Egress gateway

As explained in Google Anthos in Action

An egress gateway is a service-mesh gateway that receives traffic leaving the mesh and forwards it to external destinations.

An egress gateway is a service-mesh perimeter proxy that controls traffic leaving an Anthos cluster or mesh for external services. It centralizes outbound routing and can support TLS origination through a dedicated gateway or an external HTTPS proxy. section 4.5.3 section 10.4.3

Configure egress control by combining these components and policies:

• Deploy the istio-egressgateway as a second proxy at the service-mesh perimeter. section 10.4.3
• Set outboundTrafficPolicy to REGISTRY_ONLY so unregistered outbound destinations are blocked. section 10.4.3
• Create ServiceEntries for approved external services, identifying them with location MESH_EXTERNAL. section 10.4.3
• Use NetworkPolicies and firewall rules instead when ASM is not deployed; Pod egress can be restricted through node IP subnets. section 10.4.3

Allowing an external HTTP service

A ServiceEntry can allow HTTP traffic to httpbin.org on port 80 while marking the destination as external:\n\napiVersion: networking.istio.io/v1alpha3\nkind: ServiceEntry\nmetadata:\n name: httpbin-ext\nspec:\n hosts:\n - httpbin.org\n ports:\n - number: 80\n name: http\n protocol: HTTP\n resolution: DNS\n location: MESH_EXTERNAL section 10.4.3

Figure 4.10 Istio egress control example

Use the egress-control architecture illustration to inspect how mesh traffic is routed toward external services. section 4.5.3

How Google Anthos in Action covers it

How deep it goes

Explains perimeter proxies, allowlisted ServiceEntries, registry-only policy, TLS origination, and non-ASM alternatives.

Examples

Uses an httpbin.org ServiceEntry permitting HTTP on port 80 with DNS resolution and MESH_EXTERNAL location.

What it assumes

Assumes an Anthos cluster and service-mesh context; distinguishes ASM configuration from NetworkPolicy and firewall-based controls.

What you can do after

Operate/configure controlled external access through an ASM egress gateway, ServiceEntries, and registry-only outbound policy.

How it connects

Connects egress gateways with service mesh, ingress gateways, ServiceEntry, outbound traffic policy, NetworkPolicy, firewall rules, and TLS origination.

liveBookmanning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

• Cloud Service Meshproduced by · Cloud Service Mesh is Google's managed service mesh for controlling, securing, and observing communication among distributed services, formerly known as Anthos Service Mesh.
• egress controlused by · Egress control is the enforcement of policies governing or restricting outbound network traffic from a system or workload.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.