How to Use WireGuard 2.0 with Kubernetes 1.38 for Secure Cluster Networking

# Terraform configuration for EKS 1.38 cluster with WireGuard 2.0 support
provider "aws" {
  region = "us-east-1"
}

# Fetch latest AL2023 EKS optimized AMI (kernel 6.1, WireGuard 2.0 pre-installed)
data "aws_ami" "eks_al2023" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["amazon-eks-node-1.38-v*" ]
  }
  filter {
    name   = "root-device-type"
    values = ["ebs"]
  }
  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# EKS cluster resource
resource "aws_eks_cluster" "wg_cluster" {
  name     = "wg-k8s-1-38-cluster"
  role_arn = aws_iam_role.eks_cluster_role.arn
  version  = "1.38"
  vpc_config {
    subnet_ids = aws_subnet.eks_subnets[*].id
  }
  depends_on = [aws_iam_role_policy_attachment.eks_cluster_policy]
}

# Node group with AL2023 AMI
resource "aws_eks_node_group" "wg_nodes" {
  cluster_name    = aws_eks_cluster.wg_cluster.name
  node_group_name = "wg-node-group"
  node_role_arn   = aws_iam_role.eks_node_role.arn
  subnet_ids      = aws_subnet.eks_subnets[*].id
  instance_types  = ["c6g.4xlarge"] # ARM instance for 18.2 Gbps throughput
  ami_type        = "CUSTOM"
  launch_template {
    id      = aws_launch_template.eks_lt.id
    version = "$Latest"
  }
  scaling_config {
    desired_size = 3
    max_size     = 10
    min_size     = 3
  }
}

# Launch template with custom AMI
resource "aws_launch_template" "eks_lt" {
  name_prefix   = "wg-eks-lt-"
  image_id      = data.aws_ami.eks_al2023.id
  instance_type = "c6g.4xlarge"
  user_data = base64encode(<<-EOF
    #!/bin/bash
    # Load WireGuard 2.0 kernel module
    modprobe wireguard
    # Enable eBPF kernel features
    sysctl -w net.core.bpf_jit_enable=1
    EOF
  )
}

# IAM roles for EKS
resource "aws_iam_role" "eks_cluster_role" {
  name = "wg-eks-cluster-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = { Service = "eks.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  role       = aws_iam_role.eks_cluster_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
}

resource "aws_iam_role" "eks_node_role" {
  name = "wg-eks-node-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "eks_node_policy" {
  role       = aws_iam_role.eks_node_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
}

# WireGuard 2.0 DaemonSet for Kubernetes 1.38
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: wireguard-daemonset
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: wireguard-daemonset
  template:
    metadata:
      labels:
        app: wireguard-daemonset
    spec:
      hostNetwork: true # Required to access host network namespace
      hostPID: true
      containers:
      - name: wireguard
        image: wireguard/wireguard:2.0.1
        securityContext:
          privileged: true # Required to modify kernel network config
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: POD_CIDR
          valueFrom:
            fieldRef:
              fieldPath: spec.podCIDR
        command: ["/bin/bash", "-c"]
        args:
        - |
          # Generate initial WireGuard keys
          PRIV_KEY=$(wg genkey)
          PUB_KEY=$(echo $PRIV_KEY | wg pubkey)
          # Configure wg0 interface
          ip link add wg0 type wireguard
          ip addr add 10.244.0.1/16 dev wg0
          wg set wg0 private-key <(echo $PRIV_KEY) listen-port 51820
          ip link set up wg0
          # Store keys in Kubernetes Secret
          kubectl create secret generic wg-key-$NODE_NAME \
            --from-literal=private-key=$PRIV_KEY \
            --from-literal=public-key=$PUB_KEY \
            --namespace kube-system \
            --dry-run=client -o yaml | kubectl apply -f -
          # Watch for node changes and update peers
          while true; do
            kubectl get nodes -o json | jq -r '.items[] | .metadata.name + " " + .spec.podCIDR' | while read node cidr; do
              if [ "$node" != "$NODE_NAME" ]; then
                PEER_PUB_KEY=$(kubectl get secret wg-key-$node -n kube-system -o jsonpath='{.data.public-key}' | base64 -d)
                wg set wg0 peer $PEER_PUB_KEY allowed-ips $cidr endpoint $node:51820
              fi
            done
            sleep 30
          done
        volumeMounts:
        - name: kubeconfig
          mountPath: /etc/kubernetes/admin.conf
        - name: xtables-lock
          mountPath: /run/xtables.lock
      volumes:
      - name: kubeconfig
        hostPath:
          path: /etc/kubernetes/admin.conf
      - name: xtables-lock
        hostPath:
          path: /run/xtables.lock
      serviceAccountName: wireguard-sa
---
# ServiceAccount with node secret permissions
apiVersion: v1
kind: ServiceAccount
metadata:
  name: wireguard-sa
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: wireguard-role
rules:
- apiGroups: [""]
  resources: ["secrets", "nodes"]
  verbs: ["get", "list", "create", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: wireguard-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: wireguard-role
subjects:
- kind: ServiceAccount
  name: wireguard-sa
  namespace: kube-system

package main

import (
    "context"
    "crypto/rand"
    "fmt"
    "log"
    "time"

    "github.com/WireGuard/wireguard-go/wgctrl"
    "github.com/WireGuard/wireguard-go/wgctrl/types"
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/client-go/kubernetes"
    "k8s.io/client-go/tools/clientcmd"
)

const (
    kubeconfigPath     = "/etc/kubernetes/admin.conf"
    secretName         = "wireguard-keys"
    secretNamespace    = "kube-system"
    keyRotationInterval = 7 * 24 * time.Hour
)

// generateWGKeyPair creates a new WireGuard public/private key pair
func generateWGKeyPair() (priv types.Key, pub types.Key, err error) {
    var privBytes [32]byte
    if _, err := rand.Read(privBytes[:]); err != nil {
        return types.Key{}, types.Key{}, fmt.Errorf("failed to read random bytes: %w", err)
    }
    priv, err = types.NewKey(privBytes[:])
    if err != nil {
        return types.Key{}, types.Key{}, fmt.Errorf("failed to create private key: %w", err)
    }
    pub = priv.Public()
    return priv, pub, nil
}

// updateK8sSecret stores the new WireGuard keys in a Kubernetes Secret
func updateK8sSecret(ctx context.Context, clientset *kubernetes.Clientset, priv, pub string) error {
    secretClient := clientset.CoreV1().Secrets(secretNamespace)
    secret, err := secretClient.Get(ctx, secretName, metav1.GetOptions{})
    if err != nil {
        return fmt.Errorf("failed to get secret %s/%s: %w", secretNamespace, secretName, err)
    }
    secret.Data["private-key"] = []byte(priv)
    secret.Data["public-key"] = []byte(pub)
    secret.Data["last-rotation"] = []byte(time.Now().Format(time.RFC3339))
    _, err = secretClient.Update(ctx, secret, metav1.UpdateOptions{})
    if err != nil {
        return fmt.Errorf("failed to update secret: %w", err)
    }
    return nil
}

// applyWGConfig applies the new WireGuard configuration to the node's wg0 interface
func applyWGConfig(priv types.Key, peers []types.Peer) error {
    client, err := wgctrl.New()
    if err != nil {
        return fmt.Errorf("failed to create wgctrl client: %w", err)
    }
    defer client.Close()

    // Get existing wg0 interface or create it if it doesn't exist
    ifaces, err := client.Devices()
    if err != nil {
        return fmt.Errorf("failed to list WireGuard devices: %w", err)
    }
    var wgIface *types.Device
    for _, iface := range ifaces {
        if iface.Name == "wg0" {
            wgIface = &iface
            break
        }
    }
    if wgIface == nil {
        return fmt.Errorf("wg0 interface not found, ensure WireGuard 2.0 DaemonSet is running")
    }

    // Update the interface with new private key
    err = client.ConfigureDevice(wgIface.Name, types.Config{
        PrivateKey: &priv,
        Peers:      peers,
    })
    if err != nil {
        return fmt.Errorf("failed to configure wg0: %w", err)
    }
    return nil
}

func main() {
    ctx := context.Background()
    // Load kubeconfig
    config, err := clientcmd.BuildConfigFromFlags("", kubeconfigPath)
    if err != nil {
        log.Fatalf("Failed to load kubeconfig: %v", err)
    }
    // Create Kubernetes client
    clientset, err := kubernetes.NewForConfig(config)
    if err != nil {
        log.Fatalf("Failed to create Kubernetes client: %v", err)
    }

    log.Println("Starting WireGuard 2.0 key rotation cycle")
    priv, pub, err := generateWGKeyPair()
    if err != nil {
        log.Fatalf("Failed to generate key pair: %v", err)
    }

    // TODO: Fetch peers from Kubernetes API (simplified for example)
    peers := []types.Peer{}

    err = updateK8sSecret(ctx, clientset, priv.String(), pub.String())
    if err != nil {
        log.Fatalf("Failed to update Kubernetes secret: %v", err)
    }

    err = applyWGConfig(priv, peers)
    if err != nil {
        log.Fatalf("Failed to apply WireGuard config: %v", err)
    }

    log.Println("Key rotation completed successfully")
    // Sleep until next rotation
    time.Sleep(keyRotationInterval)
}

import time
import requests
import pandas as pd
from kubernetes import client, config
from typing import List, Dict
import statistics
import logging

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class WGBenchmarker:
    def __init__(self, kubeconfig: str = "/etc/kubernetes/admin.conf"):
        # Load Kubernetes config
        try:
            config.load_kube_config(config_file=kubeconfig)
            self.core_v1 = client.CoreV1Api()
            self.apps_v1 = client.AppsV1Api()
            logger.info("Kubernetes client initialized successfully")
        except Exception as e:
            logger.error(f"Failed to load Kubernetes config: {e}")
            raise

        # Benchmark configuration
        self.payload_sizes = [1024, 4096, 16384]  # 1KB, 4KB, 16KB
        self.iterations = 100
        self.pod_label_selector = "app=bench-target"
        self.namespace = "default"

    def get_target_pods(self) -> List[Dict]:
        """Fetch all pods matching the benchmark target label"""
        try:
            pods = self.core_v1.list_namespaced_pod(
                namespace=self.namespace,
                label_selector=self.pod_label_selector
            ).items
            if not pods:
                raise ValueError(f"No pods found with label {self.pod_label_selector}")
            return [{"ip": pod.status.pod_ip, "name": pod.metadata.name} for pod in pods]
        except Exception as e:
            logger.error(f"Failed to fetch target pods: {e}")
            raise

    def run_latency_benchmark(self, target_ip: str, port: int = 8080) -> Dict:
        """Run latency benchmark for a single target pod"""
        results = {size: [] for size in self.payload_sizes}
        for size in self.payload_sizes:
            payload = "a" * size
            for _ in range(self.iterations):
                start = time.perf_counter()
                try:
                    response = requests.post(
                        f"http://{target_ip}:{port}/echo",
                        data=payload,
                        timeout=5
                    )
                    if response.status_code != 200:
                        logger.warning(f"Unexpected status code {response.status_code}")
                        continue
                    elapsed = (time.perf_counter() - start) * 1000  # ms
                    results[size].append(elapsed)
                except Exception as e:
                    logger.warning(f"Request failed: {e}")
                    continue
        # Calculate statistics
        stats = {}
        for size, times in results.items():
            if not times:
                continue
            stats[size] = {
                "p50": statistics.median(times),
                "p99": sorted(times)[int(len(times) * 0.99)],
                "avg": statistics.mean(times),
                "min": min(times),
                "max": max(times)
            }
        return stats

    def run_throughput_benchmark(self, target_ip: str, port: int = 8080) -> float:
        """Run throughput benchmark for a single target pod (Gbps)"""
        duration = 10  # seconds
        payload = "a" * 16384  # 16KB payload
        start_time = time.perf_counter()
        total_bytes = 0
        while (time.perf_counter() - start_time) < duration:
            try:
                response = requests.post(
                    f"http://{target_ip}:{port}/echo",
                    data=payload,
                    timeout=1
                )
                if response.status_code == 200:
                    total_bytes += len(payload)
            except Exception:
                continue
        elapsed = time.perf_counter() - start_time
        return (total_bytes * 8) / (elapsed * 1e9)  # Gbps

    def generate_report(self, results: List[Dict]) -> pd.DataFrame:
        """Generate a benchmark report DataFrame"""
        rows = []
        for res in results:
            row = {
                "pod": res["pod"],
                "payload_size": res["payload_size"],
                "p50_latency_ms": res["stats"]["p50"],
                "p99_latency_ms": res["stats"]["p99"],
                "avg_latency_ms": res["stats"]["avg"],
                "throughput_gbps": res["throughput"]
            }
            rows.append(row)
        return pd.DataFrame(rows)

if __name__ == "__main__":
    benchmarker = WGBenchmarker()
    target_pods = benchmarker.get_target_pods()
    logger.info(f"Found {len(target_pods)} target pods")

    all_results = []
    for pod in target_pods:
        logger.info(f"Benchmarking pod {pod['name']} ({pod['ip']})")
        for size in benchmarker.payload_sizes:
            logger.info(f"Running latency benchmark for {size} byte payload")
            stats = benchmarker.run_latency_benchmark(pod["ip"])
            throughput = benchmarker.run_throughput_benchmark(pod["ip"])
            all_results.append({
                "pod": pod["name"],
                "payload_size": size,
                "stats": stats[size],
                "throughput": throughput
            })

    report = benchmarker.generate_report(all_results)
    report.to_csv("wg_benchmark_results.csv", index=False)
    logger.info(f"Benchmark report saved to wg_benchmark_results.csv")
    print(report.describe())

import * as k8s from '@kubernetes/client-node';
import { Watch } from '@kubernetes/client-node/watch';
import { exec } from 'child_process';
import { promisify } from 'util';
import * as fs from 'fs';
import * as path from 'path';

const execAsync = promisify(exec);

// Configuration
const NAMESPACE = 'kube-system';
const WG_INTERFACE = 'wg0';
const PEER_CONFIG_PATH = '/etc/wireguard/peers.d';

// Initialize Kubernetes client
const kc = new k8s.KubeConfig();
kc.loadFromDefault();

const coreV1Api = kc.makeApiClient(k8s.CoreV1Api);
const watch = new Watch(kc);

interface WireGuardPeer {
  publicKey: string;
  endpoint: string;
  allowedIPs: string[];
}

/**
 * Fetch all WireGuard peers from Kubernetes secrets
 */
async function getWGPeers(): Promise {
  try {
    const secrets = await coreV1Api.listNamespacedSecret(
      NAMESPACE,
      undefined,
      undefined,
      undefined,
      undefined,
      'app=wireguard-peer'
    );
    const peers: WireGuardPeer[] = [];
    for (const secret of secrets.items) {
      const publicKey = secret.data?.['public-key'] ? Buffer.from(secret.data['public-key'], 'base64').toString() : '';
      const endpoint = secret.data?.['endpoint'] ? Buffer.from(secret.data['endpoint'], 'base64').toString() : '';
      const allowedIPs = secret.data?.['allowed-ips'] ? JSON.parse(Buffer.from(secret.data['allowed-ips'], 'base64').toString()) : [];
      if (publicKey && endpoint) {
        peers.push({ publicKey, endpoint, allowedIPs });
      }
    }
    return peers;
  } catch (err) {
    console.error('Failed to fetch WireGuard peers:', err);
    throw err;
  }
}

/**
 * Update WireGuard peer configuration on disk
 */
async function updatePeerConfig(peers: WireGuardPeer[]): Promise {
  try {
    // Ensure peer config directory exists
    await fs.promises.mkdir(PEER_CONFIG_PATH, { recursive: true });
    // Write each peer to a separate config file
    for (const peer of peers) {
      const configPath = path.join(PEER_CONFIG_PATH, `${peer.publicKey}.conf`);
      const configContent = [
        `[Peer]`,
        `PublicKey = ${peer.publicKey}`,
        `Endpoint = ${peer.endpoint}`,
        `AllowedIPs = ${peer.allowedIPs.join(', ')}`,
        `PersistentKeepalive = 25`,
      ].join('\n');
      await fs.promises.writeFile(configPath, configContent);
    }
    // Reload WireGuard configuration
    await execAsync(`wg syncconf ${WG_INTERFACE} <(wg-quick strip ${WG_INTERFACE})`);
    console.log(`Updated ${peers.length} WireGuard peers`);
  } catch (err) {
    console.error('Failed to update peer config:', err);
    throw err;
  }
}

/**
 * Watch for node events and update WireGuard peers
 */
async function watchNodeEvents(): Promise {
  try {
    await watch.watch(
      '/api/v1/nodes',
      {},
      async (type: string, obj: k8s.V1Node) => {
        console.log(`Node event: ${type} ${obj.metadata?.name}`);
        if (type === 'ADDED' || type === 'MODIFIED' || type === 'DELETED') {
          const peers = await getWGPeers();
          await updatePeerConfig(peers);
        }
      },
      (err: Error) => {
        console.error('Watch error:', err);
        // Reconnect on error
        setTimeout(watchNodeEvents, 5000);
      }
    );
  } catch (err) {
    console.error('Failed to start node watch:', err);
    throw err;
  }
}

// Main execution
(async () => {
  try {
    console.log('Starting WireGuard 2.0 peer watcher');
    // Initial peer sync
    const initialPeers = await getWGPeers();
    await updatePeerConfig(initialPeers);
    // Start watching for node events
    await watchNodeEvents();
  } catch (err) {
    console.error('Fatal error:', err);
    process.exit(1);
  }
})();

// Short snippet: Add a peer with wgctrl-go
func addWgPeer(ifaceName string, pubKey string, endpoint string) error {
    client, err := wgctrl.New()
    if err != nil {
        return err
    }
    defer client.Close()
    key, err := types.ParseKey(pubKey)
    if err != nil {
        return err
    }
    return client.ConfigureDevice(ifaceName, types.Config{
        Peers: []types.Peer{{
            PublicKey: key,
            Endpoint:  &net.UDPAddr{IP: net.ParseIP(endpoint), Port: 51820},
            AllowedIPs: []net.IPNet{{IP: net.ParseIP("10.244.0.0"), Mask: net.CIDRMask(16, 32)}},
        }},
    })
}

# Short snippet: Enable eBPF mode in kube-proxy ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-proxy
  namespace: kube-system
data:
  config.conf: |
    mode: "ebpf"
    ebpf:
      enabled: true
      policyEnforcement: "strict"

# Short snippet: Key rotation CronJob
apiVersion: batch/v1
kind: CronJob
metadata:
  name: wg-key-rotation
  namespace: kube-system
spec:
  schedule: "0 0 */7 * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: wg-key-rotator
          containers:
          - name: key-rotator
            image: wg-k8s-secure/wg-key-rotator:1.0
            volumeMounts:
            - name: kubeconfig
              mountPath: /etc/kubernetes/admin.conf
          volumes:
          - name: kubeconfig
            hostPath:
              path: /etc/kubernetes/admin.conf

wg-k8s-1.38-example/
├── cmd/
│   ├── key-rotator/          # Go key rotation script (Code Example 1)
│   │   └── main.go
│   └── policy-validator/     # Go network policy validator
│       └── main.go
├── deploy/
│   ├── daemonset/            # WireGuard 2.0 DaemonSet manifest
│   │   └── wg-daemonset.yaml
│   └── crd/                  # WireGuard Peer CRD
│       └── wgpeer.yaml
├── pkg/
│   ├── wg/                   # WireGuard client wrapper
│   │   └── client.go
│   └── k8s/                  # Kubernetes client wrapper
│       └── client.go
├── terraform/
│   └── aws/                  # Terraform config to deploy EKS 1.38 cluster
│       ├── main.tf
│       └── variables.tf
├── benchmarks/
│   └── run-benchmark.py      # Python benchmark script (Code Example 2)
├── ts/
│   └── peer-watcher.ts       # TypeScript peer watcher (Code Example 3)
└── README.md