Route ambient egress traffic through Secure Web Proxy

Autopilot Standard

This page shows you how to configure egress routing for workloads running on Google Kubernetes Engine (GKE) ambient networking to a Secure Web Proxy (SWP) gateway.

By routing outbound traffic through a Secure Web Proxy gateway, you can enforce centralized egress security policies—such as URL filtering, domain allowlists, and TLS inspection—without modifying your application code. The Layer 4 node proxy intercepts outbound traffic outside the application Pod, providing out-of-Pod security isolation even if a workload container is compromised.

Architecture and traffic flow

In this deployment model, you maintain ownership of the infrastructure, including the GKE cluster, the Secure Web Proxy instance, and any Private Service Connect (PSC) endpoints.

The egress traffic flow operates as follows:

A workload or AI agent Pod initiates outbound traffic to an external endpoint or internet destination.
The local Layer 4 ambient node proxy intercepts the outbound request on the node.
The node proxy establishes an HTTP CONNECT tunnel to the egress gateway.
If the Secure Web Proxy resides in a different VPC network, traffic traverses a PSC Service Attachment.
The Secure Web Proxy terminates the tunnel, enforces configured egress security policies, and forwards authorized requests to the destination.

Limitations

Before setting up Secure Web Proxy egress routing, review the following limitations in preview:

Namespace-wide policies: Egress routing policies apply at the namespace level only. Granular Pod selection by using label selectors is not supported.
Hostname filtering requires TLS inspection: Secure Web Proxy policies can only filter egress traffic by IP address unless TLS inspection is enabled.
Workload Identity: GKE ambient networking supports standard Workload Identity. Managed Agent Identity pools are not supported for this preview.
Authentication: The connection between the ambient node proxy and the Secure Web Proxy skips server certificate verification. The CONNECT request includes an unbounded token alongside the client certificate.
Resource recreation on configuration updates: Changes made to an existing Secure Web Proxy instance or PSC configuration are not automatically propagated. If you update your Secure Web Proxy or PSC configuration, you must delete and recreate the GCPEgressPolicy resource and Secure Web Proxy instance to apply the changes.
TLS inspection trust anchor: GKE does not automatically inject the Secure Web Proxy private CA certificate into workload containers. If you use TLS inspection, you must manually install the trust certificate into your container images.

Prerequisites

Before configuring egress routing, verify that you have the following:

A GKE cluster with ambient networking enabled. For instructions, see Prepare GKE ambient networking.
A deployed Secure Web Proxy instance with a serverTlsPolicy configured with clientValidationMode: ALLOW_INVALID_OR_MISSING_CLIENT_CERT in your Google Cloud project or shared VPC.
If the Secure Web Proxy is located in a different VPC network than your GKE cluster:
- A PSC Service Attachment created for the Secure Web Proxy.
- A PSC Consumer Endpoint configured in your GKE cluster VPC network.

To complete these steps, you must have the following roles:

Agent Gateway / Network Services: networkservices.agentGateways.* (or roles/networkservices.admin) to configure agent gateway resources.
PSC Management: compute.networkAttachments.list (or roles/compute.networkAdmin) to manage Private Service Connect connections.
GKE Management: roles/container.clusterAdmin to deploy custom resources (GCPBackend, GCPEgressPolicy).

Configure trust for TLS inspection

If your Secure Web Proxy policy uses TLS inspection to inspect encrypted outbound traffic, the proxy generates certificates signed by its private Certificate Authority (CA) to impersonate external destinations.

Your workload application must trust the private CA certificate presented by the Secure Web Proxy. Because GKE does not inject this certificate automatically, you must install the SWP CA certificate (trust anchor) into your container's trust store.

To add the CA certificate to your container image, include the following lines in your Dockerfile:

COPY swp-ca-cert.pem /usr/local/share/ca-certificates/swp-ca-cert.crt
RUN update-ca-certificates

Define the gateway endpoint

The first step in configuring ambient egress routing is to create a gateway endpoint, which defines the Secure Web Proxy endpoint within your GKE cluster and informs ambient networking of the proxy's location.

To specify the URI of your Secure Web Proxy or Private Service Connect (PSC) Service Attachment, create a GCPBackend custom resource in your GKE cluster:

Save the following manifest as swp-backend.yaml:

Same VPC
```
apiVersion: networking.gke.io/v1
kind: GCPBackend
metadata:
  name: swp-backend
  namespace: ambient-test
spec:
  serviceUris:
  - //networkservices.googleapis.com/projects/PROJECT_ID/locations/REGION/gateways/SWP_NAME
```
Replace the following:
- ambient-test: the namespace enrolled in ambient networking.
- PROJECT_ID: your Google Cloud project ID.
- REGION: the region where your Secure Web Proxy or PSC Service Attachment is deployed.
- SWP_NAME: the name of your Secure Web Proxy.
Cross-VPC
```
apiVersion: networking.gke.io/v1
kind: GCPBackend
metadata:
  name: swp-backend
  namespace: ambient-test
spec:
  serviceUris:
  - //compute.googleapis.com/projects/PROJECT_ID/regions/REGION/serviceAttachments/ATTACHMENT_NAME
```
Replace the following:
- ambient-test: the namespace enrolled in ambient networking.
- PROJECT_ID: your Google Cloud project ID.
- REGION: the region where your Secure Web Proxy or PSC Service Attachment is deployed.
- ATTACHMENT_NAME: the name of your PSC Service Attachment, if your Secure Web Proxy is in a different VPC network.
Apply the GCPBackend resource:
```
kubectl apply -f swp-backend.yaml
```

Configure egress traffic redirection

Create a GCPEgressPolicy custom resource to route outbound traffic from the namespace to the Secure Web Proxy gateway. This provides the signaling necessary for the ambient node proxy to establish an HTTP CONNECT tunnel to the Secure Web Proxy, which is necessary for egress routing.

Save the following manifest as swp-egress-policy.yaml:

apiVersion: networking.gke.io/v1
kind: GCPEgressPolicy
metadata:
  name: swp-egress-policy
  namespace: ambient-test
spec:
  to:
    excludeCIDRRanges:
    - "CLUSTER_CONTROL_PLANE_CIDR"
  proxyRef:
    group: networking.gke.io
    kind: GCPBackend
    name: swp-backend

Replace the following:

ambient-test: The namespace enrolled in ambient networking.
CLUSTER_CONTROL_PLANE_CIDR: The CIDR range for internal communications that should bypass the Secure Web Proxy (such as the GKE control plane address range or internal VPC subnets).

Apply the GCPEgressPolicy resource:
```
kubectl apply -f swp-egress-policy.yaml
```
After the policy is applied, outbound traffic from workloads in the namespace is redirected to the Secure Web Proxy.

Troubleshooting

Use the following guidance to diagnose and resolve issues with ambient egress routing:

Traffic not reaching the Secure Web Proxy:
- Verify that the GCPBackend resource points to the correct PSC Service Attachment URI.
- Verify that the PSC endpoint is established and accepted in the producer VPC.
- Check that excludeCIDRRanges in GCPEgressPolicy is not inadvertently matching your destination traffic.
mTLS connection failures:
- Verify that that the Secure Web Proxy is configured to accept connections from the node proxy.
TLS inspection certificate errors:
- If client requests fail with certificate validation errors (such as x509: certificate signed by unknown authority), verify that the Secure Web Proxy CA certificate is properly installed in the workload container's system certificate store.