Secure Calico-to-Cilium Migration

I need my production Kubernetes cluster moved from Calico CNI to Cilium CNI with zero-downtime, production-grade encryption and greatly strengthened security controls. The main driver behind the change is enhanced security, so the work must enable wire-speed, node-to-node encryption, fine-grained network policy enforcement and any Cilium eBPF features that raise the overall security posture.

Because we do not yet run a monitoring stack, part of the engagement is to stand up a new observability layer. Leveraging Hubble is the natural starting point, and I am open to whichever back-end you prefer for metrics and dashboards—Prometheus/Grafana, OpenTelemetry, or another first-class option—provided the end result offers clear, real-time visibility into flows, latency, dropped packets and policy violations.

Please plan for a live environment comprising multiple worker nodes and critical workloads that cannot experience interruption.

Deliverables
• Migration plan outlining prerequisites, rollback strategy and expected impact
• Automated deployment (Helm, GitOps or comparable) of Cilium with encryption enabled
• Replacement of existing Calico policies with equivalent or stronger Cilium policies, validated in staging and then production
• Fresh observability stack configured and documented
• Knowledge-transfer session and concise run-book for ongoing operations and upgrades

Acceptance criteria: all pods communicate without regression, encrypted traffic can be verified, network policies behave as intended, and dashboards show end-to-end flow data.

If you have hands-on success stories performing Calico-to-Cilium cutovers in high-traffic clusters, I would like to review them along with your proposed timeline.