Workers nodes behind NAT

[majkrzak]

I want to setup a cluster, where only the master node is publicly available and workers are not.

Docs states that:

Both SERVER_EXTERNAL_IP and AGENT_EXTERNAL_IP must have connectivity between them and are normally public IPs.

Generally in the wireguard config, only one peer IP is required. Will it work for k3s too?

[brandond]

Only if you use an external coordinator like tailscale to build the VPN mesh. Otherwise the nodes all need to be able to connect to each other.

[majkrzak]

Ok, so the connection have to also be established between workers, not only between master and workers?

[brandond]

yes. Kubernetes requires a full mesh, as pods on any node may need to access pods and services hosted on other nodes. A simple hub and spoke VPN topology will not work. You can reference the K3s docs for port connectivity requirements between nodes.