# How are encryption keys distributed when Cilium's transparent encryption uses WireGuard, compared with IPsec?

Cilium, Hard (Expert), Security. https://k8wiz.com/uquiz/how-are-encryption-keys-distributed-when-ciliums-transparent-encryption-uses-wireguard-compared-with-ipsec

- A. WireGuard: per-node keys shared via CiliumNode. IPsec: a key in a Secret
- B. Both modes use one pre-shared key stored in a Kubernetes Secret
- C. cert-manager issues a certificate to every node in both modes
- D. The operator generates all keys and distributes them through Hubble

**Answer:** WireGuard: per-node keys shared via CiliumNode. IPsec: a key in a Secret

**Explanation:** For WireGuard, each node creates a key pair and announces its public key in the network.cilium.io/wg-pub-key annotation on its CiliumNode resource. Peers read it from there, so there's no shared secret to manage. IPsec mode reads its keys from a Secret, usually cilium-ipsec-keys, which you create and rotate yourself.