Skip to main content
apiVersion: v1alpha1
kind: WireguardConfig
name: wg1 # Name of the Wireguard link (interface).
privateKey: OJ34O6J1z4ZZB+t16c+vYrzIrKddxyU3Z2eLhwYzqE8= # Specifies a private key configuration (base64 encoded).
listenPort: 51820 # Specifies a device's listening port (UDP).
# Specifies a list of peer configurations to apply to a device.
peers:
    - publicKey: fP+xJZvUA5n1Pi/f5wcPiV6tZ6fHwqcGaXe98NfEgkE= # Specifies the public key of this peer.
      endpoint: 10.0.0.1:5180 # Specifies the endpoint of this peer entry.
      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      allowedIPs:
        - 192.168.2.0/24
    - publicKey: TDd25Cwq6tMZANIKUaqred+Zt+09HtCqwFeOLtKQ9Cs= # Specifies the public key of this peer.
      presharedKey: UpH8htYK7yJBPg5+q4M/Tx0o5ipHbeSZtI/h/mHxOeU= # Specifies the preshared key for this peer (base64 encoded).
      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      allowedIPs:
        - 192.168.3.0/24
mtu: 1420 # Configure LinkMTU (Maximum Transmission Unit) for the link.
# Configure addresses to be statically assigned to the link.
addresses:
    - address: 192.168.1.100/24 # IP address to be assigned to the link.
FieldTypeDescriptionValue(s)
namestringName of the Wireguard link (interface).
privateKeystringSpecifies a private key configuration (base64 encoded).
Can be generated by wg genkey.
listenPortintSpecifies a device’s listening port (UDP).
If not specified, a random port will be chosen.
firewallMarkintSpecifies a device’s firewall mark.
Useful for advanced routing setups, marking packets originating from this device.
peersWireguardPeerSpecifies a list of peer configurations to apply to a device.
upboolBring the link up or down.

If not specified, the link will be brought up.
mtuuint32Configure LinkMTU (Maximum Transmission Unit) for the link.

If not specified, the system default LinkMTU will be used (usually 1500).
addressesAddressConfigConfigure addresses to be statically assigned to the link.
routesRouteConfigConfigure routes to be statically created via the link.
multicastboolSet the multicast capability of the link.

​
peers[]

WireguardPeer describes a Wireguard peer configuration.
FieldTypeDescriptionValue(s)
publicKeystringSpecifies the public key of this peer.
Can be extracted from private key by running wg pubkey < private.key.
presharedKeystringSpecifies the preshared key for this peer (base64 encoded).
Can be generated by wg genpsk.
Optional, this key provides an additional layer of symmetric-key cryptography
to the peer connection.
endpointAddrPortSpecifies the endpoint of this peer entry.
Format: IP address:port.
If not set, the peer should connect to us without us connecting to it first.
persistentKeepaliveIntervalDurationSpecifies the persistent keepalive interval for this peer.
Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).
allowedIPs[]PrefixAllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
These IPs will be routed to this peer, and defines which IPs this peer is allowed to use.

​
addresses[]

AddressConfig represents a network address configuration.
FieldTypeDescriptionValue(s)
addressPrefixIP address to be assigned to the link.

This field must include the network prefix length (e.g. /24 for IPv4, /64 for IPv6).
routePriorityuint32Configure the route priority (metric) for routes created for this address.

If not specified, the system default route priority will be used.

​
routes[]

RouteConfig represents a network route configuration.
FieldTypeDescriptionValue(s)
destinationPrefixThe route’s destination as an address prefix.

If not specified, a default route will be created for the address family of the gateway.
gatewayAddrThe route’s gateway (if empty, creates link scope route).
sourceAddrThe route’s source address (optional).
metricuint32The optional metric for the route.
mtuuint32The optional MTU for the route.
tableRoutingTableThe routing table to use for the route.

If not specified, the main routing table will be used.