From 491e260d20f28c74dcd3d89a7abd32f854b4cd5b Mon Sep 17 00:00:00 2001
From: janaurka <5986148+janaurka@users.noreply.github.com>
Date: Mon, 19 Dec 2022 00:39:43 +0100
Subject: [PATCH] Feature/add flannel wireguard encryption backend as option
 (#9583)

* feat(): Add wireguard backend to flannel cni

As described in the flannel docs:
https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard

This does not support optional configuration methods like:
- setting a psk (will be autogenerated by default)
- chang listening ports
- change mode (defaults to 'separate')
- change PersistentKeepaliveInterval (defaults to 0)

* Add supported backends to flannel docs

* Fix markdown in docs
---
 docs/flannel.md                                          | 2 ++
 .../sample/group_vars/k8s_cluster/k8s-net-flannel.yml    | 3 +--
 roles/network_plugin/flannel/tasks/main.yml              | 9 +++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/docs/flannel.md b/docs/flannel.md
index d4a9b9713..78937b1b8 100644
--- a/docs/flannel.md
+++ b/docs/flannel.md
@@ -2,6 +2,8 @@
 
 Flannel is a network fabric for containers, designed for Kubernetes
 
+Supported [backends](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard): `vxlan`, `host-gw` and `wireguard`
+
 **Warning:** You may encounter this [bug](https://github.com/coreos/flannel/pull/1282) with `VXLAN` backend, while waiting on a newer Flannel version the current workaround (`ethtool --offload flannel.1 rx off tx off`) is showcase in kubespray [networking test](tests/testcases/040_check-network-adv.yml:31).
 
 ## Verifying flannel install
diff --git a/inventory/sample/group_vars/k8s_cluster/k8s-net-flannel.yml b/inventory/sample/group_vars/k8s_cluster/k8s-net-flannel.yml
index 1a38ba71f..64d20a825 100644
--- a/inventory/sample/group_vars/k8s_cluster/k8s-net-flannel.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-net-flannel.yml
@@ -10,8 +10,7 @@
 ## single quote and escape backslashes
 # flannel_interface_regexp: '10\\.0\\.[0-2]\\.\\d{1,3}'
 
-# You can choose what type of flannel backend to use: 'vxlan' or 'host-gw'
-# for experimental backend
+# You can choose what type of flannel backend to use: 'vxlan',  'host-gw' or 'wireguard'
 # please refer to flannel's docs : https://github.com/coreos/flannel/blob/master/README.md
 # flannel_backend_type: "vxlan"
 # flannel_vxlan_vni: 1
diff --git a/roles/network_plugin/flannel/tasks/main.yml b/roles/network_plugin/flannel/tasks/main.yml
index c8de8cea5..2fd82e938 100644
--- a/roles/network_plugin/flannel/tasks/main.yml
+++ b/roles/network_plugin/flannel/tasks/main.yml
@@ -1,4 +1,13 @@
 ---
+
+- name: Flannel | Stop if kernel version is too low for Flannel Wireguard encryption
+  assert:
+    that: ansible_kernel.split('-')[0] is version('5.6.0', '>=')
+  when:
+    - kube_network_plugin == 'flannel'
+    - flannel_backend_type == 'wireguard'
+    - not ignore_assert_errors
+
 - name: Flannel | Create Flannel manifests
   template:
     src: "{{ item.file }}.j2"