From fb42e27f96a8926d1cfe037afd98238ee33e7c7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Moritz=20J=C3=B6rg?= <moritz.jorg@oceanbox.io>
Date: Tue, 3 Mar 2026 15:24:35 +0100
Subject: [PATCH] fix(cilium): Disable encryption

---
 values/cilium/env-ekman.yaml.gotmpl | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/values/cilium/env-ekman.yaml.gotmpl b/values/cilium/env-ekman.yaml.gotmpl
index 2d395026..065e3a32 100644
--- a/values/cilium/env-ekman.yaml.gotmpl
+++ b/values/cilium/env-ekman.yaml.gotmpl
@@ -1,5 +1,10 @@
 cilium:
   enabled: true
+  # WireGuard cannot be used during migration -- Flannel nodes have no WireGuard
+  # keys so encrypted traffic is unreadable by them.
+  # TODO: re-enable after migration
+  encryption:
+    enabled: false
   envoy:
     enabled: true
   # kube-proxy stays running during migration; disable replacement until done.