--- title: "Introducing Data-in-Transit Encryption for Calico Enterprise" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/introducing-data-in-transit-encryption-for-calico-enterprise/" description: "Calico Enterprise, the leading solution for Kubernetes networking, security and observability in hybrid and multi-clouds now includes encryption for data-in-transit." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Introducing Data-in-Transit Encryption for Calico Enterprise By [John Armstrong](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-armstrong/) on Oct 29, 2020 • 3 min read We’re excited to announce that Calico Enterprise, the leading solution for [Kubernetes networking](https://wordpress-1075849-4005834.cloudwaysapps.com/learn/guides/kubernetes-networking/), security and observability in hybrid and multi-cloud environments, now includes encryption for data-in-transit. Calico Enterprise is known for its rich set of network security implementations to protect container workloads by restricting traffic to and from trusted sources. These include, but are not limited to, [implementing existing enterprise security controls in Kubernetes](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/security-controls/), managing [egress access using DNS policy](https://wordpress-1075849-4005834.cloudwaysapps.com/features/access-controls/), [extending firewalls to Kubernetes,](https://wordpress-1075849-4005834.cloudwaysapps.com/features/access-controls/) and [intrusion detection and threat defense](https://wordpress-1075849-4005834.cloudwaysapps.com/features/intrusion-detection-system/). As the Kubernetes footprint expands, however, we’ve seen demand for an even greater in-depth approach to protecting sensitive data that falls under regulatory compliance mandates. ## Why encryption is necessary Not all threats originate from outside an organization. According to Gartner, nearly 75% of breaches happen [due to insider behavior](http://www.cebglobal.com/member/information-risk/blog/15/is-employee-behavior-your-biggest-risk-4-easy-steps-to-find-out.html?sso=gartner), from people within the organization such as employees, former employees, contractors or business associates, who have inside information concerning the organization’s security practices, data and computer systems. This level of exposure is unacceptable for organizations that have strict data protection and regulatory compliance requirements. No matter where a threat originates, encrypted data is unreadable to anyone except the legitimate keyholder, thus protecting the data should a breach occur. ![A padlock connecting two blocks of binary code, representing insider threat breaches](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2020/07/Encrypt-Data-in-transit-1.png) ## Encryption requirements for compliance Several regulatory standards impose data protection and compliance requirements on organizations and specify the use of encryption, including SOX, HIPAA, GDPR, and PCI. For example, the Payment Card Industry Data Security Standard ([PCI DSS](https://wordpress-1075849-4005834.cloudwaysapps.com/lp/kubernetes-pci-compliance/)) applies to organizations that handle branded credit cards and was created to increase controls around cardholder data to reduce credit card fraud. PCI DSS requires organizations to encrypt credit card account numbers stored in their databases and ensure that data remains secure when transferred. Validation of compliance is performed annually or quarterly. ## Encryption methods A common solution is to encrypt traffic at the application layer using protocols like Transport Layer Security (TLS). Traffic can also be encrypted at a lower infrastructure level using IPsec. However, these approaches introduce an additional layer of complexity and performance implications. Encrypting traffic with TLS requires SSL certificates, creating operational overhead for IT organizations that are already overburdened. ![Benchmark showing performance implications of encrypted CNIs in Kubernetes, with bandwidth comparisons](/app/uploads/2020/10/Encrypted-CNI-Benchmarks_Aug2020-1-300x225.png) ## Calico’s Data-in-Transit encryption Calico Enterprise avoids that complexity by utilizing WireGuard to implement data-in-transit encryption. WireGuard is consistent with Tigera’s “batteries-included” approach to Kubernetes networking, security and observability. WireGuard runs as a module inside the Linux kernel and provides better performance and lower CPU utilization than IPsec and OpenVPN tunneling protocols. Independent [benchmark tests of Kubernetes CNI’s](http://itnext.io/benchmark-results-of-kubernetes-network-plugins-cni-over-10gbit-s-network-updated-august-2020-6e1b757b9e49) have shown that Calico with encryption enabled is [6x faster than any other solution](https://miro.medium.com/max/700/1*eul4ltPeOmG9pwK7VR_8Gw.png) in the market. We are pleased to announce that WireGuard encryption is now generally available with Calico Enterprise v3.3. The addition of data-in-transit encryption augments an existing rich security feature set in Calico Enterprise. And with Calico Enterprise, you’ll maintain [visibility into all traffic in your Kubernetes clusters](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/observability-and-troubleshooting/) even when encryption is deployed. Enabling data-in-motion encryption on Calico Enterprise is easy… all you need is a Kubernetes cluster with WireGuard installed on the host operating system. You’ll find a complete list of supported operating systems and installation instructions on the [WireGuard website](http://www.wireguard.com/install/). ————————————————- [**Free Online Training**](https://wordpress-1075849-4005834.cloudwaysapps.com/events/) Access Live and On-Demand Kubernetes Training [**Calico Enterprise – Free Trial**](https://www.calicocloud.io/home) Kubernetes Networking, Security and Observability in Hybrid and Multi-Clouds [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/)[Announcements](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/announcements/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [![Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Hackathon-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) #### [Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 17, 2026 Build the Future of Cloud-Native Networking! 🚀 The Calico community moves fast. With the releases of Calico 3.30 and 3.31, brings improvements in scalability, network security, and visibility. Now, we want to see what YOU... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) [![Introducing the New Tigera & Calico Brand](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/New-logo-blog-1200x628-1.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/introducing-the-new-tigera-calico-brand/) #### [Introducing the New Tigera & Calico Brand](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/introducing-the-new-tigera-calico-brand/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Jan 30, 2026 Same community. A clearer, more unified look. Today, we are excited to share a refresh of the Tigera and Calico visual identity! This update better reflects who we are, who we serve, and where we... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/introducing-the-new-tigera-calico-brand/)