Talos has something about Wireguard, but I never used it in the k8s context