How to route all outgoing traffic of a Pod in GKE

Question

We have a GKE Autopilot Cluster and an external Address/Cloud NAT set up. For certain Pods we want to ensure that all their outgoing traffic (layer 4) is routed through that external address.

The only possibilities I can think of is to make the whole Cluster private (and thus enforce use of the Cloud NAT) or to use a Service Mesh solution which could perhaps intercept all pakets via ebpf?

Are there other solutions to enforcing a routing to one external Address?

Answer 1

With the time being, there is no way to do this for the GKE Autopilot Cluster.

But by the end of October, there will likely be an upgrade to the Egress NAT policy that will enable users to setup SNAT based on pod labels, namespaces, and even the destination IP address.

Answer 2

You can try the Ip masquerade agent, works for me with standard cluster and NAT with public cluster/nodes.

Ip Masquerade Agent