Wireguard (Cilium) + Istio mTLS demo

(with ui + sniffer because :3)

Note

As this is a purposefully insecure system, I have archived it.

Demo environment showing Kubernetes traffic protection at two layers:

• Underlay encryption with Cilium WireGuard
• Service-to-service encryption with Istio mTLS

This repo creates a local kind cluster, deploys a sender-ui and receiver app in a mesh, and runs a privileged sniffer pod to capture packets for inspection!

Caution

The sniffer is intentionally privileged for demo purposes. DO NOT RUN THIS IN PROD PLEASE

What this demonstrates

When you trigger captures from the UI:

• Underlay capture (eth0, UDP 51871) shows WireGuard-encrypted packets between nodes
• Overlay capture (cilium_wg0, TCP 8080) is after WireGuard decryption, but payload still should not reveal app plaintext because Istio mTLS is strict for receiver

Architecture

• sender-ui (demo-mesh) runs on node label demo-role=client
• receiver (demo-mesh) runs on node label demo-role=server
• sniffer (demo-sniffer) runs on demo-role=client, hostNetwork: true, privileged: true, and uses tcpdump
• demo-mesh namespace has sidecar injection enabled
• demo-sniffer namespace has sidecar injection disabled

Key manifests:

• manifests/demo-mesh/receiver.yaml
• manifests/demo-mesh/sender-ui.yaml
• manifests/demo-sniffer/sniffer.yaml
• manifests/demo-mesh/mtls-strict.yaml
• manifests/demo-mesh/destination-rule-receiver.yaml

Prerequisites

• Linux/macOS/WSL2 shell with Bash
• Docker
• kind
• kubectl
• Helm

Check tool availability:

./scripts/00-ensure-software.sh

Quick start

Run scripts in order or just run runall.sh that...runs all scripts in scripts/ sequentially (insane, I know):

bash ./runall.sh

Note

runall.sh ends with port-forward (scripts/07-port-forward-ui.sh), which keeps the terminal session occupied

If you ran the seventh script (the port foreward one), you can open http://localhost:8080 to see the demo app!

UI workflow

From sender-ui:

1. Click send message to send plain app traffic through the mesh
2. Click send + sniff underlay (eth0 / udp 51871) to capture node-to-node WireGuard traffic
3. Click send + sniff overlay (cilium_wg0 / tcp 8080) to capture post-WireGuard interface traffic that should still be mTLS-protected

The UI exposes:

• Last request / inbox data from sender-ui and receiver
• Raw tcpdump output from the sniffer pod

Verification tips

Node role labels:

kubectl get nodes -L demo-role -o wide

Workload placement:

kubectl get pods -n demo-mesh -o wide
kubectl get pods -n demo-sniffer -o wide

WireGuard status in Cilium:

kubectl -n kube-system exec ds/cilium -- cilium-dbg status | grep -i Encryption

Configuration knobs

Script-level environment variables:

• CLUSTER_NAME (default: wg-istio-demo) used by scripts/01-create-kind-cluster.sh, scripts/04-build-images.sh, and destroy.sh
• CILIUM_VERSION (default: 1.19.1) used by scripts/02-install-cilium-wireguard.sh
• ISTIO_VERSION (default: 1.29.0) used by scripts/03-install-istio.sh
• KEEP_HELM_REPOS=1 prevents destroy.sh from removing local Helm repo entries
• CONTAINER_CLI can force image cleanup tool in destroy.sh (docker, nerdctl, or podman)

Optional: Argo CD manifests

Argo CD app definitions are provided under argocd/:

• argocd/apps/istio-base.yaml
• argocd/apps/istio-istiod.yaml
• argocd/apps/demo-app.yaml
• argocd/application.yaml

Important

These app specs currently reference https://github.com/ION606/encrypted-k8-msgs. If you run from a fork, update repoURL and targetRevision :)

Cleanup

Destroy cluster and local artifacts:

bash ./destroy.sh

Keep Helm repo entries while cleaning everything else:

KEEP_HELM_REPOS=1 bash ./destroy.sh