<p>I have deployed <a href="https://github.com/monzo/egress-operator#egress-operator" rel="nofollow noreferrer">egress-operator</a> in my ubuntu machine and this operator is internally using <a href="https://www.envoyproxy.io/" rel="nofollow noreferrer">envoy</a> proxy to control egress traffic.</p>
<p>The idea is to allow only <a href="https://github.com/monzo/egress-operator#usage" rel="nofollow noreferrer">whitelisted domains</a> from test-pod for egress. I have applied the external service <code>yaml</code> of this operator but it's giving the opposite result, instead of allowing <code>google.com</code> its blocking google.com and allowing other calls. What possibly am I doing wrong?</p>
<p><strong>My ExternalService.yaml</strong></p>
<pre><code>    apiVersion: egress.monzo.com/v1
    kind: ExternalService
    metadata:
      name: google
    spec:
      dnsName: google.com
      # optional, defaults to false, instructs dns server to rewrite queries for dnsName
      hijackDns: true
      ports:
      - port: 80
      - port: 443
        protocol: TCP
      minReplicas: 1
      maxReplicas: 3
</code></pre>
<p><strong>My testpod.yaml</strong></p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: nginx
  namespace: testNs-system
  labels:
    egress.monzo.com/allowed-gateway: google
spec:
  containers:
  - image: nginx:1.14.2
    command:
      - &quot;sleep&quot;
      - &quot;604800&quot;
    imagePullPolicy: IfNotPresent
    name: nginx
  restartPolicy: Always
</code></pre>
<p>From testpod when <code>curl -v https://google.com</code> is blocking and other urls are allowed. As per operator's Readme, I need a <a href="https://github.com/monzo/egress-operator#blocking-non-gateway-traffic" rel="nofollow noreferrer">defaut-deny-Egress K3s policy also</a>, therefore I applied that too. but after <code>default-deny-Egress</code> policy all egress calls including google.com (the one whitelisted) is blocking from testpod.</p>
<p><strong>Default-Deny-All-Egress.yaml</strong></p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all-egress
  namespace: testNs-system
spec:
  podSelector:
    matchLabels:
      app: nginx
      egress.monzo.com/allowed-gateway: google
  policyTypes:
  - Egress
  egress: []
</code></pre>
<p>How can I route the egress traffic from the egress-operator pod or egress-operator gateway?</p>

solveit
<p>Posting this answer as a community wiki, feel free to edit and expand.</p>
<hr />
<p><code>Istio</code> can be used as a solution for this case. It's an open-source project so it doesn't require to pay for its usage.</p>
<p>Istio has a very good documentation with examples how to achieve different results. Documentation is much better for <code>istio</code> in comparison with <code>monzo</code> operator + a lot of big companies use it so it's reliable solution.</p>
<hr />
<p>Accessing external services and whow it works:</p>
<blockquote>
<p>Because all outbound traffic from an Istio-enabled pod is redirected
to its sidecar proxy by default, accessibility of URLs outside of the
cluster depends on the configuration of the proxy. By default, Istio
configures the Envoy proxy to pass through requests for unknown
services. Although this provides a convenient way to get started with
Istio, configuring stricter control is usually preferable.</p>
</blockquote>
<p>Please find <code>istio</code> documentation and covered use cases with the same goal as yours:</p>
<ul>
<li><a href="https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/" rel="nofollow noreferrer">Using egress control</a></li>
<li><a href="https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/" rel="nofollow noreferrer">Using egress gateway</a></li>
</ul>
