Skip to main content
Version: 3.18 (latest)

Egress gateway policy

An EgressGatewayPolicy resource (EgressGatewayPolicy) represents a way to select different egress gateways or skip one for different destinations.

Rules in an Egress EgressGatewayPolicy are checked in Longest Prefix Match(LPM) fashion like routers. As such it is not valid to use the exact destination in two rules.

In order for an EgressGatewayPolicy to be used, its name must be added to a pod or namespace by using egress.projectcalico.org/egressGatewayPolicy annotation.

Sample YAML

apiVersion: projectcalico.org/v3
kind: EgressGatewayPolicy
metadata:
name: my-egwpolicy
spec:
rules:
- destination:
cidr: 10.0.0.0/8
description: "Local: no gateway"
- destination:
cidr: 11.0.0.0/8
description: "Gateway to on prem"
gateway:
namespaceSelector: "projectcalico.org/name == 'default'"
selector: "egress-code == 'blue'"
maxNextHops: 2
- description: "Gateway to internet"
gateway:
namespaceSelector: "projectcalico.org/name == 'default'"
selector: "egress-code == 'red'"
gatewayPreference: PreferNodeLocal

Egress gateway policy definition

Metadata

FieldDescriptionAccepted ValuesSchema
nameUnique name to describe this resource instance. Must be specified.Alphanumeric string with optional ., _, or -.string

Spec

FieldDescriptionAccepted ValuesSchemaDefault
rulesList of egress gateway policiesEgress Gateway Policy Rule

Egress gateway policy rule

FieldDescriptionAccepted ValuesSchemaDefault
descriptionA description of rulestring
destinationCIDR representing a destinationdestination
gatewayegress gateway to be used for a destinationgateway
gatewayPreferenceHints about egress gateway selectionNone for using all available egress gateway replicas from the selected deployment, or PreferNodeLocal to use only egress gateway replicas on the same local node as the client pod or namespace if available, otherwise fall back to the default behaviour.'None'

Destination

FieldDescriptionAccepted ValuesSchemaDefault
cidrCIDR of destination networkstring

Egress gateway

FieldDescriptionAccepted ValuesSchemaDefault
selectorselector to choose an egress gateway deploymentstring
namespaceSelectorname space of egress gateway deploymentstring
maxNextHopsSpecifies the maximum number of egress gateway replicas from the selected deployment that a pod should depend on. Replicas will be chosen in a manner that attempts to balance load across the whole egress gateway replicaset. If unset, or set to "0", egress traffic will behave in the default manner (load balanced over all available gateways).string

Supported operations

Datastore typeCreate/DeleteUpdateGet/ListNotes
Kubernetes API serverYesYesYes