Installation with Kubernetes

How to deploy Wiretastix on a Kubernetes cluster.

Deploying Wiretastix on Kubernetes allows for high availability, scalability, and robust management of your WireGuard VPN infrastructure. This guide provides a basic example of how to deploy Wiretastix components within a Kubernetes cluster.

Prerequisites

Before you begin, ensure you have the following:

Kubernetes Cluster: An operational Kubernetes cluster (e.g., K3s, MicroK8s, EKS, GKE).
kubectl: Configured to connect to your cluster.
WireGuard Kernel Module: The WireGuard kernel module must be installed on the Kubernetes worker nodes where the Wiretastix daemon pods will run. This is crucial as Wiretastix directly interacts with the kernel’s WireGuard interface.
nftables: The nft utility must be available on the worker nodes for firewall management.
Persistent Storage: A StorageClass configured in your cluster for database persistence.

1. Prepare Configuration and Secrets

Wiretastix requires a configuration file (wiretastix.yaml) and potentially TLS certificates and an API token. These should be managed as Kubernetes ConfigMaps and Secrets.

ConfigMap for `wiretastix.yaml`

Create a wiretastix-config.yaml file:

apiVersion: v1
kind: ConfigMap
metadata:
  name: wiretastix-config
data:
  wiretastix.yaml: |
    db:
      type: "postgres"
      dsn: "postgres://wiretastix:your_db_password@wiretastix-db:5432/wiretastix?sslmode=disable"
    wireguard:
      name: "wg0"
      port: 51820
      ipv4: "10.0.0.1/24"
      ipv6: "fd00::1/64"
    api:
      binding: "0.0.0.0:8095"
      path: "/wiretastix/api/v1/"
      # TLS certs should be mounted from a secret
    web:
      binding: "0.0.0.0:8090"
      path: "/wiretastix/"
      # TLS certs should be mounted from a secret
    metrics:
      binding: "0.0.0.0:9100"
      path: "/metrics"
    resolver:
      binding: "0.0.0.0:53"
      concurrency: 100
      domain: "wg.local"
    nftables:
      table: "wiretastix"

Apply the ConfigMap:

kubectl apply -f wiretastix-config.yaml

Secret for API Token and TLS Certificates

Create a Kubernetes Secret for your API token and TLS certificates. First, generate a token (see Initial Setup) and your TLS certs.

kubectl create secret generic wiretastix-secrets \
  --from-literal=api-token='YOUR_API_TOKEN' \
  --from-file=tls.crt=/path/to/server.crt \
  --from-file=tls.key=/path/to/server.key

2. Deploy PostgreSQL (or SQLite)

Deploy a PostgreSQL instance for Wiretastix. You can use a Helm chart or a simple Deployment and Service. Here’s a basic example for PostgreSQL:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: wiretastix-db
spec:
  selector:
    matchLabels:
      app: wiretastix-db
  template:
    metadata:
      labels:
        app: wiretastix-db
    spec:
      containers:
        - name: postgres
          image: postgres:13-alpine
          env:
            - name: POSTGRES_DB
              value: wiretastix
            - name: POSTGRES_USER
              value: wiretastix
            - name: POSTGRES_PASSWORD
              value: your_db_password
          ports:
            - containerPort: 5432
          volumeMounts:
            - name: db-data
              mountPath: /var/lib/postgresql/data
      volumes:
        - name: db-data
          persistentVolumeClaim:
            claimName: wiretastix-db-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: wiretastix-db
spec:
  selector:
    app: wiretastix-db
  ports:
    - protocol: TCP
      port: 5432
      targetPort: 5432
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: wiretastix-db-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
  # storageClassName: your-storage-class # Uncomment and specify if needed

Apply these resources:

kubectl apply -f postgres-deployment.yaml

3. Deploy Wiretastix Daemon

Create a Deployment for the Wiretastix daemon. This requires specific hostNetwork and privileged settings due to WireGuard’s kernel interactions.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: wiretastix-daemon
spec:
  selector:
    matchLabels:
      app: wiretastix-daemon
  template:
    metadata:
      labels:
        app: wiretastix-daemon
    spec:
      hostNetwork: true # Required for WireGuard interface and nftables
      containers:
        - name: wiretastix-daemon
          image: your-wiretastix-image:latest # Replace with your Docker image
          securityContext:
            privileged: true # Required for NET_ADMIN and SYS_MODULE capabilities
          env:
            - name: WIRETASTIX_TOKEN
              valueFrom:
                secretKeyRef:
                  name: wiretastix-secrets
                  key: api-token
          volumeMounts:
            - name: config-volume
              mountPath: /etc/wiretastix/wiretastix.yaml
              subPath: wiretastix.yaml
            - name: nftables-config
              mountPath: /etc/wiretastix/nftables.conf # Mount your nftables.conf
              subPath: nftables.conf
            - name: tls-certs
              mountPath: /etc/wiretastix/certs
          # Ensure /lib/modules is accessible if your image needs it
          # - name: lib-modules
          #   mountPath: /lib/modules
          #   readOnly: true
      volumes:
        - name: config-volume
          configMap:
            name: wiretastix-config
        - name: nftables-config
          configMap:
            name: wiretastix-nftables-config # You'll need to create this ConfigMap
        - name: tls-certs
          secret:
            secretName: wiretastix-secrets
        # - name: lib-modules
        #   hostPath:
        #     path: /lib/modules
        #     type: DirectoryReadOnly

Important Considerations for Kubernetes:

hostNetwork: true: This is critical for Wiretastix to create and manage the WireGuard interface directly on the host’s network stack. This means the pod will use the host’s IP address and ports.
privileged: true: Due to the need to manage network interfaces and potentially load kernel modules, the Wiretastix daemon pod often requires privileged mode. This grants the container nearly all capabilities of the host.
nftables.conf: You will need to create a ConfigMap for your nftables.conf and mount it into the daemon pod.
/lib/modules: Depending on your Docker image and host setup, you might need to mount /lib/modules from the host into the container if the WireGuard kernel module is not already accessible.

Apply the daemon deployment:

kubectl apply -f wiretastix-daemon-deployment.yaml

4. Expose Services (Optional)

If you want to expose the Wiretastix API or Web UI externally, you’ll need to create Kubernetes Services and potentially an Ingress.

apiVersion: v1
kind: Service
metadata:
  name: wiretastix-api
spec:
  selector:
    app: wiretastix-daemon
  ports:
    - protocol: TCP
      port: 8095
      targetPort: 8095
  type: ClusterIP # Or NodePort/LoadBalancer if exposing directly
---
apiVersion: v1
kind: Service
metadata:
  name: wiretastix-web
spec:
  selector:
    app: wiretastix-daemon
  ports:
    - protocol: TCP
      port: 8090
      targetPort: 8090
  type: ClusterIP

5. Initial Setup and CLI Access

After deployment, follow the Initial Setup guide. You can access the CLI by executing it within the running daemon pod:

kubectl exec -it <wiretastix-daemon-pod-name> -- wiretastix-cli --api https://127.0.0.1:8095/wiretastix/api/v1/ --token YOUR_API_TOKEN

Next Steps

After successful deployment, proceed to the Initial Setup guide to configure Wiretastix and get it running.