# In Cilium's tunnel mode (VXLAN or Geneve), how does the receiving node learn the security identity of a packet sent by a pod on another node?

Cilium, Hard (Expert), Architecture. https://k8wiz.com/uquiz/in-ciliums-tunnel-mode-vxlan-or-geneve-how-does-the-receiving-node-learn-the-security-identity-of-a-packet-sent-by-a-pod-on-anot

- A. The receiving node asks the Kubernetes API server for the source pod's labels
- B. Hubble Relay sends the identity along with each flow
- C. The identity is written into the TCP options of each packet
- D. The sending node puts the source identity in the encapsulation header

**Answer:** The sending node puts the source identity in the encapsulation header

**Explanation:** Encapsulation protocols can carry metadata with each packet. Cilium uses this to send the source security identity, in the VXLAN VNI or the Geneve header, so the destination node can enforce policy without a lookup. In native routing mode there's no tunnel header, so Cilium maps the source IP to an identity through its ipcache instead.