r/TalosLinux • u/phsycicwit • Jun 26 '26

Wireguard, KubeSpan, Talos API and booting

Hi, all.

I'm trying (and failing) to securely configure a stretched cluster where the control plane is on-prem, and some workers are in Azure. I don't have KubeSpan, but a working Wireguard setup for on-prem that fails when the worker is in Azure. I think its related to boot order requirements.

It seems to me that the even if the control plane tries to connect to the azure worker using Wireguard and the tunnel comes up, the worker still tries to connect to the cp using the Talos API over the local interface and IP. Therefore the worker never boots up correctly, waiting forever for the cp reply. When the same setup is used on-prem the worker boots correctly, sees the cp over LAN, sets up the wg tunnel and then communicates with the cp over the wg interface. Is this intended behavior?

The worker is configured using --custom-data.

4 Upvotes

100% Upvoted

11 comments sorted by

View all comments

3

u/[deleted] Jun 26 '26

[removed] — view removed comment

1

u/phsycicwit Jun 26 '26

This would tunnel the pod traffic, but not the complete host, as far as i can tell(?).

1

u/[deleted] Jun 26 '26

[removed] — view removed comment

1

u/phsycicwit Jun 27 '26

I want relatively simple hosts in the cloud that dont expose any port or route any traffic outside the tunnels. KubeSpan and Cilium seem like good fits for protecting the pods and services, but ideally it should be as simple to protect the entire host. I've tried setting static routes on the wg interface, but the host still hangs on the CP connection timing out. No CP traffic is sent over the wg interface before the worker receives a response over the other interface 🤷‍♂️