Add egw host ip docs by MichalFupso · Pull Request #2602 · tigera/docs

MichalFupso · 2026-03-20T01:47:30Z

Product Version(s):

Calico Cloud, Calico Enterprise 3.23
Issue:

Link to docs preview:

SME review:

An SME has approved this change.

DOCS review:

A member of the docs team has approved this change.

Additional information:

Merge checklist:

Deploy preview inspected wherever changes were made
Build completed successfully
Test have passed

netlify · 2026-03-20T01:47:36Z

✅ Deploy Preview for calico-docs-preview-next ready!

Name	Link
🔨 Latest commit	`d3c12f6`
🔍 Latest deploy log	https://app.netlify.com/projects/calico-docs-preview-next/deploys/69bca735760dfd0008f956d6
😎 Deploy Preview	https://deploy-preview-2602--calico-docs-preview-next.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-03-20T01:47:36Z

❌ Deploy Preview for tigera failed. Why did it fail? →

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`d3c12f6`
🔍 Latest deploy log	https://app.netlify.com/projects/tigera/deploys/69bca7356f1f2900086bda1a

Copilot

Pull request overview

Adds new documentation pages describing how to configure egress gateways to SNAT outbound traffic to the gateway node’s host IP, and exposes those pages in the Calico Enterprise and Calico Cloud navigation.

Changes:

Added a new “egress gateway host IP” guide for Calico Enterprise.
Added a corresponding “egress gateway host IP” guide for Calico Cloud.
Updated both products’ sidebars to include the new page under Networking → Egress.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 11 comments.

File	Description
sidebars-calico-enterprise.js	Adds the new host-IP egress gateway doc to the Enterprise egress section navigation.
sidebars-calico-cloud.js	Adds the new host-IP egress gateway doc to the Cloud egress section navigation.
calico-enterprise/networking/egress/egress-gateway-host-ip.mdx	New Enterprise guide explaining host-IP mode behavior and configuration steps.
calico-cloud/networking/egress/egress-gateway-host-ip.mdx	New Cloud guide explaining host-IP mode behavior and configuration steps.

Copilot · 2026-03-20T01:51:12Z

+
+#### Configure a namespace or pod to use an egress gateway (egress gateway policy method)
+
+Creating an egress gateway policy allows gives you more control over how your egress gateways work.


The sentence “Creating an egress gateway policy allows gives you more control…” has an extra verb (“allows gives”). Reword to a grammatically correct sentence (e.g., “allows you to…”).

Suggested change

Creating an egress gateway policy allows gives you more control over how your egress gateways work.

Creating an egress gateway policy gives you more control over how your egress gateways work.

Copilot · 2026-03-20T01:51:13Z

+
+  :::note
+
+  This setting is not specific to egress gateway. In some cases where nodes happen to be in the same subnet, setting the value to `Never`will work the same as `Always`. It all depends on the hop from the client node to the egress gateway node. For example, if the client nodes are in the same AWS subnet, and you are using `Always` because some of the nodes are in different subnets, then `Never` will work for the egress IP Pool when the client and gateway nodes are in the same subnet.


There is a missing space in “Neverwill”, which reads like a typo. Insert a space after the inline code so the sentence renders correctly.

Copilot · 2026-03-20T01:51:13Z

+
+#### Configure a namespace or pod to use an egress gateway (egress gateway policy method)
+
+Creating an egress gateway policy allows gives you more control over how your egress gateways work.


The sentence “Creating an egress gateway policy allows gives you more control…” has an extra verb (“allows gives”). Reword to a grammatically correct sentence (e.g., “allows you to…”).

Suggested change

Creating an egress gateway policy allows gives you more control over how your egress gateways work.

Creating an egress gateway policy gives you more control over how your egress gateways work.

Copilot · 2026-03-20T01:51:13Z

+
+  :::note
+
+  This setting is not specific to egress gateway. In some cases where nodes happen to be in the same subnet, setting the value to `Never`will work the same as `Always`. It all depends on the hop from the client node to the egress gateway node. For example, if the client nodes are in the same AWS subnet, and you are using `Always` because some of the nodes are in different subnets, then `Never` will work for the egress IP Pool when the client and gateway nodes are in the same subnet.


There is a missing space in “Neverwill”, which reads like a typo. Insert a space after the inline code so the sentence renders correctly.

Copilot · 2026-03-20T01:51:13Z

+  name: my-client,
+  namespace: my-namespace,


This Pod manifest example includes trailing commas after name and namespace, which makes the YAML invalid for copy/paste. Remove the commas so the manifest can be applied as written.

Suggested change

name: my-client,

namespace: my-namespace,

name: my-client

namespace: my-namespace

Copilot · 2026-03-20T01:51:14Z

+  name: my-client,
+  namespace: my-namespace,


This Pod manifest example includes trailing commas after name and namespace, which makes the YAML invalid for copy/paste. Remove the commas so the manifest can be applied as written.

Suggested change

name: my-client,

namespace: my-namespace,

name: my-client

namespace: my-namespace

Copilot · 2026-03-20T01:51:14Z

+  name: my-client,
+  namespace: my-namespace,


This Pod manifest example includes trailing commas after name and namespace, which makes the YAML invalid for copy/paste. Remove the commas so the manifest can be applied as written.

Suggested change

name: my-client,

namespace: my-namespace,

name: my-client

namespace: my-namespace

Copilot · 2026-03-20T01:51:14Z

          link: { type: 'doc', id: 'networking/egress/index' },
          items: [
            'networking/egress/egress-gateway-on-prem',
+            'networking/egress/egress-gateway-host-ip',


PR description lists “Calico Enterprise 3.23”, but this sidebar change only adds the new page to the unversioned (next/master) Enterprise docs. If the intent is to document the feature for the 3.23 docs set, the corresponding versioned sidebar (e.g. calico-enterprise_versioned_sidebars/version-3.23-1-sidebars.json) and versioned docs content should also be updated, or the PR metadata should be adjusted to reflect that this is for next/master only.

Copilot · 2026-03-20T01:51:15Z

+to the egress gateway. In eBPF mode, the probe traffic can be blocked by policy, so you must ensure that this traffic allowed; this should be fixed in an upcoming
+patch release.


In the eBPF-mode note, the sentence “ensure that this traffic allowed” is missing “is”, which makes it grammatically incorrect and a bit hard to parse. Add the missing word (and consider splitting the long sentence) so the requirement is unambiguous.

Suggested change

to the egress gateway. In eBPF mode, the probe traffic can be blocked by policy, so you must ensure that this traffic allowed; this should be fixed in an upcoming

patch release.

to the egress gateway. In eBPF mode, the probe traffic can be blocked by policy, so you must ensure that this traffic is

allowed by your network policy. This limitation should be fixed in an upcoming patch release.

Copilot · 2026-03-20T01:51:15Z

+  name: my-client,
+  namespace: my-namespace,


This Pod manifest example includes trailing commas after name and namespace, which makes the YAML invalid for copy/paste. Remove the commas so the manifest can be applied as written.

Suggested change

name: my-client,

namespace: my-namespace,

name: my-client

namespace: my-namespace

mazdakn

The content looks OK to me technically, but I think @ctauchen should review from other aspects.

We should also add a release note about adding this feature.

mazdakn · 2026-04-14T21:08:38Z

+## Big picture
+
+Configure specific application traffic to exit the cluster through an egress gateway, using the
+gateway's **host (node) IP** as the source address for traffic leaving the cluster.


using host and node seems redundant. Maybe we should just use host address

mazdakn · 2026-04-14T21:09:22Z

+within the cluster.
+
+In this mode, outbound traffic passing through an egress gateway is source-NATed (SNAT) to the
+**node IP of the host** where the egress gateway pod is running, rather than the gateway's own pod


Suggested change

**node IP of the host** where the egress gateway pod is running, rather than the gateway's own pod

**host address** where the egress gateway pod is running, rather than the gateway's own pod

mazdakn · 2026-04-14T21:10:26Z

+In this mode, outbound traffic passing through an egress gateway is source-NATed (SNAT) to the
+**node IP of the host** where the egress gateway pod is running, rather than the gateway's own pod
+IP. This is useful when external firewalls or services need to allowlist traffic based on a
+stable set of known node IPs, or when pod IPs are not routable outside the cluster.


Suggested change

stable set of known node IPs, or when pod IPs are not routable outside the cluster.

stable set of known host addresses, or when pod IPs are not routable outside the cluster.

mazdakn · 2026-04-14T21:23:24Z

+The Tigera Operator configures egress gateways to use the same iptables backend as `calico-node`.
+To modify the iptables backend for egress gateways, you must change the `iptablesBackend` field in the [Felix configuration](../../reference/resources/felixconfig.mdx).
+
+### Configure IP autodetection for dual-ToR clusters.


We should no include dual ToR or basically any other details related to BGP or on-prem in this page.

mazdakn · 2026-04-14T21:29:07Z

+The Tigera Operator configures egress gateways to use the same iptables backend as `calico-node`.
+To modify the iptables backend for egress gateways, you must change the `iptablesBackend` field in the [Felix configuration](../../reference/resources/felixconfig.mdx).
+
+### Configure IP autodetection for dual-ToR clusters.


We should no include dual ToR or basically any other details related to BGP or on-prem in this page. (same in the other file)

Add egw host ip docs

d3c12f6

MichalFupso requested a review from a team as a code owner March 20, 2026 01:47

Copilot AI review requested due to automatic review settings March 20, 2026 01:47

Copilot started reviewing on behalf of MichalFupso March 20, 2026 01:48 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

mazdakn reviewed Apr 14, 2026

View reviewed changes


		#### Configure a namespace or pod to use an egress gateway (egress gateway policy method)

		Creating an egress gateway policy allows gives you more control over how your egress gateways work.

	Creating an egress gateway policy allows gives you more control over how your egress gateways work.
	Creating an egress gateway policy gives you more control over how your egress gateways work.


		:::note

		This setting is not specific to egress gateway. In some cases where nodes happen to be in the same subnet, setting the value to `Never`will work the same as `Always`. It all depends on the hop from the client node to the egress gateway node. For example, if the client nodes are in the same AWS subnet, and you are using `Always` because some of the nodes are in different subnets, then `Never` will work for the egress IP Pool when the client and gateway nodes are in the same subnet.

		to the egress gateway. In eBPF mode, the probe traffic can be blocked by policy, so you must ensure that this traffic allowed; this should be fixed in an upcoming
		patch release.

	node IP of the host where the egress gateway pod is running, rather than the gateway's own pod
	host address where the egress gateway pod is running, rather than the gateway's own pod

	stable set of known node IPs, or when pod IPs are not routable outside the cluster.
	stable set of known host addresses, or when pod IPs are not routable outside the cluster.

Conversation

MichalFupso commented Mar 20, 2026

Uh oh!

netlify Bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for calico-docs-preview-next ready!

Uh oh!

netlify Bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for tigera failed. Why did it fail? →

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

mazdakn left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mazdakn Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

mazdakn Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

mazdakn Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

mazdakn Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

mazdakn Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify Bot commented Mar 20, 2026 •

edited

Loading

netlify Bot commented Mar 20, 2026 •

edited

Loading

mazdakn left a comment •

edited

Loading