Support IPv4 link-local pod address allocation for egress NAT44 in IPv6-only pod networks
Author: johngmyersCreated Aug 4, 2026Updated Sep 17, 2026
Labelskind/featurekind/cfp
Is your proposed feature related to a problem?
The desire is to reduce the traffic through an external NAT64 device (and thus the transit cost) or, in some cases, remove the need for DNS64/NAT64.
This is a NAT44 alternative to #17878
Describe the feature you'd like
In clusters with IPv6-only pod networks, assign pods an IPv4 address out of 169.254.0.0/16. This address would allow outgoing IPv4 connections, performing NAT44 through one of two possible paths:
- Through Egress Gateway. In this case the originating node could be IPv6-only.
- Through
bpf.masquerade=true. In this case, the originating node would have to be dual-stack.
It would be possible to support a hybrid mode, where egress to public IPv4 destination goes through Egress Gateway and egress to local IPv4 destinations go through bpf.masquerade=true. This complexity would not need to be in an initial implementation.
Notify relevant community channels
@cilium/sig-network
(Optional) Describe your proposed solution
No response
Source: cilium/cilium