Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard on K8s: road-warrior-style VPN server

blog.levine.sh

Post reply on HN
Print view View original

31–40 of 54 posts

Re: WireGuard on K8s: road-warrior-style VPN server

#31

Post by DictumMortuum »

0az wrote: post #8
wferrell wrote: post #4

Worth taking look at http://tailscale.com - Their tag line: Private networks made easy. No affiliation -- just like their product.

My main annoyance with Tailscale is the reliance on Google. I need to refresh my memory, but I think this makes a VLAN shared with other people impossible. This is why I'm still using https://zerotier.com -- also no affiliation.

Zerotier doesn't use wireguard though - which makes a difference. I have a private mesh of my family's computers on different networks and tailscale/wireguard was blazingly fast. I ended up using zerotier though, because it had an android client and availability was more important to me than speed at this point.

Re: WireGuard on K8s: road-warrior-style VPN server

#32

Post by moondev »

darkwater wrote: post #30
aequitas wrote: post #26

A few people seem to be confused why K8s is needed when you can just run this on the OS itself. I think they miss the point that this is not a guide to setup Wireguard using K8s but setup Wireguard if you only have/want a K8s environment. As the author notes: "you can run a road-warrior-style Wireguard server in K8s without making changes to the node." Which makes this guide ideal for me. I run a lightweight K8s flav…

You say you don't want to use Puppet or Ansible but you are basically using kubernetes manifests for the same exact reason: configuration management. I know it can be funny and I totally support it but I thought it should be pointed out anyway.

k8s manifests are declarative though, not imperative config mgmt like the other tools.

Re: WireGuard on K8s: road-warrior-style VPN server

#33

Post by brmgb »

moondev wrote: post #32
darkwater wrote: post #30

Earlier quoted context omitted.

You say you don't want to use Puppet or Ansible but you are basically using kubernetes manifests for the same exact reason: configuration management. I know it can be funny and I totally support it but I thought it should be pointed out anyway.

k8s manifests are declarative though, not imperative config mgmt like the other tools.

Both Puppet and Ansible are declarative.

Why do you think people use them rather than shell scripts ?

Re: WireGuard on K8s: road-warrior-style VPN server

#34

Post by KenanSulayman »

tombh wrote: post #28
KenanSulayman wrote: post #25

Earlier quoted context omitted.

Well if you make it a DaemonSet you could technically use the container as the network interface of other containers throughout the whole cluster. That said, I'm very happy that his example k8s deployment uses secrets. I didn't know Ubuntu 20.04 back ported WG into its 5.4 kernel. I spent a few hours yesterday fixing a node after breaking ZFS because I upgraded to 5.6 for WG support. I feel rather silly now.. edit: r…

That's an interesting idea about using a unified network interface. Do you know how you might then get the right packets to the right containers/processes? Does that even matter with Wireguard?

You can use a different container as network in docker: 'container:' would route the container traffic through specified container.

Example vpn container:

  docker run --name foo --cap-add=NET_ADMIN ...
Other container:

  docker run --net=container:foo ...
Now you'd need to specify the respective routing rules [1] in the container.

[1] i.e. https://github.com/bubuntux/nordvpn/blob/master/start_vpn.sh...

Re: WireGuard on K8s: road-warrior-style VPN server

#35

Post by georgyo »

tombh wrote: post #17

I think we all understand the usefulness of a road-warrior-style VPN. But it doesn't seem so clear what k8s is adding here? Anyway, on the topic of scalable UDP services, does anyone have any experience of load balancing a UDP service? Because UDP is connectionless there's no obvious way to make UDP packets "sticky". Are there any established practices that could help scale this k8s Wireguard service to 2 or more con…

Load balancing UDP isn't too difficult. However that is not the hard part here. It is ensuring the routing happens correctly.

A client must hard code it's IP address currently, which means if it can connect to more than one node, then it is unclear which path a response from a server should take to get back to that client. Each VPN instance could run NAT, but then users would never be able to talk to each other.

Wireguard makes this significantly harder than say ipsec. WG has nothing to indicate when a client connects. And there is no dead peer detection, so you cannot tell one a client disconnects. IE. Scripting something to update a global routing table to say which sever has which client is near impossible.

I use wireguard daily for personal stuff. However I cannot think how I would make it work in an active-active situation besides NAT, which I don't want.

Re: WireGuard on K8s: road-warrior-style VPN server

#36

Post by lukeschlather »

brmgb wrote: post #33
moondev wrote: post #32

Earlier quoted context omitted.

k8s manifests are declarative though, not imperative config mgmt like the other tools.

Both Puppet and Ansible are declarative. Why do you think people use them rather than shell scripts ?

They look declarative but every Ansible playbook I have ever read or written has involved some imperative code. And even if you only use it in a declarative fashion, it doesn't change the fact that it's very much a step-by-step ordered list of things to install.

The declarative syntax is certainly a step up from shell scripts, but it's not as pure as K8s.

Re: WireGuard on K8s: road-warrior-style VPN server

#37

Post by koffiezet »

brmgb wrote: post #33
moondev wrote: post #32

Earlier quoted context omitted.

k8s manifests are declarative though, not imperative config mgmt like the other tools.

Both Puppet and Ansible are declarative. Why do you think people use them rather than shell scripts ?

That's maybe the theory, but in reality, the only thing Ansible hopefully is, is idempotent between playbook runs - but there are no guarantees there, at all. Only in very simple setups things can be fully declarative in it's totality.

Don't have much puppet experience, but I can't count the times anymore that I've had to add steps to playbooks just to determine stuff used in one of the following steps. The other option was to write a snowflake Ansible module. The individual steps/plays might be declarative, the playbooks are not.

Re: WireGuard on K8s: road-warrior-style VPN server

#38

Post by sclevine »

aequitas wrote: post #26

A few people seem to be confused why K8s is needed when you can just run this on the OS itself. I think they miss the point that this is not a guide to setup Wireguard using K8s but setup Wireguard if you only have/want a K8s environment. As the author notes: "you can run a road-warrior-style Wireguard server in K8s without making changes to the node." Which makes this guide ideal for me. I run a lightweight K8s flav…

This was indeed the motivation for my write-up :)

Re: WireGuard on K8s: road-warrior-style VPN server

#39

Post by aequitas »

darkwater wrote: post #30
aequitas wrote: post #26

A few people seem to be confused why K8s is needed when you can just run this on the OS itself. I think they miss the point that this is not a guide to setup Wireguard using K8s but setup Wireguard if you only have/want a K8s environment. As the author notes: "you can run a road-warrior-style Wireguard server in K8s without making changes to the node." Which makes this guide ideal for me. I run a lightweight K8s flav…

You say you don't want to use Puppet or Ansible but you are basically using kubernetes manifests for the same exact reason: configuration management. I know it can be funny and I totally support it but I thought it should be pointed out anyway.

The problem I have with traditional configuration management is that in the end, even if it's declerative, you are stil modifying a imperative OS/userland. So it will collect state at some point. Things like undoing changes with those tools is not that trivial. You have to actively reverse them in your configuration. Which turns nice CM code into mess. Want to try out something quick? Better not be afraid it messes up your OS/userland as there is no simple undo.

So since I'm doing isolation in containers/Docker already it's a small step to a lightweight Kubernetes. What Kubernetes gives me on top of that is that I can consider everything below the application layer as a declarative API.

Re: WireGuard on K8s: road-warrior-style VPN server

#40

Post by sclevine »

tombh wrote: post #17

I think we all understand the usefulness of a road-warrior-style VPN. But it doesn't seem so clear what k8s is adding here? Anyway, on the topic of scalable UDP services, does anyone have any experience of load balancing a UDP service? Because UDP is connectionless there's no obvious way to make UDP packets "sticky". Are there any established practices that could help scale this k8s Wireguard service to 2 or more con…

I'm just using K8s (specifically: K3s) for configuration management in this case. This post hits the nail on the head: https://news.ycombinator.com/item?id=23006114

That said, NGINX can do UDP load balancing and WireGuard is stateless, so it should be possible to use this with a Service + NGINX ingress controller at scale: https://kubernetes.github.io/ingress-nginx/user-guide/exposi...

I have not tried it though.

Post reply on HN