Cilium overlay: transparent pod-to-pod encryption (WireGuard) for regulated tiers

[gangster]

Context

Follow-up from the Cilium overlay networking change.

Overlay VXLAN traffic is unencrypted node-to-node (plaintext within the VPC). Standard-tier risk class is unchanged (intra-VPC), but for hipaa/pci "encryption in transit everywhere" this is a gap.

Ask

Expose a Cilium transparent encryption knob (WireGuard preferred; IPsec alternative) in the cilium module, defaulted off, and enable it for regulated compliance_tier clusters. Validate throughput/latency impact.

Acceptance

• compliance_tier in [hipaa, pci] clusters run with pod-to-pod encryption enabled.
• Module variable + per-tier wiring; documented in security/compliance docs (09/10).

[gangster]

Shipped — Cilium WireGuard transparent pod-to-pod encryption is live + verified on both clusters (2026-07-07), realizing ADR-057 Phase 1. Delivered fleet-default (all tiers), a superset of this issue's "regulated tiers" ask.

• Module support: feat(cilium): gated WireGuard transparent encryption support (ADR-057 Phase 1) #1193 (encryption_enabled/encryption_type/node_encryption on the cilium module, WireGuard default).
• Enablement: feat(cilium): enable WireGuard east-west encryption on preprod + platform (ADR-057 Phase 1) #1197 (encryption_enabled = true on both cilium units).
• Verified: cilium-dbg status → Encryption: Wireguard [cilium_wg0, Peers: N] on every agent; every node has a WG pubkey + spec.encryption.key; cluster health N/N reachable; public preprod route + internal platform route both served HTTP 200 through the encrypted mesh (no MTU black-holing on the tunnel/VXLAN datapath).

Gotcha recorded in the ADR as-built: enabling encryption needs a kubectl rollout restart ds/cilium (Cilium reads enable-wireguard only at agent startup). Node-to-node (host) encryption + the mTLS/SPIFFE workload-identity half are ADR-057 Phase 2 (regulated-tier, deferred).