* Consul Connect and WireGuard?
@ 2018-07-07 11:21 Rolf Sommerhalder
0 siblings, 0 replies; only message in thread
From: Rolf Sommerhalder @ 2018-07-07 11:21 UTC (permalink / raw)
To: wireguard, consul-tool
(Cross-posting on Consul's Google group and WireGuard's mailing list.)
After watching the keynotes , are you also asking yourself if
Consul's Service Mesh is a cloud-native Control Plane for dynamic
overlay (mesh) networks, and if mTLS with certificates could not be
replaced by WireGuard  with private/public keys in the Data Plane?
Could such a combination become be a light-weight (elastic)
alternative to network-centric (static) overlays, such as VxLAN or
Or, Consul could be a much more comprehensive Control Plane for
WireGuard, compared to WireGuard-p2p  that uses ad-hoc Distributed
Hash Tables (DHT) for "Service Registration & Discovery"?
Eventually, the user-space Go implementation of WireGuard could be
included into Consul, as HashiCorp already did for its PKI (parts
taken from Vault). This would make the alternate Data Plane portable
to platforms other than Linux, much in line with the idea of running
Consul agents on each node providing a "dial-tone".
However, running Consul on each node might be a chatty and large
Control Plane that may be harder to lock down, compared to WireGuard
network overlays and proxies in the Data Plane. For the Data Plane,
Consul Connect provides nice security controls, such as key
management, or Service Graphs with ACLs and Intentions. As everything
is identity-based and independent of IP addresses, this would fit Zero
Trust Network designs.
Is this idea viable at all and worth further exploration, or do I miss
^ permalink raw reply [flat|nested] only message in thread
only message in thread, back to index
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-07 11:21 Consul Connect and WireGuard? Rolf Sommerhalder
WireGuard Archive on lore.kernel.org
Archives are clonable:
git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
Newsgroup available over NNTP:
AGPL code for this site: git clone https://public-inbox.org/ public-inbox