<story><title>WireGuard on K8s: road-warrior-style VPN server</title><url>https://blog.levine.sh/14058/wireguard-on-k8s-road-warrior-style-vpn-server</url></story><parent_chain><item><author>tombh</author><text>I think we all understand the usefulness of a road-warrior-style VPN. But it doesn&amp;#x27;t seem so clear what k8s is adding here?&lt;p&gt;Anyway, on the topic of scalable UDP services, does anyone have any experience of load balancing a UDP service? Because UDP is connectionless there&amp;#x27;s no obvious way to make UDP packets &amp;quot;sticky&amp;quot;. Are there any established practices that could help scale this k8s Wireguard service to 2 or more containers?</text></item></parent_chain><comment><author>sclevine</author><text>I&amp;#x27;m just using K8s (specifically: K3s) for configuration management in this case. This post hits the nail on the head: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=23006114&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=23006114&lt;/a&gt;&lt;p&gt;That said, NGINX can do UDP load balancing and WireGuard is stateless, so it should be possible to use this with a Service + NGINX ingress controller at scale:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;kubernetes.github.io&amp;#x2F;ingress-nginx&amp;#x2F;user-guide&amp;#x2F;exposing-tcp-udp-services&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;kubernetes.github.io&amp;#x2F;ingress-nginx&amp;#x2F;user-guide&amp;#x2F;exposi...&lt;/a&gt;&lt;p&gt;I have not tried it though.</text></comment>
<story><title>WireGuard on K8s: road-warrior-style VPN server</title><url>https://blog.levine.sh/14058/wireguard-on-k8s-road-warrior-style-vpn-server</url></story><parent_chain><item><author>tombh</author><text>I think we all understand the usefulness of a road-warrior-style VPN. But it doesn&amp;#x27;t seem so clear what k8s is adding here?&lt;p&gt;Anyway, on the topic of scalable UDP services, does anyone have any experience of load balancing a UDP service? Because UDP is connectionless there&amp;#x27;s no obvious way to make UDP packets &amp;quot;sticky&amp;quot;. Are there any established practices that could help scale this k8s Wireguard service to 2 or more containers?</text></item></parent_chain><comment><author>KenanSulayman</author><text>Well if you make it a DaemonSet you could technically use the container as the network interface of other containers throughout the whole cluster. That said, I&amp;#x27;m very happy that his example k8s deployment uses secrets.&lt;p&gt;I didn&amp;#x27;t know Ubuntu 20.04 back ported WG into its 5.4 kernel. I spent a few hours yesterday fixing a node after breaking ZFS because I upgraded to 5.6 for WG support. I feel rather silly now..&lt;p&gt;edit: rektide mentioned &amp;#x27;kilo&amp;#x27; which actually does exactly what I said (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;squat&amp;#x2F;kilo&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;squat&amp;#x2F;kilo&lt;/a&gt;).</text></comment>