Kubernetes Egress Gateway with Cloud NAT Solutions

# Allocate Elastic IP
EIP_ALLOC=$(aws ec2 allocate-address \
  --domain vpc \
  --query 'AllocationId' \
  --output text)

# Create NAT Gateway in public subnet
NAT_GW=$(aws ec2 create-nat-gateway \
  --subnet-id subnet-public-123 \
  --allocation-id $EIP_ALLOC \
  --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=eks-nat-gw}]' \
  --query 'NatGatewayId' \
  --output text)

# Wait for NAT Gateway to be available
aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT_GW

echo "NAT Gateway created: $NAT_GW"

# Get private subnet route table
ROUTE_TABLE=$(aws ec2 describe-route-tables \
  --filters "Name=tag:Name,Values=eks-private-subnet" \
  --query 'RouteTables[0].RouteTableId' \
  --output text)

# Add default route to NAT Gateway
aws ec2 create-route \
  --route-table-id $ROUTE_TABLE \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id $NAT_GW

# Check NAT Gateway status
aws ec2 describe-nat-gateways \
  --nat-gateway-ids $NAT_GW \
  --query 'NatGateways[0].{State:State,Ip:NatGatewayAddresses[0].PublicIp}'

# Check route table
aws ec2 describe-route-tables \
  --route-table-ids $ROUTE_TABLE \
  --query 'RouteTables[0].Routes[?DestinationCidrBlock==`0.0.0.0/0`]'

# Create NAT Gateway in each AZ
for AZ in us-east-1a us-east-1b us-east-1c; do
  # Get public subnet for AZ
  SUBNET=$(aws ec2 describe-subnets \
    --filters "Name=tag:Name,Values=eks-public-$AZ" \
    --query 'Subnets[0].SubnetId' \
    --output text)
  
  # Allocate EIP
  EIP=$(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text)
  
  # Create NAT Gateway
  aws ec2 create-nat-gateway \
    --subnet-id $SUBNET \
    --allocation-id $EIP \
    --tag-specifications "ResourceType=natgateway,Tags=[{Key=Name,Value=eks-nat-$AZ}]"
done

# eksctl cluster config with NAT Gateway
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: my-eks-cluster
  region: us-east-1

vpc:
  id: vpc-12345678
  subnets:
    private:
      us-east-1a:
        id: subnet-priv-1a
        natGatewayId: nat-0abc123
      us-east-1b:
        id: subnet-priv-1b
        natGatewayId: nat-0def456
    public:
      us-east-1a:
        id: subnet-pub-1a
      us-east-1b:
        id: subnet-pub-1b

# NAT Gateways are created automatically by eksctl
# One per AZ with private subnets

# Create CloudWatch alarm for high traffic
aws cloudwatch put-metric-alarm \
  --alarm-name "NAT-HighBytesOut" \
  --metric-name BytesOutToDestination \
  --namespace AWS/NatGateway \
  --statistic Sum \
  --period 300 \
  --threshold 1000000000 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:us-east-1:ACCOUNT:alerts \
  --dimensions Name=NatGatewayId,Value=nat-0abc123

# View NAT Gateway metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/NatGateway \
  --metric-name BytesOutToDestination \
  --dimensions Name=NatGatewayId,Value=nat-0abc123 \
  --start-time $(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --period 300 \
  --statistics Sum

# Enable VPC Flow Logs to analyze traffic
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-12345678 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /aws/vpc/flow-logs \
  --iam-role-arn arn:aws:iam::ACCOUNT:role/flow-logs-role

# Analyze traffic patterns to optimize
aws logs filter-log-events \
  --log-group-name /aws/vpc/flow-logs \
  --filter-pattern "dstAddr != 10.0.0.0/8" \
  --start-time $(date -u -d '7 days ago' +%s)000 \
  --end-time $(date -u +%s)000

# Create Cloud Router in region
gcloud compute routers create gke-nat-router \
  --region us-central1 \
  --network default \
  --asn 64514

# Verify router
gcloud compute routers describe gke-nat-router \
  --region us-central1

# Create Cloud NAT configuration
gcloud compute routers nats create gke-nat-config \
  --router=gke-nat-router \
  --region=us-central1 \
  --auto-allocate-nat-external-ips \
  --nat-all-subnet-ip-ranges \
  --enable-logging

# Verify NAT configuration
gcloud compute routers nats describe gke-nat-config \
  --router=gke-nat-router \
  --region=us-central1

# Get GKE cluster details
gcloud container clusters describe my-cluster \
  --region us-central1 \
  --format="value(network)"

# Ensure private cluster configuration
gcloud container clusters update my-cluster \
  --region us-central1 \
  --enable-master-authorized-networks \
  --master-authorized-networks 10.0.0.0/8

# Reserve static external IPs
gcloud compute addresses create nat-ip-1 \
  --region=us-central1

gcloud compute addresses create nat-ip-2 \
  --region=us-central1

# Create NAT with specific IPs
gcloud compute routers nats create gke-nat-custom-ip \
  --router=gke-nat-router \
  --region=us-central1 \
  --nat-external-ip-pool=nat-ip-1,nat-ip-2 \
  --nat-all-subnet-ip-ranges \
  --enable-logging

# Configure port allocation for high-traffic workloads
gcloud compute routers nats create gke-nat-optimized \
  --router=gke-nat-router \
  --region=us-central1 \
  --auto-allocate-nat-external-ips \
  --nat-all-subnet-ip-ranges \
  --min-ports-per-vm=1024 \
  --max-ports-per-vm=65536 \
  --tcp-time-wait-timeout=120 \
  --udp-idle-timeout=60 \
  --icmp-idle-timeout=60 \
  --log-config=ENABLED \
  --log-filter=ERRORS_ONLY

# Create monitoring dashboard
gcloud monitoring dashboards create --config='
{
  "displayName": "Cloud NAT Dashboard",
  "gridLayout": {
    "widgets": [
      {
        "title": "NAT Gateway Bytes",
        "xyChart": {
          "dataSets": [{
            "timeSeriesQuery": {
              "timeSeriesFilter": {
                "filter": "metric.type=\"compute.googleapis.com/nat/bytes_sent\""
              }
            }
          }]
        }
      },
      {
        "title": "NAT Gateway Packets",
        "xyChart": {
          "dataSets": [{
            "timeSeriesQuery": {
              "timeSeriesFilter": {
                "filter": "metric.type=\"compute.googleapis.com/nat/packets_sent\""
              }
            }
          }]
        }
      }
    ]
  }
}'

# Set up alerting for high traffic
gcloud alpha monitoring policies create --config='
{
  "displayName": "Cloud NAT High Egress",
  "conditions": [
    {
      "displayName": "Egress bytes > 100GB/hour",
      "conditionThreshold": {
        "filter": "metric.type=\"compute.googleapis.com/nat/bytes_sent\"",
        "comparison": "COMPARISON_GT",
        "thresholdValue": 100000000000,
        "duration": "300s"
      }
    }
  ],
  "notificationChannels": ["projects/PROJECT/notificationChannels/CHANNEL_ID"]
}'

# Analyze NAT usage by subnet
gcloud compute routers nats get-iam-policy gke-nat-config \
  --router=gke-nat-router \
  --region=us-central1

# Enable detailed logging for analysis
gcloud compute routers nats update gke-nat-config \
  --router=gke-nat-router \
  --region=us-central1 \
  --log-config=ENABLED \
  --log-filter=ALL

# Review logs in Cloud Logging
gcloud logging read "resource.type=gce_nat" \
  --limit=50 \
  --format="table(timestamp,jsonPayload)"

# Create public IP for NAT Gateway
az network public-ip create \
  --resource-group my-aks-rg \
  --name nat-gateway-ip \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

# Get public IP ID
PUBLIC_IP_ID=$(az network public-ip show \
  --resource-group my-aks-rg \
  --name nat-gateway-ip \
  --query id \
  --output tsv)

# Create NAT Gateway
az network nat gateway create \
  --resource-group my-aks-rg \
  --name aks-nat-gateway \
  --public-ip-addresses $PUBLIC_IP_ID \
  --idle-timeout 4

# Verify NAT Gateway
az network nat gateway show \
  --resource-group my-aks-rg \
  --name aks-nat-gateway

# Get AKS subnet ID
SUBNET_ID=$(az network vnet subnet show \
  --resource-group my-aks-rg \
  --vnet-name aks-vnet \
  --name aks-subnet \
  --query id \
  --output tsv)

# Associate NAT Gateway with subnet
az network vnet subnet update \
  --resource-group my-aks-rg \
  --vnet-name aks-vnet \
  --name aks-subnet \
  --nat-gateway aks-nat-gateway

# Verify association
az network vnet subnet show \
  --resource-group my-aks-rg \
  --vnet-name aks-vnet \
  --name aks-subnet \
  --query natGateway

# Create Azure Firewall
az network firewall create \
  --resource-group my-aks-rg \
  --name aks-firewall \
  --sku AZFW_Hub

# Create public IP for Firewall
az network public-ip create \
  --resource-group my-aks-rg \
  --name firewall-ip \
  --sku Standard

# Associate IP with Firewall
az network firewall update \
  --name aks-firewall \
  --resource-group my-aks-rg \
  --public-ip firewall-ip

# Create firewall policy
az network firewall policy create \
  --resource-group my-aks-rg \
  --name aks-firewall-policy

# Add application rules (L7 filtering)
az network firewall policy rule-collection-group collection add-filter \
  --resource-group my-aks-rg \
  --policy-name aks-firewall-policy \
  --collection-group-name DefaultCollectionGroup \
  --collection-name AppRules \
  --priority 100 \
  --rule-type ApplicationRule \
  --action Allow \
  --rules web-access \
  --protocols Https=443 Http=80 \
  --source-addresses '*' \
  --target-fqdns '*.api.github.com' '*.docker.io' 'packages.microsoft.com'

# Associate policy with firewall
az network firewall update \
  --name aks-firewall \
  --resource-group my-aks-rg \
  --firewall-policy aks-firewall-policy

# Create AKS cluster with NAT Gateway
az aks create \
  --resource-group my-aks-rg \
  --name my-aks-cluster \
  --node-count 3 \
  --network-plugin azure \
  --vnet-subnet-id $SUBNET_ID \
  --enable-managed-identity

# For existing cluster, update subnet association
az network vnet subnet update \
  --resource-group my-aks-rg \
  --vnet-name aks-vnet \
  --name aks-subnet \
  --nat-gateway aks-nat-gateway

# Enable diagnostic logs
az network nat gateway show \
  --resource-group my-aks-rg \
  --name aks-nat-gateway \
  --query id \
  --output tsv | xargs -I {} az monitor diagnostic-settings create \
    --name nat-gateway-logs \
    --resource {} \
    --workspace /subscriptions/SUB_ID/resourcegroups/DefaultResourceGroup-EUS/providers/microsoft.operationalinsights/workspaces/DefaultWorkspace-SUB_ID-EUS \
    --logs '[{"category": "AllMetrics", "enabled": true}]'

# Create alert for high egress
az monitor metrics alert create \
  --name high-nat-egress \
  --resource-group my-aks-rg \
  --scopes $(az network nat gateway show --resource-group my-aks-rg --name aks-nat-gateway --query id --output tsv) \
  --condition "total BytesOut > 100000000000" \
  --evaluation-interval 5m \
  --window-size 5m \
  --action /subscriptions/SUB_ID/resourceGroups/my-aks-rg/providers/microsoft.insights/actionGroups/alert-action-group

# Analyze NAT Gateway costs
az consumption usage list \
  --start-date $(date -d '30 days ago' +%Y-%m-%d) \
  --end-date $(date +%Y-%m-%d) \
  --query "[?contains(meterDetails,'NAT Gateway')]" \
  --output table

# Review traffic patterns
az monitor metrics list \
  --resource $(az network nat gateway show --resource-group my-aks-rg --name aks-nat-gateway --query id --output tsv) \
  --metric "BytesOut" \
  --interval PT1H \
  --start-time $(date -d '7 days ago' -u +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ)

# AWS: One NAT Gateway per AZ
for az in us-east-1a us-east-1b us-east-1c; do
  aws ec2 create-nat-gateway \
    --subnet-id subnet-public-$az \
    --allocation-id $(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text)
done

# Azure: Zone-redundant NAT Gateway
az network nat gateway create \
  --resource-group my-rg \
  --name nat-gateway \
  --public-ip-addresses $IP_IDS \
  --zone 1 2 3

# Set up alerts for all cloud providers
# AWS
aws cloudwatch put-metric-alarm \
  --alarm-name NAT-HighTraffic \
  --metric-name BytesOutToDestination \
  --namespace AWS/NatGateway \
  --threshold 100000000000 \
  --comparison-operator GreaterThanThreshold

# GCP
gcloud alpha monitoring policies create --config='
{
  "displayName": "Cloud NAT High Egress",
  "conditions": [{
    "conditionThreshold": {
      "filter": "metric.type=\"compute.googleapis.com/nat/bytes_sent\"",
      "comparison": "COMPARISON_GT",
      "thresholdValue": 100000000000
    }
  }]
}'

# Azure
az monitor metrics alert create \
  --name high-nat-egress \
  --condition "total BytesOut > 100000000000"

# AWS: Restrict NAT Gateway access with Security Groups
aws ec2 create-security-group \
  --group-name nat-sg \
  --description "Security group for NAT Gateway"

# GCP: Use firewall rules to control egress
gcloud compute firewall-rules create allow-egress \
  --direction EGRESS \
  --action ALLOW \
  --rules tcp:443,tcp:80 \
  --destination-ranges 0.0.0.0/0

# Azure: Use NSG rules
az network nsg rule create \
  --resource-group my-rg \
  --nsg-name aks-nsg \
  --name AllowEgressHTTPS \
  --direction Outbound \
  --access Allow \
  --protocol Tcp \
  --destination-port-ranges 443