Completed upto lesson 28

lab/lesson-23-solution.md

@@ -0,0 +1,34 @@
+# Cilium WireGuard rollout answer
+
+## 1. Helm upgrade command
+
+```bash
+helm upgrade cilium cilium/cilium \
+  --namespace kube-system \
+  --version 1.19.6 \
+  --reuse-values \
+  --set encryption.enabled=true \
+  --set encryption.type=wireguard
+```
+
+## 2. Firewall change
+
+Allow **UDP port 51871** between every cluster node. This is the WireGuard tunnel port used by Cilium.
+
+## 3. Preflight checks
+
+```bash
+cilium status --wait
+kubectl -n kube-system get daemonset cilium
+```
+
+The first confirms Cilium is healthy before the change. The second confirms that the Cilium agent is scheduled on the nodes that will participate in encrypted Pod networking. Also confirm the node firewall allows UDP 51871 in both directions before the upgrade.
+
+## 4. Post-change validation
+
+```bash
+cilium status --wait
+cilium encrypt status
+```
+
+`cilium status --wait` confirms the Cilium deployment is healthy after the rollout. `cilium encrypt status` confirms WireGuard encryption is enabled and reports the encryption state for the nodes.