What needs to happen
Every gateway node offering egress needs a public address to masquerade tenant traffic to. That address has to be real, routable from the internet, and outside the fabric's own address space, because the internet cannot reach anything inside it.
Nothing allocates one. The value is supplied per node by whoever writes the deployment, and there is no mechanism anywhere that derives, requests, or tracks it.
The lab works around this by pointing at a second loopback address on the node's own fabric router, which is enough to exercise the datapath and proves nothing about how a real deployment gets one.
Desired outcome: decide where these addresses come from, who holds the pool, and how a node ends up knowing its own, before egress is offered outside a lab.
Why this matters
Egress cannot be enabled anywhere real until this is answered. The feature is complete on both sides of the datapath and still undeployable, which is an easy thing to discover late.
The gateway's internal reachability address has the same gap today, but that one is derived from values we already own. This address is an external allocation, so it is the harder of the two to eventually automate rather than the easier.
Status
Stated as a phase one non goal, operator supplied by design. Filed so the deployment blocker is tracked as a blocker rather than a line in a plan.
What needs to happen
Every gateway node offering egress needs a public address to masquerade tenant traffic to. That address has to be real, routable from the internet, and outside the fabric's own address space, because the internet cannot reach anything inside it.
Nothing allocates one. The value is supplied per node by whoever writes the deployment, and there is no mechanism anywhere that derives, requests, or tracks it.
The lab works around this by pointing at a second loopback address on the node's own fabric router, which is enough to exercise the datapath and proves nothing about how a real deployment gets one.
Desired outcome: decide where these addresses come from, who holds the pool, and how a node ends up knowing its own, before egress is offered outside a lab.
Why this matters
Egress cannot be enabled anywhere real until this is answered. The feature is complete on both sides of the datapath and still undeployable, which is an easy thing to discover late.
The gateway's internal reachability address has the same gap today, but that one is derived from values we already own. This address is an external allocation, so it is the harder of the two to eventually automate rather than the easier.
Status
Stated as a phase one non goal, operator supplied by design. Filed so the deployment blocker is tracked as a blocker rather than a line in a plan.