kubespray/roles/network_plugin/cilium/tasks/check.yml

---
- name: Cilium | Check cilium_ipsec_enabled variables
  assert:
    that:
      - "cilium_ipsec_key is defined"
    msg: "cilium_ipsec_key should be defined to use cilium_ipsec_enabled"
  when:
    - cilium_ipsec_enabled
    - cilium_tunnel_mode in ['vxlan']