What is the issue with the following egress gateway manifest specification?

Technical explanation

The manifest specifies both interface: net1 and egressIP: 10.3.4.5 in the same egressGateway configuration. These properties are mutually exclusive. Cilium ignores an Egress Gateway policy containing both, so A correctly identifies the defect.

When interface is supplied, Cilium uses the selected interface and chooses its first suitable IPv4 and IPv6 addresses as the SNAT addresses. When egressIP is supplied, that address must already be assigned to a network device on the chosen gateway node; Cilium determines the corresponding interface through a route lookup. Administrators may also omit both fields, causing Cilium to select the default-route interface and its addresses.

Option B is incorrect because matchLabels can contain multiple label key-value pairs, as the exhibit does with app: blog and component: backend . Option C is false because the egress address need not be publicly routable; private addresses are valid when routing and upstream network design support them. Option D is false because Cilium does not restrict gateway interfaces to names beginning with eth .

Official references

Cilium Egress Gateway

Study Guide topic: Egress Gateway node selection, interface selection, and SNAT addresses.