LOL Achievement unlocked ... it works now steps to reproduce: controller-0:~$ wget https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1...
controller-0:~$ sudo yum install -y wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: wireguard-tools-1.0.20210914-1.el7.x86_64 Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be installed --> Finished Dependency Resolution
Dependencies Resolved
===============================================================================================================================================================
Package Arch Version Repository Size ===============================================================================================================================================================
Installing: wireguard-tools x86_64 1.0.20210914-1.el7 /wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
Transaction Summary ===============================================================================================================================================================
Install 1 Package
Total size: 291 k Installed size: 291 k Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : wireguard-tools-1.0.20210914-1.el7.x86_64
1/1 Verifying : wireguard-tools-1.0.20210914-1.el7.x86_64
1/1
Installed: wireguard-tools.x86_64 0:1.0.20210914-1.el7
controller-0:~$ curl -o kubectl-calico -O -L "https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoc..."
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M controller-0:~$ chmod +x kubectl-calico controller-0:~$ sudo mv kubectl-calico /bin/ controller-0:~$ kubectl calico patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}' Successfully patched 1 'FelixConfiguration' resource
controller-0:~$ sudo wg interface: wireguard.cali public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= endpoint: 192.168.206.3:51820 allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32 controller-0:~$
controller-1:~$ sudo wg interface: wireguard.cali public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= endpoint: 192.168.206.2:51820 allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32 controller-1:~$
On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel wrote:
based on the calico documentation,
https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we should be able to patch felix calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
I have a pre-6 stx aio duplex deployed, wireguard does work, i yum
installed wireguard-tools, i can bring up the wg interface
so two things, how can we execute calico commands ? i see 0
documentation on it
and two im curious what wireguard firewall rules for calico would look
like.
id imagine based on the docs
cat <<EOF > gnp-oam-overrides.yaml apiVersion: crd.projectcalico.org/v1 kind: GlobalNetworkPolicy metadata: name: wg-oam-overrides spec: ingress:
- action: Allow
destination: ports:
- 51820
protocol: UDP order: 500 selector: has(iftype) && iftype == 'oam' types:
- Ingress
EOF
when applied, i cannot connect a remote client to the OAM address, or
the floating address