nmiculinic / wg-operator

Wireguard operator

wg-operator

This project aim to dynamically reconfigure wireguard on the fly for the cluster nodes.

QuickStart

See /deploy folder. Apply CRDs, that is under /deploy/crds. Example servers/clients are under /deploy/servers and /deploy/clients. Recommended deployment is also provided under /deploy

Goals

• Basic client-server VPN paradigm
• Implement IPtables masqerading for out of VPN IPs --> use preUp/postDown for now, and wg-quick or wg-quick-go to run them at system boot.
• Highly scalable for clients (i.e. supporting 1000+ clients with minimal resource usage on client side). For mostly static topologies this should be quite performant.
  • update coalescing --> implemented via 200ms coalescing time window
  • error exponential backoff --> Not implemented, on error we retry every 5 seconds
  • client query only myself --> partially implemeted, informer cache is fetching all client changes, but update is triggered only for myself
• Implement per server interface for clients -- allows custom routing to operate on top of wireguard (e.g. OSPF/BGP)
• Medium dynamic network topology changes, wireguard setting & nodes won't change too often
• Unit test coverage + CI for config generation
• End2end test within CI
• Support key rotation
• Have decent usage documentation

Non-goals

• support OpenVPN or other VPN providers
• install wireguard on the target machines/perform upgrades. Use ansible or something else for it. Also look into https://github.com/KrakenSystems/wg-cni

Docker images registy, automatically built via CI pipeline

It's located at:

• https://gitlab.com/neven-miculinic/wg-operator/container_registry

Per tag images:

• registry.gitlab.com/neven-miculinic/wg-operator:-

Example:

• registry.gitlab.com/neven-miculinic/wg-operator:v0.1.0-amd64

Per branch images:

registry.gitlab.com/neven-miculinic/wg-operator:- registry.gitlab.com/neven-miculinic/wg-operator:--

Example:

• registry.gitlab.com/neven-miculinic/wg-operator:master-6b18ddbf-amd64
• registry.gitlab.com/neven-miculinic/wg-operator:master-6b18ddbf-arm32v7
• registry.gitlab.com/neven-miculinic/wg-operator:master-6b18ddbf-arm64v8
• registry.gitlab.com/neven-miculinic/wg-operator:master-amd64
• registry.gitlab.com/neven-miculinic/wg-operator:master-arm32v7
• registry.gitlab.com/neven-miculinic/wg-operator:master-arm64v8

Bare metal deployment

There's ansible role in the deploy/role with example playbook in deploy/playbook.yml

wg-operator's Issues

wireguardctrl has been moved and renamed to wgctrl

Hello, I've spotted your project as a user of my wireguardctrl project and wanted to reach out to let you know that the project has been moved to the WireGuard org and the main package has been renamed:

https://godoc.org/golang.zx2c4.com/wireguard/wgctrl

It should be fairly easy to update, but feel free to reach out if you run into any issues. Thanks!

Add missing license

I'm interested in using this project, but there is no license defined for it. Could you please add it?