DataPlane v2 cilium set static egress IP address for namespace

[AdamKrawczyk]

Hello,

I would like to set a static ip address to some egress traffic coming out from one namespace in GKE standard cluster on DataPlane v2 to some third party managed service(outside cluster).

It's possible to do this? There are no problem with OSS Cilium distribution. 

GKE 1.28

Cilium  1.13.10 (v1.13.10-dfa87aee5d)

[garisingh · Accepted solution]

GKE DPv2 does not support Cilium Egress Gateway (which is what I assume you are referencing above).  We have a feature on the backlog to implement analogous functionality, but we don't yet have a committed plan / date for it.

In the meantime, your best option would be to use Cloud NAT and possibly combine it with Network Policy.   Assuming you only want pods in a specific namespace to be able to access the 3rd party service, you can of course use NetworkPolicy to only allow egress to that service from a specific namespace.
You can then set up a Cloud NAT gateway with 1 or more static IPs and if you want to limit that gateway to only egress to the service, you can use Cloud NAT rules to limit where that gateway can connect to. 

If you have paid support or an account team, you can have them file a feature request on your behalf.   If you don't and/or want to create a public issue, you can enter a request in our public tracker.

[AdamKrawczyk]

Hey,

thanks for your reply.

That's how it went. I read about CloudNat and thought it only applied to Calico-based clusters. I will be testing today. I'll come back to let you know if it worked.

Thank you!