Skip to content
Wireguard based overlay network CNI plugin for kubernetes
Go Shell Other
Branch: master
Clone or download
knisbet Kevin/master/bump rigging (#15)
* update rigging

* fix some issues when integrating with gravity and with revent changes to seccomp
Latest commit fc11233 May 20, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github/ISSUE_TEMPLATE Update issue templates Apr 4, 2019
assets/docker/wireguard Kevin/initial implementation (#1) Nov 1, 2018
cmd mss clamping (#6) Apr 26, 2019
docs Kevin/master/bump rigging (#15) May 20, 2019
hack Refactor for initial release (#5) Apr 22, 2019
pkg Kevin/master/bump rigging (#15) May 20, 2019
scripts Kevin/gravity (#4) Mar 4, 2019
vendor Kevin/master/bump rigging (#15) May 20, 2019
.gitignore initial build setup Oct 9, 2018
Dockerfile Refactor for initial release (#5) Apr 22, 2019
Gopkg.lock Kevin/master/bump rigging (#15) May 20, 2019
Gopkg.toml Kevin/master/bump rigging (#15) May 20, 2019
LICENSE Create LICENSE (#11) Apr 29, 2019
Makefile Refactor for initial release (#5) Apr 22, 2019 update readme with links to discourse for news (#9) Apr 29, 2019
build.go Kevin/master/bump rigging (#15) May 20, 2019
mage.go initial build setup Oct 8, 2018

Gravitational Wormhole

Wormhole is a simple CNI plugin designed to create an encrypted overlay network for kubernetes clusters.

WireGuard is a fascinating Fast, Modern, Secure VPN tunnel, that has been gaining significant praise from security experts, and is currently proposed for inclusion within the linux kernel.

Wormhole uses WireGuard to create a simple and secure high performance encrypted overlay network for kubernetes clusters, that is easy to manage and troubleshoot.

Wormhole does not implement network policy, instead we recommend to use calico or kube-router as network policy controllers.


The Gravitational Wormhole project is currently considered experimental, and has not undergone any external security audits. Use at your own risk.

Getting Started

System Requirements

  1. WireGuard is installed on each node in you're cluster.
  2. A Kubernetes cluster with IPAM enabled (--pod-network-cidr= when using kubeadm based install)

Install (Kubeadm Cluster)

kubectl apply -f

Note: The kubeadm cluster must be initialized with (--pod-network-cidr / --service-cidr) to enable IPAM

Install (Generic)

kubectl apply -f

Note: Replace the --overlay-cidr flag in the daemonset with the overlay-cidr that matches you're network Note: Kubernetes IPAM must be enabled (--cluster-cidr / --allocate-node-cidrs on kube-controller-manager)



Build and Publish to a docker registry

WORM_REGISTRY_IMAGE="" go run mage.go build:publish


go run mage.go test:all

More Information


The best way to contribute is to create issues or pull requests right here on Github. You can also reach the Gravitational team through their website


Project Links Description
Blog Our blog, where we publish gravitational news
Security and Release Updates Subscribe to our discourse for security and news updates
Community Forum Gravitational Community Forum

Who Built Wormhole?

Wormhole was created by Gravitational Inc. We have built wormhole by leveraging our experience automating and supporting hundreds of kubernetes clusters with Gravity, our Kubernetes distribution optimized for deploying and remotely controlling complex applications into multiple environments at the same time:

  • Multiple cloud regions
  • Colocation
  • Private enterprise clouds located behind firewalls
You can’t perform that action at this time.