A Gateway Is Not a Security Concept
The egress topic has barely hit the table when the reflex kicks in: “We will build an egress gateway, then everything runs through one place.” It is often decided before anyone asks what it is actually supposed to enforce.
- Date
- Topic
- Egress gateway
- Sources
- 2
- Reading time
- 2 min
- Version
- Translation
There are good reasons for the thing. External partners maintain IP allowlists, in which case outbound traffic needs a fixed, known source address. Or compliance demands a central zone where outbound traffic is inspected and logged. Both are real requirements, and an egress gateway solves both cleanly.
Figure as text
Path diagram of an egress gateway: workloads route through the gateway to external destinations via a sidecar rule, a red dashed bypass runs past the gateway below and is stopped by a NetworkPolicy bolt (egress closed, door only for the gateway). At the top, two cards: the good reasons (fixed source address for IP allowlists, central inspection zone) and the operations side (one extra hop per external call, capacity and upkeep, possible single point of failure).
The catch: the fact that traffic is SUPPOSED to go through the gateway is written in the sidecars’ routing rules. Nothing is enforced by that. The Istio docs essentially say so themselves: the mesh alone does not guarantee that outbound traffic really goes through the egress gateway, that takes complementary mechanisms such as NetworkPolicies. Only when the cluster network closes the direct way out for all workloads and leaves the door open only for the gateway does routing turn into enforcement.
Without this bolt, you have a gateway you can walk past. That is not a control point, it is decoration with running costs.
And the operations side belongs in the same calculation: one extra hop for every external call, a component that needs capacity and upkeep, and a possible single point of failure right on the path to your external dependencies.
The pattern that holds up: an egress gateway only with an enforced path and a reason that fits in one sentence. If either is missing, REGISTRY_ONLY without the detour (report #16) is the more honest architecture. Same inventory, one hop fewer, no pretense.
The question for decision makers has two parts: what exactly does your gateway enforce? And has anyone ever checked whether you can get past it? Feel free to share what sits in your path, a control point or a habit that grew over time. I am reading along.
