Initial commit

(squashing before publish)

Author: NiklasBeierl

.github/workflows/build-and-push.yaml

@@ -0,0 +1,56 @@
+name: Build and Push Container Image
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: niklasbeierl/nodecryptor
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=sha,prefix=
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -0,0 +1,5 @@
+.env
+.idea
+.venv
+node_modules
+dump

docker/.env.example

@@ -0,0 +1,2 @@
+# Use a node that actually exists here (it will not mess with that node)
+NODE_NAME=...

docker/Dockerfile

@@ -0,0 +1,37 @@
+FROM golang:1.25-alpine AS builder
+
+RUN apk add --no-cache \
+    iproute2 \
+    nftables \
+    wireguard-tools
+
+RUN go install github.com/go-delve/delve/cmd/dlv@latest
+
+WORKDIR /app
+
+RUN apk add --no-cache git
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY internal ./internal
+COPY main.go .
+RUN CGO_ENABLED=0 GOOS=linux go build -gcflags="all=-N -l" -o nodeCryptor .
+
+ENTRYPOINT ["/go/bin/dlv", "--listen=:40000", "--headless=true", "--api-version=2", "--accept-multiclient", "exec", "/app/nodeCryptor", "--"]
+CMD []
+
+FROM builder AS release
+RUN CGO_ENABLED=0 GOOS=linux go build -o nodeCryptor .
+
+FROM alpine:3.21
+
+RUN apk add --no-cache \
+    iproute2 \
+    nftables \
+    wireguard-tools
+
+COPY --from=release /app/nodeCryptor /usr/local/bin/nodeCryptor
+
+ENTRYPOINT ["/usr/local/bin/nodeCryptor"]
+CMD []

docker/compose.yaml

@@ -0,0 +1,44 @@
+services:
+  nodecryptor: &base
+    image: ghcr.io/niklasbeierl/nodecryptor/base:latest
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+    cap_add:
+      - NET_ADMIN
+    volumes:
+      - ${HOME}/.kube/config:/root/.kube/config:ro
+    command:
+      - --node-name
+      - ${NODE_NAME?error}
+
+  dev: &dev
+    <<: *base
+    container_name: nodecryptor-dev
+    image: ghcr.io/niklasbeierl/nodecryptor/dev:latest
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+      target: builder
+    ports:
+      - 127.0.0.1:40000:40000
+    profiles:
+      - donostart
+    command:
+      - --node-name
+      - ${NODE_NAME?error}
+      - --noop-route
+      - 10.10.10.255/32
+
+  setup-link:
+    <<: *dev
+    network_mode: container:nodecryptor-dev
+    cap_add:
+      - NET_ADMIN
+    entrypoint:
+      - /bin/bash
+    command:
+      - -c
+      - ip link add dev cilium_wg0 type wireguard && ip link set cilium_wg0 up
+    profiles:
+      - donotstart

go.mod

@@ -0,0 +1,113 @@
+module github.com/niklasbeierl/nodeCryptor
+
+go 1.25.5
+
+require (
+	github.com/cilium/cilium v1.18.5
+	github.com/go-logr/logr v1.4.3
+	github.com/vishvananda/netlink v1.3.1
+	golang.org/x/sys v0.40.0
+	k8s.io/apimachinery v0.34.1
+	k8s.io/client-go v0.34.1
+	sigs.k8s.io/controller-runtime v0.22.4
+)
+
+require (
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cilium/ebpf v0.19.0 // indirect
+	github.com/cilium/hive v0.0.0-20250611195437-5a5dacdfb354 // indirect
+	github.com/cilium/proxy v0.0.0-20250623105955-2136f59a4ea1 // indirect
+	github.com/cilium/statedb v0.4.6 // indirect
+	github.com/cilium/stream v0.0.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-logr/zapr v1.3.0 // indirect
+	github.com/go-openapi/analysis v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.1 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/loads v0.22.0 // indirect
+	github.com/go-openapi/runtime v0.28.0 // indirect
+	github.com/go-openapi/spec v0.21.0 // indirect
+	github.com/go-openapi/strfmt v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/validate v0.24.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
+	github.com/mackerelio/go-osstat v0.2.6 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/oklog/ulid v1.3.1 // indirect
+	github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sasha-s/go-deadlock v0.3.5 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.14.0 // indirect
+	github.com/spf13/cast v1.9.2 // indirect
+	github.com/spf13/cobra v1.9.1 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/spf13/viper v1.20.1 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/vishvananda/netns v0.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.mongodb.org/mongo-driver v1.14.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.uber.org/dig v1.17.1 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/api v0.34.1 // indirect
+	k8s.io/apiextensions-apiserver v0.34.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)

internal/controller/ciliumnode_controller.go

@@ -0,0 +1,62 @@
+package controller
+
+import (
+	"context"
+
+	ciliumv2 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2"
+	"github.com/niklasbeierl/nodeCryptor/internal/state"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+// CiliumNodeReconciler reconciles CiliumNode objects
+type CiliumNodeReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+	state  state.State
+}
+
+// NewCiliumNodeReconciler creates a new CiliumNode reconciler
+func NewCiliumNodeReconciler(
+	client client.Client,
+	scheme *runtime.Scheme,
+	state state.State,
+) *CiliumNodeReconciler {
+	return &CiliumNodeReconciler{
+		Client: client,
+		Scheme: scheme,
+		state:  state,
+	}
+}
+
+// +kubebuilder:rbac:groups=cilium.io,resources=ciliumnodes,verbs=get;list;watch
+// +kubebuilder:rbac:groups=cilium.io,resources=ciliumnodes/status,verbs=get
+
+// Reconcile handles CiliumNode reconciliation
+func (r *CiliumNodeReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	var node ciliumv2.CiliumNode
+	if err := r.Get(ctx, req.NamespacedName, &node); err != nil {
+		if apierrors.IsNotFound(err) {
+			logger.Info("CiliumNode deleted", "name", req.Name)
+			r.state.DeleteNode(req.Name)
+			return ctrl.Result{}, nil
+		}
+		logger.Error(err, "unable to fetch CiliumNode")
+		return ctrl.Result{}, err
+	}
+
+	r.state.SetNode(&node)
+	return ctrl.Result{}, nil
+}
+
+// SetupWithManager sets up the controller with the Manager
+func (r *CiliumNodeReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&ciliumv2.CiliumNode{}).
+		Complete(r)
+}