<p>In our Kubernetes deployment, we have deployed a WebApp on a deployment controller and created a Load-balancer for external access.<br>
So all the inbound request is getting load-balanced by load-balancer and works fine.</p>

<p>But we are facing issue with our outbound request.In our case external application can only accept traffic from whitelisted IP addresses so we wanted to give load-balancer ip which will then get whitelisted as pods are ephemeral in nature and their IP will not be static.</p>

<p>But as request are originating from pod, it keeps the source ip of pod and then external application drops the request.</p>

<p>Is there a way in which pod can send outbound request using source as service ip, or can source ip be masked by service Ip?</p>

<p>You can potentially use a egress gateway for this. Istio provides Envoy as a egress gateway proxy. From your service inside the cluster all outbound traffic will be routed through this egress proxy. You can configure TLS origination at the proxy before the traffic is send to the external service. You need to then whitelist the IP of the egress gateway in your external service.</p>

<p>Other option will be to have a reverse proxy in front of that external service and terminate traffic from service inside kubernetes and start a new TCP session from the reverse proxy to the external service. In this case the reverse proxy accepts connection from any origin IP but the external service only receives request originated from the proxy. You can configure the proxy to pass the actual client IP in a http header typically X-Forwarded-Host</p>

<p><a href="https://istio.io/docs/tasks/traffic-management/egress/" rel="nofollow noreferrer">https://istio.io/docs/tasks/traffic-management/egress/</a></p>
