Enabling node-to-node transparant encryption using wireguard and traffic insights with hubble

[Arnold van Wijnbergen (avwsolutions)]

Hi All,

I have tested the new Azure CNI Powered by Cilium. It works great, but still have some questions.

First question is about ensuring Wireguard node to node transparant encryption. I did the configuration using the configuration map and works as expected. Again works, but not really without hacking around (kubectl edit)

kubectl edit cm -n kube-system cilium-config

# Add the following settings

enable-wireguard: "true"
encrypt-interface: eth0
encrypt-node: "true"

Is it supported and is there a way to manipulate the configuration to be persistent during an AKS deployment?
Would be great to leverage cilium advanced features.

Additionally I'm looking if it is possible to install your own hubble. Is there also some concerns / ideas here on this topic ?
Also here would be great to have this as optional within the Azure CNI deployment.

[Raúl Garcia Sanchez (rgarcia89)]

I would be interested in that too

[Amit Gupta (amitmavgupta)]

Hi, you can try this with Isovalent Enterprise for Cilium from the Azure Marketplace- https://isovalent.com/blog/post/isovalent-azure-kubernetes-service/#h-encryption

[Raúl Garcia Sanchez (rgarcia89)]

That's true if I would only pay for what I use I would be fine to give it a try. However the enterprise version comes with a lot of features that I do not need ;)

[Igor Beliakov (weisdd)]

Funny enough, if you try to enable wireguard using this method now, AKS rolls the change back in a few seconds.