Add Strict Mode Ingress Encryption Support for Wireguard by rgo3 · Pull Request #39239 · cilium/cilium

rgo3 · 2025-04-29T14:04:29Z

This PR adds strict mode ingress encryption support in Cilium, enabling users to drop unencrypted pod-to-pod traffic when using WireGuard with tunneling. It also renames existing strict mode options to be egress-specific and updates CI configurations to test the new feature.

Please see the individual commit and respective messages for more details. Any deprecated options will be removed in Cilium 1.20.

rgo3 · 2025-04-29T14:16:59Z

/ci-e2e-upgrade

rgo3 · 2025-04-30T10:29:01Z

/ci-e2e-upgrade

rgo3 · 2025-04-30T15:00:26Z

/ci-e2e-upgrade

rgo3 · 2025-05-07T10:33:05Z

/ci-e2e-upgrade

rgo3 · 2025-05-08T07:29:07Z

/ci-e2e-upgrade

rgo3 · 2025-06-11T14:18:42Z

/ci-e2e-upgrade

rgo3 · 2025-06-13T11:43:48Z

/test

joestringer · 2025-06-13T17:35:43Z

Realistically based on the current state of this PR, we should target this for v1.19.

rgo3 · 2025-06-13T18:04:05Z

In my opinion the main issue isn't this PR but the related backport for 1.17: #39498.

Is there precedent to add features that can't be enabled during the upgrade? If the backport wasn't required and we document that to enable this feature, users must first upgrade and only enable once they are on 1.18, there shouldn't be too much work left to get this in. Apart from review of course.

joestringer · 2025-06-13T18:43:40Z

I'd say as a general rule it's good practice to first upgrade and then in a separate step enable new functionality. I don't believe this that this guidance is provided in the current upgrade guide, but it seems like a reasonable addition to make.

At this stage of the development cycle in order to get a PR into v1.18 on time, the development and review should be largely complete with a clear path to merging within days. The default is that everything must be in before feature freeze, then we'll branch off in 1-2 weeks and open the main branch back up. Between the relevant reviewers (cc @cilium/sig-encryption) and committers (cc @cilium/committers) we can decide to make an exception for crucial changes that have low risk and a clear path into the tree.

smagnani96

Left a couple of comments.
I think we should document the behavior Traffic is Unencrypted after enabling this new feature. Or do we expect to have this feature enabled only when the counterpart egress is enabled too?
In addition, our CLI --no-unexpected-packet-drops checks in general if there are errors in the nodes. That means, running that CLI command in a cluster that has historical drop recorded (such as Traffic is Unencrypted) would always fail.

install/kubernetes/cilium/values.yaml.tmpl

pkg/datapath/linux/config/config.go

.github/actions/e2e/wireguard.yaml

rgo3 · 2025-12-18T12:04:04Z

I think we should document the behavior Traffic is Unencrypted after enabling this new feature. Or do we expect to have this feature enabled only when the counterpart egress is enabled too?

Where should this be documented?

In addition, our CLI --no-unexpected-packet-drops checks in general if there are errors in the nodes. That means, running that CLI command in a cluster that has historical drop recorded (such as Traffic is Unencrypted) would always fail.

AFAIK the CLI also has an option to ignore certain drop reasons, so unless you are witnessing ongoing drops, historical drop reasons can be ignored to get a successful test.

viktor-kurchenko

LGTM

rgo3 · 2025-12-18T20:12:17Z

/test

smagnani96

LGTM, and thanks also for upgrade doc mention 🙏🏼
I think we're good to go after a rebase, don't see anything else missing at the moment.

pkg/option/config.go

pkg/datapath/loader/loader.go

rgo3 · 2026-01-07T22:48:09Z

/test

rgo3 · 2026-01-08T07:38:31Z

Removing Chris as ci-structure was covered by Viktor.

rgo3 · 2026-01-08T10:23:19Z

I've made a very small change to how I set the decrypted mark in the first commit because I saw some strange failure on the awscni CI. Is it possible that doing ctx->mark = MARK_MAGIC_DECRYPT; overrides bits in the mark that aws is using? Does this ring a bell somehow? @julianwiedmann @smagnani96

I'm now using ctx->mark |= MARK_MAGIC_DECRYPT; instead, hoping that only touching the cilium mark magic space doesn't interfere with aws, but that's a hail mary to be quite honest.

rgo3 · 2026-01-08T10:26:44Z

/ci-awscni

rgo3 · 2026-01-08T13:09:50Z

/ci-awscni

Previously, the agent conditionally attached cil_from_wireguard based on NeedIngressOnWireGuardDevice(), which checked for native routing mode or tunnel mode with NodePort and encrypt-node enabled. Now, cil_from_wireguard is always compiled and attached unconditionally. The previous agent-side conditions are reflected in the datapath itself: in tunnel mode without NodePort + node encyrption, the program returns early after setting the decrypt mark. This ensures decrypted traffic is always marked while preserving the original behavior of not processing packets further when unnecessary. For environments where AWS-CNI might interfere with the use of the skb mark, we need to ensure that the marking of the packet can be turned of. See #38738 and related PRs for more details. For now we use `ENABLE_IDENTITY_MARK` to guard writing to the mark, as a follow-up we might want to introduce something more generic. Signed-off-by: Robin Gögge <[email protected]>

rgo3 · 2026-01-08T14:30:26Z

/test

This commits adds a feature that lets users drop any pod-to-pod traffic that hasn't been encrypted. It can be enabled by setting --enable-encryption-strict-mode-ingress, or the respective helm value. For now, this feature will only be available when Wireguard and tunneling are enabled as well. This new strict ingress encryption mode is unrelated to the already existing strict mode encryption feature. To avoid any confusion, the next commit will deprecate the exisiting feature flags and helm values for the strict mode encryption and rename them to have a distinct separation between ingress and egress strict mode encryption. Signed-off-by: Robin Gögge <[email protected]>

This commit renames the encryption strict mode options to be more explicit about their egress context: CLI flags: - `--enable-encryption-strict-mode` → `--enable-encryption-strict-mode-egress` - `--encryption-strict-mode-cidr` → `--encryption-strict-egress-cidr` - `--encryption-strict-mode-allow-remote-node-identities` → `--encryption-strict-egress-allow-remote-node-identities` Helm options: - `encryption.strictMode.enabled` → `encryption.strictMode.egress.enabled` - `encryption.strictMode.cidr` → `encryption.strictMode.egress.cidr` - `encryption.strictMode.allowRemoteNodeIdentities` → `encryption.strictMode.egress.allowRemoteNodeIdentities` The old options are deprecated and will be removed in Cilium 1.20. The new names better reflect that these options only apply to egress traffic. Signed-off-by: Robin Gögge <[email protected]>

Signed-off-by: Robin Gögge <[email protected]>

rgo3 · 2026-01-08T16:16:02Z

/test

joestringer · 2026-01-09T01:17:45Z

@cilium/cli (@asauber) PTAL 🙏

tommyp1ckles

looks good for @cilium/cli

julianwiedmann

Just two small drive-by comments (sorry for not spotting this earlier)

bpf/bpf_wireguard.c

daemon/cmd/daemon_main.go

maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Apr 29, 2025

rgo3 added the dont-merge/preview-only Only for preview or testing, don't merge it. label Apr 29, 2025

rgo3 force-pushed the pr/rgo3/wg-strict-mode-ingress branch from 7823c7a to f8d79d5 Compare April 30, 2025 10:28

rgo3 force-pushed the pr/rgo3/wg-strict-mode-ingress branch from f8d79d5 to b3dce95 Compare April 30, 2025 14:40

rgo3 force-pushed the pr/rgo3/wg-strict-mode-ingress branch from b3dce95 to e060f66 Compare May 7, 2025 10:32

rgo3 force-pushed the pr/rgo3/wg-strict-mode-ingress branch from e060f66 to c76d6dc Compare May 7, 2025 15:27

rgo3 added the release-note/minor This PR changes functionality that users may find relevant to operating Cilium. label May 7, 2025

maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label May 7, 2025

rgo3 force-pushed the pr/rgo3/wg-strict-mode-ingress branch 2 times, most recently from 7d6171a to 6cead71 Compare May 8, 2025 06:42

rgo3 mentioned this pull request Jun 4, 2025

[1.17] bpf: always mark decrypted wireguard traffic #39498

Closed

smagnani96 self-requested a review June 5, 2025 10:04

rgo3 force-pushed the pr/rgo3/wg-strict-mode-ingress branch from 6cead71 to 495cf66 Compare June 11, 2025 13:42

rgo3 changed the title ~~Pr/rgo3/wg strict mode ingress~~ Add strict mode ingress for wireguard transparent encryption Jun 11, 2025

rgo3 changed the title ~~Add strict mode ingress for wireguard transparent encryption~~ Add Strict Mode Ingress Encryption Support for Wireguard Jun 11, 2025

rgo3 force-pushed the pr/rgo3/wg-strict-mode-ingress branch from 495cf66 to 0060b99 Compare June 13, 2025 10:59

rgo3 added the release-blocker/1.18 This issue will prevent the release of the next version of Cilium. label Jun 13, 2025

github-project-automation bot added this to Release blockers Jun 13, 2025

github-project-automation bot moved this to Proposed in Release blockers Jun 13, 2025

rgo3 force-pushed the pr/rgo3/wg-strict-mode-ingress branch from 0060b99 to c454bfc Compare June 16, 2025 13:12

rgo3 marked this pull request as ready for review December 17, 2025 21:38

rgo3 requested a review from a team as a code owner December 17, 2025 21:38

rgo3 requested a review from chancez December 17, 2025 21:38

rgo3 added the release-blocker/1.19 This issue will prevent the release of the next version of Cilium. label Dec 17, 2025

github-project-automation bot added this to Release blockers Dec 17, 2025

github-project-automation bot moved this to Active in Release blockers Dec 17, 2025

maintainer-s-little-helper bot requested a review from smagnani96 December 17, 2025 22:51

smagnani96 reviewed Dec 18, 2025

View reviewed changes

install/kubernetes/cilium/values.yaml.tmpl Outdated Show resolved Hide resolved

pkg/datapath/linux/config/config.go Outdated Show resolved Hide resolved

.github/actions/e2e/wireguard.yaml Show resolved Hide resolved

viktor-kurchenko approved these changes Dec 18, 2025

View reviewed changes

chancez approved these changes Dec 18, 2025

View reviewed changes

smagnani96 approved these changes Jan 7, 2026

View reviewed changes

pkg/option/config.go Outdated Show resolved Hide resolved

pkg/datapath/loader/loader.go Outdated Show resolved Hide resolved

rgo3 added 3 commits January 8, 2026 16:43

ci: add strict-mode-ingress wireguard config

94ee427

Signed-off-by: Robin Gögge <[email protected]>

tommyp1ckles approved these changes Jan 9, 2026

View reviewed changes

julianwiedmann reviewed Jan 12, 2026

View reviewed changes

bpf/bpf_wireguard.c Show resolved Hide resolved

bpf/bpf_wireguard.c Show resolved Hide resolved

julianwiedmann reviewed Jan 13, 2026

View reviewed changes

daemon/cmd/daemon_main.go Show resolved Hide resolved

daemon/cmd/daemon_main.go Show resolved Hide resolved

daemon/cmd/daemon_main.go Show resolved Hide resolved

rgo3 mentioned this pull request Jan 13, 2026

daemon: fix version for deprecated encryption strict egress mode flags #43731

Merged

smagnani96 mentioned this pull request Feb 2, 2026

bpf:wireguard: set identity before redirecting to host #43011

Merged

Conversation

rgo3 commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rgo3 commented Apr 29, 2025

Uh oh!

rgo3 commented Apr 30, 2025

Uh oh!

rgo3 commented Apr 30, 2025

Uh oh!

rgo3 commented May 7, 2025

Uh oh!

rgo3 commented May 8, 2025

Uh oh!

rgo3 commented Jun 11, 2025

Uh oh!

rgo3 commented Jun 13, 2025

Uh oh!

joestringer commented Jun 13, 2025

Uh oh!

rgo3 commented Jun 13, 2025

Uh oh!

joestringer commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

smagnani96 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rgo3 commented Dec 18, 2025

Uh oh!

viktor-kurchenko left a comment

Choose a reason for hiding this comment

Uh oh!

rgo3 commented Dec 18, 2025

Uh oh!

smagnani96 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rgo3 commented Jan 7, 2026

Uh oh!

rgo3 commented Jan 8, 2026

Uh oh!

rgo3 commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rgo3 commented Jan 8, 2026

Uh oh!

rgo3 commented Jan 8, 2026

Uh oh!

rgo3 commented Jan 8, 2026

Uh oh!

rgo3 commented Jan 8, 2026

Uh oh!

joestringer commented Jan 9, 2026

Uh oh!

tommyp1ckles left a comment

Choose a reason for hiding this comment

Uh oh!

julianwiedmann left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

rgo3 commented Apr 29, 2025 •

edited

Loading

joestringer commented Jun 13, 2025 •

edited

Loading

rgo3 commented Jan 8, 2026 •

edited

Loading