Kubernetes Egress for AI Agents: NetworkPolicy, Egress Gateways, and AI Gateways Compared
TL;DR: Tetrate Agent Router Enterprise controls outbound agent traffic by model, token, tool, and team, so your NetworkPolicy can close direct paths and the gateway can govern the approved path.
Three tools control Kubernetes egress for AI agents: NetworkPolicy, a service mesh egress gateway, and an AI gateway. NetworkPolicy blocks by IP and port. An AI gateway controls by model, token, tool, and team, and the AI gateway fits AI traffic.
Many clusters start with open outbound access. Any pod can reach any provider endpoint. An agent with a provider key can send prompts to any model, and a compromised pod can send data to any host. Your security team gets a connection log with IP addresses and no model names, no token counts, and no team names.
Tetrate Agent Router Enterprise gives your platform team an AI gateway on the outbound path. NetworkPolicy closes direct paths from agent namespaces. The gateway governs the calls that leave. AI ingress vs. AI egress sets out both directions.
NetworkPolicy Blocks by IP and Port and Cannot See Tokens
NetworkPolicy is a core Kubernetes API. A policy can allow or deny traffic by pod, namespace, IP block, and port. Your CNI plugin enforces the policy.
Provider endpoints move. Model providers publish hostnames, and the IP addresses behind the hostnames change. A policy written with IP blocks needs updates as addresses change. A policy written with broad IP ranges allows more than the provider endpoint.
NetworkPolicy sees packets and connections. NetworkPolicy cannot read a model name inside an HTTPS request. NetworkPolicy cannot count tokens in a streamed answer. NetworkPolicy cannot name the team or agent that sent a call.
Use NetworkPolicy as the wall. Allow agent namespaces to reach the gateway and your cluster services. Deny direct outbound access to provider endpoints. The wall makes the gateway path the available path.
A Service Mesh Egress Gateway Controls Hosts and TLS
A service mesh egress gateway routes outbound traffic through a gateway workload. Istio and other meshes can route by host, apply TLS settings, and log outbound calls. Tetrate has shipped egress gateways in Tetrate Service Bridge for years, and the TSB egress gateway docs show the pattern.
A mesh egress gateway sees the destination host and the TLS connection. The mesh gateway can allow api.openai.com and deny other hosts. The mesh gateway does not parse token usage from a model answer. The mesh gateway does not add provider keys or apply a model list per team.
Use a mesh egress gateway when your control need ends at hosts and protocols. AI traffic needs controls past the host. One host serves many models at many prices, and one host can serve an MCP endpoint with many tools.
An AI Gateway Controls by Model, Token, Tool, and Team
| Option | Controls by | Sees tokens | Keeps provider keys | Cost per team | MCP aware |
|---|---|---|---|---|---|
| NetworkPolicy | Pod, namespace, IP block, and port | No | No | No | No |
| Service mesh egress gateway | Host, port, and TLS settings | No | No | No | No |
| AI gateway | Model, token, tool, team, agent, and project | Yes | Yes | Yes | Yes |
An AI gateway reads the AI request. The gateway sees the model name, the caller key, and the prompt size. The gateway counts input tokens and output tokens as the answer streams back. The gateway records the team, agent, and project on each call.
An AI gateway also governs MCP calls. The gateway can allow one agent to reach a file search tool and deny a payments tool. MCP egress control covers tool allow lists and audit. What is an AI egress gateway? defines the egress gateway role.
Two limits. NetworkPolicy support depends on your CNI plugin, and a cluster with no policy enforcement leaves every path open. An AI gateway governs traffic routed through the gateway. A pod with a provider key and a network path around the gateway can still call a provider directly until you remove the key and close the path.
A Practical Setup Uses All Three Layers With Clear Jobs
NetworkPolicy closes direct outbound paths from agent namespaces. Your mesh or ingress setup handles service traffic you already govern. The AI gateway receives outbound model and MCP calls and applies model, token, tool, and team policy.
Give each agent a gateway key. Store provider credentials at the gateway. Set a token limit per team and per agent. Export gateway records to your observability stack, so alerts name the agent that caused a cost spike. Gateway API egress and GEP-4488 explains the current standards gap for egress in Gateway API.
Agent Router Enterprise runs the AI gateway data plane in your cluster. Your team sets projects, keys, budgets, and MCP policy from one management plane. The AI gateway performance benchmarks publish overhead and method. The AI gateway glossary defines the terms in this comparison.
Agent Router Enterprise
Tetrate Agent Router Enterprise routes AI agent traffic across providers and your own models, with policy, cost controls, and audit on every request — in cloud, on-prem, or edge.
AI gateway vs. API gateway explains how AI controls differ from web API controls. Tetrate co-created the open source data plane project, and who created Envoy AI Gateway covers the project history. Teams in an active evaluation can compare options in best enterprise AI gateway.
Availability and How to Get Started
Tetrate Agent Router Enterprise is available now for outbound agent traffic on Kubernetes. Start with the docs on stop runaway workloads and govern MCP server access. Book a demo to test the gateway with your own namespaces and policies.
Frequently Asked Questions
What Controls Kubernetes Egress for AI Agents?
NetworkPolicy, service mesh egress gateways, and AI gateways control Kubernetes egress. NetworkPolicy blocks by IP and port. A mesh egress gateway controls hosts and TLS. An AI gateway controls by model, token, tool, and team.
Can NetworkPolicy Limit LLM Spend?
No. NetworkPolicy sees connections and bytes. NetworkPolicy cannot count tokens, name a model, or stop a caller at a token limit.
Does an AI Gateway Replace NetworkPolicy?
No. NetworkPolicy closes direct outbound paths from agent namespaces. The AI gateway governs calls on the approved outbound path. The two controls work together.
What Does a Service Mesh Egress Gateway Add?
A service mesh egress gateway routes outbound traffic through a gateway workload and controls hosts, ports, and TLS settings. A mesh egress gateway does not count tokens or manage provider keys.
Can an AI Gateway Control MCP Tool Calls?
Yes. An AI gateway can allow or deny MCP servers and tools per agent, apply authentication, and record each tool call for audit.
How Does Finance Get Cost per Team From Kubernetes Egress?
An AI gateway records tokens per team, agent, and project on each outbound call. Finance can use gateway records to split the provider invoice by team.
Sources
Related: Ingress and egress architecture, on ingress and egress components in Kubernetes.
