<p>In preparation for HIPAA compliance, we are transitioning our Kubernetes cluster  to use secure endpoints across the fleet (between all pods). Since the cluster is composed of about 8-10 services currently using HTTP connections, it would be super useful to have this taken care of by Kubernetes.</p>
<p>The specific attack vector we'd like to address with this is packet sniffing between nodes (physical servers).</p>
<p>This question breaks down into two parts:</p>
<ul>
<li>Does Kubernetes encrypts the traffic between pods &amp; nodes by default?</li>
<li>If not, is there a way to configure it such?</li>
</ul>
<p>Many thanks!</p>

<p>Actually the correct answer is &quot;it depends&quot;. I would split the cluster into 2 separate networks.</p>
<ol>
<li><p><strong>Control Plane Network</strong></p>
<p>This network is that of the physical network or the underlay network in other words.</p>
<p>k8s control-plane elements - kube-apiserver, kube-controller-manager, kube-scheduler, kube-proxy, kubelet - talk to each other in various ways. Except for a few endpoints (eg. metrics), it is possible to configure encryption on all endpoints.</p>
<p>If you're also pentesting, then <a href="https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization" rel="nofollow noreferrer">kubelet authn/authz</a> should be switched on too. Otherwise, the encryption doesn't prevent unauthorized access to the kubelet. This endpoint (at port 10250) can be hijacked with ease.</p>
</li>
<li><p><strong>Cluster Network</strong></p>
<p>The cluster network is the one used by the Pods, which is also referred to as the overlay network. Encryption is left to the 3rd-party overlay plugin to implement, failing which, the app has to implement.</p>
<p>The Weave overlay <a href="https://github.com/weaveworks-experiments/weave-kube/issues/38" rel="nofollow noreferrer">supports encryption</a>. The service mesh linkerd that @lukas-eichler suggested can also achieve this, but on a different networking layer.</p>
</li>
</ol>
