Disable SNAT for Kubernetes Workloads

Aviatrix DCF enforces firewall policies on Kubernetes workloads by their pod source IP. When worker nodes apply Source NAT (SNAT) to pod traffic, the pod IP is replaced with the node IP before the packet leaves the cluster — DCF then sees only the node, not the pod, and the policy targeting individual workloads breaks. You must disable SNAT on worker nodes regardless of cloud provider. Use the cloud-specific instructions below.

AWS (EKS)
Azure (AKS)
Google Cloud (GKE)

EKS uses the AWS VPC CNI plugin (aws-node DaemonSet). Set the AWS_VPC_K8S_CNI_EXTERNALSNAT environment variable to true.Terraform — using terraform-aws-modules/eks/aws:

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_addons = {
    vpc-cni = {
      configuration_values = jsonencode({
        env = {
          AWS_VPC_K8S_CNI_EXTERNALSNAT = "true"
        }
      })
      before_compute = true
    }
  }
}

Or imperatively via kubectl:

kubectl set env daemonset -n kube-system aws-node AWS_VPC_K8S_CNI_EXTERNALSNAT=true

For background, see Enable outbound internet access for Pods in the AWS documentation.

AKS uses the ip-masq-agent DaemonSet, which reads its configuration from a ConfigMap named azure-ip-masq-agent-config in kube-system. Apply a ConfigMap that lists 0.0.0.0/0 as a non-masquerade CIDR.Terraform:

resource "azurerm_kubernetes_cluster" "cluster" {
  network_profile {
    network_plugin    = "azure"
    network_policy    = "azure"
    load_balancer_sku = "standard"
  }
}

resource "kubernetes_config_map_v1" "azure_ip_masq_agent_config" {
  metadata {
    name      = "azure-ip-masq-agent-config"
    namespace = "kube-system"
    labels = {
      component                         = "ip-masq-agent"
      "kubernetes.io/cluster-service"   = "true"
      "addonmanager.kubernetes.io/mode" = "EnsureExists"
    }
  }

  data = {
    "ip-masq-agent" = <<-EOT
      nonMasqueradeCIDRs:
        - "0.0.0.0/0"
    EOT
  }
}

The ip-masq-agent reload happens automatically when the ConfigMap changes.

GKE has a built-in default-SNAT toggle on the cluster resource. Disable it on a VPC-native cluster.Terraform:

resource "google_container_cluster" "cluster" {
  networking_mode = "VPC_NATIVE"

  default_snat_status {
    disabled = true
  }
}

VPC-native networking is required because the default-SNAT toggle is only meaningful when pods have unique IP addresses across the VPC. VPC-native is also the GKE default for new clusters.

Verification

Verifying SNAT-disabled directly from inside the cluster is awkward. With SNAT off, the pod’s source IP is private; an outbound curl from the pod will not reach an external echo service through the Aviatrix data plane the way a node-source-IP packet would. The cleanest verification is to route traffic from a pod through an Aviatrix Spoke Gateway with DCF and flow logging enabled, then check the source IP recorded in the DCF flow logs. The IP should match the pod IP, not the node IP. If pod IPs and node IPs are showing the same address in flow logs, SNAT is still active.

Concepts & Architecture

Guides

Reference

Verification

​Verification

​Related Topics

Verification

Related Topics