masipcat
commented
2 years ago I think I need to improve the README :P The k8s example is not just how to deploy wireguard in a k8s cluster, it also contains the additional configuration to be able to communicate from outside the cluster to all the pods. That's the purpose of enabling ip routing and it can be done in a different container because it is a system-wide configuration (affects the entire k8s node).
I don't remember, but I guess I used the busybox image in the initContainer to avoid installing sysctl in the wireguard image. Anyway, now it seems that there is a better way to do it with k8s. Something like this should work as well (but I haven't tried):
apiVersion: apps/v1
kind: Deployment
metadata:
name: wireguard
spec:
replicas: 1
selector:
matchLabels:
app: wireguard
template:
metadata:
labels:
app: wireguard
spec:
securityContext:
sysctls:
- name: net.ipv4.ip_forward
value: "1"
- name: net.ipv4.conf.all.forwarding
value: "1"
containers:
- name: wireguard
image: masipcat/wireguard-go:latest
...I hope this answers your questions :) If this works for you, feel free to open a PR to improve the readme with this change.
airza
I'm trying to get this container to work on a k8s deployment and am a bit perplexed: the
initContainer'sysctls' is created and enables ipv4 routing but it doesn't seem to be accessed or used anywhere else. Can I remove this safely? It is quite possible that I don't understand how images are composed as I am new to k8s, but I don't understand its relationship to the wg container. Thanks for the image, by the way! I am slowly understanding what it's up to 8^)