wormhole

Really appreciate your input (and congrats!), Jason ;-) I have been running 2 simple standalone WireGuard VPN servers for remote access and encrypting traffic (2 EC2 instances inside a VPC, scripted configuration). Admittedly I didn't dig deep enough to think about or leverage VPC's DHCP and/or DHCP servers running on other EC2 instances in the same VPC over the last 2+ years (facepalm), which also means, WireGuard has been set & forget (reliably working ;-) Will dive into obfuscation and compare with (known to work) solution V2Ray (WebSocket + TLS + Web) / Trojan for next battle with the GFW. BTW: Gravitational has built a WireGuard based overlay network CNI for k8s called wormhole [1] which can be used to replace flannel when encryption is required for in-cluster traffic across the overlay. [1]: https://github.com/gravitational/wormhole

Gravitational has built something called wormhole (clashes with magic wormhole, bad naming, isn't? Some other hold can be better) https://github.com/gravitational/wormhole It can be used to replace flannel if encryption in transit is required.

James, we respectfully disagree. I think it's helpful if you (or anyone reading this) compare two projects side by side. This is the project you have submitted: https://github.com/jameskeane/scrambler It is a prototype of IPSec CNI plugin using Bash. We are happy you are promoting your project online and as we've discussed during the interview, you could use it as you wish as it's your work. This is the project that we have created at Gravitational: https://github.com/gravitational/wormhole It is using Go, Wireguard and is designed for production use under Apache 2 license. I understand that similarities in the problem statement may have led you to believe that we could re-use the project idea, I'm assuring that you that we have not. There are many OSS CNI plugins in the market solving the similar problem in a similar fashion (e.g. flanne

This is discussed a bit in the rationale and alternatives section of the original spec: https://github.com/gravitational/wormhole/blob/master/docs/r... To try and summarize without speaking too much for projects that I'm not intimately familiar with, Wormhole takes the approach of automating the configuration of WireGuard to create a full mesh encrypted network. Other approaches take a much more comprehensive approach, of trying to solve key signing, identity, revocation, offload to the kernel and intercept via sidecars (using ebpf), etc. These tools come with many features and an inherent complexity, where I believe there is room for a simpler tool that is easier to use and troubleshoot.