linux - Kubernetes:是否可以将主机的整个根文件系统挂载到容器中并执行其命令？

Question

我有一个 Kubernetes 集群，需要安装 WireGuard内核模块作为集群中每个节点中的类似守护进程的作业，因为我必须处理的内核版本是 5.16 之前的版本。

我的问题是:是否可以将整个主机根文件系统替换并挂载到容器中(如果可以，那么容器镜像并不重要，让我们选择 ubuntu)并使用主机命令安装 WireGuard 内核模块(或通常从容器中安装任何东西)？

Answer 1

当您可以将 docker 镜像用于 wireguard 时，为什么还要挂载根文件系统？ .

或者基于wireguard dockerfile构建自己的镜像.

还有一个项目kubewg它可以帮助您管理 Wireguard。

kubewg is a Kubernetes controller that allows you to configure and manage [Wireguard] VPN configuration using a Kubernetes API server.

It introduces the following [CustomResourceDefinition] resources:

• Network: Represents a Wireguard VPN network.
• Peer: Represents a single Peer in a a Network. Each peer will be allocated an address in the network's subnet.
• RouteBinding: Represents additional route configuration that should be used by all members of the VPN network.

和 Wormhole用于 kubernetes 的基于 Wireguard 的覆盖网络 CNI 插件。

Wormhole is a simple CNI plugin designed to create an encrypted overlay network for kubernetes clusters.

WireGuard is a fascinating Fast, Modern, Secure VPN tunnel, that has been gaining significant praise from security experts, and is currently proposed for inclusion within the linux kernel.

Wormhole uses WireGuard to create a simple and secure high performance encrypted overlay network for kubernetes clusters, that is easy to manage and troubleshoot.

Wormhole does not implement network policy, instead we recommend to use calico or kube-router as network policy controllers.