docs: add limitation for Wireguard node-to-node encryption

Signed-off-by: Yusuke Suzuki <yusuke-suzuki@cybozu.co.jp>
cilium · Jun 22, 2023 · 3fc1e87 · 3fc1e87
1 parent 222230a
commit 3fc1e87
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/Documentation/security/network/encryption-wireguard.rst b/Documentation/security/network/encryption-wireguard.rst
@@ -283,6 +283,12 @@ options:
   key in its corresponding ``CiliumNode`` CRD when a worker node's public key
   changes, given that the worker node will be unable to do so itself.
 
+  N/S load balancer traffic isn't encrypted when an intermediate node redirects
+  a request to a different node with the following load balancer configuration:
+
+  - LoadBalancer & NodePort XDP Acceleration
+  - Direct Server Return (DSR)
+
 Legal
 =====