Why is there no server-side config?

[winston0410]

I notice that with WireguardPeer it generate a Wireguard Client side config file, and no configuration file is stored/read by the Wireguard server inside the cluster. As other setup guides/tutorial would mention using something like /etc/wireguard/wg0.conf in server side, does this operator generate a server-side config?

If not, does that mean that I can change the client file after it is generated, and it will still work?

[jodevsa]

Hi @winston0410,

The agent pod (wg server) has access to the peers public key, ip, etc.. .This information is injected by the operator in /tmp/wireguard/state.json

If not, does that mean that I can change the client file after it is generated, and it will still work?

Can you give me an example of what change?

[winston0410]

Sorry I was asking before I try yesterday. And I found out that changing the Peer config would work fine.

[jodevsa]

As other setup guides/tutorial would mention using something like /etc/wireguard/wg0.conf

those setups uses wg-quick. wg-quick is actually only a wrapper that uses wireguard.

the problem with wg-quick is that it wasn't designed to be used in an "automated" way and was mostly a simple tool for easily setting up a wireguard server. I've built an agent in golang that interacts with wireguard directly and configures it with the peers defined. One huge benefit from that is that you can actually add a new peer without having to restart wireguard (zero downtime). wg-quick suffers from that problem

[winston0410]

Thank you very much for answering that! That is an awesome and important detail of this operator(not sure if that agent belongs to this repo) and I think it should really goto README