Cilium encryption rollout scenario

Cluster prod-east already runs Cilium 1.19.6 from the official Helm chart in namespace kube-system.

The security team requires transparent encryption for traffic between Cilium-managed Pods on different nodes. The team does not require node-to-node encryption. The worker-node firewall currently allows TCP 6443 and UDP 8472, but not WireGuard traffic.

The cluster's operating-system image has WireGuard kernel support. There is no CNI chaining.