node subnets are not included in "allowed ips"?

[bmullan]

I have wesher creating my mesh using wireguard ok. But I'm finding that subnets on various nodes
are not reachable.

On some of my NODEs I have created bridged subnets.

With regular WireGuard I could normally include those Subnets (example 192.168.75.0/24) as an "allowed ips"

But running Wesher if I check /var/lib/wesher/state.json the IP subnets are not included !

Is there a command line option not documented for how someone can specifically identify subnets they want included in the WireGuard config?

thanks

[costela]

Is there a way with Wesher to include other/additional subnets in the "allowed ips" ?

Currently no.
It's a bit trickier to implement than one might think at first. But it is something I'm considering. PR always welcome if someone beats me to it!

[bmullan]

@costela

Thanks for adding it as a milestone as I think many of the container technologies will be better enabled to be used with Wesher.

[kaiyou]

I plan on working on something a bit different, but I might end up supporting both. First my use case in a sentence (I'll develop in another issue): multiple k8s CNI set routes directly to other nodes and expect them to be honored, so I need to reflect routes added manually on the wg devices to be reflected in allowed IPs on other nodes.

Regarding this issue, it seems like a nice complement to my use case. It would probably need an additionnal setting ROUTED_NETWORKS_FILTER that contains a list of CIDRs that is used to filter advertised networks, in order to avoid propagating unwanted networks, or even 127.0.0.1/8.

A sane default value would be the empty filter, which means no network is propagated, and would also avoid adding a setting for enabling/disabling this feature.

[kaiyou]

For implementation, I intend on using this : https://godoc.org/github.com/vishvananda/netlink#RouteSubscribe

I will implement a new loop, identical to the cluster loop, consuming events from netlink, filtering the routes using a configuration setting, and providing locla node route list on a channel. Then in the main loop, I will update the local node based on these routes.

Routes will be propagated using node meta, and the node parsing routine will handle extra allowed addresses and netlink routes on top of the node overlay address. The main catch at the moment is that we will need to add and delete routes, removing routes that are not annonuced anymore by a node. How do we handle routes that are set manually by the admin instead of wesher then?

I do not intend on handling conflicting routes in this first implementation. Does that sound ok? I think I will implement the code in the node package since those are properties of the local node.

[kaiyou]

Here is the current state of our work on the routing matter. It will undergo some tests in our use case in the next few days: https://github.com/kaiyou/wesher/tree/feature-routed-net

[kaiyou]

This is currently running on three different clusters of mine, properly propagating kubernetes routes. I will provide production feedback next week.

[arnarg]

@kaiyou @costela Any updates on this?

This functionality would be great as adding a routing protocol on top of a wesher cluster would still leave the destinations out of allowed-ips on the peers.