diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 75ea08626e..d48a778246 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -90,6 +90,7 @@ jobs:
         - metric-agent
         - telemetry
         - proxy
+        - gateway/tunnel/wireguard
     steps:
 
       - name: Set up QEMU
diff --git a/Makefile b/Makefile
index d12e6e162b..89d1fcdfa0 100644
--- a/Makefile
+++ b/Makefile
@@ -60,21 +60,22 @@ manifests: controller-gen
 #Generate RBAC for each controller
 rbacs: controller-gen
 	rm -f deployments/liqo/files/*
-	$(CONTROLLER_GEN) paths="./internal/liqonet/route-operator" rbac:roleName=liqo-route output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-route-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-route-ClusterRole.yaml deployments/liqo/files/liqo-route-Role.yaml
-	$(CONTROLLER_GEN) paths="./internal/liqonet/tunnel-operator" rbac:roleName=liqo-gateway output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-gateway-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-gateway-ClusterRole.yaml deployments/liqo/files/liqo-gateway-Role.yaml
-	$(CONTROLLER_GEN) paths="./internal/liqonet/network-manager/..." rbac:roleName=liqo-network-manager output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-network-manager-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-network-manager-ClusterRole.yaml deployments/liqo/files/liqo-network-manager-Role.yaml
-	$(CONTROLLER_GEN) paths="./internal/crdReplicator" rbac:roleName=liqo-crd-replicator output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-crd-replicator-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-crd-replicator-ClusterRole.yaml deployments/liqo/files/liqo-crd-replicator-Role.yaml
-	$(CONTROLLER_GEN) paths="./pkg/discoverymanager" rbac:roleName=liqo-discovery output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-discovery-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-discovery-ClusterRole.yaml deployments/liqo/files/liqo-discovery-Role.yaml
-	$(CONTROLLER_GEN) paths="./internal/auth-service" rbac:roleName=liqo-auth-service output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-auth-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-auth-ClusterRole.yaml deployments/liqo/files/liqo-auth-Role.yaml
-	$(CONTROLLER_GEN) paths="./pkg/peering-roles/basic" rbac:roleName=liqo-remote-peering-basic output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-remote-peering-basic-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-remote-peering-basic-ClusterRole.yaml
-	$(CONTROLLER_GEN) paths="./pkg/peering-roles/incoming" rbac:roleName=liqo-remote-peering-incoming output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-remote-peering-incoming-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-remote-peering-incoming-ClusterRole.yaml
-	$(CONTROLLER_GEN) paths="./pkg/peering-roles/outgoing" rbac:roleName=liqo-remote-peering-outgoing output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-remote-peering-outgoing-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-remote-peering-outgoing-ClusterRole.yaml
-	$(CONTROLLER_GEN) paths="./pkg/liqo-controller-manager/..." rbac:roleName=liqo-controller-manager output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-controller-manager-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-controller-manager-ClusterRole.yaml deployments/liqo/files/liqo-controller-manager-Role.yaml
-	$(CONTROLLER_GEN) paths="./pkg/virtualKubelet/roles/local" rbac:roleName=liqo-virtual-kubelet-local output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-virtual-kubelet-local-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-virtual-kubelet-local-ClusterRole.yaml
-	$(CONTROLLER_GEN) paths="./pkg/virtualKubelet/roles/remote" rbac:roleName=liqo-virtual-kubelet-remote output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-virtual-kubelet-remote-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-virtual-kubelet-remote-ClusterRole.yaml
-	$(CONTROLLER_GEN) paths="./cmd/uninstaller" rbac:roleName=liqo-pre-delete output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-pre-delete-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-pre-delete-ClusterRole.yaml
-	$(CONTROLLER_GEN) paths="./cmd/metric-agent" rbac:roleName=liqo-metric-agent output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-metric-agent-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-metric-agent-ClusterRole.yaml
-	$(CONTROLLER_GEN) paths="./cmd/telemetry" rbac:roleName=liqo-telemetry output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-telemetry-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' && $(SED_COMMAND) deployments/liqo/files/liqo-telemetry-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./internal/liqonet/route-operator" rbac:roleName=liqo-route output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-route-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-route-ClusterRole.yaml deployments/liqo/files/liqo-route-Role.yaml
+	$(CONTROLLER_GEN) paths="./internal/liqonet/tunnel-operator" rbac:roleName=liqo-gateway output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-gateway-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-gateway-ClusterRole.yaml deployments/liqo/files/liqo-gateway-Role.yaml
+	$(CONTROLLER_GEN) paths="./internal/liqonet/network-manager/..." rbac:roleName=liqo-network-manager output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-network-manager-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-network-manager-ClusterRole.yaml deployments/liqo/files/liqo-network-manager-Role.yaml
+	$(CONTROLLER_GEN) paths="./internal/crdReplicator" rbac:roleName=liqo-crd-replicator output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-crd-replicator-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-crd-replicator-ClusterRole.yaml deployments/liqo/files/liqo-crd-replicator-Role.yaml
+	$(CONTROLLER_GEN) paths="./pkg/discoverymanager" rbac:roleName=liqo-discovery output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-discovery-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-discovery-ClusterRole.yaml deployments/liqo/files/liqo-discovery-Role.yaml
+	$(CONTROLLER_GEN) paths="./internal/auth-service" rbac:roleName=liqo-auth-service output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-auth-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-auth-ClusterRole.yaml deployments/liqo/files/liqo-auth-Role.yaml
+	$(CONTROLLER_GEN) paths="./pkg/peering-roles/basic" rbac:roleName=liqo-remote-peering-basic output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-remote-peering-basic-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-remote-peering-basic-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./pkg/peering-roles/incoming" rbac:roleName=liqo-remote-peering-incoming output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-remote-peering-incoming-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-remote-peering-incoming-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./pkg/peering-roles/outgoing" rbac:roleName=liqo-remote-peering-outgoing output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-remote-peering-outgoing-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-remote-peering-outgoing-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./pkg/liqo-controller-manager/..." rbac:roleName=liqo-controller-manager output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-controller-manager-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-controller-manager-ClusterRole.yaml deployments/liqo/files/liqo-controller-manager-Role.yaml
+	$(CONTROLLER_GEN) paths="./pkg/virtualKubelet/roles/local" rbac:roleName=liqo-virtual-kubelet-local output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-virtual-kubelet-local-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-virtual-kubelet-local-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./pkg/virtualKubelet/roles/remote" rbac:roleName=liqo-virtual-kubelet-remote output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-virtual-kubelet-remote-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-virtual-kubelet-remote-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./cmd/uninstaller" rbac:roleName=liqo-pre-delete output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-pre-delete-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-pre-delete-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./cmd/metric-agent" rbac:roleName=liqo-metric-agent output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-metric-agent-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-metric-agent-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./cmd/telemetry" rbac:roleName=liqo-telemetry output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-telemetry-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-telemetry-ClusterRole.yaml
+	$(CONTROLLER_GEN) paths="./pkg/gateway/..." rbac:roleName=liqo-newgateway output:rbac:stdout | awk -v RS="---\n" 'NR>1{f="./deployments/liqo/files/liqo-newgateway-" $$4 ".yaml";printf "%s",$$0 > f; close(f)}' &&  sed -i -n '/rules/,$$p' deployments/liqo/files/liqo-newgateway-ClusterRole.yaml
 
 # Install gci if not available
 gci:
diff --git a/build/gateway/tunnel/wireguard/Dockerfile b/build/gateway/tunnel/wireguard/Dockerfile
new file mode 100644
index 0000000000..711f521809
--- /dev/null
+++ b/build/gateway/tunnel/wireguard/Dockerfile
@@ -0,0 +1,20 @@
+FROM golang:1.21 as goBuilder
+WORKDIR /tmp/builder
+
+COPY go.mod ./go.mod
+COPY go.sum ./go.sum
+RUN  go mod download
+
+COPY . ./
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=$(go env GOARCH) go build -ldflags="-s -w" ./cmd/gateway/tunnel/wireguard
+
+
+FROM alpine:3.18
+
+RUN apk update && \
+    apk add iptables bash wireguard-tools tcpdump conntrack-tools curl iputils && \
+    rm -rf /var/cache/apk/*
+
+COPY --from=goBuilder /tmp/builder/wireguard /usr/bin/liqo-wireguard
+
+ENTRYPOINT [ "/usr/bin/liqo-wireguard" ]
diff --git a/cmd/gateway/tunnel/wireguard/main.go b/cmd/gateway/tunnel/wireguard/main.go
new file mode 100644
index 0000000000..e96c34a9d7
--- /dev/null
+++ b/cmd/gateway/tunnel/wireguard/main.go
@@ -0,0 +1,165 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package wireguard contains the logic to configure the Wireguard interface.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"net"
+	"os"
+
+	"github.com/spf13/cobra"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/tools/leaderelection/resourcelock"
+	"k8s.io/klog/v2"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	ipamv1alpha1 "github.com/liqotech/liqo/apis/ipam/v1alpha1"
+	networkingv1alpha1 "github.com/liqotech/liqo/apis/networking/v1alpha1"
+	"github.com/liqotech/liqo/pkg/gateway/tunnel/common"
+	"github.com/liqotech/liqo/pkg/gateway/tunnel/wireguard"
+	flagsutils "github.com/liqotech/liqo/pkg/utils/flags"
+	"github.com/liqotech/liqo/pkg/utils/mapper"
+	"github.com/liqotech/liqo/pkg/utils/restcfg"
+)
+
+var (
+	addToSchemeFunctions = []func(*runtime.Scheme) error{
+		corev1.AddToScheme,
+		networkingv1alpha1.AddToScheme,
+		ipamv1alpha1.AddToScheme,
+	}
+	options = wireguard.NewOptions()
+)
+
+func main() {
+	var cmd = cobra.Command{
+		Use:  "liqo-wireguard",
+		RunE: run,
+	}
+
+	legacyflags := flag.NewFlagSet("legacy", flag.ExitOnError)
+	restcfg.InitFlags(legacyflags)
+	klog.InitFlags(legacyflags)
+	flagsutils.FromFlagToPflag(legacyflags, cmd.Flags())
+
+	wireguard.InitFlags(cmd.Flags(), options)
+	if err := wireguard.MarkFlagsRequired(&cmd, options); err != nil {
+		klog.Error(err)
+		os.Exit(1)
+	}
+
+	if err := cmd.Execute(); err != nil {
+		klog.Error(err)
+		os.Exit(1)
+	}
+}
+
+func run(_ *cobra.Command, _ []string) error {
+	var err error
+	ctx := ctrl.SetupSignalHandler()
+	scheme := runtime.NewScheme()
+
+	// Adds the APIs to the scheme.
+	for _, addToScheme := range addToSchemeFunctions {
+		if err = addToScheme(scheme); err != nil {
+			return fmt.Errorf("unable to add scheme: %w", err)
+		}
+	}
+
+	// Set controller-runtime logger.
+	log.SetLogger(klog.NewKlogr())
+
+	// Get the rest config.
+	cfg := config.GetConfigOrDie()
+
+	// Create the client. This cliend should be used only outside the reconciler.
+	cl, err := client.New(cfg, client.Options{
+		Scheme: scheme,
+		Cache:  nil,
+	})
+	if err != nil {
+		return fmt.Errorf("unable to create client: %w", err)
+	}
+
+	// Create the manager.
+	mgr, err := ctrl.NewManager(cfg, ctrl.Options{
+		MapperProvider:         mapper.LiqoMapperProvider(scheme),
+		Scheme:                 scheme,
+		Namespace:              options.Namespace,
+		MetricsBindAddress:     "0", // Metrics are exposed by "connection" container.
+		HealthProbeBindAddress: options.ProbeAddr,
+		LeaderElection:         options.LeaderElection,
+		LeaderElectionID: fmt.Sprintf(
+			"%s.%s.%s.wgtunnel.liqo.io",
+			wireguard.GenerateResourceName(options.Name), options.Namespace, options.Mode,
+		),
+		LeaderElectionNamespace:       options.Namespace,
+		LeaderElectionReleaseOnCancel: true,
+		LeaderElectionResourceLock:    resourcelock.LeasesResourceLock,
+		LeaseDuration:                 &options.LeaderElectionLeaseDuration,
+		RenewDeadline:                 &options.LeaderElectionRenewDeadline,
+		RetryPeriod:                   &options.LeaderElectionRetryPeriod,
+	})
+	if err != nil {
+		return fmt.Errorf("unable to create manager: %w", err)
+	}
+
+	// Setup the controller.
+	pkr, err := wireguard.NewPublicKeysReconciler(
+		mgr.GetClient(),
+		mgr.GetScheme(),
+		mgr.GetEventRecorderFor("wireguard-controller"),
+		options,
+	)
+	if err != nil {
+		return fmt.Errorf("unable to create public keys reconciler: %w", err)
+	}
+
+	dnsChan := make(chan event.GenericEvent)
+	if options.Mode == common.ModeClient {
+		if wireguard.IsDNSRoutineRequired(options) {
+			go wireguard.StartDNSRoutine(ctx, dnsChan, options)
+			klog.Infof("Starting DNS routine: resolving the endpoint address every %s", options.DNSCheckInterval.String())
+		} else {
+			options.EndpointIP = net.ParseIP(options.EndpointAddress)
+			klog.Infof("Setting static endpoint IP: %s", options.EndpointIP.String())
+		}
+	}
+
+	// Setup the controller.
+	if err = pkr.SetupWithManager(mgr, dnsChan); err != nil {
+		return fmt.Errorf("unable to setup public keys reconciler: %w", err)
+	}
+
+	// Ensure presence of Secret with private and public keys.
+	if err = wireguard.EnsureKeysSecret(ctx, cl, options); err != nil {
+		return fmt.Errorf("unable to manage wireguard keys secret: %w", err)
+	}
+
+	// Create the wg-liqo interface and init the wireguard configuration depending on the mode (client/server).
+	if err := wireguard.InitWireguardLink(options); err != nil {
+		return fmt.Errorf("unable to init wireguard link: %w", err)
+	}
+
+	// Start the manager.
+	return mgr.Start(ctx)
+}
diff --git a/deployments/liqo/charts/liqo-crds/crds/networking.liqo.io_publickeys.yaml b/deployments/liqo/charts/liqo-crds/crds/networking.liqo.io_publickeys.yaml
deleted file mode 100644
index 6549afa6c2..0000000000
--- a/deployments/liqo/charts/liqo-crds/crds/networking.liqo.io_publickeys.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
-  name: publickeys.networking.liqo.io
-spec:
-  group: networking.liqo.io
-  names:
-    categories:
-    - liqo
-    kind: PublicKey
-    listKind: PublicKeyList
-    plural: publickeys
-    singular: publickey
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: PublicKey contains a public key data required by some interconnection
-          technologies.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: PublicKeySpec defines the desired state of PublicKey.
-            properties:
-              publicKey:
-                description: PublicKey contains the public key.
-                format: byte
-                type: string
-            type: object
-        type: object
-    served: true
-    storage: true
diff --git a/deployments/liqo/files/liqo-newgateway-ClusterRole.yaml b/deployments/liqo/files/liqo-newgateway-ClusterRole.yaml
new file mode 100644
index 0000000000..61aa35e3fd
--- /dev/null
+++ b/deployments/liqo/files/liqo-newgateway-ClusterRole.yaml
@@ -0,0 +1,21 @@
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - publickeys
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
diff --git a/deployments/liqo/templates/liqo-newgateway-rbac.yaml b/deployments/liqo/templates/liqo-newgateway-rbac.yaml
new file mode 100644
index 0000000000..1ebdad851f
--- /dev/null
+++ b/deployments/liqo/templates/liqo-newgateway-rbac.yaml
@@ -0,0 +1,14 @@
+---
+{{- $gatewayConfig := (merge (dict "name" "newgateway" "module" "networking") .) -}}
+
+{{- if .Values.networking.internal }}
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "liqo.prefixedName" $gatewayConfig }}
+  labels:
+    {{- include "liqo.labels" $gatewayConfig | nindent 4 }}
+{{ .Files.Get (include "liqo.cluster-role-filename" (dict "prefix" ( include "liqo.prefixedName" $gatewayConfig))) }}
+
+{{- end }}
diff --git a/go.mod b/go.mod
index e44722df60..3cfc896e44 100644
--- a/go.mod
+++ b/go.mod
@@ -240,11 +240,11 @@ require (
 	go.opentelemetry.io/otel/trace v1.16.0 // indirect
 	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
 	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.25.0 // indirect
 	golang.org/x/crypto v0.14.0 // indirect
 	golang.org/x/net v0.17.0 // indirect
 	golang.org/x/oauth2 v0.11.0 // indirect
 	golang.org/x/term v0.13.0 // indirect
-	go.uber.org/zap v1.25.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.13.0 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20220904105730-b51010ba13f0 // indirect
diff --git a/pkg/consts/externalnetwork.go b/pkg/consts/externalnetwork.go
index e9acccf525..a7094fd811 100644
--- a/pkg/consts/externalnetwork.go
+++ b/pkg/consts/externalnetwork.go
@@ -19,8 +19,14 @@ const (
 	WgServerNameLabel = "liqo.io/wg-server-name"
 	// WgClientNameLabel is the label used to indicate the name of the WireGuard client.
 	WgClientNameLabel = "liqo.io/wg-client-name"
+
 	// ExternalNetworkLabel is the label added to all components that belong to the external network.
 	ExternalNetworkLabel = "liqo.io/external-network"
 	// ExternalNetworkLabelValue is the value of the label added to components that belong to the external network.
 	ExternalNetworkLabelValue = "true"
+
+	// GatewayResourceLabel is the label added to a gateway resource.
+	GatewayResourceLabel = "networking.liqo.io/gateway-resource"
+	// GatewayResourceLabelValue is the value of the label added to a gateway resource.
+	GatewayResourceLabelValue = "true"
 )
diff --git a/pkg/gateway/connection/doc.go b/pkg/gateway/connection/doc.go
new file mode 100644
index 0000000000..a938ab5f3e
--- /dev/null
+++ b/pkg/gateway/connection/doc.go
@@ -0,0 +1,16 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package connection manage Connection resources.
+package connection
diff --git a/pkg/gateway/connection/k8s.go b/pkg/gateway/connection/k8s.go
new file mode 100644
index 0000000000..c544c374ad
--- /dev/null
+++ b/pkg/gateway/connection/k8s.go
@@ -0,0 +1,40 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package connection
+
+import (
+	"context"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	networkingv1alpha1 "github.com/liqotech/liqo/apis/networking/v1alpha1"
+	liqonetutils "github.com/liqotech/liqo/pkg/liqonet/utils"
+)
+
+// UpdateConnectionStatus updates the status of the connection.
+func UpdateConnectionStatus(ctx context.Context, cl client.Client, conn *networkingv1alpha1.Connection,
+	connected bool, latencyValue time.Duration, latencyTimestamp time.Time) error {
+	switch connected {
+	case true:
+		conn.Status.Value = networkingv1alpha1.Connected
+	case false:
+		conn.Status.Value = networkingv1alpha1.Connecting
+	}
+	conn.Status.Latency.Value = liqonetutils.FormatLatency(latencyValue)
+	conn.Status.Latency.Timestamp = metav1.Time{Time: latencyTimestamp}
+	return cl.Status().Update(ctx, conn)
+}
diff --git a/pkg/gateway/tunnel/common/doc.go b/pkg/gateway/tunnel/common/doc.go
new file mode 100644
index 0000000000..8b5f93cd07
--- /dev/null
+++ b/pkg/gateway/tunnel/common/doc.go
@@ -0,0 +1,16 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package common contains the common functions used by the tunneling package.
+package common
diff --git a/pkg/gateway/tunnel/common/netlink.go b/pkg/gateway/tunnel/common/netlink.go
new file mode 100644
index 0000000000..f784928059
--- /dev/null
+++ b/pkg/gateway/tunnel/common/netlink.go
@@ -0,0 +1,32 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package common
+
+import "github.com/vishvananda/netlink"
+
+// AddAddress adds an IP address to the Wireguard interface.
+func AddAddress(link netlink.Link, ip string) error {
+	addr, err := netlink.ParseAddr(ip)
+	if err != nil {
+		return err
+	}
+
+	return netlink.AddrAdd(link, addr)
+}
+
+// GetLink returns the Wireguard interface.
+func GetLink(name string) (netlink.Link, error) {
+	return netlink.LinkByName(name)
+}
diff --git a/pkg/gateway/tunnel/common/options.go b/pkg/gateway/tunnel/common/options.go
new file mode 100644
index 0000000000..1fef1d84ef
--- /dev/null
+++ b/pkg/gateway/tunnel/common/options.go
@@ -0,0 +1,51 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package common
+
+import (
+	"fmt"
+)
+
+// Mode is the mode in which the wireguard interface is configured.
+type Mode string
+
+const (
+	// ModeServer is the mode in which the wireguard interface is configured as a server.
+	ModeServer Mode = "server"
+	// ModeClient is the mode in which the wireguard interface is configured as a client.
+	ModeClient Mode = "client"
+)
+
+// String returns the string representation of the mode.
+func (m Mode) String() string {
+	return string(m)
+}
+
+// Set sets the value of the mode.
+func (m *Mode) Set(value string) error {
+	if value == "" {
+		return fmt.Errorf("mode cannot be empty")
+	}
+	if value != ModeServer.String() && value != ModeClient.String() {
+		return fmt.Errorf("invalid mode %q", value)
+	}
+	*m = Mode(value)
+	return nil
+}
+
+// Type returns the type of the mode.
+func (m *Mode) Type() string {
+	return "string"
+}
diff --git a/pkg/gateway/tunnel/wireguard/device.go b/pkg/gateway/tunnel/wireguard/device.go
new file mode 100644
index 0000000000..fc1c9f9d26
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/device.go
@@ -0,0 +1,58 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import (
+	"net"
+
+	"golang.zx2c4.com/wireguard/wgctrl"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+func configureServerDevice(wgcl *wgctrl.Client, options *Options, peerPubKey wgtypes.Key) error {
+	return wgcl.ConfigureDevice(options.InterfaceName, wgtypes.Config{
+		PrivateKey: &options.PrivateKey,
+		ListenPort: &options.ListenPort,
+		Peers: []wgtypes.PeerConfig{
+			{
+				PublicKey:  peerPubKey,
+				AllowedIPs: []net.IPNet{{IP: net.IP{0, 0, 0, 0}, Mask: net.CIDRMask(0, 32)}},
+			},
+		},
+		ReplacePeers: true,
+	})
+}
+
+// Runs in a goroutine.
+func configureClientDevice(wgcl *wgctrl.Client, options *Options, peerPubKey wgtypes.Key) error {
+	options.EndpointIPMutex.Lock()
+	defer options.EndpointIPMutex.Unlock()
+
+	return wgcl.ConfigureDevice(options.InterfaceName, wgtypes.Config{
+		PrivateKey: &options.PrivateKey,
+		ListenPort: nil,
+		Peers: []wgtypes.PeerConfig{
+			{
+				PublicKey:  peerPubKey,
+				AllowedIPs: []net.IPNet{{IP: net.IP{0, 0, 0, 0}, Mask: net.CIDRMask(0, 32)}},
+				Endpoint: &net.UDPAddr{
+					IP:   options.EndpointIP,
+					Port: options.EndpointPort,
+				},
+			},
+		},
+		ReplacePeers: true,
+	})
+}
diff --git a/pkg/gateway/tunnel/wireguard/dns.go b/pkg/gateway/tunnel/wireguard/dns.go
new file mode 100644
index 0000000000..6b89694b27
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/dns.go
@@ -0,0 +1,130 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+
+	"github.com/liqotech/liqo/pkg/consts"
+	"github.com/liqotech/liqo/pkg/gateway/tunnel/common"
+	"github.com/liqotech/liqo/pkg/utils/getters"
+)
+
+// StartDNSRoutine run a routine which periodically resolves the DNS associated to the wireguard client endpoint.
+// The DNS is resolved every 5 minutes.
+// If the DNS changed a new publickkeys-controller reconcile is triggered through a generic event.
+func StartDNSRoutine(ctx context.Context, ch chan event.GenericEvent, opts *Options) {
+	err := wait.PollUntilContextCancel(ctx, opts.DNSCheckInterval, true, func(ctx context.Context) (done bool, err error) {
+		ips, err := net.LookupIP(opts.EndpointAddress)
+		if err != nil {
+			dnsErr := &net.DNSError{}
+			if !errors.As(err, &dnsErr) {
+				return false, err
+			}
+			switch {
+			case dnsErr.IsNotFound:
+				klog.Warningf("DNS %q not found", opts.EndpointAddress)
+				return false, nil
+			case dnsErr.IsTimeout:
+				klog.Warningf("DNS %q timeout", opts.EndpointAddress)
+				return false, nil
+			default:
+				return false, err
+			}
+		}
+
+		// Checks if the DNS resolution has changed
+		for _, ip := range ips {
+			if opts.EndpointIP.Equal(ip) {
+				return false, nil
+			}
+		}
+
+		klog.Infof("DNS %q resolved to %q: updating endpoint", opts.EndpointAddress, ips[0])
+
+		// Copies the new IPs to store for the next check
+		opts.EndpointIPMutex.Lock()
+		defer opts.EndpointIPMutex.Unlock()
+		opts.EndpointIP = ips[0]
+
+		// Triggers a new reconcile
+		ch <- event.GenericEvent{}
+		return false, nil
+	})
+	if err != nil {
+		klog.Error(err)
+		os.Exit(1)
+	}
+}
+
+// IsDNSRoutineRequired checks if the client endpoint is a DNS.
+// If it is a DNS the DNS routine is required.
+func IsDNSRoutineRequired(opts *Options) bool {
+	if opts.Mode != common.ModeClient {
+		return false
+	}
+	return net.ParseIP(opts.EndpointAddress) == nil
+}
+
+// WatcherDNS is a structure containing Source and EventHandler
+// for controller-manager WatchesRawSources function.
+type WatcherDNS struct {
+	Source       source.Channel
+	EventHandler handler.EventHandler
+}
+
+// NewWatcherDNS creates a new WatcherDNS.
+func NewWatcherDNS(src <-chan event.GenericEvent, cl client.Client, opts *Options) *WatcherDNS {
+	return &WatcherDNS{
+		Source: source.Channel{
+			Source: src,
+		},
+		EventHandler: handler.EnqueueRequestsFromMapFunc(
+			func(ctx context.Context, _ client.Object) []reconcile.Request {
+				labelSet := labels.Set{
+					string(LabelsMode):             string(opts.Mode),
+					string(consts.RemoteClusterID): opts.RemoteClusterID,
+				}
+				list, err := getters.ListPublicKeysByLabel(ctx, cl, opts.Namespace, labels.SelectorFromSet(labelSet))
+				if err != nil {
+					klog.Error(err)
+				}
+				if len(list.Items) == 0 {
+					klog.Errorf("There are no public keys with label %s", labelSet)
+					return nil
+				}
+				if len(list.Items) != 1 {
+					klog.Errorf("There are %d public keys with label %s", len(list.Items), labelSet)
+					return nil
+				}
+				return []reconcile.Request{
+					{NamespacedName: types.NamespacedName{Name: list.Items[0].Name, Namespace: list.Items[0].Namespace}},
+				}
+			}),
+	}
+}
diff --git a/pkg/gateway/tunnel/wireguard/doc.go b/pkg/gateway/tunnel/wireguard/doc.go
new file mode 100644
index 0000000000..81baec8e31
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/doc.go
@@ -0,0 +1,16 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package wireguard contains the implementation of the wireguard tunnel.
+package wireguard
diff --git a/pkg/gateway/tunnel/wireguard/flags.go b/pkg/gateway/tunnel/wireguard/flags.go
new file mode 100644
index 0000000000..cc52f54330
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/flags.go
@@ -0,0 +1,133 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import (
+	"time"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+
+	"github.com/liqotech/liqo/pkg/gateway/tunnel/common"
+)
+
+// FlagName is the type for the name of the flags.
+type FlagName string
+
+func (fn FlagName) String() string {
+	return string(fn)
+}
+
+const (
+	// FlagNameName is the name of the WgGateway resource.
+	FlagNameName FlagName = "name"
+	// FlagNameNamespace is the namespace WgGateway resource.
+	FlagNameNamespace FlagName = "namespace"
+	// FlagNameRemoteClusterID is the clusterID of the remote cluster.
+	FlagNameRemoteClusterID FlagName = "remote-cluster-id"
+	// FlagNameWireguardGatewayUID is the UID of the wireguard gateway.
+	FlagNameWireguardGatewayUID FlagName = "gateway-uid"
+
+	// FlagNameMode is the mode in which the wireguard interface is configured.
+	FlagNameMode FlagName = "mode"
+	// FlagNameMTU is the MTU for the wireguard interface.
+	FlagNameMTU FlagName = "mtu"
+	// FlagNameListenPort is the listen port for the wireguard interface.
+	FlagNameListenPort FlagName = "listen-port"
+	// FlagNameInterfaceName is the name of the wireguard interface.
+	FlagNameInterfaceName FlagName = "interface-name"
+	// FlagNameInterfaceIP is the IP of the wireguard interface.
+	FlagNameInterfaceIP FlagName = "interface-ip"
+	// FlagNameEndpointAddress is the address of the endpoint for the wireguard interface.
+	FlagNameEndpointAddress FlagName = "endpoint-address"
+	// FlagNameEndpointPort is the port of the endpoint for the wireguard interface.
+	FlagNameEndpointPort FlagName = "endpoint-port"
+
+	// FlagNameDNSCheckInterval is the interval between two DNS checks.
+	FlagNameDNSCheckInterval FlagName = "dns-check-interval"
+
+	// FlagNameLeaderElection is the flag to enable leader election.
+	FlagNameLeaderElection FlagName = "leader-election"
+	// FlagNameLeaderElectionLeaseDuration is the lease duration for the leader election.
+	FlagNameLeaderElectionLeaseDuration FlagName = "leader-election-lease-duration"
+	// FlagNameLeaderElectionRenewDeadline is the renew deadline for the leader election.
+	FlagNameLeaderElectionRenewDeadline FlagName = "leader-election-renew-deadline"
+	// FlagNameLeaderElectionRetryPeriod is the retry period for the leader election.
+	FlagNameLeaderElectionRetryPeriod FlagName = "leader-election-retry-period"
+
+	// FlagNameMetricsAddress is the address for the metrics endpoint.
+	FlagNameMetricsAddress FlagName = "metrics-address"
+	// FlagNameProbeAddr is the address for the health probe endpoint.
+	FlagNameProbeAddr FlagName = "health-probe-bind-address"
+)
+
+// RequiredFlags contains the list of the mandatory flags.
+var RequiredFlags = []FlagName{
+	FlagNameName,
+	FlagNameNamespace,
+	FlagNameRemoteClusterID,
+	FlagNameWireguardGatewayUID,
+	FlagNameMode,
+}
+
+// ClientRequiredFlags contains the list of the mandatory flags for the client mode.
+var ClientRequiredFlags = []FlagName{
+	FlagNameEndpointAddress,
+}
+
+// InitFlags initializes the flags for the wireguard tunnel.
+func InitFlags(flagset *pflag.FlagSet, opts *Options) {
+	flagset.StringVar(&opts.Name, FlagNameName.String(), "", "Name for the wireguard interface")
+	flagset.StringVar(&opts.Namespace, FlagNameNamespace.String(), "", "Namespace for the wireguard interface")
+	flagset.StringVar(&opts.RemoteClusterID, FlagNameRemoteClusterID.String(), "", "ClusterID for the wireguard interface")
+	flagset.StringVar(&opts.WireguardGatewayUID, FlagNameWireguardGatewayUID.String(), "", "WireguardGateway resource UID, used for owner reference")
+
+	flagset.Var(&opts.Mode, FlagNameMode.String(), "Mode for the wireguard interface")
+	flagset.IntVar(&opts.MTU, FlagNameMTU.String(), 1420, "MTU for the wireguard interface")
+	flagset.StringVar(&opts.InterfaceName, FlagNameInterfaceName.String(), "liqo-wg", "Name for the wireguard interface")
+	flagset.IntVar(&opts.ListenPort, FlagNameListenPort.String(), 51820, "Listen port for the wireguard interface (server only)")
+	flagset.StringVar(&opts.EndpointAddress, FlagNameEndpointAddress.String(), "", "Endpoint address for the wireguard peer (client only)")
+	flagset.IntVar(&opts.EndpointPort, FlagNameEndpointPort.String(), 51820, "Endpoint port for the wireguard peer (client only)")
+
+	flagset.DurationVar(&opts.DNSCheckInterval, FlagNameDNSCheckInterval.String(), 5*time.Minute, "Interval between two DNS checks")
+
+	flagset.BoolVar(&opts.LeaderElection, FlagNameLeaderElection.String(), false, "Enable leader election")
+	flagset.DurationVar(&opts.LeaderElectionLeaseDuration, FlagNameLeaderElectionLeaseDuration.String(), 15*time.Second,
+		"LeaseDuration for the leader election")
+	flagset.DurationVar(&opts.LeaderElectionRenewDeadline, FlagNameLeaderElectionRenewDeadline.String(), 10*time.Second,
+		"RenewDeadline for the leader election")
+	flagset.DurationVar(&opts.LeaderElectionRetryPeriod, FlagNameLeaderElectionRetryPeriod.String(), 2*time.Second,
+		"RetryPeriod for the leader election")
+
+	flagset.StringVar(&opts.MetricsAddress, FlagNameMetricsAddress.String(), ":8080", "Address for the metrics endpoint")
+	flagset.StringVar(&opts.ProbeAddr, FlagNameProbeAddr.String(), ":8081", "Address for the health probe endpoint")
+}
+
+// MarkFlagsRequired marks the flags as required.
+func MarkFlagsRequired(cmd *cobra.Command, opts *Options) error {
+	for _, flag := range RequiredFlags {
+		if err := cmd.MarkFlagRequired(flag.String()); err != nil {
+			return err
+		}
+	}
+	if opts.Mode == common.ModeClient {
+		for _, flag := range ClientRequiredFlags {
+			if err := cmd.MarkFlagRequired(flag.String()); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
diff --git a/pkg/gateway/tunnel/wireguard/k8s.go b/pkg/gateway/tunnel/wireguard/k8s.go
new file mode 100644
index 0000000000..296ec1c454
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/k8s.go
@@ -0,0 +1,124 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import (
+	"context"
+	"fmt"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	networkingv1alpha1 "github.com/liqotech/liqo/apis/networking/v1alpha1"
+	"github.com/liqotech/liqo/pkg/consts"
+	"github.com/liqotech/liqo/pkg/gateway/tunnel/common"
+)
+
+// SetOwnerReferenceWithMode sets the owner reference of the object according to the mode.
+func SetOwnerReferenceWithMode(opts *Options, obj metav1.Object, scheme *runtime.Scheme) error {
+	meta := metav1.ObjectMeta{
+		Name:      opts.Name,
+		Namespace: opts.Namespace,
+		UID:       types.UID(opts.WireguardGatewayUID),
+	}
+	switch opts.Mode {
+	case common.ModeServer:
+		return controllerutil.SetOwnerReference(&networkingv1alpha1.GatewayServer{ObjectMeta: meta}, obj, scheme)
+	case common.ModeClient:
+		return controllerutil.SetOwnerReference(&networkingv1alpha1.GatewayClient{ObjectMeta: meta}, obj, scheme)
+	}
+	return fmt.Errorf("invalid mode %v", opts.Mode)
+}
+
+// CheckKeysSecret checks if the keys secret exists and if it contains the private and public keys.
+func CheckKeysSecret(ctx context.Context, cl client.Client, opts *Options) (wgtypes.Key, error) {
+	secret := &corev1.Secret{}
+	if err := cl.Get(ctx, types.NamespacedName{Name: GenerateResourceName(opts.Name), Namespace: opts.Namespace}, secret); err != nil {
+		return wgtypes.Key{}, err
+	}
+	if secret.Data == nil {
+		return wgtypes.Key{}, nil
+	}
+	if k, ok := secret.Data[SecretPrivateKeyField]; !ok || len(k) != wgtypes.KeyLen {
+		return wgtypes.Key{}, nil
+	}
+	if k, ok := secret.Data[SecretPublicKeyField]; !ok || len(k) != wgtypes.KeyLen {
+		return wgtypes.Key{}, nil
+	}
+	return wgtypes.Key(secret.Data[SecretPrivateKeyField]), nil
+}
+
+// CreateKeysSecret creates the private and public keys for the Wireguard interface and save them inside a Secret resource.
+func CreateKeysSecret(ctx context.Context, cl client.Client, opts *Options, pri, pub wgtypes.Key) error {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      GenerateResourceName(opts.Name),
+			Namespace: opts.Namespace,
+		},
+	}
+
+	if _, err := controllerutil.CreateOrUpdate(ctx, cl, secret, func() error {
+		secret.SetLabels(map[string]string{
+			string(consts.RemoteClusterID):      opts.RemoteClusterID,
+			string(consts.GatewayResourceLabel): string(consts.GatewayResourceLabelValue),
+		})
+		// TODO: uncomment this line when the owner reference will exist.
+		if err := SetOwnerReferenceWithMode(opts, secret, cl.Scheme()); err != nil {
+			return err
+		}
+		secret.Data = map[string][]byte{
+			SecretPrivateKeyField: pri[:],
+			SecretPublicKeyField:  pub[:],
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// EnsureConnection creates or updates the connection resource.
+func EnsureConnection(ctx context.Context, cl client.Client, scheme *runtime.Scheme, opts *Options) error {
+	conn := &networkingv1alpha1.Connection{ObjectMeta: metav1.ObjectMeta{
+		Name: GenerateResourceName(opts.Name), Namespace: opts.Namespace,
+	}}
+	_, err := controllerutil.CreateOrUpdate(ctx, cl, conn, func() error {
+		// TODO: set the connection
+		if err := SetOwnerReferenceWithMode(opts, conn, scheme); err != nil {
+			return err
+		}
+		conn.Spec.GatewayRef.APIVersion = networkingv1alpha1.GroupVersion.String()
+		conn.Spec.GatewayRef.Name = opts.Name
+		conn.Spec.GatewayRef.Namespace = opts.Namespace
+		conn.Spec.GatewayRef.UID = types.UID(opts.WireguardGatewayUID)
+		switch opts.Mode {
+		case common.ModeServer:
+			conn.Spec.Type = networkingv1alpha1.ConnectionTypeServer
+			conn.Spec.GatewayRef.Kind = networkingv1alpha1.WgGatewayServerKind
+		case common.ModeClient:
+			conn.Spec.Type = networkingv1alpha1.ConnectionTypeClient
+			conn.Spec.GatewayRef.Kind = networkingv1alpha1.WgGatewayClientKind
+		}
+		return nil
+	})
+
+	return err
+}
diff --git a/pkg/gateway/tunnel/wireguard/keys.go b/pkg/gateway/tunnel/wireguard/keys.go
new file mode 100644
index 0000000000..7f1ecb7465
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/keys.go
@@ -0,0 +1,58 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import (
+	"context"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// cluster-role
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;create;delete;update
+
+const (
+	// SecretPrivateKeyField is the name of the field inside the Secret resource that contains the private key.
+	SecretPrivateKeyField = "private-key"
+	// SecretPublicKeyField is the name of the field inside the Secret resource that contains the public key.
+	SecretPublicKeyField = "public-key"
+)
+
+// EnsureKeysSecret ensure the presence of the private and public keys for the Wireguard interface and save them inside a Secret resource and Options.
+func EnsureKeysSecret(ctx context.Context, cl client.Client, opts *Options) error {
+	var pri, pub wgtypes.Key
+	var err error
+	pri, err = CheckKeysSecret(ctx, cl, opts)
+
+	switch {
+	case kerrors.IsNotFound(err) || len(pri) == 0:
+		pri, err = wgtypes.GeneratePrivateKey()
+		if err != nil {
+			return err
+		}
+		pub = pri.PublicKey()
+		if err := CreateKeysSecret(ctx, cl, opts, pri, pub); err != nil {
+			return err
+		}
+	case err != nil:
+		return err
+	}
+
+	opts.PrivateKey = pri
+
+	return nil
+}
diff --git a/pkg/gateway/tunnel/wireguard/labels.go b/pkg/gateway/tunnel/wireguard/labels.go
new file mode 100644
index 0000000000..dc5b402886
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/labels.go
@@ -0,0 +1,35 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import "github.com/liqotech/liqo/pkg/gateway/tunnel/common"
+
+// Labels is the type used to identify the wireguard labels.
+type Labels string
+
+// LabelsValue is the type used to identify the wireguard labels values.
+type LabelsValue string
+
+const (
+	// LabelsMode is the label used to identify the wireguard mode.
+	LabelsMode Labels = "networking.liqo.io/wireguard-mode"
+)
+
+const (
+	// LabelsModeServer is the label used to identify the wireguard mode server.
+	LabelsModeServer LabelsValue = LabelsValue(common.ModeServer)
+	// LabelsModeClient is the label used to identify the wireguard mode client.
+	LabelsModeClient LabelsValue = LabelsValue(common.ModeClient)
+)
diff --git a/pkg/gateway/tunnel/wireguard/netlink.go b/pkg/gateway/tunnel/wireguard/netlink.go
new file mode 100644
index 0000000000..b4070987f4
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/netlink.go
@@ -0,0 +1,91 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import (
+	"github.com/vishvananda/netlink"
+	"golang.zx2c4.com/wireguard/wgctrl"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	"k8s.io/klog/v2"
+
+	"github.com/liqotech/liqo/pkg/gateway/tunnel/common"
+)
+
+const (
+	// ServerInterfaceIP is the IP address of the Wireguard interface in server mode.
+	ServerInterfaceIP = "169.254.0.1/30"
+	// ClientInterfaceIP is the IP address of the Wireguard interface in client mode.
+	ClientInterfaceIP = "169.254.0.2/30"
+)
+
+// InitWireguardLink inits the Wireguard interface.
+func InitWireguardLink(options *Options) error {
+	if err := createLink(options); err != nil {
+		return err
+	}
+
+	link, err := common.GetLink(options.InterfaceName)
+	if err != nil {
+		return err
+	}
+
+	klog.Infof("Setting up Wireguard interface %q with IP %q", options.InterfaceName, GetInterfaceIP(options.Mode))
+	if err := common.AddAddress(link, GetInterfaceIP(options.Mode)); err != nil {
+		return err
+	}
+
+	return netlink.LinkSetUp(link)
+}
+
+// GetInterfaceIP returns the IP address of the Wireguard interface.
+func GetInterfaceIP(mode common.Mode) string {
+	switch mode {
+	case common.ModeServer:
+		return ServerInterfaceIP
+	case common.ModeClient:
+		return ClientInterfaceIP
+	}
+	return ""
+}
+
+// CreateLink creates a new Wireguard interface.
+func createLink(options *Options) error {
+	link := netlink.Wireguard{
+		LinkAttrs: netlink.LinkAttrs{
+			MTU:  options.MTU,
+			Name: options.InterfaceName,
+		},
+	}
+
+	err := netlink.LinkAdd(&link)
+	if err != nil {
+		return err
+	}
+
+	if options.Mode == common.ModeServer {
+		wgcl, err := wgctrl.New()
+		if err != nil {
+			return err
+		}
+		defer wgcl.Close()
+
+		if err := wgcl.ConfigureDevice(options.InterfaceName, wgtypes.Config{
+			ListenPort: &options.ListenPort,
+		}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/pkg/gateway/tunnel/wireguard/options.go b/pkg/gateway/tunnel/wireguard/options.go
new file mode 100644
index 0000000000..ce0a695ee0
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/options.go
@@ -0,0 +1,68 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import (
+	"net"
+	"sync"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/liqotech/liqo/pkg/gateway/tunnel/common"
+)
+
+// Options contains the options for the wireguard interface.
+type Options struct {
+	Name                string
+	Namespace           string
+	RemoteClusterID     string
+	WireguardGatewayUID string
+
+	Mode            common.Mode
+	MTU             int
+	PrivateKey      wgtypes.Key
+	InterfaceName   string
+	InterfaceIP     string
+	ListenPort      int
+	EndpointAddress string
+	EndpointPort    int
+
+	EndpointIP      net.IP
+	EndpointIPMutex *sync.Mutex
+
+	DNSCheckInterval time.Duration
+
+	LeaderElection              bool
+	LeaderElectionLeaseDuration time.Duration
+	LeaderElectionRenewDeadline time.Duration
+	LeaderElectionRetryPeriod   time.Duration
+
+	MetricsAddress string
+	ProbeAddr      string
+}
+
+// NewOptions returns a new Options struct.
+func NewOptions() *Options {
+	return &Options{
+		EndpointIPMutex: &sync.Mutex{},
+	}
+}
+
+// GenerateResourceName generates the name used for the resources created by the gateway.
+// This will help if a suffix will be added to the name of the resources in future.
+func GenerateResourceName(name string) string {
+	return name
+}
diff --git a/pkg/gateway/tunnel/wireguard/publickeys-controller.go b/pkg/gateway/tunnel/wireguard/publickeys-controller.go
new file mode 100644
index 0000000000..31150d68b6
--- /dev/null
+++ b/pkg/gateway/tunnel/wireguard/publickeys-controller.go
@@ -0,0 +1,117 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wireguard
+
+import (
+	"context"
+	"fmt"
+
+	"golang.zx2c4.com/wireguard/wgctrl"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/klog/v2"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+
+	networkingv1alpha1 "github.com/liqotech/liqo/apis/networking/v1alpha1"
+	"github.com/liqotech/liqo/pkg/consts"
+	"github.com/liqotech/liqo/pkg/gateway/tunnel/common"
+)
+
+// cluster-role
+// +kubebuilder:rbac:groups=networking.liqo.io,resources=publickeys,verbs=get;list;create;delete;update
+
+// PublicKeysReconciler updates the PublicKey resource used to establish the Wireguard connection.
+type PublicKeysReconciler struct {
+	Wgcl           *wgctrl.Client
+	Client         client.Client
+	Scheme         *runtime.Scheme
+	EventsRecorder record.EventRecorder
+	Options        *Options
+}
+
+// NewPublicKeysReconciler returns a new PublicKeysReconciler.
+func NewPublicKeysReconciler(cl client.Client, s *runtime.Scheme, er record.EventRecorder, options *Options) (*PublicKeysReconciler, error) {
+	wgcl, err := wgctrl.New()
+	if err != nil {
+		return nil, fmt.Errorf("unable to create wireguard client: %w", err)
+	}
+	return &PublicKeysReconciler{
+		Wgcl:           wgcl,
+		Client:         cl,
+		Scheme:         s,
+		EventsRecorder: er,
+		Options:        options,
+	}, nil
+}
+
+// Reconcile manage PublicKey resources.
+func (r *PublicKeysReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	publicKey := &networkingv1alpha1.PublicKey{}
+	if err := r.Client.Get(ctx, req.NamespacedName, publicKey); err != nil {
+		if apierrors.IsNotFound(err) {
+			klog.Infof("There is no publicKey %s", req.String())
+			return ctrl.Result{}, nil
+		}
+		return ctrl.Result{}, fmt.Errorf("unable to get the publicKey %q: %w", req.NamespacedName, err)
+	}
+
+	switch r.Options.Mode {
+	case common.ModeServer:
+		if err := configureServerDevice(r.Wgcl, r.Options, wgtypes.Key(publicKey.Spec.PublicKey)); err != nil {
+			return ctrl.Result{}, err
+		}
+	case common.ModeClient:
+		if err := configureClientDevice(r.Wgcl, r.Options, wgtypes.Key(publicKey.Spec.PublicKey)); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
+	return ctrl.Result{}, EnsureConnection(ctx, r.Client, r.Scheme, r.Options)
+}
+
+// SetupWithManager register the ConfigurationReconciler to the manager.
+func (r *PublicKeysReconciler) SetupWithManager(mgr ctrl.Manager, src <-chan event.GenericEvent) error {
+	watcherDNS := NewWatcherDNS(src, r.Client, r.Options)
+
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&networkingv1alpha1.PublicKey{}, r.Predicates()).
+		WatchesRawSource(&watcherDNS.Source, watcherDNS.EventHandler).
+		Complete(r)
+}
+
+// Predicates returns the predicates required for the PublicKey controller.
+func (r *PublicKeysReconciler) Predicates() builder.Predicates {
+	return builder.WithPredicates(
+		predicate.NewPredicateFuncs(func(object client.Object) bool {
+			mode, ok := object.GetLabels()[string(LabelsMode)]
+			if !ok {
+				return false
+			}
+			if mode != string(r.Options.Mode) {
+				return false
+			}
+			id, ok := object.GetLabels()[string(consts.RemoteClusterID)]
+			if !ok {
+				return false
+			}
+			return id == r.Options.RemoteClusterID
+		}))
+}
diff --git a/pkg/utils/flags/doc.go b/pkg/utils/flags/doc.go
new file mode 100644
index 0000000000..62348375ba
--- /dev/null
+++ b/pkg/utils/flags/doc.go
@@ -0,0 +1,16 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package flags provides a set of utilities to manage flags.
+package flags
diff --git a/pkg/utils/flags/flags.go b/pkg/utils/flags/flags.go
new file mode 100644
index 0000000000..18a5e3c7da
--- /dev/null
+++ b/pkg/utils/flags/flags.go
@@ -0,0 +1,28 @@
+// Copyright 2019-2023 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package flags
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+)
+
+// FromFlagToPflag copies the flags from a flag.FlagSet to a pflag.FlagSet.
+func FromFlagToPflag(flags *flag.FlagSet, pflags *pflag.FlagSet) {
+	flags.VisitAll(func(f *flag.Flag) {
+		pflags.AddGoFlag(f)
+	})
+}
diff --git a/pkg/utils/getters/k8sGetters.go b/pkg/utils/getters/k8sGetters.go
index e444395285..d628e0ffdd 100644
--- a/pkg/utils/getters/k8sGetters.go
+++ b/pkg/utils/getters/k8sGetters.go
@@ -29,6 +29,7 @@ import (
 	discoveryv1alpha1 "github.com/liqotech/liqo/apis/discovery/v1alpha1"
 	ipamv1alpha1 "github.com/liqotech/liqo/apis/ipam/v1alpha1"
 	netv1alpha1 "github.com/liqotech/liqo/apis/net/v1alpha1"
+	networkingv1alpha1 "github.com/liqotech/liqo/apis/networking/v1alpha1"
 	offloadingv1alpha1 "github.com/liqotech/liqo/apis/offloading/v1alpha1"
 	sharingv1alpha1 "github.com/liqotech/liqo/apis/sharing/v1alpha1"
 	virtualkubeletv1alpha1 "github.com/liqotech/liqo/apis/virtualkubelet/v1alpha1"
@@ -336,3 +337,13 @@ func ListNetworkByLabel(ctx context.Context, cl client.Client, ns string, lSelec
 	}
 	return list, err
 }
+
+// ListPublicKeysByLabel returns the PublicKey resource with the given labels.
+func ListPublicKeysByLabel(ctx context.Context, cl client.Client, ns string, lSelector labels.Selector) (*networkingv1alpha1.PublicKeyList, error) {
+	list := &networkingv1alpha1.PublicKeyList{}
+	err := cl.List(ctx, list, &client.ListOptions{LabelSelector: lSelector}, client.InNamespace(ns))
+	if err != nil {
+		return nil, err
+	}
+	return list, err
+}