EgressGateway¶

Overview¶

The EgressGateway custom resource defines how application pods in selected namespaces send outbound traffic through a specific egress gateway.

Key characteristics:

Supports egress through both VLAN and VXLAN encapsulation
Supports multi-tenancy — deploy multiple EgressGateway CRs for different tenants
An EgressGateway creates IPv4 and IPv6 wildcard virtual servers when it has resolved dependencies, matching running pods, and active Traffic Management Microkernel (TMM) devices. When Calico with SNAT is used, Vxlan IPs are used as source addresses.
Does not include DNS46, NAT46, or DNS Virtual Server functionality

Scope and persona¶

Scope: Namespaced. Can be deployed in any namespace. The referenced GatewaySettings CR must be in the same namespace.
Persona: Application developer or tenant administrator.

API details¶

Property	Value
API group	`gateway.k8s.f5.com`
API version	`v1alpha1`
Kind	`EgressGateway`
Short name	`egw`
Scope	Namespaced

Spec fields¶

All three top-level fields are required: gatewayClassName, infrastructure, and sourceSelector.

Note

VLAN versus VXLAN is a cluster-wide setting, not configurable per EgressGateway. While EgressGateway supports both VLAN and VXLAN, the chosen mode is derived from the singleton Infra resource (spec.egressDefaults) and applied to all EgressGateways. Individual EgressGateway resources cannot override this selection. To change the encapsulation mode, update the Infra resource.
The gatewayClassName field cannot be modified after the EgressGateway custom resource (CR) is created. If you need to change this value, delete and recreate the EgressGateway CR.

gatewayClassName¶

Field	Type	Required	Description
`gatewayClassName`	string	Yes	References the GatewayClass that binds this EgressGateway to the CNE controller. Determines which controller processes this CR. Length: 1–253 characters. Immutable.

infrastructure¶

Infrastructure-level configuration for the EgressGateway.

parametersRef¶

References a GatewaySettings CR in the same namespace. Namespace scoping prevents cross-tenant reference escalation.

Field	Type	Required	Description
`name`	string	Yes	Name of the GatewaySettings resource. Length: 1–253 characters. Immutable.
`sectionName`	string	Yes	References a specific `egressConfigs[].name` entry in the GatewaySettings resource. Identifies which egress configuration block to use. Length: 1–253 characters. Immutable.

sourceSelector¶

Defines which pods are selected for egress through this gateway.

Field	Type	Required	Description
`selectionMode`	string	Yes	Determines how source pods are selected. Accepted values: `NamespaceSelector`, `PodSelector`, `Combined`.
`namespaces`	object	Conditional	Namespace selection criteria. Required when `selectionMode` is `NamespaceSelector` or `Combined`.
`pods`	object	Conditional	Pod selection criteria. Required when `selectionMode` is `PodSelector` or `Combined`.

selectionMode values¶

Mode	Behavior	Required fields
`NamespaceSelector`	Selects all pods within the specified namespaces.	`namespaces`
`PodSelector`	Selects specific pods matched by pod selectors, across all namespaces.	`pods`
`Combined`	Selects pods that satisfy both namespace and pod selection criteria (intersection).	`namespaces` and `pods`

namespaces¶

Field	Type	Required	Description
`matchLabels`	object (map)	Conditional	Selects namespaces by label key-value pairs.
`matchNames[]`	array of strings	Conditional	Selects namespaces by explicit name. Min 1 item.

At least one of matchLabels or matchNames must be specified. When both are provided, the result is an intersection of all matched namespaces.

pods¶

Field	Type	Required	Description
`matchLabels`	object (map)	Conditional	Selects pods by label key-value pairs.
`matchExpressions[]`	array	Conditional	Selects pods by set-based label expressions.

At least one of matchLabels or matchExpressions must be specified. When both are provided, pods must satisfy both (intersection).

matchExpressions¶

Field	Type	Required	Description
`key`	string	Yes	The label key that the selector applies to.
`operator`	string	Yes	Relationship to the set of values. Accepted values: `In`, `NotIn`, `Exists`, `DoesNotExist`.
`values[]`	array of strings	Conditional	An array of string values. Required and non-empty for `In` and `NotIn`. Must be empty (or omitted) for `Exists` and `DoesNotExist`.

Validation rules¶

Rule	Message
`selectionMode` is `PodSelector` → `pods` must be specified	“pods must be specified when selectionMode is PodSelector”
`selectionMode` is `NamespaceSelector` → `namespaces` must be specified	“namespaces must be specified when selectionMode is NamespaceSelector”
`selectionMode` is `Combined` → both `namespaces` and `pods` must be specified	“both namespaces and pods must be specified when selectionMode is Combined”
`In`/`NotIn` operators → `values` must be non-empty	“In/NotIn operators require non-empty values; Exists/DoesNotExist must have empty values”
`gatewayClassName` is immutable	“gatewayClassName is immutable”

Status fields¶

The controller populates the status section after reconciliation.

Top-level status¶

Field	Type	Description
`observedGeneration`	integer	Most recent `metadata.generation` observed by the controller.
`conditions[]`	array	Conditions describing the current state. Max 8 conditions.

Condition types¶

Type	Description
`Accepted`	The resource is syntactically valid and admitted by the controller.
`Programmed`	The controller has successfully programmed the resource on TMM.
`ResolvedRefs`	All referenced resources (GatewaySettings, etc.) are available and valid.

Known reason values¶

Reason	Description
`Programming`	Reconciliation in progress (happy path).
`Converged`	Fully reconciled (happy path).
`UserError`	Spec is invalid. The controller surfaces the error and does not retry. Alias: `InvalidParameters`.
`DependencyMissing`	A referenced resource does not exist. Create or check the referenced resource.
`InfraTransient`	A transient infrastructure issue occurred.

Printer columns¶

When you run kubectl get egressgateways, the following columns display:

Column	Source
Programmed	`.status.conditions[?(@.type=="Programmed")].status`
Age	`.metadata.creationTimestamp`

Example¶

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: EgressGateway
metadata:
  name: bnk-egress
  namespace: f5-gateways
spec:
  gatewayClassName: f5-bnk-gateways
  infrastructure:
    parametersRef:
      name: my-gateway-settings
      sectionName: default-egress
  sourceSelector:
    selectionMode: Combined
    namespaces:
      matchLabels:
        tier: production
      matchNames:
        - my-tenant-ns
    pods:
      matchLabels:
        app: web-app
        version: v1