<p>I have a Kubernetes cluster with multiple nodes in two different subnets (<code>x</code> and <code>y</code>). I have an IPsec VPN tunnel setup between my <code>x</code> subnet and an external network. Now my problem is that the pods that get scheduled in the nodes on the <code>y</code> subnet can't send requests to the external network because they're in nodes not covered by the VPN tunnel. Creating another VPN to cover the <code>y</code> subnet isn't possible right now. Is there a way in k8s to force all pods' traffic to go through a single source? Or any clean solution even if outside of k8s?</p>

<p>Posting this as a community wiki, feel free to edit and expand.</p>
<hr />
<p>There is no built-in functionality in kubernetes that can do it. However there are two available options which can help to achieve the required setup:</p>
<ol>
<li><strong>Istio</strong></li>
</ol>
<p>If services are well known then it's possible to use <a href="https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/" rel="nofollow noreferrer">istio egress gateway</a>. We are interested in this use case:</p>
<blockquote>
<p>Another use case is a cluster where the application nodes don’t have
public IPs, so the in-mesh services that run on them cannot access the
Internet. Defining an egress gateway, directing all the egress traffic
through it, and allocating public IPs to the egress gateway nodes
allows the application nodes to access external services in a
controlled way.</p>
</blockquote>
<ol start="2">
<li><strong>Antrea egress</strong></li>
</ol>
<p>There's another solution which can be used - <a href="https://antrea.io/docs/v1.4.0/docs/egress/" rel="nofollow noreferrer">antrea egress</a>. Use cases are:</p>
<p>You may be interested in using this capability if any of the following apply:</p>
<blockquote>
<ul>
<li><p>A consistent IP address is desired when specific Pods connect to
services outside of the cluster, for source tracing in audit logs, or
for filtering by source IP in external firewall, etc.</p>
</li>
<li><p>You want to force outgoing external connections to leave the cluster
via certain Nodes, for security controls, or due to network topology
restrictions.</p>
</li>
</ul>
</blockquote>
