Chapter 9. Configuring an egress IP address

By using the OpenShift Container Platform egress IP address functionality, you can ensure that the traffic from one or more pods in one or more namespaces has a consistent source IP address for services outside the cluster network.

For example, you might have a pod that periodically queries a database that is hosted on a server outside of your cluster. To enforce access requirements for the server, a packet filtering device is configured to allow traffic only from specific IP addresses.

To ensure that you can reliably allow access to the server from only that specific pod, you can configure a specific egress IP address for the pod that makes the requests to the server.

An egress IP address assigned to a namespace is different from an egress router, which is used to send traffic to specific destinations.

In some cluster configurations, application pods and ingress router pods run on the same node. If you configure an egress IP address for an application project in this scenario, the IP address is not used when you send a request to a route from the application project.

The following examples illustrate the annotation from nodes on several public cloud providers. The annotations are indented for readability.

cloud.network.openshift.io/egress-ipconfig: [
  {
    "interface":"eni-078d267045138e436",
    "ifaddr":{"ipv4":"10.0.128.0/18"},
    "capacity":{"ipv4":14,"ipv6":15}
  }
]

The following sections describe the IP address capacity for supported public cloud environments for use in your capacity calculation.

The following capacity limits exist for IP aliasing assignment:

For more information, see "Per instance" quotas and "Alias IP ranges overview" in the Additional resources section.

For more information, see "Networking limits" in the Additional resources section.

You can view YAML files to better understand how you can effectively configure an EgressIP object to better meet your needs.

When the EgressIP namespace selector matches the label on multiple namespaces, consider the following behaviors:

The following YAML describes the API for the EgressIP object. The scope of the object is cluster-wide and is not created in a namespace.

apiVersion: k8s.ovn.org/v1
kind: EgressIP
metadata:
  name: <name>
spec:
  egressIPs:
  - <ip_address>
  namespaceSelector:
    ...
  podSelector:
    ...

where:

The following YAML describes the stanza for the namespace selector:

namespaceSelector:
  matchLabels:
    <label_name>: <label_value>

where:

The following YAML describes the optional stanza for the pod selector:

podSelector:
  matchLabels:
    <label_name>: <label_value>

where:

In the following example, the EgressIP object associates the 192.168.126.11 and 192.168.126.102 egress IP addresses with pods that have the app label set to web and are in the namespaces that have the env label set to prod:

apiVersion: k8s.ovn.org/v1
kind: EgressIP
metadata:
  name: egress-group1
spec:
  egressIPs:
  - 192.168.126.11
  - 192.168.126.102
  podSelector:
    matchLabels:
      app: web
  namespaceSelector:
    matchLabels:
      env: prod

In the following example, the EgressIP object associates the 192.168.127.30 and 192.168.127.40 egress IP addresses with any pods that do not have the environment label set to development:

apiVersion: k8s.ovn.org/v1
kind: EgressIP
metadata:
  name: egress-group2
spec:
  egressIPs:
  - 192.168.127.30
  - 192.168.127.40
  namespaceSelector:
    matchExpressions:
    - key: environment
      operator: NotIn
      values:
      - development

To assign one or more egress IPs to a namespace or specific pods in a namespace, you must meet specific conditions.

When creating an EgressIP object, the following conditions apply to nodes that are labeled with the k8s.ovn.org/egress-assignable: "" label:

When a pod matches the selector for multiple EgressIP objects, there is no guarantee which of the egress IP addresses that are specified in the EgressIP objects is assigned as the egress IP address for the pod.

Additionally, if an EgressIP object specifies multiple egress IP addresses, there is no guarantee which of the egress IP addresses might be used. For example, if a pod matches a selector for an EgressIP object with two egress IP addresses, 10.10.20.1 and 10.10.20.2, either might be used for each TCP connection or UDP conversation.

You can assign one or more egress IP addresses to a namespace or to specific pods in a namespace.

The reachabilityTotalTimeoutSeconds parameter controls how quickly the system detects a failing egressIP node and initiates a failover. This parameter directly determines the maximum time the platform waits before declaring a node unreachable.

To ensure traffic uses the correct external path, egressIP traffic on a node will always egress through the network interface on which the egressIP address has been assigned.

You can apply the k8s.ovn.org/egress-assignable="" label to a node in your cluster so that OpenShift Container Platform can assign one or more egress IP addresses to the node.

For a cluster configured for dual-stack networking, you can apply dual-stack networking to a single EgressIP object. The EgressIP object can then extend dual-stack networking capabilities to a pod.