WireGuard on K8s: road-warrior-style VPN server • Hacker News Board

Re: WireGuard on K8s: road-warrior-style VPN server

#51

Post by vorpalhex » Tue, Apr 28, 2020, 9:28 PM UTC

0xCMP wrote: post #46

vorpalhex wrote: post #44

Earlier quoted context omitted.

Exchange your keys ahead of time, preferably offline, and just run wireguard yourself. You may need a service discovery solution depending on your networking situation.

"You may need a service discovery solution" You mean... like tailscale does? (e.g. They have devices registered with a name and you can access them. They're all given static IPs so an internal DNS server could simply resolve their names... kind of like service discovery)

Right and Tailscale is a fine product for a variety of cases but there are cases where TailScale may not be a fit for you either due to the gSuite Integration, different privacy constraints or just not wanting to trust someone else with your vpn.

Re: WireGuard on K8s: road-warrior-style VPN server

#52

Post by the_resistence » Wed, Apr 29, 2020, 1:06 PM UTC

0az wrote: post #8

wferrell wrote: post #4

Worth taking look at http://tailscale.com - Their tag line: Private networks made easy. No affiliation -- just like their product.

My main annoyance with Tailscale is the reliance on Google. I need to refresh my memory, but I think this makes a VLAN shared with other people impossible. This is why I'm still using https://zerotier.com -- also no affiliation.

wow, good for you. No luck at all with zt in mainland China

Re: WireGuard on K8s: road-warrior-style VPN server

#53

Post by jatone » Wed, Apr 29, 2020, 1:34 PM UTC

aequitas wrote: post #39

darkwater wrote: post #30

Earlier quoted context omitted.

You say you don't want to use Puppet or Ansible but you are basically using kubernetes manifests for the same exact reason: configuration management. I know it can be funny and I totally support it but I thought it should be pointed out anyway.

The problem I have with traditional configuration management is that in the end, even if it's declerative, you are stil modifying a imperative OS/userland. So it will collect state at some point. Things like undoing changes with those tools is not that trivial. You have to actively reverse them in your configuration. Which turns nice CM code into mess. Want to try out something quick? Better not be afraid it messes u…

not really true anymore with systemd portable services. or package managers.

Re: WireGuard on K8s: road-warrior-style VPN server

#54

Post by lima » Mon, May 04, 2020, 9:49 AM UTC

pot8n wrote: post #19

lima wrote: post #16

Earlier quoted context omitted.

Tailscale is open source, it should be possible to set up your own server. The hosted Tailscale product is meant for GSuite customers who want an peer-to-peer VPN with corporate SSO. Yes, you have to trust them - SSO login is inherently centralized. My company uses it, it works great.

I am not really sure you understand how it works. There is no hosted/not hosted versions of it. You must connect your "opensource" client/agent through their coordination servers hosted by them to host and publish the public key to the other devices in your network and you can not skip their service. So Tailscale is effectively as opensource as any commercial opensource VPN client. It's entirely useless when not used…

The backend (minus the web UI?) is open source as well.