EgressGateway

Overview

Persona

• Application developer

• Tenant administrator

Function

Declares an egress gateway for a CNE instance, binding a GatewayClass resource, referencing infrastructure configuration in a GatewaySettings resource, and selecting which pods egress through this gateway.

This resource defines how application pods in the selected namespaces send outbound traffic through a specific egress gateway. Key characteristics:

• Supports egress through both VLAN and VXLAN encapsulation.

• Supports multi-tenancy. Deploy one egress gateway for each tenant.

• Creates IPv4 and IPv6 wildcard virtual servers when it has resolved dependencies, matching running pods, and active Traffic Management Microkernel (TMM) devices. When you use Calico with SNAT, the VXLAN IP addresses are the source addresses.

• Doesn’t include DNS46, NAT46, or DNS virtual server functionality.

Note

VLAN versus VXLAN is a cluster-wide setting, not configurable for each egress gateway. The mode comes from the singleton Infra resource (spec.egressDefaults) and applies to all egress gateways. To change the encapsulation mode, update the Infra resource.

Names

Singular name	Plural name	Short name
egressgateway	egressgateways	egw

API group and version

gateway.k8s.f5.com/v1alpha1

Scope

Namespace

Specification

spec

Field	Required	Default	Description
gatewayClassName string	Yes	—	References the GatewayClass resource that binds this egress gateway to the CNE controller and determines which controller processes this resource. Must be 1 to 253 characters. This field is immutable after creation.
infrastructure object	Yes	—	Infrastructure-level configuration for the egress gateway.
sourceSelector object	Yes	—	Defines which pods are selected for egress through this gateway.

spec.infrastructure

Field	Required	Default	Description
parametersRef object	Yes	—	References a GatewaySettings resource in the same namespace that provides infrastructure configuration, such as SNAT pools and network configuration.

spec.infrastructure.parametersRef

Field	Required	Default	Description
name string	Yes	—	Name of the GatewaySettings resource. Must be 1 to 253 characters.
sectionName string	Yes	—	References a specific section within the GatewaySettings resource, for example egressConfig. Identifies which egress configuration block to use for this egress gateway. Must be 1 to 253 characters.

spec.sourceSelector

Field	Required	Default	Description
selectionMode string	Yes	—	How source pods are selected for egress through this gateway. Accepted values: NamespaceSelector, PodSelector, Combined. See the selectionMode behavior table below.
namespaces object	No	—	Namespace selection criteria. Required when selectionMode is NamespaceSelector or Combined.
pods object	No	—	Pod selection criteria within the selected namespaces. Required when selectionMode is PodSelector or Combined.

spec.sourceSelector.selectionMode behavior

Mode	Behavior	Required fields
NamespaceSelector	Selects all pods in the specified namespaces.	namespaces
PodSelector	Selects specific pods matched by pod selectors, across all namespaces.	pods
Combined	Selects pods that satisfy both the namespace and pod selection criteria (intersection).	namespaces and pods

spec.sourceSelector.namespaces

Specify at least one of matchLabels or matchNames. When you specify both, the result is the intersection of all matched namespaces.

Field	Required	Default	Description
matchLabels object	No	—	Selects namespaces by label key-value pairs.
matchNames array	No	—	Selects namespaces by explicit name. Each name is 1 to 253 characters. Must contain at least one item.

spec.sourceSelector.pods

Specify at least one of matchLabels or matchExpressions. When you specify both, the result is the intersection (pods must satisfy both).

Field	Required	Default	Description
matchLabels object	No	—	Selects pods by label key-value pairs.
matchExpressions array	No	—	Selects pods by set-based label expressions.

spec.sourceSelector.pods.matchExpressions[]

Field	Required	Default	Description
key string	Yes	—	Label key that the selector applies to. Must be at least one character.
operator string	Yes	—	The key’s relationship to a set of values. Accepted values: In, NotIn, Exists, DoesNotExist. In and NotIn require a non-empty values array. Exists and DoesNotExist require an empty values array.
values array	No	—	Array of string values.

Example manifest

The following manifest creates an egress gateway that uses Combined selection to egress the production pods labeled app: web-app and version: v1 in the my-tenant-ns namespace.

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: EgressGateway
metadata:
  name: bnk-egress
  namespace: f5-gateways
spec:
  gatewayClassName: f5-bnk-gateways
  infrastructure:
    parametersRef:
      name: my-gateway-settings
      sectionName: default-egress
  sourceSelector:
    selectionMode: Combined
    namespaces:
      matchLabels:
        tier: production
      matchNames:
        - my-tenant-ns
    pods:
      matchLabels:
        app: web-app
        version: v1