Connect clusters peer-to-peer
WireGuard connects Kubernetes clusters directly, encrypted and without extra setup.
Fabric
The secure network of the platform.
WireGuard connects Kubernetes clusters peer-to-peer. The eBPF firewall sits on the hosts and stops attacks. The VPN reaches the nodes.
Dataplane
One dataplane for clusters and services.
Fabric is the network layer of the platform. WireGuard connects your clusters with encryption, the eBPF firewall on the Kubernetes hosts stops attacks, and the VPN gets you to the nodes.
WireGuard P2P
With WireGuard you automatically have access to your clusters. The nodes connect peer-to-peer, and the tunnel is part of the platform.
Encrypted connection
Traffic between cluster hosts runs encrypted. The private network of your clusters runs over the same layer.
eBPF firewall
The firewall runs on every host, meaning the Kubernetes nodes in the cluster. It filters traffic where it reaches the node.
DDoS protection
The eBPF firewall is your DDoS protection. Allowed traffic comes through, attacks stay out.
VPN access to the nodes
Over the VPN you reach the Kubernetes nodes of your clusters directly.
Loopback RBAC
You use Loopback RBAC to set who can see or change tunnels, firewall, and VPN.
From cluster to a protected network.
You bring the clusters into the WireGuard network, protect the hosts with the eBPF firewall, and reach the nodes over the VPN.
01
Connect the cluster
WireGuard connects your clusters peer-to-peer in an encrypted network.
02
Encrypt the tunnel
The connection between hosts is encrypted. The platform's private network runs through the same tunnel.
03
Protect the hosts
The eBPF firewall on the Kubernetes nodes stops attacks right at the host. It is the DDoS protection of the dataplane.
04
Reach the nodes
Over the VPN you reach the Kubernetes nodes. You place load balancers in front of the project or directly on the cluster.
What you can do
Fabric brings firewall, load balancer, private network, and VPN together in your organization. Your clusters use all of it directly.
Protect hosts in the cluster
The eBPF firewall runs on the Kubernetes nodes. You set rules where traffic reaches the host and manage firewall and cluster in one place.
Stop attacks on the host
The eBPF firewall on the Kubernetes nodes is the DDoS protection. It filters traffic on the host and lets allowed traffic through.
Reach the nodes over VPN
Over the VPN you reach the Kubernetes nodes. You control access in your organization.
Distribute load
You place load balancers in front of the project or directly on the Kubernetes workspace. They run in the same dataplane as firewall and private network.
Control access through Loopback RBAC
You use Loopback RBAC in the organization to set who can see or change tunnels, firewall, VPN, and load balancer.
Fabric lives in the organization.
Fabric belongs to the organization and protects every cluster and service beneath it. Organization, Fabric, and clusters form one shared model.
Organization
Account, teams, and Loopback RBAC. This is where you decide who can use Fabric.
Fabric
Firewall, private network, VPN, and load balancer. The shared dataplane of the platform.
Clusters and services
Your Kubernetes clusters run in the WireGuard network. The VPN gets you to the nodes.
The facts.
| Tunnel | WireGuard, peer-to-peer between Kubernetes clusters |
|---|---|
| Connection | Encrypted |
| Firewall | eBPF on the Kubernetes hosts in the cluster |
| Defense | eBPF firewall on the hosts, including DDoS protection |
| VPN | Access to the Kubernetes nodes |
| Private network | Operated by Loopback |
| Load balancer | In front of the project or on the Kubernetes workspace |
| Permissions | Loopback RBAC |
| Scope | Organization |
Keep working in the same model.
Fabric protects your clusters. Kubernetes, DNS, and Bundles share the organization and RBAC with Fabric.
FAQ
What does Fabric take on for the cluster?
Fabric is the platform's data plane. WireGuard gives you automatic, encrypted access to your clusters. The eBPF firewall on the hosts stops attacks and provides the DDoS protection. The VPN takes you straight to your nodes. The private network and the load balancer belong to the same layer, and Loopback RBAC decides who configures Fabric.
What is the VPN in Fabric for?
The VPN reaches the Kubernetes nodes. The clusters sit in the WireGuard network.
How does Fabric work with Loopback RBAC?
Fabric uses Loopback RBAC. You decide in the organization who can see or change tunnels, firewall, VPN, and load balancer.