Red Hat OpenShift Container Platform

EgressIP object

You can view YAML files to better understand how you can effectively configure an EgressIP object to better meet your needs.

When the EgressIP namespace selector matches the label on multiple namespaces, consider the following behaviors:

All traffic for selected pods must pass through a single node. During times of high traffic, the network interface of the node might experience performance issues.
An error in a label selector might change the outbound IP address for many cluster namespaces.
Only a cluster administrator can create or change cluster-scoped objects.
Packets must move from a pod that exists in a node to the named host node that is referenced in the EgressIP object. This approach adds a network hop.

Do not create egress rules, such as a single label selector, that forces all namespaces that exist in a cluster to use the same outbound IP address. This configuration can cause the node that hosts the IP address to crash during times of high network traffic.

The following YAML describes the API for the EgressIP object. The scope of the object is cluster-wide and is not created in a namespace.

apiVersion: k8s.ovn.org/v1
kind: EgressIP
metadata:
  name: <name>
spec:
  egressIPs:
  - <ip_address>
  namespaceSelector:
    ...
  podSelector:
    ...

where:

<name>: Specifies the name for the EgressIPs object.
<egressIPs>: Specifies an array of one or more IP addresses.
<namespaceSelector>: Specifies one or more selectors for the namespaces to associate the egress IP addresses with.
<podSelector>: Optional parameter. Specifies one or more selectors for pods in the specified namespaces to associate egress IP addresses with. Applying these selectors allows for the selection of a subset of pods within a namespace.

The following YAML describes the stanza for the namespace selector:

Namespace selector stanza

namespaceSelector:
  matchLabels:
    <label_name>: <label_value>

where:

<namespaceSelector>: Specifies one or more matching rules for namespaces. If more than one match rule is provided, all matching namespaces are selected.

The following YAML describes the optional stanza for the pod selector:

Pod selector stanza

podSelector:
  matchLabels:
    <label_name>: <label_value>

where:

<podSelector>: Optional parameter. Specifies one or more matching rules for pods in the namespaces that match the specified namespaceSelector rules. If specified, only pods that match are selected. Others pods in the namespace are not selected.

In the following example, the EgressIP object associates the 192.168.126.11 and 192.168.126.102 egress IP addresses with pods that have the app label set to web and are in the namespaces that have the env label set to prod:

Example EgressIP object

apiVersion: k8s.ovn.org/v1
kind: EgressIP
metadata:
  name: egress-group1
spec:
  egressIPs:
  - 192.168.126.11
  - 192.168.126.102
  podSelector:
    matchLabels:
      app: web
  namespaceSelector:
    matchLabels:
      env: prod

In the following example, the EgressIP object associates the 192.168.127.30 and 192.168.127.40 egress IP addresses with any pods that do not have the environment label set to development:

Example EgressIP object

apiVersion: k8s.ovn.org/v1
kind: EgressIP
metadata:
  name: egress-group2
spec:
  egressIPs:
  - 192.168.127.30
  - 192.168.127.40
  namespaceSelector:
    matchExpressions:
    - key: environment
      operator: NotIn
      values:
      - development