--- title: "Introducing WireGuard Encryption with Calico" source: "https://www.tigera.io/blog/introducing-wireguard-encryption-with-calico/" description: "Learn about WireGuard and how to enable WireGuard support in Calico." --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # Introducing WireGuard Encryption with Calico By [Chris Hoge](https://www.tigera.io/blog/author/chrishoge/) on Jun 05, 2020 • 4 min read Calico is well known as a Container Network Interface (CNI) that offers connectivity and security for container workloads by using standard Linux tools. Calico’s best-known security feature is an implementation of Kubernetes Network Policies, which provides a way to secure container workloads by restricting traffic to and from trusted sources. While the source of traffic can be controlled, without encryption the traffic itself is vulnerable to interception. A common solution is to encrypt traffic at the application layer using protocols like Transport Layer Security (TLS), but it’s also possible to encrypt traffic at a lower infrastructure level using protocols like IPSec, or WireGuard. This article will guide you through how to enable WireGuard support in Calico, demonstrating how simple it is to enable and disable low-level encryption with minimal effort. ## Why WireGuard for encryption? IPSec has shipped as a standard option in the Linux kernel for a long time, but it introduces a layer of management complexity for setting up and maintaining secure network connections. WireGuard is a kernel alternative to IPSec that aims to “be  [faster](http://www.wireguard.com/performance/), [simpler](http://www.wireguard.com/quickstart/), leaner, and more useful.” It’s always been possible to run Calico on top of an IPSec enabled network that you are managing yourself, but the 3.14 release of Project Calico introduced a new tech-preview of Calico managed encryption backed by WireGuard. ![WireGuard mascot holding a book in front of a monitor with a lock and binary code](https://www.tigera.io/app/uploads/2021/01/Calico-WireGuard-Encryption.png) ## Enabling WireGuard support in Calico To begin, you will need a Kubernetes cluster with WireGuard installed on the host operating system. A complete list of supported operating systems and installation instructions can be found on the [WireGuard website.](http://www.wireguard.com/install/) Note that after you install WireGuard, you may need to reboot your machines to make the required kernel modules available. For the tech preview in Calico 3.14, Calico needs to be installed and configured to not use an overlay network. Calico 3.15 will lift this restriction with support for WireGuard in Calico VXLAN and IPIP overlay networks.  With all of these prerequisites met, you can enable WireGuard encryption. ``` `calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'` ``` You can check to see if WireGuard is enabled by inspecting the nodes: ``` `calicoctl get node -o yaml` ``` If successfully configured, each node should contain a field with a WireGuard public key: ``` `... status: .. wireguardPublicKey: jlkVyQYooZYzI2wFfNhSZez5eWh44yfq1wKVjLvSXgY= ...` ``` That’s it! With the basic prerequisites met, and a simple change to the Felix configuration, you’ve enabled encryption for all on-the-wire pod-to-pod traffic. It’s worth noting that enabling encryption for all network traffic comes with a performance penalty. We can demonstrate this using IPerf, which we can run on our cluster using the [kubernetes-iperf3](http://github.com/Pharb/kubernetes-iperf3) project. It’s easy to download and run: ``` `git clone http://github.com/Pharb/kubernetes-iperf3 cd kubernetes-iperf3 ./iperf3.sh` ``` This will deploy an iperf3 server to one of your nodes, a client to every node, then check the performance between the server and clients for every node, including the master. For example, in a three node cluster running Ubuntu 20.04 on virtual machine hosts, iperf3 measured on average 3.74 Gbits/sec throughput between the client and server pods. Compare to a connection with WireGuard enabled, which has a throughput of 611 Mbits/sec on average. Keep in mind that performance metrics are highly dependent on the test setup, and may vary depending on your configuration. The WireGuard [performance documentation](http://www.wireguard.com/performance/) covers benchmarking in more depth. If your network security requires that all traffic on your cluster be encrypted, Calico offers an easy to install and use method with WireGuard. It gives you another tool in your security toolbox. Try it out, and let us know how it works! With your feedback from this tech preview we can continue to improve this new feature. ## About Project Calico Project Calico is supported by a community of developers and users. You can join the community and connect to other users at the [Project Calico Slack](http://slack.projectcalico.org/). Asking questions on the  [GitHub Discussions](https://github.com/projectcalico/calico/discussions) is a great way to get help with issues you might encounter. You can meet the developers and other community members by joining us for the [monthly community meetings](http://github.com/projectcalico/community). Follow [@projectcalico](http://twitter.com/projectcalico) on Twitter for up-to-date information about new blog posts, videos, community meetings, and releases. If you enjoyed this blog then you may also like: - Calico community meeting [Demonstration of WireGuard encryption](http://youtu.be/Ejfk9P6lvEw?t=1320) - Free online training at [projectcalico.org/events](http://projectcalico.org/events) or subscribe to [Calico Essentials](https://info.tigera.io/rs/805-GFH-732/images/Calico-Essentials-Datasheet.pdf) for personalized training & workshops - Learn about [Calico Enterprise](http://docs.projectcalico.org/calico-enterprise/)   [Open Source](https://www.tigera.io/tags/open-source/)[Partner/Integration](https://www.tigera.io/tags/partner-integration/)[Project Calico](https://www.tigera.io/tags/project-calico/) ## Related posts [![What’s new in Calico: Spring 2026 Release](https://www.tigera.io/app/uploads/2026/06/Whats-New-in-Calico-NEW-TEMPLATE-2026.png)](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [Company Blog](https://www.tigera.io/category/company-blog/) #### [What’s new in Calico: Spring 2026 Release](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on Jun 2, 2026 Kubernetes has come a long way since its debut in 2014. It’s gone from running a couple of containerized microservices to orchestrating fleets of production workloads spanning everything from AI agents to full scale VMs... [Read more](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [![Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/app/uploads/2026/05/Kubernetes-Operational-Maturity-Secure-and-Resilient-Cluster-Federation-with-Cluster-Mesh.png)](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) #### [Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on May 25, 2026 Practically no one runs a single Kubernetes cluster in production these days. Maybe that’s how it started but data sovereignty requirements, acquisitions, AI initiatives and the need for edge servers, among other considerations, have pulled... [Read more](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) [![What’s New in Calico v3.32](https://www.tigera.io/app/uploads/2026/05/Green-Please-use-a-different-background-color-alternately-1.png)](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) #### [What’s New in Calico v3.32](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) By [Reza Ramezanpour](https://www.tigera.io/blog/author/rezar/) on May 13, 2026 We’re excited to announce the release of Calico Open Source v3.32! 🎉 This release corresponds with Kubernetes v1.36 (Codename Haru) and it goes beyond just sharing a cat as the mascot of the release, it... [Read more](https://www.tigera.io/blog/whats-new-in-calico-v3-32/)