Egress gateway policy

An EgressGatewayPolicy resource (EgressGatewayPolicy) represents a way to select different egress gateways or skip one for different destinations.

Rules in an Egress EgressGatewayPolicy are checked in Longest Prefix Match(LPM) fashion like routers. As such it is not valid to use the exact destination in two rules.

In order for an EgressGatewayPolicy to be used, its name must be added to a pod or namespace by using egress.projectcalico.org/egressGatewayPolicy annotation.

Sample YAML

apiVersion: projectcalico.org/v3
kind: EgressGatewayPolicy
metadata:
  name: my-egwpolicy
spec:
  rules:
  - destination:
      cidr: 10.0.0.0/8
    description: "Local: no gateway"
  - destination:
      cidr: 11.0.0.0/8
    description: "Gateway to on prem"
    gateway:
      namespaceSelector: "projectcalico.org/name == 'default'"
      selector: "egress-code == 'blue'"
      maxNextHops: 2
  - description: "Gateway to internet"
    gateway:
      namespaceSelector: "projectcalico.org/name == 'default'"
      selector: "egress-code == 'red'"
    gatewayPreference: PreferNodeLocal

Egress gateway policy definition

Metadata

Field	Description	Accepted Values	Schema
name	Unique name to describe this resource instance. Must be specified.	Alphanumeric string with optional ., _, or -.	string

Spec

Field	Description	Accepted Values	Schema	Default
rules	List of egress gateway policies		Egress Gateway Policy Rule

Egress gateway policy rule

Field	Description	Accepted Values	Schema	Default
description	A description of rule		string
destination	CIDR representing a destination		destination
gateway	egress gateway to be used for a destination		gateway
gatewayPreference	Hints about egress gateway selection	None for using all available egress gateway replicas from the selected deployment, or PreferNodeLocal to use only egress gateway replicas on the same local node as the client pod or namespace if available, otherwise fall back to the default behaviour.		'None'

Destination

Field	Description	Accepted Values	Schema	Default
cidr	CIDR of destination network		string

Egress gateway

Field	Description	Accepted Values	Schema	Default
selector	selector to choose an egress gateway deployment		string
namespaceSelector	name space of egress gateway deployment		string
maxNextHops	Specifies the maximum number of egress gateway replicas from the selected deployment that a pod should depend on. Replicas will be chosen in a manner that attempts to balance load across the whole egress gateway replicaset. If unset, or set to "0", egress traffic will behave in the default manner (load balanced over all available gateways).		string

Supported operations

Datastore type	Create/Delete	Update	Get/List	Notes
Kubernetes API server	Yes	Yes	Yes