Install K3 on VPC VMs over VPN Mesh Network

Zhimin Wen
4 min readDec 8, 2023
Image by Adam R from Pixabay

I have couple of cloud VMs from different VPC. Though they are from the same region, they could not talk to each other.

Let’s try to setup a mesh VPN to connect these VMs together and from which we can install K3s.

We will choose Tinc as the the solution for the VPN mesh network setup. Wireguard is out simply because the UDP traffic among the VMs are blocked. Only a few TCP ports are open for these VMs.

Install of Tinc

The installation of Tinc on Ubuntu is straight forward, on each of the VMs.

sudo apt install -y tinc

Next create a directory on each VM,

sudo mkdir -p /etc/tinc/myvpn 

We will have a Tinc instance named as myvpn.


Let’s have the following network topology,

We have 4 nodes. Named as master, and worker1–4, suppose to be the Kubernetes master and workers. Each node just has one private NIC card, and a public ip associate that used to access it for some ports exposed only.

We will create a VPN network with the IP range from–4. In the VPN network, workers will connect to the masters to form the connections.

  1. Create tinc.conf

In the master node, the conf file, /etc/tinc/myvpn/tinc.conf , is shown below,

Name = master
Device = /dev/net/tun
AddressFamily = ipv4
BindToAddress = {{ .privateIP }} 8443

The name of the tinc node is set as master. We configure it bind to the private IP address port 8443, which will be available through the public IP port 8443.

For the worker node, use the following configuration, use worker1 as an example,

Name = worker1
Device = /dev/net/tun
AddressFamily = ipv4
BindToAddress = {{ .privateIP }} 8443

ConnectTo = master

The only extra line is ConnectTo. We ask it connect to master. The details of the master is defined in the hosts file directory.