Semaphore
summary
Semaphore implements three independent Go operators that enable encrypted pod-to-pod routing, local load‑balanced access to remote services, and cross‑cluster firewalling and it ships as open‑source. It brings up a WireGuard device on every node and publishes peer info via WireGuard peer manager node annotations so routes to remote pod subnets exist and are encrypted; a mirror controller creates local Services with remote Pod endpoints via service mirroring; a policy controller writes Calico Calico GlobalNetworkSet entries (per‑pod /32s) used by NetworkPolicies. Demos across AWS and GCP succeed; operators expose Prometheus metrics and require only node daemonsets and a service account on remote clusters.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:40Problem Definition
- 1:55Objectives
- 3:23Design. The User Perspective
- 6:22Solution
- 17:10Cross Cluster Services Service Mirroring
- 19:47Service Mirroring - The Technical Bit
- 20:58Service Mirroring - The Naming Problem
- 36:50Epilogue
related talks
29mSecuring Data-in-Transit with Wireguard for Kubernetes Cluster- 29mSecuring Data-in-Transit with Wireguard for Kubernetes Cluster
37mBuilding a Multi-Cloud Service Mesh from the Ground Up with Kilo
40mSecuring User to Service Access in Kubernetes
35mFull Mesh Encryption in Kubernetes with WireGuard and Calico
31mEffective building blocks for securing...
21mProduction-Ready gRPC: How Service Meshes Simplify Security, Routing, and Observability
53mDo you need a Service Mesh?