vwbusguy, 1 month ago

@mikael I use Wireguard to encrypt traffic between Kubernetes nodes. Since there are so many vendor specific quirks with vxlan, using Wireguard ends up simplifying things while adding to the general security.

Flannel CNI supports Wireguard natively. (Node traffic encryption with Cilium CNI is also coming soon, but this is one area where Flannel is still better.)

mikael, 1 month ago

@vwbusguy not a bad use case for it. Does it affect throughput for you in a meaningful way?

vwbusguy, 1 month ago

@mikael Not in any appreciable way. The overhead is negligible, especially since Wireguard is built directly into the Linux kernel.

If etcd doesn't complain about added latency, it's a pretty good sign you're not going to notice it for anything else.

mikael, 1 month ago

@vwbusguy sounds really good! I’ll definitely keep this in mind.

vwbusguy, 1 month ago

@mikael

https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard