Securing Kubernetes with Wireguard & others

As the cluster grew, I needed secure access to internal services — PostgreSQL, NATS, Redis, ScyllaDB — without exposing them to the public internet. I went through three solutions: WireGuard, Tailscale, and eventually Netbird. Each one taught me something. The Problem Early on I was forwarding TCP ports directly through the ingress controller: tcp : " 4222" : nats/nats-cluster:4222 "5432" : pgo/astring-ha:5432 "6379" : redis/redis:6379 "9042" : scylla/scylla-client:9042 Each service has authenti