Its a question of choosing when and how you encrypt. For internal datacentre traffic, it depends on the value of the data. But you will need to do application

Its a question of choosing when and how you encrypt. For internal datacentre traffic, it depends on the value of the data. But you will need to do application level encryption. For links between datacentres, encrypting links based on rules is a sensible and not horrifically challenging thing to do. If you're big enough to have to worry about the volume of encrypted traffic, then you have rules based bandwidth priorities. for virtually everyone else, just use wireguard or some other VPN with encryption.