Unified Load Balancer Configuration and Administration Guide, Release 2026.02

PDF

Service outbound route (SOR)

Updated: April 23, 2026

Want to summarize with AI?

Log in

Overview

Explains the Service Outbound Route (SOR) feature, including its technical implementation, operational benefits, limitations, and how SOR works within Kubernetes clusters.

The Service Outbound Route (SOR) feature provides a policy-based mechanism to isolate outbound traffic for applications within a Kubernetes cluster. It eliminates the need for manual configuration of static routes by allowing administrators to define custom routing policies using a Custom Resource (CR). The SOR CR is referenced by Load Balancer (LB) CRs for Direct Server Return (DSR) and Egress Management Policy (EMP) CRs for egress traffic.

Benefits of implementing SOR

  • Simplified network configuration: Automates the configuration of outbound routing, reducing manual effort and potential errors.

  • Enhanced security: Isolates outbound traffic, enabling more granular control and security policies.

  • Improved compliance: Facilitates adherence to compliance requirements by ensuring outbound traffic follows defined paths.

  • Resource optimization: Reduces the operational overhead associated with managing static routes.

Limitations and restrictions with SOR

  • Backend application pods must use separate target ports for different applications or interfaces in the respective LB or EMP CRs.

  • This feature is applicable only for LB/EMP CRs that have a target port defined.

  • Currently, SOR is only applicable for UDP traffic.

How the SOR feature works

The SOR feature in the ULB isolates outbound traffic using routing tables and rules. For applications that require outbound traffic isolation, the network administrator creates an SOR CR that specifies the next-hop (gateway IP address) and device (network interface). The load balancer and endpoint custom resources reference this SOR CR to manage routing.

  • Network administrator creates an SOR CR specifying next-hop and device.

  • ULB assigns routing table ID and configures routes.

  • Load balancer and endpoint custom resources reference the SOR CR.

Summary

The main actors and components involved in this process are:

  • Network administrator: Creates and manages SOR CRs for outbound traffic isolation.

  • ULB (Unified Load Balancer): Assigns routing table IDs and configures routes based on SOR CRs.

  • Load balancer and endpoint custom resources: Reference SOR CRs to manage routing for associated pods.

This process ensures that outbound traffic from pods is routed through the specified gateway, enabling controlled and efficient routing for outbound requests.

Workflow

These stages describe how the SOR feature manages outbound traffic routing using SOR CRs and routing tables.

  1. The network administrator creates an SOR CR specifying the next-hop (gateway IP address) and device (network interface).
  2. The ULB assigns a unique routing table ID and configures routes using the specified next-hop and device.
  3. Load balancer and endpoint custom resources reference the SOR CR to manage routing for associated pods.
  4. IP rules are set so that pod traffic uses the corresponding routing table. Updates or deletions of pods trigger changes or removal of these IP rules. Iptables are adjusted for load balancer events.
  5. When a pod generates outbound traffic, the routing table linked to the SOR CR ensures the traffic is sent through the configured gateway.