Egress Connectivity Requirements: CCA practice questions

Traffic that leaves a Cilium cluster has to look acceptable to the network outside. Pod IPv4 addresses usually come from private ranges, so by default Cilium masquerades the source of traffic leaving the cluster to the IPv4 address of the node, which the surrounding network can route. The switches enable-ipv4-masquerade and enable-ipv6-masquerade control this per family.

Not every destination should be masqueraded. Cilium leaves traffic to the local node's allocation CIDR alone, and ipv4-native-routing-cidr widens that exclusion when pod addresses are routable across a larger network; in public clouds the VPC range is detected automatically, so pods reach VMs in the same VPC with their own addresses. For finer control the eBPF ip-masq-agent, enabled with ipMasqAgent.enabled, reads a list of nonMasqueradeCIDRs from configuration and falls back to a default list of private and reserved ranges when the file is empty.

Masquerading has two implementations. The eBPF one, enabled with bpf.masquerade=true, is described as the most efficient; it runs on the devices selected for BPF NodePort, handles TCP, UDP and a few ICMP types, and depends on the BPF NodePort feature. The legacy iptables one works on any kernel and masquerades traffic leaving through non-Cilium devices, optionally limited with egress-masquerade-interfaces.

Masquerading to the node address is not enough when an external firewall expects one fixed source. Node IPs change and every node uses its own, so Cilium offers the egress gateway. A cluster-scoped CiliumEgressGatewayPolicy selects source pods with a podSelector, using io.kubernetes.pod.namespace for namespaces, lists destinationCIDRs and optional excludedCIDRs, and names a gateway node through a nodeSelector. The gateway SNATs the matching traffic to an egressIP, the first address of a named interface, or the address of the default-route interface; setting both egressIP and interface makes Cilium ignore the policy. If no node matches the gateway selector, matching traffic is dropped. The feature needs BPF masquerading and the kube-proxy replacement, does not work with Cluster Mesh, and policies apply to new pods only after a short delay.

Egress is also a question of permission and rate. Network policy controls which external destinations are allowed, through the world entity, CIDR rules or toFQDNs with the DNS proxy. The bandwidth manager limits a pod's egress rate from the kubernetes.io/egress-bandwidth annotation, using EDT and eBPF on the native devices, and is off until bandwidthManager.enabled is set.