Skip to content

Commit 096a4d1

Browse files
julianwiedmannqmonnet
authored andcommitted
docs: egressgw: clarify egress interface/IP selection
With cilium#38961 we introduced ifindex support for IPv6 policies in v1.18, and for v1.20 we now also added such support for IPv4 policy entries in cilium#45833. Finally also reflect this in the docs. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
1 parent c493c36 commit 096a4d1

1 file changed

Lines changed: 11 additions & 9 deletions

File tree

Documentation/network/egress-gateway/egress-gateway.rst

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -243,8 +243,9 @@ the ``nodeSelector`` field:
243243
If there is no match for the given set of labels, Cilium drops the
244244
traffic that matches the destination CIDR(s).
245245

246-
The IP address that should be used to SNAT traffic must also be configured.
247-
There are 3 different ways this can be achieved:
246+
The policy needs to select the egress network interface on a gateway node,
247+
and the IP addresses that should be used to SNAT traffic. There are 3 different ways
248+
this can be achieved:
248249

249250
1. By specifying the interface:
250251

@@ -259,7 +260,8 @@ There are 3 different ways this can be achieved:
259260
In this case the first IPv4 and IPv6 addresses assigned to the ``ethX`` interface
260261
will be used.
261262

262-
2. By explicitly specifying the egress IP:
263+
2. By explicitly specifying the egress IP. Here the egress network interface is
264+
determined dynamically for each packet, by performing a route lookup in the datapath.
263265

264266
.. code-block:: yaml
265267
@@ -273,9 +275,9 @@ There are 3 different ways this can be achieved:
273275

274276
The egress IP must be assigned to a network device on the node.
275277

276-
3. By omitting both ``egressIP`` and ``interface`` properties, which will make
277-
the agent use the first IPv4 and IPv6 addresses assigned to the interface
278-
for the default route.
278+
3. By omitting both ``egressIP`` and ``interface`` properties. This selects the
279+
network interface with the default route as the egress interface, and the
280+
first IPv4 and IPv6 addresses on this interface as the egress IPs.
279281

280282
.. code-block:: yaml
281283
@@ -285,8 +287,8 @@ There are 3 different ways this can be achieved:
285287
testLabel: testVal
286288
287289
Regardless of which way the egress IP is configured, the user must ensure that
288-
Cilium is running on the device that has the egress IP assigned to it, by
289-
setting the ``--devices`` agent option accordingly.
290+
Cilium is running on the selected network interface, by setting the ``--devices``
291+
agent option accordingly.
290292

291293
.. warning::
292294

@@ -299,7 +301,7 @@ setting the ``--devices`` agent option accordingly.
299301

300302
.. note::
301303

302-
After Cilium has selected the Egress IP for an Egress Gateway policy (or failed to do so), it does not automatically respond to a change in the
304+
After Cilium has selected the network interface and Egress IP for an Egress Gateway policy (or failed to do so), it does not automatically respond to a change in the
303305
gateway node's network configuration (for example if an IP address is added or deleted). You can force a fresh selection by re-applying the
304306
Egress Gateway policy.
305307

0 commit comments

Comments
 (0)