WireGuard on Antrea implementation

[xliuxu]

Describe what you are trying to solve
This proposal summarizes the first version of WireGuard on Antrea. Refer to #2204 for the proposal.

In the first version, we want to implement WireGuard on default encap mode as existing features such as EgressPolicy will not be affected.

Describe how your solution impacts user flows
Users can enable WireGuard in configmap by setting enableWireGuard: true to enable WireGuard encryption.

Describe the main design/architecture of your solution

Control Plane

antrea-init

antrea-init should be able to load WireGuard kernel module and save the status.

antrea-agent

Node controller should check whether WireGuard is enabled in configmap. If yes the following steps should take place.

• setup up WireGuard interface, including setting up MTU, private key, listening port, setting rp_filter to 2
• expose the public key by annotation.
• list and watch all kubernetes Node resource, read set PublicKey, AllowedIPs, Endpoint as WireGuard peer.

Data plane

On the Node, antrea-agent will realize whether WireGuard is enabled and mark packets accordingly.

// If wireguard is enabled
// table=70
- priority=200,ip,nw_dst=remote_cidr, actions=mod_dl_src:gw0_mac,mod_dl_dst:vMAC,load:remote_node_ip->NXM_NX_TUN_IPV4_DST[],resubmit(,72)
+ priority=200,ip,nw_dst=remote_cidr, actions=mod_dl_src:local_gw_mac,mod_dl_dst:vMAC,load:remote_node_ip->NXM_NX_TUN_IPV4_DST[],load:tunnel_pkt_mark->NXM_NX_PKT_MARK[],resubmit(,72)

// If EgressPolicy rules are present
// table 72
- priority=200 ip,in_port=local_pods mod_dl_src:gw0_mac,mod_dl_dst:vMAC,snat_ip->NXM_NX_TUN_IPV4_DST,goto:72
+ priority=200 ip,in_port=local_pods mod_dl_src:gw0_mac,mod_dl_dst:vMAC,snat_ip->NXM_NX_TUN_IPV4_DST,set_field:1234->pkt_mark,goto:72

Routing change:
Add a new routing table to handle packets with the specific pkt_mark. The default route should be the WireGuard tunnel.
e.g.

// ip rule 
0:	from all lookup local
1000:	from all fwmark 0x4d2 lookup 10
32766:	from all lookup main
32767:	from all lookup default
// route in table 10
default dev antrea-wg scope link src 172.16.10.12

Work breakdown

• antrea-init load kernel module
• antrea-agent setting up WireGuard interface and watch/reconcile changes
• openflow entries change
• routing rule/table change

Alternative solutions that you considered
N/A

Test plan
Add E2E tests to verify all features when WireGuard is enabled. We can use user-space implementation of WireGuard to run tests in kind clusters.

Additional context
Any other relevant information.

[tnqn]

@xliuxu Thanks for your work. Please use github keyword "Closes #XXXX" in your future PRs so they can close issues automatically on merge.

#2297 implemented this, closing this issue.

[xliuxu]

Thank you @tnqn!