Deploying an egress router pod in HTTP proxy mode

As a cluster administrator, you can deploy an egress router pod configured to proxy traffic to specified HTTP and HTTPS-based services.

Egress router pod specification for HTTP mode

Define the configuration for an egress router pod in the Pod object. The following YAML describes the fields for the configuration of an egress router pod in HTTP mode:

  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   name: egress-1
  5.   labels:
  6.     name: egress-1
  7.   annotations:
  8.     pod.network.openshift.io/assign-macvlan: "true" (1)
  9. spec:
  10.   initContainers:
  11.   - name: egress-router
  12.     image: openshift/origin-egress-router
  13.     securityContext:
  14.       privileged: true
  15.     env:
  16.     - name: EGRESS_SOURCE (2)
  17.       value: <egress-router>
  18.     - name: EGRESS_GATEWAY (3)
  19.       value: <egress-gateway>
  20.     - name: EGRESS_ROUTER_MODE
  21.       value: http-proxy
  22.   containers:
  23.   - name: egress-router-pod
  24.     image: openshift/origin-egress-http-proxy
  25.     env:
  26.     - name: EGRESS_HTTP_PROXY_DESTINATION (4)
  27.       value: |-
  28.         ...
  29.     ...
1Before starting the egress-router container, create a macvlan network interface on the primary network interface and move that interface into the pod network namespace. You must include the quotation marks around the “true” value. To create the macvlan interface on a network interface other than the primary one, set the annotation value to the name of that interface. For example, eth1.
2IP address from the physical network that the node is on that is reserved for use by the egress router pod. Optional: You can include the subnet length, the /24 suffix, so that a proper route to the local subnet is set. If you do not specify a subnet length, then the egress router can access only the host specified with the EGRESS_GATEWAY variable and no other hosts on the subnet.
3Same value as the default gateway used by the node.
4A string or YAML multi-line string specifying how to configure the proxy. Note that this is specified as an environment variable in the HTTP proxy container, not with the other environment variables in the init container.

Egress destination configuration format

When an egress router pod is deployed in HTTP proxy mode, you can specify redirection rules by using one or more of the following formats. Each line in the configuration specifies one group of connections to allow or deny:

  • An IP address allows connections to that IP address, such as 192.168.1.1.

  • A CIDR range allows connections to that CIDR range, such as 192.168.1.0/24.

  • A hostname allows proxying to that host, such as www.example.com.

  • A domain name preceded by *. allows proxying to that domain and all of its subdomains, such as *.example.com.

  • A ! followed by any of the previous match expressions denies the connection instead.

  • If the last line is *, then anything that is not explicitly denied is allowed. Otherwise, anything that is not allowed is denied.

You can also use * to allow connections to all remote destinations.

Example configuration

  1. !*.example.com
  2. !192.168.1.0/24
  3. 192.168.2.1
  4. *

Deploying an egress router pod in HTTP proxy mode

In HTTP proxy mode, an egress router pod runs as an HTTP proxy on port 8080. This mode only works for clients that are connecting to HTTP-based or HTTPS-based services, but usually requires fewer changes to the client pods to get them to work. Many programs can be told to use an HTTP proxy by setting an environment variable.

Prerequisites

  • Install the OpenShift CLI (oc).

  • Log in as a user with cluster-admin privileges.

Procedure

  1. Create an egress router pod.

  2. To ensure that other pods can find the IP address of the egress router pod, create a service to point to the egress router pod, as in the following example:

    1. apiVersion: v1
    2. kind: Service
    3. metadata:
    4.   name: egress-1
    5. spec:
    6.   ports:
    7.   - name: http-proxy
    8.     port: 8080 (1)
    9.   type: ClusterIP
    10.   selector:
    11.     name: egress-1
    1Ensure the http port is set to 8080.

  3. To configure the client pod (not the egress proxy pod) to use the HTTP proxy, set the http_proxy or https_proxy variables:

    1. apiVersion: v1
    2. kind: Pod
    3. metadata:
    4.   name: app-1
    5.   labels:
    6.     name: app-1
    7. spec:
    8.   containers:
    9.     env:
    10.     - name: http_proxy
    11.       value: http://egress-1:8080/ (1)
    12.     - name: https_proxy
    13.       value: http://egress-1:8080/
    14.     ...
    1The service created in the previous step.

    Using the http_proxy and https_proxy environment variables is not necessary for all setups. If the above does not create a working setup, then consult the documentation for the tool or software you are running in the pod.

Additional resources