Skip to content

Add note about experimental nature of BGP namespace egress IPs #185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 12, 2025
Merged

Add note about experimental nature of BGP namespace egress IPs #185

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions component/espejote-templates/egress-gateway.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,7 @@ local NamespaceEgressPolicy =
egress_range,
namespace,
],
[if bgp_egress_ip then 'cilium.syn.tools/experimental-policy']: 'true',
'cilium.syn.tools/egress-ip': egress_ip,
'cilium.syn.tools/interface-prefix': interface_prefix,
'cilium.syn.tools/egress-range': egress_range,
Expand Down
12 changes: 11 additions & 1 deletion docs/modules/ROOT/pages/references/parameters.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -408,12 +408,22 @@ When this field is omitted or empty, the component generates egress policies wit
Such policies assign the egress IP to all traffic originating in the namespace.
====

[IMPORTANT]
====
Support for configuring BGP egress IPs through `egress_ip_ranges` is currently experimental.

Policies which configure BGP egress IPs have an additional annotation `cilium.syn.tools/experimental-policy=true`.
====

[NOTE]
====
Field `bgp_policy_labels` is optional.
The component's support for configuring BGP egress IPs through `egress_ip_ranges` is currently experimental.

When the field is provided, and not an empty object, the component adds the contents as entries in `metadata.labels` of the resulting policies.
In this case, the component also configures the egress policies directly with the egress IP and `maxGatewayNodes: 1` in the `spec.egressGroups` entry.
In this case, the component configures the egress policies with https://docs.isovalent.com/v1.16/configuration-guide/networking/egress-gateway/introduction.html#requirements-for-egress-ip-and-ipam-feature[Cilium's Egress Gateawy IPAM] and `maxGatewayNodes: 1` in the `spec.egressGroups` entry.

Please note that policies which use EGW IPAM will ignore static routes on the active gateway node (as of Cilium 1.16.16 and Cilium 1.17.9).

If the field is omitted or empty, the component configures the egress group with the interface name and doesn't set `maxGatewayNodes`.
====
Expand Down
1 change: 1 addition & 0 deletions tests/golden/egress-gateway/cilium/cilium/20_namespace_egress_ip_policies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@ metadata:
in egress range "egress_f" (192.0.2.160 - 192.0.2.190) to namespace qux.
cilium.syn.tools/egress-ip: 192.0.2.160
cilium.syn.tools/egress-range: 192.0.2.160 - 192.0.2.190
cilium.syn.tools/experimental-policy: 'true'
cilium.syn.tools/interface-prefix: egress_f
cilium.syn.tools/source-namespace: qux
labels:
Expand Down
1 change: 1 addition & 0 deletions tests/golden/egress-gateway/cilium/cilium/40_egress_ip_managed_resource.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,7 @@ spec:
egress_range,
namespace,
],
[if bgp_egress_ip then 'cilium.syn.tools/experimental-policy']: 'true',
'cilium.syn.tools/egress-ip': egress_ip,
'cilium.syn.tools/interface-prefix': interface_prefix,
'cilium.syn.tools/egress-range': egress_range,
Expand Down