### Install kgctl from Source (Latest)

Source: https://kilo.squat.ai/docs/kgctl

Installs the latest version of kgctl using the Go toolchain. Ensure the Go toolchain is installed.

```bash
go install github.com/squat/kilo/cmd/kgctl@latest
```

--------------------------------

### Install kgctl using Mise

Source: https://kilo.squat.ai/docs/kgctl

Installs kgctl using the mise tool. Updates will be automatically installed with `mise up`.

```bash
mise use -g github:squat/kilo@latest
```

--------------------------------

### Install kgctl from Source (Specific Version)

Source: https://kilo.squat.ai/docs/kgctl

Installs a specific version of kgctl by specifying a Git tag or hash. Ensure the Go toolchain is installed.

```bash
go install github.com/squat/kilo/cmd/kgctl@0.2.0
```

--------------------------------

### Start Website Development Server

Source: https://kilo.squat.ai/docs/building_website

Starts the local development server for the website. This command uses `yarn` to run the server, which typically opens `http://localhost:3000` in your browser.

```bash
yarn --cwd website start
```

--------------------------------

### Install kgctl using Arkade

Source: https://kilo.squat.ai/docs/kgctl

Installs kgctl on any OS and architecture using the arkade CLI.

```bash
arkade get kgctl
```

--------------------------------

### Install Kilo on Bootkube

Source: https://kilo.squat.ai/docs/introduction

Installs Kilo on a Kubernetes cluster managed by Bootkube. Ensure WireGuard is installed and its port is accessible.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/crds.yaml  
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/kilo-bootkube.yaml  
```

--------------------------------

### WireGuard Node Configuration Example

Source: https://kilo.squat.ai/docs/kgctl

Example INI-formatted WireGuard configuration output for a Kilo mesh node. Includes ListenPort, AllowedIPs, Endpoint, and PublicKey.

```ini
[Interface]
ListenPort = 51820

[Peer]
AllowedIPs = 10.2.0.0/24, 10.1.13.74/32, 10.2.4.0/24, 10.1.20.76/32, 10.4.0.2/32
Endpoint = 3.120.246.76:51820
PersistentKeepalive = 0
PublicKey = IgDTEvasUvxisSAmfBKh8ngFmc2leZBvkRwYBhkybUg=
```

--------------------------------

### Install kgctl using AUR

Source: https://kilo.squat.ai/docs/kgctl

Installs kgctl on Arch Linux using an AUR helper like paru or yay.

```bash
paru -S kgctl-bin
```

--------------------------------

### Annotate Nodes for Logical Location (GCP Example)

Source: https://kilo.squat.ai/docs/topology

Annotates nodes matching 'gcp' with a specific Kilo location. Use this to group nodes in a particular cloud provider or environment into a single logical location within the Kilo network.

```bash
for node in $(kubectl get nodes | grep -i gcp | awk '{print $1}'); do kubectl annotate node $node kilo.squat.ai/location="gcp"; done  

```

--------------------------------

### GraphViz DOT Language Example

Source: https://kilo.squat.ai/docs/kgctl

Example output in DOT language representing the Kilo mesh graph. This format can be processed by GraphViz tools.

```dot
digraph kilo {
    label="10.2.4.0/24";
    labelloc=t;
    outputorder=nodesfirst;
    overlap=false;
    "ip-10-0-6-7"->"ip-10-0-6-146"[ dir=both ];
    "ip-10-1-13-74"->"ip-10-1-20-76"[ dir=both ];
    "ip-10-0-6-7"->"ip-10-1-13-74"[ dir=both ];
    "ip-10-0-6-7"->"squat"[ dir=both, style=dashed ];
    "ip-10-1-13-74"->"squat"[ dir=both, style=dashed ];

# ...

}
;
```

--------------------------------

### Build Website HTML

Source: https://kilo.squat.ai/docs/building_website

This command builds the website's HTML files from the generated markdown. It installs necessary node modules and processes the markdown content.

```bash
make website/build/index.html
```

--------------------------------

### Install Kilo on k3s

Source: https://kilo.squat.ai/docs/introduction

Installs Kilo on a k3s Kubernetes cluster. This process requires the WireGuard kernel module and an open UDP port for node communication.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/crds.yaml  
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/kilo-k3s.yaml  
```

--------------------------------

### Install Kilo on Typhoon

Source: https://kilo.squat.ai/docs/introduction

Deploys Kilo to a Typhoon-managed Kubernetes cluster. Verify that the WireGuard kernel module is present and the necessary UDP port is open.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/crds.yaml  
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/kilo-typhoon.yaml  
```

--------------------------------

### WireGuard Peer Configuration Output

Source: https://kilo.squat.ai/docs/vpn

Example output of the WireGuard configuration generated by 'kgctl showconf'. This includes the peer's public key, allowed IPs, and endpoint.

```ini
[Peer]
PublicKey = 2/xU029dz/WtvMZAbnSzmhicl8U1/Y3NYmunRr8EJ0Q=
AllowedIPs = 10.4.0.2/32, 10.2.3.0/24, 10.1.0.3/32
Endpoint = 108.61.142.123:51820

```

--------------------------------

### Install Kilo on Kubeadm

Source: https://kilo.squat.ai/docs/introduction

Installs Kilo on a Kubernetes cluster managed by kubeadm. This requires the WireGuard kernel module to be loaded and the WireGuard UDP port to be open on all nodes.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/crds.yaml  
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/kilo-kubeadm.yaml  
```

--------------------------------

### Install Kilo in Add-on Mode with Flannel

Source: https://kilo.squat.ai/docs/introduction

Apply Kilo CRDs and the specific configuration for running Kilo on a Typhoon cluster with Flannel as the CNI.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/crds.yaml
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/kilo-typhoon-flannel.yaml
```

--------------------------------

### Install kube-router for Network Policy Support

Source: https://kilo.squat.ai/docs/network-policies

Deploy kube-router to enable Kubernetes Network Policy enforcement alongside Kilo. This is a prerequisite for using network policies.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/kube-router.yaml  

```

--------------------------------

### Configure Local DNS for Cluster

Source: https://kilo.squat.ai/docs/kgctl

Configures the local host's DNS server to use the cluster DNS provider's IP address for resolving `.cluster.local` domain names. This example uses `systemd-resolved`.

```bash
systemd-resolve --interface kilo0 --set-dns $(kubectl get service -n kube-system kube-dns -o=jsonpath='{.spec.clusterIP}') --set-domain cluster.local
# Now all lookups for DNS names ending in `.cluster.local` will be routed over the `kilo0` interface to the cluster DNS provider.
dig kubernetes.default.svc.cluster.local +short
# > 10.43.0.1
```

--------------------------------

### Build Kilo Manifest

Source: https://kilo.squat.ai/docs/building_kilo

Push the container images and build a manifest using the 'make manifest' command.

```bash
make manifest
```

--------------------------------

### Build Kilo Container Images for Multiple Architectures

Source: https://kilo.squat.ai/docs/building_kilo

Build the 'kg' container image for 'arm', 'arm64', and 'amd64' architectures using the 'make all-container' command.

```bash
make all-container
```

--------------------------------

### Configure QEMU for Multi-Architecture Builds

Source: https://kilo.squat.ai/docs/building_kilo

Configure QEMU as the interpreter for binaries built for non-native architectures to enable multi-architecture Docker image builds.

```bash
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
```

--------------------------------

### Execute Kilo Unit Tests

Source: https://kilo.squat.ai/docs/building_kilo

Run the unit tests for the Kilo project using the 'make unit' command.

```bash
make unit
```

--------------------------------

### Tag and Push Kilo Manifest with Latest

Source: https://kilo.squat.ai/docs/building_kilo

Tag and push the Kilo manifest with the 'latest' tag using the 'make manifest-latest' command.

```bash
make manifest-latest
```

--------------------------------

### Configure WireGuard Interface with Peer Configuration

Source: https://kilo.squat.ai/docs/introduction

Export the peer configuration using `kgctl` and set it on a local WireGuard interface (e.g., wg0).

```bash
kgctl showconf peer squat > peer.ini
sudo wg setconf wg0 peer.ini
```

--------------------------------

### Compile Kilo Binaries

Source: https://kilo.squat.ai/docs/building_kilo

Compile the 'kg' and 'kgctl' binaries using the make command. Binaries are placed in 'bin/<os>/<architecture>/'.

```bash
make
```

--------------------------------

### Generate WireGuard Configuration with kgctl

Source: https://kilo.squat.ai/docs/vpn

Use the 'kgctl showconf' command to generate the WireGuard configuration for a specific peer. This command requires the peer name as an argument.

```bash
PEER=squat
kgctl showconf peer $PEER

```

--------------------------------

### Deploy WireGuard Exporter and PodMonitor

Source: https://kilo.squat.ai/docs/monitoring

Create the 'kilo' namespace and deploy the WireGuard exporter as a DaemonSet along with a PodMonitor for Prometheus.

```bash
kubectl create ns kilo
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/wg-exporter.yaml
```

--------------------------------

### Apply WireGuard Configuration to Interface

Source: https://kilo.squat.ai/docs/vpn

Save the generated WireGuard configuration to a file and apply it to a local WireGuard interface using 'wg setconf'. This requires root privileges.

```bash
IFACE=wg0
kgctl showconf peer $PEER > peer.ini
sudo wg setconf $IFACE peer.ini

```

--------------------------------

### Compile Kilo Binaries for Specific OS

Source: https://kilo.squat.ai/docs/building_kilo

Build Kilo binaries for a different operating system by setting the OS environment variable before running 'make'.

```bash
OS=<windows|darwin|linux> make
```

--------------------------------

### Execute All Kilo Tests

Source: https://kilo.squat.ai/docs/building_kilo

Run all tests (unit, lint, e2e) for the Kilo project with a single command.

```bash
make test
```

--------------------------------

### Generate Website Docs Markdown

Source: https://kilo.squat.ai/docs/building_website

Use this command to generate the markdown files for the website from the main documentation directory. Run this command whenever you add or modify documentation files in the `/docs` directory.

```bash
make website/docs/README.md
```

--------------------------------

### Compile Kilo Binaries for Specific Architecture

Source: https://kilo.squat.ai/docs/building_kilo

Build Kilo binaries for a different architecture by setting the ARCH environment variable before running 'make'.

```bash
ARCH=<arm|arm64|amd64> make
```

--------------------------------

### Generate Peer Configuration

Source: https://kilo.squat.ai/docs/vpn-server

Generates the WireGuard configuration file for a registered peer. Replace 'squat' with the actual name of your registered peer.

```bash
PEER=squat # name of the registered peer
kgctl showconf peer $PEER > peer.ini
```

--------------------------------

### Execute Kilo End-to-End Tests

Source: https://kilo.squat.ai/docs/building_kilo

Run basic end-to-end tests for the Kilo project. Note that these tests can be flaky.

```bash
make e2e
```

--------------------------------

### Apply Kilo PodMonitor

Source: https://kilo.squat.ai/docs/monitoring

Apply the PodMonitor configuration for Kilo to enable Prometheus monitoring.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/podmonitor.yaml
```

--------------------------------

### Clone Kilo Repository

Source: https://kilo.squat.ai/docs/building_kilo

Clone the Kilo repository to your local machine and navigate into the project directory.

```bash
git clone https://github.com/squat/kilo.git
cd kilo
```

--------------------------------

### Kilo Agent (kg) Usage and Flags

Source: https://kilo.squat.ai/docs/kg

This snippet displays the help text for the 'kg' command, outlining its purpose, available commands, and a comprehensive list of configurable flags. Use this to understand how to customize kg's behavior.

```bash
kg is the Kilo agent.  
        It runs on every node of a cluster,  
        setting up the public and private keys for the VPN  
        as well as the necessary rules to route packets between locations.  
  
Usage:  
  kg [flags]  
  kg [command]  
  
Available Commands:  
  completion  Generate the autocompletion script for the specified shell  
  help        Help about any command  
  version     Print the version and exit.  
  webhook     webhook starts a HTTPS server to validate updates and creations of Kilo peers.  
  
Flags:  
      --backend string                 The backend for the mesh. Possible values: kubernetes (default "kubernetes")  
      --clean-up                       Should kilo clean up network modifications on shutdown? (default true)  
      --clean-up-interface             Should Kilo delete its interface when it shuts down?  
      --cni                            Should Kilo manage the node's CNI configuration? (default true)  
      --cni-path string                Path to CNI config. (default "/etc/cni/net.d/10-kilo.conflist")  
      --compatibility string           Should Kilo run in compatibility mode? Possible values: flannel, cilium  
      --create-interface               Should kilo create an interface on startup? (default true)  
      --encapsulate string             When should Kilo encapsulate packets within a location? Possible values: never, crosssubnet, always (default "always")  
  -h, --help                           help for kg  
      --hostname string                Hostname of the node on which this process is running.  
      --interface string               Name of the Kilo interface to use; if it does not exist, it will be created. (default "kilo0")  
      --internal-cidr strings          CIDRs to consider for internal IP auto-detection. If specified, only IPs within these CIDRs will be used. Can be specified multiple times.  
      --iptables-forward-rules         Add default accept rules to the FORWARD chain in iptables. Warning: this may break firewalls with a deny all policy and is potentially insecure!  
      --kubeconfig string              Path to kubeconfig.  
      --listen string                  The address at which to listen for health and metrics. (default ":1107")  
      --local                          Should Kilo manage routes within a location? (default true)  
      --log-level string               Log level to use. Possible values: all, debug, info, warn, error, none (default "info")  
      --master string                  The address of the Kubernetes API server (overrides any value in kubeconfig).  
      --mesh-granularity string        The granularity of the network mesh to create. Possible values: location, full (default "location")  
      --mtu string                     The MTU of the WireGuard interface created by Kilo. Set to 'auto' to detect from the underlay interface. (default "auto")  
      --port int                       The port over which WireGuard peers should communicate. (default 51820)  
      --prioritise-private-addresses   Prefer to assign a private IP address to the node's endpoint.  
      --resync-period duration         How often should the Kilo controllers reconcile? (default 30s)  
      --service-cidr strings           The service CIDR for the Kubernetes cluster. Can be provided optionally to avoid masquerading packets sent to service IPs. Can be specified multiple times.  
      --subnet string                  CIDR from which to allocate addresses for WireGuard interfaces. (default "10.4.0.0/16")  
      --topology-label string          Kubernetes node label used to group nodes into logical locations. (default "topology.kubernetes.io/region")  
      --version                        Print version and exit.  

```

--------------------------------

### Configure Full Mesh Topology

Source: https://kilo.squat.ai/docs/topology

Enables a full mesh topology for the Kilo network using a command-line flag. This ensures all inter-node traffic is encrypted.

```bash
--mesh-granularity=full

```

--------------------------------

### Connect Host to Cluster

Source: https://kilo.squat.ai/docs/kgctl

Connects the local host to the cluster, configuring interfaces, routes, and keys. This command requires the CAP_NET_ADMIN capability and is currently only supported on Linux. The configuration is cleaned up on exit unless `--clean-up false` is used.

```bash
SERVICECIDR=10.43.0.0/16
kgctl connect --allowed-ips $SERVICECIDR
```

--------------------------------

### Automate Route Creation for Cluster Access

Source: https://kilo.squat.ai/docs/vpn

Automate the creation of necessary IP routes on a Linux machine to access the cluster through the WireGuard interface. This script parses the 'AllowedIPs' from the 'kgctl showconf' output.

```bash
for ip in $(kgctl showconf peer $PEER | grep AllowedIPs | cut -f 3- -d ' ' | tr -d ','); do
    sudo ip route add $ip dev $IFACE
done

```

--------------------------------

### Apply Kilo CRDs and K3s Heterogeneous Userspace Manifest

Source: https://kilo.squat.ai/docs/userspace-wireguard

This command applies the CRDs and a Kilo configuration for heterogeneous K3s clusters. It deploys userspace WireGuard only to nodes that require it, while others leverage the kernel module.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/crds.yaml
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/kilo-k3s-userspace-heterogeneous.yaml

```

--------------------------------

### Configure Multi-cluster Services

Source: https://kilo.squat.ai/docs/introduction

Register nodes between two clusters and create a mirrored Service and Endpoints in the second cluster to access services from the first.

```bash
# Register the nodes in cluster1 as peers of cluster2.
for n in $(kubectl --kubeconfig $KUBECONFIG1 get no -o name | cut -d'/' -f2); do
    kgctl --kubeconfig $KUBECONFIG1 showconf node $n --as-peer -o yaml --allowed-ips $SERVICECIDR1 | kubectl --kubeconfig $KUBECONFIG2 apply -f -
done
# Register the nodes in cluster2 as peers of cluster1.
for n in $(kubectl --kubeconfig $KUBECONFIG2 get no -o name | cut -d'/' -f2); do
    kgctl --kubeconfig $KUBECONFIG2 showconf node $n --as-peer -o yaml --allowed-ips $SERVICECIDR2 | kubectl --kubeconfig $KUBECONFIG1 apply -f -
done
# Create a Service in cluster2 to mirror the Service in cluster1.
cat <<EOF | kubectl --kubeconfig $KUBECONFIG2 apply -f -
apiVersion: v1
kind: Service
metadata:
  name: important-service
spec:
  ports:
    - port: 80
---
apiVersion: v1
kind: Endpoints
metadata:
    name: important-service
subsets:
  - addresses:
      - ip: $CLUSTERIP # The cluster IP of the important service on cluster1.
    ports:
      - port: 80
EOF
```

--------------------------------

### Apply Peer Validation Manifest

Source: https://kilo.squat.ai/docs/peer-validation

Apply the Service, Deployment, and ValidatingWebhookConfiguration for Kilo Peer Validation using kubectl.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/blob/main/manifests/peer-validation.yaml  

```

--------------------------------

### Force Rebuild and Reload Website Docs

Source: https://kilo.squat.ai/docs/building_website

Use this command to force a rebuild of the website's documentation markdown files and automatically reload the local development server. This is useful when making changes to the source markdown files while the server is running.

```bash
make website/docs/README.md -B
```

--------------------------------

### Annotate Nodes for Mixed Topology (AWS, GCP, and Others)

Source: https://kilo.squat.ai/docs/topology

Configures a mixed topology by annotating nodes for AWS, GCP, and any remaining nodes. AWS and GCP nodes form their own logical groups, while other nodes are assigned unique locations.

```bash
for node in $(kubectl get nodes | grep -i aws | awk '{print $1}'); do kubectl annotate node $node kilo.squat.ai/location="aws"; done  
for node in $(kubectl get nodes | grep -i gcp | awk '{print $1}'); do kubectl annotate node $node kilo.squat.ai/location="gcp"; done  
for node in $(kubectl get nodes | tail -n +2 | grep -v aws | grep -v gcp | awk '{print $1}'); do kubectl annotate node $node kilo.squat.ai/location="$node"; done  

```

--------------------------------

### Create Kubernetes Service and Endpoints for Peer Service

Source: https://kilo.squat.ai/docs/vpn

Create a Kubernetes Service and Endpoints to provide discoverability for a service exposed by a peer. This allows cluster workloads to easily access the peer's service.

```yaml
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Service
metadata:
  name: important-service
spec:
  ports:
    - port: 80
---
apiVersion: v1
kind: Endpoints
metadata:
    name: important-service
subsets:
  - addresses:
      - ip: 10.5.0.1
    ports:
      - port: 80
EOF

```

--------------------------------

### Configure a Node as a Peer in Another Cluster (YAML)

Source: https://kilo.squat.ai/docs/kgctl

Outputs the WireGuard configuration for a node as a peer in YAML format, suitable for applying to another cluster using `kubectl`. Requires specifying kubeconfig files for both clusters.

```bash
NODE=master # the name of a node
kgctl --kubeconfig $KUBECONFIG1 showconf node $NODE --as-peer --output yaml | kubectl --kubeconfig $KUBECONFIG2 apply -f -
```

--------------------------------

### Show WireGuard Configuration for a Node

Source: https://kilo.squat.ai/docs/kgctl

Retrieves and displays the WireGuard configuration for a specified node in the Kilo mesh. This configuration is needed for the node to join the mesh.

```bash
NODE=master # the name of a node
kgctl showconf node $NODE
```

--------------------------------

### Annotate Nodes for Mixed Topology (GCP and Bare Metal)

Source: https://kilo.squat.ai/docs/topology

Annotates nodes for a mixed topology. GCP nodes are grouped into a 'gcp' location, while other nodes (assumed bare metal) are assigned their own unique location, creating a full mesh among them.

```bash
for node in $(kubectl get nodes | grep -i gcp | awk '{print $1}'); do kubectl annotate node $node kilo.squat.ai/location="gcp"; done  
for node in $(kubectl get nodes | tail -n +2 | grep -v gcp | awk '{print $1}'); do kubectl annotate node $node kilo.squat.ai/location="$node"; done  

```

--------------------------------

### Apply WireGuard Configuration

Source: https://kilo.squat.ai/docs/vpn-server

Applies the modified WireGuard configuration to a specified network interface. Replace 'wg0' with your WireGuard interface name.

```bash
IFACE=wg0
sudo wg setconf $IFACE peer.ini
```

--------------------------------

### Apply Kilo CRDs and K3s Userspace Manifest

Source: https://kilo.squat.ai/docs/userspace-wireguard

Use this command to apply the necessary Custom Resource Definitions (CRDs) and the Kilo userspace configuration for a K3s cluster where all nodes will use the userspace WireGuard implementation.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/crds.yaml
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/kilo-k3s-userspace.yaml

```

--------------------------------

### Annotate Nodes with Location

Source: https://kilo.squat.ai/docs/introduction

This command annotates nodes with 'GCP' in their name to specify their location for Kilo. Ensure the WireGuard kernel module is loaded and the UDP port is open.

```bash
for node in $(kubectl get nodes | grep -i gcp | awk '{print $1}'); do kubectl annotate node $node kilo.squat.ai/location="gcp"; done  
```

--------------------------------

### Generate Cluster Graph Visualization

Source: https://kilo.squat.ai/docs/topology

Generates a visual representation of the Kilo network topology. This command is useful for understanding the connections and structure of the encrypted network after configuring topology settings.

```bash
kgctl graph | circo -Tsvg > cluster.svg  

```

--------------------------------

### Edit WireGuard Configuration

Source: https://kilo.squat.ai/docs/vpn-server

Opens the generated peer configuration file in your default editor for modification.

```bash
$EDITOR peer.ini
```

--------------------------------

### Apply Peer Resource to Cluster

Source: https://kilo.squat.ai/docs/vpn

Apply the defined Kilo Peer resource to the Kubernetes cluster using kubectl.

```bash
kubectl apply -f peer.yaml

```

--------------------------------

### Set WireGuard Interface as Default Route

Source: https://kilo.squat.ai/docs/vpn-server

Configures the local machine to use the WireGuard interface as the device for the default route, effectively making it the internet gateway.

```bash
sudo ip route delete default
sudo ip route add default dev $IFACE
```

--------------------------------

### Set Kilo Docker Image Name

Source: https://kilo.squat.ai/docs/building_kilo

Set the IMAGE environment variable to your Docker Hub username followed by '/kilo' to name the generated container images and manifests correctly.

```bash
export IMAGE=<docker hub user name>/kilo
```

--------------------------------

### Make Requests to Peer Service from Cluster

Source: https://kilo.squat.ai/docs/vpn

Make HTTP requests to a service exposed by the peer (e.g., on TCP port 80) from within the cluster.

```bash
curl http://10.5.0.1

```

--------------------------------

### Grant Prometheus Access to Kilo Namespace

Source: https://kilo.squat.ai/docs/monitoring

Apply the Role and RoleBinding to allow the kube-prometheus stack to monitor the 'kilo' namespace.

```bash
kubectl apply -f https://raw.githubusercontent.com/squat/kilo/main/manifests/wg-exporter-role-kube-prometheus.yaml
```

--------------------------------

### Generate Kilo Network Graph

Source: https://kilo.squat.ai/docs/introduction

Use `kgctl graph` to generate a network graph in Graphviz format, which can then be rendered to SVG.

```bash
kgctl graph | circo -Tsvg > cluster.svg
```

--------------------------------

### Lint Kilo Code

Source: https://kilo.squat.ai/docs/building_kilo

Lint the code in the Kilo repository using the 'make lint' command.

```bash
make lint
```

--------------------------------

### Verify External IP Address

Source: https://kilo.squat.ai/docs/vpn-server

Fetches and displays the current external IP address of the local machine to verify internet gateway configuration.

```bash
curl https://icanhazip.com
```

--------------------------------

### Mirror a Service Between Clusters

Source: https://kilo.squat.ai/docs/multi-cluster-services

Create a Kubernetes Service and Endpoints in cluster2 to mirror a Service from cluster1. This makes the service discoverable and accessible in cluster2 using its Kubernetes DNS name.

```yaml
apiVersion: v1  
kind: Service  
metadata:  
  name: important-service  
spec:  
  ports:  
    - port: 80  
---
apiVersion: v1  
kind: Endpoints  
metadata:  
    name: important-service  
subsets:  
  - addresses:  
      - ip: $(kubectl --kubeconfig $KUBECONFIG1 get service important-service -o jsonpath='{.spec.clusterIP}') # The cluster IP of the important service on cluster1.  
    ports:  
      - port: 80  

```

--------------------------------

### Generate Kilo Network Graph

Source: https://kilo.squat.ai/docs/kgctl

Generates a GraphViz DOT representation of the Kilo mesh topology. This is useful for visualizing and debugging network structure.

```bash
kgctl graph
```

--------------------------------

### Add Routes for WireGuard Peers

Source: https://kilo.squat.ai/docs/vpn-server

Ensures that packets encapsulated by WireGuard are sent through a real interface by adding routes for the public IPs of WireGuard peers.

```bash
default=$(ip route list all | grep default | awk '{$1=""; print $0}')
for ip in $(sudo wg | grep endpoint | awk '{print $2}' | sed 's/\(. \+ \):[0-9]\+/\1/'); do
    sudo ip route add $ip $default
done
```

--------------------------------

### Define a Kilo Peer Resource

Source: https://kilo.squat.ai/docs/vpn

Define a Kilo Peer resource in YAML format. Ensure the 'publicKey' field contains a valid WireGuard public key. The 'allowedIPs' specifies the IP address on the peer's interface.

```yaml
apiVersion: kilo.squat.ai/v1alpha1
kind: Peer
metadata:
  name: squat
spec:
  allowedIPs:
  - 10.5.0.1/32 # Example IP address on the peer's interface.
  publicKey: GY5aT1N9dTR/nJnT1N2f4ClZWVj0jOAld0r8ysWLyjg=
  persistentKeepalive: 10

```

--------------------------------

### Port-forward to Prometheus

Source: https://kilo.squat.ai/docs/monitoring

Use port-forwarding to access the Prometheus UI if not directly connected to the cluster. Navigate to localhost:9090 to view targets and execute queries.

```bash
kubectl -n monitoring port-forward svc/prometheus-k8s 9090
```

--------------------------------

### Peer Nodes Between Clusters

Source: https://kilo.squat.ai/docs/multi-cluster-services

Register nodes from one cluster as peers of another and specify service CIDRs to ensure full routability. This is a prerequisite for enabling cross-cluster service access.

```bash
# Register the nodes in cluster1 as peers of cluster2.  
for n in $(kubectl --kubeconfig $KUBECONFIG1 get no -o name | cut -d'/' -f2); do  
    # Specify the service CIDR as an extra IP range that should be routable.  
    kgctl --kubeconfig $KUBECONFIG1 showconf node $n --as-peer -o yaml --allowed-ips $SERVICECIDR1 | kubectl --kubeconfig $KUBECONFIG2 apply -f -  
done  
# Register the nodes in cluster2 as peers of cluster1.  
for n in $(kubectl --kubeconfig $KUBECONFIG2 get no -o name | cut -d'/' -f2); do  
    # Specify the service CIDR as an extra IP range that should be routable.  
    kgctl --kubeconfig $KUBECONFIG2 showconf node $n --as-peer -o yaml --allowed-ips $SERVICECIDR2 | kubectl --kubeconfig $KUBECONFIG1 apply -f -  
done  

```

--------------------------------

### Ping Peer from Cluster Node

Source: https://kilo.squat.ai/docs/vpn

Ping the peer's IP address from any node or Pod within the cluster to verify layer 3 connectivity.

```bash
ping 10.5.0.1

```

--------------------------------

### PeerList

Source: https://kilo.squat.ai/docs/api

Represents a list of peers.

```APIDOC
## PeerList

### Description
PeerList is a list of peers.

### Fields
- **metadata** (metav1.ListMeta) - Optional - Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- **items** ([]Peer) - Required - List of peers. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md
```

--------------------------------

### Test Connection to Cluster API Server

Source: https://kilo.squat.ai/docs/vpn

Test the connection to the Kubernetes API server using curl. This command retrieves the API server endpoint and connects securely, ignoring certificate issues.

```bash
curl -k https://$(kubectl get endpoints kubernetes | tail -n +2 | tr , \t | awk '{print $2}')

```

--------------------------------

### DNSOrIP

Source: https://kilo.squat.ai/docs/api

Represents either a DNS name or an IP address. If both are provided, the IP address takes precedence.

```APIDOC
## DNSOrIP

### Description
Represents either a DNS name or an IP address. When both are given, the IP address, as it is more specific, overrides the DNS name.

### Fields
- **dns** (string) - Optional - DNS must be a valid RFC 1123 subdomain.
- **ip** (string) - Optional - IP must be a valid IP address.
```

--------------------------------

### PeerSpec

Source: https://kilo.squat.ai/docs/api

The description and configuration of a peer.

```APIDOC
## PeerSpec

### Description
PeerSpec is the description and configuration of a peer.

### Fields
- **allowedIPs** ([]string) - Required - AllowedIPs is the list of IP addresses that are allowed for the given peer's tunnel.
- **endpoint** (*PeerEndpoint) - Optional - Endpoint is the initial endpoint for connections to the peer.
- **persistentKeepalive** (int) - Optional - PersistentKeepalive is the interval in seconds of the emission of keepalive packets by the peer. This defaults to 0, which disables the feature.
- **presharedKey** (string) - Optional - PresharedKey is the optional symmetric encryption key for the peer.
- **publicKey** (string) - Required - PublicKey is the WireGuard public key for the peer.
```

--------------------------------

### Peer

Source: https://kilo.squat.ai/docs/api

Represents a WireGuard peer that should have access to the VPN.

```APIDOC
## Peer

### Description
Peer is a WireGuard peer that should have access to the VPN.

### Fields
- **metadata** (metav1.ObjectMeta) - Optional - Standard object’s metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/api-conventions.md#metadata
- **spec** (PeerSpec) - Required - Specification of the desired behavior of the Kilo Peer. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/api-conventions.md#spec-and-status
```

--------------------------------

### Port-forward to Grafana

Source: https://kilo.squat.ai/docs/monitoring

Use port-forwarding to access the Grafana dashboard if not directly connected to the cluster. Navigate to localhost:3000 with default credentials 'admin'/'admin'.

```bash
kubectl -n monitoring port-forward svc/grafana 3000
```

--------------------------------

### Deny All Ingress Except WireGuard

Source: https://kilo.squat.ai/docs/network-policies

Create a NetworkPolicy to restrict ingress traffic to a namespace, allowing only connections from the specified WireGuard CIDR. This is useful for securing namespaces by limiting access.

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress-except-wireguard
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 10.5.0.0/16 # The WireGuard mesh/s CIDR.

```

--------------------------------

### PeerEndpoint

Source: https://kilo.squat.ai/docs/api

Represents a WireGuard endpoint, which is an IP:port tuple.

```APIDOC
## PeerEndpoint

### Description
PeerEndpoint represents a WireGuard endpoint, which is an IP:port tuple.

### Fields
- **dnsOrIP** (DNSOrIP) - Required - DNSOrIP is a DNS name or an IP address.
- **port** (uint32) - Required - Port must be a valid port number.
```

--------------------------------

### Set Custom Container Registry

Source: https://kilo.squat.ai/docs/building_kilo

Set the REGISTRY environment variable to your custom container registry (without a trailing slash) if you are not using Docker Hub.

```bash
export REGISTRY=<your registry without a trailing slash>
```

--------------------------------

### Deny Egress to WireGuard Peers

Source: https://kilo.squat.ai/docs/network-policies

Implement a NetworkPolicy to prevent Pods in a namespace from initiating connections to the WireGuard mesh. This enhances security by isolating potentially untrusted Pods.

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-egress-to-wireguard
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.5.0.0/16 # The WireGuard mesh's CIDR.

```

--------------------------------

### WireGuard Exporter Metrics

Source: https://kilo.squat.ai/docs/monitoring

These metrics are exported by the Prometheus WireGuard Exporter, detailing bytes sent/received and the time since the last handshake.

```prometheus
# HELP wireguard_sent_bytes_total Bytes sent to the peer
# TYPE wireguard_sent_bytes_total counter

# HELP wireguard_received_bytes_total Bytes received from the peer
# TYPE wireguard_received_bytes_total counter

# HELP wireguard_latest_handshake_seconds Seconds from the last handshake
# TYPE wireguard_latest_handshake_seconds gauge
```

--------------------------------

### Resolve Kubernetes API ClusterIP

Source: https://kilo.squat.ai/docs/kgctl

Resolves the clusterIP of the Kubernetes API service using `dig`. This is useful after connecting to the cluster to verify DNS resolution.

```bash
dig @$(kubectl get service -n kube-system kube-dns -o=jsonpath='{.spec.clusterIP}') kubernetes.default.svc.cluster.local +short
# > 10.43.0.1
```

--------------------------------

### Kilo Metrics

Source: https://kilo.squat.ai/docs/monitoring

These are the standard and Kilo-specific metrics exported by Kilo, including errors, leadership status, node count, peer count, and reconciliation attempts.

```prometheus
# HELP kilo_errors_total Number of errors that occurred while administering the mesh.
# TYPE kilo_errors_total counter

# HELP kilo_leader Leadership status of the node.
# TYPE kilo_leader gauge

# HELP kilo_nodes Number of nodes in the mesh.
# TYPE kilo_nodes gauge

# HELP kilo_peers Number of peers in the mesh.
# TYPE kilo_peers gauge

# HELP kilo_reconciles_total Number of reconciliation attempts.
# TYPE kilo_reconciles_total counter
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.