Using WireGuard with Kubernetes

Tom Denham tom at
Thu Apr 26 01:32:33 CEST 2018

For Kubernetes, using the bridge CNI plugin (
or even the ptp plugin (
should work fine. I wonder though if there's a way to alias the wg0 device
itself and push that into the container with something like the host-device
plugin (
This would avoid the overhead of a veth (and a bridge).

<> *Tom* *Denham*
Senior Software Engineer
tom at | @_tomdee <> |  <>
Follow us: Blog <> | Twitter
<> | LinkedIn

Secure Application Connectivity for the Cloud Native World

On Wed, Apr 25, 2018 at 1:15 PM, Martin Eskdale Moen <martinmoen at>

> I've been doing some experiments with this. Not so much with kubes yet,
> that was next on the list.
> I think at the moment linking together the various network namespaces
> using a linux bridge should work.
> Not sure if I'm shooting myself in the foot at all using linux bridges.
> Reading over the docs of openvswitch vs linux bridge it seems the bridge is
> easier to understand and overall more useful.
> On Wed, Apr 25, 2018 at 6:54 PM, Tom Denham <tom at> wrote:
>> I was wondering if anyone had any experience using WireGuard with
>> Kubernetes? I see that the WireGuard website says "Ready for Containers"
>> but the model it describes sounds like it would work for adding WireGuard
>> to a single container (putting the wg interface in the container itself).
>> If I have many containers on a host, and many containers on a host, and I
>> want them all to be able to communicate with each other using WireGuard,
>> then I would need to create many different WireGuard interfaces and
>> presumably they would all need their own independent config. It doesn't
>> feel like this would scale to 100's of hosts and tens of thousands of
>> containers.
>> I'm interested in hearing people's thoughts and ideas on this
>> Thanks
>> Tom
>> _______________________________________________
>> WireGuard mailing list
>> WireGuard at
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the WireGuard mailing list