Skip to content
A CNI plugin for WireGuard
Branch: master
Clone or download
schu Create wg link directly in container net ns
Otherwise, when starting multiple pods simultaneously, there would be
collisions.
Latest commit 5f2b5bb Feb 18, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
cmd/wg-cni Create wg link directly in container net ns Feb 18, 2019
pkg/netlink
.gitignore Initial skeleton based on sample CNI plugin Feb 3, 2019
Makefile Initial skeleton based on sample CNI plugin Feb 3, 2019
README.md Support multiple peers Feb 11, 2019
go.mod First prototype code Feb 10, 2019
go.sum

README.md

wireguard-cni

Status: alpha, work in progress

wireguard-cni is a CNI plugin for WireGuard.

Usage

The current prototype can be used as a chained CNI plugin, the configuration must be provided through CNI network configuration for the moment.

Example: chained plugin with flannel

Edit the kube-flannel-cfg configmap and add wg-cni as a chained plugin. Make sure wg-cni is available in the CNI path, /opt/cni/bin. Deploy new flannel pods for the configuration to be written.

kubectl -n kube-system edit configmap kube-flannel-cfg

Example configmap:

kind: ConfigMap
apiVersion: v1
metadata:
  name: kube-flannel-cfg
  namespace: kube-system
  labels:
    tier: node
    app: flannel
data:
  cni-conf.json: |
    {
      "name": "cbr0",
      "plugins": [
        {
          "type": "flannel",
          "delegate": {
            "hairpinMode": true,
            "isDefaultGateway": true
          }
        },
        {
          "type": "portmap",
          "capabilities": {
            "portMappings": true
          }
        },
        {
          "type": "wg-cni",
          "address": "10.13.13.210/24",
          "privateKey": "AAev16ZVYhmCQliIYKXMje1zObRp6TmET0KiUx7MJXc=",
          "peers": [
            {
              "endpoint": "1.2.3.4:51820",
              "endpointPublicKey": "+gXCSfkib2xFMeebKXIYBVZxV/Vh2mbi1dJeHCCjQmg=",
              "allowedIPs": [
                "10.13.13.0/24"
              ],
              "persistentKeepalive": 25
            }
          ]
        }
      ]
    }
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",
      "Backend": {
        "Type": "vxlan"
      }
    }

Roadmap

  • Allow dynamic configuration through Kubernetes resources
  • Allow wireguard-cni to be used in standalone and chained mode
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.