Kubernetes egress control with squid proxy

Summary

Kubernetes Egress Control with Squid proxy ¶ 2025-12-28 This Way to the Egress! — Sign at P.T. Barnum’s Americam Museum Kubernetes ingress gets a lot of attention – Gateway API, Ingress controllers, service meshes – compared with the Egress, mostly ignored until someone asks “what exactly is our cluster talking to?”, or, in even simple deployments, “Can we see what we are talking to?”. This is a (very) simple approach to that, using the venerable Squid proxy and a NetworkPolicy, without reaching for heavier machinery (but beginning to understand why we would). This is the overview of the thing I’m about to describe: Squid as egress proxy in k3s Why do I care ¶ Most Kubernetes tutorials focus on getting traffic into your cluster, which is fair since that’s where it usually starts... but traffic flows both ways, and once your workloads start making outbound calls to APIs, databases, and services beyond your cluster boundary, there’s a discussion on visibility and security to be had. I ran into this while working with OpenShift’s egress policies years ago, in so-called “regulated industries”: while not the most flexible at the time, they were the most straightforward answer to security requirements that defined that outbound traffic should go through a proxy. I’m using Kubernetes through k3s (mostly) and kind (often, for develpment) for my own personal stuff (see Projects), so I went back to basics on this: what if we just used Squid – a proxy that’s been solving this problem since 1996! – and enforced its usage with a NetworkPolicy? Nothing fancy, nothing “next-gen cloud-native” just a proxy with logs, and see where that got me? Squid and k3s: the solution ¶ The architecture is deliberately simple: ┌────────────────────────────────────────────────────────────┐ │ Cluster │ │ │ │ ┌─────────────────────┐ ┌────────────────────────┐ │ │ │ workload namespace │ │ egress-proxy namespace │ │ │ │ │ │ │ │ │ │ ┌─────┐ │ :3128│ ┌───────┐ │ │ │ │ │ pod │ HTTP_PROXY ├──────┼─▶│ squi...