Using WireGuard with Kubernetes
tom at tigera.io
Thu Apr 26 01:32:33 CEST 2018
For Kubernetes, using the bridge CNI plugin (
or even the ptp plugin (
should work fine. I wonder though if there's a way to alias the wg0 device
itself and push that into the container with something like the host-device
This would avoid the overhead of a veth (and a bridge).
<https://tigera.io/> *Tom* *Denham*
Senior Software Engineer
tom at tigera.io | @_tomdee <https://twitter.com/_tomdee> |
Follow us: Blog <https://blog.tigera.io/> | Twitter
<https://twitter.com/tigeraio> | LinkedIn
Secure Application Connectivity for the Cloud Native World
On Wed, Apr 25, 2018 at 1:15 PM, Martin Eskdale Moen <martinmoen at gmail.com>
> I've been doing some experiments with this. Not so much with kubes yet,
> that was next on the list.
> I think at the moment linking together the various network namespaces
> using a linux bridge should work.
> Not sure if I'm shooting myself in the foot at all using linux bridges.
> Reading over the docs of openvswitch vs linux bridge it seems the bridge is
> easier to understand and overall more useful.
> On Wed, Apr 25, 2018 at 6:54 PM, Tom Denham <tom at tigera.io> wrote:
>> I was wondering if anyone had any experience using WireGuard with
>> Kubernetes? I see that the WireGuard website says "Ready for Containers"
>> but the model it describes sounds like it would work for adding WireGuard
>> to a single container (putting the wg interface in the container itself).
>> If I have many containers on a host, and many containers on a host, and I
>> want them all to be able to communicate with each other using WireGuard,
>> then I would need to create many different WireGuard interfaces and
>> presumably they would all need their own independent config. It doesn't
>> feel like this would scale to 100's of hosts and tens of thousands of
>> I'm interested in hearing people's thoughts and ideas on this
>> WireGuard mailing list
>> WireGuard at lists.zx2c4.com
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the WireGuard