---
name: containers-encryption-wireguard-workers
title: Encrypting worker-to-worker traffic with WireGuard
description: You can encrypt data that flows between worker nodes in your cluster by using WireGuard.
last-updated: 2026-04-14
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Encrypting worker-to-worker traffic with WireGuard
{: #encrypt-nodes-wireguard}

[Classic infrastructure]{: tag-classic-inf} [Virtual Private Cloud]{: tag-vpc}

You can encrypt data that flows between worker nodes in your cluster by using WireGuard.
{: shortdesc}

- This feature encrypts traffic only between worker nodes in the same cluster. It does not encrypt traffic between different pods on the same worker node.
- Worker-to-worker encryption with WireGuard is supported on Kubernetes Service clusters with workers that run [Ubuntu 20 or later](https://cloud.ibm.com/docs/containers?topic=containers-ubuntu-migrate&format=markdown).
- WireGuard is not supported on workers that have user-installed encryption modules.
- WireGuard is not FIPS or FedRAMP compliant.
- You cannot change the WireGuard configuration after you enable it. However, you can disable it.

For more information on this configuration setting, see [Enable WireGuard for a cluster](https://archive-os-3-25.netlify.app/calico/3.25/network-policy/encrypt-cluster-pod-traffic/#enable-wireguard-for-a-cluster){: external} in the Calico documentation.
{: tip}


## Enabling WireGuard encryption
{: #encrypt-nodes-wireguard-enable}

1. Run the following command to enable WireGuard for worker-to-worker traffic.

    ```sh
    kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
    ```
    {: pre}

    Example output
    ```sh
    felixconfiguration.crd.projectcalico.org/default patched
    ```
    {: screen}

2. Verify your setup by reviewing the `felixconfiguration`. In the output, find the WireGuard section and verify that `wireguardEnabled: true`.

    ```sh
    kubectl get felixconfiguration default -o yaml
    ```
    {: pre}

    Example output

    ```yaml
    apiVersion: crd.projectcalico.org/v1
    kind: FelixConfiguration
    metadata:
      annotations:
        created-by: IBMCloudKubernetesService
        projectcalico.org/metadata: '{"uid":"8a21b69b-9ffb-451d-9619-0dd1605810dc","creationTimestamp":"2023-09-13T14:00:15Z"}'
      creationTimestamp: "2023-09-13T14:00:15Z"
      generation: 2
      name: default
      resourceVersion: "24839234"
      uid: ff0c79f3-5548-4db4-a22f-2f367282631d
    spec:
      bpfLogLevel: ""
      floatingIPs: Disabled
      logSeverityScreen: Info
      natPortRange: 32768:65535
      reportingInterval: 0s
      wireguardEnabled: true
    ```
    {: screen}

## Disabling WireGuard encryption
{: #encrypt-nodes-wireguard-disable}

If you no longer need worker-to-worker encryption in your cluster, you can disable WireGuard.

1. Run the following command to disable WireGuard.

    ```sh
    kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":false}}'
    ```
    {: pre}

    Example output
    ```sh
    felixconfiguration.crd.projectcalico.org/default patched
    ```
    {: screen}

1. Verify WireGuard is disabled.
    ```sh
    kubectl get felixconfiguration default -o yaml
    ```
    {: pre}

    Example output
    ```yaml
    apiVersion: crd.projectcalico.org/v1
    kind: FelixConfiguration
    metadata:
      annotations:
        created-by: IBMCloudKubernetesService
        projectcalico.org/metadata: '{"uid":"8a21b69b-9ffb-451d-9619-0dd1605810dc","creationTimestamp":"2023-09-13T14:00:15Z"}'
      creationTimestamp: "2023-09-13T14:00:15Z"
      generation: 3
      name: default
      resourceVersion: "24839453"
      uid: ff0c79f3-5548-4db4-a22f-2f367282631d
    spec:
      bpfLogLevel: ""
      floatingIPs: Disabled
      logSeverityScreen: Info
      natPortRange: 32768:65535
      reportingInterval: 0s
      wireguardEnabled: false
    ```
    {: screen}