anchor.diff:  ====
   
   [[admin-guide-config-pod-access]]
  -=== Configuring Pod Access Limits
  +==== Configuring Pod Access Limits
   
   To configure pod access limits, you must use the `oc` command or the REST API.
   You can use `oc [create|replace|delete]` to manipulate `*EgressNetworkPolicy*`
  
positive.code: === Configuring the RunOnceDuration Plug-in
  
  The plug-in configuration should include the default active deadline for
  run-once pods. This deadline will be enforced globally, but can be superseded on
  a per-project basis.
  
  ====
  
negative.code: ====
  endif::openshift-enterprise,openshift-origin[]
  
  [[admin-guide-controlling-egress-traffic]]
  == Controlling Egress Traffic
  As an {product-title} cluster administrator, you can control egress traffic
  using either a xref:admin-guide-deploying-an-egress-router-service[router] or
  xref:admin-guide-limit-pod-access-egress[firewall] methods.
  
  [[admin-guide-limit-pod-access-egress-router]]
  === Limiting Pod Access with an Egress Router
  
  The {product-title} egress router runs a service that redirects traffic to a
  specified remote server, using a private source IP address that is not used for
  anything else. The service allow pods to talk to servers that are set up
  to only allow access from whitelisted IP addresses.
  
  [[admin-guide-deploying-an-egress-router-pod]]
  ==== Deploying an Egress Router Pod
  
  .Example Pod Definition for an Egress Router
  ====
  ----
  apiVersion: v1
  kind: Pod
  metadata:
    name: egress-1
    labels:
      name: egress-1
    annotations:
      pod.network.openshift.io/assign-macvlan: true
  spec:
    containers:
    - name: egress-router
      image: openshift/origin-egress-router
      securityContext:
        privileged: true
      env:
      - name: EGRESS_SOURCE <1>
        value: 192.168.12.99
      - name: EGRESS_GATEWAY <2>
        value: 192.168.12.1
      - name: EGRESS_DESTINATION <3>
        value: 203.0.113.25
    nodeSelector:
      site: springfield-1 <4>
  ----
  <1> IP address on the node subnet reserved by the cluster administrator for use by
  this pod.
  <2> Same value as the default gateway used by the node itself.
  <3>  Connections to the pod are redirected to 203.0.113.25, with a source IP
  address of 192.168.12.99
  <4> The pod will only be deployed to nodes with the label site *springfield-1*.
  ====
  
  The `pod.network.openshift.io/assign-macvlan annotation` creates a Macvlan
  network interface on the primary network interface, and then moves it into the
  pod's network name space before starting the *egress-router* container.
  
  The pod contains a single container, using the *openshift/origin-egress-router*
  image, and that container is run privileged so that it can configure the Macvlan
  interface and set up `iptables` rules.
  
  The environment variables tell the *egress-router* image what addresses to use; it
  will configure the Macvlan interface to use `*EGRESS_SOURCE*` as its IP address,
  with `*EGRESS_GATEWAY*` as its gateway.
  
  NAT rules are set up so that connections to any TCP or UDP port on the
  pod's cluster IP address are redirected to the same port on
  `*EGRESS_DESTINATION*`.
  
  If only some of the nodes in your cluster are capable of claiming the specified
  source IP address and using the specified gateway, you can specify a
  `*nodeName*` or `*nodeSelector*` indicating which nodes are acceptable.
  
  [[admin-guide-deploying-an-egress-router-service]]
  ==== Deploying an Egress Router Service
  
  Though not strictly necessary, you normally want to create a service pointing to
  the egress router:
  
  ====
  ----
  apiVersion: v1
  kind: Service
  metadata:
    name: egress-1
  spec:
    ports:
    - name: http
      port: 80
    - name: https
      port: 443
    type: ClusterIP
    selector:
      name: egress-1
  ----
  ====
  
  Your pods can now connect to this service. Their connections are redirected to
  the corresponding ports on the external server, using the reserved egress IP
  address.
  
  [[admin-guide-limit-pod-access-egress]]
  === Limiting Pod Access with Egress Firewall
  
  As an {product-title} cluster administrator, you can use egress policy to limit
  the addresses that some or all pods can access from within the cluster, so that:
  