Direction and boundary
Ingress is traffic that enters a defined system boundary. Egress is traffic that leaves it. The same connection can be egress from one workload and ingress to another. State the boundary before using either term: cluster, namespace, workload, cloud network, application, or organization.
Direction describes topology. It does not prove caller identity, destination identity, intent, or permission. An internal request can be hostile. An external request can be authorized.
Control placement
Ingress controls can select a route, terminate TLS, authenticate a caller, apply request policy, limit exposed methods, and forward to an upstream. Egress controls can restrict destinations, resolve approved names, authenticate the remote service, protect credentials, limit protocols, and record outbound use.
Use layer 3 and layer 4 controls for reachable addresses, ports, and directions. Use layer 7 controls when the decision needs a host, method, path, service identity, user, token audience, or application action. Keep source and destination policy independent where their protection needs differ.
Failure and residual risk
A default backend, alternate listener, direct service address, node port, internal load balancer, or cross-network route can bypass ingress policy. Unrestricted egress can let a compromised workload reach a metadata service, exfiltration endpoint, or unauthorized control API. DNS and proxy rules can disagree about the effective destination.
An egress proxy sees only the traffic sent through it. A workload can bypass it when another route remains. Encrypted traffic hides application context unless policy runs at an endpoint or approved termination point.
Pomerium boundary
Pomerium can act as an identity-aware ingress path for configured application routes. Operators must restrict direct upstream reachability and configure the expected client and upstream transport. Pomerium is not a general egress control for arbitrary workload traffic unless the deployed path explicitly routes that traffic through an applicable Pomerium capability.
Evaluation checklist
- Is the boundary explicit for each use of ingress and egress?
- Can every public, private, node, service, and recovery route be enumerated?
- Which identity and action facts are available at each control point?
- Can a workload reach an external or metadata destination outside approved egress?
- Do direct-origin and alternate-listener tests prove that enforcement cannot be bypassed?
