link

func Apply ¶

func Apply(ctx context.Context, run runner, rc RuntimeConfig, privKey, peerPubKey string, resolve func(ctx context.Context, host string) (string, error)) error

Apply brings up the WireGuard tunnel and programs nftables from rc.

It mutates host network state (wg0 and the nftables ruleset) and must not be called concurrently; it relies on the single reconcile-goroutine caller.

It assumes a kube-proxy data plane (iptables or ipvs) so that masqueraded traffic to a Service ClusterIP is load-balanced to a backend pod. Cilium's kube-proxy replacement bypasses the ClusterIP DNAT that this design relies on and is out of scope for v1.

resolve maps a Service DNS name to a single address; pass a resolver built by newResolver in production. privKey and peerPubKey are base64 WireGuard keys read from mounted Secret files. The rendered config (which embeds the private key) is written to a 0600 temp file for the duration of the call and removed before return. A best-effort delete of any pre-existing wg0 runs first so Apply is idempotent across restarts; it is used for first-time setup, not for the live reload path, which is Reconcile. If a step after the interface is created fails, wg0 is torn down best-effort before returning, so a partial Apply never leaves a half-configured interface that a later Reconcile would patch instead of rebuilding.

func Reconcile ¶

func Reconcile(ctx context.Context, run runner, rc RuntimeConfig, privKey, peerPubKey string, resolve func(ctx context.Context, host string) (string, error)) error

Reconcile applies rc onto an already-up wg0 without tearing the interface down: wg syncconf reconciles the peer endpoint and key against the running interface, and nft -f atomically swaps the ruleset. Unlike Apply it issues no ip link del or ip link add, so an established handshake and in-flight connections survive a config change. The caller chooses Apply versus Reconcile from wg0Exists.

Concurrency, resolve, and key handling match Apply: a single reconcile goroutine, and the rendered config (which embeds the private key) lives in a 0600 temp file only for the duration of the call.

func RenderNftables ¶

func RenderNftables(forwards []ResolvedForward) (string, error)

RenderNftables renders the inet "gateway" table that DNATs configured public ports arriving on wg0 to in-cluster ClusterIPs and masquerades the forwarded traffic toward the cluster so backends reply to the link pod.

The document is self-replacing: it opens with `add table inet gateway` then `flush table inet gateway`, so a single `nft -f` ensures the table exists, empties it, and repopulates it in one atomic transaction. Re-applying the same or a changed ruleset is therefore idempotent and never accumulates stale rules.

The forward filter chain defaults to drop and accepts forwarded packets by their post-DNAT destination (ClusterIP and target port): the prerouting nat hook rewrites the destination before the forward hook runs, so matching the public port there would never hit. The established/related rule covers the return path. The output is deterministic: forwards are sorted by public port then protocol on a copy before rendering. It returns an error only if template execution fails.

func RenderWGConf ¶

func RenderWGConf(rc RuntimeConfig, privKey, peerPubKey string) (string, error)

RenderWGConf renders a wg(8) setconf-compatible configuration for wg0. The output is suitable for `wg setconf`, which understands only [Interface] PrivateKey/ListenPort and Peer keys: Address and MTU are interface properties applied via ip(8) and are deliberately omitted here. ListenPort is emitted only when greater than zero. PersistentKeepalive is always emitted, including the value 0, so that `wg syncconf` clears a previously-set keepalive when the config drops it. privKey and peerPubKey are base64 WireGuard keys read from mounted Secret files, not from rc. It returns an error only if template execution fails.

func Run ¶

func Run(ctx context.Context, cfg Config, log *zap.SugaredLogger) error

Run loads the runtime config and key material, then runs two concurrent loops until ctx is cancelled: a reload loop that applies the WireGuard and nftables configuration and re-applies it in place whenever the mounted ConfigMap changes, and the readiness HTTP server. Config load and key reads are fatal and returned before the loops start. The reload loop is non-fatal on transient load or apply failures: it logs and retries, so the process does not exit merely because the peer endpoint is not yet present in the config. The peer endpoint is supplied by the operator in the ConfigMap; the link holds no cluster credentials. The health server is drained gracefully on cancel.