wg-operator

This project aim to dynamically reconfigure wireguard on the fly for the cluster nodes.

QuickStart

See /deploy folder. Apply CRDs, that is under /deploy/crds. Example servers/clients are under /deploy/servers and /deploy/clients. Recommended deployment is also provided under /deploy

Goals

• Basic client-server VPN paradigm
• Implement IPtables masqerading for out of VPN IPs --> use preUp/postDown for now, and wg-quick or wg-quick-go to run them at system boot.
• Highly scalable for clients (i.e. supporting 1000+ clients with minimal resource usage on client side). For mostly static topologies this should be quite performant.
  • update coalescing --> implemented via 200ms coalescing time window
  • error exponential backoff --> Not implemented, on error we retry every 5 seconds
  • client query only myself --> partially implemeted, informer cache is fetching all client changes, but update is triggered only for myself
• Implement per server interface for clients -- allows custom routing to operate on top of wireguard (e.g. OSPF/BGP)
• Medium dynamic network topology changes, wireguard setting & nodes won't change too often
• Unit test coverage + CI for config generation
• End2end test within CI
• Support key rotation
• Have decent usage documentation

Non-goals

• support OpenVPN or other VPN providers
• install wireguard on the target machines/perform upgrades. Use ansible or something else for it. Also look into https://github.com/KrakenSystems/wg-cni

Docker images registy, automatically built via CI pipeline

It's located at:

• https://gitlab.com/neven-miculinic/wg-operator/container_registry

Per tag images:

• registry.gitlab.com/neven-miculinic/wg-operator:-

Example:

• registry.gitlab.com/neven-miculinic/wg-operator:v0.1.0-amd64

Per branch images:

registry.gitlab.com/neven-miculinic/wg-operator:- registry.gitlab.com/neven-miculinic/wg-operator:--

Example:

• registry.gitlab.com/neven-miculinic/wg-operator:master-6b18ddbf-amd64
• registry.gitlab.com/neven-miculinic/wg-operator:master-6b18ddbf-arm32v7
• registry.gitlab.com/neven-miculinic/wg-operator:master-6b18ddbf-arm64v8
• registry.gitlab.com/neven-miculinic/wg-operator:master-amd64
• registry.gitlab.com/neven-miculinic/wg-operator:master-arm32v7
• registry.gitlab.com/neven-miculinic/wg-operator:master-arm64v8

Bare metal deployment

There's ansible role in the deploy/role with example playbook in deploy/playbook.yml