fix(userspace): boringtun is unmaintained and we are now hitting bugs

The first issue is not so bad: https://github.com/cloudflare/boringtun/issues/447

The second issue is severe: https://github.com/cloudflare/boringtun/issues/348
This one is problematic because Kilo uses the WireGuard socket to detect
configuration drift for the `kilo0` interface. Since boringtun always
returns empty configuration, Kilo thinks that there is always
configuration drift, resulting in reconfigurations of the interface
every sync-interval seconds, which causes the interface to drop existing
connections.

This commit fixes the issues by switching from boringtun to the more
maintained, upstream userspace WireGuard implementation wireguard-go.
Furthermore, this commit locks the manifests to specific tags.

Signed-off-by: squat <lserven@gmail.com>

e2e/kilo-kind-userspace.yaml

@@ -135,10 +135,10 @@ spec:
         - name: kubeconfig
           mountPath: /etc/kubernetes
           readOnly: true
-      - name: boringtun
-        image: leonnicolas/boringtun
+      - name: wireguard
+        image: masipcat/wireguard-go:0.0.20230223
         args:
-        - --disable-drop-privileges
+        - wireguard-go
         - --foreground
         - kilo0
         securityContext:

e2e/lib.sh

@@ -65,7 +65,7 @@ build_kind_config() {
 }
 
 create_interface() {
-	docker run -d --name="$1" --rm --network=host --cap-add=NET_ADMIN --device=/dev/net/tun -v /var/run/wireguard:/var/run/wireguard -e WG_LOG_LEVEL=debug leonnicolas/boringtun --foreground --disable-drop-privileges "$1"
+	docker run -d --name="$1" --rm --network=host --cap-add=NET_ADMIN --device=/dev/net/tun -v /var/run/wireguard:/var/run/wireguard -e WG_LOG_LEVEL=debug masipcat/wireguard-go:0.0.20230223 wireguard-go --foreground "$1"
 }
 
 delete_interface() {

manifests/kilo-k3s-userspace-heterogeneous.yaml

@@ -298,10 +298,10 @@ spec:
         - name: wireguard
           mountPath: /var/run/wireguard
           readOnly: false
-      - name: boringtun
-        image: leonnicolas/boringtun:cc19859
+      - name: wireguard
+        image: masipcat/wireguard-go:0.0.20230223:cc19859
         args:
-        - --disable-drop-privileges
+        - wireguard-go
         - --foreground
         - kilo0
         securityContext:

manifests/kilo-k3s-userspace.yaml

@@ -165,10 +165,10 @@ spec:
         - name: wireguard
           mountPath: /var/run/wireguard
           readOnly: false
-      - name: boringtun
-        image: leonnicolas/boringtun:cc19859
+      - name: wireguard
+        image: masipcat/wireguard-go:0.0.20230223:cc19859
         args:
-        - --disable-drop-privileges
+        - wireguard-go
         - --foreground
         - kilo0
         securityContext:

manifests/kilo-kubeadm-flannel-userspace.yaml

@@ -66,10 +66,10 @@ spec:
       serviceAccountName: kilo
       hostNetwork: true
       containers:
-      - name: boringtun
-        image: leonnicolas/boringtun:cc19859
+      - name: wireguard
+        image: masipcat/wireguard-go:0.0.20230223:cc19859
         args:
-        - --disable-drop-privileges=true
+        - wireguard-go=true
         - --foreground
         - kilo0
         securityContext:

manifests/kilo-kubeadm-userspace.yaml

@@ -100,11 +100,11 @@ spec:
       serviceAccountName: kilo
       hostNetwork: true
       containers:
-      - name: boringtun
-        image: leonnicolas/boringtun:cc19859
+      - name: wireguard
+        image: masipcat/wireguard-go:0.0.20230223:cc19859
         imagePullPolicy: IfNotPresent
         args:
-        - --disable-drop-privileges
+        - wireguard-go
         - --foreground
         - kilo0
         securityContext: