wg-easy-deploy.yml

kind: Deployment
apiVersion: apps/v1
metadata:
  name: wg-easy
  labels:
    app: wg-easy
    part-of: wg-easy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: wg-easy
      part-of: wg-easy
  template:
    metadata:
      labels:
        app: wg-easy
        part-of: wg-easy
    spec:
      nodeName: k3s-master01
      securityContext:
        sysctls:
        - name: net.ipv4.conf.all.src_valid_mark
          value: "1"
        - name: net.ipv4.ip_forward
          value: "1"
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            preference:
              matchExpressions:
              - key: disktype
                operator: In
                values:
                - ssd   
      containers:
      - name: wg-easy
        securityContext:
          capabilities:
            add:
              - NET_ADMIN
              - SYS_MODULE
        image: weejewel/wg-easy:7
        ports:
        - name: wg-easy
          containerPort: 51820
          protocol: UDP
        - name: wg-easy-tcp
          containerPort: 51821
          protocol: TCP
        env:
        - name: WG_HOST
          value: "wireguard.<path:apps-kv/data/general#DN>"
        - name: WG_PORT
          value: "51820"
        - name: WG_PERSISTENT_KEEPALIVE
          value: "25"
        - name: WG_DEFAULT_DNS
          value: "192.168.1.2"
        - name: WG_ALLOWED_IPS
          value: "192.168.1.0/24"
        - name: WG_MTU
          value: "1280"
        volumeMounts:
        - name: wg-easy
          mountPath: /etc/wireguard
      volumes:
      - name: wg-easy
        persistentVolumeClaim:
          claimName: wg-easy