Using just a Calico CRD felixconfiguration
, instead of vxlan tunnel.
calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
This should only be enabled by direction from your professional services consultant on an as-needed basis after a thorough examination of the specific environmental factors.