Red Hat OpenShift Container Platform

Egress router custom resource

You can define the configuration for an egress router pod in an egress router custom resource.

The following YAML describes the fields for the configuration of an egress router in redirect mode:

apiVersion: network.operator.openshift.io/v1
kind: EgressRouter
metadata:
  name: <egress_router_name>
  namespace: <namespace>
spec:
  addresses: [
    {
      ip: "<egress_router>",
      gateway: "<egress_gateway>"
    }
  ]
  mode: Redirect
  redirect: {
    redirectRules: [
      {
        destinationIP: "<egress_destination>",
        port: <egress_router_port>,
        targetPort: <target_port>,
        protocol: <network_protocol>
      },
      ...
    ],
    fallbackIP: "<egress_destination>"
  }

where:

metadata.namespace: Optional parameter. Specifies the namespace for creating the egress router. If you do not specify a value in the file or on the command line, the default namespace is used.
spec.addresses: Specifies the IP addresses to configure on the secondary network interface.
spec.addresses.ip: Specifies the reserve source IP address and netmask from the physical network that the node is on to use with egress router pod. Use CIDR notation to specify the IP address and netmask.
spec.addresses.gateway: Specifies the IP address of the network gateway.
spec.redirect.redirectRules: Optional parameter. Specifies the combinination of egress destination IP address, egress router port, and protocol. Incoming connections to the egress router on the specified port and protocol are routed to the destination IP address.
spec.redirect.redirectRules.targetPort: Optional parameter. Specifies the network port on the destination IP address. If this field is not specified, traffic is routed to the same network port that it arrived on.
spec.redirect.redirectRules.protocol: Specifies the protocols to support, such as TCP, UDP, or SCTP.
spec.redirect.fallbackIP: Optional parameter. Specifies a destination IP address. If you do not specify any redirect rules, the egress router sends all traffic to this fallback IP address. If you specify redirect rules, any connections to network ports that are not defined in the rules are sent by the egress router to this fallback IP address. If you do not specify this field, the egress router rejects connections to network ports that are not defined in the rules.

Example egress router specification

apiVersion: network.operator.openshift.io/v1
kind: EgressRouter
metadata:
  name: egress-router-redirect
spec:
  networkInterface: {
    macvlan: {
      mode: "Bridge"
    }
  }
  addresses: [
    {
      ip: "192.168.12.99/24",
      gateway: "192.168.12.1"
    }
  ]
  mode: Redirect
  redirect: {
    redirectRules: [
      {
        destinationIP: "10.0.0.99",
        port: 80,
        protocol: UDP
      },
      {
        destinationIP: "203.0.113.26",
        port: 8080,
        targetPort: 80,
        protocol: TCP
      },
      {
        destinationIP: "203.0.113.27",
        port: 8443,
        targetPort: 443,
        protocol: TCP
      }
    ]
  }