WireGuard for Kubernetes: Introducing Gravitational Wormhole

Today we’re excited to introduce Gravitational Wormhole, our latest Open Source project. Wormhole is a Kubernetes network plugin that combines the simplicity of flannel with encrypted networking from WireGuard.

We created Wormhole to use with Gravity, our Kubernetes packaging solution, but Wormhole should be compatible with any certified Kubernetes distribution. If you’re running Kubernetes in a network you don’t fully trust or need to encrypt all pod network traffic between hosts for legacy applications or compliance reasons, Wormhole might be for you.

WireGuard network encryption in a nutshell

Wormhole is a basic CNI plugin for Kubernetes that uses WireGuard for creating a full mesh encrypted network between each host in the Kubernetes cluster. The Kubernetes API is used to coordinate key exchange and configuration, allowing Wormhole to configure the encrypted mesh network.

Wormhole Overlay Network

If you’d like to jump right in, check out the getting started docs on Github to use Wormhole in your cluster.

Why a new network encryption plugin?

There are a number of fascinating encrypted network plugins already available that cover various features and capabilities that are not included in Wormhole. So this begs the question, why introduce another network plugin?

At Gravitational, one of the use cases we target with Gravity is packaging applications and the Kubernetes runtime into an installer package that can be deployed on any infrastructure. These packaged applications then get installed to a variety of infrastructure environments including those that are air-gapped or otherwise isolated, with limited remote access to support.

So, this plugin addresses that use case - when we need to take encrypted networking to a variety of environments with the objective of keeping the technology and design as simple as possible.

Why WireGuard?

Wireguard is an exciting and new lightweight VPN technology that has been getting many accolades and is currently expected to be mainlined into the Linux kernel. It’s designed to replace IPsec and OpenVPN for most use cases while being more secure, more performant, and easier to use.

WireGuard is the current state of the art in encrypted VPN and light-weight encrypted networking that will work with a wide variety of applications and eventually be available in the Linux kernel.

At Gravitational, our experience has consistently shown that simpler is better when operating overlay networks in many different clouds and on-prem environments. WireGuard is especially appealing as a simple, highly opinionated and highly performant network encryption solution that will allow us to troubleshoot in a variety of environments.

The WireGuard paper provides a detailed explanation of the choices and properties offered by Wireguard.

Gravitational is hiring!

Enterprise Account Rep SF Bay Area, USA New York City, USA Golang/Linux Systems Engineer Seattle, WA Toronto, Canada Solutions Engineer Seattle, WA Toronto, Canada

How does it work?

Wormhole is developed as a CNI network plugin designed specifically to be deployed to Kubernetes clusters as a daemonset. It relies on the Kubernetes IPAM controller to assign each node a subnet within the overlay network.

Each node generates a new set of keys on startup, configures its local networking and firewall (iptables) and publishes the public key and node status to the Kubernetes API. Shared secrets are also generated for each pair of peers and synchronized through the API.

As peers are detected via the Kubernetes API, WireGuard gets configured on each node, setting up a full mesh network between each node within the cluster.

You can learn more about Wormhole’s design and security model in the spec on Github.

Current status

This project should currently be considered alpha. It’s ready for early adopters to test and find problems. It should be reasonably stable in design and upgrade path but hasn’t been battle tested in a wide variety of networks and configurations. It also hasn’t undergone a formal third-party security review.

Future work

Adopting WireGuard as an underlying network technology creates exciting opportunities for future development and use cases:

Currently, WireGuard doesn’t exist within the Linux kernel on its own and until it gets mainlined and available in common distributions, WireGuard needs to be installed and compiled on the host manually. We would like to make this process smoother – if anyone has experience delivering kernel modules from within containers supporting multiple distributions, we would really appreciate the help.

How to Contribute

We are always looking for community involvement with our projects. If you have any bug fixes or issues, please feel free to open an issue or pull request in the Github repo. If you have any more general comments or questions, we have created a Wormhole category in our community forum.

Try Gravitational Wormhole today by following our getting started guide.

kubernetes wormhole security

Want to stay informed?

Subscribe to our weekly newsletter for the latest articles, industry changes, and products updates.

Connect with Us

Microservices, Containers and Kubernetes in 10 minutes By Ev Kontsevoy The Leading Open Source Serverless Solutions for Kubernetes By Abraham Ingersoll The Kubernetes Kustomize KEP Kerfuffle By Abraham Ingersoll

Start Using Gravity Today

Deploy and remotely manage cloud-native applications on premises with Gravity.

Demo Gravity Download Gravity