# squat/kilo

Kilo is a multi-cloud network overlay built on WireGuard and designed for Kubernetes (k8s + wg = kg)

Repository: https://github.com/squat/kilo
Canonical: https://ross.abutalabs.com/products/squat-kilo
Homepage: https://kilo.squat.ai
Language: Go
License: Apache-2.0
License Family: permissive
Topics: kubernetes, networking, vpn, wireguard, multi-cloud, multi-cluster, federation, cni
Last push: 2026-08-20T01:10:47+00:00

## Health v2 (maintenance only)
Score: 78/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 41, longevity 100
- inputs: {"age_days": 2813, "days_push": 14, "days_rel": 182, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2284, forks 141 (observed 2026-08-28T04:06:33.978413+00:00)

## What it is
Kilo is a multi-cloud network overlay for Kubernetes built on WireGuard, providing an encrypted layer 3 network that connects nodes across data centers, clouds, and NAT boundaries. It runs as an agent (kg) on every node and can act as a full CNI or an add-on alongside existing networking like Flannel, also enabling VPN access for external peers and multi-cluster services.

## Use cases
- connect kubernetes nodes across different clouds into one cluster
- create a multi-cloud kubernetes cluster with encrypted pod networking
- vpn into a kubernetes cluster to access pods and services securely
- connect two kubernetes clusters to share services privately
- encrypt cluster traffic between nodes on unsecured networks
- run local development workloads connected to a remote cluster
- add wireguard networking on top of flannel
- give cluster workloads secure access to services behind a corporate vpn

## When to choose
- you need a single kubernetes cluster spanning multiple clouds or data centers
- you want wireguard-based encrypted pod networking with a simple agent
- you need private multi-cluster services without exposing them via ingress or nodeport
- you want external clients or developers to VPN into the cluster network
- you need a lightweight CNI add-on that complements an existing network plugin

## When to avoid
- you run kubernetes on windows or non-linux nodes without WireGuard support
- you need a CNI with rich L7 policy or service mesh features
- your cluster is single-location and your existing CNI already meets your needs
- you cannot load the WireGuard kernel module or use a userspace fallback

## Facets
- artifact type: service
- maturity: active
- function: networking, vpn, security, cryptography, self-hosted
- domain: networking, cloud-computing, security, infrastructure-as-code, microservices
- platform: go, self-hosted, cloud
- tags: wireguard, kubernetes-cni, multi-cloud, multi-cluster, network-overlay, cni, vpn-mesh, kubernetes-networking, containers, linux, kubernetes, docker

## Member repositories
- squat/kilo (main) score 78

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:33.978413+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:41:06.936926+00:00, confidence not recorded.
  - readme: https://github.com/squat/kilo (fetched 2026-08-28T04:06:33.978413+00:00, sha ae4e4271bd76)
  - homepage: https://kilo.squat.ai (fetched 2026-08-29T10:21:30.893710+00:00, sha 6075d5c395ca)
  - site_page: https://kilo.squat.ai/docs/introduction (fetched 2026-08-29T10:21:30.896041+00:00, sha 1db04ca4fb07)
  - site_page: https://kilo.squat.ai/docs/vpn (fetched 2026-08-29T10:21:30.898008+00:00, sha 6d04b4f4c4a3)
  - site_page: https://kilo.squat.ai/docs/multi-cluster-services (fetched 2026-08-29T10:21:30.899675+00:00, sha 933943e8fcbc)
  - site_page: https://kilo.squat.ai/docs/topology (fetched 2026-08-29T10:21:30.901435+00:00, sha be155d9e8fa5)
- Data as of 2026-08-30T08:39:29.467469+00:00.