To Support Configurable Default SNAT Behavior for Antrea Egress #6988
Labels
area/transit/egress
Issues or PRs related to Egress (SNAT for traffic egressing the cluster).
kind/design
Categorizes issue or PR as related to design.
Milestone
Describe what you are trying to solve
As discussed in #6228 and #6831
The following considerations should be addressed
1.Configurable Default in Antrea Config: Allowing cluster admins to define a default SNAT behavior at the cluster level.
2.Per-Egress Override: Providing a field in the Egress resource to override the default behavior on a per-Egress basis
3.Policy Enforcement: If admins want to enforce a strict SNAT behavior and prevent deviations, they can use an OPA policy to restrict modifications by application owners.
Describe the solution you have in mind
1.Provide an option for allowing default SNAT behavior
antrea-agent.conf: |
egress:
defaultSNATMode: "Enabled" # Possible values: "Enabled", "Disabled"
2.Provide an option to override per egress basis applicable for static as well as Egress HA
Ex - static egress
apiVersion: crd.antrea.io/v1beta1
kind: Egress
metadata:
name: egress-staging
spec:
egressIP: 192.168.1.100
appliedTo:
podSelector:
matchLabels:
app: web
snatMode: "Enabled" # Possible values: "Enabled", "Disabled" (Optional field)
Describe how your solution impacts user flows
Describe the main design/architecture of your solution
Alternative solutions that you considered
Test plan
Additional context
The text was updated successfully, but these errors were encountered: