You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
With cilium#38961 we introduced ifindex support for IPv6 policies in v1.18, and
for v1.20 we now also added such support for IPv4 policy entries in cilium#45833.
Finally also reflect this in the docs.
Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
Copy file name to clipboardExpand all lines: Documentation/network/egress-gateway/egress-gateway.rst
+11-9Lines changed: 11 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -243,8 +243,9 @@ the ``nodeSelector`` field:
243
243
If there is no match for the given set of labels, Cilium drops the
244
244
traffic that matches the destination CIDR(s).
245
245
246
-
The IP address that should be used to SNAT traffic must also be configured.
247
-
There are 3 different ways this can be achieved:
246
+
The policy needs to select the egress network interface on a gateway node,
247
+
and the IP addresses that should be used to SNAT traffic. There are 3 different ways
248
+
this can be achieved:
248
249
249
250
1. By specifying the interface:
250
251
@@ -259,7 +260,8 @@ There are 3 different ways this can be achieved:
259
260
In this case the first IPv4 and IPv6 addresses assigned to the ``ethX`` interface
260
261
will be used.
261
262
262
-
2. By explicitly specifying the egress IP:
263
+
2. By explicitly specifying the egress IP. Here the egress network interface is
264
+
determined dynamically for each packet, by performing a route lookup in the datapath.
263
265
264
266
.. code-block:: yaml
265
267
@@ -273,9 +275,9 @@ There are 3 different ways this can be achieved:
273
275
274
276
The egress IP must be assigned to a network device on the node.
275
277
276
-
3. By omitting both ``egressIP`` and ``interface`` properties, which will make
277
-
the agent use the first IPv4 and IPv6 addresses assigned to the interface
278
-
for the default route.
278
+
3. By omitting both ``egressIP`` and ``interface`` properties. This selects the
279
+
network interface with the default route as the egress interface, and the
280
+
first IPv4 and IPv6 addresses on this interface as the egress IPs.
279
281
280
282
.. code-block:: yaml
281
283
@@ -285,8 +287,8 @@ There are 3 different ways this can be achieved:
285
287
testLabel: testVal
286
288
287
289
Regardless of which way the egress IP is configured, the user must ensure that
288
-
Cilium is running on the device that has the egress IP assigned to it, by
289
-
setting the ``--devices`` agent option accordingly.
290
+
Cilium is running on the selected network interface, by setting the ``--devices``
291
+
agent option accordingly.
290
292
291
293
.. warning::
292
294
@@ -299,7 +301,7 @@ setting the ``--devices`` agent option accordingly.
299
301
300
302
.. note::
301
303
302
-
After Cilium has selected the Egress IP for an Egress Gateway policy (or failed to do so), it does not automatically respond to a change in the
304
+
After Cilium has selected the network interface and Egress IP for an Egress Gateway policy (or failed to do so), it does not automatically respond to a change in the
303
305
gateway node's network configuration (for example if an IP address is added or deleted). You can force a fresh selection by re-applying the
0 commit comments