# Cilium encryption rollout scenario

Cluster `prod-east` already runs Cilium 1.19.6 from the official Helm chart in namespace `kube-system`.

The security team requires transparent encryption for traffic between Cilium-managed Pods on different nodes. The team does **not** require node-to-node encryption. The worker-node firewall currently allows TCP 6443 and UDP 8472, but not WireGuard traffic.

The cluster's operating-system image has WireGuard kernel support. There is no CNI chaining.