CKS-Lessons/lab/lesson-23-solution.md

Cilium WireGuard rollout answer

1. Helm upgrade command

helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --version 1.19.6 \
  --reuse-values \
  --set encryption.enabled=true \
  --set encryption.type=wireguard

2. Firewall change

Allow UDP port 51871 between every cluster node. This is the WireGuard tunnel port used by Cilium.

3. Preflight checks

cilium status --wait
kubectl -n kube-system get daemonset cilium

The first confirms Cilium is healthy before the change. The second confirms that the Cilium agent is scheduled on the nodes that will participate in encrypted Pod networking. Also confirm the node firewall allows UDP 51871 in both directions before the upgrade.

4. Post-change validation

cilium status --wait
cilium encrypt status

cilium status --wait confirms the Cilium deployment is healthy after the rollout. cilium encrypt status confirms WireGuard encryption is enabled and reports the encryption state for the nodes.