4 top-level fields, 1 required · last changed in Cilium 1.20.0
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
DestinationCIDRs is a list of destination CIDRs for destination IP addresses. If a destination IP matches any one CIDR, it will be selected.
EgressGateway is the gateway node responsible for SNATing traffic. In case multiple nodes are a match for the given set of labels, the first node in lexical ordering based on their name will be selected.
EgressIP is the source IP address that the egress traffic is SNATed with. Example: When set to "192.168.1.100", matching egress traffic will be redirected to the node matching the NodeSelector field and SNATed with IP address 192.168.1.100. When set to "2001:db8::1", matching egress traffic will be redirected to the node matching the NodeSelector field and SNATed with IPv6 address 2001:db8::1. When none of the Interface or EgressIP fields is specified, the policy will use the first IPv4 assigned to the interface with the default route.
Interface is the network interface to which the egress IP address that the traffic is SNATed with is assigned. Example: When set to "eth1", matching egress traffic will be redirected to the node matching the NodeSelector field and SNATed with the first IPv4 address assigned to the eth1 interface. When none of the Interface or EgressIP fields is specified, the policy will use the first IPv4 assigned to the interface with the default route.
This is a label selector which selects the node that should act as egress gateway for the given policy. In case multiple nodes are selected, only the first one in the lexical ordering over the node names will be used. This field follows standard label selector semantics.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Optional list of gateway nodes responsible for SNATing traffic. If this field has any entries the contents of the egressGateway field will be ignored. In case multiple nodes are a match for the given set of labels in each entry, the first node in lexical ordering based on their name will be selected for each entry.
EgressIP is the source IP address that the egress traffic is SNATed with. Example: When set to "192.168.1.100", matching egress traffic will be redirected to the node matching the NodeSelector field and SNATed with IP address 192.168.1.100. When set to "2001:db8::1", matching egress traffic will be redirected to the node matching the NodeSelector field and SNATed with IPv6 address 2001:db8::1. When none of the Interface or EgressIP fields is specified, the policy will use the first IPv4 assigned to the interface with the default route.
Interface is the network interface to which the egress IP address that the traffic is SNATed with is assigned. Example: When set to "eth1", matching egress traffic will be redirected to the node matching the NodeSelector field and SNATed with the first IPv4 address assigned to the eth1 interface. When none of the Interface or EgressIP fields is specified, the policy will use the first IPv4 assigned to the interface with the default route.
This is a label selector which selects the node that should act as egress gateway for the given policy. In case multiple nodes are selected, only the first one in the lexical ordering over the node names will be used. This field follows standard label selector semantics.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ExcludedCIDRs is a list of destination CIDRs that will be excluded from the egress gateway redirection and SNAT logic. Should be a subset of destinationCIDRs otherwise it will not have any effect.
Egress represents a list of rules by which egress traffic is filtered from the source pods.
Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
This is a label selector which selects Pods by Node. This field follows standard label selector semantics; if present but empty, it selects all nodes.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Source: ciliumegressgatewaypolicies.yaml
Changes to CiliumEgressGatewayPolicy (cilium.io/v2) in each Cilium version, compared to the version before it.
2 properties have changed the description
Released · View CiliumEgressGatewayPolicy in 1.20.0
1 property has been added
1 property has changed the description
Released · View CiliumEgressGatewayPolicy in 1.18.0
1 property has been added
19 properties have changed the description
Released · View CiliumEgressGatewayPolicy in 1.17.0
1 property has been added
Released · View CiliumEgressGatewayPolicy in 1.14.0
CiliumEgressGatewayPolicy was first seen on this version of Cilium
Released · View CiliumEgressGatewayPolicy in 1.12.0
No examples of CiliumEgressGatewayPolicy yet. Contribute one on GitHub.
kubespec.dev