Cilium drops SPIRE for ztunnel mTLS encryption

Cilium has deprecated its SPIRE-based Mutual Authentication feature, with removal planned for v1.21. The replacement, ztunnel Transparent Encryption, provides per-node L4 mTLS for pod-to-pod traffic without a SPIRE server, but has limits around UDP, Cluster Mesh and L4 policies.

• SPIRE-based Mutual Auth will be removed in Cilium v1.21; removal PR already merged
• ztunnel needs bootstrap and CA secrets generated via an OpenSSL script
• Encryption is enabled per namespace with the io.cilium/mtls-enabled=true label
• ztunnel is incompatible with Cluster Mesh and breaks L4 policies except port 15008