{
  "id": 14693880,
  "title": "Cilium mTLS ztunnel: Sidecar-Free Encryption Explained",
  "url": "https://urgent.news/2026/10/15/cilium-mtls-ztunnel-sidecar-free-encryption-explained",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T12:37:20.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/amareswer/cilium-mtls-ztunnel-sidecar-free-encryption-explained-nke"
  },
  "original_language": "en",
  "account": "Cilium has introduced a new mTLS solution called ztunnel, which eliminates the need for a separate SPIRE server. This development marks a significant shift in Cilium's approach to Mutual Authentication. The older SPIRE-based mutual authentication feature is now deprecated and set to be removed in the upcoming v1.21 version of Cilium.\n\nTo implement ztunnel, users must first disable the cluster mesh feature, as it is incompatible with ztunnel. After disabling the mesh, a set of Kubernetes secrets needs to be generated using a series of OpenSSL commands. These secrets include a bootstrap private key, CA private key, bootstrap root certificate, and CA root certificate. These secrets are then used to create a Kubernetes secret named cilium-ztunnel-secrets.\n\nOnce the secrets are in place, ztunnel can be enabled during the Cilium installation process. This enables transparent Layer 4 mTLS encryption and authentication for pod-to-pod communication. Importantly, ztunnel does not require the installation of a SPIRE server, simplifying the deployment process.\n\nHowever, there are important considerations to keep in mind during the migration to ztunnel. One major gotcha is that traffic between workloads is only supported when both the source and destination endpoints are enrolled in ztunnel. If a workload's traffic involves both enrolled and non-enrolled endpoints, the communication will break. This highlights the importance of carefully planning the namespace-by-namespace rollout, taking into account all service-to-service dependencies.\n\nAnother significant issue is that ztunnel interferes with Cilium's network policies. While ztunnel provides encryption, it does not integrate with the L4 network policies, which may lead to unexpected behavior. Therefore, it is essential to verify the behavior of any existing L4 network policies after enabling ztunnel on a namespace.\n\nFinally, it is worth noting that ztunnel supports only TCP connections, and does not handle UDP or other protocols. Additionally, it enrolls namespaces as whole units, without the ability to opt-in individual pods. Pods that run on the host network are also excluded from ztunnel's protection. Lastly, ztunnel requires the kernel to support iptables.",
  "summary": "Originally published on DevToolHub . Cilium mTLS ztunnel doesn't need a SPIRE server — and that's actually the second-biggest news here. The bigger story: Cilium's older, SPIRE-based \"Mutual Authentication\" feature is now officially deprecated, with removal targeted for v1.21. If you adopted it, you're migrating whether you planned to or not. I fetched the real docs and the maintainer's own…",
  "key_points": [
    "Cilium introduces ztunnel, an mTLS solution without a separate SPIRE server.",
    "Users must disable cluster mesh and generate Kubernetes secrets for ztunnel."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}