---
title: "LOKI OpenShift on OpenStack egress IP Address per project - Fairbanks"
description: "A couple of weeks ago, we wrote an article about the benefits of LOKI, a combination of Linux, OpenStack, Kubernetes and network infrastructure. This article can be found here: https://www.linkedin.com/feed/update/ When using LOKI, in this case OpenShift (or OKD) on OpenStack you know that OpenShift egress traffic will always use the IP address of the […]"
url: "https://fairbanks-upgrade.ubo-dev.nl/loki-openshift-on-openstack-egress-ip-address-per-project/"
language: "en"
---
Blog
# LOKI OpenShift on OpenStack egress IP Address per project
Technology
April 19, 2022
Author: Elvira Dautović
In this post
[Want to find out if your OpenStack infrastructure can run smoother? Claim your free health check](https://fairbanks-upgrade.ubo-dev.nl/loki-openshift-on-openstack-egress-ip-address-per-project#section-1-1)
Share this post
A couple of weeks ago, we wrote an article about the benefits of LOKI, a combination of Linux, OpenStack, Kubernetes and network infrastructure. This article can be found here: [https://www.linkedin.com/feed/update/](https://www.linkedin.com/feed/update/urn:li:ugcPost:6899649383181148160?updateEntityUrn=urn%3Ali%3Afs%5FupdateV2%3A%28urn%3Ali%3AugcPost%3A6899649383181148160%2CFEED%5FDETAIL%2CEMPTY%2CDEFAULT%2Cfalse%29)
When using LOKI, in this case OpenShift (or OKD) on OpenStack you know that OpenShift egress traffic will always use the IP address of the virtual router. This is not always favorable because it provides you not much control. Systems are mostly configured separately from each other as you don’t want your entry system at the same virtual place as your client data. When you would like to have control of what projects can access other services on your network, we have a solution for you. So here, is a short case study in the form of a blog on how we solve this.
When using LOKI, in this case OpenShift (or OKD) on OpenStack you know that OpenShift egress traffic will always use the IP address of the virtual router. This is not always favorable because it provides you not much control. Systems are mostly configured separately from each other as you don’t want your entry system at the same virtual place as your client data. When you would like to have control of what projects can access other services on your network, we have a solution for you. So here a short case study in the form of a blog on how we solve this.
## Want to find out if your OpenStack infrastructure can run smoother? Claim your free health check
- Improve system performance
- Improve reliability
- Prepare for scale
- Collaborate with a Fairbanks OpenStack expert
A couple of weeks ago, we wrote an article about the benefits of LOKI, a combination of Linux, OpenStack, Kubernetes and network infrastructure. This article can be found here: [https://www.linkedin.com/feed/update/](https://www.linkedin.com/feed/update/urn:li:ugcPost:6899649383181148160?updateEntityUrn=urn%3Ali%3Afs%5FupdateV2%3A%28urn%3Ali%3AugcPost%3A6899649383181148160%2CFEED%5FDETAIL%2CEMPTY%2CDEFAULT%2Cfalse%29)
When using LOKI, in this case OpenShift (or OKD) on OpenStack you know that OpenShift egress traffic will always use the IP address of the virtual router. This is not always favorable because it provides you not much control. Systems are mostly configured separately from each other as you don’t want your entry system at the same virtual place as your client data. When you would like to have control of what projects can access other services on your network, we have a solution for you. So here, is a short case study in the form of a blog on how we solve this.
When using LOKI, in this case OpenShift (or OKD) on OpenStack you know that OpenShift egress traffic will always use the IP address of the virtual router. This is not always favorable because it provides you not much control. Systems are mostly configured separately from each other as you don’t want your entry system at the same virtual place as your client data. When you would like to have control of what projects can access other services on your network, we have a solution for you. So here a short case study in the form of a blog on how we solve this.
In this particular case we have OpenShift running on OpenStack with an external firewall. We want to separate the data from other systems to make sure the data from users are kept safe. Furthermore, we want to remain in control over the infrastructure. We looked if we could achieve this within a LOKI infrastructure; OpenStack in combination with OpenShift and open networking. According to the OpenShift manual this was possible. However, there were a lot of side notes to pay attention to.
One option would be Kuryr, with the downside that every Pod will get its own IP address from OpenStack, causing a lot of overhead. For this reason, we chose another solution.
Our solution starts with the installation of the cluster where it normally installs OVNkubernetes as the standard network type. However, this network type does not support custom egress when using OpenShift on OpenStack. We resolved this by using OpenShiftSDN instead. After some trials and tests, we eventually tried to put it on another network infrastructure layer. This gave mixed results. It was good and bad at the same time. However, we wanted it only to be good, so we kept trying. Lastly, we connected OpenShift’s machine network to the provider network of OpenStack and this gave us a successful result. The first commando to send to the cluster, when the cluster is up and running:
- $ oc patch netnamespace –type=merge -p ‘{“egressIPs”: \[“ip\_address>”\]}’
The second commando is to give the same IP address to a host:
- $ oc patch hostsubnet –type=merge -p ‘{“egressCIDRs”:\[“ip\_address\_range\_1>”, “”\]}’
After this it is important to allow address pairs in OpenStack Neutron. To allow the approval for use of the IP address. So, there you have it; in this we have created a solution that gives you more control of the network within you LOKI OpenStack OpenShift infrastructure. More information on this OpenShift subject can be found here: [https://docs.openshift.com/container-platform/4.9/networking/openshift\_sdn/assigning-egress-ips.html ](https://docs.openshift.com/container-platform/4.9/networking/openshift%5Fsdn/assigning-egress-ips.html)If you have any questions about this solution or LOKI in general; we are happy to have a talk with you.
Curious about whether your current Kubernetes or Openstack infrastructure is performing up to the market standard? Or are you looking for ways to improve your current situation? Request a free scan of your Openstack or Kubernetes infrastructure and receive interesting insights **free of commitment**.
## Want to know more about open source private cloud
Let’s talk with Michiel Manten
[Let's talk](https://fairbanks-upgrade.ubo-dev.nl/contact/?subject=LOKI%20OpenShift%20on%20OpenStack%20egress%20IP%20Address%20per%20project)
Insights & resources
## Latest blogs & news
[Insights & resources](https://fairbanks-upgrade.ubo-dev.nl/insights-resources/)
[KeynoteSustainable private cloud: how to balance energy, performance and business impactSustainable private cloud: how to balance energy, performance and business impactEvent](https://fairbanks-upgrade.ubo-dev.nl/sustainable-private-cloud/)
[BlogOpenStack Hibiscus is here: What’s new in the latest releaseOctober 20, 2026OpenStack Hibiscus is here: What’s new in the latest releaseTechnology](https://fairbanks-upgrade.ubo-dev.nl/openstack-hibiscus-is-here-whats-new-in-the-latest-release/)
[KeynoteHow Kubernetes and Talos make OpenStack easier to upgrade, manage and scaleHow Kubernetes and Talos make OpenStack easier to upgrade, manage and scaleEvent](https://fairbanks-upgrade.ubo-dev.nl/how-kubernetes-and-talos-make-openstack-easier-to-upgrade-manage-and-scale/)
[KeynoteFrom infrastructure complexity to cloud control: how to orchestrate your datacenter with softwareFrom infrastructure complexity to cloud control: how to orchestrate your datacenter with softwareEvent](https://fairbanks-upgrade.ubo-dev.nl/from-infrastructure-complexity-to-cloud-control-how-to-orchestrate-your-datacenter-with-software/)
[BlogDigital autonomy: looking beyond the cloudSeptember 9, 2026Digital autonomy: looking beyond the cloudTechnology](https://fairbanks-upgrade.ubo-dev.nl/digital-autonomy-looking-beyond-the-cloud/)
[BlogUpgrading OpenStack: why containerization and Kubernetes are the answerAugust 26, 2026Upgrading OpenStack: why containerization and Kubernetes are the answerTechnology](https://fairbanks-upgrade.ubo-dev.nl/upgrading-openstack-containerization-kubernetes/)
[BlogCloud infrastructure migration: what are your options and where do you start?July 24, 2026Cloud infrastructure migration: what are your options and where do you start?Technology](https://fairbanks-upgrade.ubo-dev.nl/cloud-infrastructure-migration-what-are-your-options-and-where-do-you-start/)
[BlogFairbanks named as a representative vendor in the 2026 Gartner® Market GuideJuly 21, 2026Fairbanks named as a representative vendor in the 2026 Gartner® Market Guide for cloud infrastructure sovereign solutionsTechnology](https://fairbanks-upgrade.ubo-dev.nl/fairbanks-named-as-a-representative-vendor-in-the-2026-gartner-market-guide-for-cloud-infrastructure-sovereign-solutions/)
[BlogMutable vs. immutable infrastructureJune 18, 2026Mutable vs. immutable infrastructure: What it means for your datacenterTechnology](https://fairbanks-upgrade.ubo-dev.nl/mutable-vs-immutable-infrastructure-what-it-means-for-your-datacenter/)
[BlogPress releaseJune 10, 2026Press releaseEvent](https://fairbanks-upgrade.ubo-dev.nl/press-release/)
Newsletter