Egress Gateway

Overview #

The Egress Gateway page lists Cilium Egress Gateway Policies in the cluster. A Cilium Egress Gateway Policy defines how selected pods route outbound traffic through a predictable source IP address or network interface. Because pod IPs change frequently, this resource is useful when external systems must see traffic from a known source address.

On the Egress Gateway page you can create, edit, delete or view previously created Egress Gateways.

Creating Egress Gateway #

To add a new resource, click + Add Egress Gateway.

On the page that opens, fill in the information:

• Name Egress Gateway.
• IP address - used for SNAT (network address translation) traffic. You cannot specify an IP address and a network interface at the same time.
• Interface - instead of an IP address, you can specify the network interface that will be used for outgoing traffic, for example eth1.
• List of target CIDRs (destinationCIDRs) - destinations where traffic will be sent from the pods. The default is 0.0.0.0/0.
• List of excluded CIDRs (excludedCIDRs) - you can specify one or more excluded CIDRs.
• Namespace — select a namespace to define pods for outgoing traffic. After selecting a namespace, a list of potential pods will be displayed in the List of Pods table. If necessary, click + Add namespace for pods from different namespaces. This may be required when the application is deployed in several instances in several namespaces of the same cluster and it is necessary to assign a single IP address for outgoing traffic to them.
• Pod selector - if necessary, specify matching labels to identify potential pods of the selected namespace.

Note: Please note: The label selector works on the AND logic (all labels must match). The selected object must have all of the specified labels.

To define a cluster Worker node as a gateway node, set one or more conditions in the Node selector section:

• Labels — press + and specify the label key, if needed.
• Matching expressions - press +, select a key and operator:
  • In — nodes with a matching key and the specified value will be selected;
  • NotIn—nodes with a matching key and the specified value are not selected;
  • Exists—nodes with a matching key will be selected; no value needs to be specified;
  • DoesNotExist—nodes with a matching key are not selected, the value does not need to be specified.

If multiple Worker nodes match a given set of conditions, the first node in lexical order will be used. Click Save to complete the creation of the Egress Gateway.

The created resource will appear in the list on the Egress Gateway page.

Features of setting up Egress Gateway #

• When specifying an IP address, outgoing traffic will exit through the specified IP address from the Worker node.
• When specifying a network interface, traffic passes through this interface of one of the nodes selected in the selector. If the specified interface is not available on the selected host, outgoing traffic will be denied.
• If no Worker nodes are found in the node selector, outgoing traffic will be prohibited.
• If only 1 Worker node is selected in the node selector and it is unavailable, outgoing traffic will be prohibited.
• If you do not directly specify a network interface or IP address, one of the Worker nodes of the cluster will use the first IPv4 assigned to the interface with the default route.

View and change Egress Gateway #

To view, click on the Egress Gateway line in the list.

The view page contains the Egress Gateway and Manifest tabs.

If changes are necessary, Egress Gateway can be updated:

• IP address;
• network interface;
• list of target CIDRs (destinationCIDRs);
• list of excluded CIDRs (excludedCIDRs);
• a list of namespaces whose pod traffic will be sent out in accordance with the Egress Gateway settings.

When you are finished making changes, click Save.

Egress Gateway can also be modified using a YAML manifest. To do this, go to the Manifest tab, edit the manifest and run the verification. The test result will be available on the right side of the screen. Expand the verification result block to see the full manifest. If manifest format validation fails, manifest verification is not available.

Save the changes you made to the manifest. Unsaved data will not be be applied.

To remove Egress Gateway, click the delete action on the object row on the Egress Gateway page, or go to the view page and click Delete on the Egress Gateway or Manifest tab, then confirm the action.