Comparison
EgressvsEgress gateway
Egress
your workload calling a payment provider goes out through something with a fixed address, because the provider allow-lists it.
Traffic leaving a cluster or network for the outside world. It is the direction teams forget until two things happen: a third party requires a stable source address to allow-list, and the bill arrives with data-transfer charges on it. Controlling it also matters for security, because unrestricted egress is how a compromised workload reaches a command-and-control host or exfiltrates data.
Full entry →Egress gateway
everything leaving the cluster is funnelled through one hop, so there is one address to allow-list and one place to log it.
A dedicated exit point that all outbound traffic is routed through, giving a stable source identity and a single enforcement and audit point. It is how you satisfy a partner who allow-lists addresses without pinning your workloads to particular nodes. It is also a bottleneck and a failure domain of its own, which is the trade you are making in return for the control.
Full entry →