Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for pod Wireguard sidecar #44

Draft
wants to merge 23 commits into
base: main
Choose a base branch
from

Conversation

Matthew-Beckett
Copy link
Collaborator

This PR adds a sidecar which can be added to a pod by the controller when the annotation:

vpn.example.com/sidecar-enable: true is set and
vpn.example.com/sidecar-wireguard-ref: is a valid wireguard reference

The wireguard sidecar is automatically configured for the vpn and a peer is created automatically.

@Matthew-Beckett Matthew-Beckett self-assigned this Apr 29, 2023
@Matthew-Beckett
Copy link
Collaborator Author

Matthew-Beckett commented Apr 29, 2023

@jodevsa can I get a cursory review on this? My Go is awful, so just want to know I am heading in the right direction

@jodevsa
Copy link
Owner

jodevsa commented Apr 29, 2023

Sure, Can you please elaborate on the use cases of this feature?

@Matthew-Beckett
Copy link
Collaborator Author

Sure, the use case would be to put the individual pods on a WireGuard network for secure communication with services elsewhere in the mesh.

See: #27

@Matthew-Beckett
Copy link
Collaborator Author

@jodevsa can I get some help on why the e2e tests are failing, this code is still unfinished because I had to do some work to improve and fix up the makefile for local development.

@roberto-sebastiano
Copy link

roberto-sebastiano commented Sep 23, 2023

Hello, @Matthew-Beckett

how this would work to route multiple pods to a single wireguard peer interface ?

Having this scenario:
Wireguard is deployed as a peer that connects to a remote server. In that case, if i'm not wrong you have wg0 created inside the wireguard deployment (or better, inside the pod of the deployment).

In order to have another pod (your application) to route its traffic to that network interface, would this PR solve this scenario?

As far as I know, you need a multi-homed pod (like using multus) and bridge a dummy interface, otherwise your application pod will not connect or route to another interface (wg0) inside another pod.

@uhthomas
Copy link
Collaborator

uhthomas commented May 9, 2024

Has this been tested? Aren't pods immutable? I believe other projects use admission webhooks to patch pod specs before they're actually created.

https://github.com/linkerd/linkerd2/blob/1fed61edc945a39612c1c9bc6fec340dbeb0f15d/controller/proxy-injector/webhook.go

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants