egressproxy

Overview ¶

Command egressproxy is the sandbox egress filter. It ships in the idle image and runs in three roles inside a sandbox Pod:

install-redirect  (init container, CAP_NET_ADMIN) — program iptables REDIRECT
serve             (native sidecar)                — the filtering proxy
set-policy/reset  (invoked via kubectl exec)      — control-plane policy push