{"id":17067314,"url":"https://github.com/schu/wireguard-cni","last_synced_at":"2025-03-22T17:31:27.859Z","repository":{"id":55479069,"uuid":"170037218","full_name":"schu/wireguard-cni","owner":"schu","description":"A CNI plugin for WireGuard","archived":false,"fork":false,"pushed_at":"2020-12-28T08:53:11.000Z","size":41,"stargazers_count":39,"open_issues_count":0,"forks_count":5,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-01T17:51:17.422Z","etag":null,"topics":["cni","cni-plugin","kubernetes","networking","wireguard","wireguard-cni"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/schu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-02-10T22:58:23.000Z","updated_at":"2025-01-16T08:05:35.000Z","dependencies_parsed_at":"2022-08-15T01:20:14.765Z","dependency_job_id":null,"html_url":"https://github.com/schu/wireguard-cni","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schu%2Fwireguard-cni","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schu%2Fwireguard-cni/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schu%2Fwireguard-cni/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/schu%2Fwireguard-cni/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/schu","download_url":"https://codeload.github.com/schu/wireguard-cni/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244236093,"owners_count":20420752,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cni","cni-plugin","kubernetes","networking","wireguard","wireguard-cni"],"created_at":"2024-10-14T11:10:18.066Z","updated_at":"2025-03-22T17:31:27.537Z","avatar_url":"https://github.com/schu.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# wireguard-cni\n\nStatus: alpha, use with caution\n\nwireguard-cni is a CNI plugin for [WireGuard](https://www.wireguard.com/).\n\n## Installation\n\nConfigure the apiserver endpoint that `wg-cni` should use to query\nconfiguration:\n\n```\nkubectl -n kube-system create configmap wg-cni-env --from-literal=KUBERNETES_APISERVER_ENDPOINT=https://\u003cIP_ADDRESS\u003e:\u003cPORT\u003e\n```\n\nInstall wg-cni and its kubeconfig file on all nodes in the cluster:\n\n```\nkubectl apply -f manifests/wg-cni.yml\n```\n\nwg-cni is set up as a chained CNI plugin. This means you have\nto configure wg-cni as an additional CNI plugin in your configuration.\n\nTo do this, add wg-cni to the list of `plugins`:\n\n```\n{\n  \"type\": \"wg-cni\",\n  \"kubeConfigPath\": \"/etc/kubernetes/wg-cni.kubeconfig\"\n}\n```\n\nNote that the `wg-cni.kubeconfig` file gets created automatically by\nwg-cni during installation.\n\nwg-cni should now be ready and running - you can check with:\n\n```\nkubectl -n kube-system get pods -l k8s-app=wg-cni\n```\n\n### Example: chained plugin configuration with flannel\n\n\u003cdetails\u003e\n\nEdit the `kube-flannel-cfg` configmap and add `wg-cni` as a chained\nplugin. Deploy new flannel pods for the configuration to be written.\nTo do that, you can delete the currently running flannel pods with\n`kubectl -n kube-system delete pods -l app=flannel`.\n\nEdit the configmap:\n\n```\nkubectl -n kube-system edit configmap kube-flannel-cfg\n```\n\nExample kube-flannel-cfg configmap:\n\n```\nkind: ConfigMap\napiVersion: v1\nmetadata:\n  name: kube-flannel-cfg\n  namespace: kube-system\n  labels:\n    tier: node\n    app: flannel\ndata:\n  cni-conf.json: |\n    {\n      \"name\": \"cbr0\",\n      \"plugins\": [\n        {\n          \"type\": \"flannel\",\n          \"delegate\": {\n            \"hairpinMode\": true,\n            \"isDefaultGateway\": true\n          }\n        },\n        {\n          \"type\": \"portmap\",\n          \"capabilities\": {\n            \"portMappings\": true\n          }\n        },\n        {\n          \"type\": \"wg-cni\",\n          \"kubeConfigPath\": \"/etc/kubernetes/wg-cni.kubeconfig\"\n        }\n      ]\n    }\n  net-conf.json: |\n    {\n      \"Network\": \"10.244.0.0/16\",\n      \"Backend\": {\n        \"Type\": \"vxlan\"\n      }\n    }\n```\n\n\u003c/details\u003e\n\n## Usage\n\nTo add a WireGuard connection to a pod, two things are required:\n\n1. a secret with the configuration and\n1. an annotation in the pod's metadata to signal wg-cni that it should\n   configuare a link for it and where the configuration can be found.\n\nNote: pods that are not annotated are skipped by wg-cni.\n\nCreate a file `config.json` with the following structure:\n\n```\n{\n  \"address\": \"10.13.13.210/24\",\n  \"privateKey\": \"AAev16ZVYhmCQliIYKXMje1zObRp6TmET0KiUx7MJXc=\",\n  \"peers\": [\n    {\n      \"endpoint\": \"1.2.3.4:51820\",\n      \"publicKey\": \"+gXCSfkib2xFMeebKXIYBVZxV/Vh2mbi1dJeHCCjQmg=\",\n      \"allowedIPs\": [\n        \"10.13.13.0/24\"\n      ],\n      \"persistentKeepalive\": \"25s\"\n    }\n  ]\n}\n```\n\nCreate a secret from the file:\n\n```\nkubectl create secret generic wgcni-demo --from-file ./config.json\n```\n\nStart a new pod with a corresponding `wgcni.schu.io/configsecret` annotation:\n\n```\napiVersion: v1\nkind: Pod\nmetadata:\n  name: test\n  annotations:\n    wgcni.schu.io/configsecret: \"wgcni-demo\"\nspec:\n  ...\n```\n\nThe value `wgcni-demo` is the name of the secret in the pod's namespace.\n\nOnce running, the pod should have a `wg\u003csuffix\u003e` interface that is\nconfigured according to your configuration.\n\nIf an error occurs, you should find a message in the events:\n\n```\nkubectl get events\n```\n\n## Roadmap / Todo\n\n* [x] Switch to https://github.com/WireGuard/wgctrl-go for netlink\n* [x] Provide a container and manifest to install the wg-cni plugin binary\n  and required configuration on all nodes in a cluster\n* [ ] Allow dynamic configuration through Kubernetes resources\n* [ ] Consider allowing wg-cni to be used in standalone and chained mode\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fschu%2Fwireguard-cni","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fschu%2Fwireguard-cni","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fschu%2Fwireguard-cni/lists"}