This guide shows how to route outbound traffic from pods through a specific Kubernetes node using Cilium’s Egress Gateway functionality. This is useful when you need predictable egress IPs, for example, for firewall allowlists or compliance.
This guide assumes your egress gateway node has a static public IP assigned to the host. On Hetzner, cloud VMs will receive a different public IP after cluster upgrades or node reprovisioning. To avoid this, use bare-metal servers as your egress gateway nodes.
As an added benefit, Hetzner bare-metal machines offer significantly higher network bandwidth: up to 10 Gbit/s dedicated NIC, compared to max 1 Gbit/s on cloud instances.
The label acts as a selector that the Egress Gateway Policy will use to identify which node should handle the outbound traffic. Without this label, the policy wouldn’t know which node is eligible to route egress traffic, and the setup would not function as intended.
For adding a persistent label to the node, add it to the metadata section of your machine deployment in the Cluster resource. This ensures that the label is applied to the node even after a node replacement or upgrade. Example cluster definition:
For more information on node labeling, please refer to the Labelling and assign roles on nodes page.
The Egress Gateway Policy is a Kubernetes resource that defines how outbound traffic should be routed. It specifies the node label to match and the static IP address to use for egress traffic.
Replace the egressIP value with the actual external IP of your egress gateway node. For finding the external IP of your node, you can use the following command:
Sample Egress Gateway Policy YAML:
You can save this YAML to a file named egress-gateway-policy.yaml and apply it using kubectl :
In this example, the policy will route all outbound traffic from pods with the label app: my-app through the node labeled with node-role.kubernetes.io/egress-gateway: "true" . There are additional options available for an Egress Gateway Policy, such as specifying multiple node labels or CIDR ranges. For more details, refer to the Cilium documentation.
To verify that the egress traffic is being routed through the specified node, you can deploy a test pod in the non-egress node and check its outbound IP address:
Save this YAML to a file named test-pod.yaml and apply it using kubectl :
Once the pod is running, you can exec into it and check the outbound IP address. The following command uses ifconfig.me , a simple web service that returns the public IP address of the client making the request:
The output will show the IP address as seen by external services.
If you see the static IP address you specified in the Egress Gateway Policy, it means the setup is working correctly.