anchor.diff:  ====
   endif::openshift-enterprise,openshift-origin[]
   
  +[[admin-guide-controlling-egress-traffic]]
  +== Controlling Egress Traffic
  +As an {product-title} cluster administrator, you can control egress traffic
  +using either a xref:admin-guide-deploying-an-egress-router-service[router] or
  +xref:admin-guide-limit-pod-access-egress[firewall] methods.
  +
  +[[admin-guide-limit-pod-access-egress-router]]
  +=== Limiting Pod Access with an Egress Router
  +
  +The {product-title} egress router runs a service that redirects traffic to a
  +specified remote server, using a private source IP address that is not used for
  +anything else. The service allow pods to talk to servers that are set up
  +to only allow access from whitelisted IP addresses.
  +
  +[[admin-guide-deploying-an-egress-router-pod]]
  +==== Deploying an Egress Router Pod
  +
  +.Example Pod Definition for an Egress Router
  +====
  +----
  +apiVersion: v1
  +kind: Pod
  +metadata:
  +  name: egress-1
  +  labels:
  +    name: egress-1
  +  annotations:
  +    pod.network.openshift.io/assign-macvlan: true
  +spec:
  +  containers:
  +  - name: egress-router
  +    image: openshift/origin-egress-router
  +    securityContext:
  +      privileged: true
  +    env:
  +    - name: EGRESS_SOURCE <1>
  +      value: 192.168.12.99
  +    - name: EGRESS_GATEWAY <2>
  +      value: 192.168.12.1
  +    - name: EGRESS_DESTINATION <3>
  +      value: 203.0.113.25
  +  nodeSelector:
  +    site: springfield-1 <4>
  +----
  +<1> IP address on the node subnet reserved by the cluster administrator for use by
  +this pod.
  +<2> Same value as the default gateway used by the node itself.
  +<3>  Connections to the pod are redirected to 203.0.113.25, with a source IP
  +address of 192.168.12.99
  +<4> The pod will only be deployed to nodes with the label site *springfield-1*.
  +====
  +
  +The `pod.network.openshift.io/assign-macvlan annotation` creates a Macvlan
  +network interface on the primary network interface, and then moves it into the
  +pod's network name space before starting the *egress-router* container.
  +
  +The pod contains a single container, using the *openshift/origin-egress-router*
  +image, and that container is run privileged so that it can configure the Macvlan
  +interface and set up `iptables` rules.
  +
  +The environment variables tell the *egress-router* image what addresses to use; it
  +will configure the Macvlan interface to use `*EGRESS_SOURCE*` as its IP address,
  +with `*EGRESS_GATEWAY*` as its gateway.
  +
  +NAT rules are set up so that connections to any TCP or UDP port on the
  +pod's cluster IP address are redirected to the same port on
  +`*EGRESS_DESTINATION*`.
  +
  +If only some of the nodes in your cluster are capable of claiming the specified
  +source IP address and using the specified gateway, you can specify a
  +`*nodeName*` or `*nodeSelector*` indicating which nodes are acceptable.
  +
  +[[admin-guide-deploying-an-egress-router-service]]
  +==== Deploying an Egress Router Service
  +
  +Though not strictly necessary, you normally want to create a service pointing to
  +the egress router:
  +
  +====
  +----
  +apiVersion: v1
  +kind: Service
  +metadata:
  +  name: egress-1
  +spec:
  +  ports:
  +  - name: http
  +    port: 80
  +  - name: https
  +    port: 443
  +  type: ClusterIP
  +  selector:
  +    name: egress-1
  +----
  +====
  +
  +Your pods can now connect to this service. Their connections are redirected to
  +the corresponding ports on the external server, using the reserved egress IP
  +address.
  +
   [[admin-guide-limit-pod-access-egress]]
  -== Limiting Pod Access with Egress Firewall
  +=== Limiting Pod Access with Egress Firewall
   
   As an {product-title} cluster administrator, you can use egress policy to limit
   the addresses that some or all pods can access from within the cluster, so that:
  
positive.code: === Configuring the RunOnceDuration Plug-in
  
  The plug-in configuration should include the default active deadline for
  run-once pods. This deadline will be enforced globally, but can be superseded on
  a per-project basis.
  
  ====
  
negative.code: ====
  
  [[admin-guide-config-pod-access]]
  ==== Configuring Pod Access Limits
  
  To configure pod access limits, you must use the `oc` command or the REST API.
  You can use `oc [create|replace|delete]` to manipulate `*EgressNetworkPolicy*`
  