Cilium’s mutual-authentication feature lets policy require a workload to prove its identity to a peer using a SPIRE-issued X.509 identity. It is documented as beta and incomplete in Cilium 1.20.2, and authentication alone does not encrypt pod-to-pod application traffic. Cilium says encryption must also be enabled to meet most common service-to-service authentication and encryption requirements.
What Cilium mutual authentication does
Mutual TLS authenticates both sides of a connection: the client verifies the server, and the server verifies the client. In Cilium’s documented implementation, this identity check uses an out-of-band handshake for regular connections. Policy determines which connections require authentication; the handshake does not itself encrypt the application traffic.
As an Amazon Associate I earn from qualifying purchases.
Cilium uses SPIFFE APIs to identify workloads. A workload identity corresponds to a Cilium Security Identity, which represents a set of pods described by a label set. The SPIFFE ID is a URI, and the workload receives an X.509 SVID containing a TLS keypair.
Recommended Free Tools
How SPIRE supplies identities
The documented SPIRE arrangement has a central server that serves as the trust-domain root and a SPIRE agent on each node. The agent checks workload attributes, attests identity requests to the server, and supplies the resulting X.509 SVID. Cilium agents can request identities on behalf of workloads. See Cilium’s Mutual Authentication documentation for the release-specific identity flow.
#1 Best Overall
Enable the feature and configure policy
Cilium documents two deployment options: install SPIRE with Cilium’s Helm chart or use a separately managed SPIRE server. The bundled installation’s default storage requires PersistentVolumeClaim support. In-memory server storage can suit a lab or local cluster, but its data is recreated when the SPIRE server restarts.
The following CLI example is from Cilium’s stable documentation labeled 1.20.2. It requires Cilium CLI Helm mode version 0.15 or later. Check the documentation for your exact Cilium release before using it; chart settings and support can change.
cilium install
--set authentication.mutual.enabled=true
--set authentication.mutual.spire.enabled=true
--set authentication.mutual.spire.install.enabled=trueThe documented Helm values include the SPIRE server address and SPIFFE trust domain. The default trust domain listed for that documentation release is spiffe.cilium. Review the Cilium Helm values reference and set values appropriate to your cluster rather than assuming the example defaults fit your deployment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Require authentication in a CiliumNetworkPolicy
Add authentication: mode: "required" to the ingress or egress rule that should enforce peer authentication. For example, the relevant part of a policy rule has this form:
authentication:
mode: "required"Place this under the appropriate ingress or egress rule in the CiliumNetworkPolicy; it is not a standalone policy. Cilium’s mutual-authentication example shows the wider policy and verification workflow.
Verify identity registration and policy behavior
- Confirm that the SPIRE server is healthy.
- Check that the Cilium agent, operator, and workload identities are registered.
- Apply the CiliumNetworkPolicy with required authentication on the intended ingress or egress rule.
- Test traffic that should be allowed and traffic that should be denied under the policy.
- Inspect Cilium agent logs for certificate validation and successful authentication.
The example documentation’s output is illustrative; actual output and behavior depend on your release and cluster configuration.
Does mutual authentication encrypt pod traffic?
No. Authentication establishes the peer identity; it does not by itself encrypt application data. Cilium’s documentation says that to meet most common service-to-service authentication and encryption requirements, users must enable encryption. It points to WireGuard and IPsec transparent encryption as options that automatically create and maintain encrypted connections between pods. See the Cilium mutual-authentication guide and its encryption guidance for the configuration appropriate to your release.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the separate ztunnel option differs
Cilium also documents ztunnel as a beta option for transparent Layer 4 mutual-TLS authentication and encryption of Cilium-managed endpoints. It is a distinct traffic path, not simply another way to turn on the policy-driven handshake described above.
- Policy-driven mutual authentication: add a required-authentication setting to a CiliumNetworkPolicy ingress or egress rule.
- Ztunnel: enroll pods by namespace and redirect their traffic through a per-node ztunnel proxy.
- Certificates: the ztunnel guide says required private keys and certificates must be available through Kubernetes secrets.
Both approaches are labeled beta in the Cilium 1.20.2 stable documentation. Review the ztunnel guide before choosing a path; their enforcement, traffic handling, and operational requirements differ.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compatibility and production-readiness limits
Cilium labels mutual authentication beta and says the feature is incomplete. Its documentation states, “This feature is still incomplete, see Detailed Roadmap Status below for more details.” The same guide lists security and maturity work as outstanding, including WireGuard integration, per-connection handshakes, syncing ipcache with authentication data, detailed security-model documentation, penetration testing, reducing packet drops, using the authentication secret for network encryption, and maturity review. These are release-sensitive details; consult the current guide before relying on them.
- SPIFFE implementations: Cilium says its mutual-authentication support has been validated only with SPIRE. Other SPIFFE implementations may work in principle but are not currently supported by the project.
- Cluster Mesh: the guide says the feature is not compatible with clusters connected in Cluster Mesh because this setup has no shared trust domain across those clusters.
- External mTLS: Cilium documents the feature as incompatible with an external mTLS solution.
- SPIRE persistence: persistent server storage is enabled by default in the documented Helm values. Confirm suitable persistent-volume support before treating the bundled example as production-ready.
For current release status and caveats, consult Cilium’s stable mutual-authentication guide and the Service Mesh documentation.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
