[Starlingx-discuss] calicoctl / calico containers stx 6.0 aio duplex and wireguard - DONE!

[Embedded Devel]

LOL Achievement unlocked ... it works now
steps to reproduce:
controller-0:~$ wget 
https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1.el7.x86_64.rpm.html

controller-0:~$ sudo yum install -y 
wireguard-tools-1.0.20210914-1.el7.x86_64.rpm 
Loaded plugins: fastestmirror
Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: 
wireguard-tools-1.0.20210914-1.el7.x86_64
Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

===============================================================================================================================================================
  
Package                         Arch                   Version              
                 Repository                                                 
 Size
===============================================================================================================================================================

Installing:
  wireguard-tools                 x86_64                 1.0.20210914-1.el7 
                   /wireguard-tools-1.0.20210914-1.el7.x86_64               
  291 k

Transaction Summary
===============================================================================================================================================================

Install  1 Package

Total size: 291 k
Installed size: 291 k
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
   Installing : wireguard-tools-1.0.20210914-1.el7.x86_64                   
                                                                            
    1/1 
   Verifying  : wireguard-tools-1.0.20210914-1.el7.x86_64                   
                                                                            
    1/1 

Installed:
   wireguard-tools.x86_64 0:1.0.20210914-1.el7                              
                                                                            
        

controller-0:~$ curl -o kubectl-calico -O -L  
"https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoctl"
   
% Total    % Received % Xferd  Average Speed   Time    Time     Time  
Current
                                  Dload  Upload   Total   Spent    Left  
Speed
100   615  100   615    0     0   1930      0 --:--:-- --:--:-- --:--:--  
1933
100 42.8M  100 42.8M    0     0  28.1M      0  0:00:01  0:00:01 --:--:-- 
46.2M
controller-0:~$ chmod +x kubectl-calico
controller-0:~$ sudo mv kubectl-calico /bin/
controller-0:~$  kubectl calico patch felixconfiguration default 
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
Successfully patched 1 'FelixConfiguration' resource

controller-0:~$ sudo wg
interface: wireguard.cali
   public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
   private key: (hidden)
   listening port: 51820
   fwmark: 0x100000

peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
   endpoint: 192.168.206.3:51820
   allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32
controller-0:~$ 

controller-1:~$ sudo wg
interface: wireguard.cali
   public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
   private key: (hidden)
   listening port: 51820
   fwmark: 0x100000

peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
   endpoint: 192.168.206.2:51820
   allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32
controller-1:~$



On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel wrote:

 > based on the calico documentation, 
https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we 
should be able to patch felix calicoctl patch felixconfiguration default 
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
 >
 > I have a pre-6 stx aio duplex deployed, wireguard does work, i yum 
installed wireguard-tools, i can bring up the wg interface
 >
 > so two things, how can we execute calico commands ? i see 0 
documentation on it
 >
 > and two im curious what wireguard firewall rules for calico would look 
like.
 >
 > id imagine based on the docs
 >
 > cat <<EOF > gnp-oam-overrides.yaml
 > apiVersion: crd.projectcalico.org/v1
 > kind: GlobalNetworkPolicy
 > metadata:
 > name: wg-oam-overrides
 > spec:
 > ingress:
 > - action: Allow
 > destination:
 > ports:
 > - 51820
 > protocol: UDP
 > order: 500
 > selector: has(iftype) && iftype == 'oam'
 > types:
 > - Ingress
 > EOF
 >
 >
 > when applied, i cannot connect a remote client to the OAM address, or 
the floating address
 >
-- 
Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com