# Cilium WireGuard rollout answer

## 1. Helm upgrade command

```bash
helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --version 1.19.6 \
  --reuse-values \
  --set encryption.enabled=true \
  --set encryption.type=wireguard
```

## 2. Firewall change

Allow **UDP port 51871** between every cluster node. This is the WireGuard tunnel port used by Cilium.

## 3. Preflight checks

```bash
cilium status --wait
kubectl -n kube-system get daemonset cilium
```

The first confirms Cilium is healthy before the change. The second confirms that the Cilium agent is scheduled on the nodes that will participate in encrypted Pod networking. Also confirm the node firewall allows UDP 51871 in both directions before the upgrade.

## 4. Post-change validation

```bash
cilium status --wait
cilium encrypt status
```

`cilium status --wait` confirms the Cilium deployment is healthy after the rollout. `cilium encrypt status` confirms WireGuard encryption is enabled and reports the encryption state for the nodes.