Skip to main content

​
Configuring Wireguard Network

​
Quick Start

The quickest way to try out Wireguard is to use talosctl cluster create command:
It will automatically generate Wireguard network configuration for each node with the following network topology: Where all controlplane nodes will be used as Wireguard servers which listen on port 51111. All controlplanes and workers will connect to all controlplanes. It also sets PersistentKeepalive to 5 seconds to establish controlplanes to workers connection. After the cluster is deployed it should be possible to verify Wireguard network connectivity. It is possible to deploy a container with hostNetwork enabled, then do kubectl exec <container> /bin/bash and either do:
Or install wireguard-tools package and run:
Wireguard show should output something like this:
It is also possible to use generated configuration as a reference by pulling generated config files using:

​
Manual Configuration

All Wireguard configuration can be done by changing Talos machine config files. As an example we will use this official Wireguard quick start tutorial.

​
Key Generation

This part is exactly the same:

​
Setting up Device

Inline comments show relations between configs and wg quickstart tutorial commands:
When networkd gets this configuration it will create the device, configure it and will bring it up (equivalent to ip link set up dev wg0). All supported config parameters are described in the Machine Config Reference.