Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard on K8s: road-warrior-style VPN server

blog.levine.sh

Post reply on HN
Print view View original

41–50 of 54 posts

Re: WireGuard on K8s: road-warrior-style VPN server

#41

Post by aequitas »

brmgb wrote: post #33
moondev wrote: post #32

Earlier quoted context omitted.

k8s manifests are declarative though, not imperative config mgmt like the other tools.

Both Puppet and Ansible are declarative. Why do you think people use them rather than shell scripts ?

Ansible is only declerative on a action level. At a playbook level it's imperative. You can install and remove the same package within a playbook, the outcome will be dependent on the order.

Puppet is fully declerative but for me it lacks an easy way to undo changes. It would be nice if it could work like Terraform where it keeps a 'state' of all changes it made in the past so when you remove a resource from your config it could 'undo' the change.

I still use Puppet (mostly with Bolt nowadays) for systems that don't fit Kubernetes, but they're becomming less and less.

Re: WireGuard on K8s: road-warrior-style VPN server

#42

Post by aequitas »

sclevine wrote: post #38
aequitas wrote: post #26

A few people seem to be confused why K8s is needed when you can just run this on the OS itself. I think they miss the point that this is not a guide to setup Wireguard using K8s but setup Wireguard if you only have/want a K8s environment. As the author notes: "you can run a road-warrior-style Wireguard server in K8s without making changes to the node." Which makes this guide ideal for me. I run a lightweight K8s flav…

This was indeed the motivation for my write-up :)

Thanks, I was meaning to look into this but your post will save me some research work.

Re: WireGuard on K8s: road-warrior-style VPN server

#43

Post by dfox »

tombh wrote: post #17

I think we all understand the usefulness of a road-warrior-style VPN. But it doesn't seem so clear what k8s is adding here? Anyway, on the topic of scalable UDP services, does anyone have any experience of load balancing a UDP service? Because UDP is connectionless there's no obvious way to make UDP packets "sticky". Are there any established practices that could help scale this k8s Wireguard service to 2 or more con…

As for what k8s adds here I don't know, but this thing adds to k8s knowledge one interesting fact: It can be useful to run container that does not contain any process doing useful work ;)

Re: WireGuard on K8s: road-warrior-style VPN server

#44

Post by vorpalhex »

j88439h84 wrote: post #23
pot8n wrote: post #9

Earlier quoted context omitted.

Honestly that's the least of all problems and catastrophes of Tailscale. You must have 1000% of confidence in their own servers security, if the published public keys hosted on their servers have been tampered then the entire network is compromised. Also, if their service is down, you will be unable to connect to your network even if it is completely fine and working.

What's the more-secure alternative?

Exchange your keys ahead of time, preferably offline, and just run wireguard yourself. You may need a service discovery solution depending on your networking situation.

Re: WireGuard on K8s: road-warrior-style VPN server

#45

Post by alyandon »

DictumMortuum wrote: post #31
0az wrote: post #8

Earlier quoted context omitted.

My main annoyance with Tailscale is the reliance on Google. I need to refresh my memory, but I think this makes a VLAN shared with other people impossible. This is why I'm still using https://zerotier.com -- also no affiliation.

Zerotier doesn't use wireguard though - which makes a difference. I have a private mesh of my family's computers on different networks and tailscale/wireguard was blazingly fast. I ended up using zerotier though, because it had an android client and availability was more important to me than speed at this point.

For me, WireGuard isn't really a viable option because I want functional mDNS name resolution.

As a test, I did set up a vxlan tunnel through a wireguard tunnel (linux to linux) to prove that it is possible to get that working. However, I can't do that on something like a mobile android client.

Re: WireGuard on K8s: road-warrior-style VPN server

#46

Post by 0xCMP »

vorpalhex wrote: post #44
j88439h84 wrote: post #23

Earlier quoted context omitted.

What's the more-secure alternative?

Exchange your keys ahead of time, preferably offline, and just run wireguard yourself. You may need a service discovery solution depending on your networking situation.

"You may need a service discovery solution"

You mean... like tailscale does? (e.g. They have devices registered with a name and you can access them. They're all given static IPs so an internal DNS server could simply resolve their names... kind of like service discovery)

Re: WireGuard on K8s: road-warrior-style VPN server

#47

Post by jzelinskie »

rektide wrote: post #3

Worth metnioning Kilo, which is an enhancement or a CNI (container network interface) provider that does Wireguard for Kubernetes. https://github.com/squat/kilo

Yes! When you think of Wireguard and Kubernetes, you should think of Lucas! He spends a lot of his free time experimenting with the combination of these two technologies. At KubeCon EU Barcelona, he gave a talk about cross-cluster networking using Wireguard: https://www.youtube.com/watch?v=iPz_DAOOCKA

Re: WireGuard on K8s: road-warrior-style VPN server

#49

Post by yardstick »

georgyo wrote: post #35
tombh wrote: post #17

I think we all understand the usefulness of a road-warrior-style VPN. But it doesn't seem so clear what k8s is adding here? Anyway, on the topic of scalable UDP services, does anyone have any experience of load balancing a UDP service? Because UDP is connectionless there's no obvious way to make UDP packets "sticky". Are there any established practices that could help scale this k8s Wireguard service to 2 or more con…

Load balancing UDP isn't too difficult. However that is not the hard part here. It is ensuring the routing happens correctly. A client must hard code it's IP address currently, which means if it can connect to more than one node, then it is unclear which path a response from a server should take to get back to that client. Each VPN instance could run NAT, but then users would never be able to talk to each other. Wire…

WireGuard proponents would probably tell you to run BGP or some routing protocol over the VPN, maybe GRE too?

I agree with you, WireGuard makes this significantly harder than it needs to be. Other protocols do better in this respect.

Re: WireGuard on K8s: road-warrior-style VPN server

#50

Post by ignoramous »

tombh wrote: post #29
dmw_ng wrote: post #27

Earlier quoted context omitted.

This has been done for 2 decades or more by hashing the connection tuple somehow, e.g. hash(src ip | src port) % number-of-replicas, etc. Naturally it breaks if replica count changes. The other option is conntrack but then you have another stateful component that doesn't scale

That makes sense, though I suppose for a road warrior setup the source IP might change every so often right?

Wireguard, inspired by MoSH, handles reconnections especially well. I guess, TCP flows tunnled through UDP might be reset depending on which server (behind the load-balancer) is handling them?

Cloudflare shared, in some detail, how they load-balance wireguard traffic for roaming-ip and ports: https://news.ycombinator.com/item?id=21070315

Usually, I've seen UDP client-affinity set on (source-ip, destination-ip) tuple to handle port changes, but it doesn't help client with roaming-ips.

Post reply on HN