helm chart things for IPsec were already in place, however never usable from the outside.
We can add the mode to the NetworkConfig later on

domdom82 · 2025-11-20T08:22:17Z

test/e2e/network_connectivity_test.go

-	})
+	},
+		Entry("default config", "default", defaultOverlayCiliumConfig()),
+		Entry("wireguard config", "wg", wireguardCiliumConfig()),


ipsec option missing

domdom82 · 2025-11-20T08:22:39Z

test/e2e/network_test.go

-	})
+	},
+		Entry("default config", "default", defaultOverlayCiliumConfig()),
+		Entry("wireguard config", "wg", wireguardCiliumConfig()),


ipsec option missing

IPsec mode was never tested before, so I didn't add it to the E2E tests in this PR.
We can definitely add it in a follow up.

Signed-off-by: Lukas Hoehl <[email protected]>

gardener-prow bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. area/networking Networking related labels Nov 5, 2025

gardener-prow bot added the do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. label Nov 5, 2025

gardener-prow bot added cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 5, 2025

gardener-prow bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Nov 5, 2025

hown3d force-pushed the wireguard-encryption branch 2 times, most recently from f750bbc to 9b0d278 Compare November 7, 2025 10:45

hown3d changed the title ~~feat: support wireguard encryption~~ support wireguard encryption Nov 7, 2025

hown3d marked this pull request as ready for review November 7, 2025 10:45

hown3d requested a review from a team as a code owner November 7, 2025 10:45

gardener-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 7, 2025

gardener-prow bot added kind/enhancement Enhancement, improvement, extension and removed do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Nov 7, 2025

gardener-prow bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 12, 2025

hown3d force-pushed the wireguard-encryption branch from 9b0d278 to e549882 Compare November 12, 2025 15:18

gardener-prow bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 12, 2025

axel7born reviewed Nov 12, 2025

View reviewed changes

charts/internal/cilium/charts/config/templates/configmap.yaml Outdated Show resolved Hide resolved

hown3d force-pushed the wireguard-encryption branch from e549882 to 78692f5 Compare November 13, 2025 11:14

gardener-prow bot removed the cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. label Nov 13, 2025

gardener-prow bot added cla: no Indicates the PR's author has not signed the cla-assistant.io CLA. cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. and removed cla: no Indicates the PR's author has not signed the cla-assistant.io CLA. labels Nov 13, 2025

hown3d force-pushed the wireguard-encryption branch from 78692f5 to de5a436 Compare November 18, 2025 15:58

hown3d commented Nov 18, 2025

View reviewed changes

test/e2e/force_delete_test.go Outdated Show resolved Hide resolved

axel7born reviewed Nov 20, 2025

View reviewed changes

domdom82 reviewed Nov 20, 2025

View reviewed changes

hown3d force-pushed the wireguard-encryption branch from de5a436 to 633fc6e Compare November 20, 2025 11:11

Lukas Hoehl and others added 3 commits November 20, 2025 16:04

feat: support wireguard encryption

64931bc

Signed-off-by: Lukas Hoehl <[email protected]>

regenerate

3b712c0

Signed-off-by: Lukas Hoehl <[email protected]>

e2e tests

43d2b76

Signed-off-by: Lukas Hoehl <[email protected]>

hown3d force-pushed the wireguard-encryption branch 2 times, most recently from e6276f9 to 5388e4f Compare November 20, 2025 17:35

hown3d added 3 commits November 21, 2025 11:20

validation

eece2fb

Signed-off-by: Lukas Hoehl <[email protected]>

unit tests

5bbacb6

Signed-off-by: Lukas Hoehl <[email protected]>

docs

67fb035

Signed-off-by: Lukas Hoehl <[email protected]>

hown3d force-pushed the wireguard-encryption branch from 5388e4f to 67fb035 Compare November 21, 2025 10:25

support wireguard encryption #654

Are you sure you want to change the base?

support wireguard encryption #654

Uh oh!

Conversation

hown3d commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gardener-prow bot commented Nov 5, 2025

Uh oh!

gardener-prow bot commented Nov 5, 2025

Uh oh!

gardener-prow bot commented Nov 5, 2025

Uh oh!

hown3d commented Nov 5, 2025

Uh oh!

gardener-prow bot commented Nov 5, 2025

Uh oh!

hown3d commented Nov 7, 2025

Uh oh!

axel7born commented Nov 12, 2025

Uh oh!

axel7born commented Nov 12, 2025

Uh oh!

Uh oh!

axel7born commented Nov 14, 2025

Uh oh!

Uh oh!

axel7born Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

domdom82 Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

axel7born commented Nov 20, 2025

Uh oh!

domdom82 Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

hown3d Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

domdom82 Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

domdom82 Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

hown3d Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hown3d commented Nov 5, 2025 •

edited

Loading