High-availability egress access with consistent source IP addresses for workloads
Systems and methods for configuring an egress node for an egress pod set comprising one or more pods are provided. The egress pod set may be allocated one or more egress internet protocol (IP) addresses. The egress node may be selected among nodes of a cluster including the one or more pods. The egress node may be configured as the routing destination for an egress IP address selected among the one or more egress internet protocol (IP) addresses.
1. A method for configuring an egress node for an egress pod set comprising one or more pods, the method comprising:
selecting a node of a cluster of nodes to act as the egress node for the egress pod set, wherein the egress pod set has a single active egress internet protocol (IP) address, wherein the single egress IP address is outside a classless inter-domain routing (CIDR) block of a subnet of the egress node, and wherein selecting the node comprises selecting the node based on a number of egress pod sets associated with the node; and
configuring a router with a static route to associate the egress node with the single active egress IP address.
2. The method of claim 1 , wherein configuring the router comprises configuring the router via border gateway protocol (BGP).
3. The method of claim 1 , further comprising:
receiving, at the egress node, an encapsulated packet comprising:
an outer header including a destination IP address set as the single egress IP address; and
an inner header including a source IP address set as an IP address of one of the one or more pods;
decapsulating the encapsulated packet to generate a packet with a header that is the inner header; and
translating the source IP address of the header of the packet by setting the source IP address as the single egress IP address.
4. The method of claim 3 , further comprising applying a firewall policy to the packet based on the source IP address.
5. The method of claim 1 , wherein the single active egress address is one of a plurality of egress IP addresses assigned to the egress pod.
6. One or more non-transitory computer readable media comprising instructions that, when executed by one or more processors of a computing system, cause the computing system to perform operations for configuring an egress node for an egress pod set comprising one or more pods, the operations comprising:
selecting a node of a cluster of nodes to act as the egress node for the egress pod set, wherein the egress pod set has a single active egress internet protocol (IP) address, wherein the single egress IP address is outside a classless inter-domain routing (CIDR) block of a subnet of the egress node, and wherein selecting the node comprises selecting the node based on a number of egress pod sets associated with the node; and
configuring a router with a static route to associate the egress node with the single active egress IP address.
7. The one or more non-transitory computer readable media of claim 6 , wherein configuring the router comprises configuring the router via border gateway protocol (BGP).
8. The one or more non-transitory computer readable media of claim 6 , the operations further comprising:
receiving, at the egress node, an encapsulated packet comprising:
an outer header including a destination IP address set as the single egress IP address; and
an inner header including a source IP address set as an IP address of one of the one or more pods;
decapsulating the encapsulated packet to generate a packet with a header that is the inner header; and
translating the source IP address of the header of the packet by setting the source IP address as the single egress IP address.
9. The one or more non-transitory computer readable media of claim 8 , the operations further comprising applying a firewall policy to the packet based on the source IP address.
10. The one or more non-transitory computer readable media of claim 6 , wherein the single active egress address is one of a plurality of egress IP addresses assigned to the egress pod.
11. A computer system, the computer system comprising:
one or more memories; and
one or more processors, the one or more processors being configured to perform operations for configuring an egress node for an egress pod set comprising one or more pods, the operations comprising:
selecting a node of a cluster of nodes to act as the egress node for the egress pod set, wherein the egress pod set has a single active egress internet protocol (IP) address, wherein the single egress IP address is outside a classless inter-domain routing (CIDR) block of a subnet of the egress node, and wherein selecting the node comprises selecting the node based on a number of egress pod sets associated with the node; and
configuring a router with a static route to associate the egress node with the single active egress IP address.
12. The computer system of claim 11 , wherein configuring the router comprises configuring the router via border gateway protocol (BGP).
13. The computer system of claim 11 , the operations further comprising:
receiving, at the egress node, an encapsulated packet comprising:
an outer header including a destination IP address set as the single egress IP address; and
an inner header including a source IP address set as an IP address of one of the one or more pods;
decapsulating the encapsulated packet to generate a packet with a header that is the inner header; and
translating the source IP address of the header of the packet by setting the source IP address as the single egress IP address.
14. The computer system of claim 13 , the operations further comprising applying a firewall policy to the packet based on the source IP address.
15. The computer system of claim 11 , wherein the single active egress address is one of a plurality of egress IP addresses assigned to the egress pod.
16. The method of claim 5 , further comprising:
determining, from the plurality of egress IP addresses assigned to the egress pod, the single active egress IP address as the active egress IP address for the egress pod.
17. The method of claim 16 , wherein the single active IP address is determined based on the CIDR block of the subnet of the egress node.
18. The one or more non-transitory computer readable media of claim 10 , the operations further comprising:
determining, among the plurality of egress IP addresses assigned to the egress pod, the single active egress IP address of the egress pod.
19. The one or more non-transitory computer readable media of claim 18 , wherein the single active IP address is determined based on the CIDR block of the subnet of the egress node.
20. The system of claim 15 , the operations further comprising:
selecting, from the plurality of egress IP addresses assigned to the egress pod, the single active egress IP address as the active egress IP address for the egress pod.